joyce8/EMBER2024-capa huggingface dataset:
Function at 0x930e8
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x70
mov eax, dword [rcx + 0x58]
mov ebx, 0x40
mov rbp, rdx
and eax, 0x3f
mov esi, ebx
mov rdi, rcx
sub esi, eax
cmp esi, 8
ja 0x93116
add esi, ebx
lea ecx, [rsi - 8]
xor r12d, r12d
lea rax, [rsp + 0x20]
cmp ecx, 8
jb 0x93141
mov edx, ecx
shr rdx, 3
nop word [rax + rax]
mov qword [rax], r12
add rax, 8
add ecx, 0xfffffff8
sub rdx, 1
jne 0x93131
test ecx, ecx
je 0x93150
mov byte [rax], r12b
inc rax
add ecx, 0xffffffff
jne 0x93145
mov edx, dword [rdi + 0x58]
mov eax, dword [rdi + 0x54]
mov r8d, 2
mov ecx, edx
shl eax, 3
mov byte [rsp + 0x20], pe_nt_image_headers64
shr ecx, 0x1d
or ecx, eax
lea eax, [rdx*8]
lea rdx, [rsp + 0x90]
mov dword [rsp + 0x90], ecx
lea rcx, [rsp + rsi + 0x18]
mov dword [rsp + 0x94], eax
call fcn.00093220
lea rdx, [rsp + 0x20]
mov r8d, esi
mov rcx, rdi
call fcn.00092fb0
lea rdx, [rdi + 0x40]
mov r8d, 5
mov rcx, rbp
call fcn.00093220
mov rax, rdi
mov ecx, 8
nop dword [rax + rax]
mov qword [rax], r12
add rax, 8
add ebx, 0xfffffff8
sub rcx, 1
jne 0x931c0
test ebx, ebx
je 0x931df
mov byte [rax], r12b
inc rax
add ebx, 0xffffffff
jne 0x931d4
lea r11, [rsp + 0x70]
mov dword [rdi + 0x54], r12d
mov dword [rdi + 0x58], r12d
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov dword [rdi + 0x40], 0x67452301
mov dword [rdi + 0x44], 0xefcdab89
mov dword [rdi + 0x48], 0x98badcfe
mov dword [rdi + 0x4c], 0x10325476
mov dword [rdi + 0x50], 0xc3d2e1f0
mov rsp, r11
pop r12
pop rdi
pop rsi
ret

Function at 0x93244
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x20], eax
mov dword [rcx + 0x24], eax
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
ret
Function at 0x93e6c
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x0001c170]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov esi, dword [rcx + 0x24]
mov edi, 0x40
mov rbp, rdx
mov eax, esi
mov rbx, rcx
and eax, 0x3f
sub edi, eax
cmp edi, 8
ja 0x93eaa
add edi, 0x40
lea r8d, [rdi - 8]
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.00011100
mov edx, dword [rbx + 0x20]
mov eax, esi
shr eax, 0x1d
shl edx, 3
lea rcx, [rsp + rdi + 0x28]
or edx, eax
lea eax, [rsi*8]
mov r8d, 2
mov dword [rsp + 0x20], edx
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x30], pe_nt_image_headers64
mov dword [rsp + 0x24], eax
call fcn.00093220
lea rdx, [rsp + 0x30]
mov r8d, edi
mov rcx, rbx
call fcn.00093d30
mov r8d, 8
mov rdx, rbx
mov rcx, rbp
call fcn.00093220
xor eax, eax
lea rdi, [rbx + 0x28]
mov ecx, 0x40
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov dword [rbx + 0x20], eax
mov dword [rbx + 0x24], eax
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.000110ac
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret

Function at 0x93f80
Capabilities:
Hash data using sha384

Disassembly:
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x10], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x18], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x20], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x28], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x30], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x38], rax
xor eax, eax
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x48], rax
ret

Function at 0x93ffc
Capabilities:
Hash data using sha512

Disassembly:
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
xor eax, eax
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x48], rax
ret
Function at 0x94e44
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x0001c170]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov eax, dword [rcx + 0x48]
mov ebx, pe_nt_image_headers64
mov rsi, rdx
and eax, 0x7f
mov rdi, rcx
sub ebx, eax
cmp ebx, 0x10
ja 0x94e83
sub ebx, 0xffffff80
lea r8d, [rbx - 0x10]
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.00011100
mov rdx, qword [rdi + 0x48]
mov rax, qword [rdi + 0x40]
shl rax, 3
mov rcx, rdx
mov byte [rsp + 0x30], pe_nt_image_headers64
shr rcx, 0x3d
or rcx, rax
lea rax, [rdx*8]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov eax, ebx
mov qword [rsp + 0x20], rcx
sub rax, rdx
lea rcx, [rsp + 0x20]
mov edx, 2
lea r8, [rsp + rax + 0x20]
nop word [rax + rax]
mov rax, qword [rcx]
add rcx, 8
sub rdx, 1
bswap rax
mov qword [r8 + rcx - 8], rax
jne 0x94ede
lea rdx, [rsp + 0x30]
mov r8d, ebx
mov rcx, rdi
call fcn.00094d38
mov rdx, rdi
sub rsi, rdi
mov ecx, 8
mov rax, qword [rdx]
add rdx, 8
sub rcx, 1
bswap rax
mov qword [rsi + rdx - 8], rax
jne 0x94f0e
movabs rax, 0x6a09e667f3bcc908
mov ecx, pe_nt_image_headers64
mov qword [rdi], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rdi + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rdi + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rdi + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rdi + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rdi + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rdi + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rdi + 0x38], rax
xor eax, eax
add rdi, 0x50
mov qword [rdi - 0x10], rax
mov qword [rdi - 8], rax
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.000110ac
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x94fcc
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x0001c170]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov eax, dword [rcx + 0x48]
mov ebx, pe_nt_image_headers64
mov rsi, rdx
and eax, 0x7f
mov rdi, rcx
sub ebx, eax
cmp ebx, 0x10
ja 0x9500b
sub ebx, 0xffffff80
lea r8d, [rbx - 0x10]
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.00011100
mov rdx, qword [rdi + 0x48]
mov rax, qword [rdi + 0x40]
shl rax, 3
mov rcx, rdx
mov byte [rsp + 0x30], pe_nt_image_headers64
shr rcx, 0x3d
or rcx, rax
lea rax, [rdx*8]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov eax, ebx
mov qword [rsp + 0x20], rcx
sub rax, rdx
lea rcx, [rsp + 0x20]
mov edx, 2
lea r8, [rsp + rax + 0x20]
nop word [rax + rax]
mov rax, qword [rcx]
add rcx, 8
sub rdx, 1
bswap rax
mov qword [r8 + rcx - 8], rax
jne 0x95066
lea rdx, [rsp + 0x30]
mov r8d, ebx
mov rcx, rdi
call fcn.00094d38
mov rdx, rdi
sub rsi, rdi
mov ecx, 6
mov rax, qword [rdx]
add rdx, 8
sub rcx, 1
bswap rax
mov qword [rsi + rdx - 8], rax
jne 0x95096
movabs rax, 0x6a09e667f3bcc908
mov ecx, pe_nt_image_headers64
mov qword [rdi], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rdi + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rdi + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rdi + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rdi + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rdi + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rdi + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rdi + 0x38], rax
xor eax, eax
add rdi, 0x50
mov qword [rdi - 0x10], rax
mov qword [rdi - 8], rax
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.000110ac
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x3cd82f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
adc r9w, 0x7d6f
mov qword [rsp + 0x10], rdi
stc
bswap r10d
movzx r10d, r11w
xor edi, edi
movzx ebx, r8b
inc r9w
mov r11b, bl
mov r11, rcx
bswap r8
mov r8, rdi
bswap r10d
movsx r9, r8w
nop
movzx r9d, byte [r11]
not r10b
mov r10b, 0xc2
movzx r10, bx
movzx r10d, byte [rdx]
jmp 0x3cd87c
inc r11
jmp 0x3cd884
inc rdx
test bl, bl
jmp 0x3cd88e
je 0x3cd8b7
mov ecx, r8d
mov eax, 0x5c1503d9
jmp 0x3cd8a2
rol eax, cl
test r14d, r15d
stc
clc
add al, r8b
jmp 0x3cd8b1
xor r9b, al
inc r8
test r9b, r9b
jmp 0x3cd8bf
je 0x3cd8d3
cmp r9b, r10b
jmp 0x3cd8cd
je 0x3cd865
cmp r9b, r10b
jmp 0x3cd8db
jae 0x3cd905
or eax, 0xffffffff
movsx ebx, r9w
bswap di
mov rbx, qword [rsp + 8]
mov rdi, 0x1191340b
mov dil, r15b
mov rdi, qword [rsp + 0x10]
jmp 0x3cd904
ret
mov rbx, qword [rsp + 8]
jmp 0x3cd90f
seta dil
mov al, 0x45
setno al
mov eax, edi
mov rdi, qword [rsp + 0x10]
jmp 0x3cd924
ret

Function at 0x140004000
Capabilities:
Encode data using xor

Disassembly:
xor rcx, rcx
sub rcx, 0xffffffffffffffac
lea rax, [entry0]
movabs rbx, 0xfc64431d7e8ac44e
xor qword [rax + 0x27], rbx
sub rax, 0xfffffffffffffff8
loop 0x14000401b
invalid
Function at 0x1400756a3
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14010a330
mov rax, rcx
neg rcx
test rax, 7
je 0x14010a34d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x14010a3a8
test al, 7
jne 0x14010a340
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x14010a361
mov rdx, qword [rax - 8]
test dl, dl
je 0x14010a3d2
test dh, dh
je 0x14010a3cc
shr rdx, 0x10
test dl, dl
je 0x14010a3c6
test dh, dh
je 0x14010a3c0
shr rdx, 0x10
test dl, dl
je 0x14010a3ba
test dh, dh
je 0x14010a3b4
shr edx, 0x10
test dl, dl
je 0x14010a3ae
test dh, dh
jne 0x14010a361
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x140075a04
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140095390
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140094d10
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400953cf
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1401af020]
jmp 0x1400953d9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x140075b5d
Capabilities:
Query environment variable

Disassembly:
jmp 0x140123320
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140123150
lea rcx, [rsp + 0x40]
call fcn.1401232d0
movzx eax, al
test eax, eax
jne 0x140123368
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.140123180
mov rax, qword [rsp + 0x70]
jmp 0x140123539
lea rcx, [rsp + 0x40]
call fcn.1401232a0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140123240
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.1401232a0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.1400765f8
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x14012340e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.140123180
mov rax, qword [rsp + 0x80]
jmp 0x140123539
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.1400758f6
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400757c0
lea rcx, [rsp + 0x48]
call fcn.140075464
movzx eax, al
test eax, eax
jne 0x140123475
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.1400747d0
lea rcx, [rsp + 0x40]
call fcn.140123180
mov rax, qword [rsp + 0x88]
jmp 0x140123539
lea rcx, [rsp + 0x48]
call fcn.140075e37
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.1401232a0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.1400765f8
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x14012350b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.1400747d0
lea rcx, [rsp + 0x40]
call fcn.140123180
mov rax, qword [rsp + 0xa0]
jmp 0x140123539
lea rcx, [rsp + 0x48]
call fcn.140075798
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.1400747d0
lea rcx, [rsp + 0x40]
call fcn.140123180
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret

Function at 0x140075b67
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1400952c0
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.140094c90
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140095301
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1401af020]
jmp 0x140095307
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret
Function at 0x140075bf3
Capabilities:
Get geographical location

Disassembly:
jmp 0x140130e70
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.14012fda0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140130ed7
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x1401af030]
jmp 0x140130ef9
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.140075405
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x140075c02
Capabilities:
Terminate process

Disassembly:
jmp 0x14007e780
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140075de2
Capabilities:
Print debug messages

Disassembly:
jmp 0x140141ce0
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x14019e130]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x140141d06
jmp 0x140141d83
mov rcx, qword [rbp + 0x30]
call fcn.1400756a3
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x140141d1f
jmp 0x140141d83
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x140141d3c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140074929
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.140074cf3
test eax, eax
jne 0x140141d83
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.140075883
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x140076021
Capabilities:
Create process on windows

