joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002c20
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x110
movaps xmmword [rax - 0x18], xmm6
mov r14, r8
movaps xmmword [rax - 0x28], xmm7
mov rsi, rdx
movaps xmmword [rax - 0x38], xmm8
mov rbp, rcx
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd r9, dword [r10 + 0x3c]
mov edi, dword [r9 + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180002cf7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180002cf7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x60ef6db4
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180002cf2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180002cd0
cmp r8d, 0x6f58a212
je 0x180002cfc
test r9d, r9d
jne 0x180002cb0
mov rax, qword [rax]
jmp 0x180002c80
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, rbp
add rax, r10
call rax
movsd xmm7, qword [rsi]
mov rcx, rbp
movsd xmm8, qword [rsi + 8]
addsd xmm7, qword [0x180013c48]
addsd xmm8, qword [0x180013c48]
movups xmm9, xmmword [0x180013b80]
movups xmm10, xmmword [0x18001a338]
movaps xmm11, xmmword [r14]
movaps xmm6, xmmword [rsi]
call fcn.1800025d0
cmp word [rax], 0
je 0x180002d76
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp word [rax + rcx*2], 0
jne 0x180002d60
xor edx, edx
add ecx, 1
je 0x180002d7a
mov rdx, rax
jmp 0x180002d7a
xor edx, edx
mov ecx, edx
mov rax, qword [0x1800167c8]
movaps xmm0, xmmword [0x180013ec0]
mov rbx, qword [0x180016828]
mov qword [rsp + 0x20], rax
mov rax, qword [0x18001a7f0]
movsd qword [rsp + 0x38], xmm6
unpckhpd xmm6, xmm6
movsd qword [rsp + 0x40], xmm6
movsd qword [rsp + 0x80], xmm7
movsd qword [rsp + 0x88], xmm8
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x68], 0
mov word [rsp + 0x90], 0x100
mov byte [rsp + 0x92], 1
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm11
movups xmmword [rsp + 0x6c], xmm10
movups xmmword [rsp + 0x94], xmm9
test rax, rax
jne 0x180002e28
mov rax, qword [0x180016950]
lea r8, str.Canvas.K2_DrawText
add rax, 0x10061f0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x18001a7f0], rax
mov r9, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rbx
call qword [r9 + 0x268]
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r14
ret
Function at 0x180002e80
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x100
movaps xmmword [rax - 0x18], xmm6
mov r14, r8
movaps xmmword [rax - 0x28], xmm7
mov rsi, rdx
movaps xmmword [rax - 0x38], xmm8
mov rbp, rcx
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd r9, dword [r10 + 0x3c]
mov edi, dword [r9 + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180002f47
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180002f47
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xd5fb5ed6
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180002f42
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180002f20
cmp r8d, 0xbb316c70
je 0x180002f4c
test r9d, r9d
jne 0x180002f00
mov rax, qword [rax]
jmp 0x180002ed0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, rbp
add rax, r10
call rax
movsd xmm7, qword [rsi]
mov rcx, rbp
movsd xmm8, qword [rsi + 8]
addsd xmm7, qword [0x180013c48]
addsd xmm8, qword [0x180013c48]
movups xmm9, xmmword [0x180013b80]
movups xmm10, xmmword [0x18001a338]
movaps xmm6, xmmword [rsi]
call fcn.1800025d0
cmp word [rax], 0
je 0x180002fc6
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x180002fb0
xor edx, edx
add ecx, 1
je 0x180002fca
mov rdx, rax
jmp 0x180002fca
xor edx, edx
mov ecx, edx
mov rax, qword [0x1800167c8]
movaps xmm0, xmmword [0x180013ec0]
mov rbx, qword [0x180016828]
mov qword [rsp + 0x20], rax
mov rax, qword [0x18001a7f0]
movsd qword [rsp + 0x38], xmm6
unpckhpd xmm6, xmm6
movsd qword [rsp + 0x40], xmm6
movsd qword [rsp + 0x80], xmm7
movsd qword [rsp + 0x88], xmm8
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x68], 0
mov word [rsp + 0x90], 0x101
mov byte [rsp + 0x92], 1
movups xmmword [rsp + 0x48], xmm0
movaps xmm0, xmmword [r14]
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x6c], xmm10
movups xmmword [rsp + 0x94], xmm9
test rax, rax
jne 0x18000307b
mov rax, qword [0x180016950]
lea r8, str.Canvas.K2_DrawText
add rax, 0x10061f0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x18001a7f0], rax
mov r9, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rbx
call qword [r9 + 0x268]
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop r14
ret
Function at 0x1800010df
Capabilities:
Encode data using xor

