joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006823c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14010d0f8]
xor rax, rsp
mov qword [rbp - 8], rax
lea rax, [rbp - 0x18]
mov ebx, 1
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.Control_PanelDesktop
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
nop dword [rax + rax]
test eax, eax
jne 0x140068361
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x1c]
lea rax, [rbp - 0x10]
mov dword [rbp - 0x20], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.CaretWidth
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
nop dword [rax + rax]
test eax, eax
jne 0x1400682d0
cmp dword [rbp - 0x20], 4
cmovbe ebx, dword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x1c]
lea rax, [rbp - 0x10]
mov dword [rbp - 0x20], 8
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.CursorBlinkRate
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
nop dword [rax + rax]
test eax, eax
jne 0x140068351
mov ecx, dword [rbp - 0x20]
cmp ecx, 8
ja 0x140068351
xor edx, edx
xor r8d, r8d
test ecx, ecx
je 0x14006833d
movzx r9d, byte [rbp + r8 - 0x10]
lea eax, [r9 - 0x30]
cmp eax, 9
ja 0x14006833d
lea edx, [rdx + rdx*4]
inc r8d
lea edx, [rdx - 0x18]
lea edx, [r9 + rdx*2]
cmp r8d, ecx
jb 0x14006831c
or ecx, 0xffffffff
test edx, edx
cmovne ecx, edx
call qword [sym.imp.USER32.dll_SetCaretBlinkTime]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, 0xff
movzx ecx, bl
cmp ebx, eax
cmovl eax, ecx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400e6ab0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x140069fc4
Capabilities:
Get keyboard layout

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
nop dword [rax + rax]
movzx ecx, ax
mov qword [0x140114a78], rax
mov r9, rax
call fcn.14006985c
cmp eax, 0x2e
ja 0x140069ffb
movsxd rcx, eax
lea rax, [0x1401146f0]
mov qword [rax + rcx*8], r9
add rsp, 0x28
ret

Function at 0x14006a008
Capabilities:
Get geographical location

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14010d0f8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebx, ecx
and ebx, 0x3ff
cmp dword [0x140114870], 2
jne 0x14006a15e
cmp dword [0x140114868], 5
jb 0x14006a15e
mov r9d, SafeArrayGetElement
lea r8, [rsp + 0x20]
lea edx, [r9 - 1]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
nop dword [rax + rax]
test eax, eax
je 0x14006a15e
movzx ecx, word [rsp + 0x22]
mov eax, 0xbe7
cmp ecx, eax
ja 0x14006a103
je 0x14006a0fc
cmp ecx, 0x31
je 0x14006a0f5
cmp ecx, 0x661
je 0x14006a0ee
cmp ecx, 0x6f1
je 0x14006a0e7
cmp ecx, 0x967
je 0x14006a0e0
cmp ecx, 0x9e7
je 0x14006a0d9
cmp ecx, 0xa67
je 0x14006a0cf
cmp ecx, 0xae7
je 0x14006a0c5
cmp ecx, 0xb67
jne 0x14006a15e
mov ebx, 0x48
jmp 0x14006a15e
mov ebx, 0x47
jmp 0x14006a15e
mov ebx, 0x46
jmp 0x14006a15e
mov ebx, 0x45
jmp 0x14006a15e
mov ebx, 0x39
jmp 0x14006a15e
mov ebx, 0x29
jmp 0x14006a15e
mov ebx, 1
jmp 0x14006a15e
mov ebx, 9
jmp 0x14006a15e
mov ebx, 0x49
jmp 0x14006a15e
sub ecx, 0xc67
je 0x14006a159
mov eax, 0x80
sub ecx, eax
je 0x14006a152
sub ecx, eax
je 0x14006a14b
sub ecx, 0xea
je 0x14006a144
sub ecx, eax
je 0x14006a13d
sub ecx, 0x50
je 0x14006a136
cmp ecx, 0x8c0
jne 0x14006a15e
lea ebx, [rax - 0x2d]
jmp 0x14006a15e
mov ebx, 0x51
jmp 0x14006a15e
mov ebx, 0x54
jmp 0x14006a15e
mov ebx, 0x1e
jmp 0x14006a15e
mov ebx, 0x4c
jmp 0x14006a15e
mov ebx, 0x4b
jmp 0x14006a15e
mov ebx, 0x4a
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400e6ab0
add rsp, 0x50
pop rbx
ret
Function at 0x1400d29cc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov r11d, dword [rsp + 0x70]
mov rdi, r8
mov r10, rcx
cmp r9d, r11d
jle 0x1400d2b64
test byte [rcx + 0xec], 8
je 0x1400d2adf
mov rax, qword [rdx + 0x18]
test rax, rax
je 0x1400d2a49
movzx eax, word [rax + 0x60]
cmp eax, r11d
jle 0x1400d2a49
lfence
mov r9, qword [rdx + 0x18]
movzx eax, word [r9 + 0x60]
mov rdx, qword [r9 + 0x20]
sub eax, r11d
movsxd rcx, eax
mov rax, qword [r9 + 0x38]
movzx r8d, word [rax + rcx*2 - 2]
add rdx, r8
jmp 0x1400d2a34
inc r8d
inc rdx
test byte [rdx], 2
je 0x1400d2a2e
mov rax, qword [r9]
movsxd rcx, r8d
movzx edx, word [rax + rcx*2]
mov rax, qword [r9 + 0x48]
jmp 0x1400d2a9b
lfence
movzx eax, word [rcx + 0xf0]
mov r8, qword [r10 + 0x70]
sub eax, r11d
add eax, r9d
movsxd rcx, eax
mov rax, qword [r10 + 0x58]
movzx edx, word [rax + rcx*2 - 2]
add r8, rdx
jmp 0x1400d2a73
inc edx
inc r8
test byte [r8], 2
je 0x1400d2a6e
movzx eax, word [r10 + 0xf6]
lea ecx, [rdx + 1]
cmp ecx, eax
jle 0x1400d2b64
mov rax, qword [r10 + 0x38]
movsxd rcx, edx
movzx edx, word [rax + rcx*2]
mov rax, qword [r10 + 0x68]
mov r8d, dword [rax + rcx*4]
mov r9, rdi
mov rax, qword [r10 + 8]
mov rbx, qword [rsp + 0x78]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], r8d
mov rcx, qword [rax]
mov r8d, dword [r10 + 0xd8]
mov word [rsp + 0x20], dx
mov edx, 1
mov rax, qword [rcx]
mov rcx, qword [rcx + 8]
mov rax, qword [rax + 0x238]
call qword [case.0x140066f27.0]
jmp 0x1400d2b43
movzx eax, word [rdx + 0x8e]
cmp eax, r11d
jg 0x1400d2b64
movzx ecx, word [rcx + 0xf0]
mov edx, ecx
sub edx, r11d
add edx, r9d
cmp edx, ecx
jle 0x1400d2b64
mov rax, qword [r10 + 0x18]
mov r9, rdi
mov rbx, qword [rsp + 0x78]
mov r8d, dword [r10 + 0xd8]
movsxd rcx, edx
mov qword [rsp + 0x28], rbx
movzx edx, word [rax + rcx*2 - 2]
mov rax, qword [r10 + 8]
mov word [rsp + 0x20], dx
mov edx, 1
mov rcx, qword [rax]
mov rax, qword [rcx]
mov rcx, qword [rcx + 8]
mov rax, qword [rax + 0x228]
call qword [case.0x140066f27.0]
test eax, eax
jne 0x1400d2b66
cmp dword [rbx], 0x80000000
je 0x1400d2b5d
mov eax, dword [rbx]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x2faf080
jle 0x1400d2b64
mov eax, 0xffffff9c
jmp 0x1400d2b66
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400d8380
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
and dword [rbp + 0x40], 0
xor r15d, r15d
xor r14d, r14d
xor edi, edi
mov r13, r8
mov r10d, edx
mov rbx, rcx
cmp dword [rcx + 0xb8], edi
jle 0x1400d846d
xor esi, esi
mov rcx, qword [rbx + 0xc0]
cmp dword [rsi + rcx + 0x28], r14d
je 0x1400d845b
lea eax, [r10 + 1]
cmp dword [rsi + rcx + 0x1c], eax
jle 0x1400d845b
mov r12, qword [rsi + rcx + 0x30]
lea r8, [rbp - 0x30]
mov rax, qword [r12]
mov rdx, qword [rax + 8]
movsxd rax, dword [r12 + 0x28]
imul rcx, rax, 0xd0
mov rax, qword [rdx + 0x660]
mov edx, r10d
mov rax, qword [rcx + rax + 0xa8]
mov rcx, qword [rbp + 0x68]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x20], rcx
mov rcx, qword [r12 + 0x58]
call qword [case.0x140066f27.0]
mov edx, dword [rbp + 0x40]
test eax, eax
jne 0x1400d8477
mov eax, dword [r12 + 0x8c]
add eax, dword [r12 + 0x88]
add edx, eax
xor eax, eax
mov dword [rbp + 0x40], edx
test eax, eax
jne 0x1400d8477
cmp dword [rbp - 0x30], r14d
je 0x1400d8490
mov r10d, dword [rbp + 0x48]
mov r9, qword [rbp + 0x58]
inc edi
add rsi, 0x60
cmp edi, dword [rbx + 0xb8]
jl 0x1400d83c3
mov dword [r13], 1
xor eax, eax
mov rbx, qword [rsp + 0xc0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rbx + 0xc0]
movsxd r8, edi
lea r9, [r8 + r8*2]
shl r9, 5
test edi, edi
je 0x1400d84b3
lea rax, [r8 + r8*2]
shl rax, 5
mov r15, qword [rax + rcx - 0x60]
lea eax, [rdi + 1]
cmp eax, dword [rbx + 0xb8]
jge 0x1400d84d4
lea rax, [r8 + 1]
lea rax, [rax + rax*2]
shl rax, 5
mov r14d, dword [rax + rcx + 0x50]
add r14d, dword [rax + rcx + 0x48]
cmp dword [r9 + rcx + 0x3c], 6
jne 0x1400d84f8
mov rdx, qword [r9 + rcx]
lea r8, [rbp - 0x28]
mov rcx, qword [rcx]
call fcn.1400ddf40
test eax, eax
jne 0x1400d8477
mov edx, dword [rbp - 0x10]
add edx, r14d
jmp 0x1400d851a
test r15, r15
je 0x1400d851a
mov rcx, qword [rcx]
lea r8, [rbp - 0x28]
mov rdx, r15
call fcn.1400ddf40
test eax, eax
jne 0x1400d8477
mov edx, dword [rbp + 0x40]
add edx, dword [rbp - 0x10]
and dword [r13], 0
mov ecx, dword [rbx + 0x78]
add ecx, dword [rbx + 0x68]
mov rax, qword [rbp + 0x60]
add ecx, edx
mov dword [rax], ecx
jmp 0x1400d8475
Function at 0x1400e6810
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x1401151a0], rbx
je 0x1400e6877
cmp rax, rbx
jne 0x1400e686a
mov ebx, 1
mov esi, ebx
jmp 0x1400e687c
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400e684f
mov ebx, 1
mov eax, dword [0x1401151a8]
cmp eax, ebx
jne 0x1400e6894
mov edi, 0x1f
mov ecx, edi
call fcn.14020b000
jmp 0x1400e6900
mov eax, dword [0x1401151a8]
test eax, eax
jne 0x1400e68f5
mov dword [0x1401151a8], ebx
lea r15, [0x1400f0668]
lea rdi, [0x1400f0650]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x1400e68e7
test eax, eax
jne 0x1400e68eb
cmp qword [rdi], r14
je 0x1400e68dc
mov rax, qword [rdi]
mov rcx, qword [case.0x140066f27.0]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x1400e68be
test eax, eax
je 0x1400e68fb
mov eax, 0xff
jmp 0x1400e6a56
mov dword [0x140113e44], ebx
mov edi, 0x1f
mov eax, dword [0x1401151a8]
cmp eax, ebx
jne 0x1400e6927
lea rdx, [0x1400f0648]
lea rcx, [0x1400f05b8]
call sub.msvcrt.dll__initterm
mov dword [0x1401151a8], 2
test esi, esi
jne 0x1400e6935
mov rax, r14
xchg qword [0x1401151a0], rax
cmp qword [0x1401151c0], r14
je 0x1400e6968
lea rcx, [0x1401151c0]
call fcn.1400e7310
test eax, eax
je 0x1400e6968
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x1401151c0]
mov r9, qword [case.0x140066f27.0]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x1400e6981
mov eax, 0xff
jmp 0x1400e6a56
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x1400e6a07
test ax, ax
je 0x1400e699c
test edx, edx
jne 0x1400e6a07
sub ax, bx
cmp ax, di
ja 0x1400e69b2
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x1400e699c
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.14000eb08
mov dword [0x140113e40], eax
cmp dword [0x140113e60], r14d
jne 0x1400e69f0
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140113e44], r14d
jne 0x1400e6a05
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140113e40]
jmp 0x1400e6a56
cmp ax, 0x22
jne 0x1400e6a1b
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400e698a
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.1400e73a4
add rsp, 0x28
jmp 0x1400e6810
Function at 0x1400e71fc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400e7248
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400e7240
cmp dword [rcx + 0x3c], edx
jl 0x1400e7240
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1400e7240
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1400e7248
mov rax, rdx
add rsp, 0x18
ret

Function at 0x1400e74bc
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400e74c8
push rbx
sub rsp, 0x540
mov rax, qword [0x14010d0f8]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x1400e7545
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x1400e7565
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.1400e6ab0
add rsp, 0x540
pop rbx
ret

Function at 0x1400e74c8
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400e74c8
push rbx
sub rsp, 0x540
mov rax, qword [0x14010d0f8]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x1400e7545
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x1400e7565
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.1400e6ab0
add rsp, 0x540
pop rbx
ret
Function at 0x140002f50
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140004b00
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140004b00
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140002fc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400090a4]
mov rbx, rcx
test esi, esi
jle 0x1400030f0
mov rax, qword [0x1400090a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14000300b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140003095
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140002ff0
mov rcx, rbx
call fcn.140003a10
mov rdi, rax
test rax, rax
je 0x140003112
mov rax, qword [0x1400090a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140003b50
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400090a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400030f7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14000308e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1400030a0
add dword [0x1400090a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1400090a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000308e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140002f50
nop dword [rax]
xor esi, esi
jmp 0x140003018
mov rax, qword [0x1400090a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140002f50
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140002f50
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140003680
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140009100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400090e0]
test rbx, rbx
je 0x1400036dc
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x1400036d3
test rsi, rsi
je 0x1400036d3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400036b8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140003a10
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140006a40]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140003a30
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140003a38
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140003a30
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x140003a8d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140003a84
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140003a30
add rax, 0x28
cmp rax, r9
jne 0x140003a70
xor eax, eax
ret

Function at 0x140003a90
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006a40]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x140003aaf
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140003ab8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x140003aaf
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140003b50
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006a40]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140003b6f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140003b78
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x14000583c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000562c
Function at 0x140008244
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400082cb
mov rsi, rbx
cmp word [rax], bp
je 0x14000828a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140008274
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140008270
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140008c3c
mov rdi, rax
test rax, rax
je 0x1400082b8
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140002d50
mov rbp, rdi
xor ecx, ecx
call fcn.140006f6c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000bfa0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rdi
cmp dword [0x140096e54], 0
lea rdi, [0x140096e50]
mov r11d, r8d
mov r9d, edx
mov r10, rcx
jne 0x14000c078
mov qword [rsp + 0x10], rbx
xor edx, edx
mov rbx, rdi
nop dword [rax]
mov r8d, edx
lea rbx, [rbx + 4]
and r8d, 1
mov eax, edx
shr eax, 1
neg r8d
and r8d, 0xedb88320
inc edx
xor r8d, eax
mov eax, r8d
shr r8d, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, r8d
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rbx - 4], eax
cmp edx, 0x100
jb 0x14000bfd0
mov rbx, qword [rsp + 0x10]
not r11d
mov eax, r11d
test r9d, r9d
jle 0x14000c0ae
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
movzx edx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [rdi + rdx*4]
sub r9d, 1
jne 0x14000c090
not eax
pop rdi
ret
movzx r9d, byte [r10]
lea r8, [r10 + 1]
test r9b, r9b
je 0x14000c0ef
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x14000c0d3
cmp byte [r8], r9b
jne 0x14000c0d3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rdi + rdx*4]
test r9b, r9b
jne 0x14000c0c0
not eax
pop rdi
ret
Function at 0x14000c2f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
test r8, r8
je 0x14000c309
mov qword [r8], 0
lea rdx, [0x14008dcd0]
call fcn.14000c100
mov rbx, rax
test rax, rax
jne 0x14000c328
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor edx, edx
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000c3e8
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x14000c3e8
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000c3e8
mov rax, qword [0x140096cf8]
mov rbp, rsi
test rax, rax
je 0x14000c385
inc dword [rax + 0x3c8]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x14000c3e8
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rbp
je 0x14000c3d5
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140096cf8]
test rax, rax
je 0x14000c3ca
dec dword [rax + 0x3c8]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000c3f1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x14000c3e3
mov qword [rdi], rbp
mov rax, rsi
jmp 0x14000c3f3
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001d4a0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x20
mov rdi, qword [0x140096cf8]
xor esi, esi
mov r15, rcx
mov dword [rdi + 0x2d9c], esi
test rcx, rcx
je 0x14001d5ba
mov qword [rsp + 0x40], rbx
lea rbx, [rdi + 0x2da0]
mov dword [rdi + 0x2d9c], esi
mov ecx, dword [rbx + 4]
mov qword [rsp + 0x48], rbp
test ecx, ecx
jns 0x14001d4fa
mov eax, ecx
cdq
sub eax, edx
mov edx, esi
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.14001e6f0
mov dword [rbx], esi
cmp dword [rbx + 4], esi
jne 0x14001d50e
mov edx, 8
mov rcx, rbx
call fcn.14001e6f0
movsxd rcx, dword [rbx]
mov ebp, esi
mov rax, qword [rbx + 8]
mov byte [rcx + rax], sil
inc dword [rbx]
cmp dword [rdi + 0x2db0], esi
jle 0x14001d55a
mov qword [rsp + 0x50], r14
mov r14, rsi
nop dword [rax]
mov r9, qword [rdi + 0x2db8]
mov r8, rbx
add r9, r14
mov rcx, rdi
mov rdx, r9
call qword [r9 + 0x20]
inc ebp
add r14, 0x30
cmp ebp, dword [rdi + 0x2db0]
jl 0x14001d530
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
cmp qword [rbx + 8], rsi
je 0x14001d569
mov esi, dword [rbx]
dec esi
mov rax, qword [rdi + 0x2da8]
lea rdx, [0x14008dcd4]
test rax, rax
movsxd rsi, esi
lea rdi, [0x140096cec]
mov rcx, r15
cmovne rdi, rax
call fcn.14000c100
mov rbx, rax
test rax, rax
je 0x14001d5b5
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret