joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140059520
Capabilities:
Get file attributes
Map section object

Disassembly:
push rbp
push rdi
push r12
push r15
lea rbp, [rsp - 0x3f]
sub rsp, 0xf8
mov rax, qword [0x140155040]
xor rax, rsp
mov qword [rbp + 0x17], rax
xor r12b, r12b
mov qword [rbp - 0x49], rdx
mov rdi, r8
mov r15, rdx
test rdx, rdx
jne 0x14005959e
test rcx, rcx
jne 0x140059565
mov eax, 0xc0000030
jmp 0x140059769
mov dword [rsp + 0x30], 0x60
mov rdx, rcx
mov dword [rsp + 0x28], 1
lea rcx, [rbp - 0x49]
mov r8d, 0x100081
mov dword [rsp + 0x20], 5
call fcn.140076fe0
test eax, eax
js 0x140059769
mov r15, qword [rbp - 0x49]
mov r12b, 1
mov qword [rsp + 0x138], rbx
lea r8, [rbp - 1]
mov qword [rsp + 0xf0], rsi
lea rdx, [rbp - 0x49]
mov qword [rsp + 0xe8], r13
mov r9d, 0x18
mov rcx, r15
mov qword [rsp + 0xe0], r14
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
xor r13d, r13d
mov r14d, eax
test eax, eax
js 0x1400596b5
movups xmm0, xmmword ds:[rbp - 1]
mov qword [rsp + 0x30], r15
lea r9, [rbp - 0x61]
mov dword [rsp + 0x28], 0x8000000
lea r8, [rbp - 0x31]
movups xmmword [rbp - 0x49], xmm0
mov rax, qword [rbp - 0x41]
lea rcx, [rbp - 0x59]
xorps xmm0, xmm0
mov qword [rbp - 0x61], rax
mov edx, 5
mov dword [rbp - 0x31], 0x30
movdqu xmmword [rbp - 0x11], xmm0
mov qword [rbp - 0x29], r13
mov dword [rbp - 0x19], 0x20
mov qword [rbp - 0x21], r13
mov dword [rsp + 0x20], 2
call qword [sym.imp.ntdll.dll_NtCreateSection]
mov r14d, eax
test eax, eax
js 0x1400596b5
mov rax, qword [rbp - 0x61]
lea r8, [rbp - 0x51]
mov rcx, qword [rbp - 0x59]
xor r9d, r9d
mov dword [rsp + 0x48], 2
mov rdx, 0xffffffffffffffff
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], 2
mov qword [rbp - 0x69], rax
lea rax, [rbp - 0x69]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
mov qword [rbp - 0x51], r13
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov rcx, qword [rbp - 0x59]
mov r14d, eax
call qword [sym.imp.ntdll.dll_NtClose]
test r14d, r14d
js 0x1400596b5
mov rbx, qword [rbp - 0x51]
mov rsi, qword [rbp - 0x61]
jmp 0x1400596bd
mov rbx, qword [rbp - 0x69]
mov rsi, qword [rbp - 0x69]
nop dword [rax]
test r12b, r12b
je 0x1400596ce
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtClose]
test r14d, r14d
js 0x140059746
movzx eax, word [rbx]
mov ecx, 0x457f
mov word [rdi], ax
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rsi
cmp ax, cx
je 0x14005970c
mov ecx, 0x5a4d
cmp ax, cx
je 0x1400596fc
mov ebx, 0xc00001a3
jmp 0x140059724
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.1400593e0
jmp 0x14005971a
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.14007fe80
mov ebx, eax
test eax, eax
jns 0x140059742
cmp qword [rdi + 8], r13
je 0x140059742
lfence
mov rdx, qword [rdi + 8]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov qword [rdi + 8], r13
mov eax, ebx
jmp 0x140059749
mov eax, r14d
mov r13, qword [rsp + 0xe8]
mov rsi, qword [rsp + 0xf0]
mov rbx, qword [rsp + 0x138]
mov r14, qword [rsp + 0xe0]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1400c6a20
add rsp, 0xf8
pop r15
pop r12
pop rdi
pop rbp
ret
Function at 0x1400597a0
Capabilities:
Get file attributes
Map section object

Disassembly:
push rbp
push rbx
push rsi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov rax, qword [0x140155040]
xor rax, rsp
mov qword [rbp + 0x17], rax
xor sil, sil
mov qword [rbp - 0x51], rdx
mov r15, r9
mov r14, r8
mov rbx, rdx
test rdx, rdx
jne 0x14005982c
test rcx, rcx
jne 0x1400597e6
mov eax, 0xc0000030
jmp 0x140059958
mov dword [rsp + 0x38], 0x60
mov rdx, rcx
mov dword [rsp + 0x30], 1
lea rcx, [rbp - 0x51]
mov dword [rsp + 0x28], 5
mov r8d, 0x100081
mov dword [rsp + 0x20], 0x80
call fcn.140076e00
test eax, eax
jns 0x140059825
lfence
jmp 0x140059958
mov rbx, qword [rbp - 0x51]
mov sil, 1
mov r9d, 0x18
mov qword [rsp + 0xe8], rdi
lea r8, [rbp - 1]
mov dword [rsp + 0x20], 5
lea rdx, [rbp - 0x51]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov edi, eax
test eax, eax
js 0x140059940
movups xmm0, xmmword ds:[rbp - 1]
mov qword [rsp + 0x30], rbx
lea r9, [rbp - 0x69]
mov qword [rsp + 0xe0], r12
lea r8, [rbp - 0x31]
movups xmmword [rbp - 0x51], xmm0
mov rax, qword [rbp - 0x49]
lea rcx, [rbp - 0x61]
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x8000000
xor r12d, r12d
mov qword [rbp - 0x69], rax
mov edx, 5
mov dword [rbp - 0x31], 0x30
movdqu xmmword [rbp - 0x11], xmm0
mov qword [rbp - 0x29], r12
mov dword [rbp - 0x19], 0x20
mov qword [rbp - 0x21], r12
mov dword [rsp + 0x20], 2
call qword [sym.imp.ntdll.dll_NtCreateSection]
mov edi, eax
test eax, eax
js 0x140059938
mov rax, qword [rbp - 0x69]
lea r8, [rbp - 0x59]
mov rcx, qword [rbp - 0x61]
xor r9d, r9d
mov dword [rsp + 0x48], 2
mov rdx, 0xffffffffffffffff
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], 2
mov qword [rbp - 0x39], rax
lea rax, [rbp - 0x39]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov qword [rbp - 0x59], r12
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov rcx, qword ds:[rbp - 0x61]
mov edi, eax
call qword [sym.imp.ntdll.dll_NtClose]
test edi, edi
js 0x140059938
mov rax, qword [rbp - 0x59]
mov qword [r14], rax
mov rax, qword [rbp - 0x69]
mov qword [r15], rax
mov r12, qword [rsp + 0xe0]
test sil, sil
je 0x14005994e
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
mov rdi, qword [rsp + 0xe8]
mov rcx, qword ds:[rbp + 0x17]
xor rcx, rsp
call fcn.1400c6a20
add rsp, 0xf0
pop r15
pop r14
pop rsi
pop rbx
pop rbp
ret
Function at 0x14005c880
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r15, r8
mov r12, rdx
mov rbx, rcx
mov esi, 0xffffffff
mov r9d, esi
mov r10, qword [rcx + 8]
mov eax, 0x5a4d
cmp word [r10], ax
je 0x14005c8c5
mov eax, 0xc000012f
jmp 0x14005ca95
mov ecx, dword [r10 + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14005ca90
mov r11d, ecx
lea rax, [rcx + r10]
cmp dword [rax], 0x4550
jne 0x14005c916
add r10, 0x40
nop word [rax + rax]
cmp rax, r10
jb 0x14005c916
cmp dword [rax], 0x68636952
jne 0x14005c90b
mov r9d, eax
sub r9d, dword [rbx + 8]
mov dword [rsp + 0x20], r9d
jmp 0x14005c916
sub rax, 4
jmp 0x14005c8f0
nop word [rax + rax]
cmp r9d, 0xffffffff
je 0x14005ca89
mov r14d, r9d
mov rdx, qword [rbx + 8]
lea rcx, [r14 + rdx]
mov rax, qword [rbx + 0x10]
