joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a4730
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1400a4772
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1400a47b9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1400a4812
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1400a47d0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400a4853
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400b71a2]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400b71a3]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400a4820
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x1400a57c8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400a5812
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400a5812
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400a5812
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400a5812
cmp dword [rcx + 0x84], 0xe
jbe 0x1400a5812
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400a5814
xor al, al
add rsp, 0x28
ret
Function at 0x140001000
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov edi, r8d
mov ebx, edx
mov rsi, rcx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140001029
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140001029
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov r14d, dword [r9 + r11*4]
mov bpl, byte [rax + r14]
test bpl, bpl
je 0x140001094
add r14, r10
mov r15d, 0xa20a94b5
movsx ebp, bpl
xor ebp, r15d
imul r15d, ebp, 0x1000193
mov bpl, byte [r14]
inc r14
test bpl, bpl
jne 0x140001072
cmp r15d, 0xe0086ff3
je 0x14000109b
test r11, r11
jne 0x140001056
jmp 0x140001029
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov rcx, rsi
call rdx
cmp eax, 0xffffffff
je 0x14000117f
mov ecx, eax
or ecx, edi
not edi
mov rdx, qword gs:[0x60]
mov r8, qword [rdx + 0x18]
add r8, 0x10
mov r8, qword [r8]
mov rdx, qword [r8 + 0x30]
movsxd r9, dword [rdx + 0x3c]
mov r9d, dword [rdx + r9 + 0x88]
test r9, r9
je 0x1400010d9
mov r10d, dword [rdx + r9 + 0x18]
test r10, r10
je 0x1400010d9
mov r14d, dword [rdx + r9 + 0x20]
add r14, rdx
lea r15, [rdx + 1]
dec r10
mov r11d, r10d
mov r12d, dword [r14 + r11*4]
mov bpl, byte [rdx + r12]
test bpl, bpl
je 0x140001146
add r12, r15
mov r13d, 0x9cfb824c
movsx ebp, bpl
xor ebp, r13d
imul r13d, ebp, 0x1000193
mov bpl, byte [r12]
inc r12
test bpl, bpl
jne 0x140001123
cmp r13d, 0x5daac542
je 0x14000114d
test r11, r11
jne 0x140001107
jmp 0x1400010d9
and eax, edi
test bl, bl
cmovne eax, ecx
mov ecx, dword [rdx + r9 + 0x1c]
mov r8d, dword [rdx + r9 + 0x24]
add rcx, rdx
add r8, rdx
movzx r8d, word [r8 + r11*2]
mov r8d, dword [rcx + r8*4]
add r8, rdx
mov rcx, rsi
mov edx, eax
call r8
test eax, eax
setne al
jmp 0x140001181
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140001d8c
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140001da8
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140001da8
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
mov bl, byte [rax + rdi]
test bl, bl
je 0x140001e0a
add rdi, r10
mov ebp, 0xf4fb4173
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rdi]
inc rdi
test bl, bl
jne 0x140001dee
cmp ebp, 0x44a4adb1
je 0x140001e11
test r11, r11
jne 0x140001dd5
jmp 0x140001da8
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
xor ecx, ecx
call rdx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140001e3f
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140001e3f
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
mov bl, byte [rax + rdi]
test bl, bl
je 0x140001ea1
add rdi, r10
mov ebp, 0x2be84048
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rdi]
inc rdi
test bl, bl
jne 0x140001e85
cmp ebp, 0x271b1652
je 0x140001ea8
test r11, r11
jne 0x140001e6c
jmp 0x140001e3f
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov rcx, rsi
call rdx
cmp eax, 0xffffffff
jne 0x140001f70
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140001ee0
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140001ee0
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
mov bl, byte [rax + rsi]
test bl, bl
je 0x140001f42
add rsi, r10
mov edi, 0xb295ad05
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
mov bl, byte [rsi]
inc rsi
test bl, bl
jne 0x140001f26
cmp edi, 0xd29a0077
je 0x140001f49
test r11, r11
jne 0x140001f0d
jmp 0x140001ee0
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov ecx, dword [rcx + rdx*4]
add rcx, rax
call rcx
and eax, 0xfffffffe
cmp eax, 2
jne 0x140001f70
xor eax, eax
jmp 0x140001f72
mov al, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x140003220
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbp
push rbx
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
add rdx, 0x10
mov rdx, qword [rdx]
mov rax, qword [rdx + 0x30]
movsxd r8, dword [rax + 0x3c]
mov r8d, dword [rax + r8 + 0x88]
test r8, r8
je 0x140003235
mov r9d, dword [rax + r8 + 0x18]
test r9, r9
je 0x140003235
mov r10d, dword [rax + r8 + 0x20]
add r10, rax
lea r11, [rax + 1]
dec r9
mov esi, r9d
mov edi, dword [r10 + rsi*4]
mov bl, byte [rax + rdi]
test bl, bl
je 0x140003298
add rdi, r11
mov ebp, 0x1568aee3
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rdi]
inc rdi
test bl, bl
jne 0x14000327c
cmp ebp, 0x8819e4b5
je 0x14000329f
test rsi, rsi
jne 0x140003263
jmp 0x140003235
mov edx, dword [rax + r8 + 0x1c]
mov r8d, dword [rax + r8 + 0x24]
add rdx, rax
add r8, rax
movzx r8d, word [r8 + rsi*2]
mov edx, dword [rdx + r8*4]
add rdx, rax
pop rbx
pop rbp
pop rdi
pop rsi
jmp rdx
Function at 0x1400032f6
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x28
lea rcx, str.msvcrt.dll
call fcn.140003220
mov qword [0x140006180], rax
test rax, rax
je 0x14000339f
lea rdx, str.msvcrt.dll
xor ecx, ecx
call 0x1400033a5
lea rdx, str.ws2_32.dll
mov ecx, 1
call 0x1400033a5
lea rdx, str.iphlpapi.dll
mov ecx, 2
call 0x1400033a5
lea rdx, str.kernel32.dll
mov ecx, 3
call 0x1400033a5
lea rdx, str.Shell32.dll
mov ecx, 4
call 0x1400033a5
lea rdx, str.Advapi32.dll
mov ecx, 5
call 0x1400033a5
lea rdx, str.Secur32.dll
mov ecx, 6
call 0x1400033a5
lea rdx, str.ntdll.dll
mov ecx, 7
add rsp, 0x28
jmp 0x1400033a5
nop
add rsp, 0x28
ret
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rdx
mov edi, ecx
movsxd rdx, dword [0x140006170]
inc rdx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd r8, dword [rax + 0x3c]
mov r8d, dword [rax + r8 + 0x88]
test r8, r8
je 0x1400033d1
mov r9d, dword [rax + r8 + 0x18]
test r9, r9
je 0x1400033d1
mov r10d, dword [rax + r8 + 0x20]
add r10, rax
lea rbx, [rax + 1]
dec r9
mov r11d, r9d
mov r14d, dword [r10 + r11*4]
mov bpl, byte [rax + r14]
test bpl, bpl
je 0x14000343d
add r14, rbx
mov r15d, 0x286f8891
movsx ebp, bpl
xor ebp, r15d
imul r15d, ebp, 0x1000193
mov bpl, byte [r14]
inc r14
test bpl, bpl
jne 0x14000341b
cmp r15d, 0xda1c1559
je 0x140003444
test r11, r11
jne 0x1400033ff
jmp 0x1400033d1
shl rdx, 4
mov ecx, dword [rax + r8 + 0x1c]
mov r8d, dword [rax + r8 + 0x24]
add rcx, rax
add r8, rax
movzx r8d, word [r8 + r11*2]
mov r8d, dword [rcx + r8*4]
add r8, rax
mov rcx, qword [0x140006178]
call r8
mov qword [0x140006178], rax
test rax, rax
je 0x140003569
test edi, edi
je 0x140003496
mov rcx, rsi
call fcn.140003220
mov rcx, rax
mov rax, qword [0x140006178]
jmp 0x14000349d
mov rcx, qword [0x140006180]
movsxd rdx, dword [0x140006170]
shl rdx, 4
mov qword [rax + rdx + 8], rcx
mov rax, qword [0x140006178]
mov dword [rax + rdx + 4], edi
cmp qword [rax + rdx + 8], 0
setne byte [rax + rdx]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400034d3
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400034d3
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
mov bl, byte [rax + rdi]
test bl, bl
je 0x140003535
add rdi, r10
mov ebp, 0xe66a3fda
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rdi]
inc rdi
test bl, bl
jne 0x140003519
cmp ebp, 0xee9a4021
je 0x14000353c
test r11, r11
jne 0x140003500
jmp 0x1400034d3
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r8d, dword [rcx + rdx*4]
add r8, rax
lea rcx, str.Successfully_loaded_DLL___s___n
mov rdx, rsi
call r8
inc dword [0x140006170]
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400033a5
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x28
lea rcx, str.msvcrt.dll
call fcn.140003220
mov qword [0x140006180], rax
test rax, rax
je 0x14000339f
lea rdx, str.msvcrt.dll
xor ecx, ecx
call 0x1400033a5
lea rdx, str.ws2_32.dll
mov ecx, 1
call 0x1400033a5
lea rdx, str.iphlpapi.dll
mov ecx, 2
call 0x1400033a5
lea rdx, str.kernel32.dll
mov ecx, 3
call 0x1400033a5
lea rdx, str.Shell32.dll
mov ecx, 4
call 0x1400033a5
lea rdx, str.Advapi32.dll
mov ecx, 5
call 0x1400033a5
lea rdx, str.Secur32.dll
mov ecx, 6
call 0x1400033a5
lea rdx, str.ntdll.dll
mov ecx, 7
add rsp, 0x28
jmp 0x1400033a5
nop
add rsp, 0x28
ret
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rdx
mov edi, ecx
movsxd rdx, dword [0x140006170]
inc rdx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd r8, dword [rax + 0x3c]
mov r8d, dword [rax + r8 + 0x88]
test r8, r8
je 0x1400033d1
mov r9d, dword [rax + r8 + 0x18]
test r9, r9
je 0x1400033d1
mov r10d, dword [rax + r8 + 0x20]
add r10, rax
lea rbx, [rax + 1]
dec r9
mov r11d, r9d
mov r14d, dword [r10 + r11*4]
mov bpl, byte [rax + r14]
test bpl, bpl
je 0x14000343d
add r14, rbx
mov r15d, 0x286f8891
movsx ebp, bpl
xor ebp, r15d
imul r15d, ebp, 0x1000193
mov bpl, byte [r14]
inc r14
test bpl, bpl
jne 0x14000341b
cmp r15d, 0xda1c1559
je 0x140003444
test r11, r11
jne 0x1400033ff
jmp 0x1400033d1
shl rdx, 4
mov ecx, dword [rax + r8 + 0x1c]
mov r8d, dword [rax + r8 + 0x24]
add rcx, rax
add r8, rax
movzx r8d, word [r8 + r11*2]
mov r8d, dword [rcx + r8*4]
add r8, rax
mov rcx, qword [0x140006178]
call r8
mov qword [0x140006178], rax
test rax, rax
je 0x140003569
test edi, edi
je 0x140003496
mov rcx, rsi
call fcn.140003220
mov rcx, rax
mov rax, qword [0x140006178]
jmp 0x14000349d
mov rcx, qword [0x140006180]
movsxd rdx, dword [0x140006170]
shl rdx, 4
mov qword [rax + rdx + 8], rcx
mov rax, qword [0x140006178]
mov dword [rax + rdx + 4], edi
cmp qword [rax + rdx + 8], 0
setne byte [rax + rdx]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400034d3
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400034d3
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
mov bl, byte [rax + rdi]
test bl, bl
je 0x140003535
add rdi, r10
mov ebp, 0xe66a3fda
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rdi]
inc rdi
test bl, bl
jne 0x140003519
cmp ebp, 0xee9a4021
je 0x14000353c
test r11, r11
jne 0x140003500
jmp 0x1400034d3
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r8d, dword [rcx + rdx*4]
add r8, rax
lea rcx, str.Successfully_loaded_DLL___s___n
mov rdx, rsi
call r8
inc dword [0x140006170]
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140004124
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x58]
mov qword [rax], rdx
mov qword [rax + 8], r8
mov qword [rax + 0x10], r9
mov qword [rsp + 0x28], rax
mov rax, qword [0x140006188]
test rax, rax
jne 0x1400041ad
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
add rax, 0x10
mov rax, qword [rax]
movzx r8d, word [rax + 0x58]
mov rdx, r8
shr rdx, 1
cmp r8, 2
jb 0x14000415d
mov r8, qword [rax + 0x60]
add rdx, rdx
mov r9d, 0xad6b84b7
xor r10d, r10d
movsx r11d, byte [r8 + r10]
xor r11d, r9d
imul r9d, r11d, 0x1000193
add r10, 2
cmp rdx, r10
jne 0x140004181
cmp r9d, 0x73d6a94c
jne 0x14000415d
mov rax, qword [rax + 0x30]
mov qword [0x140006188], rax
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
mov r8d, dword [rax + rdx + 0x20]
add r8, rax
lea r10, [rax + 1]
xor r11d, r11d
mov r9d, r11d
mov esi, dword [r8 + r9*4]
mov bl, byte [rax + rsi]
test bl, bl
je 0x1400041f9
add rsi, r10
mov edi, 0xac6b8324
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
mov bl, byte [rsi]
inc rsi
test bl, bl
jne 0x1400041dd
cmp edi, 0x89549cf5
je 0x1400041fe
inc r11d
jmp 0x1400041c7
mov r8d, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add r8, rax
add rdx, rax
movzx edx, word [rdx + r9*2]
mov r8d, dword [r8 + rdx*4]
add r8, rax
mov rdx, qword [rsp + 0x28]
call r8
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400111fe
Capabilities:
Terminate process

Disassembly:
jmp 0x140012ea0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011285
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400141f0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014210
xor al, al
jmp 0x140014291
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014223
xor al, al
jmp 0x140014291
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001424d
xor al, al
jmp 0x140014291
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014261
xor al, al
jmp 0x140014291
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014273
xor al, al
jmp 0x140014291
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001428f
xor al, al
jmp 0x140014291
mov al, 1
add rsp, 0x38
ret
Function at 0x1400021d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14000b940]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400021f0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400021f8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400021f0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000224d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002244
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400021f0
add rax, 0x28
cmp rax, r9
jne 0x140002230
xor eax, eax
ret

Function at 0x140002250
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000b940]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000226f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002278
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000226f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140002310
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000b940]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000232f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002338
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140004884
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.140012b50
mov r15, qword [0x140020514]
cmp r15, 1
jne 0x140004953
push qword [0x140020604]
pop rcx
call fcn.14000dd04
mov r15, rax
and r15, r15
jle 0x1400048e9
mov rcx, qword [0x140020604]
call fcn.14000dd0c
mov rcx, qword [0x140020604]
call fcn.14000dd20
or rax, rax
je 0x1400048e9
mov rbp, qword [0x14002060c]
push qword [rbp + 0x10]
pop rcx
call fcn.14000e1bc
jmp 0x1400048c6
push qword [0x1400205f4]
pop rcx
call fcn.14000dd04
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x140004953
push 5
push 0
push 1
push qword [0x1400205f4]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140009060
mov rcx, qword [0x1400205f4]
call fcn.14000dd0c
mov rcx, qword [0x1400205f4]
call fcn.14000dd20
or rax, rax
je 0x140004953
mov rbp, qword [0x1400205fc]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
jmp 0x140004930
mov rax, 1
jmp 0x14000495f
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140006b38
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f190]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021210]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020640]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020640]
call fcn.1400123b8
lea rcx, [0x140021210]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jl 0x14003f67f
inc dword [rbx + 0x5cff837f]
cmp dword [rdi - 0x7d], 0xffffffff
pop rsp
push rdi
pop rbx
call qword [rax + 0x49]
push rax
jmp qword [rsi + 0x62]
invalid
je 0x14003f6b3
push qword [rdx + 0x71]
jb 0x14003f727
jae 0x14003f6b7
jmp [rsi + 0x6d]
outsb dx, byte [rsi]
insd dword [rdi], dx
jo 0x14003f6bb
jmp qword [rcx + 0x60]
invalid
invalid
invalid
insd dword [rdi], dx
jmp [rbx + 0x6b]
jo 0x14003f6f3
push qword [rax + 0x70]
jo 0x14003f766
jo 0x14003f6f7
jmp [rdi + 0x6f]
outsd dx, dword [rsi]
outsd dx, dword [rsi]
outsd dx, dword [rsi]
jmp [rdi + 0x6f]
ja 0x14003f781
ja 0x14003f70b
invalid
js 0x14003f786
js 0x14003f70f
push qword [rax + 0x70]
jo 0x14003f782
jo 0x14003f713
jmp [rdi + 0x6f]
outsd dx, dword [rsi]
outsd dx, dword [rsi]
outsd dx, dword [rsi]
jmp qword [rdi + 0x67]
jmp [rcx + 0x69]
push rsp
call [rdi + 0x5f]
pop rdi
jmp qword [rbx + 0x63]
push rbx
push rbx
jmp qword [rbp + 0x65]
jmp qword [rdi + 0x66]