joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b4f60
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1401fd570]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400b4f80
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400b4f88
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400b4f80
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400b4fdd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400b4fd4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400b4f80
add rax, 0x28
cmp rax, r9
jne 0x1400b4fc0
xor eax, eax
ret

Function at 0x1400b4fe0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1401fd570]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400b4fff
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400b5008
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400b4fff
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400b50a0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1401fd570]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400b50bf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400b50c8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x1400021dc
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140004650], rbx
je 0x140002228
cmp rax, rbx
jne 0x14000221b
mov ebx, 1
mov esi, ebx
jmp 0x14000222d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002200
mov ebx, 1
mov eax, dword [0x140004658]
cmp eax, ebx
jne 0x140002243
mov ecx, 0x1f
call fcn.140201000
jmp 0x1400022a8
mov eax, dword [0x140004658]
test eax, eax
jne 0x1400022a2
mov dword [0x140004658], ebx
lea r15, [0x1400033b0]
lea rdi, [0x140003398]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140002294
test eax, eax
jne 0x140002298
cmp qword [rdi], 0
je 0x140002289
mov rax, qword [rdi]
mov rcx, qword [0x140003378]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000226a
test eax, eax
je 0x1400022a8
mov eax, 0xff
jmp 0x140002384
mov dword [0x140004064], ebx
mov eax, dword [0x140004658]
cmp eax, ebx
jne 0x1400022cf
lea rdx, [0x140003390]
lea rcx, [0x140003380]
call sub.msvcrt.dll__initterm
mov dword [0x140004658], 2
test esi, esi
jne 0x1400022dc
xor eax, eax
xchg qword [0x140004650], rax
cmp qword [0x140004660], 0
je 0x140002310
lea rcx, [0x140004660]
call fcn.140002540
test eax, eax
je 0x140002310
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140004660]
mov r9, qword [0x140003378]
call r9
mov r8, qword [0x140004078]
mov rdx, qword [0x140004070]
mov ecx, dword [0x140004068]
call fcn.140001800
mov dword [0x140004060], eax
cmp dword [0x140004080], 0
jne 0x140002340
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140004064], 0
jne 0x140002355
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140004060]
jmp 0x140002384
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.1400025c0
add rsp, 0x28
jmp 0x1400021dc

Function at 0x140002450
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000249c
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140002494
cmp dword [rcx + 0x3c], edx
jl 0x140002494
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140002494
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14000249c
mov rax, rdx
add rsp, 0x18
ret
Function at 0x14006894c
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1400f20e0
mov qword [rsp + 8], rcx
sub rsp, 0x38
call fcn.1400f1130
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400f2117
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
call qword [0x140187020]
jmp 0x1400f211d
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x38
ret

Function at 0x140069667
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1400ed060
mov rax, rcx
neg rcx
test rax, 7
je 0x1400ed07d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1400ed0d8
test al, 7
jne 0x1400ed070
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1400ed091
mov rdx, qword [rax - 8]
test dl, dl
je 0x1400ed102
test dh, dh
je 0x1400ed0fc
shr rdx, 0x10
test dl, dl
je 0x1400ed0f6
test dh, dh
je 0x1400ed0f0
shr rdx, 0x10
test dl, dl
je 0x1400ed0ea
test dh, dh
je 0x1400ed0e4
shr edx, 0x10
test dl, dl
je 0x1400ed0de
test dh, dh
jne 0x1400ed091
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x1400696a8
Capabilities:
Query environment variable

Disassembly:
jmp 0x14010e270
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
je 0x14010e30d
mov rbp, rax
cmp word [rax], si
je 0x14010e2b9
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14010e2a0
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14010e29c
sub rbp, rbx
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
add rbp, 2
mov r9d, 0x40
sar rbp, 1
add rbp, rbp
mov rcx, rbp
lea edx, [r9 - 0x3e]
call fcn.1400698ab
mov rdi, rax
test rax, rax
je 0x14010e2f8
mov r8, rbp
mov rdx, rbx
mov rcx, rax
call fcn.14006983d
mov rsi, rdi
mov edx, 2
xor ecx, ecx
call fcn.1400688c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400699b9
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x14008b0c0
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.14008aa40
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14008b0ff
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140187020]
jmp 0x14008b109
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x140069afe
Capabilities:
Query environment variable

Disassembly:
jmp 0x14010e114
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
mov rbx, rax
test rax, rax
je 0x14010e1fc
mov rsi, rax
cmp word [rax], r14w
je 0x14010e167
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], r14w
jne 0x14010e14f
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], r14w
jne 0x14010e14b
mov qword [rsp + 0x38], r14
sub rsi, rbx
mov qword [rsp + 0x30], r14
add rsi, 2
sar rsi, 1
mov r8, rbx
mov r9d, esi
mov dword [rsp + 0x28], r14d
xor edx, edx
mov qword [rsp + 0x20], r14
xor ecx, ecx
call fcn.14006a50d
movsxd rbp, eax
test eax, eax
je 0x14010e1fc
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov rcx, rbp
lea edx, [r9 - 0x64]
call fcn.1400698ab
mov rdi, rax
test rax, rax
je 0x14010e1ea
mov qword [rsp + 0x38], r14
mov r9d, esi
mov qword [rsp + 0x30], r14
mov r8, rbx
mov dword [rsp + 0x28], ebp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.14006a50d
test eax, eax
je 0x14010e1ea
mov rsi, rdi
mov rdi, r14
jmp 0x14010e1ed
mov rsi, r14
mov edx, 2
mov rcx, rdi
call fcn.1400688c0
jmp 0x14010e1ff
mov rsi, r14
test rbx, rbx
je 0x14010e20d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140069b0d
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x14008aff0
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.14008a9c0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14008b031
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140187020]
jmp 0x14008b037
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret

Function at 0x140069b85
Capabilities:
Get geographical location

Disassembly:
jmp 0x1400f23b0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1400f1330
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400f2403
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
call qword [0x140187020]
jmp 0x1400f2425
xor edx, edx
mov rcx, qword [rsp + 0x50]
call fcn.1400693bf
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x48
ret
Function at 0x140069b8f
Capabilities:
Terminate process

Disassembly:
jmp 0x1400722c0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140069d88
Capabilities:
Print debug messages

Disassembly:
jmp 0x14012c150
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x140175008]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x14012c176
jmp 0x14012c1f3
mov rcx, qword [rbp + 0x30]
call fcn.140069667
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x14012c18f
jmp 0x14012c1f3
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x14012c1ac
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400688ed
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.140068c8f
test eax, eax
jne 0x14012c1f3
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.140069838
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x140069f95
Capabilities:
Create process on windows

Disassembly:
jmp 0x1401270c0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x118
lea rcx, [rsp + 0xe0]
call fcn.1400692a7
lea rcx, [rsp + 0xb0]
call fcn.1400692a7
lea rcx, [rsp + 0x80]
call fcn.1400692a7
call fcn.140069aae
mov r8d, eax
lea rdx, [rsp + 0xe0]
mov rcx, qword [rsp + 0x120]
call fcn.1400690b8
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x140127162
mov dword [rsp + 0x54], 0
lea rcx, [rsp + 0x80]
call fcn.14006959a
lea rcx, [rsp + 0xb0]
call fcn.14006959a
lea rcx, [rsp + 0xe0]
call fcn.14006959a
mov eax, dword [rsp + 0x54]
jmp 0x1401272fe
call fcn.140069aae
mov r8d, eax
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x128]
call fcn.1400690b8
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
je 0x1401271c2
mov dword [rsp + 0x5c], 0
lea rcx, [rsp + 0x80]
call fcn.14006959a
lea rcx, [rsp + 0xb0]
call fcn.14006959a
lea rcx, [rsp + 0xe0]
call fcn.14006959a
mov eax, dword [rsp + 0x5c]
jmp 0x1401272fe
mov qword [rsp + 0x70], 0
cmp qword [rsp + 0x158], 0
je 0x140127248
call fcn.140069aae
mov r8d, eax
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x158]
call fcn.1400690b8
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x140127236
mov dword [rsp + 0x64], 0
lea rcx, [rsp + 0x80]
call fcn.14006959a
lea rcx, [rsp + 0xb0]
call fcn.14006959a
lea rcx, [rsp + 0xe0]
call fcn.14006959a
mov eax, dword [rsp + 0x64]
jmp 0x1401272fe
lea rcx, [rsp + 0x80]
call fcn.14006922a
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0xb0]
call fcn.14006922a
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0xe0]
call fcn.14006922a
mov rcx, qword [rsp + 0x168]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x160]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsp + 0x150]
mov qword [rsp + 0x30], rcx
mov ecx, dword [rsp + 0x148]
mov dword [rsp + 0x28], ecx
mov ecx, dword [rsp + 0x140]
mov dword [rsp + 0x20], ecx
mov r9, qword [rsp + 0x138]
mov r8, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x78]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rsp + 0x68], eax
lea rcx, [rsp + 0x80]
call fcn.14006959a
lea rcx, [rsp + 0xb0]
call fcn.14006959a
lea rcx, [rsp + 0xe0]
call fcn.14006959a
mov eax, dword [rsp + 0x68]
add rsp, 0x118
ret
Function at 0x14006a1cf
Capabilities:
Parse pe header

Disassembly:
jmp 0x140073650
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140073670
xor al, al
jmp 0x1400736f1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140073683
xor al, al
jmp 0x1400736f1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400736ad
xor al, al
jmp 0x1400736f1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400736c1
xor al, al
jmp 0x1400736f1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400736d3
xor al, al
jmp 0x1400736f1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400736ef
xor al, al
jmp 0x1400736f1
mov al, 1
add rsp, 0x38
ret
Function at 0x14006a666
Capabilities:
Terminate process

Disassembly:
jmp 0x1400f0660
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1400f068e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.14006ad64
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14006a715
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1400f21a0
mov dword [rsp + 8], ecx
sub rsp, 0x38
call fcn.1400f11b0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400f21d5
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov ecx, dword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
call qword [0x140187020]
jmp 0x1400f21df
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x38
ret

Function at 0x14006ab52
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1400f2200
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x38
call fcn.1400f11f0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400f223f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
call qword [0x140187020]
jmp 0x1400f224e
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x38
ret

Function at 0x14006adc8
Capabilities:
Print debug messages

Disassembly:
jmp 0x140106a40
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x14006ae59
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x14008b130
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.14008aa80
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14008b179
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140187020]
jmp 0x14008b188
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret
Function at 0x14006aef9
Capabilities:
Set environment variable

Disassembly:
jmp 0x14012e4b0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
lea rcx, [rsp + 0x70]
call fcn.1400692a7
lea rcx, [rsp + 0x40]
call fcn.1400692a7
call fcn.140069aae
mov r8d, eax
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0xb0]
call fcn.1400690b8
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14012e51f
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x40]
call fcn.14006959a
lea rcx, [rsp + 0x70]
call fcn.14006959a
mov eax, dword [rsp + 0x24]
jmp 0x14012e5ac
call fcn.140069aae
mov r8d, eax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0xb8]
call fcn.1400690b8
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x14012e566
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x40]
call fcn.14006959a
lea rcx, [rsp + 0x70]
call fcn.14006959a
mov eax, dword [rsp + 0x2c]
jmp 0x14012e5ac
lea rcx, [rsp + 0x40]
call fcn.14006922a
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x70]
call fcn.14006922a
mov rcx, qword [rsp + 0x38]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x40]
call fcn.14006959a
lea rcx, [rsp + 0x70]
call fcn.14006959a
mov eax, dword [rsp + 0x30]
add rsp, 0xa8
ret

Function at 0x14006af3f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140139cb0
mov word [rsp + 0x10], dx
mov qword [rsp + 8], rcx
sub rsp, 0x48
movzx eax, word [rsp + 0x58]
movd xmm0, eax
movdqa xmmword [rsp + 0x20], xmm0
pshuflw xmm0, xmmword [rsp + 0x20], 0
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [rsp + 0x20]
pshufd xmm0, xmm0, 0
movdqa xmmword [rsp + 0x20], xmm0
mov rax, qword [rsp + 0x50]
and rax, 0xfff
cmp rax, 0xff0
ja 0x140139dc1
mov rax, qword [rsp + 0x50]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [rsp + 0x10]
pxor xmm0, xmmword [rsp + 0x10]
movdqa xmmword [rsp + 0x10], xmm0
movdqa xmm0, xmmword [rsp + 0x10]
pcmpeqw xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x10], xmm0
movdqa xmm0, xmmword [rsp + 0x30]
pcmpeqw xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [rsp + 0x10]
por xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x10], xmm0
movdqa xmm0, xmmword [rsp + 0x10]
pmovmskb eax, xmm0
mov dword [rsp], eax
cmp dword [rsp], 0
je 0x140139db1
mov eax, dword [rsp]
bsf eax, eax
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
add rax, qword [rsp + 0x50]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x58]
cmp eax, ecx
jne 0x140139da1
mov rax, qword [rsp + 0x50]
mov qword [rsp + 8], rax
jmp 0x140139daa
mov qword [rsp + 8], 0
mov rax, qword [rsp + 8]
jmp 0x140139dfc
mov rax, qword [rsp + 0x50]
add rax, 0x10
mov qword [rsp + 0x50], rax
jmp 0x140139df7
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x58]
cmp eax, ecx
jne 0x140139dd9
mov rax, qword [rsp + 0x50]
jmp 0x140139dfc
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
test eax, eax
jne 0x140139de9
xor eax, eax
jmp 0x140139dfc
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
jmp 0x140139ceb
add rsp, 0x48
ret
Function at 0x140011f20
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov qword [rax], 0
mov rax, qword [rsp + 8]
mov qword [rax + 8], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x67452301
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0xefcdab89
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x98badcfe
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x10325476
ret
Function at 0x140029330
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov dword [rsp + 4], 0
mov dword [rsp], 0xffffffff
movsxd rax, dword [rsp + 4]
mov rcx, qword [rsp + 0x30]
movzx eax, byte [rcx + rax]
test eax, eax
je 0x1400293c3
movsxd rax, dword [rsp + 4]
mov rcx, qword [rsp + 0x30]
movzx eax, byte [rcx + rax]
mov dword [rsp + 0xc], eax
mov eax, dword [rsp + 0xc]
mov ecx, dword [rsp]
xor ecx, eax
mov eax, ecx
mov dword [rsp], eax
mov dword [rsp + 8], 7
jmp 0x14002938e
mov eax, dword [rsp + 8]
dec eax
mov dword [rsp + 8], eax
cmp dword [rsp + 8], 0
jl 0x1400293b7
mov eax, dword [rsp]
and eax, 1
neg eax
mov dword [rsp + 0x10], eax
mov eax, dword [rsp]
shr eax, 1
mov ecx, dword [rsp + 0x10]
and ecx, 0xedb88320
xor eax, ecx
mov dword [rsp], eax
jmp 0x140029384
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
jmp 0x140029348
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret
Function at 0x14002e4d0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov qword [rax], 0
mov rax, qword [rsp + 8]
mov qword [rax + 8], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x6a09e667
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0xbb67ae85
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x3c6ef372
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0xa54ff53a
mov eax, 4
imul rax, rax, 4
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x510e527f
mov eax, 4
imul rax, rax, 5
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x9b05688c
mov eax, 4
imul rax, rax, 6
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x1f83d9ab
mov eax, 4
imul rax, rax, 7
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x5be0cd19
ret

Function at 0x140051d18
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140051a7c
Function at 0x140064130
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r8d, 0x5c
xor edx, edx
mov rcx, qword [rsp + 0x30]
call fcn.140046750
mov rax, qword [rsp + 0x30]
mov dword [rax], 0x67452301
mov rax, qword [rsp + 0x30]
mov dword [rax + 4], 0xefcdab89
mov rax, qword [rsp + 0x30]
mov dword [rax + 8], 0x98badcfe
mov rax, qword [rsp + 0x30]
mov dword [rax + 0xc], 0x10325476
mov eax, 1
add rsp, 0x28
ret