joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001f76
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov rax, qword [rbp + 0x28]
mov rcx, rax
call fcn.14010c140
mov rcx, rax
lea rax, [0x1401b413e]
mov rdx, rax
mov rax, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140001ff5
lea rax, [0x1401b4148]
mov rdx, rax
mov rax, qword [0x140c86560]
mov rcx, rax
call fcn.1401a79c0
mov rcx, rax
mov rax, qword [rbp + 0x28]
mov rdx, rax
call fcn.1401a7d70
mov rcx, rax
mov rax, qword [0x140c86540]
mov rdx, rax
call fcn.140173010
jmp 0x1400020c2
lea rax, [rbp - 0x30]
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call fcn.140001bf1
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.14010b3a0
test al, al
je 0x140002053
lea rax, [0x1401b41a0]
mov rdx, rax
mov rax, qword [0x140c86500]
mov rcx, rax
call fcn.1401a76b0
mov rcx, rax
mov rax, qword [0x140c86530]
mov rdx, rax
call fcn.140156de0
mov rax, qword [rbp - 8]
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov ebx, 0
jmp 0x140002096
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.14010b360
mov rbx, rax
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.140186f90
mov rdx, qword [rbp - 8]
mov r9, rdx
mov r8, rbx
mov edx, 1
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rax, qword [rbp - 8]
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov ebx, 1
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.14018a090
cmp ebx, 1
jmp 0x1400020c2
add rsp, 0x58
pop rbx
pop rbp
ret

Function at 0x1400020c9
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x380
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x2fc], 0
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x2f0], rax
cmp qword [rbp + 0x2f0], 0xffffffffffffffff
je 0x1400021bb
mov dword [rbp - 0x50], 0x130
lea rax, [rbp - 0x50]
mov rcx, qword [rbp + 0x2f0]
mov rdx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
setne al
test al, al
je 0x1400021a8
lea rax, [rbp - 0x50]
lea rdx, [rax + 0x2c]
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rdx
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call rax
lea rax, [rbp + 0xe0]
lea rdx, [0x1401b41c2]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
sete al
test al, al
je 0x14000218c
mov eax, dword [rbp - 0x48]
mov dword [rbp + 0x2fc], eax
jmp 0x1400021a8
lea rax, [rbp - 0x50]
mov rcx, qword [rbp + 0x2f0]
mov rdx, rax
call sub.KERNEL32.dll_Process32Next
test eax, eax
setne al
test al, al
jne 0x14000212a
mov rax, qword [rbp + 0x2f0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp + 0x2fc]
add rsp, 0x380
pop rbp
ret
Function at 0x1400027de
Capabilities:
Create process on windows

Disassembly:
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0xe0]
mov qword [rbp + 0x20], rcx
lea rdx, [rbp - 0x70]
mov eax, 0
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp - 0x70], 0x68
mov dword [rbp - 0x34], 1
mov word [rbp - 0x30], 0
mov rax, qword [rbp + 0x20]
mov rcx, rax
call fcn.14010c140
mov rdx, rax
lea rax, [rbp - 0x90]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessW]
call rax
test eax, eax
sete al
test al, al
je 0x1400028b1
lea rax, [0x1401b4410]
mov rdx, rax
mov rax, qword [0x140c86560]
mov rcx, rax
call fcn.1401a79c0
mov rcx, rax
mov rax, qword [0x140c86540]
mov rdx, rax
call fcn.140173010
jmp 0x1400028f0
mov rax, qword [rbp - 0x90]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp - 0x90]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x88]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
nop
add rsp, 0xe8
pop rdi
pop rbp
ret
Function at 0x14000f62d
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x18]
mov qword [rbp - 8], rax
call fcn.1400d4d01
test eax, eax
jne 0x14000f7ff
mov ecx, 5
call fcn.14000a92c
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.14000a987
cmp dword [rbp + 0x10], 0
jle 0x14000f678
cmp qword [rbp + 0x18], 0
jne 0x14000f693
mov dword [0x140cc1220], 0
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.14000a9e6
jmp 0x14000f800
mov eax, dword [0x140cc1220]
test eax, eax
jne 0x14000f723
mov ecx, 0
call fcn.14000a38d
mov qword [rbp - 0x18], rax
mov rax, qword [0x140c7e660]
mov rdx, qword [0x140c7e668]
mov qword [0x140cc1220], rax
mov qword [0x140cc1228], rdx
cmp qword [rbp - 0x18], 0
jne 0x14000f6ee
mov r8d, 0x2c
mov edx, 0
lea rax, [0x140cc1230]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
jmp 0x14000f706
mov rax, qword [rbp - 0x18]
lea r8, [0x140cc1230]
mov edx, 0x2c
mov rcx, rax
call fcn.14000a104
mov eax, dword [0x140cc1250]
mov dword [0x140cc125c], eax
mov dword [0x140cc1250], 0
mov byte [0x140cc12a0], 0
movzx eax, byte [0x140cc12a0]
movzx eax, al
cmp dword [rbp + 0x10], eax
jg 0x14000f785
mov eax, dword [rbp + 0x10]
movsxd rcx, eax
movzx eax, byte [0x140cc12a0]
movzx eax, al
sub eax, dword [rbp + 0x10]
cdqe
lea rdx, [rax + 0x40]
lea rax, [0x140cc1220]
add rdx, rax
mov rax, qword [rbp - 8]
mov r8, rcx
mov rcx, rax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
movzx eax, byte [0x140cc12a0]
mov edx, dword [rbp + 0x10]
sub eax, edx
mov byte [0x140cc12a0], al
nop
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.14000a9e6
jmp 0x14000f800
movzx eax, byte [0x140cc12a0]
test al, al
je 0x14000f7cb
movzx eax, byte [0x140cc12a0]
movzx edx, al
mov rax, qword [rbp - 8]
mov r8, rdx
lea rdx, [0x140cc1260]
mov rcx, rax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
movzx eax, byte [0x140cc12a0]
movzx eax, al
sub dword [rbp + 0x10], eax
movzx eax, byte [0x140cc12a0]
movzx eax, al
add qword [rbp - 8], rax
mov eax, dword [0x140cc1250]
add eax, 1
mov dword [0x140cc1250], eax
lea rax, [0x140cc1220]
mov rdx, rax
lea rax, [0x140cc1260]
mov rcx, rax
call fcn.14000f1bb
mov byte [0x140cc12a0], 0x40
jmp 0x14000f723
nop
add rsp, 0x40
pop rbp
ret
Function at 0x14006b476
Capabilities:
Reference sql statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov qword [rbp + 0x28], r9
mov rax, qword [rbp + 0x10]
mov byte [rax + 0x1c], 1
mov r8, qword [rbp + 0x18]
mov rcx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x10]
mov edx, dword [rbp + 0x30]
mov dword [rsp + 0x30], edx
mov rdx, qword [rbp + 0x28]
mov qword [rsp + 0x28], rdx
mov edx, dword [rbp + 0x20]
mov dword [rsp + 0x20], edx
mov r9, r8
mov r8, rcx
lea rdx, [0x140c74748]
mov rcx, rax
call fcn.140073a26
cmp dword [rbp + 0x20], 0
jne 0x14006b4fc
mov r8, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x10]
mov edx, dword [rbp + 0x30]
mov dword [rsp + 0x20], edx
mov r9, r8
mov r8, rcx
lea rdx, [0x140c747f8]
mov rcx, rax
call fcn.140073a26
nop
add rsp, 0x40
pop rbp
ret
Function at 0x1400ef3f0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, [0x140c85660]
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call fcn.1400f9ad0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
nop dword [rax]

Function at 0x1400ef460
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x140cc1544]
test esi, esi
mov rbx, rcx
jle 0x1400ef590
mov rax, qword [0x140cc1548]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x1400ef4ab
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x1400ef535
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x1400ef490
mov rcx, rbx
call fcn.1400efed0
test rax, rax
mov rdi, rax
je 0x1400ef5b2
mov rax, qword [0x140cc1548]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.1400f0010
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x140cc1548]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400ef597
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400ef52e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1400ef540
add dword [0x140cc1544], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov r8d, 0x40
mov eax, 4
mov rcx, qword [rsp + 0x20]
cmove r8d, eax
mov rdx, qword [rsp + 0x38]
add rbx, qword [0x140cc1548]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400ef52e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140c856d8]
mov edx, eax
call fcn.1400ef3f0
nop dword [rax]
xor esi, esi
jmp 0x1400ef4b8
mov rax, qword [0x140cc1548]
lea rcx, [0x140c856a0]
mov edx, dword [rdi + 8]
mov r8, qword [rax + rbx + 0x18]
call fcn.1400ef3f0
lea rcx, [0x140c85680]
mov rdx, rbx
call fcn.1400ef3f0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400efb20
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140cc15a0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140cc1580]
test rbx, rbx
je 0x1400efb7c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x1400efb73
test rsi, rsi
je 0x1400efb73
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400efb58
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1400efd90
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x1400efdc8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x1400efdd0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x1400efda0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x1400efdc8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x1400efdd0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x1400efdb0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x1400efdc8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x1400efdd0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x1400efed0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140c86b70]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400efef0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400efef8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400efef0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400eff4d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x1400eff44
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400efef0
add rax, 0x28
cmp rax, r9
jne 0x1400eff30
xor eax, eax
ret

Function at 0x1400eff50
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140c86b70]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400eff6f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400eff78
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400eff6f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400f0010
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140c86b70]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400f002f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400f0038
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x1400f0460
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400f0490
mov rdx, rbx
mov ecx, eax
mov dword [rsi], eax
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.1400fa440
add rsp, 0x28
pop rbx
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x1400f04d0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, ebx
mov esi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, esi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x1400f0500
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1400f0518
xor eax, eax
add rsp, 0x28
ret
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x1400f0c80
Capabilities:
Allocate thread local storage
Create thread
Resume thread

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rax, qword [0x140c85f00]
mov rsi, r8
mov r8d, dword [rax]
mov rdi, rcx
mov rbp, rdx
test r8d, r8d
je 0x1400f0cb0
mov ecx, dword [0x1401b0ce0]
test ecx, ecx
je 0x1400f0d30
mov ecx, 0x18
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
lea r8, [0x1400f0c40]
xor ecx, ecx
xor edx, edx
mov qword [rax], rbp
mov rbx, rax
mov r9, rax
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov rcx, rax
mov qword [rbx + 0x10], rax
je 0x1400f0d10
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rbx + 0x10]
mov qword [rdi], rax
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rbx
call fcn.1400fa070
nop
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
lock add dword [0x1401b0ce4], 1
jne 0x1400f0d70
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400f0da0
mov rdx, qword [fcn.1400fa070]
mov ecx, eax
mov dword [0x1401b0ce8], eax
call fcn.1400fa440
test eax, eax
jne 0x1400f0da8
mov dword [0x1401b0ce0], 1
jmp 0x1400f0cb0
mov edx, dword [0x1401b0ce0]
lea rbx, [0x1401b0ce0]
mov r12, qword [sym.imp.KERNEL32.dll_Sleep]
test edx, edx
jne 0x1400f0cb0
nop dword [rax]
xor ecx, ecx
call r12
mov eax, dword [rbx]
test eax, eax
je 0x1400f0d90
jmp 0x1400f0cb0
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400f0d59
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
nop
Function at 0x14015ea20
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sub.api_ms_win_crt_stdio_l1_1_0.dll__fileno
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
cmp eax, 0xffffffff
movsxd rbp, eax
je 0x14015ea68
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x14015ea3a
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140184e40
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rdx
mov rax, qword [0x140c85f00]
mov eax, dword [rax]
test eax, eax
je 0x140184dde
mov r8, qword [rdx]
lea rdx, [0x1401abed0]
call fcn.1400f0c80
test eax, eax
jne 0x140184dd7
mov qword [rbx], 0
add rsp, 0x38
pop rbx
pop rsi
ret
mov ecx, eax
call fcn.1401ac8e0
mov ecx, 0x20
call fcn.1401ab380
mov rbx, rax
call fcn.1401809c0
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov qword [rsp + 0x20], 1
lea r8, [0x140c82c28]
mov qword [rsp + 0x28], rax
call fcn.14015ffe0
lea r8, [fcn.140160860]
mov rcx, rbx
lea rdx, [0x140c89260]
call fcn.1401abbe0
mov rsi, rax
mov rcx, rbx
call fcn.1401ab670
mov rcx, rsi
call fcn.1400f09b0
nop
nop
nop
nop
nop
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
xor edx, edx
test eax, eax
cmovs eax, edx
add rsp, 0x58
ret

Function at 0x1401ab6c0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x1401b3e20]
jmp fcn.1400f1090

Function at 0x1401ab6d0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x1401b3e20]
jmp fcn.1400f1090
Function at 0x14014997d
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg r9b
inc r9b
xor sil, r9b
ror dword [rsp + 0x13], 0xb0
lea r9, [rsp + r9 + 0x18]
mov byte [r9], r8b
jae 0x14014b5dc
lea rsp, [rsp + 0x18]
jae 0x14015f96c
sbb si, 0x17b8
xor si, 0x91f
xor bx, si
add rsi, rsp
rol dx, 0xc5
shl dl, 0xe2
mov dx, word [rsi + rdx*2 - 0x200]
sub rdi, 2
call fcn.1401372d0
mov ecx, 0xd330a3be
sar cx, 0x85
sub r9, 4
mov ecx, dword [r9]
jmp 0x140169e20
call fcn.140148ec6
mov edx, 0x4c01a
movsx eax, dx
rdtsc
push 0xffffffff88287e87
not byte [rsp + 3]
sub r11, 8
mov dword [r11 + 4], eax
jmp 0x14017758d
lea rsp, [rsp + 8]
jmp 0x14015f526
mov dword [r11], edx
jmp 0x14016b5ef

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62
Function at 0x1400128b0
Capabilities:
Check if file exists
Get file attributes
Terminate process

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x90
movaps xmmword [rsp + 0x80], xmm8
movaps xmmword [rsp + 0x70], xmm7
movaps xmmword [rsp + 0x60], xmm6
mov rax, qword [0x140038008]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rcx, qword [0x14003cab8]
test rcx, rcx
je 0x14001291a
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14001290d
mov rcx, qword [0x14003cab8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14003cab8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x14003f300], 1
jne 0x1400129c7
mov rbx, qword [0x14002d060]
mov qword [rsp + 0x50], rbx
movups xmm6, xmmword [0x14002d050]
movaps xmmword [rsp + 0x40], xmm6
movups xmm7, xmmword [0x14002d040]
movaps xmmword [rsp + 0x30], xmm7
movups xmm8, xmmword [0x14002d030]
movaps xmmword [rsp + 0x20], xmm8
lea rsi, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebp, 0x14
lea rdi, [0x14003cad0]
mov r14, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r15, qword [sym.imp.KERNEL32.dll_Sleep]
mov r12, qword [sym.imp.SHELL32.dll_SHFileOperationW]
nop dword [rax + rax]
mov rcx, rdi
call r14
cmp eax, 0xffffffff
je 0x1400129c7
and eax, 0x10
je 0x1400129c7
mov ecx, 0x64
call r15
mov qword [rsp + 0x50], rbx
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm8
mov rcx, rsi
call r12
dec ebp
jne 0x140012990
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140013dc0
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x70]
movaps xmm8, xmmword [rsp + 0x80]
add rsp, 0x90
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140013c00
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
mov eax, 0x2030
call fcn.140013d60
sub rsp, rax
mov rsi, rcx
mov rax, qword [0x140038008]
xor rax, rsp
mov qword [rsp + 0x2028], rax
mov eax, dword [0x14003cac0]
test eax, eax
je 0x140013c35
test eax, eax
jg 0x140013c7d
jmp 0x140013cb2
lea rdx, str._HOME_
lea rcx, [rsp + 0x20]
mov r8d, 0x1000
call fcn.140012130
test al, al
je 0x140013d3a
lea rcx, [rsp + 0x20]
call fcn.14001a994
movsxd rcx, dword [0x14003cac0]
lea rdx, [0x140041b40]
mov qword [rdx + rcx*8], rax
lea eax, [rcx + 1]
mov dword [0x14003cac0], eax
test eax, eax
jle 0x140013cb2
lea rdi, [0x140041b40]
xor ebx, ebx
nop word cs:[rax + rax]
mov rdx, qword [rdi]
mov rcx, rsi
call fcn.14001b5f0
test eax, eax
je 0x140013d1b
inc rbx
movsxd rax, dword [0x14003cac0]
add rdi, 8
cmp rbx, rax
jl 0x140013c90
mov rcx, rsi
call fcn.14001b628
cmp rax, 2
jne 0x140013cc9
mov bl, 1
cmp word [rsi + 2], 0x3a
je 0x140013d1d
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x140013ce8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete bl
test bl, bl
je 0x140013d1d
cmp dword [0x14003cac0], 0x3ff
jg 0x140013d1d
mov rcx, rsi
call fcn.14001a994
movsxd rcx, dword [0x14003cac0]
lea rdx, [0x140041b40]
mov qword [rdx + rcx*8], rax
lea eax, [rcx + 1]
mov dword [0x14003cac0], eax
mov bl, 1
mov rcx, qword [rsp + 0x2028]
xor rcx, rsp
call fcn.140013dc0
mov eax, ebx
add rsp, 0x2030
pop rbx
pop rdi
pop rsi
ret
lea rcx, str._HOME_
call fcn.140013150
int3

Function at 0x140014540
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001458a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001458a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001458a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001458a
cmp dword [rcx + 0x84], 0xe
jbe 0x14001458a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001458c
xor al, al
add rsp, 0x28
ret