lea r8, [rcx + 8]
cmp r8, rcx
jb 0x14005ca77
cmp rcx, rdx
jb 0x14005ca77
add rax, rdx
cmp r8, rax
ja 0x14005ca77
mov r10d, dword [rcx + 4]
mov edi, dword [rcx]
test r10d, r10d
je 0x14005c99d
test edi, edi
je 0x14005c99d
lea rcx, [rdx + r11]
add rdx, 0x40
cmp rcx, rdx
jb 0x14005c99d
mov eax, r10d
xor eax, dword [rcx]
cmp eax, 0x536e6144
jne 0x14005c992
mov esi, ecx
sub esi, dword [rbx + 8]
mov dword [rsp + 0x24], esi
jmp 0x14005c99d
sub rcx, 4
jmp 0x14005c975
nop dword [rax]
cmp esi, 0xffffffff
je 0x14005ca89
mov rax, qword ds:[rbx + 8]
mov edx, esi
add rdx, rax
mov r8, qword [rbx + 0x10]
lea rcx, [rdx + 8]
cmp rcx, rdx
jb 0x14005ca69
cmp rdx, rax
jb 0x14005ca69
lea r9, [rax + r8]
cmp rcx, r9
ja 0x14005ca69
lea rcx, [rax + 8]
lea rcx, [rcx + r14]
lea r8, [rcx + 8]
cmp r8, rcx
jb 0x14005ca5a
cmp rcx, rax
jb 0x14005ca5a
cmp r8, r9
ja 0x14005ca5a
nop word [rax + rax]
cmp edi, 0x68636952
jne 0x14005ca53
mov eax, r10d
xor eax, dword [rdx]
cmp eax, 0x536e6144
jne 0x14005ca53
xor r8d, r8d
cmp rdx, rcx
jae 0x14005ca2a
sub rcx, rdx
lea r8, [rcx - 1]
shr r8, 3
inc r8d
mov dword [r12], esi
shr r10d, 5
mov eax, 0xaaaaaaab
mul r10d
shr edx, 1
lea eax, [rdx + rdx*2]
sub r10d, eax
lea eax, [r8 + r10]
lea eax, [rax + 1]
lea eax, [rsi + rax*8]
mov dword [r15], eax
xor eax, eax
jmp 0x14005ca95
mov eax, 0xc0000001
jmp 0x14005ca95
mov ecx, 0xc0000005
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
nop
jmp 0x14005ca95
mov ecx, 0xc0000005
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
nop
jmp 0x14005ca95
mov ecx, 0xc0000005
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
nop
jmp 0x14005ca95
mov eax, 0xc0000229
jmp 0x14005ca95
mov eax, 0xc000007b
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x140060380
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
xor eax, eax
mov rbx, rcx
cmp dword [0x140155b08], 0xffffffff
mov dword [rcx], eax
mov qword [rcx + 0x208], rax
mov qword [rcx + 0x210], rax
mov ecx, dword [0x14015967c]
jae 0x1400603c9
cmp ecx, 0x40
jae 0x1400603c9
mov rcx, qword gs:[0x30]
mov r8d, dword [0x14015967c]
mov rax, qword [rcx + r8*8 + 0x1480]
jmp 0x1400603d6
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r8d, dword [0x14015967c]
cmp dword [0x140155b08], 0xffffffff
mov qword [rbx + 0x218], rax
jae 0x140060409
cmp r8d, 0x40
jae 0x140060409
mov rcx, qword gs:[0x30]
mov eax, dword [0x14015967c]
mov qword [rcx + rax*8 + 0x1480], rbx
add rsp, 0x20
pop rbx
ret
mov rdx, rbx
mov ecx, r8d
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140060403
cmp dword [0x140155b08], 0xffffffff
jae 0x140060430
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
jmp 0x140060436
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140083420
nop dword [rax]
test eax, eax
jns 0x140060403
mov ecx, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3

Function at 0x140060460
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.140060560
cmp dword [0x140155b08], 0xffffffff
mov ecx, dword [0x14015967c]
jae 0x14006049e
nop dword [rax]
cmp ecx, 0x40
jae 0x14006049e
mov rdx, qword gs:[0x30]
mov ecx, dword [0x14015967c]
mov rax, qword [rdx + rcx*8 + 0x1480]
