joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001430
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xe0
mov rax, qword [0x180064e08]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r14, qword [rsp + 0x138]
lea eax, [rdx - 0x80]
cmp edx, 0x80
mov ebx, r8d
lea r8d, [rdx + 0x41]
mov rsi, rcx
cmovae r8d, eax
lea rdx, str.._c:
lea rax, str..PhysicalDrive_d
mov ebp, r9d
cmovae rdx, rax
lea rcx, [rsp + 0x50]
call fcn.180001670
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0x50]
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1800014ce
xor eax, eax
jmp 0x180001552
mov eax, ebx
xor r9d, r9d
shr eax, 8
movzx ecx, al
mov eax, ebx
and eax, 0xc0
and ebx, 0x3f
lea r8d, [rcx + rax*4]
movzx eax, byte [rsi + 0x1cd85]
imul r8d, eax
mov rcx, rdi
movzx eax, word [rsi + 0x1cd83]
add r8d, ebp
imul eax, r8d
lea r8, [rsp + 0x4c]
add eax, ebx
shl eax, 9
sub eax, 0x200
mov edx, eax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, dword [rsp + 0x130]
lea r9, [rsp + 0x40]
shl r8d, 9
mov rdx, r14
mov rcx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.180007280
add rsp, 0xe0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x180001570
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0xe0
mov rax, qword [0x180064e08]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rbp, qword [rsp + 0x120]
lea rcx, [rsp + 0x50]
mov ebx, r8d
mov esi, r9d
lea r8d, [rdx + 0x41]
lea rdx, str.._c:
call fcn.180001670
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0x50]
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1800015f1
xor eax, eax
jmp 0x18000163b
shl ebx, 9
lea r8, [rsp + 0x4c]
mov eax, ebx
xor r9d, r9d
mov edx, ebx
mov qword [rsp + 0x48], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
shl esi, 9
lea r9, [rsp + 0x40]
mov r8d, esi
mov qword [rsp + 0x20], 0
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.180007280
mov rbx, qword [rsp + 0x100]
add rsp, 0xe0
pop rdi
pop rsi
pop rbp
ret

Function at 0x1800016d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, 0xffffffff
test r8d, r8d
je 0x18000170b
mov r9d, r8d
lea r10, [0x180028430]
nop dword [rax]
nop dword [rax + rax]
movzx r8d, byte [rdx]
lea rdx, [rdx + 1]
movzx ecx, al
xor r8, rcx
shr eax, 8
xor eax, dword [r10 + r8*4]
sub r9, 1
jne 0x1800016f0
ret
Function at 0x180002150
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x20
movzx r15d, word [rsp + 0x50]
mov rbx, r8
mov rdi, rdx
mov r8d, r15d
mov rdx, rbx
movzx esi, r9b
mov r14, rcx
call fcn.180001df0
test al, al
je 0x1800021c3
mov r8d, r15d
mov rdx, rdi
mov rcx, r14
call fcn.180001df0
test al, al
je 0x1800021c3
movzx ecx, word [rsp + 0x50]
test rcx, rcx
je 0x1800021c3
sub rdi, rbx
nop dword [rax + rax]
movzx eax, sil
xor al, byte [rdi + rbx]
mov byte [rbx], al
lea rbx, [rbx + 1]
sub rcx, 1
jne 0x1800021b0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret

Function at 0x1800021e0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x20
movzx r15d, word [rsp + 0x50]
mov rbx, r8
mov rdi, rdx
mov r8d, r15d
mov rdx, rbx
movzx esi, r9w
mov r14, rcx
call fcn.180001df0
test al, al
je 0x180002264
mov r8d, r15d
mov rdx, rdi
mov rcx, r14
call fcn.180001df0
test al, al
je 0x180002264
movzx ecx, word [rsp + 0x50]
test rcx, rcx
je 0x180002264
sub rdi, rbx
dec rcx
shr rcx, 1
inc rcx
nop dword [rax]
nop dword [rax + rax]
movzx eax, si
xor ax, word [rdi + rbx]
mov word [rbx], ax
lea rbx, [rbx + 2]
sub rcx, 1
jne 0x180002250
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
Function at 0x180002f20
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, r9d
mov rbx, r8
mov r10, rdx
mov rsi, rcx
test r9d, r9d
je 0x180002f95
mov r8, rdx
movzx r9d, di
mov rdx, rbx
call fcn.180001d00
movzx eax, word [rsi + 0x2a8a]
movzx edx, word [rsi + 0x2a8c]
test edi, edi
jle 0x180002f80
mov ecx, edi
nop dword [rax]
nop word [rax + rax]
xor word [rbx], ax
lea rbx, [rbx + 1]
add ax, dx
sub rcx, 1
jne 0x180002f70
mov eax, 2
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor r11d, r11d
lea rbx, [0x180000000]
mov r8d, r11d
mov edx, r11d
nop word [rax + rax]
movzx r9d, byte [rdx + r10]
lea eax, [r9 - 5]
cmp eax, 0xe4
ja case.0x180002fd4.10
cdqe
movzx eax, byte [rbx + rax + 0x3078]
mov ecx, dword [rbx + rax*4 + 0x3060]
add rcx, rbx
jmp rcx
cmp word [rdx + r10 + 1], 0
je case.0x180002fd4.10
movsxd rax, r8d
mov word [rsi + 0x2a8a], r11w
movzx ecx, word [rax + r10 + 1]
mov eax, 2
mov word [rsi + 0x2a8c], cx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
add r8d, 2
add rdx, 2
jmp case.0x180002fd4.10
movzx r11d, word [rdx + r10 + 1]
inc r8d
inc rdx
lea eax, [r8 + 2]
and r9b, 0xf8
cmp r9b, 0xb8
cmovne eax, r8d
lea r8d, [rax + 1]
lea rax, [rdx + 2]
cmovne rax, rdx
lea rdx, [rax + 1]
cmp rdx, 0x50
jl 0x180002fb0
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180003570
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x180064e08]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov esi, 2
mov ebp, edx
mov rbx, rcx
mov r12d, 0xfffa
lea r13d, [rsi + 0x7e]
lea r15d, [rsi + 0x10]
nop dword [rax]
movzx edi, sil
lea rdx, str._c:_
lea rcx, [rsp + 0x30]
lea r8d, [rdi + 0x41]
call fcn.180001670
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test al, 3
je 0x1800036ba
cmp dil, 2
jae 0x1800036ba
lea r8d, [rdi + 0x41]
lea rdx, str._c:_
lea rcx, [rsp + 0x30]
call fcn.180001670
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
lea ecx, [rax - 1]
test r12w, cx
jne 0x180003629
cmp ax, 2
jne 0x1800036ba
cmp ax, 3
lea r9, [rsp + 0x24]
mov ecx, edi
lea r8, [rsp + 0x20]
cmove ecx, r13d
lea rdx, [rsp + 0x28]
mov byte [rbx + 0x1cd82], cl
xor eax, eax
movzx ecx, byte [rbx + 0x1cd82]
mov byte [rbx + 0x1cd85], 0
mov word [rbx + 0x1cd83], ax
call fcn.180003460
test eax, eax
je 0x18000367f
movzx eax, word [rsp + 0x20]
mov word [rbx + 0x1cd83], ax
movzx eax, byte [rsp + 0x24]
mov byte [rbx + 0x1cd85], al
mov rcx, rbx
mov word [rbx + 0x18], r15w
mov dword [rbx + 0x5e], 0x200
mov byte [rbx + 0x1cd86], dil
call fcn.180003e30
test eax, eax
jne 0x1800036ba
nop
mov edx, ebp
mov rcx, rbx
call fcn.180003a00
test eax, eax
jne 0x1800036ba
mov rcx, rbx
call fcn.180003e30
test eax, eax
jne 0x1800036a0
inc esi
cmp esi, 0x1f
jl 0x1800035c0
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.180007280
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800038c0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x180064e08]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movzx esi, dl
mov edi, r8d
mov rbx, rcx
cmp sil, 2
jae 0x1800039ca
lea r8d, [rsi + 0x41]
lea rdx, str._c:_
lea rcx, [rsp + 0x30]
call fcn.180001670
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edx, eax
lea ecx, [rax - 1]
mov eax, 0xfffa
test ax, cx
jne 0x180003930
cmp dx, 2
jne 0x1800039ca
cmp dx, 3
lea r9, [rsp + 0x24]
mov ecx, 0x80
lea r8, [rsp + 0x20]
cmovne ecx, esi
lea rdx, [rsp + 0x28]
mov byte [rbx + 0x1cd82], cl
xor eax, eax
movzx ecx, byte [rbx + 0x1cd82]
mov byte [rbx + 0x1cd85], 0
mov word [rbx + 0x1cd83], ax
call fcn.180003460
test eax, eax
je 0x180003988
movzx eax, word [rsp + 0x20]
mov word [rbx + 0x1cd83], ax
movzx eax, byte [rsp + 0x24]
mov byte [rbx + 0x1cd85], al
mov eax, 0x12
mov dword [rbx + 0x5e], 0x200
mov rcx, rbx
mov word [rbx + 0x18], ax
mov byte [rbx + 0x1cd86], sil
call fcn.180003e30
test eax, eax
jne 0x1800039ca
nop dword [rax + rax]
mov edx, edi
mov rcx, rbx
call fcn.180003a00
test eax, eax
jne 0x1800039ca
mov rcx, rbx
call fcn.180003e30
test eax, eax
jne 0x1800039b0
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.180007280
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180012e98
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180012ec8
xor eax, eax
jmp 0x180012f8b
mov rbp, rbx
cmp word [rax], si
je 0x180012eed
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180012ed4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180012ed0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180012db8
movsxd r14, eax
test eax, eax
jne 0x180012f2b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180012ec1
mov rcx, r14
call fcn.18000fa88
mov rdi, rax
test rax, rax
jne 0x180012f44
xor ecx, ecx
call fcn.18000e634
jmp 0x180012f20
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180012db8
test eax, eax
jne 0x180012f75
mov rcx, rdi
call fcn.18000e634
jmp 0x180012f7f
xor ecx, ecx
call fcn.18000e634
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x70b81c50
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
xor r8d, r8d
test rdx, rdx
mov rbx, rcx
mov rcx, rdx
je 0x70b81c7d
cmp byte [rcx], 0
lea rdx, [rdx + 1]
je 0x70b81c7d
nop dword [rax]
lea rax, [rdx + r8]
add r8, 1
cmp byte [rax], 0
jne 0x70b81c70
mov r9, rbx
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.70b9bab0
Function at 0x70b8a680
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
call fcn.70b8a410
test rax, rax
je 0x70b8a6e7
mov r9, qword [rax]
test r9, r9
jle 0x70b8a6e7
mov r8, rax
add r9, rbx
sub r8, rbx
nop dword [rax]
nop word cs:[rax + rax]
mov rcx, rbx
mov rdx, rbx
sar rcx, 8
sar rdx, 0x10
xor ecx, ebx
and edx, 0xffffffee
and ecx, 0xffffffee
xor cl, byte [r8 + rbx + 0x10]
xor ecx, edx
mov rdx, rbx
sar rdx, 0x18
and edx, 0xffffffee
xor ecx, edx
mov byte [r8 + rbx + 0x10], cl
add rbx, 1
cmp rbx, r9
jne 0x70b8a6b0
add rsp, 0x20
pop rbx
ret

Function at 0x70b8b2b0
Capabilities:
Access peb ldr_data

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
lea rsi, [0x70ba3aa0]
mov rbx, rcx
mov ebp, edx
mov edx, 0x66ea722e
lea rcx, [0x70ba3ae0]
call fcn.70b8a680
mov edx, 0x276b406e
mov rcx, rax
call fcn.70b8abe0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r12, qword [rax + 0x20]
lea rdi, [rax + 0x20]
nop dword [rax + rax]
movzx eax, word [rbx]
mov rdx, rbx
test ax, ax
je 0x70b8b330
nop dword [rax + rax]
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x70b8b440
add eax, 0x20
add rdx, 2
mov word [rdx - 2], ax
movzx eax, word [rdx]
test ax, ax
jne 0x70b8b310
mov rdx, qword [r12 + 0x50]
movzx eax, word [rdx]
test ax, ax
je 0x70b8b362
mov rcx, rdx
lea r8d, [rax - 0x41]
cmp r8w, 0x19
ja 0x70b8b460
add eax, 0x20
add rcx, 2
mov word [rcx - 2], ax
movzx eax, word [rcx]
test ax, ax
jne 0x70b8b340
mov rcx, rbx
call fcn.70b82850
mov edx, 0x3dd9844a
mov rcx, rsi
mov r13, rax
call fcn.70b8a680
mov edx, 0x191f08ee
mov rcx, rax
call fcn.70b8abe0
test r13, r13
je 0x70b8b480
mov r12, qword [r12]
cmp rdi, r12
jne 0x70b8b300
test ebp, ebp
je 0x70b8b4a0
lea rcx, [0x70ba3a40]
mov edx, 0x7bd66d2a
call fcn.70b8a680
lea rsi, [rsp + 0x30]
mov edx, 0x7dd8158e
mov rcx, rax
call fcn.70b8abe0
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x28], 0
call qword [0x70bc7160]
lea r9, [rsp + 0x28]
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [0x70bcb438]
mov edx, 0x1c8dd90e
lea rcx, [0x70ba3a00]
mov ebx, eax
call fcn.70b8a680
mov edx, 0x2929ee8a
mov rcx, rax
call fcn.70b8abe0
test ebx, ebx
jne 0x70b8b4be
mov rax, qword [rsp + 0x28]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
add rdx, 2
movzx eax, word [rdx]
test ax, ax
jne 0x70b8b310
jmp 0x70b8b330
add rcx, 2
movzx eax, word [rcx]
test ax, ax
jne 0x70b8b340
jmp 0x70b8b362
mov rax, qword [r12 + 0x20]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rcx, [0x70ba39c0]
mov edx, 0x276b406e
call fcn.70b8a680
mov edx, 0x79db0eaa
mov rcx, rax
call fcn.70b8abe0
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x70b8baa0
Capabilities:
Parse credit card information

Disassembly:
cmp cx, 0x16
je 0x70b8bd40
jbe 0x70b8bb00
cmp cx, 0x25
je 0x70b8bf30
jbe 0x70b8bc40
cmp cx, 0x44
je 0x70b8bf20
ja 0x70b8bc10
cmp cx, 0x41
je 0x70b8bf10
jbe 0x70b8bb50
cmp cx, 0x42
je 0x70b8bf00
cmp cx, 0x43
jne 0x70b8bef0
lea rcx, [0x70ba2e80]
jmp fcn.70b8a410
cmp cx, 0xa
je 0x70b8bee0
ja 0x70b8bbd0
cmp cx, 4
je 0x70b8bed0
jbe 0x70b8bb90
cmp cx, 7
je 0x70b8bec0
jbe 0x70b8bb70
cmp cx, 8
je 0x70b8beb0
cmp cx, 9
jne 0x70b8bef0
lea rcx, [0x70ba3200]
jmp fcn.70b8a410
cmp cx, 0x26
je 0x70b8bea0
cmp cx, 0x40
jne 0x70b8bef0
lea rcx, [0x70ba2ee0]
jmp fcn.70b8a410
cmp cx, 5
je 0x70b8be90
cmp cx, 6
jne 0x70b8bef0
lea rcx, [0x70ba3260]
jmp fcn.70b8a410
cmp cx, 1
je 0x70b8be80
test cx, cx
je 0x70b8be70
cmp cx, 2
je 0x70b8be60
cmp cx, 3
jne 0x70b8bef0
lea rcx, [0x70ba32c0]
jmp fcn.70b8a410
cmp cx, 0x10
je 0x70b8be50
jbe 0x70b8bd10
cmp cx, 0x13
je 0x70b8be40
jbe 0x70b8bcf0
cmp cx, 0x14
je 0x70b8be30
cmp cx, 0x15
jne 0x70b8bef0
lea rcx, [0x70ba30a0]
jmp fcn.70b8a410
cmp cx, 0x47
je 0x70b8be20
jbe 0x70b8bc80
cmp cx, 0x48
je 0x70b8be10
cmp cx, 0xfff
jne 0x70b8bef0
lea rcx, [0x70ba2d80]
jmp fcn.70b8a410
cmp cx, 0x1b
je 0x70b8be00
jbe 0x70b8bcc0
cmp cx, 0x1e
je 0x70b8bdf0
jbe 0x70b8bca0
cmp cx, 0x1f
je 0x70b8bde0
cmp cx, 0x24
jne 0x70b8bef0
lea rcx, [0x70ba2f40]
jmp fcn.70b8a410
cmp cx, 0x45
je 0x70b8bdd0
cmp cx, 0x46
jne 0x70b8bef0
lea rcx, [0x70ba2de0]
jmp fcn.70b8a410
cmp cx, 0x1c
je 0x70b8bdc0
cmp cx, 0x1d
jne 0x70b8bef0
lea rcx, [0x70ba2fa0]
jmp fcn.70b8a410
cmp cx, 0x18
je 0x70b8bdb0
jb 0x70b8bda0
cmp cx, 0x19
je 0x70b8bd90
cmp cx, 0x1a
jne 0x70b8bef0
lea rcx, [0x70ba3000]
jmp fcn.70b8a410
cmp cx, 0x11
je 0x70b8bd80
cmp cx, 0x12
jne 0x70b8bef0
lea rcx, [0x70ba3100]
jmp fcn.70b8a410
cmp cx, 0xc
je 0x70b8bd70
jb 0x70b8bd60
cmp cx, 0xd
je 0x70b8bd50
cmp cx, 0xe
jne 0x70b8bef0
lea rcx, [0x70ba3160]
jmp fcn.70b8a410
lea rcx, [0x70ba3080]
jmp fcn.70b8a410
lea rcx, [0x70ba3180]
jmp fcn.70b8a410
lea rcx, [0x70ba31c0]
jmp fcn.70b8a410
lea rcx, [0x70ba31a0]
jmp fcn.70b8a410
lea rcx, [0x70ba3120]
jmp fcn.70b8a410
lea rcx, [0x70ba3020]
jmp fcn.70b8a410
lea rcx, [0x70ba3060]
jmp fcn.70b8a410
lea rcx, [0x70ba3040]
jmp fcn.70b8a410
lea rcx, [0x70ba2fc0]
jmp fcn.70b8a410
lea rcx, [0x70ba2e00]
jmp fcn.70b8a410
lea rcx, [0x70ba2f60]
jmp fcn.70b8a410
lea rcx, [0x70ba2f80]
jmp fcn.70b8a410
lea rcx, [0x70ba2fe0]
jmp fcn.70b8a410
lea rcx, [0x70ba2da0]
jmp fcn.70b8a410
lea rcx, [0x70ba2dc0]
jmp fcn.70b8a410
lea rcx, [0x70ba30c0]
jmp fcn.70b8a410
lea rcx, [0x70ba30e0]
jmp fcn.70b8a410
lea rcx, [0x70ba3140]
jmp fcn.70b8a410
lea rcx, [0x70ba32e0]
jmp fcn.70b8a410
lea rcx, [0x70ba3320]
jmp fcn.70b8a410
lea rcx, [0x70ba3300]
jmp fcn.70b8a410
lea rcx, [0x70ba3280]
jmp fcn.70b8a410
lea rcx, [0x70ba2f00]
jmp fcn.70b8a410
lea rcx, [0x70ba3220]
jmp fcn.70b8a410
lea rcx, [0x70ba3240]
jmp fcn.70b8a410
lea rcx, [0x70ba32a0]
jmp fcn.70b8a410
lea rcx, [0x70ba31e0]
jmp fcn.70b8a410
lea rcx, [0x70ba33e0]
jmp fcn.70b8a410
lea rcx, [0x70ba2ea0]
jmp fcn.70b8a410
lea rcx, [0x70ba2ec0]
jmp fcn.70b8a410
lea rcx, [0x70ba2e40]
jmp fcn.70b8a410
lea rcx, [0x70ba2f20]
jmp fcn.70b8a410
Function at 0x70b93020
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
lea rcx, [0x70bca480]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rsi, qword [rbx]
mov ecx, 1
mov rbx, qword [fcn.70b9bc60]
call rbx
mov rcx, rax
mov rdx, rsi
call fcn.70b92e70
mov ecx, 1
call rbx
mov r8d, 1
mov edx, 1
lea rcx, [0x70ba2013]
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 1
call rbx
mov rcx, rax
call fcn.70b9bab0
lea rcx, [0x70bca480]
add rsp, 0x28
pop rbx
pop rsi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x70b930a0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
sub rsp, 0x38
lea rcx, [0x70ba3ae0]
mov edx, 0x66ea722e
call fcn.70b8a680
mov edx, 0x276b406e
mov rcx, rax
call fcn.70b8abe0
xor eax, eax
mov rdx, qword gs:[0x60]
cmp byte [rdx + 2], 0
je 0x70b93101
lea rcx, [0x70ba3bc0]
mov edx, 0x7dd8158e
mov qword [rsp + 0x28], 0
call fcn.70b8a680
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x28], rax
call fcn.70b93020
mov eax, 1
add rsp, 0x38
ret
Function at 0x70b9aac0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x70bc69e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x70b9ac48
mov rax, qword [0x70bc69e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x70b9ab0c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x70b9ab95
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x70b9aaf0
mov rcx, rbx
