joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001c70
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
push rsi
push r14
sub rsp, 0x158
mov r14, rdx
mov qword [rdx], 0
xor edx, edx
mov dword [rax + 0x10], 0
mov rsi, rcx
lea r9, [rax + 0x10]
xor r8d, r8d
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140001e0f
mov rax, qword gs:[0x30]
mov r8d, dword [rsp + 0x178]
mov qword [rsp + 0x180], rbp
add r8, r8
mov qword [rsp + 0x150], rdi
mov rdx, qword [rax + 0x60]
mov rcx, qword [rdx + 0x30]
mov edx, 8
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x178]
xor r9d, r9d
add r8d, r8d
mov rdx, rax
mov rdi, rax
lea ecx, [r9 + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebp, eax
test eax, eax
js 0x140001de1
mov qword [rsp + 0x170], rbx
xor ebx, ebx
cmp dword [rdi], ebx
jbe 0x140001dd9
nop
mov ecx, ebx
lea rax, [rsp + 0x20]
imul rdx, rcx, 0x128
lea rcx, [rdi + 8]
add rcx, rdx
mov edx, 2
nop word [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x140001d40
movups xmm0, xmmword [rcx]
lea rdx, [rsp + 0x48]
movups xmm1, xmmword [rcx + 0x10]
mov rcx, qword [rcx + 0x20]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
mov qword [rax + 0x20], rcx
mov rcx, rsi
movzx eax, word [rsp + 0x46]
add rdx, rax
call qword [sym.imp.ntdll.dll__stricmp]
test eax, eax
je 0x140001dcf
inc ebx
cmp ebx, dword [rdi]
jb 0x140001d20
jmp 0x140001dd9
mov rax, qword [rsp + 0x30]
xor ebp, ebp
mov qword [r14], rax
mov rbx, qword [rsp + 0x170]
mov rax, qword gs:[0x30]
mov r8, rdi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rdi, qword [rsp + 0x150]
mov eax, ebp
mov rbp, qword [rsp + 0x180]
add rsp, 0x158
pop r14
pop rsi
ret
Function at 0x140001e20
Capabilities:
Disable driver code integrity
Parse pe header

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
xor edi, edi
mov eax, 0x5a4d
mov r15, rcx
mov qword [r8], rdi
mov dword [rsp + 0xb0], edi
cmp word [rcx], ax
jne 0x140001efd
movsxd r9, dword [rcx + 0x3c]
add r9, rcx
cmp dword [r9], 0x4550
jne 0x140001efd
mov ecx, 0x78
mov edx, 0x20b
cmp word [r9 + 0x18], dx
mov eax, 0x88
mov ebp, edi
cmovne eax, ecx
mov ecx, dword [rax + r9]
mov eax, dword [rax + r9 + 4]
lea r13, [r15 + rcx]
mov r12d, dword [r13 + 0x20]
mov esi, dword [r13 + 0x18]
add r12, r15
mov dword [rsp + 0x20], eax
mov eax, dword [r13 + 0x1c]
add rax, r15
mov dword [rsp + 0xc8], ecx
mov qword [rsp + 0x30], rax
mov eax, dword [r13 + 0x24]
add rax, r15
sub esi, 1
mov qword [rsp + 0x28], rax
js 0x140001efd
nop dword [rax]
nop dword [rax + rax]
lea ebx, [rsi + rbp]
sar ebx, 1
lea rcx, str.CiInitialize
movsxd r14, ebx
mov edx, dword [r12 + r14*4]
add rdx, r15
call sub.ntdll.dll_strcmp
test eax, eax
jns 0x140001ef4
lea esi, [rbx - 1]
jmp 0x140001ef9
jle 0x140001f10
lea ebp, [rbx + 1]
cmp esi, ebp
jge 0x140001ed0
xor eax, eax
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp esi, ebp
jl 0x140001efd
cmp ebx, dword [r13 + 0x14]
jge 0x140001efd
lfence
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
movzx eax, word [rax + r14*2]
mov ecx, dword [rcx + rax*4]
mov eax, dword [rsp + 0xc8]
cmp ecx, eax
jb 0x140001f42
add eax, dword [rsp + 0x20]
cmp ecx, eax
jb 0x140001efd
mov r14, rcx
add r14, r15
je 0x140001efd
mov rax, qword gs:[0x30]
mov ebx, edi
mov rcx, qword [rax + 0x60]
mov eax, 0x3fab
cmp word [rcx + 0x120], ax
jb 0x140001fb0
mov esi, edi
nop dword [rax]
lea eax, [rsi + 1]
mov ecx, ebx
add rcx, r14
cmp byte [rcx], 0xe8
cmovne eax, esi
mov esi, eax
cmp eax, 1
ja 0x140001fdf
lea rdx, [rsp + 0x38]
call section..text
test dword [rsp + 0x59], 0x1000
jne 0x140001fe9
movzx eax, byte [rsp + 0x38]
add ebx, eax
cmp ebx, 0x100
jb 0x140001f70
jmp 0x140001fe9
mov ecx, ebx
add rcx, r14
cmp byte [rcx], 0xe9
je 0x140001fdf
lea rdx, [rsp + 0x38]
call section..text
test dword [rsp + 0x59], 0x1000
jne 0x140001fe9
movzx eax, byte [rsp + 0x38]
add ebx, eax
cmp ebx, 0x100
jb 0x140001fb0
jmp 0x140001fe9
mov eax, dword [rcx + 1]
mov dword [rsp + 0xb0], eax
movsxd rcx, dword [rsp + 0xb0]
add rbx, r14
add rcx, 5
mov esi, 0xd89
add rbx, rcx
mov ecx, edi
add rcx, rbx
cmp word [rcx], si
je 0x140002061
lea rdx, [rsp + 0x38]
call section..text
test dword [rsp + 0x59], 0x1000
jne 0x14000202d
movzx eax, byte [rsp + 0x38]
add edi, eax
cmp edi, 0x100
jb 0x140002000
mov eax, dword [rsp + 0xb0]
movsxd rcx, eax
mov edx, edi
add rdx, rcx
mov rcx, qword [rsp + 0xb8]
sub rdx, r15
add rcx, 6
add rdx, rbx
add rcx, rdx
mov rdx, qword [rsp + 0xc0]
mov qword [rdx], rcx
jmp 0x140001eff
mov eax, dword [rcx + 2]
jmp 0x140002034
Function at 0x140002490
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x240
mov rdi, rdx
mov rbx, rcx
call fcn.1400023f0
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlCreateRegistryKey]
test eax, eax
js 0x14000256a
lea r8, str.___
mov dword [rsp + 0x260], 1
mov edx, 5
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_wcscpy_s]
mov r8, rdi
lea rcx, [rsp + 0x30]
mov edx, 0x87
call qword [sym.imp.ntdll.dll_wcscat_s]
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140002500
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
lea r8, str.ImagePath
lea rax, [rsp + 0x30]
mov rdx, rbx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_RtlWriteRegistryValue]
test eax, eax
js 0x14000256a
lea rax, [rsp + 0x260]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, str.Type
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlWriteRegistryValue]
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret
Function at 0x140001710
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140007480
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140007480
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140001780
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14000e0a4]
mov rbx, rcx
test esi, esi
jle 0x1400018b0
mov rax, qword [0x14000e0a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x1400017cb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140001855
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x1400017b0
mov rcx, rbx
call fcn.1400021d0
mov rdi, rax
test rax, rax
je 0x1400018d2
mov rax, qword [0x14000e0a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140002310
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000e0a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400018b7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14000184e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140001860
add dword [0x14000e0a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000e0a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000184e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140001710
nop dword [rax]
xor esi, esi
jmp 0x1400017d8
mov rax, qword [0x14000e0a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140001710
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140001710
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140001e40
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14000e100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000e0e0]
test rbx, rbx
je 0x140001e9c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140001e93
test rsi, rsi
je 0x140001e93
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140001e78
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1400021d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14000ad40]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400021f0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400021f8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400021f0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000224d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002244
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400021f0
add rax, 0x28
cmp rax, r9
jne 0x140002230
xor eax, eax
ret

Function at 0x140002250
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000ad40]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000226f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002278
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000226f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140002310
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000ad40]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000232f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002338
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140008150
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
movsxd rax, dword [rcx + 0x3c]
mov r13d, dword [rcx + rax + 0x88]
add r13, rcx
mov rsi, rcx
mov rbp, rdx
mov edi, dword [r13 + 0x18]
mov eax, dword [r13 + 0x20]
test edi, edi
je 0x1400081d0
xor ebx, ebx
lea r12, [rcx + rax]
jmp 0x140008191
add rbx, 1
cmp rbx, rdi
je 0x1400081d0
mov edx, dword [r12 + rbx*4]
mov rcx, rbp
add rdx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140008188
mov eax, dword [r13 + 0x24]
lea rdx, [rsi + rbx*2]
movzx edx, word [rdx + rax]
mov eax, dword [r13 + 0x1c]
lea rdx, [rsi + rdx*4]
mov eax, dword [rdx + rax]
add rax, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x1400081e0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x448
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r15, qword [rax + 0x20]
lea r14, [rax + 0x20]
xor eax, eax
lea rsi, [rsp + 0x20]
mov qword [rsp + 0x490], rcx
lea rbx, [rsp + 0x230]
mov ecx, 0x41
mov rdi, rsi
rep stosq qword [rdi], rax
mov ecx, 0x41
mov rdi, rbx
rep stosq qword [rdi], rax
cmp r14, r15
je 0x1400082dc
mov r13, qword [sym.imp.msvcrt.dll_wcscpy_s]
mov r12, qword [sym.imp.msvcrt.dll__wcslwr_s]
xor ebp, ebp
nop
mov rax, rbp
mov ecx, 0x41
mov rdi, rsi
mov edx, 0x104
rep stosq qword [rdi], rax
mov ecx, 0x41
mov rdi, rbx
rep stosq qword [rdi], rax
mov rcx, rsi
mov r8, qword [r15 + 0x40]
call r13
mov r8, qword [rsp + 0x490]
mov edx, 0x104
mov rcx, rbx
call r13
mov edx, 0x104
mov rcx, rbx
call r12
mov edx, 0x104
mov rcx, rsi
call r12
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.SHELL32.dll_StrStrW]
test rax, rax
je 0x1400082d0
mov rax, qword [r15 + 0x20]
add rsp, 0x448
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r15, qword [r15]
cmp r14, r15
jne 0x140008250
mov rdx, qword [rsp + 0x490]
lea rcx, str.failed_to_get_a_handle_to__s_n
call fcn.140008410
xor eax, eax
jmp 0x1400082b6

Function at 0x140008350
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x90
lea rdx, str.hack5.exe
call sub.msvcrt.dll_strstr
test rax, rax
je 0x140008400
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x1400083e0
call fcn.140008460
mov ebx, eax
test eax, eax
jne 0x1400083f0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0x40], 1
jbe 0x1400083c0
mov dword [rsp + 0x50], 0x40
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0x58]
shr rax, 0x1e
cmp eax, 1
jbe 0x1400083c0
mov eax, ebx
add rsp, 0x90
pop rbx
ret
lea rcx, str.possibly_launched_in_sandbox_n
call fcn.140008410
mov ebx, 1
mov eax, ebx
add rsp, 0x90
pop rbx
ret
lea rcx, str.attached_debugger_detected___n
call fcn.140008410
jmp 0x1400083cc
lea rcx, str.NUMA_memory_allocate_failed__n
call fcn.140008410
jmp 0x1400083cc
lea rcx, str.nononono__n
call fcn.140008410
jmp 0x1400083cc
Function at 0x1400d62b7
Capabilities:
Set thread local storage value

Disassembly:
push rax
pushf
mov eax, 0x7e601333
pushf
not eax
add eax, 0x95f436a8
xor eax, 0xb198d993
rol eax, 0x47
popf
pushf
not eax
add eax, 0xf0ecd0d0
xor eax, 0xea6f5cfc
rol eax, 0xe1
popf
cmp eax, 2
jne 0x1400d62f4
popf
pop rax
jmp 0x1400d6464
cmp eax, 0
jne 0x1400d6303
popf
pop rax
jmp 0x1400d6321
cmp eax, 3
jne 0x1400d6312
popf
pop rax
jmp 0x1400d649d
cmp eax, 1
jne 0x1400d6321
popf
pop rax
jmp 0x1400d645b
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x1bbf06514]
pushf
sub r9, 0x7bef51c4
popf
mov edi, ecx
lea rdx, [0x1933269a7]
pushf
sub rdx, 0x53315657
popf
mov ecx, 0x48a27b9d
pushf
not ecx
add ecx, 0x991f249e
xor ecx, 0x84532c5c
rol ecx, 0xda
popf
pushf
not ecx
add ecx, 0xa51883c9
xor ecx, 0x89a3312e
rol ecx, 0x3b
popf
pushf
not ecx
add ecx, 0xc28b787b
xor ecx, 0xc1f85ddc
rol ecx, 0xe0
popf
pushf
not ecx
add ecx, 0xa53ba586
xor ecx, 0x900b947b
rol ecx, 0x56
popf
lea r8, [0x1b1575bf1]
pushf
sub r8, 0x715648a9
popf
call fcn.14000446c
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x1400d6427
push rax
pushf
mov eax, 0xc040dc41
pushf
not eax
add eax, 0xd936fbd3
xor eax, 0xc9c4d740
rol eax, 0x83
popf
pushf
not eax
add eax, 0xa8ddc476
xor eax, 0x95619a80
rol eax, 0x51
popf
pushf
not eax
add eax, 0x804efa60
xor eax, 0xcada772c
rol eax, 0xdf
popf
pushf
not eax
add eax, 0xd14db150
xor eax, 0x937a68b0
rol eax, 0x71
popf
jmp 0x1400d62e5
push rax
pushf
mov eax, 0x25b4c672
pushf
not eax
add eax, 0x92f053eb
xor eax, 0xed6badff
rol eax, 0xed
popf
pushf
not eax
add eax, 0xd304e8f6
xor eax, 0xdef3f8eb
rol eax, 0x45
popf
jmp 0x1400d62e5
call qword [0x140010290]
jmp 0x1400d649d
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
push rax
pushf
mov eax, 0xf70daaa2
pushf
not eax
add eax, 0xc0fc0d07
xor eax, 0xb5f4ff04
rol eax, 0xe6
popf
pushf
not eax
add eax, 0xfad07f2d
xor eax, 0xf729270d
rol eax, 0x28
popf
jmp 0x1400d62e5
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400e3eab
Capabilities:
Get thread local storage value

Disassembly:
push rax
pushf
mov eax, 0x39733cd3
pushf
not eax
add eax, 0xfe34b511
xor eax, 0xd0e36d16
rol eax, 0x16
popf
pushf
not eax
add eax, 0xfddf79ef
xor eax, 0xc20c9c82
rol eax, 0x5f
popf
pushf
not eax
add eax, 0xf1059392
xor eax, 0xd511933e
rol eax, 0x67
popf
pushf
not eax
add eax, 0xabc4f4e5
xor eax, 0xf5fd236e
rol eax, 0xf2
popf
cmp eax, 2
jne 0x1400e3f0e
popf
pop rax
jmp 0x1400e403f
cmp eax, 0
jne 0x1400e3f1d
popf
pop rax
jmp 0x1400e3f2c
cmp eax, 1
jne 0x1400e3f2c
popf
pop rax
jmp 0x1400e4033
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x1abcc4ac1]
pushf
sub r9, 0x6bcb3789
popf
mov ecx, 0x92c3a2a
pushf
not ecx
add ecx, 0x8af89781
xor ecx, 0xd43bcf44
rol ecx, 0x3d
popf
pushf
not ecx
add ecx, 0xe1e7814e
xor ecx, 0xef8d692b
rol ecx, 0x3b
popf
pushf
not ecx
add ecx, 0xa084f048
xor ecx, 0x9dbfc116
rol ecx, 0xc9
popf
lea r8, [0x18a7e793a]
pushf
sub r8, 0x4a7d660a
popf
lea rdx, [0x1bbae7c44]
pushf
sub rdx, 0x7bad690c
popf
call fcn.14000446c
mov ecx, ebx
test rax, rax
je 0x1400e3fed
push rax
pushf
mov eax, 0x13d7e19c
pushf
not eax
add eax, 0xc39decfe
xor eax, 0xca31d264
rol eax, 0xef
popf
pushf
not eax
add eax, 0x9fe8d57b
xor eax, 0xb366223f
rol eax, 0x3a
popf
jmp 0x1400e3eff
push rax
pushf
mov eax, 0xaa70d301
pushf
not eax
add eax, 0xc3beaed1
xor eax, 0x806171ef
rol eax, 0x28
popf
pushf
not eax
add eax, 0xbbe8f30e
xor eax, 0xf9808ed6
rol eax, 0xc5
popf
pushf
not eax
add eax, 0x80368fc5
xor eax, 0xa86afb66
rol eax, 0x9d
popf
jmp 0x1400e3eff
add rsp, 0x20
pop rbx
jmp qword [0x140010290]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1400e7731
Capabilities:
Allocate thread local storage

Disassembly:
push rax
pushf
mov eax, 0xe1383a18
pushf
not eax
add eax, 0xd38ddc99
xor eax, 0xbe566500
rol eax, 0x2c
popf
pushf
not eax
add eax, 0xe6bfd141
xor eax, 0xaa47cc80
rol eax, 0x12
popf
cmp eax, 2
jne 0x1400e776e
popf
pop rax
jmp 0x1400e784c
cmp eax, 0
jne 0x1400e777d
popf
pop rax
jmp 0x1400e778c
cmp eax, 1
jne 0x1400e778c
popf
pop rax
jmp 0x1400e783d
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x1b13c9bab]
pushf
sub r9, 0x713b889b
popf
xor ecx, ecx
lea r8, [0x19f05d7cb]
pushf
sub r8, 0x5f04c4c3
popf
lea rdx, [0x1a5b75031]
pushf
sub rdx, 0x65b63d21
popf
call fcn.14000446c
test rax, rax
je 0x1400e780a
push rax
pushf
mov eax, 0x66407ea6
pushf
not eax
add eax, 0x850af479
xor eax, 0xed02e200
rol eax, 0xc0
popf
pushf
not eax
add eax, 0xf25f3ae4
xor eax, 0xfe9ea311
rol eax, 0x2d
popf
jmp 0x1400e775f
push rax
pushf
mov eax, 0x99be22af
pushf
not eax
add eax, 0x96f69faa
xor eax, 0xce446b63
rol eax, 0xde
popf
pushf
not eax
add eax, 0xd9418f23
xor eax, 0x8c62897c
rol eax, 0xfb
popf
jmp 0x1400e775f
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [0x140010290]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]
Function at 0x1400f2b28
Capabilities:
Terminate process

Disassembly:
push rax
pushf
mov eax, 0xe22a504
pushf
not eax
add eax, 0xc784e86c
xor eax, 0xd1dd419c
rol eax, 0x56
popf
pushf
not eax
add eax, 0xb04486ad
xor eax, 0xf16a56ec
rol eax, 0x83
popf
cmp eax, 2
jne 0x1400f2b65
popf
pop rax
jmp 0x1400f2c33
cmp eax, 0
jne 0x1400f2b74
popf
pop rax
jmp 0x1400f2b83
cmp eax, 1
jne 0x1400f2b83
popf
pop rax
jmp 0x1400f2c21
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.1401077aa
test al, al
je 0x1400f2bda
push rax
pushf
mov eax, 0x1ce7d978
pushf
not eax
add eax, 0xda8d11be
xor eax, 0xaf3ffbb1
rol eax, 0x7a
popf
pushf
not eax
add eax, 0xe8e7baab
xor eax, 0xdb1987ce
rol eax, 0x82
popf
pushf
not eax
add eax, 0xb38ab4a8
xor eax, 0xa5f79350
rol eax, 0xa9
popf
jmp 0x1400f2b56
push rax
pushf
mov eax, 0xb1220125
pushf
not eax
add eax, 0xc7df0f2a
xor eax, 0x99da761a
rol eax, 0x3d
popf
pushf
not eax
add eax, 0xc31abbce
xor eax, 0x9f308c23
rol eax, 0xd8
popf
pushf
not eax
add eax, 0x8e9b1173
xor eax, 0xa52cf430
rol eax, 0
popf
jmp 0x1400f2b56
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
jmp 0x1400f2c2d
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
call fcn.1400f0bc3
mov ecx, ebx
jmp 0x1400f2c3d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140117fb7
Capabilities:
Authenticate hmac

Disassembly:
push rax
pushf
mov eax, 0x5e804f45
pushf
not eax
add eax, 0xe9efe2a5
xor eax, 0xaae5bbfd
rol eax, 0x9f
popf
pushf
not eax
add eax, 0xcd775409
xor eax, 0xd01cc402
rol eax, 0x63
popf
pushf
not eax
add eax, 0xaa541cda
xor eax, 0xddd1bf5e
rol eax, 0xaf
popf
pushf
not eax
add eax, 0x9138a637
xor eax, 0xd10059b0
rol eax, 0xb1
popf
cmp eax, 0
jne 0x14011801a
popf
pop rax
jmp 0x14011801a
sub rsp, 0x28
call fcn.1400e374d
lea rdx, [0x19fa22c7d]
pushf
sub rdx, 0x5f9572a5
popf
mov rcx, rax
add rsp, 0x28
jmp fcn.1400fc478
Function at 0x1400342c8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x14004c350], eax
call fcn.140034d70
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x14004c350], 0
jne case.default.0x14003431e
mov ecx, 1
call fcn.140034d70
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
invalid
Function at 0x14001123f
Capabilities:
Terminate process

Disassembly:
jmp 0x1400165b0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112d0
Capabilities:
Parse pe header

Disassembly:
jmp 0x140017900
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140017920
xor al, al
jmp 0x1400179a1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140017933
xor al, al
jmp 0x1400179a1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001795d
xor al, al
jmp 0x1400179a1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140017971
xor al, al
jmp 0x1400179a1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140017983
xor al, al
jmp 0x1400179a1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001799f
xor al, al
jmp 0x1400179a1
mov al, 1
add rsp, 0x38
ret