joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180065bc8
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.18005c9b0
xor ebx, ebx
mov rdi, rax
cmp qword [0x18008ecf0], rbx
jne 0x180065cce
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x180065da3
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180065da3
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x18008ecf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x18008ecf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x18008ed00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x18008ed10], rax
test rax, rax
je 0x180065cc5
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x18008ed08], rax
jmp 0x180065cd5
mov rax, qword [0x18008ed08]
jmp 0x180065cdc
mov rax, qword [0x18008ed08]
mov r11, qword [0x18008ed10]
cmp rax, rdi
je 0x180065d44
cmp r11, rdi
je 0x180065d44
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x18008ed10]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x180065d44
test rax, rax
je 0x180065d44
call rsi
test rax, rax
je 0x180065d3e
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x180065d3e
test byte [rsp + 0x38], 1
jne 0x180065d44
bts ebp, 0x15
jmp 0x180065d82
mov rcx, qword [0x18008ecf8]
cmp rcx, rdi
je 0x180065d82
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x180065d82
call rax
mov rbx, rax
test rax, rax
je 0x180065d82
mov rcx, qword [0x18008ed00]
cmp rcx, rdi
je 0x180065d82
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x180065d82
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x18008ecf0]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x180065da3
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x180065da5
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140003ad0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140003b04
cmp word [rcx], 0x5a4d
jne 0x140003b04
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140003b04
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003b04
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140003a10
test eax, eax
jne 0x140003b20
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140003a80
test rax, rax
je 0x140003b15
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.1400042cc
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x1400041d0
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140004170
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140004634
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x140560318]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x140560314]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x140004682
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14000467a
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140004769
inc ebx
add rax, 0x28
jmp 0x14000465a
mov rcx, r12
call fcn.140004e61
mov rbp, rax
test rax, rax
jne 0x1400046a1
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.1400045d0
movsxd rbx, ebx
mov rax, qword [0x140560318]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.140004f0f
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x140560318]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140004703
mov rax, qword [0x140560318]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400045d0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140004763
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140004763
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x140560318]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140004763
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400045d0
inc dword [0x140560314]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140004b90
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x140560380]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140560360]
test rbx, rbx
je 0x140004bdc
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140004bd6
test eax, eax
jne 0x140004bd6
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x140004bae
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140004d90
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140004db3
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140004db3
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140004db4
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x140004dee
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x140004de5
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140004df0
inc r8d
add rax, 0x28
jmp 0x140004dcc
xor eax, eax
ret

Function at 0x140004e61
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x14055c4b0]
mov r8, rcx
mov rcx, r9
call fcn.140004d90
test eax, eax
je 0x140004e8d
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140004db4
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400013f1
Capabilities:
Enumerate files on windows
Get common file path
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x278
call fcn.1400010e6
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x14000145a
lea rax, [rsp + 0x170]
mov qword [rsp + 0x20], rax
xor ecx, ecx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
je 0x140001462
lea rcx, [0x1400847e0]
lea rdx, str.Error_getting_Desktop_folder_path.
call fcn.1400015a8
mov rcx, rax
call fcn.1400017b2
mov eax, 1
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r14
ret
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, str..
lea rsi, [rsp + 0x170]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
je 0x1400014f2
mov rdi, rax
xor esi, esi
lea rbx, [rsp + 0x30]
mov r14, qword [sym.imp.KERNEL32.dll_FindNextFileA]
mov eax, dword [rsp + 0x30]
and eax, 0x10
cmp eax, 1
adc esi, 0
mov rcx, rdi
mov rdx, rbx
call r14
test eax, eax
jne 0x14000149f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [0x140084910]
lea rdx, str.Number_of_files_in_the_Desktop_folder:
call fcn.1400015a8
mov rcx, rax
mov edx, esi
call fcn.1400017e6
mov rcx, rax
call fcn.1400017b2
test esi, esi
jne 0x1400014f2
xor ecx, ecx
call fcn.14000de80
lea rsi, [0x140084910]
lea rdx, str.___Executing_NtAllocateVirtualMemory...
mov rcx, rsi
call fcn.1400015a8
mov rcx, rax
call fcn.1400017b2
mov rcx, 0xffffffffffffffff
call fcn.1400012b5
mov rdi, rax
lea rdx, str._t___Allocated_at:_0x
mov rcx, rsi
call fcn.1400015a8
mov rcx, rax
mov rdx, rdi
call fcn.140001974
mov rcx, rax
call fcn.1400017b2
lea rbx, [rsp + 0x2c]
and dword [rbx], 0
lea rdx, str.___Executing_NtWriteVirtualMemory...
mov rcx, rsi
call fcn.1400015a8
mov rcx, rax
call fcn.1400017b2
mov rcx, 0xffffffffffffffff
mov rdx, rdi
mov r8, rbx
call fcn.140001317
lea rdx, str.___Executing_NtCreateThreadEx...
mov rcx, rsi
call fcn.1400015a8
mov rcx, rax
call fcn.1400017b2
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8, rdi
call fcn.14000138d
lea rcx, str.pause
call fcn.14000de8c
int3

Function at 0x140005980
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400059ca
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400059ca
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400059ca
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400059ca
cmp dword [rcx + 0x84], 0xe
jbe 0x1400059ca
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400059cc
xor al, al
add rsp, 0x28
ret
Function at 0x1400217f8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140028f10
sub rsp, rax
mov rax, qword [0x140083818]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14001a47c
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x140021847
mov rax, rbp
jmp 0x14002194f
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x853b0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.140022918
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x853b0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x14002194b
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14002194b
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.140022918
test rax, rax
js 0x14002194b
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x14002194b
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x14002193d
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x14002193d
cmp byte [rcx], 0xd
jne 0x140021923
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x140021932
cmp byte [rcx + 1], 0xa
jne 0x140021932
inc rcx
jmp 0x140021932
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x84160]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x140021905
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x14002194f
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140028ee0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x140021b70
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140021b86
mov al, 1
jmp 0x140021be6
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140021b97
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140021be4
mov ecx, dword [rcx + 0x18]
nop
call fcn.14001d870
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140021be4
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140021be4
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140021be4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140021be6
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140021cb8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x1400853b0]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x140021d0f
cmp word [rdx], r13w
jne 0x140021d0f
or byte [rax + rdi*8 + 0x38], cl
jmp 0x140021d14
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x140021e39
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x140021e5a
lea r9, [rdx + 2]
cmp cx, r11w
je 0x140021d4d
mov rdx, r9
mov word [rbx], cx
jmp 0x140021d74
cmp r9, r8
jae 0x140021d84
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x140021d2e
jmp 0x140021e39
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140021e2e
cmp dword [rsp + 0x80], esi
je 0x140021e2e
lea r8, [0x1400853b0]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x140021e06
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x140021dd6
mov word [rbx], r13w
jmp 0x140021e36
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x140021de3
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x140021e36
cmp word [rsp + 0x70], r13w
jne 0x140021e13
cmp rbx, r14
je 0x140021dd0
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.140022920
cmp word [rsp + 0x70], r13w
je 0x140021e39
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1400853b0]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x140021e33
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x140021e39
Function at 0x140016894
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
cmp dword [0x1400200e8], 0
mov r14, rdx
mov r15, rcx
lea rbx, [0x1400200f8]
jne 0x1400168e1
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, rbx
mov dword [0x140020120], eax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x1400200e8], 1
mov ecx, dword [0x140020120]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbp, rax
test rax, rax
jne 0x1400169b6
mov rcx, qword [0x14001f41c]
lea edx, [rax + 8]
lea r8d, [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x1400169e1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x1400200f0]
test rax, rax
je 0x140016931
mov qword [rax], rbp
mov rcx, rbx
mov qword [rbp + 8], rax
mov qword [0x1400200f0], rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
lea r9, [rbp + 0x20]
mov r8, rdi
mov rcx, rax
mov rdx, rbx
mov dword [rsp + 0x20], 0x100000
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp + 0x18]
lea r8, [0x1400169fc]
mov r9, rbp
mov dword [rsp + 0x28], 8
or dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
mov ecx, dword [0x140020120]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [0x14001f41c]
xor edx, edx
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x1400169e1
mov qword [rax + 8], r15
mov qword [rax + 0x10], r14
mov rcx, qword [rbp + 0x10]
mov qword [rax], rcx
mov qword [rbp + 0x10], rax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret

Function at 0x14073c12c
Capabilities:
Encode data using xor

Disassembly:
lea rsp, [rsp + 0x18]
je 0x14073c181
mov eax, 0xd5017690
neg eax
lea r9, [rax*2 - 0x24e469e8]
lea r9, [0x14074b140]
movzx eax, byte [r11]
push 0xffffffffb1024632
xor eax, r8d
and eax, 0xff
mov eax, dword [r9 + rax*4]
shr r8d, 8
xor r8d, eax
inc r11
xor r8d, 0x2223b80c
dec rdi
lea rsp, [rsp + 8]
jne 0x14073c14d
call fcn.140752f59

Function at 0x140765039
Capabilities:
Encode data using xor

Disassembly:
add r9, 4
xor ebx, r11d
dec ebx
mov qword [rsp], 0xffffffffd7be16ac
mov dword [rsp + 4], 0x2c292b
not ebx
call fcn.14074d2be
Function at 0x140002e70
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14002b008]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea r11, [0x140026250]
mov byte [rdx], 0
mov r10, r11
lea rbp, [0x140026240]
xor r9d, r9d
mov rbx, rdx
neg r10
mov rdi, rcx
movabs rsi, 0xcccccccccccccccd
nop word [rax + rax]
mov rcx, r9
lea r8, [r11 + 1]
add r8, r9
mov rax, rsi
mul r9
shr rdx, 3
lea rax, [rdx + rdx*4]
add rax, rax
sub rcx, rax
movzx eax, byte [rcx + rbp]
lea rcx, [r10 + r8]
xor al, byte [r9 + r11]
mov byte [rsp + r9 + 0x30], al
mov rax, rsi
mul rcx
mov rcx, r9
shr rdx, 3
lea rax, [rdx + rdx*4]
add rax, rax
sub rcx, rax
movzx eax, byte [rcx + rbp + 1]
xor al, byte [r8]
lea r8, [r11 + 2]
mov byte [rsp + r9 + 0x31], al
add r8, r9
mov rax, rsi
lea rcx, [r10 + r8]
mul rcx
mov rcx, r9
shr rdx, 3
lea rax, [rdx + rdx*4]
add rax, rax
sub rcx, rax
movzx eax, byte [rcx + rbp + 2]
xor al, byte [r8]
mov byte [rsp + r9 + 0x32], al
add r9, 3
cmp r9, 0x15
jb 0x140002ec0
mov r8d, 0x15
mov byte [rsp + 0x45], 0
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14000dbe8
test eax, eax
jne 0x140002fa5
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
dec rbx
nop dword [rax]
cmp byte [rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x140002f80
xor ecx, ecx
nop dword [rax]
movzx eax, byte [rdi + rcx + 0x14]
mov byte [rbx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140002f90
jmp 0x1400030be
mov r8d, 4
mov dword [rsp + 0x20], 0x5c3f3f5c
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x24], 0
mov rcx, rdi
call fcn.14000dbe8
test eax, eax
jne 0x140002fe3
add rdi, 4
sub rbx, rdi
movzx eax, byte [rdi]
mov byte [rbx + rdi], al
lea rdi, [rdi + 1]
test al, al
jne 0x140002fd0
jmp 0x1400030be
cmp byte [rdi], 0x5c
jne 0x140003014
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
sub rbx, rdi
nop dword [rax]
movzx eax, byte [rdi]
mov byte [rbx + rdi + 2], al
lea rdi, [rdi + 1]
test al, al
jne 0x140003000
jmp 0x1400030be
mov edx, 0x5c
mov rcx, rdi
call fcn.14000bf04
test rax, rax
jne 0x1400030a1
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rcx, [rbx - 1]
mov dword [rsp + 0x20], 0x6972645c
mov dword [rsp + 0x24], 0x73726576
mov word [rsp + 0x28], 0x5c
nop
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140003050
lea r8, [rsp + 0x20]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140003070
dec rbx
cmp byte [rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x140003083
xor ecx, ecx
nop
movzx eax, byte [rdi + rcx]
mov byte [rbx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140003090
jmp 0x1400030be
sub rbx, rdi
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdi]
mov byte [rbx + rdi], al
lea rdi, [rdi + 1]
test al, al
jne 0x1400030b0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140009740
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140003440
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r14
push r15
mov r11, rdx
mov edi, 1
mov esi, 2
mov r14d, 3
mov r15d, 4
mov r12d, 5
sub rdi, rcx
sub r11, rcx
sub rsi, rcx
sub r14, rcx
sub r15, rcx
sub r12, rcx
mov rbx, rcx
mov r10, rcx
neg rbx
nop dword [rax]
nop word [rax + rax]
xor edx, edx
lea rax, [rbx + r10]
div r9
movzx eax, byte [rdx + r8]
xor edx, edx
xor al, byte [r11 + r10]
mov byte [r10], al
lea rax, [rdi + r10]
div r9
movzx eax, byte [rdx + r8]
xor edx, edx
xor al, byte [r11 + r10 + 1]
mov byte [r10 + 1], al
lea rax, [rsi + r10]
div r9
movzx eax, byte [rdx + r8]
xor edx, edx
xor al, byte [r11 + r10 + 2]
mov byte [r10 + 2], al
lea rax, [r14 + r10]
div r9
movzx eax, byte [rdx + r8]
xor edx, edx
xor al, byte [r11 + r10 + 3]
mov byte [r10 + 3], al
lea rax, [r15 + r10]
div r9
movzx eax, byte [rdx + r8]
xor edx, edx
xor al, byte [r11 + r10 + 4]
mov byte [r10 + 4], al
lea rax, [r12 + r10]
div r9
lea r10, [r10 + 6]
movzx eax, byte [rdx + r8]
xor al, byte [r11 + r10 - 1]
mov byte [r10 - 1], al
lea rax, [rbx + r10]
cmp rax, 0xc
jb 0x1400034a0
mov rbx, qword [rsp + 0x18]
mov rax, rcx
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov byte [rcx + 0xc], 0
pop r15
pop r14
ret

Function at 0x1400040c0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [0x1400346a0]
test al, 1
jne 0x140004149
xorps xmm0, xmm0
lea rcx, [0x140034660]
or eax, 1
movdqa xmmword [0x140034640], xmm0
xor ebx, ebx
mov dword [0x1400346a0], eax
mov qword [0x140034650], rbx
mov qword [0x140034688], rbx
movdqa xmmword [0x140034690], xmm0
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov qword [rsp + 0x28], rbx
lea r8, [0x140004600]
mov dword [rsp + 0x20], ebx
xor edx, edx
lea rbx, [0x140034640]
xor ecx, ecx
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [0x14001d8c0]
mov qword [0x140034658], rax
call fcn.140009ce4
mov rax, rbx
add rsp, 0x30
pop rbx
ret
lea rax, [0x140034640]
add rsp, 0x30
pop rbx
ret