joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e6230
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rdi, r8
mov rcx, rdx
call fcn.1400eb690
mov rbx, rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r14, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, 0xfde9
xor edx, edx
mov r8, rax
mov r9d, 0xffffffff
call r14
movsxd r15, eax
lea rcx, [r15 + r15]
call fcn.1400237b0
mov rsi, rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, 0xffffffff
call r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400e6377
test al, 0x10
je 0x1400e637d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1400e637d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.1400eb690
mov rdi, rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, rax
mov r9d, 0xffffffff
call r14
movsxd r15, eax
lea rcx, [r15 + r15]
call fcn.1400237b0
mov rbx, rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, rdi
mov r9d, 0xffffffff
call r14
mov rcx, rsi
mov rdx, rbx
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne dil
mov rcx, rbx
call fcn.140266508
jmp 0x1400e638a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
mov rcx, rsi
call fcn.140266508
mov eax, edi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1400e63a0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov r14, qword [rdx]
mov rax, qword [rdx + 8]
mov ebx, 0x7fff
mov edx, 0x7fff
sub rdx, rax
lea rcx, [r14 + rax*2]
lea r8, [0x140298582]
mov r9, rdi
call fcn.140016a30
mov word [r14 + 0xfffe], 0
test eax, eax
js 0x1400e645b
movsxd r14, eax
sub rbx, qword [rsi + 8]
cmp rbx, r14
jl 0x1400e645b
mov edx, 0x8000
mov rcx, rdi
call fcn.1402713e0
cmp rax, r14
jne 0x1400e645b
add qword [rsi + 8], r14
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, eax
mov al, 1
test ecx, ecx
jne 0x1400e6468
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1400e6466
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, eax
xor eax, eax
cmp edx, 0xffffffff
je 0x1400e6468
mov ecx, edx
and ecx, 1
je 0x1400e6468
and edx, 0xfffffffe
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1400e6466
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
jmp 0x1400e6468
mov ecx, reloc.WS2_32.dll_WSAGetLastError
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400eb1b0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call fcn.14027301c
cdqe
add rsp, 0x28
ret
mov rax, qword [rcx + 0x10]
mov ecx, dword [rax]
jmp 0x1400253b0

Function at 0x1400eb1c0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rdi, r8
mov rsi, rdx
mov rax, qword [0x140396de8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rax, qword [rcx + 0x10]
mov ecx, dword [rax]
call fcn.14027c748
mov rbx, rax
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov rcx, rax
mov rdx, rsi
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400eb29e
mov edi, dword [rsp + 0x44]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x1400eb2a5
mov ecx, dword [rsp + 0x44]
add rcx, rcx
call fcn.14025e008
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov ebx, eax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov ecx, ebx
xor edx, edx
mov r8, rsi
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r9d, dword [rsp + 0x44]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, ebx
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
mov rcx, rdi
call fcn.14025e29c
movsxd rdi, esi
jmp 0x1400eb2a5
mov rdi, 0xffffffffffffffff
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14025dfe0
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400eb400
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rbx, rdx
mov rsi, rcx
mov rax, qword [rcx + 0x10]
mov ecx, dword [rax]
call fcn.14027c748
xor edi, edi
mov rcx, rax
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400eb44a
mov rax, qword [rsi + 0x10]
mov ecx, dword [rax]
call fcn.14027c748
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne dil
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400ec320
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x90
mov ebp, r8d
mov rax, qword [0x140396de8]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rax, [0x1402f5d10]
mov qword [rsp + 0x48], rax
lea r9, [rsp + 0x48]
mov qword [rsp + 0x80], r9
lea rcx, [rsp + 0x38]
mov r8b, 1
call fcn.1400eb6f0
mov rsi, qword [rsp + 0x40]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rbx, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, 0xfde9
xor edx, edx
mov r8, rsi
mov r9d, 0xffffffff
call rbx
movsxd r14, eax
lea rcx, [r14 + r14]
call fcn.1400237b0
mov rdi, rax
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, rsi