jmp 0x1400604ac
nop
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [0x14015967c]
cmp rax, rbx
jne 0x140060541
cmp dword [0x140155b08], 0xffffffff
mov rdx, qword [rbx + 0x218]
jae 0x1400604e3
cmp ecx, 0x40
jae 0x1400604e3
mov rcx, qword gs:[0x30]
mov eax, dword [0x14015967c]
mov qword [rcx + rax*8 + 0x1480], rdx
jmp 0x140060515
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140060515
cmp dword [0x140155b08], 0xffffffff
jae 0x140060504
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
jmp 0x14006050a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140083420
test eax, eax
js 0x140060541
mov r8, qword ds:[rbx + 0x210]
test r8, r8
je 0x14006053a
mov rcx, qword [0x140159238]
xor edx, edx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.ntdll.dll_RtlFreeHeap]
add rsp, 0x20
pop rbx
ret
mov ecx, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
Function at 0x140060660
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
cmp dword [0x140155b08], 0xffffffff
mov rdi, rcx
mov ecx, dword [0x14015967c]
jae 0x14006069b
nop dword [rax]
cmp ecx, 0x40
jae 0x14006069b
lfence
mov rdx, qword gs:[0x30]
mov rbx, qword [rdx + rcx*8 + 0x1480]
jmp 0x1400606a9
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rdi, rdi
jne 0x1400606bb
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, dword ds:[rbx]
cmp eax, 0x40
jae 0x1400606da
mov qword [rbx + rax*8 + 8], rdi
mov rax, rdi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 0x210]
mov qword [rsp + 0x30], rsi
mov rsi, qword [0x140159238]
test rcx, rcx
jne 0x14006071a
mov edx, 4
mov dword [rbx + 0x20c], 0x40
mov r8d, 0x200
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rcx, rax
mov qword [rbx + 0x210], rax
mov eax, dword [rbx + 0x20c]
cmp dword [rbx + 0x208], eax
jne 0x140060789
add eax, eax
mov r8d, eax
shl r8, 3
mov dword [rbx + 0x20c], eax
test r8, r8
jne 0x140060757
nop dword [rax]
test rcx, rcx
je 0x140060753
mov r8, rcx
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor ecx, ecx
jmp 0x140060782
mov edx, 4
test rcx, rcx
je 0x140060776
mov r9, r8
mov r8, rcx
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
jmp 0x14006077f
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rcx, rax
mov qword [rbx + 0x210], rcx
mov eax, dword [rbx + 0x208]
mov rsi, qword [rsp + 0x30]
mov qword [rcx + rax*8], rdi
mov rax, rdi
inc dword [rbx + 0x208]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140060b00
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0xe0
mov rax, qword [0x140155040]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rdx, qword [rsp + 0x120]
lea rax, [r11 - 0x80]
mov rcx, qword [rsp + 0x128]
xor r8d, r8d
movdqa xmm1, xmmword [0x140144620]
xorps xmm0, xmm0
mov rdi, qword [rsp + 0x130]
mov r9, 0xffffffffffffffff
mov rsi, qword [rsp + 0x138]
mov dword [rsp + 0x78], 0x30
mov qword [r11 - 0x28], rax
lea rax, [r11 - 0x40]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r8
mov dword [rsp + 0x30], r8d
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rdx
mov edx, 0x1fffff
mov qword [r11 - 0x68], r8
mov dword [r11 - 0x58], r8d
mov qword [r11 - 0x60], r8
