joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007bbd8
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1400812c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x14007bc59
mov r8, qword [0x1400812c0]
mov rcx, qword [0x14008122c]
lea edx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x1400812c8]
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [0x1400812b8]
jmp 0x14007bc45
mov rdx, qword [rbx + 0x18]
test rdx, rdx
je 0x14007bc42
mov rcx, qword [rbx + 0x10]
add rcx, rdi
call rdx
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14007bc30
lea rcx, [0x14007bb3c]
mov rdx, rdi
call fcn.14007cce0
mov rbx, qword [rsp + 0x30]
lea rax, [rdi + rsi]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14007bc70
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, ecx
mov rbp, r8
mov rdi, rdx
and ecx, 7
je 0x14007bc9a
mov eax, 8
sub eax, ecx
add ebx, eax
mov rcx, qword [0x1400812c0]
test rcx, rcx
jne 0x14007bcdd
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, qword [0x14008122c]
movsxd r8, ebx
mov edx, 8
mov dword [0x1400812c8], eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x1400812c8]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [0x1400812c0]
mov rsi, rcx
movsxd rax, ebx
add rcx, rax
mov qword [0x1400812c0], rcx
mov ecx, dword [0x1400812c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r9, qword [0x1400812c0]
mov rcx, qword [0x14008122c]
mov r8, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [0x1400812c8]
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test rdi, rdi
jne 0x14007bd31
test rbp, rbp
je 0x14007bd58
lea rcx, [0x1400812b8]
mov edx, 0x28
call fcn.14007c164
mov qword [rax], rsi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rbp
test rdi, rdi
je 0x14007bd58
lea rcx, [rbx + rsi]
call rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14007c280
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov ecx, dword [0x140080230]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
movsxd rax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x10]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
jne 0x14007c2e6
movsxd rax, dword [rsp + 0x20]
add rax, 0xa
mov r8, rax
xor edx, edx
mov rcx, qword [0x1400814a0]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
jmp 0x14007c311
movsxd rax, dword [rsp + 0x20]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x40]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1400814a0]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
movsxd rax, dword [rsp + 0x20]
xor edx, edx
mov ecx, 2
div rcx
movsxd rcx, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x28]
add rcx, qword [rdx]
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call fcn.14007c710
movsxd rax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret

Function at 0x14007c360
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
xor r8d, r8d
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [0x1400814a0], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140080230], eax
call fcn.14007cae0
add rsp, 0x28
ret

Function at 0x14007c3d0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov ecx, dword [0x140080230]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x14007c480
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x140080230]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x10]
add rax, 2
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret

Function at 0x14007c4b0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x140080230]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
add rax, qword [rcx + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
add rsp, 0x38
ret
Function at 0x14007c530
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov ecx, dword [0x140080230]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
cmp dword [rsp + 0x58], 0xffffffff
jne 0x14007c560
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x58], eax
movsxd rax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x10]
lea rax, [rcx + rax*2]
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 8]
sub rcx, 4
cmp rax, rcx
jl 0x14007c5d2
mov eax, dword [rsp + 0x20]
add eax, 0x4000
cdqe
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x28]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1400814a0]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
jmp 0x14007c630
mov rax, qword [rsp + 0x28]
cmp qword [rax + 8], 0x100000
jle 0x14007c630
cmp dword [rsp + 0x20], 0x100000
jge 0x14007c5f3
mov dword [rsp + 0x20], 0x100000
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x28]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1400814a0]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
movsxd rax, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
add rax, qword [rcx]
mov qword [rsp + 0x30], rax
movsxd rax, dword [rsp + 0x58]
movsxd rcx, dword [rsp + 0x50]
lea rax, [rax + rcx*2]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x14007c670
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov ecx, dword [0x140080230]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
cmp qword [rsp + 0x40], rax
jb 0x14007c6cb
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
add rax, qword [rcx + 0x10]
cmp qword [rsp + 0x40], rax
ja 0x14007c6cb
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
inc rax
jmp 0x14007c6cd
xor eax, eax
add rsp, 0x38
ret

Function at 0x14007c6e0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x140080230]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
lea rax, [rcx + rax - 1]
add rsp, 0x38
ret
Function at 0x14007c790
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x140080230]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0x40]
shl eax, 1
cdqe
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 0x10]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret

Function at 0x14007cae0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov r8d, 0x18
xor edx, edx
mov rcx, qword [0x1400814a0]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x20], rax
mov r8d, 0x10
xor edx, edx
mov rcx, qword [0x1400814a0]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x20]
mov qword [rcx], rax
mov rax, qword [rsp + 0x20]
mov qword [rax + 8], 0x10
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x10], 0
mov rdx, qword [rsp + 0x20]
mov ecx, dword [0x140080230]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x38
ret

Function at 0x14007cce0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
cmp dword [0x1400812d8], 0
mov r14, rdx
mov r15, rcx
lea rbx, [0x1400812e8]
jne 0x14007cd2d
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, rbx
mov dword [0x140081310], eax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x1400812d8], 1
mov ecx, dword [0x140081310]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbp, rax
test rax, rax
jne 0x14007ce02
mov rcx, qword [0x14008122c]
lea edx, [rax + 8]
lea r8d, [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x14007ce2d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x1400812e0]
test rax, rax
je 0x14007cd7d
mov qword [rax], rbp
mov rcx, rbx
mov qword [rbp + 8], rax
mov qword [0x1400812e0], rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
lea r9, [rbp + 0x20]
mov r8, rdi
mov rcx, rax
mov rdx, rbx
mov dword [rsp + 0x20], 0x100000
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp + 0x18]
lea r8, [0x14007ce48]
mov r9, rbp
mov dword [rsp + 0x28], 8
or dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
mov ecx, dword [0x140081310]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [0x14008122c]
xor edx, edx
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x14007ce2d
mov qword [rax + 8], r15
mov qword [rax + 0x10], r14
mov rcx, qword [rbp + 0x10]
mov qword [rax], rcx
mov qword [rbp + 0x10], rax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x403102
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov eax, ecx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov byte [rbp + 0x10], al
mov byte [rbp - 1], 0
jmp 0x40319b
mov byte [rbp - 2], 0
jmp 0x403191
movzx eax, byte [rbp - 1]
movzx edx, byte [rbp - 2]
mov rcx, qword [rbp + 0x18]
movsxd rdx, edx
cdqe
shl rax, 2
add rax, rcx
add rax, rdx
movzx r8d, byte [rax]
movzx eax, byte [rbp + 0x10]
lea edx, [rax*4]
movzx eax, byte [rbp - 1]
add eax, edx
lea edx, [rax*4]
movzx eax, byte [rbp - 2]
add eax, edx
cdqe
mov rdx, qword [rbp + 0x20]
add rax, rdx
movzx ecx, byte [rax]
movzx eax, byte [rbp - 1]
movzx edx, byte [rbp - 2]
xor r8d, ecx
mov rcx, qword [rbp + 0x18]
movsxd rdx, edx
cdqe
shl rax, 2
add rax, rcx
add rax, rdx
mov byte [rax], r8b
add byte [rbp - 2], 1
cmp byte [rbp - 2], 3
jbe 0x403123
add byte [rbp - 1], 1
cmp byte [rbp - 1], 3
jbe 0x40311d
nop
add rsp, 0x10
pop rbp
ret

Function at 0x4031ac
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov byte [rbp - 1], 0
jmp 0x40321f
mov byte [rbp - 2], 0
jmp 0x403215
movzx eax, byte [rbp - 2]
movzx edx, byte [rbp - 1]
mov rcx, qword [rbp + 0x10]
movsxd rdx, edx
cdqe
shl rax, 2
add rax, rcx
add rax, rdx
movzx eax, byte [rax]
movzx eax, al
movzx r8d, byte [rbp - 2]
movzx ecx, byte [rbp - 1]
cdqe
lea rdx, str.cw
movzx edx, byte [rax + rdx]
mov r9, qword [rbp + 0x10]
movsxd rcx, ecx
movsxd rax, r8d
shl rax, 2
add rax, r9
add rax, rcx
mov byte [rax], dl
add byte [rbp - 2], 1
cmp byte [rbp - 2], 3
jbe 0x4031c4
add byte [rbp - 1], 1
cmp byte [rbp - 1], 3
jbe 0x4031be
nop
add rsp, 0x10
pop rbp
ret

Function at 0x403cc1
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov byte [rbp - 1], 0
jmp 0x403d34
mov byte [rbp - 2], 0
jmp 0x403d2a
movzx eax, byte [rbp - 2]
movzx edx, byte [rbp - 1]
mov rcx, qword [rbp + 0x10]
movsxd rdx, edx
cdqe
shl rax, 2
add rax, rcx
add rax, rdx
movzx eax, byte [rax]
movzx eax, al
movzx r8d, byte [rbp - 2]
movzx ecx, byte [rbp - 1]
cdqe
lea rdx, [0x00407ae0]
movzx edx, byte [rax + rdx]
mov r9, qword [rbp + 0x10]
movsxd rcx, ecx
movsxd rax, r8d
shl rax, 2
add rax, r9
add rax, rcx
mov byte [rax], dl
add byte [rbp - 2], 1
cmp byte [rbp - 2], 3
jbe 0x403cd9
add byte [rbp - 1], 1
cmp byte [rbp - 1], 3
jbe 0x403cd3
nop
add rsp, 0x10
pop rbp
ret

Function at 0x403f6b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov byte [rbp - 1], 0
jmp 0x403fb4
movzx eax, byte [rbp - 1]
mov rdx, qword [rbp + 0x10]
add rax, rdx
movzx r8d, byte [rax]
movzx eax, byte [rbp - 1]
mov rdx, qword [rbp + 0x18]
add rax, rdx
movzx ecx, byte [rax]
movzx eax, byte [rbp - 1]
mov rdx, qword [rbp + 0x10]
add rax, rdx
mov edx, r8d
xor edx, ecx
mov byte [rax], dl
add byte [rbp - 1], 1
cmp byte [rbp - 1], 0xf
jbe 0x403f81
nop
add rsp, 0x10
pop rbp
ret
Function at 0x4053c0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00407f40]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x40542d
mov rcx, r8
call fcn.004052a0
test eax, eax
je 0x40542d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x40542d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x405424
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x40542f
add rax, 0x28
cmp rax, r9
jne 0x405410
xor eax, eax
add rsp, 0x28
ret

Function at 0x4058c0
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x00401540]
jmp 0x401510
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00405780
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.00405780
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x401530
Function at 0x14001a00a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x140021ca0
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
mov dword [rbp + 0x174], 0
lea rcx, [0x1400610f9]
call fcn.14001a9f1
nop
mov byte [rbp + 8], 0x30
mov byte [rbp + 9], 0x31
mov byte [rbp + 0xa], 0x32
mov byte [rbp + 0xb], 0x33
mov byte [rbp + 0xc], 0x34
mov byte [rbp + 0xd], 0x35
mov byte [rbp + 0xe], 0x36
mov byte [rbp + 0xf], 0x37
mov byte [rbp + 0x10], 0x38
mov byte [rbp + 0x11], 0x39
mov byte [rbp + 0x12], 0x61
mov byte [rbp + 0x13], 0x62
mov byte [rbp + 0x14], 0x63
mov byte [rbp + 0x15], 0x64
mov byte [rbp + 0x16], 0x65
mov byte [rbp + 0x17], 0x66
mov rcx, qword [rbp + 0x1b0]
call fcn.14001a9e2
mov qword [rbp + 0x188], rax
mov eax, dword [rbp + 0x174]
or eax, 1
mov dword [rbp + 0x174], eax
mov dword [rbp + 0x74], 0
jmp 0x140021d5a
mov eax, dword [rbp + 0x74]
inc eax
mov dword [rbp + 0x74], eax
movzx eax, byte [rbp + 0x1b8]
cmp dword [rbp + 0x74], eax
jge 0x140021d8d
call qword [sym.imp.ucrtbased.dll_rand]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
sub eax, edx
cdqe
movzx edx, byte [rbp + rax + 8]
mov rcx, qword [rbp + 0x1b0]
call fcn.14001a541
nop
jmp 0x140021d52
mov rax, qword [rbp + 0x1b0]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140051590]
call fcn.14001a852
mov rax, rdi
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret

Function at 0x14001a5a0
Capabilities:
Terminate process

Disassembly:
jmp 0x1400481b0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x14001a6a4
Capabilities:
Get disk information

Disassembly:
jmp 0x1400255e0
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x3b0
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x84
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x3d8]
mov dword [rbp + 0x344], 0
lea rcx, [0x1400610f9]
call fcn.14001a9f1
nop
mov edx, 0x20
mov rcx, qword [rbp + 0x3b0]
call fcn.14001a0ff
mov rcx, qword [rbp + 0x3b0]
call fcn.14001a3de
mov qword [rbp + 0x378], rax
mov eax, dword [rbp + 0x344]
or eax, 1
mov dword [rbp + 0x344], eax
mov qword [rbp + 0x228], 0x104
mov rcx, qword [rbp + 0x228]
call fcn.14001a447
mov qword [rbp + 0x248], rax
cmp qword [rbp + 0x248], 0
je 0x1400256a1
mov rdi, qword [rbp + 0x248]
xor eax, eax
mov rcx, qword [rbp + 0x228]
rep stosb byte [rdi], al
mov rax, qword [rbp + 0x248]
mov qword [rbp + 0x378], rax
jmp 0x1400256ac
mov qword [rbp + 0x378], 0
mov rax, qword [rbp + 0x378]
mov qword [rbp + 0x48], rax
mov rdx, qword [rbp + 0x48]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov dword [rbp + 0x64], 0
jmp 0x1400256d8
mov eax, dword [rbp + 0x64]
add eax, 4
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0x64
jge 0x1400257cf
movsxd rax, dword [rbp + 0x64]
mov rcx, qword [rbp + 0x48]
movsx eax, byte [rcx + rax]
test eax, eax
je 0x1400257ca
movsxd rax, dword [rbp + 0x64]
mov rcx, qword [rbp + 0x48]
movzx eax, byte [rcx + rax]
mov byte [rbp + 0x364], al
mov eax, dword [rbp + 0x64]
inc eax
cdqe
mov rcx, qword [rbp + 0x48]
movzx eax, byte [rcx + rax]
mov byte [rbp + 0x365], al
mov eax, dword [rbp + 0x64]
add eax, 2
cdqe
mov rcx, qword [rbp + 0x48]
movzx eax, byte [rcx + rax]
mov byte [rbp + 0x366], al
lea rcx, [rbp + 0x2a4]
call fcn.14001a271
mov qword [rbp + 0x378], rax
lea rcx, [rbp + 0x367]
mov r8, rcx
lea rdx, [rbp + 0x364]
lea rcx, [rbp + 0x2c8]
call fcn.14001a3d9
lea rcx, [rbp + 0x320]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rbp + 0x378]
mov r8, rax
lea rdx, [rbp + 0x320]
lea rcx, [rbp + 0x268]
call fcn.14001a546
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x388], rax
mov rdx, qword [rbp + 0x388]
mov rcx, qword [rbp + 0x3b0]
call fcn.14001a37a
nop
lea rcx, [rbp + 0x268]
call fcn.14001a203
nop
jmp 0x1400256cf
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x2f8], rax
mov rcx, qword [rbp + 0x2f8]
call fcn.14001a4bf
cmp qword [rbp + 0x2f8], 0
jne 0x1400257fd
mov qword [rbp + 0x378], 0
jmp 0x140025810
mov qword [rbp + 0x48], 0x8123
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x378], rax
mov rax, qword [rbp + 0x3b0]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140051360]
call fcn.14001a852
mov rax, rdi
lea rsp, [rbp + 0x390]
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001a6fe
Capabilities:
Parse pe header

Disassembly:
jmp 0x140049500
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140049520
xor al, al
jmp 0x1400495a1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140049533
xor al, al
jmp 0x1400495a1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14004955d
xor al, al
jmp 0x1400495a1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140049571
xor al, al
jmp 0x1400495a1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140049583
xor al, al
jmp 0x1400495a1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14004959f
xor al, al
jmp 0x1400495a1
mov al, 1
add rsp, 0x38
ret
Function at 0x140046cd0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14001aa41
movzx eax, al
test eax, eax
jne 0x140046cf0
mov ecx, 7
call fcn.14001a86b
nop
mov byte [rsp + 0x20], 0
call fcn.14001a8c0
mov byte [rsp + 0x21], al
cmp dword [0x140059b98], 1
jne 0x140046d14
mov ecx, 7
call fcn.14001a86b
nop
jmp 0x140046d6c
cmp dword [0x140059b98], 0
jne 0x140046d67
mov dword [0x140059b98], 1
lea rdx, [0x140050660]
lea rcx, [0x140050330]
call fcn.14001a4a1
test eax, eax
je 0x140046d48
mov eax, 0xff
jmp 0x140046e71
lea rdx, [0x140050220]
lea rcx, [section..rdata]
call fcn.14001a8a7
mov dword [0x140059b98], 2
jmp 0x140046d6c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001a843
call fcn.14001a749
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140046dc9
mov rcx, qword [rsp + 0x30]
call fcn.14001a3ca
movzx eax, al
test eax, eax
je 0x140046dc9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140062020]
nop
call fcn.14001a7c1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140046dfd
mov rcx, qword [rsp + 0x38]
call fcn.14001a3ca
movzx eax, al
test eax, eax
je 0x140046dfd
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14001a9ba
nop
call fcn.140046f20
mov dword [rsp + 0x28], eax
call fcn.14001a6fe
movzx eax, al
test eax, eax
jne 0x140046e1c
mov ecx, dword [rsp + 0x28]
call fcn.14001a0e1
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140046e2b
call fcn.14001a9d3
nop
xor edx, edx
mov cl, 1
call fcn.14001a398
mov eax, dword [rsp + 0x28]
jmp 0x140046e71
add rsp, 0x68
ret
Function at 0x140011203
Capabilities:
Terminate process

Disassembly:
jmp 0x1400131d0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret