joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400318e8
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400318f4
push rbx
sub rsp, 0x540
mov rax, qword [0x1400543a8]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x140031971
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x140031991
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.140031020
add rsp, 0x540
pop rbx
ret
Function at 0x140034998
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, rcx
mov ebp, 0x7ff
movzx ecx, word [rcx + 6]
mov esi, edx
shr cx, 4
and cx, bp
cmp cx, bp
jne 0x1400349fc
test byte [rbx + 6], 0xf
jne 0x1400349ec
xor edi, edi
cmp word [rbx + 4], di
jne 0x1400349ec
cmp word [rbx + 2], di
jne 0x1400349ec
cmp word [rbx], di
jne 0x1400349ec
lea esi, [rdi + 1]
jmp 0x1400349f4
mov eax, 2
movzx esi, ax
movzx eax, si
jmp 0x140034bff
xor edi, edi
test cx, cx
jne 0x140034a17
mov rcx, rbx
call fcn.1400361a4
movzx ecx, ax
cmp di, ax
jl 0x140034bfc
movsx edx, cx
test esi, esi
jle 0x140034a47
sub ebp, edx
cmp ebp, esi
jg 0x140034a47
movsd xmm0, qword [0x1400543f0]
cmp word [rbx + 6], di
jge 0x140034a39
xorps xmm0, xmmword [0x14003e410]
movsd qword [rbx], xmm0
mov eax, 1
jmp 0x140034bff
movzx r11d, word [rbx + 6]
mov eax, edx
neg eax
cmp eax, esi
jge 0x140034a74
add si, cx
mov eax, 0x800f
shl si, 4
and r11w, ax
or si, r11w
mov word [rbx + 6], si
or eax, 0xffffffff
jmp 0x140034bff
movzx r15d, r11w
lea eax, [rdx + rsi]
and r11w, 0xf
lea ebp, [rax - 1]
mov r13d, 0x8000
mov r12d, 0x10
or r11w, r12w
and r15w, r13w
mov word [rbx + 6], r11w
cmp eax, 0xffffffcb
jle 0x140034bf1
test ebp, ebp
jns 0x140034bf1
lea esi, [r12 - 0xf]
movzx r14d, di
cmp bp, 0xfff0
jg 0x140034b15
movzx ecx, word [rbx + 4]
mov eax, 0xfff0
movzx edx, word [rbx + 2]
sub ax, bp
shr ax, 4
movzx r9d, r11w
add ax, si
movzx r8d, ax
movzx eax, r8w
shl ax, 4
add bp, ax
test r14w, r14w
mov eax, edi
setne al
movzx r14d, ax
or r14w, word [rbx]
mov word [rbx], dx
movzx edx, cx
movzx ecx, r9w
mov r9d, edi
sub r8, rsi
jne 0x140034ae6
mov word [rbx + 4], cx
movzx r11d, di
mov word [rbx + 2], dx
neg bp
je 0x140034b94
movzx r8d, word [rbx]
mov eax, edi
movzx r9d, word [rbx + 2]
movzx edx, r8w
movsx r10d, bp
sub r12d, r10d
mov ecx, r12d
shl dx, cl
test r14w, r14w
movzx r14d, dx
movzx edx, word [rbx + 4]
setne al
or r14w, ax
movzx eax, r9w
shl ax, cl
movzx ecx, bp
shr r8w, cl
mov ecx, r12d
or ax, r8w
mov word [rbx], ax
movzx eax, dx
shl ax, cl
movzx ecx, bp
shr r9w, cl
mov ecx, r12d
or ax, r9w
mov word [rbx + 2], ax
movzx eax, r11w
shl ax, cl
movzx ecx, bp
shr dx, cl
mov ecx, r10d
or ax, dx
mov word [rbx + 4], ax
shr r11w, cl
or r11w, r15w
mov word [rbx + 6], r11w
cmp r13w, r14w
jb 0x140034baa
jne 0x140034bc9
test byte [rbx], sil
je 0x140034bc9
add word [rbx], si
jne 0x140034bc9
add word [rbx + 2], si
jne 0x140034bc9
add word [rbx + 4], si
jne 0x140034bc9
add r11w, si
mov word [rbx + 6], r11w
jmp 0x140034a6c
cmp r11w, r15w
jne 0x140034a6c
cmp word [rbx + 4], di
jne 0x140034a6c
cmp word [rbx + 2], di
jne 0x140034a6c
cmp word [rbx], di
je 0x140034bfc
jmp 0x140034a6c
mov word [rbx + 6], r15w
mov dword [rbx + 2], edi
mov word [rbx], di
movzx eax, di
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400d2f9b
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x14014fbc0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp], 0
jmp 0x14014fbe8
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jae 0x14014fc32
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x20]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14014fbdd
mov rax, qword [rsp + 0x20]
add rsp, 0x18
ret
Function at 0x1400d3f8b
Capabilities:
Get geographical location

Disassembly:
jmp 0x14017d210
push rdi
sub rsp, 0x30
call fcn.1400d545d
mov ecx, 8
imul rcx, rcx, 5
mov rax, qword [rax + rcx]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14017d23c
mov eax, 2
jmp 0x14017d2a9
lea rax, [rsp + 0x24]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov r9d, 2
lea r8, [rsp + 0x24]
mov edx, 0x22
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
nop
mov eax, 2
imul rax, rax, 0
movzx eax, word [rsp + rax + 0x24]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x30
je 0x14017d292
cmp dword [rsp + 0x20], 0x31
je 0x14017d299
cmp dword [rsp + 0x20], 0x32
je 0x14017d2a0
jmp 0x14017d2a7
mov eax, 2
jmp 0x14017d2a9
mov eax, 1
jmp 0x14017d2a9
mov eax, 3
jmp 0x14017d2a9
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x1400d4837
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1401c1b40
mov rax, rcx
neg rcx
test rax, 7
je 0x1401c1b5d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1401c1bb8
test al, 7
jne 0x1401c1b50
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1401c1b71
mov rdx, qword [rax - 8]
test dl, dl
je 0x1401c1be2
test dh, dh
je 0x1401c1bdc
shr rdx, 0x10
test dl, dl
je 0x1401c1bd6
test dh, dh
je 0x1401c1bd0
shr rdx, 0x10
test dl, dl
je 0x1401c1bca
test dh, dh
je 0x1401c1bc4
shr edx, 0x10
test dl, dl
je 0x1401c1bbe
test dh, dh
jne 0x1401c1b71
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret
Function at 0x1400d4878
Capabilities:
Query environment variable

Disassembly:
jmp 0x1402574a0
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140257020
lea rcx, [rsp + 0x20]
call fcn.140257070
movzx eax, al
test eax, eax
jne 0x1402574e5
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.140257050
mov rax, qword [rsp + 0x40]
jmp 0x1402575df
lea rcx, [rsp + 0x20]
call fcn.140257170
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.140257110
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.1400d4c47
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400d4166
lea rcx, [rsp + 0x28]
call fcn.1400d51a1
movzx eax, al
test eax, eax
jne 0x14025757f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.1400d67b8
lea rcx, [rsp + 0x20]
call fcn.140257050
mov rax, qword [rsp + 0x50]
jmp 0x1402575df
lea rcx, [rsp + 0x20]
call fcn.140257170
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.1400d78c5
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.1400d4b66
lea rcx, [rsp + 0x28]
call fcn.1400d8306
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.1400d67b8
lea rcx, [rsp + 0x20]
call fcn.140257050
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret
Function at 0x1400d4dff
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1401a2f20
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1401a28a0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401a2f5f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402ff020]
jmp 0x1401a2f69
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret

Function at 0x1400d50cf
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1401a2e50
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1401a2820
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401a2e91
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402ff020]
jmp 0x1401a2e97
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret

Function at 0x1400d51a6
Capabilities:
Get geographical location

Disassembly:
jmp 0x1402352d0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.140234200
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140235337
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x1402ff030]
jmp 0x140235359
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.1400d4300
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x1400d51bf
Capabilities:
Terminate process

Disassembly:
jmp 0x1401806c0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x1400d5598
Capabilities:
Print debug messages

Disassembly:
jmp 0x140265830
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x1402e0140]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x140265856
jmp 0x1402658d3
mov rcx, qword [rbp + 0x30]
call fcn.1400d4837
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x14026586f
jmp 0x1402658d3
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x14026588c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400d305e
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.1400d36e4
test eax, eax
jne 0x1402658d3
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.1400d4b3e
lea rsp, [rbp + 0x20]
pop rbp
ret

Function at 0x1400d5917
Capabilities:
Get geographical location

Disassembly:
jmp 0x140102760
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14010279d
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.1400d7983
add rsp, 0x58
ret
Function at 0x1400d5944
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x1400f17d0
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x288
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x66
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
mov rax, qword [0x1402e0140]
xor rax, rbp
mov qword [rbp + 0x248], rax
lea rcx, [0x1402fe12e]
call fcn.1400d79c9
nop
cmp qword [rbp + 0x270], 0
je 0x1400f1846
cmp qword [rbp + 0x278], 0
je 0x1400f1846
cmp dword [rbp + 0x280], 0
jne 0x1400f184d
xor al, al
jmp 0x1400f190e
mov rcx, qword [rbp + 0x278]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x1400f186c
xor al, al
jmp 0x1400f190e
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x30]
call fcn.1400d43a0
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 0x20
mov rdx, qword [rbp + 0x288]
lea rcx, [rbp + 0x30]
call fcn.1400d430a
nop
lea rcx, [rbp + 0x30]
call fcn.1400d5d31
movzx eax, al
test eax, eax
jne 0x1400f18c8
mov byte [rbp + 0x214], 0
lea rcx, [rbp + 0x30]
call fcn.1400d361c
movzx eax, byte [rbp + 0x214]
jmp 0x1400f190e
mov eax, dword [rbp + 0x280]
mov r8d, eax
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x30]
call fcn.1400d4f12
nop
lea rcx, [rbp + 0x30]
call fcn.1400d4e0e
nop
mov rcx, qword [rbp + 0x278]
call qword [sym.imp.KERNEL32.dll_FreeResource]
nop
mov byte [rbp + 0x234], 1
lea rcx, [rbp + 0x30]
call fcn.1400d361c
movzx eax, byte [rbp + 0x234]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14028f480]
call fcn.1400d6a2e
mov rax, rdi
mov rcx, qword [rbp + 0x248]
xor rcx, rbp
call fcn.1400d4b3e
lea rsp, [rbp + 0x258]
pop rdi
pop rbp
ret

Function at 0x1400d5a1b
Capabilities:
Set environment variable

Disassembly:
jmp 0x140259350
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret
Function at 0x1400d5d86
Capabilities:
Parse pe header

Disassembly:
jmp 0x1401815a0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1401815c0
xor al, al
jmp 0x140181641
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1401815d3
xor al, al
jmp 0x140181641
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1401815fd
xor al, al
jmp 0x140181641
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140181611
xor al, al
jmp 0x140181641
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140181623
xor al, al
jmp 0x140181641
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14018163f
xor al, al
jmp 0x140181641
mov al, 1
add rsp, 0x38
ret
Function at 0x1400d6696
Capabilities:
Terminate process

Disassembly:
jmp 0x1401a3f10
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1401a3f3e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.1400d7366
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400d6cc2
Capabilities:
Create directory

Disassembly:
jmp 0x1401108c0
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1402e0140]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1401108fd
mov byte [rsp + 0x24], 1
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x24]
jmp 0x140110972
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xb7
jne 0x140110960
mov edx, 1
mov ecx, 2
call fcn.1400d22fd
mov r9d, 0xffffffff
mov r8d, eax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
call fcn.1400d3978
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x140110960
mov edx, 0x10
mov ecx, dword [rsp + 0x48]
call fcn.1400d2b31
movzx eax, al
test eax, eax
jne 0x140110960
mov dword [rsp + 0x20], 0xb7
mov byte [rsp + 0x2c], 0
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x2c]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400d4b3e
add rsp, 0x68
ret
Function at 0x1400d73e3
Capabilities:
Print debug messages

Disassembly:
jmp 0x140232920
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x1400d755a
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1401a2f90
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1401a28e0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401a2fd9
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402ff020]
jmp 0x1401a2fe8
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret
Function at 0x1400f0250
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1d8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1f8]
mov rax, qword [0x1402e0140]
xor rax, rbp
mov qword [rbp + 0x178], rax
lea rcx, [0x1402fe12e]
call fcn.1400d79c9
nop
mov dword [rbp + 0x10], 0x68
lea rax, [rbp + 0x18]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
mov rcx, qword [rbp + 0x1a8]
call fcn.1400d3eb9
lea rcx, [rbp + 0x98]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400f033d
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp - 0x50]
lea rdx, [0x14028fca0]
call fcn.1400d6a2e
mov rcx, qword [rbp + 0x178]
xor rcx, rbp
call fcn.1400d4b3e
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x140239320
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400d305e
sub rsp, rax
mov rax, qword [0x1402e0140]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1402e5120]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x140239512
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x140239466
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x140239466
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x14023944b
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x1402393e8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1402394d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140239531
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x14023950d
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140239531
jmp 0x1402393be
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1400d4b3e
add rsp, 0x1498
pop rdi
pop rsi
ret