Disassembly:
jmp 0x14013c990
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x128
lea rcx, [rsp + 0xe8]
call fcn.1400752ed
lea rcx, [rsp + 0xb8]
call fcn.1400752ed
lea rcx, [rsp + 0x88]
call fcn.1400752ed
call fcn.140075b08
mov r8d, eax
lea rdx, [rsp + 0xe8]
mov rcx, qword [rsp + 0x130]
call fcn.1400750fe
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x14013ca32
mov dword [rsp + 0x54], 0
lea rcx, [rsp + 0x88]
call fcn.1400755d6
lea rcx, [rsp + 0xb8]
call fcn.1400755d6
lea rcx, [rsp + 0xe8]
call fcn.1400755d6
mov eax, dword [rsp + 0x54]
jmp 0x14013cbd8
call fcn.140075b08
mov r8d, eax
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0x138]
call fcn.1400750fe
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
je 0x14013ca92
mov dword [rsp + 0x5c], 0
lea rcx, [rsp + 0x88]
call fcn.1400755d6
lea rcx, [rsp + 0xb8]
call fcn.1400755d6
lea rcx, [rsp + 0xe8]
call fcn.1400755d6
mov eax, dword [rsp + 0x5c]
jmp 0x14013cbd8
mov qword [rsp + 0x70], 0
cmp qword [rsp + 0x168], 0
je 0x14013cb18
call fcn.140075b08
mov r8d, eax
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x168]
call fcn.1400750fe
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x14013cb06
mov dword [rsp + 0x64], 0
lea rcx, [rsp + 0x88]
call fcn.1400755d6
lea rcx, [rsp + 0xb8]
call fcn.1400755d6
lea rcx, [rsp + 0xe8]
call fcn.1400755d6
mov eax, dword [rsp + 0x64]
jmp 0x14013cbd8
lea rcx, [rsp + 0x88]
call fcn.140075275
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0xb8]
call fcn.140075275
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0xe8]
call fcn.140075275
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x158]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x150]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x148]
mov r8, qword [rsp + 0x140]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rsp + 0x68], eax
lea rcx, [rsp + 0x88]
call fcn.1400755d6
lea rcx, [rsp + 0xb8]
call fcn.1400755d6
lea rcx, [rsp + 0xe8]
call fcn.1400755d6
mov eax, dword [rsp + 0x68]
add rsp, 0x128
ret
Function at 0x140076283
Capabilities:
Parse pe header

Disassembly:
jmp 0x14007c490
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14007c4b0
xor al, al
jmp 0x14007c531
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14007c4c3
xor al, al
jmp 0x14007c531
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14007c4ed
xor al, al
jmp 0x14007c531
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14007c501
xor al, al
jmp 0x14007c531
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14007c513
xor al, al
jmp 0x14007c531
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14007c52f
xor al, al
jmp 0x14007c531
mov al, 1
add rsp, 0x38
ret

Function at 0x140076788
Capabilities:
Terminate process

Disassembly:
jmp 0x14010ad20
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14010ad4e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.140076ec2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140076f26
Capabilities:
Print debug messages

Disassembly:
jmp 0x14011a2e0
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x140076fd0
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x140095400
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140094d50
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140095449
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1401af020]
jmp 0x140095458
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x14007707a
Capabilities:
Set environment variable

Disassembly:
jmp 0x140143f20
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.1400752ed
lea rcx, [rsp + 0x48]
call fcn.1400752ed
call fcn.140075b08
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.1400750fe
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x140143f8f
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.1400755d6
lea rcx, [rsp + 0x78]
call fcn.1400755d6
mov eax, dword [rsp + 0x24]
jmp 0x140144020
call fcn.140075b08
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.1400750fe
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x140143fd6
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.1400755d6
lea rcx, [rsp + 0x78]
call fcn.1400755d6
mov eax, dword [rsp + 0x2c]
jmp 0x140144020
lea rcx, [rsp + 0x48]
call fcn.140075275
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.140075275
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.1400755d6
lea rcx, [rsp + 0x78]
call fcn.1400755d6
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret