joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140016fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov byte [rax + 0x18], r8b
push rdi
push r14
push r15
sub rsp, 0x80
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rbx, r9
mov rdi, rdx
mov rsi, rcx
xor r15b, r15b
mov r11, qword [rcx]
mov r10, qword [r11 + 8]
mov r8b, 1
mov r14d, 1
nop
cmp byte [r10 + 0x19], 0
jne 0x1400170d5
mov r11, r10
test r15b, r15b
je 0x14001707d
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0x58], rax
mov rcx, qword [r10 + 0x40]
mov qword [rsp + 0x60], rcx
mov rdx, rcx
shr rdx, 0x20
mov r9, rax
shr r9, 0x20
cmp edx, r9d
jne 0x140017069
cmp ecx, eax
jne 0x140017061
xor r8d, r8d
jmp 0x140017074
or r8d, 0xffffffff
cmp ecx, eax
jmp 0x140017070
or r8d, 0xffffffff
cmp edx, r9d
cmova r8d, r14d
shr r8d, 0x1f
xor r8b, r14b
jmp 0x1400170c2
mov rax, qword [r10 + 0x40]
mov qword [rsp + 0x68], rax
mov rcx, qword [rbx + 0x20]
mov qword [rsp + 0x40], rcx
mov rdx, rcx
shr rdx, 0x20
mov r9, rax
shr r9, 0x20
cmp edx, r9d
jne 0x1400170b3
cmp ecx, eax
jne 0x1400170ab
xor r8d, r8d
jmp 0x1400170be
or r8d, 0xffffffff
cmp ecx, eax
jmp 0x1400170ba
or r8d, 0xffffffff
cmp edx, r9d
cmova r8d, r14d
shr r8d, 0x1f
test r8b, r8b
je 0x1400170cc
mov r10, qword [r10]
jmp 0x1400170d0
mov r10, qword [r10 + 0x10]
jmp 0x140017020
mov rax, r11
mov qword [rsp + 0x38], rax
test r8b, r8b
je 0x14001718a
mov rcx, qword [rsi]
cmp r11, qword [rcx]
jne 0x14001713c
mov byte [rsp + 0xb0], r14b
movzx eax, byte [rsp + 0xc0]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], rbx
mov r9, r11
movzx r8d, r14b
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1400172f0
mov rcx, qword [rax]
mov qword [rdi], rcx
lea rcx, [rsp + 0xb0]
call fcn.1400051d0
movzx ecx, byte [rax]
mov byte [rdi + 8], cl
mov rax, rdi
jmp 0x140017211
cmp byte [r11 + 0x19], 0
je 0x140017149
mov rax, qword [r11 + 0x10]
jmp 0x140017185
mov rcx, qword [r11]
cmp byte [rcx + 0x19], 0
jne 0x140017164
mov rax, rcx
mov rcx, qword [rax + 0x10]
cmp byte [rcx + 0x19], 0
jne 0x140017185
mov rax, rcx
jmp 0x140017155
mov rcx, qword [rax + 8]
cmp byte [rcx + 0x19], 0
jne 0x14001717d
cmp rax, qword [rcx]
jne 0x14001717d
mov rax, rcx
mov qword [rsp + 0x38], rcx
jmp 0x140017164
cmp byte [rax + 0x19], 0
cmove rax, rcx
mov qword [rsp + 0x38], rax
mov rcx, qword [rbx + 0x20]
mov qword [rsp + 0x70], rcx
mov rdx, qword [rax + 0x40]
mov qword [rsp + 0x48], rdx
mov r9, rdx
shr r9, 0x20
mov r10, rcx
shr r10, 0x20
cmp r9d, r10d
jne 0x1400171b3
cmp edx, ecx
je 0x1400171f6
ja 0x1400171f6
mov byte [rsp + 0x30], r14b
movzx eax, byte [rsp + 0xc0]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], rbx
mov r9, r11
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.1400172f0
mov rcx, qword [rax]
mov qword [rdi], rcx
lea rcx, [rsp + 0x30]
call fcn.1400051d0
movzx ecx, byte [rax]
mov byte [rdi + 8], cl
mov rax, rdi
jmp 0x140017211
mov byte [rsp + 0x31], 0
mov qword [rdi], rax
lea rcx, [rsp + 0x31]
call fcn.1400051d0
movzx ecx, byte [rax]
mov byte [rdi + 8], cl
mov rax, rdi
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140017c80
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xa0
mov qword [rbp - 0x39], 0xfffffffffffffffe
mov qword [rsp + 0xe0], rbx
mov r14, r9
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
xor r15d, r15d
mov dword [rbp - 0x41], r15d
lea rcx, [rbp - 0x19]
call fcn.14000af20
nop
mov qword [rbp - 0x31], r15
mov dword [rbp - 0x29], r15d
mov qword [rbp - 0x21], r15
mov rcx, rbx
call fcn.140007530
mov qword [rbp + 0x67], r15
lea rcx, [rbp + 0x67]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140017e34
mov dword [rbp - 0x29], r15d
mov rdi, qword [rbp + 0x67]
mov qword [rbp - 0x31], rdi
mov dword [rbp - 0x29], r15d
xor r8d, r8d
mov edx, 0x400
lea rcx, [rbp + 7]
call fcn.14000aef0
nop
lea rcx, [rbp + 7]
call fcn.1400051d0
mov rbx, rax
cmp qword [rax + 0x18], 8
jb 0x140017d3b
mov rbx, qword [rax]
mov rcx, r14
call fcn.140007530
mov dword [rbp + 0x7f], 0x800
lea rcx, [rbp + 0x7f]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x67]
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140017dda
mov eax, dword [rbp + 0x67]
dec eax
cmp eax, 1
ja 0x140017dda
test rbx, rbx
je 0x140017d9a
mov eax, dword [rbp + 0x7f]
test eax, eax
je 0x140017d96
test al, 1
jne 0x140017dda
shr rax, 1
cmp word [rbx + rax*2 - 2], 0
je 0x140017d9a
jmp 0x140017dda
mov word [rbx], r15w
lea rcx, [rbp + 7]
call fcn.140007530
mov rdx, rax
mov rcx, rsi
call fcn.140005160
mov dword [rbp - 0x41], 1
lea rcx, [rbp + 7]
call fcn.140005110
nop
test rdi, rdi
je 0x140017e90
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x31], r15
jmp 0x140017e90
lea rdx, [rbp + 0x7f]
mov rcx, rsi
call fcn.1400051e0
mov rcx, rsi
call fcn.140005520
mov qword [rax], 7
mov rcx, rsi
call fcn.1400051d0
mov word [rbp + 0x7f], r15w
mov qword [rax + 0x10], r15
cmp qword [rax + 0x18], 8
jb 0x140017e10
mov rax, qword [rax]
lea rdx, [rbp + 0x7f]
mov rcx, rax
call fcn.1400029a0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x19]
mov rcx, rsi
call fcn.140005530
jmp 0x140017dae
lea rdx, [rbp + 0x7f]
mov rcx, rsi
call fcn.1400051e0
mov rcx, rsi
call fcn.140005520
mov qword [rax], 7
mov rcx, rsi
call fcn.1400051d0
mov word [rbp + 0x7f], r15w
mov qword [rax + 0x10], r15
cmp qword [rax + 0x18], 8
jb 0x140017e6a
mov rax, qword [rax]
lea rdx, [rbp + 0x7f]
mov rcx, rax
call fcn.1400029a0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x19]
mov rcx, rsi
call fcn.140005530
mov dword [rbp - 0x41], 1
mov dword [rbp - 0x29], r15d
lea rcx, [rbp - 0x19]
call fcn.140005110
mov rax, rsi
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140017ec0
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x60
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rsi, r9
mov rbp, r8
mov rbx, rcx
xor r14d, r14d
mov qword [rax - 0x20], r14
mov dword [rax - 0x18], r14d
mov qword [rax - 0x10], r14
mov rcx, rdx
call fcn.140007530
mov r8, rax
mov dword [rsp + 0x28], 0x2001f
mov rdx, qword [rbx]
lea rcx, [rsp + 0x48]
call fcn.1400180d0
mov ebx, eax
test eax, eax
jne 0x140017f71
mov rcx, rsi
call fcn.140007530
mov rbx, rax
mov rcx, rbp
call fcn.140007530
mov rdx, rax
test rbx, rbx
jne 0x140017f3c
lea ebx, [r14 + 0xd]
jmp 0x140017f71
or rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp word [rbx + rax*2], 0
jne 0x140017f40
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
cmp qword [rsp + 0x48], 0
je 0x140017f89
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], r14
mov eax, ebx
mov dword [rsp + 0x50], r14d
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop r14
ret
Function at 0x1400185b0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x60
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rsi, rcx
lea rdi, [rcx + 0x28]
mov rcx, qword [rdi]
xor ebp, ebp
test rcx, rcx
je 0x1400185e9
mov qword [rdi], rbp
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x88], rbp
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
lea r9, [0x140079c80]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x1400691e0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
jne 0x140018717
mov r14, qword [rsp + 0x88]
lea ecx, [rax + 0x18]
call fcn.14001ce60
mov rbx, rax
mov qword [rsp + 0x80], rax
test rax, rax
je 0x14001866d
mov qword [rax + 8], rbp
mov dword [rax + 0x10], 1
lea rcx, str.._rootHPInstrumentedBIOS
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x140018670
mov ecx, 0x8007000e
call fcn.14001db40
int3
mov rbx, rbp
mov qword [rsp + 0x80], rbx
test rbx, rbx
jne 0x140018688
mov ecx, 0x8007000e
call fcn.14001db40
nop
mov rax, qword [r14]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, r14
call qword [rax + SafeArrayPutElement]
mov ebx, eax
lea rcx, [rsp + 0x80]
call fcn.140018d80
test ebx, ebx
jne 0x140018717
movzx eax, word [str.._rootHPInstrumentedBIOS]
neg ax
sbb r8, r8
and r8d, 0x1c
lea rcx, [rsi + 8]
lea rdx, str.._rootHPInstrumentedBIOS
call fcn.140005270
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
lea edx, [rbx + 0xa]
mov rcx, qword [rdi]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov ebx, eax
test eax, eax
