joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003c180
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov esi, dword [0x1400fde78]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test edi, edi
jne 0x14003c1b7
cmp rsi, 2
jb 0x14003c1c1
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140060190
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14003c1a3
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x14003de00
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x14003de15
mov dword [rsi], eax
cmp eax, 0xffffffff
setne al
add rsp, 0x20
pop rsi
ret

Function at 0x14003e5e0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x1400ff4c8]
cmp rdi, 1
jbe 0x14003e609
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400587a0
lea rcx, [0x1400ff4c8]
call fcn.14003d910
test al, al
je 0x14003e64f
mov qword [0x1400ff4d0], 0
lea rbx, [0x1400ff4c8]
lea rdi, [0x1400ff4d0]
mov rcx, rdi
xor edx, edx
call fcn.140036db0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.14003d9b0
jmp 0x14003e5f7
mov rdi, qword [0x1400ff4c8]
jmp 0x14003e5f7

Function at 0x140040d00
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp qword [0x1400ff530], 0
jne 0x140040d3d
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140040d30
mov dword [rdi], eax
mov dword [0x1400ff538], eax
mov qword [0x1400ff530], rsi
cmp eax, 0xffffffff
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
int3
Function at 0x14004f2d0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x14004f317
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14004f331
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14004f30f
mov qword [rsi], rdi
call fcn.14004ff10
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x14004f347
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.14004ff10
mov rcx, qword [rsi]
call fcn.14004ff20
mov qword [rsi], 0
jmp 0x14004f2fd
int3
Function at 0x1400533a0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
movapd xmmword [rsp + 0x40], xmm6
mov rsi, rcx
mov rax, qword [0x1400f4028]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
call fcn.140050980
mov qword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
movsd xmm0, qword [0x1400fa180]
xorpd xmm6, xmm6
ucomisd xmm0, xmm6
jne 0x1400533fd
jnp 0x140053462
ucomisd xmm0, xmm6
jne 0x140053409
jnp 0x14005358c
movsd xmm1, qword [rsp + 0x28]
unpcklps xmm1, xmmword [0x1400d99d0]
subpd xmm1, xmmword [0x1400d99e0]
movapd xmm2, xmm1
unpckhpd xmm2, xmm1
addsd xmm2, xmm1
divsd xmm2, xmm0
mulsd xmm2, qword [0x1400dfc58]
cvttsd2si rax, xmm2
mov qword [rsi], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140069700
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov r12d, eax
call rbx
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x1400fa190]
mov ecx, dword [0x1400f73b4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140053593
mov eax, dword [0x1400fa1a0]
mov ecx, dword [0x1400f73b4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400535cd
rdtsc
mov r14, rax
mov r15, rdx
xor edi, edi
lea rbx, [rsp + 0x30]
mov qword [rbx], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbp, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [rbx], rdi
lea rdi, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub rbp, qword [0x1400fa198]
movq xmm1, rbp
punpckldq xmm1, xmmword [0x1400d99d0]
subpd xmm1, xmmword [0x1400d99e0]
haddpd xmm1, xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rdi]
divsd xmm1, xmm0
xorpd xmm0, xmm0
movsd xmm2, qword [0x1400dfc50]
ucomisd xmm2, xmm1
ja 0x1400533fd
shl r15, 0x20
or r14, r15
sub r14, qword [0x1400fa188]
movq xmm0, r14
punpckldq xmm0, xmmword [0x1400d99d0]
subpd xmm0, xmmword [0x1400d99e0]
haddpd xmm0, xmm0
divsd xmm0, xmm1
movsd qword [0x1400fa180], xmm0
jmp 0x1400533fd
xor eax, eax
jmp 0x14005343b
lea rcx, [0x1400fa190]
call fcn.140068ae0
cmp dword [0x1400fa190], 0xffffffff
jne 0x1400534ac
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x1400fa188], rdx
lea rcx, [0x1400fa190]
call fcn.140068b78
jmp 0x1400534ac
lea rcx, [0x1400fa1a0]
call fcn.140068ae0
cmp dword [0x1400fa1a0], 0xffffffff
jne 0x1400534d1
lea rbx, [rsp + 0x30]
mov qword [rbx], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
mov qword [0x1400fa198], rax
lea rcx, [0x1400fa1a0]
call fcn.140068b78
jmp 0x1400534d1
Function at 0x140053de0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x190
mov rax, qword [0x1400f4028]
xor rax, rsp
mov qword [rsp + 0x188], rax
mov eax, dword [0x1400fa1c0]
mov ecx, dword [0x1400f73b4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140053e43
mov rax, qword [0x1400fa1b8]
mov esi, dword [rax]
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.140069700
mov eax, esi
add rsp, 0x190
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1400fa1c0]
call fcn.140068ae0
cmp dword [0x1400fa1c0], 0xffffffff
jne 0x140053e1d
lea rsi, [rsp + 0x6c]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.14006c090
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x68]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x2c]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.140068984
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x1400fa1f8]
mov ecx, dword [0x1400f73b4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140053f03
lea r8, [0x1400fa1c8]
lea rdx, [rsp + 0x68]
mov rcx, rsi
mov r9d, edi
call fcn.140030f20
mov qword [0x1400fa1b8], rsi
lea rcx, [0x1400fa1c0]
call fcn.140068b78
jmp 0x140053e1d
lea rcx, [0x1400fa1f8]
call fcn.140068ae0
cmp dword [0x1400fa1f8], 0xffffffff
jne 0x140053ed4
xorps xmm0, xmm0
lea rbx, [rsp + 0x30]
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movups xmmword [0x1400fa1e8], xmm2
movups xmmword [0x1400fa1d8], xmm1
movups xmmword [0x1400fa1c8], xmm0
lea rcx, [0x1400fa1f8]
call fcn.140068b78
jmp 0x140053ed4