mov qword [r11 - 0x20], r8
lea r8, [r11 - 0x70]
movups xmmword [rsp + 0x68], xmm0
mov qword [r11 - 0x40], 0x28
movdqu xmmword [r11 - 0x50], xmm0
movdqu xmmword [r11 - 0x38], xmm1
call qword [sym.imp.ntdll.dll_NtCreateThreadEx]
mov ebx, eax
test eax, eax
js 0x140060c05
mov rcx, qword [rsp + 0x60]
test rdi, rdi
je 0x140060beb
mov qword [rdi], rcx
jmp 0x140060bf6
test rcx, rcx
je 0x140060bf6
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
test rsi, rsi
je 0x140060c05
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rsi], xmm0
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400c6a20
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140063580
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [0x140155b08], 0xffffffff
jae 0x14006371b
mov rbx, qword gs:[0x30]
mov rax, qword gs:[0x30]
mov rsi, qword [rbx + 0x60]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x38]
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov rcx, qword [rsi + 0x78]
xor r8d, r8d
mov edx, 1
call qword [sym.imp.ntdll.dll_RtlFindClearBitsAndSet]
mov edi, eax
cmp eax, 0xffffffff
jne 0x140063689
nop dword [rax]
cmp qword [rbx + 0x1780], 0
jne 0x1400636c6
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x38]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov rax, qword gs:[0x30]
mov edx, 8
mov r8d, 0x2000
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword ds:[rbx + 0x1780], rax
test rax, rax
je 0x14006371b
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x38]
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov rcx, qword [rsi + 0x78]
xor r8d, r8d
mov edx, 1
call qword [sym.imp.ntdll.dll_RtlFindClearBitsAndSet]
mov edi, eax
cmp eax, 0xffffffff
je 0x1400635f0
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x38]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov eax, edi
mov qword [rbx + rax*8 + 0x1480], 0
mov eax, edi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rsi + 0x238]
xor r8d, r8d
mov edx, 1
call qword [sym.imp.ntdll.dll_RtlFindClearBitsAndSet]
mov rcx, qword gs:[0x30]
mov edi, eax
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x38]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
cmp edi, 0xffffffff
je 0x14006371b
mov rcx, qword [rbx + 0x1780]
lea eax, [rdi + 0x40]
mov qword [rcx + rdi*8], 0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]
add eax, 0x79abd6e0
cli
jns 0x14023bdfc
cmp ch, byte [rsi - 0x1bdfc7cf]
jno 0x14023be27
push rbx
add byte [rsi + 0x6a32335e], ch
scasb al, byte [rdi]
pop rsi
xor esi, dword [rdx]
push 0x4f
scasb al, byte [rdi]
pop rsi
xor esi, dword [rdx]
push 0x4f
invalid
invalid
xchg esp, eax
je 0x14023c2c3
invalid
test eax, ebp
scasd eax, dword [rdi]
jno 0x14023c2a1
popfq
lea edx, [0xdaeb9e2c]
sbb dh, dh
sahf
sbb edx, dword [rdi - 0x63a117d9]
xchg edi, eax
invalid
call 0xdb6c5f33
jl 0x14023c311
test al, 0xac
ja 0x14023c329
int1
mov eax, 0x4a8c0f5b
or ch, byte [rdx - 0x4d62362]
stosb byte [rdi], al
sahf
fsubr qword [rcx]
sti
wait
Function at 0x14006c1c0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov rbp, qword [0x1401590f8]
mov rax, rdx