je 0x140018729
mov rcx, qword [rdi]
test rcx, rcx
je 0x140018729
mov qword [rdi], rbp
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x14001873c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x14001ee44
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14001ee57
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.14001f4bc
lea rdx, [0x140089a90]
lea rcx, [rsp + 0x20]
call fcn.14003d338
int3

Function at 0x14002b260
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x14008f838]
xor edx, edx
jmp fcn.14001ee44

Function at 0x14002bc50
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x14008f838]
jmp fcn.14001ee44
Function at 0x140042870
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x140042644
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140042644
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140042644
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140042644
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140042644
cmp dword [rcx + 0x84], 0xe
jbe 0x140042644
cmp dword [rcx + 0xf8], esi
je 0x140042644
mov ecx, r14d
call fcn.14004278c
mov ecx, 2
call fcn.140042c28
nop
cmp byte [0x14008fb30], 0
jne 0x14004270e
mov r15d, 1
mov eax, r15d
xchg dword [0x14008fb20], eax
test ebx, ebx
jne 0x1400426b7
mov rdi, qword [0x14008c088]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14008fb28]
cmp rcx, rax
je 0x1400426ae
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.1400051b0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14008ff80]
jmp 0x1400426c3
cmp ebx, r15d
jne 0x1400426c9
lea rcx, [0x14008ff98]
call fcn.1400498c4
nop
test ebx, ebx
jne 0x1400426e0
lea rdx, [0x140061960]
lea rcx, [0x140061938]
call fcn.140049c64
lea rdx, [0x140061970]
lea rcx, [0x140061968]
call fcn.140049c64
movzx eax, byte [0x14008fb30]
test esi, esi
cmove eax, r15d
mov byte [0x14008fb30], al
jmp 0x14004270e
mov ecx, 2
call fcn.140042c7c
test esi, esi
jne 0x140042725
mov ecx, r14d
call fcn.140042740
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400425d4

Function at 0x14004c834
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, r9d
mov rsi, r8
mov ebp, edx
lea r9, [0x14006d8f8]
mov r14, rcx
lea r8, [0x14006d8f0]
lea rdx, str.GetLocaleInfoEx
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
call fcn.14004c38c
mov rbx, rax
test rax, rax
je 0x14004c897
mov rcx, rax
call qword [fcn.1400051b0]
mov r9d, edi
mov r8, rsi
mov edx, ebp
mov rcx, r14
call rbx
jmp 0x14004c8b1
xor edx, edx
mov rcx, r14
call fcn.14004cb9c
mov ecx, eax
mov r9d, edi
mov r8, rsi
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14004ffdc
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x14004fc98
call fcn.140042bc0
mov dword [rax], SafeArrayPutElement
call fcn.140042530
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14004fc80
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x14004fc80
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x14004fcca
lock or dword [rax + 0x14], 0x10
jmp 0x14004fc80
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x14004fce7
mov rcx, qword [rbp + 0x10]
call fcn.1400503d0
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14004e8e8
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1400532ac
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x14004fd3e
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x14004fc80
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x14004fdaa
mov rcx, qword [rbp + 0x10]
call fcn.14004e8e8
cmp eax, 0xffffffff
je 0x14004fd91
mov rcx, qword [rbp + 0x10]
call fcn.14004e8e8
cmp eax, 0xfffffffe
je 0x14004fd91
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14004e8e8
movsxd rdi, eax
lea rsi, [0x1400901c0]
mov rcx, rbx
sar rdi, 6
call fcn.14004e8e8
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x14004fd98
lea rax, [0x14008c3e0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14004fdaa
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x14004fde0
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x14004fddc
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x14004fddc