Disassembly:
test dl, 3
je 0x1800010ec
sub edx, 1
test dl, 3
jne 0x1800010e4
test edx, edx
je 0x18000110d
mov eax, 0
mov r9d, 0
cdqe
xor dword [rcx + rax], r8d
add r9d, 4
mov eax, r9d
cmp r9d, edx
jb 0x1800010fb
ret

Function at 0x180001417
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov r12d, edx
mov rbp, r8
movsxd rax, dword [rcx + 0x3c]
mov eax, dword [rcx + rax + 0x88]
add rax, rcx
mov edi, dword [rax + 0x20]
mov r13d, dword [rax + 0x1c]
mov r14d, dword [rax + 0x24]
mov ebx, 0
add rdi, rcx
jmp 0x180001454
mov rbx, rdx
mov ecx, dword [rdi + rbx*4]
add rcx, rsi
mov rdx, rbp
call fcn.1800013ca
lea rdx, [rbx + 1]
cmp eax, r12d
jne 0x180001451
lea rax, [rsi + rbx*2]
movzx eax, word [rax + r14]
lea rax, [rsi + rax*4]
mov eax, dword [rax + r13]
add rax, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x140002b70
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x40
mov rax, r8
mov rsi, rcx
mov rcx, qword [rdx]
mov r8d, 0xffffffff
cmp r9, r8
cmovb r8, r9
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
mov rdx, rax
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x140002bad
mov ecx, dword [rsp + 0x3c]
xor eax, eax
jmp 0x140002c38
call sub.KERNEL32.dll_GetLastError
cmp ax, 6
je 0x140002bf0
movzx eax, ax
cmp eax, 8
je 0x140002bdf
cmp eax, 0x21
je 0x140002c01
cmp eax, 0x6d
je 0x140002c12
cmp eax, 0x3e3
je 0x140002c23
cmp eax, 0x6f8
je 0x140002bdf
cmp eax, 0x718
jne 0x140002c34
and word [rsp + 0x38], 0
and dword [rsp + 0x34], 0
mov ax, 0xb
jmp 0x140002c38
and word [rsp + 0x38], 0
and dword [rsp + 0x34], 0
mov ax, 0x22
jmp 0x140002c38
and word [rsp + 0x38], 0
and dword [rsp + 0x34], 0
mov ax, 0x23
jmp 0x140002c38
and word [rsp + 0x38], 0
and dword [rsp + 0x34], 0
mov ax, 0x20
jmp 0x140002c38
and word [rsp + 0x38], 0
and dword [rsp + 0x34], 0
mov ax, 0x21
jmp 0x140002c38
mov ax, 0x12
mov qword [rsi], rcx
mov word [rsi + 8], ax
mov eax, dword [rsp + 0x34]
mov dword [rsi + 0xa], eax
movzx eax, word [rsp + 0x38]
mov word [rsi + 0xe], ax
mov rax, rsi
add rsp, 0x40
pop rsi
ret
Function at 0x401780
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x00407054]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x40189a
mov rax, qword [0x00407058]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x4017ce
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x401880
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x4017b2
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x4018d2
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x00407058]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call dbg._GetPEImageBase
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x00407058]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4018b5
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x401879
sub eax, 0x40
and eax, 0xffffffbf
je 0x401879
mov r9, rbp
add r9, qword [0x00407058]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4018a1
add dword [0x00407054], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.memcpy
xor ebp, ebp
jmp 0x4017db
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
mov rax, qword [0x00407058]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbp + 8]
call dbg.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call dbg.__report_error
nop
nop word cs:[rax + rax]

Function at 0x4024b0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x4024c0
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x4024d0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x402511
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x402508
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x402513
add rax, 0x28
cmp rax, r9
jne 0x4024f4
xor eax, eax
repz ret

Function at 0x4025c0
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x00404310]
cmp word [rbx], 0x5a4d
je 0x4025e0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, rcx
mov rcx, rbx
call sym._ValidateImageBase.part.0
test eax, eax
je 0x4025d4
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp dbg._FindPESection
Function at 0x140001f32
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
mov rsi, rcx
mov rbx, rdx
test rdx, rdx
je 0x140001f51
mov rcx, rdx
call sub.msvcrt.dll_strlen
mov r8, rax
mov rcx, rbx
mov r9, rsi
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp 0x14000be78
jmp qword [sym.imp.msvcrt.dll_fflush]

Function at 0x140004b3e
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov rsi, rcx
mov ecx, 2
call qword [fcn.14000b8b0]
mov r8, qword [rsp + 0x28]
mov rcx, rsi
mov edx, 1
mov rbx, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, rbx
add rsp, 0x38
pop rbx
pop rsi
jmp 0x14000be78

Function at 0x140004b7d
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
cmp qword [0x1400120f0], 0
jne 0x140004b95
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.140004b3e
lea rsi, [rsp + 0x20]
mov rdx, rcx
mov rcx, rsi
call fcn.140004ab7
mov rbx, qword [rsp + 0x28]
mov rcx, rsi
call qword [0x1400120f0]
test rbx, rbx
je 0x140004bc6
test byte [rbx + 7], 0x40
jne 0x140004bc6
mov rcx, rbx
call fcn.140002f93
lea rcx, [0x14000d220]
call fcn.140006690
cmp byte [rax], 0
je 0x140004bfe
mov byte [rax], 0
lea rcx, [0x14000d120]
call fcn.140006690
xor r8d, r8d
mov rcx, rax
mov rax, qword [rax]
mov rdx, qword [rax + 0x38]
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.1400034f8
add rsp, 0x38
pop rbx
pop rsi
ret

Function at 0x140005760
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.14000b8b0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.14000b8b0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x1400057d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400121f4]
mov rbx, rcx
test esi, esi
jle 0x140005900
mov rax, qword [0x1400121f8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14000581b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x1400058a5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140005800
mov rcx, rbx
call fcn.140006220
mov rdi, rax
test rax, rax
je 0x140005922
mov rax, qword [0x1400121f8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140006360
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400121f8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140005907
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14000589e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1400058b0
add dword [0x1400121f4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1400121f8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000589e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140005760
nop dword [rax]
xor esi, esi
jmp 0x140005828
mov rax, qword [0x1400121f8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140005760
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140005760
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140005e90
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140012260]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140012240]
test rbx, rbx
je 0x140005eec
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140005ee3
test rsi, rsi
je 0x140005ee3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140005ec8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140006220
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14000f120]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140006240
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140006248
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140006240
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000629d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140006294
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140006240
add rax, 0x28
cmp rax, r9
jne 0x140006280
xor eax, eax
ret

Function at 0x1400062a0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000f120]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400062bf
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400062c8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400062bf
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140006360
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000f120]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000637f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140006388
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140006630
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [0x1400122e0], 0xffffffff
mov r8d, 0xffff
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov qword [0x1400122e8], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140006680
lea rdx, [0x140006540]
mov ecx, eax
mov dword [0x1400122d8], eax
call fcn.14000bfd0
test eax, eax
jne 0x140006688
add rsp, 0x28
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140006677
call sub.msvcrt.dll_abort
nop
nop
Function at 0x140006690
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [0x14000f0b0]
mov r11d, dword [rsi]
mov rbx, rcx
test r11d, r11d
jne 0x1400066c8
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x140006730
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r12, qword [rcx + 0x10]
test r12, r12
je 0x140006740
mov esi, dword [0x1400122d8]
mov r13, qword [sym.imp.KERNEL32.dll_GetLastError]
call r13
mov edi, eax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, edi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rsi, rsi
je 0x1400067b0
mov rbp, qword [rsi]
cmp rbp, r12
jb 0x1400067f8
sub r12, 1
mov rax, qword [rsi + r12*8 + 8]
test rax, rax
jne 0x1400066b7
mov rcx, rbx
call fcn.140006590
mov qword [rsi + r12*8 + 8], rax
jmp 0x1400066b7
call fcn.140006590
mov qword [rbx + 0x10], rax
jmp 0x1400066b7
mov r10d, dword [rsi]
test r10d, r10d
je 0x14000685a
mov r9d, dword [0x14000d450]
test r9d, r9d
je 0x140006888
lock add dword [0x1400122e0], 1
jne 0x1400068bc
mov r12, qword [rbx + 0x10]
test r12, r12
je 0x140006867
mov eax, dword [rsi]
test eax, eax
je 0x1400066d1
lock sub dword [0x1400122e0], 1
js 0x1400066d1
mov rcx, qword [0x1400122e8]
xor r8d, r8d
mov edx, 1
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
jmp 0x1400066d1
lea rcx, [r12 + 0x21]
mov edx, 8
lea rdi, [r12 + 0x20]
call sub.msvcrt.dll_calloc
mov rsi, rax
test rax, rax
je 0x1400068e3
mov qword [rax], rdi
mov ecx, dword [0x1400122d8]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x14000670b
call r13
jmp 0x14000670b
lea rdi, [rbp + rbp]
lea rax, [r12 + 0x20]
mov rcx, rsi
cmp rdi, r12
cmovb rdi, rax
lea rdx, [rdi*8 + 8]
call sub.msvcrt.dll_realloc
mov rsi, rax
test rax, rax
je 0x1400068e3
mov qword [rax], rdi
sub rdi, rbp
lea rcx, [rax + rbp*8 + 8]
xor edx, edx
lea r8, [rdi*8]
call sub.msvcrt.dll_memset
jmp 0x1400067d3
call fcn.140006630
mov dword [0x14000d450], 1
mov edx, dword [rsi]
test edx, edx
jne 0x14000675c
mov r12, qword [rbx + 0x10]
test r12, r12
jne 0x1400066d1
mov rax, qword [0x1400122d0]
lea r12, [rax + 1]
mov qword [0x1400122d0], r12
mov qword [rbx + 0x10], r12
jmp 0x140006777
lock add dword [0x14000d454], 1
je 0x140006841
mov r8d, dword [0x14000d450]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
lea rdi, [0x14000d450]
test r8d, r8d
jne 0x140006850
nop dword [rax]
xor ecx, ecx
call rbp
mov ecx, dword [rdi]
test ecx, ecx
je 0x1400068b0
jmp 0x140006850
mov rcx, qword [0x1400122e8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000676a
lock sub dword [0x1400122e0], 1
jmp 0x14000676a
call sub.msvcrt.dll_abort
nop
nop dword [rax]
cmp qword [rcx], rdx
jae 0x140006900
mov qword [rcx], rdx
mov qword [rcx + 0x18], 0
cmp qword [rcx + 8], r8
jae 0x14000690a
mov qword [rcx + 8], r8
test r9, r9
je 0x140006914
cmp qword [rcx], rdx
je 0x140006918
ret
mov qword [rcx + 0x18], r9
ret
Function at 0x14001754d
Capabilities:
Acquire debug privileges

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
push rax
push rax
push rax
push rax
sub rsp, 0x28
mov dword [0x1400a7001], 0x5a
mov dword [0x1400a7001], 0x5b
mov byte [rsp + 0x28], 0
mov dword [0x1400a7001], 0x5d
lea rax, [rsp + 0x30]
mov rax, rax
push rax
push 0x28
sub rsp, 0x20
call fcn.14001e07e
add rsp, 0x20
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
call fcn.14001e0fc
and rax, rax
je 0x1400176d8
mov dword [0x1400a7001], 0x5e
lea rax, [rsp + 0x38]
mov dword [0x1400a7001], 0x60
lea rax, [rsp + 0x38]
mov rax, rax
push rax
movabs rax, str.SeDebugPrivilege
push rax
push 0
pop rcx
pop rdx
pop r8
call fcn.14001e102
and rax, rax
je 0x1400176ba
mov dword [0x1400a7001], 0x61
lea rax, [rsp + 0x40]
mov dword [0x1400a7001], 0x64
lea rbp, [rsp + 0x40]
mov dword [rbp], 1
mov dword [0x1400a7001], 0x65
lea rbp, [rsp + 0x38]
movsxd rax, dword [rbp]
push rax
lea rbp, [rsp + 0x48]
push rbp
pop rbp
pop rax
mov dword [rbp + 4], eax
mov dword [0x1400a7001], 0x66
lea rbp, [rsp + 0x38]
movsxd rax, dword [rbp + 4]
push rax
lea rbp, [rsp + 0x48]
push rbp
pop rbp
pop rax
mov dword [rbp + 8], eax
mov dword [0x1400a7001], 0x67
push rbp
pop rbp
mov dword [rbp + 0xc], 2
mov dword [0x1400a7001], 0x69
lea rax, [rsp + 0x50]
mov rax, rax
push rax
lea rax, [rsp + 0x50]
mov rax, rax
push rax
push 4
lea rax, [rsp + 0x58]
mov rax, rax
push rax
push 0
push qword [rsp + 0x58]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001e108
add rsp, 0x30
mov rax, rax
push rax
pop rax
mov byte [rsp + 0x28], al
mov dword [0x1400a7001], 0x6a
mov dword [0x1400a7001], 0x6b
push qword [rsp + 0x30]
pop rcx
call fcn.14001e054
mov dword [0x1400a7001], 0x6c
mov dword [0x1400a7001], 0x6d
movsx rax, byte [rsp + 0x28]
movsx rax, al
jmp 0x140017705
add rsp, 0x58
pop r15
pop rbp
ret
Function at 0x14005c120
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r8, rcx
test rcx, rcx
je 0x14005c1eb
mov rdx, qword [rcx]
xor r9d, r9d
mov qword [rsp], rdi
mov eax, r9d
mov r10d, r9d
lea rdi, [0x1400991f0]
mov byte [rdx + 0x16], al
mov rdx, qword [rcx]
mov byte [rdx + 0x17], al
mov rdx, qword [rcx]
mov byte [rdx + 0x18], al
mov rdx, qword [rcx]
mov byte [rdx + 0x19], al
movsxd r11, dword [rcx + 8]
test r11, r11
jle 0x14005c195
mov qword [rsp + 0x10], rbx
mov rbx, qword [rcx]
nop dword [rax]
movzx edx, byte [rbx + r10]
mov ecx, eax
inc r10
shr rcx, 0x18
xor rdx, rcx
mov ecx, eax
mov eax, dword [rdi + rdx*4]
shl ecx, 8
xor eax, ecx
cmp r10, r11
jl 0x14005c170
mov rbx, qword [rsp + 0x10]
movsxd r10, dword [r8 + 0x18]
test r10, r10
jle 0x14005c1c2
mov r11, qword [r8 + 0x10]
movzx edx, byte [r11 + r9]
mov ecx, eax
inc r9
shr rcx, 0x18
xor rdx, rcx
mov ecx, eax
mov eax, dword [rdi + rdx*4]
shl ecx, 8
xor eax, ecx
cmp r9, r10
jl 0x14005c1a2
mov rcx, qword [r8]
mov rdi, qword [rsp]
mov edx, eax
mov byte [rcx + 0x16], al
mov rcx, qword [r8]
shr edx, 8
mov byte [rcx + 0x17], dl
mov rcx, qword [r8]
mov edx, eax
shr edx, 0x10
shr eax, 0x18
mov byte [rcx + 0x18], dl
mov rcx, qword [r8]
mov byte [rcx + 0x19], al
add rsp, 8
ret