Function at 0x140056d60
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov edi, dword [0x1400fde78]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test esi, esi
jne 0x140056d8d
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140056d83

Function at 0x140058760
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1400f7218]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140058794
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x140058794
mov rax, qword [rax + rcx]
add rsp, 0x20
pop rsi
ret
xor eax, eax
jmp 0x14005878e
Function at 0x1400587a0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1400f7218]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400587de
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x1400587d7
call fcn.140036ba0
jmp 0x1400587be

Function at 0x14005cf70
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x14005cfa8
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
mov rbx, rsi
cmp rsi, r14
jae 0x14005cfb2
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14005cfb9
add rdi, rbx
sub rsi, rbx
jne 0x14005cf8a
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ebx, 0xffffffff
jmp 0x14005cf92
int3

Function at 0x14005d4b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
movzx eax, byte [rcx + 0x4f]
test al, al
js 0x14005d548
test rax, rax
jne 0x14005d537
cmp dword [rsi + 0x50], 0
jne 0x14005d537
mov byte [rsi + 0x54], 0
mov rax, qword [rsi + 0x10]
mov qword [rsi + 8], rax
cmp rax, qword [rsi + 0x18]
je 0x14005d525
lea rdi, [rsi + 0x20]
movabs r14, 0x100003600
lea rcx, [rax + 1]
mov qword [rsi + 0x10], rcx
movzx edx, byte [rax]
mov rcx, rdi
xor r8d, r8d
call fcn.140048410
cmp rax, 0xffffffffffffffff
jne 0x14005d517
cmp dword [rsi + 0x58], 1
jne 0x14005d564
jmp 0x14005d551
mov rax, qword [rsi + 0x10]
mov qword [rsi + 8], rax
cmp rax, qword [rsi + 0x18]
jne 0x14005d4f3
mov byte [rsi + 0x54], 1
xor ebx, ebx
mov eax, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400bdc80
mov rax, qword [rsi + 0x40]
jmp 0x14005d4c8
mov rax, qword [rsi + 8]
movzx eax, byte [rax]
cmp rax, 0x20
ja 0x14005d564
bt r14, rax
jb 0x14005d517
mov rax, qword [rsi + 0x10]
mov bl, 1
nop word [rax + rax]
cmp rax, qword [rsi + 0x18]
je 0x14005d52b
movzx edx, byte [rax]
mov rcx, rdi
xor r8d, r8d
call fcn.140048410
cmp rax, 0xffffffffffffffff
jne 0x14005d52b
cmp dword [rsi + 0x58], 1
mov rax, qword [rsi + 0x10]
je 0x14005d59e
add rax, 1
mov qword [rsi + 0x10], rax
jmp 0x14005d570
movzx ecx, byte [rax]
cmp rcx, 0x20
ja 0x14005d594
bt r14, rcx
jae 0x14005d594
jmp 0x14005d52b
Function at 0x140060710
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x1400fdf30]
cmp rsi, 1
jbe 0x140060733
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400587a0
lea rcx, [0x1400fdf30]
call fcn.14003d910
test al, al
je 0x140060779
mov qword [0x1400fdf38], 0
lea rdi, [0x1400fdf30]
lea rsi, [0x1400fdf38]
mov rcx, rsi
xor edx, edx
call fcn.140036db0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.14003d9b0
jmp 0x140060723
mov rsi, qword [0x1400fdf30]
jmp 0x140060723

Function at 0x140060b80
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x1400fdf58]
cmp rsi, 1
jbe 0x140060ba3
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400587a0
lea rcx, [0x1400fdf58]
call fcn.14003d910
test al, al
je 0x140060be9
mov qword [0x1400fdf60], 0
lea rdi, [0x1400fdf58]
lea rsi, [0x1400fdf60]
mov rcx, rsi
xor edx, edx
call fcn.140036db0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.14003d9b0
jmp 0x140060b93
mov rsi, qword [0x1400fdf58]
jmp 0x140060b93

Function at 0x140061170
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, ecx
test r8, r8
je 0x14006119c
xor ecx, ecx
lea r9, [0x1400e37a0]
movzx r10d, al
movzx r11d, byte [rdx + rcx]
xor r11d, r10d
shr eax, 8
xor eax, dword [r9 + r11*4]
add rcx, 1
cmp r8, rcx
jne 0x140061180
ret

Function at 0x140065730
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
xor eax, eax
test r8d, r8d
sete al
xor ebx, ebx
test edx, edx
sete bl
xor ecx, ecx
mov edx, ebx
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi], 0
test rax, rax
je 0x1400657c7
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400657b1
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14006578e
mov qword [rsi], rdi
call fcn.14004ff10
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi]
mov byte [rsi + 8], 1
inc rax
cmp rax, 1
jbe 0x1400657cb
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.14004ff10
mov rcx, qword [rsi]
call fcn.14004ff20
mov qword [rsi], 0
jmp 0x14006577c
mov byte [rsi + 8], 1
int3

Function at 0x140065c60
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1400ff4e0]
mov ecx, dword [0x1400f73b4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140065c95
lea rcx, [0x1400ff4d8]
add rsp, 0x28
jmp fcn.140058760
lea rcx, [0x1400ff4e0]
call fcn.140068ae0
cmp dword [0x1400ff4e0], 0xffffffff
jne 0x140065c85
mov qword [0x1400ff4d8], 0
lea rcx, [0x1400ff4d8]
xor edx, edx
call fcn.140036db0
lea rcx, [0x1400ff4e0]
call fcn.140068b78
jmp 0x140065c85
Function at 0x140068200
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1400ff9e8]
mov ecx, dword [0x1400f73b4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140068266
lea rcx, [0x1400ff9e0]
xor edx, edx
call fcn.1400587a0
mov eax, dword [0x1400ff9f8]
mov ecx, dword [0x1400f73b4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400682a2
lea rcx, [0x1400ff9f0]
xor edx, edx
add rsp, 0x28
jmp fcn.1400587a0
lea rcx, [0x1400ff9e8]
call fcn.140068ae0
cmp dword [0x1400ff9e8], 0xffffffff
jne 0x140068225
mov qword [0x1400ff9e0], 0
lea rcx, [0x1400ff9e0]
xor edx, edx
call fcn.140036db0
lea rcx, [0x1400ff9e8]
call fcn.140068b78
jmp 0x140068225
lea rcx, [0x1400ff9f8]
call fcn.140068ae0
cmp dword [0x1400ff9f8], 0xffffffff
jne 0x140068254
mov qword [0x1400ff9f0], 0
lea rcx, [0x1400ff9f0]
xor edx, edx
call fcn.140036db0
lea rcx, [0x1400ff9f8]
call fcn.140068b78
jmp 0x140068254

Function at 0x1400682f0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x1400ffa08]
mov ecx, dword [0x1400f73b4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14006832d
lea rcx, [0x1400ffa00]
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.1400587a0
lea rcx, [0x1400ffa08]
call fcn.140068ae0
cmp dword [0x1400ffa08], 0xffffffff
jne 0x140068319
mov qword [0x1400ffa00], 0
lea rcx, [0x1400ffa00]
xor edx, edx
call fcn.140036db0
lea rcx, [0x1400ffa08]
call fcn.140068b78
jmp 0x140068319

Function at 0x140075114
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140075244
Function at 0x140094c70
Capabilities:
Set registry value

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x1400f4028]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x34]
mov dword [rax], r8d
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140069700
mov eax, esi
add rsp, 0x40
pop rsi
ret
xor r8d, r8d
test edx, edx
cmovns r8d, edx
lea rdx, str.PWALauncherResult
jmp 0x14002b870

Function at 0x1400abe60
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call fcn.140068984
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400abed0]
xor ecx, ecx
xor edx, edx
mov r9, rax
call fcn.140074ee0
mov qword [rbx], rax
test rax, rax
je 0x1400abeb7
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x1400ada80
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rcx
mov edi, 2
cmp rdx, 1
jne 0x1400adaba
mov rsi, qword [r14 + 8]
cmp rdi, rsi
ja 0x1400adbbb
jae 0x1400adbb1
mov rax, qword [r14 + 0x18]
test rax, rax
js 0x1400adad5
cvtsi2ss xmm0, rax
jmp 0x1400adaea
lea rax, [rdx - 1]
test rdx, rax
jne 0x1400adac8
mov rdi, rdx
jmp 0x1400ada97
mov rcx, rdx
call fcn.140046860
mov rdi, rax
jmp 0x1400ada97
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [r14 + 0x20]
call fcn.140094200
cvttss2si rcx, xmm0
movss xmm1, dword [0x1400dbdc0]
movaps xmm2, xmm0
subss xmm2, xmm1
cvttss2si rax, xmm2
btc rax, 0x3f
ucomiss xmm0, xmm1
cmovb rax, rcx
cmp rsi, 3
jb 0x1400adb9d
mov rcx, rsi
shr rcx, 1
movabs rdx, 0x5555555555555555
and rdx, rcx
mov rbx, rsi
sub rbx, rdx
movabs rdx, 0x3333333333333333
mov rcx, rbx
shr rcx, 2
and rbx, rdx
and rcx, rdx
add rcx, rbx
mov rdx, rcx
shr rdx, 4
add rdx, rcx
movabs rcx, 0xf0f0f0f0f0f0f0f
and rcx, rdx
movabs rdx, 0x101010101010101
imul rdx, rcx
shr rdx, 0x38
cmp edx, 1
ja 0x1400adb9d
cmp rax, 2
jb 0x1400adba5
dec rax
bsr rcx, rax
xor ecx, 0x3f
neg cl
mov eax, 1
shl rax, cl
jmp 0x1400adba5
mov rcx, rax
call fcn.140046860
cmp rdi, rax
cmovb rdi, rax
cmp rdi, rsi
jb 0x1400adbbb
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, r14
mov rdx, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x140095ea0

Function at 0x1400add70
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x1400f4028]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x1400addef
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, esi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x1400addf4
test bl, bl
je 0x1400addcb
cmp byte [rdi + 8], 0
je 0x1400ade50
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
mov edx, esi
call fcn.14002b300
mov sil, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140069700
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rcx, qword [rdi]
jmp 0x1400add9d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rdi + 8], 0
je 0x1400ade1c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400ade21
xor esi, esi
jmp 0x1400addd8
mov rcx, qword [rdi]
jmp 0x1400ade09
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rdi + 8], 0
je 0x1400ade58
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1400addcb
mov esi, dword [rsp + 0x24]
jmp 0x1400addcb
mov rcx, qword [rdi]
jmp 0x1400addc0
mov rcx, qword [rdi]
jmp 0x1400ade38
Function at 0x1400c5af0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, rcx
test r8d, r8d
jne 0x1400c5b1e
movabs rax, 0x100000001
mov qword [r14], rax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov r15d, r8d
mov dword [r14], 0
test dl, 1
jne 0x1400c5b3f
xor ebx, ebx
movzx edx, dx
shr edx, 1
inc ebx
mov ebp, edx
test dl, 1
je 0x1400c5b2f
jmp 0x1400c5b44
movzx ebp, dx
xor ebx, ebx
bsr ecx, ebp
xor ecx, 0x1f
mov eax, 0x20
sub eax, ecx
imul eax, r15d
cmp eax, 0xde3
jg 0x1400c5c41
mov eax, 1
mov esi, eax
lea eax, [rsi + rsi]
cmp esi, r15d
jle 0x1400c5b65
or cl, 0x20
mov r8, 0xffffffffffffffff
shl r8, cl
sar esi, 2
movzx r10d, dx
xor eax, eax
test esi, esi
jne 0x1400c5c00
xor esi, esi
mov rcx, r10
mov dword [r14], 0
test rcx, rcx
je 0x1400c5bb9
xor edx, edx
mov edi, ecx
and edi, 0xfffffff
mov dword [r14 + rdx*4 + 4], edi
shr rcx, 0x1c
inc rdx
test rcx, rcx
jne 0x1400c5b9c
mov word [r14], dx
test al, 1
je 0x1400c5bc7
mov rcx, r14
mov edx, ebp
call fcn.1400c5810
test esi, esi
je 0x1400c5be6
mov rcx, r14
call fcn.1400c5960
test esi, r15d
je 0x1400c5be2
mov rcx, r14
mov edx, ebp
call fcn.1400c5810
sar esi, 1
jne 0x1400c5bcb
imul ebx, r15d
mov rcx, r14
mov edx, ebx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.1400c5760
xor eax, eax
mov r9d, 1
mov rcx, r10
imul rcx, rcx
test esi, r15d
je 0x1400c5c2b
test rcx, r8
mov edx, 1
cmove rdx, r10
movzx eax, al
cmovne eax, r9d
imul rcx, rdx
sar esi, 1
je 0x1400c5b8e
mov rdx, rcx
shr rdx, 0x20
je 0x1400c5c0b
jmp 0x1400c5b8e
call fcn.1400b1890
int3
Function at 0x1800012d0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xf0
mov edi, edx
mov r8, rcx
test rcx, rcx
je 0x180001417
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180001417
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x180001417
movups xmm0, xmmword [rax + 0x18]
lea rcx, [rsp]
xor r9d, r9d
movups xmm1, xmmword [rax + 0x28]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x38]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x48]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x68]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x78]
movups xmmword [rcx + 0x50], xmm1
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax + 0x88]
sub rax, 0xffffffffffffff68
movups xmmword [rcx - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rcx], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm1
movups xmm1, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm0
movups xmm0, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm1
movups xmm1, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x60], xmm1
mov eax, dword [rsp + 0x70]
add rax, r8
mov r10d, dword [rax + 0x20]
mov ebp, dword [rax + 0x1c]
add r10, r8
mov r11d, dword [rax + 0x24]
add rbp, r8
mov esi, dword [rax + 0x14]
add r11, r8
test esi, esi
je 0x180001417
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [r11]
mov edx, dword [r10]
add rdx, r8
mov ebx, dword [rbp + rax*4]
xor eax, eax
add rbx, r8
movsx ecx, byte [rdx]
test ecx, ecx
je 0x180001403
nop word [rax + rax]
add eax, ecx
lea rdx, [rdx + 1]
add ecx, 4
imul eax, ecx
movsx ecx, byte [rdx]
test ecx, ecx
jne 0x1800013f0
cmp edi, eax
je 0x180001432
inc r9d
add r11, 2
add r10, 4
cmp r9d, esi
jb 0x1800013d0
xor eax, eax
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rax, rbx
jmp 0x180001419