joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c4f42
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1401735c0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140172f10
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140173609
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402be020]
jmp 0x140173618
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x1400c5046
Capabilities:
Set environment variable

Disassembly:
jmp 0x140240050
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.1400c1e78
lea rcx, [rsp + 0x48]
call fcn.1400c1e78
call fcn.1400c2c47
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.1400c1b49
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1402400bf
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.1400c23b4
lea rcx, [rsp + 0x78]
call fcn.1400c23b4
mov eax, dword [rsp + 0x24]
jmp 0x140240150
call fcn.1400c2c47
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.1400c1b49
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x140240106
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.1400c23b4
lea rcx, [rsp + 0x78]
call fcn.1400c23b4
mov eax, dword [rsp + 0x2c]
jmp 0x140240150
lea rcx, [rsp + 0x48]
call fcn.1400c1d92
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.1400c1d92
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.1400c23b4
lea rcx, [rsp + 0x78]
call fcn.1400c23b4
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x1401f0400
Capabilities:
Terminate process

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
sub rsp, 0x28
movzx eax, byte [rsp + 0x38]
test eax, eax
je 0x1401f0428
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [rsp + 0x30]
call fcn.1401f05a0
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x14020ae90
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400c0f23
sub rsp, rax
mov rax, qword [0x1402a1040]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1402a5c30]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x14020b08a
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x14020afd6
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x14020afd6
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x14020afbb
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x14020af58
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14020b04a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14020b0a9
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x40], eax
jae 0x14020b085
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14020b0a9
jmp 0x14020af2e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1400c27ec
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x14020b150
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400c0f23
sub rsp, rax
mov rax, qword [0x1402a1040]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1402a5c30]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14020b365
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x14020b2a9
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14020b2a9
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x14020b289
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x14020b218
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x48]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14020b325
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14020b384
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x48]
cmp dword [rsp + 0x44], eax
jae 0x14020b360
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14020b384
jmp 0x14020b1ee
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1400c27ec
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x14020f3f0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov edx, 8
lea rcx, [rsp + 0x60]
call fcn.1400c1874
movzx eax, al
test eax, eax
je 0x14020f417
mov al, 1
jmp 0x14020f50c
lea rcx, [rsp + 0x60]
call fcn.1400c56f9
movzx eax, al
test eax, eax
je 0x14020f456
lea rcx, [rsp + 0x60]
call fcn.1400c45ba
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x60]
call fcn.1400c45ba
mov rax, qword [rax + 8]
mov rcx, qword [rsp + 0x40]
cmp qword [rcx], rax
jne 0x14020f456
xor al, al
jmp 0x14020f50c
lea rcx, [rsp + 0x60]
call fcn.1400c47d6
mov ecx, eax
call fcn.1400c566d
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x14020f47b
xor al, al
jmp 0x14020f50c
lea rax, [rsp + 0x38]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
lea rax, [rsp + 0x48]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov r9d, 1
lea r8, [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x14020f4c0
xor al, al
jmp 0x14020f50c
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x14020f4e9
xor al, al
jmp 0x14020f50c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
jne 0x14020f4ff
mov dword [rsp + 0x20], 1
jmp 0x14020f507
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x50
pop rdi
ret
Function at 0x140232060
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 0
cmp qword [rsp + 0x40], 0
je 0x14023209f
mov rax, qword [rsp + 0x40]
movzx eax, word [rax]
test eax, eax
je 0x14023209f
lea rdx, [0x140281310]
mov rcx, qword [rsp + 0x40]
call fcn.1400c2869
test eax, eax
jne 0x1402320d6
mov r9d, 2
lea r8, [rsp + 0x20]
mov edx, 0x20001004
mov rax, qword [rsp + 0x48]
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1402320c5
xor eax, eax
jmp 0x140232125
cmp dword [rsp + 0x20], 0
jne 0x1402320d4
call qword [sym.imp.KERNEL32.dll_GetACP]
jmp 0x140232125
jmp 0x140232121
lea rdx, [0x140281330]
mov rcx, qword [rsp + 0x40]
call fcn.1400c2869
test eax, eax
jne 0x140232113
mov r9d, 2
lea r8, [rsp + 0x20]
mov edx, 0x2000000b
mov rax, qword [rsp + 0x48]
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x140232111
xor eax, eax
jmp 0x140232125
jmp 0x140232121
mov rcx, qword [rsp + 0x40]
call fcn.1400c00d2
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x1402321e0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov dword [rsp + 0x20], 0
movzx eax, word [rsp + 0x50]
and eax, 0x3ff
movzx eax, ax
bts eax, 0xa
movzx eax, ax
mov dword [rsp + 0x24], eax
call fcn.1400c1216
add rax, 0x98
mov qword [rsp + 0x30], rax
mov r9d, 2
lea r8, [rsp + 0x20]
mov edx, 0x20000001
mov ecx, dword [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x140232243
xor eax, eax
jmp 0x140232283
mov eax, dword [rsp + 0x20]
cmp dword [rsp + 0x50], eax
je 0x14023227e
cmp dword [rsp + 0x58], 0
je 0x14023227e
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call fcn.1402317b0
mov dword [rsp + 0x28], eax
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
call fcn.1400c0573
mov ecx, dword [rsp + 0x28]
cmp ecx, eax
jne 0x14023227e
xor eax, eax
jmp 0x140232283
mov eax, 1
add rsp, 0x48
ret
Function at 0x140001488
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140020be0]
mov dword [rax], 1
mov rax, qword [0x140020bf0]
mov dword [rax], 1
mov rax, qword [0x140020c00]
mov dword [rax], 1
mov rax, qword [0x140020bd0]
mov dword [rax], 1
mov rax, qword [0x140020a30]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014e6
mov eax, 0
jmp 0x140001593
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140001512
mov eax, 0
jmp 0x140001593
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x140001538
cmp eax, 0x20b
je 0x14000155f
jmp 0x14000158e
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000154b
mov eax, 0
jmp 0x140001593
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001593
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000157a
mov eax, 0
jmp 0x140001593
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001593
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140008f40
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x90
movaps xmmword [rsp + 0x80], xmm6
lea rbx, [0x14001f30e]
lea rax, [0x140032120]
mov rcx, qword [0x140034128]
movq xmm6, rax
movq xmm0, rbx
punpcklqdq xmm6, xmm0
test rcx, rcx
je 0x140008faf
call qword [sym.imp.KERNEL32.DLL_GetProcessId]
xor ecx, ecx
mov edx, eax
call qword [sym.imp.KERNEL32.DLL_GenerateConsoleCtrlEvent]
test eax, eax
je 0x140009018
mov rcx, qword [0x140034128]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [0x140034128]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp byte [0x140034120], 0
jne 0x140008fd0
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x90
pop rbx
ret
mov eax, 0x414
mov dword [rsp + 0x48], 3
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], 0
mov word [rsp + 0x60], ax
mov dword [rsp + 0x64], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], rbx
movaps xmmword [rsp + 0x50], xmm6
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
jmp 0x140008fb8
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov r9d, 0x400
xor edx, edx
mov qword [rsp + 0x30], 0
mov r8d, eax
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 0
mov ecx, 0x1300
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.DLL_FormatMessageA]
lea rcx, str.Failed_to_send_CTRL_C_to_child_process.
call sub.msvcrt.dll_puts
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_puts
jmp 0x140008f90
Function at 0x140015ab0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.14001cca0
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.14001cca0
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x1400166e2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140034208]
test eax, eax
je 0x14001677a
lea rax, [0x1400341e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
call rax
mov rax, qword [0x140034210]
mov qword [rbp - 8], rax
jmp 0x14001675e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.DLL_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.DLL_GetLastError]
call rax
test eax, eax
jne 0x140016752
cmp qword [rbp - 0x10], 0
je 0x140016752
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140016718
lea rax, [0x1400341e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
call rax
jmp 0x14001677b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140016880
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400168a8
mov eax, 0
jmp 0x1400168f6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400168d1
mov eax, 0
jmp 0x1400168f6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x1400168f1
mov eax, 0
jmp 0x1400168f6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x1400168fc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14001697a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140016971
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140016971
mov rax, qword [rbp - 8]
jmp 0x14001698f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140016944
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140004d50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbp, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
mov rax, qword gs:[0x58]
mov r12, qword [rax]
mov esi, 0x1398
mov eax, dword [rsi + r12]
mov r13d, 0x13b0
test al, 1
jne 0x140004de9
or eax, 1
mov dword [rsi + r12], eax
mov ebx, r13d
add rbx, r12
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rbx + 0x1384], 0xffffffff
mov dword [rbx + 4], eax
mov ecx, 1
lea r8, [rbx + 8]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [r8], edx
inc rcx
lea r8, [r8 + 4]
cmp rcx, 0x270
jb 0x140004dc1
mov dword [rbx], 0x270
mov ecx, dword [rsi + r12]
mov ebx, 0x2740
mov eax, ebx
test cl, 2
jne 0x140004e0d
or ecx, 2
mov dword [rsi + r12], ecx
mov qword [r12 + rbx], r14
mov qword [r12 + rbx + 8], 0x3d
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov dword [rsp + 0x20], 1
cmp rbp, 0x10
jb 0x140004e44
mov rdx, rbp
mov rcx, rdi
call fcn.140007060
mov qword [rdi + 0x10], r14
mov r15d, ebx
jmp 0x140004e50
mov r15, rax
test rbp, rbp
je 0x140004eed
mov ebx, r13d
add rbx, r12
lea r13, str.0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
nop dword [rax]
dec rbp
mov qword [rsp + 0x28], rbx
mov r14, qword [r12 + r15]
mov rdx, qword [r12 + r15 + 8]
sub rdx, r14
cmp rdx, 0xffffffffffffffff
jne 0x140004e97
mov rcx, rbx
call fcn.140007730
mov esi, eax
shl rsi, 0x20
mov rcx, rbx
call fcn.140007730
mov eax, eax
or rsi, rax
jmp 0x140004ea7
inc rdx
lea rcx, [rsp + 0x28]
call fcn.140007540
mov rsi, rax
lea rax, [rsi + r14]
movzx r9d, byte [rax + r13]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x140004edc
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0xf
jbe 0x140004ed1
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140004ee4
mov rcx, rdi
call fcn.1400020f0
test rbp, rbp
jne 0x140004e60
mov rax, rdi
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140004f10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbp, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
mov rax, qword gs:[0x58]
mov r12, qword [rax]
mov esi, 0x2738
mov eax, dword [rsi + r12]
mov r13d, 0x10
test al, 1
jne 0x140004fa9
or eax, 1
mov dword [rsi + r12], eax
mov ebx, r13d
add rbx, r12
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rbx + 0x1384], 0xffffffff
mov dword [rbx + 4], eax
mov ecx, 1
lea r8, [rbx + 8]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [r8], edx
inc rcx
lea r8, [r8 + 4]
cmp rcx, 0x270
jb 0x140004f81
mov dword [rbx], 0x270
mov ecx, dword [rsi + r12]
mov ebx, 0x13a0
mov eax, ebx
test cl, 2
jne 0x140004fcd
or ecx, 2
mov dword [rsi + r12], ecx
mov qword [r12 + rbx], r14
mov qword [r12 + rbx + 8], 9
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov dword [rsp + 0x20], 1
cmp rbp, 0x10
jb 0x140005004
mov rdx, rbp
mov rcx, rdi
call fcn.140007060
mov qword [rdi + 0x10], r14
mov r15d, ebx
jmp 0x140005010
mov r15, rax
test rbp, rbp
je 0x1400050ad
mov ebx, r13d
add rbx, r12
lea r13, str.0123456789
nop dword [rax]
dec rbp
mov qword [rsp + 0x28], rbx
mov r14, qword [r12 + r15]
mov rdx, qword [r12 + r15 + 8]
sub rdx, r14
cmp rdx, 0xffffffffffffffff
jne 0x140005057
mov rcx, rbx
call fcn.140007730
mov esi, eax
shl rsi, 0x20
mov rcx, rbx
call fcn.140007730
mov eax, eax
or rsi, rax
jmp 0x140005067
inc rdx
lea rcx, [rsp + 0x28]
call fcn.140007540
mov rsi, rax
lea rax, [rsi + r14]
movzx r9d, byte [rax + r13]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x14000509c
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0xf
jbe 0x140005091
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400050a4
mov rcx, rdi
call fcn.1400020f0
test rbp, rbp
jne 0x140005020
mov rax, rdi
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140005a50
Capabilities:
Parse pe header

Disassembly:
cmp byte [rcx + 0x3e], 0
je 0x140005b51
xor byte [rcx], 0x33
xor byte [rcx + 1], 0x34
xor byte [rcx + 2], 0x35
xor byte [rcx + 3], 0x36
xor byte [rcx + 4], 0x37
xor byte [rcx + 5], 0x38
xor byte [rcx + 6], 0x39
xor byte [rcx + 7], 0x3a
xor byte [rcx + 8], 0x3b
xor byte [rcx + 9], 0x3c
xor byte [rcx + 0xa], 0x3d
xor byte [rcx + 0xb], 0x3e
xor byte [rcx + 0xc], 0x3f
xor byte [rcx + 0xd], 0x40
xor byte [rcx + 0xe], 0x41
xor byte [rcx + 0xf], 0x42
xor byte [rcx + 0x10], 0x43
xor byte [rcx + 0x11], 0x44
xor byte [rcx + 0x12], 0x45
xor byte [rcx + 0x13], 0x46
xor byte [rcx + 0x14], 0x47
xor byte [rcx + 0x15], 0x48
xor byte [rcx + 0x16], 0x49
xor byte [rcx + 0x17], 0x4a
xor byte [rcx + 0x18], 0x4b
xor byte [rcx + 0x19], 0x4c
xor byte [rcx + 0x1a], 0x4d
xor byte [rcx + 0x1b], 0x4e
xor byte [rcx + 0x1c], 0x4f
xor byte [rcx + 0x1d], 0x50
xor byte [rcx + 0x1e], 0x51
xor byte [rcx + 0x1f], 0x52
xor byte [rcx + 0x20], 0x53
xor byte [rcx + 0x21], 0x54
xor byte [rcx + 0x22], 0x55
xor byte [rcx + 0x23], 0x56
xor byte [rcx + 0x24], 0x57
xor byte [rcx + 0x25], 0x58
xor byte [rcx + 0x26], 0x59
xor byte [rcx + 0x27], 0x5a
xor byte [rcx + 0x28], 0x5b
xor byte [rcx + 0x29], 0x5c
xor byte [rcx + 0x2a], 0x5d
xor byte [rcx + 0x2b], 0x5e
xor byte [rcx + 0x2c], 0x5f
xor byte [rcx + 0x2d], 0x60
xor byte [rcx + 0x2e], 0x61
xor byte [rcx + 0x2f], 0x62
xor byte [rcx + 0x30], 0x63
xor byte [rcx + 0x31], 0x64
xor byte [rcx + 0x32], 0x65
xor byte [rcx + 0x33], 0x66
xor byte [rcx + 0x34], 0x67
xor byte [rcx + 0x35], 0x68
xor byte [rcx + 0x36], 0x69
xor byte [rcx + 0x37], 0x6a
xor byte [rcx + 0x38], 0x6b
xor byte [rcx + 0x39], 0x6c
xor byte [rcx + 0x3a], 0x6d
xor byte [rcx + 0x3b], 0x6e
xor byte [rcx + 0x3c], 0x6f
mov byte [rcx + 0x3e], 0
ret