mov r9d, 0xffffffff
call rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400ec3e1
mov ebx, eax
test eax, 0x400
jne 0x1400ec3e8
shr ebx, 4
and ebx, 1
jmp 0x1400ec455
mov ebx, 5
jmp 0x1400ec455
mov ebx, 2
test bpl, bpl
je 0x1400ec455
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
mov rcx, rdi
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1400ec455
mov r14, rax
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x48]
shr eax, 4
and eax, 1
test ebx, ebx
mov ebx, 2
cmovne ebx, eax
mov rcx, rdi
call fcn.140266508
cmp byte [rsp + 0x38], 0
je 0x1400ec46c
mov rcx, rsi
call fcn.140266508
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14025dfe0
mov eax, ebx
add rsp, 0x90
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x1400ec640
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rax, qword [0x140396de8]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea rax, [0x1402f5d40]
mov qword [rsp + 0x40], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x78], r9
lea rcx, [rsp + 0x30]
mov r8b, 1
call fcn.1400eb6f0
mov rdi, qword [rsp + 0x38]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rbx, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, 0xfde9
xor edx, edx
mov r8, rdi
mov r9d, 0xffffffff
call rbx
movsxd r14, eax
lea rcx, [r14 + r14]
call fcn.1400237b0
mov rsi, rax
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, rdi
mov r9d, 0xffffffff
call rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400ec702
mov ecx, eax
and ecx, 0x400
je 0x1400ec702
mov rcx, rsi
test al, 0x10
jne 0x1400ec711
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1400ec717
mov ecx, 0x1126
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
jmp 0x1400ec71d
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne dil
mov rcx, rsi
call fcn.140266508
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14025dfe0
mov eax, edi
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400ec750
Capabilities:
Move file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rsi, r8
mov rax, qword [0x140396de8]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea r14, [0x1402f5d40]
mov qword [rsp + 0x48], r14
lea rdi, [rsp + 0x48]
mov qword [rsp + 0x80], rdi
lea rcx, [rsp + 0x38]
mov r8b, 1
mov r9, rdi
call fcn.1400eb6f0
mov rbx, qword [rsp + 0x40]
mov rdx, rbx
xor r8d, r8d
call fcn.1400ec320
test eax, eax
je 0x1400ec7c2
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x1400ec8b6
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x80], rdi
lea rcx, [rsp + 0x38]
mov rdx, rsi
mov r8b, 1
mov r9, rdi
call fcn.1400eb6f0
mov rsi, qword [rsp + 0x40]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r14, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, 0xffffffff
call r14
movsxd r15, eax
lea rcx, [r15 + r15]
call fcn.1400237b0
mov rdi, rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, 0xffffffff
call r14
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, rsi
mov r9d, 0xffffffff
call r14
movsxd r15, eax
lea rcx, [r15 + r15]
call fcn.1400237b0
mov rbx, rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, rsi
mov r9d, 0xffffffff
call r14
mov rcx, rdi
mov rdx, rbx
mov r8d, 9
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne sil
mov rcx, rbx
call fcn.140266508
mov rcx, rdi
call fcn.140266508
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14025dfe0
mov eax, esi
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400ec8e0
Capabilities:
Move file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rbx, r8
mov rdi, rcx
mov rax, qword [0x140396de8]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea r13, [0x1402f5d40]
mov qword [rsp + 0x40], r13
lea r14, [rsp + 0x40]
mov qword [rsp + 0x78], r14
lea rcx, [rsp + 0x30]
mov r8b, 1
mov r9, r14
call fcn.1400eb6f0
mov r15, qword [rsp + 0x38]
mov rdx, r15
xor r8d, r8d
call fcn.1400ec320
cmp eax, 2
jne 0x1400eca6c
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r12, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, 0xfde9
xor edx, edx
mov r8, r15
mov r9d, 0xffffffff
call r12
movsxd rbp, eax
lea rcx, [rbp*2]
call fcn.1400237b0
mov rsi, rax
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, r15
mov r9d, 0xffffffff
call r12
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x78], r14
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov r8b, 1
mov r9, r14
call fcn.1400eb6f0
mov r14, qword [rsp + 0x38]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, r14
mov r9d, 0xffffffff
call r12
movsxd r15, eax
lea rcx, [r15 + r15]
call fcn.1400237b0
mov rbx, rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, r14
mov r9d, 0xffffffff
call r12
mov rcx, rdi
mov rdx, r14
call fcn.1400e5720
cmp eax, 1
jne 0x1400eca42
mov rdx, r14
xor r8d, r8d
call fcn.1400ec320
cmp eax, 2
jne 0x1400eca42
mov rdx, r14
call fcn.1400ec640
test al, al
je 0x1400eca9f
mov rcx, rsi
mov rdx, rbx
mov r8d, 9
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne dil
mov rcx, rbx
call fcn.140266508
mov rcx, rsi
call fcn.140266508
jmp 0x1400eca79
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14025dfe0
mov eax, edi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor edi, edi
jmp 0x1400eca5a
Function at 0x1400ee2b0
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140396de8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ecx, 0x18
call fcn.14025e260
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rsi
lea rcx, [rsp + 0x34]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
lea r8, [0x1400ee350]
xor esi, esi
xor ecx, ecx
mov edx, 0x100000
mov r9, rax
call fcn.14027d0f0
lea rcx, [rax + 1]
cmp rcx, 1
ja 0x1400ee321
call fcn.140270958
mov esi, dword [rax]
jmp 0x1400ee32a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14025dfe0
mov eax, esi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400ee9d0
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rsi, rdx
mov ebx, ecx
mov rax, qword [0x140396de8]
xor rax, rsp
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x44]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rdi, rax
test rax, rax
je 0x1400eeab7
mov eax, dword [rsp + 0x44]
cmp eax, ebx
jle 0x1400eea26
mov dword [rsp + 0x44], ebx
mov eax, ebx
test eax, eax
jle 0x1400eeaae
xor r12d, r12d
xorps xmm6, xmm6
mov r13, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop dword [rax + rax]
mov rbx, qword [rdi + r12*8]
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, 0xffffffff
call r13
movsxd r14, eax
mov rcx, r14
call fcn.1400237b0
mov r15, rax
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, 0xffffffff
call r13
mov qword [rsi + r12*8], r15
inc r12
movsxd rax, dword [rsp + 0x44]
cmp r12, rax
jl 0x1400eea40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14025dfe0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400f9b20
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rbx, r8
mov r14, rdx
mov rsi, rcx
mov rax, qword [0x140396de8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, qword [rdx + 0x18]
lea rcx, [rsp + 0x50]
mov edx, 8
xor r8d, r8d
call fcn.14014d390
mov rdx, qword [rsp + 0x50]
mov rcx, rdi
call fcn.1400f9ed0
mov r15, rax
mov eax, dword [0x14039dea0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 8]
mov rax, qword [rax + 0x18]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], rax
movups xmmword [rsp + 0x20], xmm0
lea r8, [rsp + 0x30]
mov rcx, r14
mov rdx, r15
mov r9d, ebx
call fcn.1401ba380
lea rcx, [rsp + 0x60]
mov rdx, r15
xor r8d, r8d
call fcn.14015ea90
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call fcn.1400f2340
mov rbx, rax
mov r8, qword [rsp + 0x30]
lea rcx, [rsp + 0x58]
mov edx, 0x91
xor r9d, r9d
call fcn.140169360
mov rdx, qword [rsp + 0x58]
mov rcx, rdi
call fcn.1400fa110
mov rdi, rax
mov rax, qword [rax]
mov rcx, qword [rdi + 8]
mov rdx, qword [rcx + 7]
mov rcx, rdi
call qword [rax + 0x300]
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x40]
shl r8, 3
mov rcx, rax
call fcn.1402609f0
mov rcx, rsi
mov rdx, rbx
mov r8, rdi
xor r9d, r9d
call fcn.1401756b0
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14025dfe0
nop
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x14010def0
Capabilities:
Enumerate process modules

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov eax, 0x2038
call fcn.14025e2c0
sub rsp, rax
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140396de8]
xor rax, rsp
mov qword [rsp + 0x2030], rax
cmp qword [0x140399170], 0
jne 0x14010df43
mov ecx, 8
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov qword [0x140399170], rax
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 0x410
xor edx, edx
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x14010dfcf
mov rbx, rax
lea rdx, [rsp + 0x30]
lea r9, [rsp + 0x2c]
mov rcx, rax
mov r8d, 0x2000
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x14010dfb0
cmp dword [rsp + 0x2c], 8
jb 0x14010dfb0
xor r15d, r15d
mov r12, qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
mov rcx, qword [rsp + r15*8 + 0x30]
mov rdx, rdi
call r12
test rax, rax
jne 0x14010e007
inc r15
mov eax, dword [rsp + 0x2c]
shr rax, 3
cmp r15, rax
jb 0x14010df90
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.None_of_the_loaded_modules_contained_the_requested_symbol__s.
