joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180008588
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx + 8]
mov edi, edx
mov dword [rsp + 0x50], 1
test rcx, rcx
jne 0x1800085af
xor eax, eax
jmp 0x18000867d
cmp edx, 1
jge 0x1800085bb
mov edi, 0x2dc6c0
jmp 0x1800085c1
imul edi, edi, 0x3e8
mov edx, 6
lea r9, [rsp + 0x50]
mov dword [rsp + 0x20], 4
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rbx + 8]
test eax, eax
je 0x1800085ed
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x1800085a8
lea r9, [rsp + 0x40]
mov edx, 0xffff
mov r8d, 8
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rbx + 8]
test eax, eax
jne 0x1800085e5
lea r9, [rsp + 0x40]
mov edx, 0xffff
mov r8d, 0x1006
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rbx + 8]
test eax, eax
jne 0x1800085e5
lea r9, [rsp + 0x40]
mov edx, 0xffff
mov r8d, 0x1005
mov dword [rsp + 0x40], 0x2dc6c0
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x180008678
mov rcx, qword [rbx + 8]
jmp 0x1800085e5
mov eax, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x180008820
Capabilities:
Hash data with md5

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x18002b028]
xor rax, rsp
mov qword [rsp + 0x98], rax
xor eax, eax
mov edi, r8d
mov rsi, rcx
mov rbx, rdx
lea rcx, [rsp + 0x38]
lea r8d, [rax + 0x50]
xor edx, edx
mov dword [rsp + 0x34], eax
call fcn.180015e20
and dword [rsp + 0x28], 0
xor eax, eax
and dword [rsp + 0x20], eax
and dword [rsp + 0x30], eax
and dword [rsp + 0x34], eax
lea rcx, [rsp + 0x30]
mov r8d, edi
mov rdx, rbx
mov dword [rsp + 0x2c], eax
mov dword [rsp + 0x38], 0x67452301
mov dword [rsp + 0x3c], 0xefcdab89
mov dword [rsp + 0x40], 0x98badcfe
mov dword [rsp + 0x44], 0x10325476
call fcn.180005d58
mov r11d, dword [rsp + 0x30]
mov eax, gethostname
mov r8d, 0x78
shr r11d, 3
lea rcx, [rsp + 0x91]
lea rdx, [rsp + 0x31]
and r11d, 0x3f
mov r9d, 2
sub eax, r11d
sub r8d, r11d
cmp r11d, 0x38
cmovb r8d, eax
mov al, byte [rdx - 1]
mov byte [rcx - 1], al
mov al, byte [rdx]
add rdx, 4
mov byte [rcx], al
mov al, byte [rdx - 3]
add rcx, 4
sub r9, 1
mov byte [rcx - 3], al
mov al, byte [rdx - 2]
mov byte [rcx - 2], al
jne 0x1800088dc
lea rdx, [0x18002d3c0]
lea rcx, [rsp + 0x30]
call fcn.180005d58
mov ebx, 8
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x30]
mov r8d, ebx
call fcn.180005d58
mov al, byte [rsp + 0x39]
mov r11b, byte [rsp + 0x38]
mov byte [rsp + 0x21], al
mov al, byte [rsp + 0x3a]
lea rdx, [rsp + 0x28]
mov byte [rsp + 0x22], al
mov al, byte [rsp + 0x3b]
mov r8d, ebx
mov rcx, rsi
mov byte [rsp + 0x20], r11b
mov byte [rsp + 0x23], al
call fcn.1800066d4
test eax, eax
je 0x18000897a
cmp dword [rsp + 0x28], 0x1f4d
jne 0x18000897a
mov ecx, dword [rsp + 0x20]
cmp dword [rsp + 0x2c], ecx
jne 0x18000897a
lea eax, [rbx - 7]
jmp 0x18000897c
xor eax, eax
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.180012970
add rsp, 0xa0
pop rdi
pop rsi
pop rbx
ret
Function at 0x180008e28
Capabilities:
Get hostname
Get session user name
Resolve dns

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x100
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x18002b028]
xor rax, rsp
mov qword [rsp + 0xf8], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
call fcn.18000939c
mov dword [rdi + 0x2c], eax
lea rdx, [rdi + 0xb8]
mov rcx, rbx
call fcn.18000963c
mov dword [rdi + 0x30], eax
xor edx, edx
lea r8d, [rdx + 0x3c]
lea rcx, [rsp + 0x34]
call fcn.180015e20
mov dword [rsp + 0x30], 0x40
lea rcx, [rsp + 0x30]
call qword [0x180030560]
mov r11, qword [rsp + 0x38]
mov qword [rdi + 0x18], r11
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea rcx, [rdi + 0x25c]
lea rdx, [rsp + 0x20]
call qword [0x180030568]
mov dword [rsp + 0x24], 0x80
lea rcx, [rdi + 0x38]
lea rdx, [rsp + 0x24]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov ebx, 1
mov dword [rdi + 0x10], ebx
cmp dword [rdi], 0x1f40
jne 0x180008ef5
lea edx, [rbx + 1]
xor ecx, ecx
call qword [0x180030148]
nop
mov dword [rdi + 0x28], ebx
lea rdx, [rsi + 0x118]
lea rcx, [rdi + 0x1dc]
call qword [0x180030240]
lea rcx, [rdi + 0x1b8]
call qword [0x180030150]
lea rdx, [rsi + 0x178]
lea rcx, [rdi + 0x2dc]
call qword [0x180030240]
mov byte [rsp + 0x70], 0
xor edx, edx
lea r8d, [rdx + 0x7f]
lea rcx, [rsp + 0x71]
call fcn.180015e20
mov edx, 0x80
lea rcx, [rsp + 0x70]
call qword [sym.imp.WS2_32.dll_gethostname]
lea rcx, [rsp + 0x70]
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x180008f80
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov ecx, dword [rcx]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
lea rcx, [rdi + 0x31c]
call qword [0x180030240]
jmp 0x180008f94
lea rdx, [rsi + 0x158]
lea rcx, [rdi + 0x31c]
call qword [0x180030240]
call qword [0x180030570]
mov dword [rdi + 0x20], eax
call qword [0x180030578]
mov dword [rdi + 0x24], eax
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.180012970
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18000963c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x280
mov rax, qword [0x18002b028]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbx, rdx
lea rcx, [rsp + 0x61]
xor edi, edi
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x60], dil
call fcn.180015e20
mov r11d, dword [0x180030698]
mov r9, qword [0x180030690]
lea r8, [rsp + 0x60]
lea rcx, [0x180030060]
mov edx, 0x2813
mov dword [rsp + 0x20], r11d
call fcn.18000af10
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0x60]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x40], 0x50
mov byte [rsp + 0x41], WSAStartup
mov byte [rsp + 0x42], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x43], 0x63
mov byte [rsp + 0x44], 0x65
mov byte [rsp + 0x45], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x46], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x47], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x48], WSAStartup
mov byte [rsp + 0x49], 0x4e
mov byte [rsp + 0x4a], 0x61
mov byte [rsp + 0x4b], WSAGetLastError
mov byte [rsp + 0x4c], 0x65
mov byte [rsp + 0x4d], 0x53
mov byte [rsp + 0x4e], 0x74
mov byte [rsp + 0x4f], WSAStartup
mov byte [rsp + 0x50], 0x69
mov byte [rsp + 0x51], WSAGetLastError
mov byte [rsp + 0x52], 0x67
mov byte [rsp + 0x53], dil
mov qword [rsp + 0x38], rdi
call qword [0x1800305a8]
cmp eax, edi
jne 0x1800097a9
lea rcx, [rsp + 0x161]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x160], dil
call fcn.180015e20
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x160]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0x104
call qword [0x1800305d8]
cmp eax, edi
jne 0x18000979e
mov r8d, dword [rsp + 0x30]
lea rdx, [rsp + 0x160]
mov rcx, rbx
call qword [0x180030230]
mov rcx, qword [rsp + 0x38]
call qword [0x1800305a0]
mov ecx, gethostbyname
call fcn.1800129d0
mov rcx, rax
mov rdi, rax
call qword [0x180030558]
mov ebx, dword [rdi + 0x20]
mov rcx, rdi
call fcn.180012990
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180012970
mov rbx, qword [rsp + 0x290]
add rsp, 0x280
pop rdi
ret
Function at 0x180012340
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x170
mov rax, qword [0x18002b028]
xor rax, rsp
mov qword [rsp + 0x160], rax
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x12c
call fcn.180015e20
mov byte [rsp + 0x150], WSAStartup
mov byte [rsp + 0x151], 0x64
mov byte [rsp + 0x152], WSAStartup
mov byte [rsp + 0x153], 0x63
mov byte [rsp + 0x154], WSAStartup
mov byte [rsp + 0x155], WSAGetLastError
mov byte [rsp + 0x156], WSAStartup
mov byte [rsp + 0x157], gethostbyname
mov byte [rsp + 0x158], 0x65
mov byte [rsp + 0x159], 0x78
mov byte [rsp + 0x15a], 0x65
mov byte [rsp + 0x15b], 0
mov dword [rsp + 0x20], 0x130
call qword [0x1800304d0]
xor edx, edx
mov ebx, eax
lea ecx, [rdx + 2]
call qword [0x1800304d8]
lea rdx, [rsp + 0x20]
mov rcx, rax
mov rdi, rax
call qword [0x1800304e0]
jmp 0x180012448
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x4c]
call fcn.18001bf10
test eax, eax
jne 0x18001243a
mov r8d, dword [rsp + 0x28]
cmp r8d, ebx
je 0x18001243a
lea ecx, [rax + 1]
xor edx, edx
call qword [0x1800303f0]
test rax, rax
je 0x18001243a
xor edx, edx
mov rcx, rax
call qword [0x1800303f8]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [0x1800304e8]
test eax, eax
jne 0x1800123ff
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180012970
mov rbx, qword [rsp + 0x180]
add rsp, 0x170
pop rdi
ret
Function at 0x180013a6b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x18002b028]
jne 0x18001298a
rol rcx, 0x10
test cx, 0xffff
jne 0x180012986
repz ret
ror rcx, 0x10
jmp 0x1800139c4
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18002da20]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x18002db18]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180013a49
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18002da20]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180013a6b
mov rax, qword [rsp + 0x88]
mov qword [0x18002db18], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18002dab8], rax
mov rax, qword [0x18002db18]
mov qword [0x18002d990], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18002daa0], rax
mov dword [0x18002d980], 0xc0000409
mov dword [0x18002d984], 1
mov rax, qword [0x18002b028]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18002b030]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18002da18], eax
mov ecx, 1
call fcn.180017b80
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x180023488]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18002da18], 0
jne 0x180013af2
mov ecx, 1
call fcn.180017b80
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x180013f94
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x180013e08
Function at 0x180018238
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.180015a70
xor ebx, ebx
mov rdi, rax
cmp qword [0x18002e690], rbx
jne 0x18001833e
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x180018413
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180018413
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x18002e690], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x18002e698], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x18002e6a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x18002e6b0], rax
test rax, rax
je 0x180018335
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x18002e6a8], rax
jmp 0x180018345
mov rax, qword [0x18002e6a8]
jmp 0x18001834c
mov rax, qword [0x18002e6a8]
mov r11, qword [0x18002e6b0]
cmp rax, rdi
je 0x1800183b4
cmp r11, rdi
je 0x1800183b4
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x18002e6b0]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x1800183b4
test rax, rax
je 0x1800183b4
call rsi
test rax, rax
je 0x1800183ae
lea rcx, [rsp + 0x88]
mov r9d, reloc.WS2_32.dll_inet_ntoa
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1800183ae
test byte [rsp + 0x38], 1
jne 0x1800183b4
bts ebp, 0x15
jmp 0x1800183f2
mov rcx, qword [0x18002e698]
cmp rcx, rdi
je 0x1800183f2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800183f2
call rax
mov rbx, rax
test rax, rax
je 0x1800183f2
mov rcx, qword [0x18002e6a0]
cmp rcx, rdi
je 0x1800183f2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800183f2
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x18002e690]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x180018413
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x180018415
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140011267
Capabilities:
Terminate process

Disassembly:
jmp 0x140014460
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001130c
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400157b0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400157d0
xor al, al
jmp 0x140015851
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400157e3
xor al, al
jmp 0x140015851
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001580d
xor al, al
jmp 0x140015851
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015821
xor al, al
jmp 0x140015851
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015833
xor al, al
jmp 0x140015851
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001584f
xor al, al
jmp 0x140015851
mov al, 1
add rsp, 0x38
ret
Function at 0x140004020
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140004054
cmp word [rcx], 0x5a4d
jne 0x140004054
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140004054
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004054
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140003f60
test eax, eax
jne 0x140004070
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140003fd0
test rax, rax
je 0x140004065
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.140004819
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x140004720
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.1400046c0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140004b74
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x140561778]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x140561774]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x140004bc2
mov rdx, qword [rax]
cmp r12, rdx
jb 0x140004bba
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140004ca9
inc ebx
add rax, 0x28
jmp 0x140004b9a
mov rcx, r12
call fcn.1400053a1
mov rbp, rax
test rax, rax
jne 0x140004be1
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140004b10
movsxd rbx, ebx
mov rax, qword [0x140561778]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.14000544f
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x140561778]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140004c43
mov rax, qword [0x140561778]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140004b10
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140004ca3
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140004ca3
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x140561778]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140004ca3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140004b10
inc dword [0x140561774]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x1400050d0
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x1405617e0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1405617c0]
test rbx, rbx
je 0x14000511c
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140005116
test eax, eax
jne 0x140005116
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x1400050ee
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x1400052d0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x1400052f3
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x1400052f3
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x1400052f4
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x14000532e
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x140005325
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140005330
inc r8d
add rax, 0x28
jmp 0x14000530c
xor eax, eax
ret

Function at 0x1400053a1
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x14055d830]
mov r8, rcx
mov rcx, r9
call fcn.1400052d0
test eax, eax
je 0x1400053cd
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.1400052f4
xor eax, eax
add rsp, 0x28
ret
Function at 0x140003808
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rdi
sub rsp, 0x40
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rbx, rdx
mov rdi, rcx
cmp qword [rcx + 8], 0
je 0x14000385c
mov rcx, qword [rdx + 0x38]
test rcx, rcx
je 0x140003852
mov rax, qword [rcx]
cmp rcx, rdx
setne dl
mov rax, qword [rax + 0x20]
call qword [0x14000dbe8]
and qword [rbx + 0x38], 0
mov eax, 0x80070005
jmp 0x1400038f2
add rcx, 0x10
call fcn.1400039b0
and qword [rdi + 0x50], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
mov r9, rdi
lea r8, [0x140003940]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_CreateThread]
test rax, rax
jne 0x1400038cb
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1400038c7
mov r8, qword [rcx]
cmp rcx, rbx
setne dl
mov rax, qword [r8 + 0x20]
call qword [0x14000dbe8]
and qword [rbx + 0x38], 0
mov eax, edi
jmp 0x1400038f2
mov qword [rdi + 8], rax
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1400038f0
mov rax, qword [rcx]
cmp rcx, rbx
setne dl
mov rax, qword [rax + 0x20]
call qword [0x14000dbe8]
and qword [rbx + 0x38], 0
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140005160
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rdx
movabs r9, 0xcbf29ce484222325
mov rdx, rcx
xor r10d, r10d
movzx eax, byte [r10 + r8]
movabs rcx, 0x100000001b3
xor r9, rax
inc r10
imul r9, rcx
cmp r10, 0x10
jb 0x140005173
mov rcx, qword [rdx + 0x30]
and rcx, r9
mov r9, qword [rdx + 0x18]
mov rdx, qword [rdx + 8]
mov rax, rcx
add rax, rax
lea r10, [rcx + rcx]
mov rax, qword [r9 + rax*8]
cmp qword [r9 + r10*8], rdx
jne 0x1400051ba
mov rcx, rdx
jmp 0x1400051c2
mov rcx, qword [r9 + r10*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400051fc
mov rcx, qword [rax + 0x10]
cmp rcx, qword [r8]
jne 0x1400051da
mov rcx, qword [rax + 0x18]
cmp rcx, qword [r8 + 8]
je 0x1400051df
mov rax, qword [rax]
jmp 0x1400051af
mov rcx, qword [r8]
sub rcx, qword [rax + 0x10]
jne 0x1400051f0
mov rcx, qword [r8 + 8]
sub rcx, qword [rax + 0x18]
test rcx, rcx
cmovne rax, rdx
mov qword [r11], rax
jmp 0x1400051ff
mov qword [r11], rdx
mov rax, r11
ret