joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400289f0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov ebx, ecx
mov dword [rsp + 0x60], 0
xor ecx, ecx
mov dword [rsp + 0x68], 2
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140028a52
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140028a52
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
jne 0x140028a52
mov eax, 0x20b
cmp word [rdx + 0x18], ax
jne 0x140028a52
cmp dword [rdx + 0x84], 0xe
jbe 0x140028a52
cmp dword [rdx + 0xf8], 0
je 0x140028a52
mov ecx, ebx
call fcn.140028bb0
lea rax, [rsp + 0x68]
mov byte [rsp + 0x58], 0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rcx, [0x141164800]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.140028d30
cmp dword [rsp + 0x60], 0
jne 0x140028a95
mov ecx, ebx
call fcn.140028c30
int3
add rsp, 0x40
pop rbx
ret

Function at 0x140028e40
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x530
mov rax, qword [0x140041640]
xor rax, rsp
mov qword [rsp + 0x520], rax
xor ebx, ebx
mov rdi, rdx
mov esi, ecx
test rdx, rdx
je 0x140028eac
lea edx, [rbx + 0x2d]
mov rcx, rdi
call sub.msvcrt.dll_strchr
test rax, rax
je 0x140028eac
mov ecx, ebx
lea r8, [rsp + 0x120]
mov rdx, rdi
nop dword [rax]
movsx eax, byte [rdx]
test al, al
je 0x140028eff
mov word [r8], ax
inc ecx
add r8, 2
inc rdx
cmp ecx, 0x100
jne 0x140028e90
mov rcx, qword [0x141164808]
test rcx, rcx
jne 0x140028ee2
call fcn.14002c920
mov rcx, rax
lea rdx, str.setlocale
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov rcx, 0xffffffffffffffff
cmovne rcx, rax
mov qword [0x141164808], rcx
cmp rcx, 0xffffffffffffffff
cmovne rbx, rcx
test rbx, rbx
je 0x140028fe3
mov rdx, rdi
mov ecx, esi
call rbx
jmp 0x140028fe5
movsxd rax, ecx
add rax, rax
cmp rax, 0x200
jae 0x14002900a
mov edx, 0x2d
mov word [rsp + rax + 0x120], bx
lea rcx, [rsp + 0x120]
call sub.msvcrt.dll_wcsrchr
test rax, rax
je 0x140028eac
mov r9d, 0xff
lea r8, [rsp + 0x320]
mov edx, 0x1001
lea rcx, [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
je 0x140028eac
lea ecx, [rax - 1]
mov r9d, 0x100
movsxd rdx, ecx
lea r8, [rsp + 0x320]
sub r9d, eax
mov ecx, 0x5f
cdqe
mov word [rsp + rdx*2 + 0x320], cx
mov edx, 0x1002
lea rcx, [rsp + 0x120]
lea r8, [r8 + rax*2]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
je 0x140028eac
lea rcx, [rsp + 0x320]
mov eax, ebx
lea rdx, [rsp + 0x20]
movzx r8d, word [rcx]
test r8w, r8w
je 0x140028fd3
mov byte [rdx], r8b
inc eax
inc rdx
add rcx, 2
cmp eax, 0x100
jne 0x140028fb1
jmp 0x140028eac
cdqe
lea rdi, [rsp + 0x20]
mov byte [rsp + rax + 0x20], bl
jmp 0x140028eac
xor eax, eax
mov rcx, qword [rsp + 0x520]
xor rcx, rsp
call fcn.14001c010
lea r11, [rsp + 0x530]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.14001d214
int3
Function at 0x1400296c0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rax, qword [0x140041640]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1400296fc
mov ecx, 5
int 0x29
mov ecx, 2
call fcn.14001d428
xorps xmm0, xmm0
lea rcx, [rbp + 0x10]
xor eax, eax
xor edx, edx
mov r8d, 0x4d0
mov qword [rbp], rax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x10]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rbp + 0x108]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x1400297b8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], 0
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0x4f8]
add rax, 8
mov dword [rsp + 0x70], 0xc0000417
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x74], 1
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x14002981e
test ebx, ebx
jne 0x14002981e
lea ecx, [rax + 2]
call fcn.14001d428
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.14001c010
mov rbx, qword [rsp + 0x600]
add rsp, 0x5f0
pop rbp
ret
Function at 0x14002b6c0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x70
mov rax, qword gs:[0x30]
mov rsi, r9
mov r14, r8
mov rbp, rdx
mov rbx, rcx
mov r10, qword [rax + 0x60]
mov eax, dword [r10 + 0x118]
shl eax, 0x10
or eax, dword [r10 + 0x11c]
cmp eax, 0x60000
jb 0x14002b718
call fcn.14001e6a0
mov ecx, dword [rax + 0x2c0]
jmp 0x14002b725
mov ecx, 1
call fcn.14002c3c0
mov ecx, dword [rax + 0x28]
mov rdi, qword [rsp + 0xa0]
test ecx, ecx
jne 0x14002b761
mov eax, dword [rbx]
cmp eax, 0xe06d7363
je 0x14002b761
cmp eax, 0x80000029
jne 0x14002b751
cmp dword [rbx + 0x18], 0xf
jne 0x14002b758
cmp qword [rbx + 0x60], 0x19930520
je 0x14002b761
cmp eax, 0x80000026
je 0x14002b761
test byte [rdi], 0x20
jne 0x14002b8ee
mov r8d, dword [rbx + 4]
test r8b, 0x66
je 0x14002b827
movsxd rax, dword [rdi + 8]
test eax, eax
je 0x14002b8ee
mov rdx, rax
lea r9, [0x140000000]
add rdx, qword [rsi + 8]
movzx ecx, byte [rdx]
and ecx, 0xf
movsx rax, byte [rcx + r9 + 0x335d0]
movzx ecx, byte [rcx + r9 + 0x335e0]
sub rdx, rax
mov eax, dword [rdx - 4]
shr eax, cl
test eax, eax
je 0x14002b8ee
cmp dword [rsp + 0xa8], 0
jne 0x14002b8ee
test r8b, 0x20
je 0x14002b814
mov ecx, dword [rbx]
cmp ecx, 0x80000026
jne 0x14002b7f4
mov r8, qword [rsi + 0x20]
mov rdx, rsi
mov rcx, rdi
call fcn.14002df20
mov r9d, eax
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
call fcn.14002a8c0
jmp 0x14002b8ee
cmp ecx, 0x80000029
jne 0x14002b814
mov r9d, dword [rbx + 0x38]
mov r8, rdi
mov rcx, qword [rbx + 0x28]
mov rdx, rsi
call fcn.14002a8c0
jmp 0x14002b8ee
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
call fcn.14001e250
jmp 0x14002b8ee
mov r8, qword [rsi + 8]
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.14002a460
cmp dword [rsp + 0x40], 0
jne 0x14002b848
test byte [rdi], 0x40
je 0x14002b8ee
cmp dword [rbx], 0xe06d7363
jne 0x14002b8b4
cmp dword [rbx + 0x18], 3
jb 0x14002b8b4
cmp dword [rbx + 0x20], 0x19930522
jbe 0x14002b8b4
mov rax, qword [rbx + 0x30]
cmp dword [rax + 8], 0
je 0x14002b8b4
call fcn.14001e780
mov rcx, qword [rbx + 0x30]
movsxd rdx, dword [rcx + 8]
add rax, rdx
je 0x14002b8b4
movzx ecx, byte [rsp + 0xb8]
mov r9, rsi
mov dword [rsp + 0x38], ecx
mov r8, r14
mov rcx, qword [rsp + 0xb0]
mov rdx, rbp
mov qword [rsp + 0x30], rcx
mov ecx, dword [rsp + 0xa8]
mov dword [rsp + 0x28], ecx
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call rax
jmp 0x14002b8f3
mov rax, qword [rsp + 0xb0]
mov r9, rsi
mov qword [rsp + 0x38], rax
mov r8, r14
mov eax, dword [rsp + 0xa8]
mov rdx, rbp
mov dword [rsp + 0x30], eax
mov rcx, rbx
movzx eax, byte [rsp + 0xb8]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], rdi
call fcn.14002b910
mov eax, 1
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x14002c5e0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, qword [0x1428c4898]
mov rdi, rcx
nop
mov ebx, edx
mov rax, qword [0x140041640]
xor r9, rax
mov ecx, eax
and ecx, 0x3f
ror r9, cl
cmp r9, 0xffffffffffffffff
je 0x14002c6ab
test r9, r9
jne 0x14002c672
lea rdx, [0x14003457c]
lea rcx, [0x140034578]
call fcn.14002c6c0
test rax, rax
je 0x14002c684
lea rdx, str.SystemFunction036
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9, rax
test rax, rax
je 0x14002c684
mov r8, qword [0x140041640]
mov r10d, 0x40
mov ecx, r8d
mov rdx, rax
and ecx, 0x3f
sub r10d, ecx
movzx ecx, r10b
ror rdx, cl
xor rdx, r8
xchg qword [0x1428c4898], rdx
mov edx, ebx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp r9
mov rdx, qword [0x140041640]
mov ecx, 0x40
mov eax, edx
and eax, 0x3f
sub ecx, eax
mov rax, 0xffffffffffffffff
ror rax, cl
xor rax, rdx
xchg qword [0x1428c4898], rax
call sub.msvcrt.dll_abort
int3

Function at 0x14002c6c0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x430
mov rax, qword [0x140041640]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov rbp, rdx
mov rdi, rcx
cmp rcx, rdx
je 0x14002c801
lea r14, [0x140000000]
mov r15d, 0x5c
xor r12d, r12d
nop word [rax + rax]
mov eax, dword [rdi]
lea rsi, [r14 + 0x28c4868]
mov rbx, qword [rsi + rax*8]
lea rsi, [rsi + rax*8]
nop
test rbx, rbx
je 0x14002c736
cmp rbx, 0xffffffffffffffff
jne 0x14002c843
jmp 0x14002c7f4
cmp byte [0x1428c4860], r12b
mov rbx, qword [r14 + rax*8 + 0x34568]
je 0x14002c755
mov r8d, 0x800
mov rcx, rbx
jmp 0x14002c7da
test rbx, rbx
je 0x14002c7ea
cmp word [rbx], r12w
je 0x14002c7ea
mov edx, 0x200
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [rax - 1]
cmp ecx, 0x1fe
ja 0x14002c7ea
mov ecx, eax
inc eax
mov word [rsp + rcx*2 + 0x20], r15w
cmp eax, 0x200
jae 0x14002c7ea
movzx edx, word [rbx]
test dx, dx
je 0x14002c7bb
nop dword [rax]
mov word [rsp + rax*2 + 0x20], dx
inc eax
cmp eax, 0x200
jae 0x14002c7ea
movzx edx, word [rbx + 2]
add rbx, 2
test dx, dx
jne 0x14002c7a0
mov ecx, eax
add rcx, rcx
cmp rcx, 0x400
jae 0x14002c848
mov word [rsp + rcx + 0x20], r12w
mov r8d, 8
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x14002c82f
mov rax, 0xffffffffffffffff
xchg qword [rsi], rax
add rdi, 4
cmp rdi, rbp
jne 0x14002c710
xor eax, eax
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.14001c010
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov rcx, rbx
xchg qword [rsi], rcx
test rcx, rcx
je 0x14002c843
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, rbx
jmp 0x14002c803
call fcn.14001d214
int3
Function at 0x140011398
Capabilities:
Terminate process

Disassembly:
jmp 0x1400177c0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011410
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x1400147e0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x30]
lea rcx, [0x14002933b]
call fcn.14001165e
mov r9d, 0x40
mov r8d, 0x1000
mov rax, qword [rbp + 0xe0]
mov rdx, qword [rax + 8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, qword [rbp + 0xe0]
mov qword [rcx + 0x18], rax
mov rax, qword [rbp + 0xe0]
cmp qword [rax + 0x18], 0
jne 0x140014861
lea rdx, str.Failed_to_allocate_memory.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400110c8
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor al, al
jmp 0x140014909
mov rax, qword [rbp + 0xe0]
mov r8, qword [rax + 8]
mov rax, qword [rbp + 0xe0]
mov rdx, qword [rax]
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax + 0x18]
call fcn.140011334
mov al, 1
jmp 0x140014909
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x140011497
Capabilities:
Parse pe header

Disassembly:
jmp 0x140018b10
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140018b30
xor al, al
jmp 0x140018bb1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140018b43
xor al, al
jmp 0x140018bb1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140018b6d
xor al, al
jmp 0x140018bb1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140018b81
xor al, al
jmp 0x140018bb1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140018b93
xor al, al
jmp 0x140018bb1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140018baf
xor al, al
jmp 0x140018bb1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400115e1
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x140014320
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x6e8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x122
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x708]
mov rax, qword [0x140023040]
xor rax, rbp
mov qword [rbp + 0x6b8], rax
lea rcx, [0x14002933e]
call fcn.14001165e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov ecx, 8
call fcn.140011311
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
je 0x1400143d2
mov dword [rbp + 0x30], 0x438
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.14001141f
test eax, eax
je 0x1400143c8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rbp + 0x38], eax
je 0x1400143b7
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x1400143d4
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.14001110e
test eax, eax
jne 0x14001439e
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001efc0]
call fcn.140011578
mov rax, rdi
mov rcx, qword [rbp + 0x6b8]
xor rcx, rbp
call fcn.14001132f
lea rsp, [rbp + 0x6c8]
pop rdi
pop rbp
ret

Function at 0x1400115e6
Capabilities:
Enumerate processes

Disassembly:
jmp 0x1400145d0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x448
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x468]
mov rax, qword [0x140023040]
xor rax, rbp
mov qword [rbp + 0x418], rax
lea rcx, [0x14002933e]
call fcn.14001165e
mov dword [rbp + 4], 0
xor edx, edx
mov ecx, 2
call fcn.140011311
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0xffffffffffffffff
je 0x14001467d
mov dword [rbp + 0x50], 0x238
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call fcn.1400113f7
test eax, eax
je 0x140014673
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rbp + 0x58], eax
jne 0x140014662
mov eax, dword [rbp + 0x70]
mov dword [rbp + 4], eax
jmp 0x140014673
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call fcn.1400115be
test eax, eax
jne 0x14001464f
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001f040]
call fcn.140011578
mov eax, edi
mov rcx, qword [rbp + 0x418]
xor rcx, rbp
call fcn.14001132f
lea rsp, [rbp + 0x428]
pop rdi
pop rbp
ret
Function at 0x140029a2c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001d034
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001d034
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140029b7c
cmp rax, 0xffffffffffffffff
je 0x140029b7c
xor edi, edi
test rbp, rbp
jle 0x140029b27
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f948
mov rbx, rax
test rax, rax
jne 0x140029ab4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140029b1d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a99c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001dd10
cmp eax, 0xffffffff
je 0x140029afd
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140029ac4
mov edx, r15d
mov ecx, r14d
call fcn.14001a99c
jmp 0x140029b1d
cmp byte [rsi + 0x38], dil
je 0x140029b14
cmp dword [rsi + 0x34], 5
jne 0x140029b14
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140029b1d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b700
jmp 0x140029b90
jns 0x140029b90
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001d034
cmp rax, 0xffffffffffffffff
jne 0x140029b48
cmp byte [rsi + 0x30], dil
je 0x140029b90
mov edi, dword [rsi + 0x2c]
jmp 0x140029b90
mov ecx, r14d
call fcn.140018e54
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140029b90
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029b90
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029b89
mov eax, dword [rsi + 0x2c]
jmp 0x140029b8e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001d034
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14002ac80
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002aca8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002aca8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x14046cf6d
Capabilities:
Encode data using xor

Disassembly:
cmp ebx, 3
jmp 0x140487f43
Function at 0x140005170
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ecx, 4
mov rax, qword gs:[0x58]
mov rax, qword [rax]
mov eax, dword [rcx + rax]
cmp dword [0x1405a7f8c], eax
jg 0x1400051cc
mov rax, qword [0x1405a7fb8]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
inc dword [rax]
mov qword [rbx], rdi
mov qword [0x1405a7fb8], rbx
lea rcx, [0x1405a7f8c]
call fcn.1400c9dec
jmp 0x14000519b
lea rcx, [0x1405a7f8c]
call fcn.1400c9e58
cmp dword [0x1405a7f8c], 0xffffffff
jne 0x14000519b
mov ecx, 8
call fcn.1400c9d40
mov rbx, rax
mov qword [rsp + 0x30], rax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400c9d40
mov rdi, rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rdi], eax
lea rax, [0x140006500]
mov qword [rdi + 8], rax
xor esi, esi
mov qword [rdi + 0x10], rsi
mov rax, qword [0x1405a7c10]
test rax, rax
jne 0x1400051b2
lea edx, [rsi + 0x18]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [0x1405a7c10], rax
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov dword [rax], esi
jmp 0x1400051b2
Function at 0x140005af0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140005b21
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x140005b9b
mov rdi, r14
mov rcx, rbx
call fcn.140008ee0
test rax, rax
jle 0x140005b73
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.140279770
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x140005b8b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140005b93
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140005b35
sub r14, rdi
jmp 0x140005c7f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140005bb2
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140005bb4
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140005be6
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.140279770
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x140005c7c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140005c21
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x140005c5d
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1400de218
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x140005c7c
cmp rbp, rax
ja 0x140005c30
test rbp, rbp
je 0x140005c7c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1400de218
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140006420
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [rcx]
mov rsi, rcx
mov rbp, rdx
mov ecx, dword [rdi]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x1400064de
lea edx, [rax + 0x30]
mov qword [rsp + 0x30], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dl, 1
mov rbx, rax
mov qword [rax], rdi
mov qword [rax + 8], rbp
call fcn.140102d00
lea rdx, [rbx + 0x10]
mov rcx, qword [rax]
mov qword [rdx], rcx
mov qword [rax], rbx
mov qword [rbx + 0x18], rax
mov rax, qword [rdx]
test rax, rax
je 0x140006487
mov qword [rax + 0x18], rdx
call fcn.140102ee0
mov rax, qword [rdi + 0x10]
lea rdx, [rdi + 0x10]
lea rcx, [rbx + 0x20]
mov qword [rcx], rax
mov qword [rdx], rbx
mov rax, qword [rcx]
mov qword [rbx + 0x28], rdx
test rax, rax
je 0x1400064ae
mov qword [rax + 0x28], rcx
mov rcx, qword [0x1405a78b8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [rdi]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rax + 8], rbp
mov rax, rsi
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret