joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410d90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x50
mov rax, qword [rcx]
cmp byte [rax], 0
mov byte [rax], 0
je 0x410fb6
mov byte [rsp + 0x2e], 0
mov rax, qword [0x00443080]
cmp rax, 3
jne 0x410f62
cmp byte [rsp + 0x2e], 0
jne 0x410f77
mov ecx, dword [0x00436098]
test ecx, ecx
je 0x410f7d
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x410ded
mov rsi, rax
cmp byte [rax + 8], 0
jne 0x410e89
mov ecx, dword [0x00436098]
test ecx, ecx
je 0x410f90
dec ecx
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x410e3b
mov rsi, rax
cmp rax, 1
jne 0x410e83
lea rax, [0x0043b958]
mov qword [rsp + 0x20], rax
lea rcx, str.cannot_access_a_Thread_Local_Storage_value_during_or_after_destructionlibrary_std_src_threadlocal.rs
lea r9, [0x0043b128]
lea r8, [rsp + 0x2f]
mov edx, 0x46
call fcn.00403b20
ud2
movzx eax, byte [0x00443030]
mov ecx, 0x10
mov edx, 8
call fcn.00401950
test rax, rax
je 0x410ffb
mov rsi, rax
lea rax, [0x00436080]
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov ecx, dword [0x00436098]
test ecx, ecx
je 0x410fa3
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov word [rsi + 8], 1
add rsi, 9
mov rax, qword [0x00443048]
cmp rax, rsi
jne 0x410ebd
mov eax, dword [0x00443078]
inc eax
jne 0x410edd
lea rcx, str.lock_count_overflow_in_reentrant_mutexlibrary_std_src_sync_remutex.rs
lea r8, [0x0043bc90]
mov edx, 0x26
call fcn.00403d90
ud2
lea rcx, [0x00443040]
call sub.KERNEL32.dll_TryAcquireSRWLockExclusive
test al, al
je 0x410f77
mov qword [0x00443048], rsi
mov eax, 1
mov dword [0x00443078], eax
mov qword [rsp + 0x30], 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x46], 0
cmp qword [0x00443050], 0
jne 0x410fd0
mov qword [0x00443050], 0xffffffffffffffff
lea rcx, [0x00443058]
call fcn.004110f0
movups xmm0, xmmword [rsp + 0x30]
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [0x00443068], xmm1
movups xmmword [0x00443058], xmm0
inc qword [0x00443050]
dec dword [0x00443078]
jne 0x410f77
mov qword [0x00443048], 0
lea rcx, [0x00443040]
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
jmp 0x410f77
lea rcx, [rsp + 0x2e]
call fcn.00411060
cmp byte [rsp + 0x2e], 0
je 0x410dc5
add rsp, 0x50
pop rsi
ret
lea rcx, [0x00436080]
call fcn.00410900
mov ecx, eax
jmp 0x410dd5
lea rcx, [0x00436080]
call fcn.00410900
mov ecx, eax
jmp 0x410dfd
lea rcx, [0x00436080]
call fcn.00410900
mov ecx, eax
jmp 0x410e7b
lea rcx, str.called__Option::unwrap____on_a__None__value_rustc_cc66ad468955717ab92600c770da8c1601a4ff33library_alloc_srccollections_btree_navigate.rsinvalid_args
lea r8, str.library_std_src_synconce.rs
mov edx, 0x2b
call fcn.00403110
ud2
lea rax, [0x0043b8d8]
mov qword [rsp + 0x20], rax
lea rcx, str.already_borrowedlibrary_std_srcio_stdio.rs
lea r9, [0x0043b148]
lea r8, [rsp + 0x2f]
mov edx, 0x10
call fcn.00403b20
ud2
mov ecx, 8
mov edx, 0x10
call fcn.00401db0
ud2
Function at 0x411ed0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x00436058]
test ecx, ecx
je 0x411f8d
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x411f00
cmp qword [rax + 8], 0
je 0x411f00
add rax, 0x10
jmp 0x411f87
mov ecx, dword [0x00436058]
test ecx, ecx
je 0x411fa0
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x411f85
mov rsi, rax
test rax, rax
jne 0x411f6b
movzx eax, byte [0x00443030]
mov ecx, 0x20
mov edx, 8
call fcn.00401950
test rax, rax
je 0x411fc3
mov rsi, rax
lea rax, [0x00436040]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x00436058]
test ecx, ecx
je 0x411fb3
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], 0
mov byte [rsi + 0x18], 0
jmp 0x411f87
xor eax, eax
add rsp, 0x20
pop rsi
ret
lea rcx, [0x00436040]
call fcn.00410900
mov ecx, eax
jmp 0x411ee5
lea rcx, [0x00436040]
call fcn.00410900
mov ecx, eax
jmp 0x411f10
lea rcx, [0x00436040]
call fcn.00410900
mov ecx, eax
jmp 0x411f63
mov ecx, 8
mov edx, 0x20
call fcn.00401db0
ud2

