joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140030de0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0x88
mov rax, qword [0x14008f040]
xor rax, rsp
mov qword [rbp + 7], rax
mov qword [rbp - 0x49], r9
mov r15, r8
mov r13, rdx
mov r14, rcx
xor esi, esi
mov dword [rbp - 0x51], esi
mov qword [rbp - 0x41], rdx
mov rbx, rdx
lea rax, [r8 - 1]
mov qword [rbp - 0x51], rax
mov r12, rax
sar r12, 1
cmp rdx, r12
jge 0x140030ead
lea rdi, [rbx + rbx]
lea rbx, [rdi + 2]
shl rbx, 5
add rbx, r14
lea rdx, [rbx - 0x20]
lea rcx, [rbp - 0x19]
call fcn.1400050c4
or esi, 1
mov rdx, rbx
lea rcx, [rbp - 0x39]
call fcn.1400050c4
or esi, 2
lea r8, [rbp - 0x19]
lea rdx, [rbp - 0x39]
call fcn.14002ff68
movzx ebx, al
lea rcx, [rbp - 0x39]
call fcn.140005060
nop
lea rcx, [rbp - 0x19]
call fcn.140005060
xor rbx, 1
inc rbx
add rbx, rdi
mov rdx, rbx
shl rdx, 5
add rdx, r14
shl r13, 5
lea rcx, [r14 + r13]
call fcn.140009d20
mov r13, rbx
cmp rbx, r12
jl 0x140030e33
mov rdi, rbx
cmp rbx, r12
jne 0x140030ed7
test r15b, 1
jne 0x140030ed7
shl r15, 5
lea rdx, [r14 - 0x20]
add rdx, r15
shl rbx, 5
lea rcx, [r14 + rbx]
call fcn.140009d20
mov rdi, qword [rbp - 0x51]
lea rbx, [rdi - 1]
mov r12, qword [rbp - 0x49]
mov r13, qword [rbp - 0x41]
sar rbx, 1
cmp r13, rdi
jge 0x140030f32
mov rdx, r12
lea rcx, [rbp - 0x39]
call fcn.1400050c4
or esi, 0x10
or esi, 4
mov dword [rbp - 0x51], esi
mov rdx, rbx
shl rdx, 5
add rdx, r14
lea rcx, [rbp - 0x19]
call fcn.1400050c4
or esi, 0x20
or esi, 8
mov dword [rbp - 0x51], esi
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.14002ff68
test al, al
je 0x140030f32
mov r15b, 1
jmp 0x140030f35
xor r15b, r15b
test sil, 8
je 0x140030f48
and esi, 0xfffffff7
lea rcx, [rbp - 0x19]
call fcn.140005060
nop
test sil, 4
je 0x140030f5a
and esi, 0xfffffffb
lea rcx, [rbp - 0x39]
call fcn.140005060
shl rdi, 5
lea rcx, [rdi + r14]
test r15b, r15b
je 0x140030f81
mov rdx, rbx
shl rdx, 5
add rdx, r14
call fcn.140009d20
mov rdi, rbx
dec rbx
jmp 0x140030ee3
mov rdx, r12
call fcn.140009d20
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.140072730
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x140033120
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x14003317a
mov r11b, 0x23
lea rdi, [0x14007aaf0]
movzx ebx, byte [r10]
dec rdx
inc r10
cmp bl, r11b
jne 0x140033164
cmp rdx, 2
jb 0x140033164
cmp byte [r10], r11b
jne 0x140033164
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rbx
shr r9d, 8
xor r9d, dword [rdi + rcx*4]
test rdx, rdx
jne 0x140033142
jmp 0x1400331bb
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x1400331bb
mov r11b, 0x23
lea rdi, [0x14007aaf0]
cmp dl, r11b
jne 0x14003319f
cmp byte [r10], r11b
jne 0x14003319f
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rdi + rcx*4]
test dl, dl
jne 0x14003318d
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret
Function at 0x1400332f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
test r8, r8
je 0x140033310
and qword [r8], 0
lea rdx, [0x1400819cc]
call fcn.1400331cc
mov rbx, rax
test rax, rax
je 0x140033401
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x1400333f8
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400333f8
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1400333f8
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400333f8
mov rbp, rdi
cmp rdi, 0xffffffffffffffff
je 0x1400333f8
mov rax, qword [0x14013c7b0]
test rax, rax
je 0x140033395
inc dword [rax + 0xf4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x1400333f8
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rbp
je 0x1400333e5
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14013c7b0]
test rax, rax
je 0x1400333da
dec dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140033401
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x1400333f3
mov qword [rsi], rbp
mov rax, rdi
jmp 0x140033403
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140035eb4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xe8]
mov r10d, 4
mov rax, qword [rcx + 0xf0]
mov r9d, r10d
mov ebx, dword [rax + r8*4 - 4]
lea r8, [rsp + 0x38]
not ebx
movzx eax, byte [r8]
inc r8
movzx ecx, bl
xor rcx, rax
shr ebx, 8
lea rax, [0x14007aaf0]
xor ebx, dword [rax + rcx*4]
sub r9, 1
jne 0x140035ee0
mov rcx, qword [0x14013c7b0]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x140035f1e
movsxd r8, edx
mov ecx, ebx
mov edx, r10d
call fcn.140046cb8
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x140035f28
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x18
movss xmm2, dword [rcx + 0x108]
lea r9, [rsp]
movss xmm3, dword [rcx + 0x10c]
mov r10d, 0x10
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
mov rax, qword [rcx + 0xf0]
subss xmm1, xmm3
movsxd rcx, dword [rcx + 0xe8]
movss dword [rsp], xmm0
movss xmm0, dword [rdx + 8]
mov r8d, dword [rax + rcx*4 - 4]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
not r8d
movss xmm1, dword [rdx + 0xc]
subss xmm1, xmm3
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
movzx ecx, byte [r9]
lea rax, [0x14007aaf0]
movzx edx, r8b
inc r9
xor rdx, rcx
shr r8d, 8
xor r8d, dword [rax + rdx*4]
sub r10, 1
jne 0x140035f96
not r8d
mov eax, r8d
add rsp, 0x18
ret
Function at 0x140045954
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c50], 0
lea rbx, [rcx + 0x5c58]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x1400459ed
mov r9d, dword [rbx + 4]
test r9d, r9d
jns 0x1400459a5
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140047c10
and dword [rbx], 0
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call fcn.140033c9c
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c50]
lea ecx, [rax - 1]
neg eax
sbb eax, eax
and eax, ecx
lea rcx, [0x14013c7ac]
movsxd r8, eax
mov rax, qword [rdi + 0x5c60]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x1400459f5
mov rcx, rbx
call fcn.140033c9c
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400461d4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x14013c7b0]
mov rbx, rcx
and dword [rax + 0x5bb4], 0
test rcx, rcx
je 0x14004623d
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.140046248
lea rdx, [0x1400819e4]
mov rcx, rbx
mov rdi, rax
call fcn.1400331cc
mov rbx, rax
test rax, rax
je 0x14004623d
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140071ef0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x40
mov r14, rdx
lea rdx, [0x14013b4c0]
cmp qword [0x14013b4d8], 0xf
cmova rdx, qword [0x14013b4c0]
movabs rdi, 0xcbf29ce484222325
xor ecx, ecx
mov r8, qword [0x14013b4d0]
test r8, r8
je 0x140071f54
movzx eax, byte [rcx + rdx]
xor rdi, rax
movabs r9, 0x100000001b3
imul rdi, r9
inc rcx
cmp rcx, r8
jb 0x140071f37
mov r9, rdi
lea r8, [0x14013b4c0]
lea rdx, [rsp + 0x20]
call fcn.140072660
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x140071f7f
mov qword [r14], rax
mov byte [r14 + 8], 0
jmp 0x1400720d3
movabs rax, 0x3ffffffffffffff
cmp qword [0x14013e340], rax
jne 0x140071fa0
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [0x14013e338]
mov qword [rsp + 0x30], rax
and qword [rsp + 0x38], 0
mov ecx, 0x40
call fcn.140072750
mov rsi, rax
mov qword [rsp + 0x38], rax
lea rdx, [0x14013b4c0]
lea rcx, [rax + 0x10]
call fcn.14000548c
xor eax, eax
mov qword [rsi + 0x30], rax
mov dword [rsi + 0x38], eax
mov r8, qword [0x14013e340]
lea rcx, [r8 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x140071ff7
cvtsi2ss xmm0, rcx
jmp 0x14007200c
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x14013e368]
xorps xmm1, xmm1
test rcx, rcx
js 0x140072022
cvtsi2ss xmm1, rcx
jmp 0x140072037
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x14013e330]
seta al
test al, al
je 0x14007206f
call fcn.140072380
lea r8, [rsi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x30]
call fcn.140072660
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x20], xmm0
mov r8, qword [0x14013e340]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 8]
inc r8
mov qword [0x14013e340], r8
mov qword [rsi], rcx
mov qword [rsi + 8], rdx
mov qword [rdx], rsi
mov qword [rcx + 8], rsi
and rdi, qword [0x14013e360]
add rdi, rdi
mov rax, qword [0x14013e348]
mov r8, qword [rax + rdi*8]
cmp r8, qword [0x14013e338]
jne 0x1400720b4
mov qword [rax + rdi*8], rsi
jmp 0x1400720c6
cmp r8, rcx
jne 0x1400720bf
mov qword [rax + rdi*8], rsi
jmp 0x1400720cb
cmp qword [rax + rdi*8 + 8], rdx
jne 0x1400720cb
mov qword [rax + rdi*8 + 8], rsi
mov qword [r14], rsi
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
Function at 0x1400720ec
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x40
mov r14, r8
mov rsi, rdx
mov rdx, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x140072114
mov rdx, qword [r8]
movabs rbx, 0xcbf29ce484222325
xor ecx, ecx
cmp qword [r8 + 0x10], rcx
jbe 0x140072144
movzx eax, byte [rcx + rdx]
xor rbx, rax
movabs r8, 0x100000001b3
imul rbx, r8
inc rcx
cmp rcx, qword [r14 + 0x10]
jb 0x140072126
mov r9, rbx
mov r8, r14
lea rdx, [rsp + 0x20]
call fcn.140072660
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x14007216a
mov qword [rsi], rax
mov byte [rsi + 8], 0
jmp 0x1400722e0
movabs rax, 0x3ffffffffffffff
cmp qword [0x14013e340], rax
jne 0x14007218b
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [0x14013e338]
mov qword [rsp + 0x30], rax
and qword [rsp + 0x38], 0
mov ecx, 0x40
call fcn.140072750
mov rdi, rax
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
and qword [rax + 0x20], 0
and qword [rax + 0x28], 0
movups xmm0, xmmword [r14]
movups xmmword [rax + 0x10], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rax + 0x20], xmm1
and qword [r14 + 0x10], 0
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
xor eax, eax
mov qword [rdi + 0x30], rax
mov dword [rdi + 0x38], eax
mov r8, qword [0x14013e340]
lea rcx, [r8 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x140072205
cvtsi2ss xmm0, rcx
jmp 0x14007221a
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x14013e368]
xorps xmm1, xmm1
test rcx, rcx
js 0x140072230
cvtsi2ss xmm1, rcx
jmp 0x140072245
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x14013e330]
seta al
test al, al
je 0x14007227d
call fcn.140072380
lea r8, [rdi + 0x10]
mov r9, rbx
lea rdx, [rsp + 0x30]
call fcn.140072660
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x20], xmm0
mov r8, qword [0x14013e340]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 8]
inc r8
mov qword [0x14013e340], r8
mov qword [rdi], rcx
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rcx + 8], rdi
and rbx, qword [0x14013e360]
add rbx, rbx
mov rax, qword [0x14013e348]
mov r8, qword [rax + rbx*8]
cmp r8, qword [0x14013e338]
jne 0x1400722c2
mov qword [rax + rbx*8], rdi
jmp 0x1400722d4
cmp r8, rcx
jne 0x1400722cd
mov qword [rax + rbx*8], rdi
jmp 0x1400722d9
cmp qword [rax + rbx*8 + 8], rdx
jne 0x1400722d9
mov qword [rax + rbx*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
Function at 0x1400733b0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400733fa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400733fa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400733fa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400733fa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400733fa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400733fc
xor al, al
add rsp, 0x28
ret

Function at 0x1400735f0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14007362a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14007362f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140073678
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140078cd0]
cmp byte [rcx + rax], 0
je 0x140073678
dec r8
sub rdx, 1
jne 0x14007365e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140011a30
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rbx, qword [0x140020c80]
mov rdi, qword [0x140020ca0]
lea rsi, [0x140020320]
movq xmm0, rsi
mov rcx, qword [rbx]
movq xmm6, rdi
punpcklqdq xmm6, xmm0
test rcx, rcx
je 0x140011a86
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140011ab0
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x140020c90]
cmp byte [rax], 0
jne 0x140011ac0
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x140011a7d
mov edx, 0x414
lea r12, [rsp + 0x20]
mov qword [rsp + 0x20], 0
mov rbp, qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [rsp + 0x28], 3
mov rcx, r12
mov ebx, 0x14
mov word [rsp + 0x40], dx
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], rsi
movaps xmmword [rsp + 0x30], xmm6
call rbp
mov r13, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140011b74
test al, 0x10
je 0x140011a92
mov ecx, 0x64
call r14
mov eax, 0x414
mov qword [rsp + 0x50], rsi
mov rcx, r12
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 3
mov word [rsp + 0x40], ax
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
movaps xmmword [rsp + 0x30], xmm6
call rbp
sub ebx, 1
je 0x140011a92
mov rcx, rdi
call r13
cmp eax, 0xffffffff
jne 0x140011b20
jmp 0x140011a92

Function at 0x140015b30
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.14001ca30
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.14001ca30
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
Function at 0x1400167e2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140036248]
test eax, eax
je 0x14001687a
lea rax, [0x140036220]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140036250]
mov qword [rbp - 8], rax
jmp 0x14001685e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140016852
cmp qword [rbp - 0x10], 0
je 0x140016852
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140016818
lea rax, [0x140036220]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14001687b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140016980
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400169a8
mov eax, 0
jmp 0x1400169f6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400169d1
mov eax, 0
jmp 0x1400169f6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x1400169f1
mov eax, 0
jmp 0x1400169f6
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x1400169fc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x140016a7a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140016a71
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140016a71
mov rax, qword [rbp - 8]
jmp 0x140016a8f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140016a44
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x100411cb0
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [rsi], dword [rdi]
xor eax, 0x6f363548
cmp dl, byte [rbx]
cld
invalid
Function at 0x140001320
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
lea rax, [rsp + 0x30]
mov rdi, rcx
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
mov r9d, 0x20006
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test eax, eax
je 0x1400013a6
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, [0x1400044a0]
call fcn.140001e70
mov edx, esi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
mov rcx, rax
lea rdx, [0x140002050]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor al, al
jmp 0x140001437
cmp qword [rbx + 0x18], 7
mov rcx, rbx
jbe 0x1400013b3
mov rcx, qword [rbx]
cmp qword [rdi + 0x18], 7
jbe 0x1400013bd
mov rdi, qword [rdi]
mov eax, dword [rbx + 0x10]
mov r9d, 1
xor r8d, r8d
mov rdx, rdi
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x140001412
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, [0x1400044f0]
call fcn.140001e70
mov edx, ebx
jmp 0x140001386
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [0x140004570]
call fcn.140001e70
mov rcx, rax
lea rdx, [0x140002050]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140002230
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x140002bb0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002bfa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002bfa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002bfa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002bfa
cmp dword [rcx + 0x84], 0xe
jbe 0x140002bfa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002bfc
xor al, al
add rsp, 0x28
ret