call fcn.70b9b760
test rax, rax
mov r12, rax
je 0x70b9ac7d
mov rax, qword [0x70bc69e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.70b9b890
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x70bc69e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x70b9ac60
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x70b9ab8e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x70b9abf0
add dword [0x70bc69e4], 1
cmp edi, 8
jae 0x70b9abc3
test dil, 4
jne 0x70b9ac34
test edi, edi
je 0x70b9abb8
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x70b9ac4f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x70b9abb8
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x70b9abdc
jmp 0x70b9abb8
add rsi, qword [0x70bc69e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x70b9ab8e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.70ba0ba0
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x70b9abb8
xor esi, esi
jmp 0x70b9ab17
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x70b9abb8
mov rax, qword [0x70bc69e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.70ba0ba0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.70ba0ba0
nop
nop dword [rax]

Function at 0x70b9b3d0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x70bc6cc0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x70bc6ca0]
test rbx, rbx
je 0x70b9b424
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x70b9b41b
test rsi, rsi
je 0x70b9b41b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x70b9b400
lea rcx, [0x70bc6cc0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x70b9b760
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x70bbf920]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x70b9b7cd
mov rcx, r8
call fcn.70b9b640
test eax, eax
je 0x70b9b7cd
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x70b9b7cd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x70b9b7c4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x70b9b7cf
add rax, 0x28
cmp rax, r9
jne 0x70b9b7b0
xor eax, eax
add rsp, 0x28
ret

Function at 0x70b9c710
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x70ba13f8], eax
je 0x70b9c72a
add rsp, 0x28
ret
call sub.msvcrt.dll_abort
nop

Function at 0x70b9cc30
Capabilities:
Print debug messages

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x90
test rcx, rcx
mov rbx, rcx
je 0x70b9cc53
call fcn.70b9f970
cmp eax, 1
je 0x70b9cc5e
mov qword [rbx], 0xffffffffffffffff
add rsp, 0x90
pop rbx
pop rsi
pop rdi
ret
lea rdi, [rsp + 0x20]
xor eax, eax
mov ecx, 0xa
lea rsi, str.Error_cleaning_up_spin_keys_for_thread
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x48]
mov ecx, 0x43
rep stosb byte [rdi], al
lea rbx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rbx + 0x27]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x70b9ccd5
mov eax, 0x28
jmp 0x70b9ccba
add rax, 1
cmp rax, 0x6b
je 0x70b9ccc7
cmp byte [rbx + rax], 0
mov edx, eax
jne 0x70b9ccb0
cmp eax, 0x6a
jne 0x70b9ccda
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov edx, 0x27
movsxd rax, edx
mov byte [rsp + rax + 0x20], 0xa
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rax + 0x20], 0
jmp 0x70b9ccc7