Function at 0x414b20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
movzx r11d, byte [rdx + 0x38]
cmp r11b, 1
ja 0x414b88
movzx r10d, byte [rdx + 0x10]
movzx r8d, byte [rdx + 0x3a]
xor eax, eax
movzx r9d, r10b
test r8b, r8b
jne 0x414cd6
cmp r10b, 5
jb 0x414cd6
mov r10, qword [rdx]
mov rax, qword [rdx + 8]
xor esi, esi
test r11b, r11b
jne 0x414b78
cmp r9b, 6
je 0x414b78
mov esi, 2
cmp rax, 2
jb 0x414d7d
cmp rsi, rax
jne 0x414c99
xor eax, eax
jmp 0x414cd6
xor eax, eax
xor r8d, r8d
xor r10d, r10d
add rax, r10
lea rdi, [r10 + rsi]
inc rdi
cmp rdi, rax
invalid
sete al
movzx r10d, byte [r10 + rsi]
invalid
test al, 1
jne 0x414ccb
cmp r10b, 0x2e
jne 0x414ccb
lea r8, case.0x4189fe.0
mov ecx, 2
jmp 0x414d73
Function at 0x434680
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x00443764]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x434808
mov rax, qword [0x00443768]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x4346cc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x434755
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x4346b0
mov rcx, rbx
call fcn.00435320
test rax, rax
mov r12, rax
je 0x43483d
mov rax, qword [0x00443768]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.00435450
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00443768]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x434820
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x43474e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x4347b0
add dword [0x00443764], 1
cmp edi, 8
jae 0x434783
test dil, 4
jne 0x4347f4
test edi, edi
je 0x434778
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x43480f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x434778
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x43479c
jmp 0x434778
add rsi, qword [0x00443768]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x43474e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00435680
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x434778
xor esi, esi
jmp 0x4346d7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x434778
mov rax, qword [0x00443768]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.00435680
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.00435680
nop
nop dword [rax]

Function at 0x434f90
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00443a40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00443a20]
test rbx, rbx
je 0x434fe4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x434fdb
test rsi, rsi
je 0x434fdb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x434fc0
lea rcx, [0x00443a40]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x435320
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x0043d200]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x43538d
mov rcx, r8
call fcn.00435200
test eax, eax
je 0x43538d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x43538d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x435384
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x43538f
add rax, 0x28
cmp rax, r9
jne 0x435370
xor eax, eax
add rsp, 0x28
ret

Function at 0x435680
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x00401540]
jmp 0x401510
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00435620
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.00435620
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x401530
Function at 0x1400025fc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002646
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002646
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002646
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002646
cmp dword [rcx + 0x84], 0xe
jbe 0x140002646
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002648
xor al, al
add rsp, 0x28
ret

Function at 0x1400061d8
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140006043
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006043
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140006043
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140006043
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140006043
cmp dword [rcx + 0x84], 0xe
jbe 0x140006043
cmp dword [rcx + 0xf8], 0
je 0x140006043
mov ecx, ebx
call fcn.1400060f4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140005ed0
nop
cmp dword [rbp + 0x20], 0
je 0x140006091
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000609c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140005fd4
Function at 0x140011190
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x140029790]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x1400111e7
cmp word [rdx], r13w
jne 0x1400111e7
or byte [rax + rdi*8 + 0x38], cl
jmp 0x1400111ec
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x140011311
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x140011332
lea r9, [rdx + 2]
cmp cx, r11w
je 0x140011225
mov rdx, r9
mov word [rbx], cx
jmp 0x14001124c
cmp r9, r8
jae 0x14001125c
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x140011206
jmp 0x140011311
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140011306
cmp dword [rsp + 0x80], esi
je 0x140011306
lea r8, [0x140029790]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x1400112de
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x1400112ae
mov word [rbx], r13w
jmp 0x14001130e
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x1400112bb
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x14001130e
cmp word [rsp + 0x70], r13w
jne 0x1400112eb
cmp rbx, r14
je 0x1400112a8
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.1400167f0
cmp word [rsp + 0x70], r13w
je 0x140011311
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x140029790]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x14001130b
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x140011311
Function at 0x140013030
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400130b7
mov rsi, rbx
cmp word [rax], bp
je 0x140013076
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140013060
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14001305c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14000d488
mov rdi, rax
test rax, rax
je 0x1400130a4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140003f70
mov rbp, rdi
xor ecx, ecx
call fcn.14000d44c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400161e8
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400161fe
mov al, 1
jmp 0x14001625e
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001620f
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001625c
mov ecx, dword [rcx + 0x18]
nop
call fcn.140013578
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001625c
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001625c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001625c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001625e
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140018850
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400167f0
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400167f0
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400189a0
cmp rax, 0xffffffffffffffff
je 0x1400189a0
xor edi, edi
test rbp, rbp
jle 0x14001894b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14000f540
mov rbx, rax
test rax, rax
jne 0x1400188d8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140018941
mov edx, 0x8000
mov ecx, r14d
call fcn.14000c508
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400106dc
cmp eax, 0xffffffff
je 0x140018921
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400188e8
mov edx, r15d
mov ecx, r14d
call fcn.14000c508
jmp 0x140018941
cmp byte [rsi + 0x38], dil
je 0x140018938
cmp dword [rsi + 0x34], 5
jne 0x140018938
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140018941
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14000d44c
jmp 0x1400189b4
jns 0x1400189b4
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400167f0
cmp rax, 0xffffffffffffffff
jne 0x14001896c
cmp byte [rsi + 0x30], dil
je 0x1400189b4
mov edi, dword [rsi + 0x2c]
jmp 0x1400189b4
mov ecx, r14d
call fcn.140013578
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400189b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400189b4
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400189ad
mov eax, dword [rsi + 0x2c]
jmp 0x1400189b2
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400167f0
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400195e0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140019608
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140019608
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140003008]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor ecx, ecx
mov dword [rsp + 0x30], 0
mov edx, 0x114
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, 0x114
lea rdx, [0x140003040]
mov rcx, rax
mov rbx, rax
call sub.VCRUNTIME140.dll_memmove
lea r9, [rsp + 0x30]
mov edx, 0x114
mov r8d, 0x20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140001098
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov r8, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400010c0
add rsp, 0x40
pop rbx
ret

Function at 0x14000199c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400019e6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400019e6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400019e6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400019e6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400019e6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400019e8
xor al, al
add rsp, 0x28
ret
Function at 0x140192c20
Capabilities:
Set current directory

Disassembly:
push rsi
sub rsp, 0x170
mov rsi, rcx
mov qword [rsp + 0x58], rsi
xor ecx, ecx
call fcn.140149810
mov ecx, eax
call fcn.140217cd0
mov rax, qword [str.P:HfrefChoyvpQbjaybnqf_]
mov qword [rsp + 0x30], rax
mov rax, qword [0x1402294a8]
mov qword [rsp + 0x38], rax
mov rax, qword [0x1402294b0]
mov qword [rsp + 0x40], rax
mov ax, word [0x1402294b8]
mov word [rsp + 0x48], ax
mov al, byte [0x1402294ba]
mov byte [rsp + 0x4a], al
lea rcx, [rsp + 0x30]
call fcn.140218790
lea rcx, [rsp + 0x30]
mov rdx, rax
call fcn.140192b60
mov rcx, rsi
mov edx, 0x104
mov r8, rax
call fcn.140213dd0
mov rcx, rsi
add rcx, 0x104
mov edx, 8
call fcn.140192ac0
mov rcx, rsi
add rcx, 0x10d
mov edx, 8
call fcn.140192ac0
mov rax, rsi
add rax, 0x10d
mov rdx, rsi
add rdx, 0x104
mov rcx, rsi
add rcx, 0x116
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea r8, str._s_s_s.exe
mov edx, 0x104
mov r9, rsi
call fcn.140213dd0
mov rax, rsi
add rax, 0x10d
mov rdx, rsi
add rdx, 0x104
mov rcx, rsi
add rcx, 0x116
add rcx, 0x104
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea r8, str._s_s_s.dat
mov edx, 0x104
mov r9, rsi
call fcn.140213dd0
mov rax, rsi
add rax, 0x104
mov rcx, rsi
add rcx, 0x116
add rcx, 0x208
mov qword [rsp + 0x20], rax
lea r8, str._s_sedge.xml
mov edx, 0x104
mov r9, rsi
call fcn.140213dd0
mov rax, rsi
add rax, 0x104
mov rcx, rsi
add rcx, 0x116
add rcx, 0x30c
mov qword [rsp + 0x20], rax
lea r8, str._s_sedge.jpg
mov edx, 0x104
mov r9, rsi
call fcn.140213dd0
mov rax, rsi
add rax, 0x104
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r8, str._s_s_
mov edx, 0x104
mov r9, rsi
call fcn.140213dd0
lea rcx, [rsp + 0x60]
call fcn.140218a50
cmp eax, 0
je 0x140192deb
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
jmp 0x140192df6
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov rax, rsi
add rsp, 0x170
pop rsi
ret

Function at 0x140192e10
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x88
mov dword [rsp + 0x3c], 4
mov dword [rsp + 0x48], 4
lea rcx, [rsp + 0x50]
lea rdx, [0x1402294c0]
mov r8d, 0x2a
call fcn.140214a30
lea rcx, [rsp + 0x50]
call fcn.140218790
lea rcx, [rsp + 0x50]
mov rdx, rax
call fcn.140192b60
lea r10, [rsp + 0x40]
mov rcx, 0xffffffff80000001
mov rdx, rax
xor r8d, r8d
mov r9d, 1
mov qword [rsp + 0x20], r10
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 0
jne 0x140192ed6
lea r10, [rsp + 0x4c]
mov rcx, qword [rsp + 0x40]
lea rdx, str.IsStatus
lea r9, [rsp + 0x3c]
lea rax, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], r10
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 0
jne 0x140192ecb
cmp dword [rsp + 0x3c], 4
jne 0x140192ec9
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
call fcn.140218608
jmp 0x140192ecb
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add rsp, 0x88
ret
Function at 0x140192ee0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0xa8
lea rax, str.IsStatus
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x5c], 1
lea rcx, [rsp + 0x70]
lea rdx, str.FbsgjnerZvpebfbsgVagrearg_RkcybereZnva
mov r8d, 0x2a
call fcn.140214a30
lea rcx, [rsp + 0x70]
call fcn.140218790
lea rcx, [rsp + 0x70]
mov rdx, rax
call fcn.140192b60
lea r10, [rsp + 0x50]
mov rcx, 0xffffffff80000001
mov rdx, rax
xor r8d, r8d
mov r9d, 0x20006
mov qword [rsp + 0x20], r10
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 0
jne 0x140192fa9
lea rax, [rsp + 0x5c]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov r9d, 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, 0
jne 0x140192f99
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x58], 1
jmp 0x140193062
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14019305a
lea rcx, [rsp + 0x70]
call fcn.140218790
lea rcx, [rsp + 0x70]
mov rdx, rax
call fcn.140192b60
lea r10, [rsp + 0x50]
lea r11, [rsp + 0x6c]
mov rcx, 0xffffffff80000001
mov rdx, rax
xor r8d, r8d
xor r9d, r9d
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0x20006
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], r11
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, 0
jne 0x140193058
lea rax, [rsp + 0x5c]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov r9d, 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, 0
jne 0x14019304d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x58], 1
jmp 0x140193062
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14019305a
mov dword [rsp + 0x58], 0
mov eax, dword [rsp + 0x58]
add rsp, 0xa8
ret
Function at 0x1401f8530
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x44], 0
mov rcx, qword [rsp + 0x50]
mov edx, 0xc0000000
mov r8d, 3
xor r9d, r9d
mov dword [rsp + 0x20], 2
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x48], rax
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x68
ret