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x14004fc83
jmp 0x14004fc50
Function at 0x14004ffe4
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x14004fe4a
call fcn.140042bc0
mov dword [rax], SafeArrayPutElement
call fcn.140042530
mov eax, 0xffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14004fe2c
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x14004fe2c
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x20]
shr ecx, 1
test cl, 1
je 0x14004fe7c
lock or dword [rax + 0x14], 0x10
jmp 0x14004fe2c
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x14004fe99
mov rcx, qword [rbp + 0x20]
call fcn.1400503d0
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x10], 1
jne 0x14004feae
mov rcx, qword [rax]
mov sil, 1
mov r14b, byte [rcx]
jmp 0x14004feb4
xor sil, sil
xor r14b, r14b
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.14004e8e8
mov rdx, qword [rbp + 0x20]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1400532ac
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x20]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 2
ja 0x14004ff07
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x20]
and dword [rax + 0x10], 0
jmp 0x14004fe2c
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x14004ff73
mov rcx, qword [rbp + 0x20]
call fcn.14004e8e8
cmp eax, 0xffffffff
je 0x14004ff5a
mov rcx, qword [rbp + 0x20]
call fcn.14004e8e8
cmp eax, 0xfffffffe
je 0x14004ff5a
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.14004e8e8
movsxd rdi, eax
lea r15, [0x1400901c0]
mov rcx, rbx
sar rdi, 6
call fcn.14004e8e8
and eax, 0x3f
shl rax, 6
add rax, qword [r15 + rdi*8]
jmp 0x14004ff61
lea rax, [0x14008c3e0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14004ff73
mov rax, qword [rbp + 0x20]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x20], 0x200
jne 0x14004ffa9
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x14004ffa5
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x14004ffa5
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
test sil, sil
je 0x14004ffc7
movzx edx, byte [rcx]
dec dword [rax + 0x10]
shl dx, 8
movzx ecx, r14b
or dx, cx
inc qword [rax]
jmp 0x14004ffd2
movzx edx, word [rcx]
add dword [rax + 0x10], 0xfffffffe
add qword [rax], 2
movzx eax, dx
jmp 0x14004fe31
jmp 0x14004fdf8
Function at 0x2fc4cdf30
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4cf010
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4ce932
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f1108]
test eax, eax
je 0x2fc4ce9ca
lea rax, [0x2fc4f10e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f1110]
mov qword [rbp - 8], rax
jmp 0x2fc4ce9ae
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4ce9a2
cmp qword [rbp - 0x10], 0
je 0x2fc4ce9a2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4ce968
lea rax, [0x2fc4f10e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4ce9cb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4cead0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4ceaf8
mov eax, 0
jmp 0x2fc4ceb46
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4ceb21
mov eax, 0
jmp 0x2fc4ceb46
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4ceb41
mov eax, 0
jmp 0x2fc4ceb46
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4ceb4c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4cebca
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4cebc1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4cebc1
mov rax, qword [rbp - 8]
jmp 0x2fc4cebdf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4ceb94
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x14076aad8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14076aae2
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x14076ab0b
pop rbp
sub rbp, 0x33
sub rbp, 0x76aad8
sub rsp, 0x20
jmp 0x14076ab2a
mov rax, 0x76aad8
add rax, rbp
add rax, 0x84
mov rcx, 0x647
mov rdx, 0x4c4f8707
xor byte [rax], dl
inc rax
dec rcx
jne 0x14076ab49
jmp 0x14076ab60
mov gs, r14
mov word [rsi + 0x707073b], cs
xchg r14b, r8b
clts
invalid