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0xa8], rbp
test byte [rbp + 0x20], 1
je 0x14006c202
mov rdx, qword ss:[rbp + 0x18]
jmp 0x14006c209
mov rdx, 0xffffffffffffffff
mov ebx, 2
mov qword [rsp + 0x90], rbx
test rax, rax
je 0x14006c23d
nop dword [rax + rax]
test rdx, rdx
je 0x14006c23d
lea rcx, [rsp + 0x98]
mov r8d, ebx
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140098240
lea rax, [rsp + 0x98]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 4
call fcn.140098240
lea r12, [0x140156c30]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r13, qword [rcx + 0x18]
add r13, 0x10
mov r15, qword [r13]
cmp r15, r13
je 0x14006c43b
nop dword [rax]
movzx eax, word [r15 + 0x58]
mov rbx, qword [r15 + 0x60]
test r12, r12
je 0x14006c346
mov rsi, qword [r12]
cmp rax, rsi
jb 0x14006c40b
mov r14, qword [r12 + 8]
mov rcx, rsi
shr rcx, 4
test rcx, rcx
je 0x14006c2fa
movdqu xmm0, xmmword [rbx]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14006c3f9
add rbx, 0x10
add r14, 0x10
sub rcx, 1
jne 0x14006c2d0
shr rsi, 1
and esi, 7
test rsi, rsi
je 0x14006c346
sub r14, rbx
nop dword [rax + rax]
movzx ecx, word [rbx]
movzx ebp, word [r14 + rbx]
cmp cx, bp
je 0x14006c33b
nop dword [rax]
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, bp
movzx edi, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp di, ax
jne 0x14006c40b
add rbx, 2
sub rsi, 1
jne 0x14006c310
test r15, r15
je 0x14006c433
movzx eax, word [r15 + 0x48]
lea rcx, [rsp + 0x30]
mov rdi, qword [r15 + 0x30]
mov esi, dword [r15 + 0x40]
mov qword [rsp + 0x30], rax
mov rax, qword [r15 + 0x50]
mov qword [rsp + 0x38], rax
call fcn.140075f80
mov rcx, qword gs:[0x30]
mov rbx, rax
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x110]
test rax, rax
je 0x14006c42b
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov rcx, qword [rsp + 0xa8]
mov r9d, esi
mov r8, rdi
mov rdx, rbx
call fcn.14006bc40
lea rcx, ds:[rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14006c3ca
call fcn.1400602c0
mov rbx, qword [rsp + 0x90]
add r12, 0x10
sub rbx, 1
mov qword [rsp + 0x90], rbx
jne 0x14006c260
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
and esi, 0xf
shl rcx, 4
add rsi, rcx
shr rsi, 1
jmp 0x14006c300
mov r15, qword [r15]
cmp r15, r13
jne 0x14006c2a0
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
jmp 0x14006c3ca
mov rbx, qword [rsp + 0x90]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
jmp 0x14006c3d2
Function at 0x14006ed40
Capabilities:
Access peb ldr_data

Disassembly:
push rbx
sub rsp, 0x20
mov eax, edx
mov ebx, ecx
test edx, edx
jne 0x14006ed96
cmp ecx, 0xc0000022
je 0x14006ed7c
cmp ecx, 0xc0000005
je 0x14006ed7c
mov eax, ecx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x14006ed71
movzx eax, bx
jmp 0x14006ed86
cmp eax, 0xb0000
jne 0x14006ed8a
mov eax, ebx
jmp 0x14006ed86
nop dword [rax]
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x14006ed96
mov ecx, ebx
add rsp, 0x20
pop rbx
jmp fcn.14006e580
mov ecx, eax
add rsp, 0x20
pop rbx
jmp fcn.14006e860

Function at 0x140070a60
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
sub rsp, 0x18
cmp qword [0x140159750], 0
mov r9, rcx
je 0x140070a81
movups xmm0, xmmword [0x140159748]
movups xmmword ds:[rcx], xmm0
add rsp, 0x18
ret
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
cmp qword [rcx + 0x90], 0
je 0x140070acb
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x90]
cmp dword [rax], 0
je 0x140070acb
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r8, qword [rcx + 0x90]
add r8, 0x1e
jmp 0x140070ad1
mov r8d, 0x7ffe0030
mov rdx, r8
mov qword [rsp + 8], r8
and rdx, 0xfffffffffffffff1
mov ecx, r8d
xorps xmm1, xmm1
and ecx, 0xf
je 0x140070b09
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rsp + 0x28], ecx
je 0x140070b05
mov edx, ecx
shr rdx, 1
jmp 0x140070b47
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x28], ecx
jne 0x140070b39
nop dword [rax]
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x28], ecx
je 0x140070b20
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
add rdx, rdx
mov qword [rsp], rdx
cmp word [rdx + r8 - 2], 0x5c
jne 0x140070b5f
lea rax, [rdx - 2]
mov qword [rsp], rax
movups xmm0, xmmword [rsp]
lea rax, [rdx - 2]
cmovne rax, rdx
movups xmmword [r9], xmm0
mov qword [0x140159748], rax
lock or dword [rsp], 0
mov qword [0x140159750], r8
add rsp, 0x18
ret
Function at 0x140072240
Capabilities:
Hash data using sha1
Hash data using sha256

Disassembly:
sub rsp, 0x28
mov dword [rcx], edx
test edx, edx
je 0x1400722e4
sub edx, 1
je 0x1400722b6
sub edx, 1
je 0x1400722ac
cmp edx, 1
je 0x140072269
mov ecx, 0xc00000f0
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
xor eax, eax
mov dword [rcx + 0xc], 0x6a09e667
mov dword [rcx + 0x10], 0xbb67ae85
mov dword [rcx + 0x14], 0x3c6ef372
mov dword [rcx + 0x18], 0xa54ff53a
mov dword [rcx + 0x1c], 0x510e527f
mov dword [rcx + 0x20], 0x9b05688c
mov dword [rcx + 0x24], 0x1f83d9ab
mov dword [rcx + 0x28], 0x5be0cd19
mov qword [rcx + 4], rax
add rsp, 0x28
ret
xor eax, eax
mov dword [rcx + 4], eax
add rsp, 0x28
ret
xor eax, eax
mov dword [rcx + 0x1c], 0x67452301
mov qword [rcx + 0x30], rax
mov dword [rcx + 0x20], 0xefcdab89
mov dword [rcx + 0x24], 0x98badcfe
mov dword [rcx + 0x28], 0x10325476
mov dword [rcx + 0x2c], 0xc3d2e1f0
add rsp, 0x28
ret
xor eax, eax
mov dword [rcx + 0xc], 0x67452301
mov dword [rcx + 0x10], 0xefcdab89
mov dword [rcx + 0x14], 0x98badcfe
mov dword [rcx + 0x18], 0x10325476
mov qword [rcx + 4], rax
add rsp, 0x28
ret

Function at 0x140072320
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x28
mov r9d, dword [rcx]
mov r10, rdx
mov r11, rcx
test r9d, r9d
je 0x1400723b5
sub r9d, 1
je 0x1400723a8
nop dword [rax]
sub r9d, 1
je 0x140072365
cmp r9d, 1
je 0x140072358
mov ecx, 0xc000000d
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
add rcx, 4
add rsp, 0x28
jmp fcn.1400b53e0
mov edx, dword [rcx + 4]
mov r8d, r8d
not edx
test r8, r8
je 0x14007239d
lea r9, [0x140140b80]
nop dword [rax]
movsx ecx, byte [r10]
lea r10, [r10 + 1]
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
xor edx, dword [r9 + rax*4]
sub r8, 1
jne 0x140072380
not edx
mov dword [r11 + 4], edx
add rsp, 0x28
ret
add rcx, 4
add rsp, 0x28
jmp fcn.1400b72e0
add rcx, 4
add rsp, 0x28
jmp fcn.1400b5740