xor r14d, r14d
xor ecx, ecx
mov r8, rdi
call fcn.14018dd40
jmp 0x14010dfe0
lea rdx, str.Failed_to_open_current_process.
xor r14d, r14d
xor ecx, ecx
call fcn.14018dd40
mov qword [rsi], rax
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.14025dfe0
mov rax, r14
add rsp, 0x2038
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14010dfe3
Function at 0x1401209e0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
lea rax, [0x1402f64e8]
mov qword [rcx], rax
xorps xmm0, xmm0
movups xmmword [rcx + 8], xmm0
call fcn.14010f680
lea rax, [0x1402fd378]
mov qword [rsi], rax
mov eax, dword [rdi + 0x708]
mov dword [rsi + 0x18], eax
cmp eax, 2
jne 0x140120a60
mov eax, 1
cmp dword [rdi + 0xbb8], 1
je 0x140120a4b
cmp qword [rdi + 0x788], 0
setle al
cmp qword [rdi + 0x790], 0
setg cl
and cl, al
movzx eax, cl
shl rax, 4
or rax, 5
xor ecx, ecx
lock cmpxchg qword [rdi + 0x710], rcx
je 0x140120a60
mov rcx, rdi
call fcn.1401c2890
mov qword [rdi + 0x708], 1
lea rax, [0x1402fd370]
mov qword [rsi], rax
mov qword [rsi + 0x28], 0
mov rax, qword [rdi + 0x28]
mov qword [rsi + 0x20], rax
mov qword [rdi + 0x28], 0
mov rax, qword [rdi + 0x698]
mov qword [rsi + 0x28], rax
mov ecx, dword [0x140394de0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140120abc
cmp byte [rax + 8], 0
jne 0x140120ac1
mov rcx, rax
call fcn.140048340
test rax, rax
jne 0x140120ac1
call fcn.14018d030
mov rdx, qword [rax + 0x58]
add rdx, qword [rax + 0x50]
mov rcx, rdi
call fcn.1401c1ac0
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140130730
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov eax, dword [0x14039dea0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rdi, qword [rax + 8]
test rdi, rdi
je 0x14013078b
mov rcx, qword [rdi + 0x690]
lea rsi, [0x140399478]
test rcx, rcx
je 0x1401307e5
mov rdx, qword [0x140399468]
test rdx, rdx
je 0x1401307b6
mov rax, qword [rcx + 0x380]
mov rcx, qword [rax + 8]
call fcn.140261248
test rax, rax
jne 0x1401307dd
jmp 0x1401307e5
mov ecx, dword [0x140394de0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1401307af
cmp byte [rax + 8], 0
jne 0x1401307e1
mov rcx, rax
call fcn.140048340
test rax, rax
jne 0x1401307e1
call fcn.14018d030
jmp 0x1401307e1
mov rax, qword [0x1403991e0]
test rax, rax
je 0x1401307cd
mov rax, qword [rax + 0x50]
cmp rax, rcx
jne 0x1401307d4
jmp 0x1401307dd
xor eax, eax
cmp rax, rcx
je 0x1401307dd
call fcn.14012a4c0
test al, al
jne 0x1401307e5
mov rax, qword [rdi + 0x10]
mov rsi, qword [rax + 0x40]
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1401463a0
Capabilities:
Encode data using xor

Disassembly:
mov rdx, qword [rcx + 7]
mov rax, rdx
sar rax, 1
mov r8, qword [rcx - 1]
and r8d, 0xfffff000
cmp r8d, 0x5d000
je 0x1401463d2
mov r8, qword [rcx - 1]
and r8d, 0xfffff000
cmp r8d, 0x5f000
jne 0x140146438
mov r8, qword [rcx - 1]
and r8d, 0xfffff000
cmp r8d, 0x5d000
jne 0x1401463ec
add rcx, 0xf
jmp 0x1401463f0
mov rcx, qword [rcx + 0xf]
xor r8d, r8d
cmp rdx, 2
jl 0x14014649b
inc rax
xor edx, edx
nop word cs:[rax + rax]
movzx r8d, byte [rcx]
add r8d, edx
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov edx, r9d
shr edx, 6
xor edx, r9d
inc rcx
dec rax
cmp rax, 1
ja 0x140146410
jmp 0x140146497
mov r8, qword [rcx - 1]
and r8d, 0xfffff000
cmp r8d, 0x5e000
jne 0x140146452
add rcx, 0xf
jmp 0x140146456
mov rcx, qword [rcx + 0xf]
xor r8d, r8d
cmp rdx, 2
jl 0x14014649b
inc rax
xor edx, edx
nop word cs:[rax + rax]
movzx r8d, word [rcx]
add r8d, edx
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov edx, r9d
shr edx, 6
xor edx, r9d
add rcx, 2
dec rax
cmp rax, 1
ja 0x140146470
lea r8d, [rdx + rdx*8]
mov ecx, r8d
shr ecx, 0xb
xor ecx, r8d
mov eax, ecx
shl eax, 0xf
add eax, ecx
and eax, 0x3fffffff
cmp eax, 1
adc eax, 0
ret
Function at 0x1401553d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rbx, r9
mov r15, r8
mov qword [rsp + 0x30], rdx
mov rdi, rcx
mov rax, qword [0x140396de8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, dword [0x14039dea0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 8]
mov rsi, qword [rax + 0x18]
mov rcx, rsi
call fcn.1400f7d60
mov r12, rax
mov rcx, rsi
call fcn.1400f7d60
mov r13, rax
mov rax, qword [rdi + 8]
add rdi, 8
cmp rax, qword [0x140394c80]
je 0x140155588
mov rbp, qword [rax + 0xf]
cmp rbp, 2
jl 0x140155588
mov qword [rsp + 0x48], rsi
sar rbp, 1
xor esi, esi
xor r14d, r14d
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], rbx
jmp 0x14015549d
test rsi, rsi
je 0x140155581
mov rcx, qword [rsi + 8]
mov r8, qword [r13 + 8]
lea rdx, [rcx + r14*8]
add rdx, 0x27
dec rcx
call fcn.1400ef910
inc r14
cmp r14, rbp
je 0x14015558a
mov rax, qword [rdi]
mov rdx, qword [rax + r14*8 + 0x27]
mov rcx, r12
call fcn.1400f7d80
mov rax, qword [r12]
mov rcx, qword [rsp + 0xd8]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rsp + 0xd0]
mov dword [rsp + 0x20], ecx
mov rcx, r12
lea rdx, [rsp + 0x58]
mov r8, r15
mov r9, rbx
call qword [rax + 0x358]
mov rdx, qword [rsp + 0x58]
mov rcx, r13
call fcn.1400f7d80
mov rax, qword [r12 + 8]
cmp rax, qword [r13 + 8]
je 0x140155470
test rsi, rsi
jne 0x140155470
lea rcx, [rsp + 0x50]
mov rdx, rbp
mov r8d, dword [rsp + 0xd0]
call fcn.14014b830
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call fcn.1400eefc0
mov rsi, rax
test r14, r14
je 0x140155479
xor ebx, ebx
mov r15, r14
nop word [rax + rax]
mov rax, qword [rdi]
mov rdx, qword [rax + rbx + 0x27]
mov rcx, r12
call fcn.1400f7d80
mov rcx, qword [rsi + 8]
mov r8, qword [r12 + 8]
lea rdx, [rcx + rbx]
add rdx, 0x27
dec rcx
call fcn.1400ef910
add rbx, 8
dec r15
jne 0x140155540
mov rbx, qword [rsp + 0x38]
mov r15, qword [rsp + 0x40]
jmp 0x140155479
xor esi, esi
jmp 0x140155491
xor esi, esi
lea rax, [rsi + 8]
test rsi, rsi
cmove rax, rdi
mov rax, qword [rax]
mov rsi, qword [rsp + 0x30]
mov qword [rsi], rax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14025dfe0
mov rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret