joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007d639
Capabilities:
Parse pe header

Disassembly:
jmp 0x140092530
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140092550
xor al, al
jmp 0x1400925d1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140092563
xor al, al
jmp 0x1400925d1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14009258d
xor al, al
jmp 0x1400925d1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400925a1
xor al, al
jmp 0x1400925d1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400925b3
xor al, al
jmp 0x1400925d1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400925cf
xor al, al
jmp 0x1400925d1
mov al, 1
add rsp, 0x38
ret
Function at 0x14007db98
Capabilities:
Terminate process

Disassembly:
jmp 0x1400b6cc0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1400b6cee
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.14007e3d1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14007e42b
Capabilities:
Print debug messages

Disassembly:
jmp 0x14012e8a0
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x14007e4f3
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1400b5960
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1400b52b0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400b59a9
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1401ce020]
jmp 0x1400b59b8
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x14007e5bb
Capabilities:
Set environment variable

Disassembly:
jmp 0x14016b4a0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.14007c4c3
lea rcx, [rsp + 0x48]
call fcn.14007c4c3
call fcn.14007cddd
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.14007c298
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14016b50f
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.14007c829
lea rcx, [rsp + 0x78]
call fcn.14007c829
mov eax, dword [rsp + 0x24]
jmp 0x14016b5a0
call fcn.14007cddd
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.14007c298
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x14016b556
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.14007c829
lea rcx, [rsp + 0x78]
call fcn.14007c829
mov eax, dword [rsp + 0x2c]
jmp 0x14016b5a0
lea rcx, [rsp + 0x48]
call fcn.14007c432
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.14007c432
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.14007c829
lea rcx, [rsp + 0x78]
call fcn.14007c829
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x14015c9e0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.14007b9d3
sub rsp, rax
mov rax, qword [0x1401ba040]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1401bd8e0]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x14015cbd2
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x14015cb26
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x14015cb26
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x14015cb0b
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x14015caa8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14015cb92
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14015cbf1
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x14015cbcd
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14015cbf1
jmp 0x14015ca7e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.14007cb17
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x14015cca0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.14007b9d3
sub rsp, rax
mov rax, qword [0x1401ba040]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1401bd8e0]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14015cead
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x14015cdf9
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14015cdf9
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x14015cdd9
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x14015cd68
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14015ce6d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14015cecc
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x14015cea8
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14015cecc
jmp 0x14015cd3e
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.14007cb17
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x140003258
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400032a2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400032a2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400032a2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400032a2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400032a2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400032a4
xor al, al
add rsp, 0x28
ret

Function at 0x140009778
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400095a4

Function at 0x140016130
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140016158
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140016158
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180001360
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x180061698
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x180111490]
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 3
lea r8, [0x180111488]
call fcn.180060ff0
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x1800616d8
call qword [0x180140010]
jmp 0x1800616de
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1800013e0
Capabilities:
Query environment variable

Disassembly:
jmp 0x1800943bc
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
mov rbx, rax
test rax, rax
je 0x180094490
mov rsi, rax
cmp word [rax], r14w
je 0x18009440f
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], r14w
jne 0x1800943f7
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], r14w
jne 0x1800943f3
mov qword [rsp + 0x38], r14
sub rsi, rbx
mov qword [rsp + 0x30], r14
add rsi, 2
sar rsi, 1
mov r8, rbx
mov r9d, esi
mov dword [rsp + 0x28], r14d
xor edx, edx
mov qword [rsp + 0x20], r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbp, eax
test eax, eax
je 0x180094490
mov rcx, rbp
call fcn.180003760
mov rdi, rax
test rax, rax
je 0x180094483
mov qword [rsp + 0x38], r14
mov r9d, esi
mov qword [rsp + 0x30], r14
mov r8, rbx
mov dword [rsp + 0x28], ebp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x180094483
mov rsi, rdi
mov rdi, r14
jmp 0x180094486
mov rsi, r14
mov rcx, rdi
call fcn.180009460
jmp 0x180094493
mov rsi, r14
test rbx, rbx
je 0x1800944a1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1800019a0
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x180061640
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x180111470]
mov ecx, 2
lea r8, [0x180111468]
lea rdx, str.FlsGetValue
call fcn.180060ff0
mov ecx, ebx
test rax, rax
je 0x18006167a
add rsp, 0x20
pop rbx
jmp qword [0x180140010]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x180002b80
Capabilities:
Query environment variable

Disassembly:
jmp 0x180094500
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
je 0x180094587
mov rbp, rax
cmp word [rax], si
je 0x180094549
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180094530
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18009452c
sub rbp, rbx
add rbp, 2
sar rbp, 1
add rbp, rbp
mov rcx, rbp
call fcn.180003760
mov rdi, rax
test rax, rax
je 0x180094577
mov r8, rbp
mov rdx, rbx
mov rcx, rax
call fcn.180006200
mov rsi, rdi
xor ecx, ecx
call fcn.180009460
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180002bb0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
jmp 0x180056398
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x180000000], ax
jne 0x180056426
movsxd rax, dword [0x18000003c]
lea rdx, [0x180000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x180056426
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x180056426
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x18005640d
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x180056407
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x18005640f
add rdx, 0x28
jmp 0x1800563ec
xor edx, edx
test rdx, rdx
jne 0x180056418
xor al, al
jmp 0x18005642c
cmp dword [rdx + 0x24], 0
jge 0x180056422
xor al, al
jmp 0x18005642c
mov al, 1
jmp 0x18005642c
xor al, al
jmp 0x18005642c
add rsp, 0x18
ret

Function at 0x180002e50
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x1800abe80
movsxd r8, dword [rcx + 0x3c]
xor r9d, r9d
add r8, rcx
mov r10, rdx
movzx eax, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rax, 0x18
add rax, r8
test r11d, r11d
je 0x1800abec1
mov edx, dword [rax + 0xc]
cmp r10, rdx
jb 0x1800abeb5
mov ecx, dword [rax + 8]
add ecx, edx
cmp r10, rcx
jb 0x1800abec3
inc r9d
add rax, 0x28
cmp r9d, r11d
jb 0x1800abea3
xor eax, eax
ret

Function at 0x1800030a0
Capabilities:
Get geographical location

Disassembly:
jmp 0x180096970
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, r9d
mov rdi, r8
mov esi, edx
lea r9, [0x180112e08]
mov rbp, rcx
lea r8, [0x180112e00]
lea rdx, str.GetLocaleInfoEx
mov ecx, 0xb
call fcn.180095d7c
mov rcx, rbp
test rax, rax
je 0x1800969c6
mov r9d, ebx
mov r8, rdi
mov edx, esi
call qword [0x180140010]
jmp 0x1800969dd
xor edx, edx
call fcn.180005120
mov ecx, eax
mov r9d, ebx
mov r8, rdi
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180004810
Capabilities:
Parse pe header

Disassembly:
jmp 0x1800abf40
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1800abf6a
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x1800abf6a
mov ecx, 0x20b
cmp word [rax + 0x18], cx
jne 0x1800abf6a
mov eax, 1
ret
xor eax, eax
ret

Function at 0x1800057f0
Capabilities:
Parse pe header

Disassembly:
jmp 0x180083348
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x180083113
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180083113
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x180083113
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x180083113
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x180083113
cmp dword [rcx + 0x84], 0xe
jbe 0x180083113
cmp dword [rcx + 0xf8], 0
je 0x180083113
mov ecx, ebx
call fcn.1800832a4
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.180082e08
cmp dword [rbp + 0x20], 0
je 0x180083160
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.180083198
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1800830ac

Function at 0x180005a70
Capabilities:
Terminate process

Disassembly:
jmp 0x180088a14
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x180088a2e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
lea ecx, [r8 + 1]
call fcn.180002a40
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1800063a0
Capabilities:
Terminate process

Disassembly:
jmp 0x18005533c
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x1800064f0
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x180061590
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x180111430]
xor ecx, ecx
lea r8, [0x180111428]
lea rdx, str.FlsAlloc
call fcn.180060ff0
test rax, rax
je 0x1800615c9
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [0x180140010]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x180007100
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x180096784
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x180112d40]
mov ecx, 5
lea r8, [0x180112d38]
lea rdx, str.FlsGetValue
call fcn.180095d7c
mov ecx, ebx
test rax, rax
je 0x1800967be
add rsp, 0x20
pop rbx
jmp qword [0x180140010]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x180007820
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1800967dc
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x180112d50]
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 6
lea r8, [0x180112d48]
call fcn.180095d7c
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x18009681c
call qword [0x180140010]
jmp 0x180096822
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180007b80
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1800966d0
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x180112d20]
mov ecx, 3
lea r8, [0x180112d18]
lea rdx, str.FlsAlloc
call fcn.180095d7c
test rax, rax
je 0x18009670c
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [0x180140010]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x180008560
Capabilities:
Parse pe header

Disassembly:
jmp 0x180083358
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x1800830ac

Function at 0x180008d00
Capabilities:
Print debug messages

Disassembly:
jmp 0x1800aa9ec
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rbp, rdx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
setne sil
test eax, eax
je 0x1800aaa37
test rbx, rbx
je 0x1800aaa26
mov rcx, rbx
call fcn.1800095e0
call fcn.1800018c0
cmp eax, 1
je 0x1800aaa37
mov eax, 4
jmp 0x1800aaa7a
call fcn.180005d50
cmp eax, 2
jne 0x1800aaa73
call fcn.180001d50
test al, al
je 0x1800aaa73
call fcn.1800089a0
test al, al
jne 0x1800aaa69
bts edi, 0x15
xor ecx, ecx
mov rdx, rbx
mov r8, rbp
mov r9d, edi
call fcn.180006d50
jmp 0x1800aaa7a
call fcn.180003980
mov rcx, rax
jmp 0x1800aaa59
movzx eax, sil
add eax, 3
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180082a10
Capabilities:
Encode data using xor

Disassembly:
jmp 0x180082a10
mov rax, rcx
neg rcx
test rax, 7
je 0x180082a2d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x180082a88
test al, 7
jne 0x180082a20
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x180082a41
mov rdx, qword [rax - 8]
test dl, dl
je 0x180082ab2
test dh, dh
je 0x180082aac
shr rdx, 0x10
test dl, dl
je 0x180082aa6
test dh, dh
je 0x180082aa0
shr rdx, 0x10
test dl, dl
je 0x180082a9a
test dh, dh
je 0x180082a94
shr edx, 0x10
test dl, dl
je 0x180082a8e
test dh, dh
jne 0x180082a41
lea rax, [rcx + rax - 1]
ret
lea rax, [rcx + rax - 2]
ret
lea rax, [rcx + rax - 3]
ret
lea rax, [rcx + rax - 4]
ret
lea rax, [rcx + rax - 5]
ret
lea rax, [rcx + rax - 6]
ret
lea rax, [rcx + rax - 7]
ret
lea rax, [rcx + rax - 8]
ret
Function at 0x140003430
Capabilities:
Delete file
Encode data using xor

Disassembly:
sub rsp, 0x68
cmp byte [0x14019faf3], 0
movups xmm0, xmmword [0x14019fad8]
mov eax, dword [0x14019faf0]
mov dword [rsp + 0x48], eax
movups xmmword [rsp + 0x30], xmm0
movsd xmm0, qword [0x14019fae8]
movsd qword [rsp + 0x40], xmm0
je 0x1400035ff
xor ecx, ecx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x1400035c1
movdqa xmm0, xmmword [0x1401a0e50]
lea rdx, [rsp + 0x34]
movdqa xmm5, xmmword [0x1401a0db0]
movdqa xmm4, xmmword [0x1401a0eb0]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x1401a0dd0]
nop dword [rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1401a0e10]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1401a0e10]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x18
jl 0x1400034b0
movaps xmm6, xmmword [rsp + 0x50]
cmp ecx, 0x1c
jge 0x1400035ff
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
nop dword [rax]
mov eax, 0xa0a0a0a1
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x33
movzx eax, cl
inc ecx
sub al, dl
add al, 0x35
xor byte [r8 - 1], al
cmp ecx, 0x1c
jl 0x1400035d0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add rsp, 0x68
ret