joyce8/EMBER2024-capa huggingface dataset:
Function at 0x187c4
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rdx + 0xb8]
mov rdi, rdx
mov rsi, r8
movzx edx, byte [rbx]
test edx, edx
je 0x189e7
sub edx, 0xe
je 0x1884c
sub edx, 1
je 0x18895
cmp edx, 3
jne 0x1892a
mov rax, qword [rbx + 0x30]
mov rcx, qword [rax + 0x20]
sub rcx, 1
je 0x1883c
cmp rcx, 1
je 0x1882c
inc byte [rdi + 0x43]
lea rax, [rbx + 0x48]
mov rcx, r8
mov qword [rdi + 0xb8], rax
jmp 0x189b8
mov rdx, rbx
mov rcx, rdi
call fcn.00018ee8
jmp 0x189f2
mov rdx, rbx
mov rcx, rdi
call fcn.0001533c
jmp 0x189f2
mov r8, rbx
mov rdx, rdi
call sub.TDI.SYS_TdiMapUserRequest
test eax, eax
jns 0x18895
cmp dword [rbx + 0x18], 0x210203
jne 0x1892a
mov rax, qword [rbx + 0x20]
test rax, rax
je 0x1892a
lea rcx, [0x00018604]
xor edx, edx
mov qword [rax], rcx
and dword [rdi + 0x30], 0
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
jmp 0x189f2
mov rax, qword [rbx + 0x30]
mov rcx, qword [rax + 0x20]
cmp rcx, 2
jne 0x189c3
movzx ecx, byte [rbx + 1]
sub ecx, 1
je 0x1896a
sub ecx, 1
je 0x18942
sub ecx, 1
je 0x1892f
sub ecx, 1
je 0x1892a
sub ecx, 2
je 0x18917
sub ecx, 1
je 0x18904
sub ecx, 1
je 0x188f1
cmp ecx, 0x127ffc
jne 0x1892a
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.0001865c
jmp 0x189f2
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.0001593c
jmp 0x189f2
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.0001af10
jmp 0x189f2
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.00019e60
jmp 0x189f2
inc byte [rdi + 0x43]
jmp 0x18974
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.000192e0
jmp 0x189f2
cmp byte [rdi + 0x43], 1
je 0x18970
mov rdx, qword [rdi + 0xb8]
mov r8d, 0x38
lea rbx, [rdx - 0x48]
mov rcx, rbx
call fcn.0001bb40
lea rcx, [0x000197bc]
jmp 0x1899e
cmp byte [rdi + 0x43], 1
jne 0x1897e
mov byte [rdi + 0x43], 2
add qword [rdi + 0xb8], 0x48
jmp 0x189b5
mov rdx, qword [rdi + 0xb8]
mov r8d, 0x38
lea rbx, [rdx - 0x48]
mov rcx, rbx
call fcn.0001bb40
lea rcx, [0x00019668]
mov byte [rbx + 3], 0
mov rax, qword [rdi + 0xb8]
mov qword [rax - 0x10], rcx
mov qword [rax - 8], rdi
mov byte [rax - 0x45], 0xe0
mov rcx, rsi
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
jmp 0x189f2
cmp rcx, 1
jne 0x1892a
cmp byte [rbx + 1], 0xb
jne 0x1892a
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.000154b0
jmp 0x189f2
mov rdx, rbx
mov rcx, rdi
call fcn.00018514
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1ad54
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdx, qword [rdx + 0xb8]
xor edi, edi
movzx ecx, byte [rdx]
cmp ecx, edi
je 0x1ae96
sub ecx, 2
je 0x1ae8c
sub ecx, 1
je 0x1ae82
sub ecx, 1
je 0x1ae1c
cmp ecx, 0xa
jne 0x1ae03
cmp dword [rdx + 0x18], 0x12c800
je 0x1adf6
cmp dword [rdx + 0x18], 0x220194
jne 0x1ae03
mov rcx, qword [rbx + 0x18]
mov esi, dword [rdx + 8]
cmp rcx, rdi
je 0x1add8
cmp dword [rdx + 0x10], 0x11
jb 0x1add8
cmp esi, 0x11
jb 0x1add8
call fcn.00012e0c
cmp eax, edi
mov dword [rbx + 0x30], eax
jl 0x1add8
mov qword [rbx + 0x38], rsi
jmp 0x1ae73
mov esi, 0xc0000001
xor edx, edx
mov rcx, rbx
mov dword [rbx + 0x30], esi
mov qword [rbx + 0x38], rdi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov edi, esi
jmp 0x1ae7e
mov rcx, rbx
call fcn.00013c90
jmp 0x1aefa
xor edx, edx
mov rcx, rbx
mov dword [rbx + 0x30], edi
mov qword [rbx + 0x38], rdi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
jmp 0x1aefa
mov rcx, qword [rbx + 8]
mov esi, dword [rdx + 8]
test byte [rcx + 0xa], 5
je 0x1ae2f
mov rax, qword [rcx + 0x18]
jmp 0x1ae4a
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x28], 0x10
lea r8d, [r9 + 1]
mov dword [rsp + 0x20], edi
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
cmp rax, rdi
je 0x1ae6b
cmp esi, 8
jb 0x1ae6b
mov edx, dword [rax]
mov rcx, qword [0x0001e130]
call fcn.000130a0
mov r11d, eax
mov qword [rbx + 0x38], r11
jmp 0x1ae70
mov edi, 0xc000009a
mov dword [rbx + 0x30], edi
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
jmp 0x1aefa
mov rcx, rbx
call fcn.00013674
jmp 0x1aefa
mov rcx, rbx
call fcn.000133c0
jmp 0x1aefa
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
lea rcx, [0x0001f8c0]
mov rsi, rax
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
cmp byte [0x0001f8e0], dil
je 0x1aebe
mov dword [rbx + 0x30], 0xc0000010
jmp 0x1aecf
mov qword [0x0001f8e8], rsi
mov byte [0x0001f8e0], 1
mov dword [rbx + 0x30], edi
lea rcx, [0x0001f8c0]
mov dl, al
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
cmp dword [rbx + 0x30], edi
jne 0x1aee8
call fcn.00015704
xor edx, edx
mov rcx, rbx
mov qword [rbx + 0x38], rdi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, dword [rbx + 0x30]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1af10
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
mov r13d, r15d
cmp byte [0x0001f8e0], r15b
jne 0x1af5a
inc byte [rcx + 0x43]
add qword [rcx + 0xb8], 0x48
mov rdx, rcx
mov rcx, r8
jmp 0x1b0d4
lea rcx, [0x0001f7c0]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov r8, qword [0x0001f7d8]
mov r9, qword [rbp + 0x30]
mov ecx, dword [r8]
mov r12b, al
xor edx, edx
mov rax, r9
div rcx
mov rdi, qword [r8 + rdx*8 + 8]
jmp 0x1af90
cmp qword [rdi], r9
je 0x1af98
mov rdi, qword [rdi + 8]
cmp rdi, r15
jne 0x1af87
mov rdi, r15
cmp rdi, r15
je 0x1b0a9
lea rax, [rbp + 8]
cmp rax, r15
je 0x1afc5
test byte [rax + 4], 0x20
je 0x1afc5
lea rcx, [0x0001f7c0]
mov dl, r12b
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
jmp 0x1b0c3
test byte [rdi + 0x38], 2
je 0x1b0a9
cmp byte [rdi + 0xd9], r15b
jne 0x1b0a9
cmp byte [0x0001f8e0], r15b
je 0x1b0f7
cmp byte [rdi + 0x17d], r15b
jne 0x1b0f7
lea rcx, [rdi + 0x180]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
lea rdx, [rdi + 0x138]
lea rbp, [rbx + 0xa8]
mov rcx, qword [rdx + 8]
mov qword [rbp], rdx
mov qword [rbp + 8], rcx
mov qword [rcx], rbp
mov qword [rdx + 8], rbp
lea rcx, [rdi + 0x180]
mov dl, al
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov r11, qword [rbx + 0xb8]
mov eax, 0x103
or byte [r11 + 3], 1
mov qword [rbx + 0x38], r15
lea r15, [0x00019d74]
xchg qword [rbx + 0x68], r15
mov dword [rbx + 0x30], eax
mov rdx, qword [rdi + 0x20]
mov ecx, 3
mov r13d, eax
call fcn.00013208
test eax, eax
jns 0x1b0a9
lea rcx, [rdi + 0x180]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov rdx, qword [rbp + 8]
mov r8, qword [rbp]
mov qword [rdx], r8
mov qword [r8 + 8], rdx
lea rcx, [rdi + 0x180]
mov dl, al
mov qword [rbp + 8], rbp
mov qword [rbp], rbp
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
xchg qword [rbx + 0x68], r15
and dword [rbx + 0x30], 0
xor r13d, r13d
lea rcx, [0x0001f7c0]
mov dl, r12b
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov eax, 0x103
cmp r13d, eax
je 0x1b0da
inc byte [rbx + 0x43]
add qword [rbx + 0xb8], 0x48
mov rcx, rsi
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, [0x0001f7c0]
mov dl, r12b
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov edi, 0xc0000184
xor edx, edx
mov rcx, rbx
mov qword [rbx + 0x38], r15
mov dword [rbx + 0x30], edi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
jmp 0x1b0da

Function at 0x21064
Capabilities:
Create device object

Disassembly:
sub rsp, 0x28
mov r8, rdx
mov r9, rcx
call fcn.00021008
mov rdx, r8
mov rcx, r9
add rsp, 0x28
jmp fcn.00013ff0
Function at 0x14000277a
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1400aa500
mov rax, rcx
neg rcx
test rax, 7
je 0x1400aa51d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1400aa578
test al, 7
jne 0x1400aa510
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1400aa531
mov rdx, qword [rax - 8]
test dl, dl
je 0x1400aa5a2
test dh, dh
je 0x1400aa59c
shr rdx, 0x10
test dl, dl
je 0x1400aa596
test dh, dh
je 0x1400aa590
shr rdx, 0x10
test dl, dl
je 0x1400aa58a
test dh, dh
je 0x1400aa584
shr edx, 0x10
test dl, dl
je 0x1400aa57e
test dh, dh
jne 0x1400aa531
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x1400027ac
Capabilities:
Query environment variable

Disassembly:
jmp 0x1400c1ae0
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1400c1660
lea rcx, [rsp + 0x20]
call fcn.1400c16b0
movzx eax, al
test eax, eax
jne 0x1400c1b25
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.1400c1690
mov rax, qword [rsp + 0x40]
jmp 0x1400c1c1f
lea rcx, [rsp + 0x20]
call fcn.1400c17b0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.1400c1750
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.1400029c8
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400023c9
lea rcx, [rsp + 0x28]
call fcn.140002ca2
movzx eax, al
test eax, eax
jne 0x1400c1bbf
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.14000395e
lea rcx, [rsp + 0x20]
call fcn.1400c1690
mov rax, qword [rsp + 0x50]
jmp 0x1400c1c1f
lea rcx, [rsp + 0x20]
call fcn.1400c17b0
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.1400043c7
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.140002946
lea rcx, [rsp + 0x28]
call fcn.14000499e
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.14000395e
lea rcx, [rsp + 0x20]
call fcn.1400c1690
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret

Function at 0x140002ab3
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x14003aa70
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.14003a3f0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14003aaaf
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x14014f020]
jmp 0x14003aab9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x140002c16
Capabilities:
Query environment variable

Disassembly:
jmp 0x1400c1830
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400c1660
lea rcx, [rsp + 0x40]
call fcn.1400c17e0
movzx eax, al
test eax, eax
jne 0x1400c1878
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.1400c1690
mov rax, qword [rsp + 0x70]
jmp 0x1400c1a49
lea rcx, [rsp + 0x40]
call fcn.1400c17b0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.1400c1750
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.1400c17b0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.140003715
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x1400c191e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.1400c1690
mov rax, qword [rsp + 0x80]
jmp 0x1400c1a49
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.1400029c8
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140002888
lea rcx, [rsp + 0x48]
call fcn.140002527
movzx eax, al
test eax, eax
jne 0x1400c1985
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.140001816
lea rcx, [rsp + 0x40]
call fcn.1400c1690
mov rax, qword [rsp + 0x88]
jmp 0x1400c1a49
lea rcx, [rsp + 0x48]
call fcn.140002f27
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.1400c17b0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.140003715
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x1400c1a1b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.140001816
lea rcx, [rsp + 0x40]
call fcn.1400c1690
mov rax, qword [rsp + 0xa0]
jmp 0x1400c1a49
lea rcx, [rsp + 0x48]
call fcn.140002860
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.140001816
lea rcx, [rsp + 0x40]
call fcn.1400c1690
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret

Function at 0x140002c25
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x14003a9a0
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.14003a370
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14003a9e1
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x14014f020]
jmp 0x14003a9e7
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret
Function at 0x140002cac
Capabilities:
Get geographical location

Disassembly:
jmp 0x1400ac3e0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.1400ab350
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400ac447
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x14014f030]
jmp 0x1400ac469
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.1400024d2
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x140002cc0
Capabilities:
Terminate process

Disassembly:
jmp 0x140017af0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140002ecd
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400df820
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x14013e010]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x1400df846
jmp 0x1400df8c3
mov rcx, qword [rbp + 0x30]
call fcn.14000277a
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x1400df85f
jmp 0x1400df8c3
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x1400df87c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140001979
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.140001d7f
test eax, eax
jne 0x1400df8c3
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.140002941
lea rsp, [rbp + 0x20]
pop rbp
ret

Function at 0x1400031bb
Capabilities:
Set environment variable

Disassembly:
jmp 0x1400c3990
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret

Function at 0x1400033a5
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400186b0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400186d0
xor al, al
jmp 0x140018751
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400186e3
xor al, al
jmp 0x140018751
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001870d
xor al, al
jmp 0x140018751
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140018721
xor al, al
jmp 0x140018751
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140018733
xor al, al
jmp 0x140018751
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001874f
xor al, al
jmp 0x140018751
mov al, 1
add rsp, 0x38
ret
Function at 0x1400038b4
Capabilities:
Terminate process

Disassembly:
jmp 0x14008d520
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14008d54e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.14000408e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400040e8
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400b97f0
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x140004197
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x14003aae0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.14003a430
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14003ab29
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x14014f020]
jmp 0x14003ab38
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x1400042af
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1400ef6e0
mov word [rsp + 0x10], dx
mov qword [rsp + 8], rcx
sub rsp, 0x48
movzx eax, word [rsp + 0x58]
movd xmm0, eax
movdqa xmmword [rsp + 0x20], xmm0
pshuflw xmm0, xmmword [rsp + 0x20], 0
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [rsp + 0x20]
pshufd xmm0, xmm0, 0
movdqa xmmword [rsp + 0x20], xmm0
mov rax, qword [rsp + 0x50]
and rax, 0xfff
cmp rax, 0xff0
ja 0x1400ef7f1
mov rax, qword [rsp + 0x50]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [rsp + 0x10]
pxor xmm0, xmmword [rsp + 0x10]
movdqa xmmword [rsp + 0x10], xmm0
movdqa xmm0, xmmword [rsp + 0x10]
pcmpeqw xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x10], xmm0
movdqa xmm0, xmmword [rsp + 0x30]
pcmpeqw xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [rsp + 0x10]
por xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x10], xmm0
movdqa xmm0, xmmword [rsp + 0x10]
pmovmskb eax, xmm0
mov dword [rsp], eax
cmp dword [rsp], 0
je 0x1400ef7e1
mov eax, dword [rsp]
bsf eax, eax
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
add rax, qword [rsp + 0x50]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x58]
cmp eax, ecx
jne 0x1400ef7d1
mov rax, qword [rsp + 0x50]
mov qword [rsp + 8], rax
jmp 0x1400ef7da
mov qword [rsp + 8], 0
mov rax, qword [rsp + 8]
jmp 0x1400ef82c
mov rax, qword [rsp + 0x50]
add rax, 0x10
mov qword [rsp + 0x50], rax
jmp 0x1400ef827
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x58]
cmp eax, ecx
jne 0x1400ef809
mov rax, qword [rsp + 0x50]
jmp 0x1400ef82c
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
test eax, eax
jne 0x1400ef819
xor eax, eax
jmp 0x1400ef82c
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
jmp 0x1400ef71b
add rsp, 0x48
ret
Function at 0x1400d06e0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.140001979
sub rsp, rax
mov rax, qword [0x14013e010]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x140141160]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1400d08d2
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x1400d0826
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1400d0826
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x1400d080b
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x1400d07a8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400d0892
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1400d08f1
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x1400d08cd
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1400d08f1
jmp 0x1400d077e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140002941
add rsp, 0x1498
pop rdi
pop rsi
ret