joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004060
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [0x14001c580]
mov rax, qword [rsi]
test rax, rax
je 0x1400040f0
cmp qword [rax + 0x30], 0
jne 0x140004110
lea rbx, [0x14001a088]
mov qword [rax + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx], eax
mov rax, qword [rsi]
test rax, rax
je 0x1400040c0
cmp qword [rax + 0x30], 0
jne 0x1400040e0
lea rdx, [0x14001a088]
mov qword [rax + 0x30], rdx
mov rax, rdx
cmp dword [rax], 0xffffffff
je 0x140019320
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.140008f60
mov r8, rax
mov rax, qword [rsi]
cmp qword [r8 + 0x30], 0
je 0x1400040a2
test rax, rax
jne 0x1400040e0
call fcn.140008f60
nop dword [rax]
mov rax, qword [rax + 0x30]
jmp 0x1400040b0
call fcn.140008f60
cmp qword [rax + 0x30], 0
mov rax, qword [rsi]
je 0x140004080
test rax, rax
jne 0x140004110
call fcn.140008f60
nop dword [rax]
mov rbx, qword [rax + 0x30]
jmp 0x14000408b
call fcn.140018bc8
nop
call fcn.140018bc8
nop
mov rax, qword [pe_dos_header]
ud2

Function at 0x140004120
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x98
movabs rax, 0x6c6320726f727245
movabs rdx, 0x7520676e696e6165
mov qword [rsp + 0x20], rax
movabs rax, 0x6b5f6e6970732070
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20726f6620737965
mov qword [rsp + 0x30], rax
movabs rax, 0x20646165726874
mov qword [rsp + 0x38], rdx
xor edx, edx
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov word [rsp + 0x88], ax
mov byte [rsp + 0x8a], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x47]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x140004232
mov eax, 0x28
lea rcx, [rsp + 0x20]
jmp 0x14000420a
add rax, 1
cmp rax, 0x6b
je 0x140004227
cmp byte [rcx + rax], 0
movsxd rdx, eax
jne 0x140004200
cmp edx, 0x6a
je 0x140004227
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rdx + 0x20], 0xa
mov byte [rsp + rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call fcn.140018bc8
mov eax, 0x28
mov edx, 0x27
lea rcx, [rsp + 0x20]
jmp 0x14000421b
Function at 0x140004c40
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, qword [0x14001c580]
mov rax, qword [rsi]
test rax, rax
je 0x140004e30
cmp qword [rax + 0x28], 0
jne 0x140004e18
lea rcx, [0x14001f1d8]
cmp dword [rcx], 1
mov qword [rax + 0x28], rcx
je 0x140004e25
call fcn.140004250
mov rax, qword [rsi]
test rax, rax
je 0x140004cc0
cmp qword [rax + 0x30], 0
jne 0x140004ce0
lea rdx, [0x14001a088]
mov qword [rax + 0x30], rdx
mov rax, rdx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x140004cf4
mov rax, r12
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call fcn.140008f60
cmp qword [rax + 0x30], 0
mov rax, qword [rsi]
je 0x140004c90
test rax, rax
jne 0x140004ce0
call fcn.140008f60
nop dword [rax]
mov rax, qword [rax + 0x30]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
jne 0x140004cae
call fcn.140003d90
cmp qword [0x140022050], 0
mov rbx, rax
je 0x140004cae
test rax, rax
je 0x140004cae
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rbx + 0x70], eax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x38], 0xffffffffffffffff
lea rcx, [rbx + 0x68]
mov qword [rbx + 0x30], rax
call fcn.14000ae00
cmp eax, 1
je 0x140004e9d
pop rbp
call fcn.1401d2d1b
jrcxz 0x140004d9c
mov dword [rbx + 0x68], 0xffffffff
mov dword [rbx + 0xb8], 0
mov qword [rbx + 0x28], 0
call rbp
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r12, rax
call rbp
mov dword [rsp + 0x30], 2
mov r8, rdi
mov rdx, r12
mov dword [rsp + 0x28], 0
mov rcx, rax
lea r9, [rbx + 0x28]
mov dword [rsp + 0x20], 0
and al, 0x20
add byte [rax], al
add byte [rax], al
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x140019326
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0xc0], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
mov rax, qword [rsi]
test rax, rax
je 0x140004e78
cmp qword [rax + 0x30], 0
je 0x140004e60
mov rax, qword [rax + 0x30]
mov ecx, dword [rax]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140019326
mov r12, rbx
mov rax, r12
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rax + 0x28]
cmp dword [rcx], 1
jne 0x140004c7c
mov rax, qword [rsi]
jmp 0x140004c89
call fcn.140008f60
cmp qword [rax + 0x28], 0
mov rax, qword [rsi]
je 0x140004c68
test rax, rax
jne 0x140004e18
call fcn.140008f60
mov rcx, qword [rax + 0x28]
cmp dword [rcx], 1
jne 0x140004c7c
jmp 0x140004c81
lea rdx, [0x14001a088]
mov qword [rax + 0x30], rdx
mov rax, rdx
jmp 0x140004dee
call fcn.140008f60
mov r8, rax
mov rax, qword [rsi]
cmp qword [r8 + 0x30], 0
je 0x140004e60
test rax, rax
jne 0x140004dea
call fcn.140008f60
jmp 0x140004dea
call fcn.140004120
nop word cs:[rax + rax]
nop dword [rax]
mov rax, qword [0x14001c580]
mov rdx, qword [rax]
lea rax, [0x14001f1e8]
mov qword [rdx + 0x10], rax
ret
Function at 0x140008f60
Capabilities:
Check mutex on windows

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [0x14001f2c0]
mov dword [rsp + 0x2c], eax
lea rcx, [rsp + 0x2c]
lea r9, [rsp + 0x30]
movzx eax, byte [rcx]
add rcx, 1
add rdx, 2
mov r8d, eax
and eax, 0xf
shr r8b, 4
add eax, 0x61
add r8d, 0x41
mov byte [rdx - 1], al
mov byte [rdx - 2], r8b
cmp rcx, r9
jne 0x140008f83
lea rax, [0x14001f2c8]
mov ecx, 0x5f
lea rdx, str.__shmem3_winpthreads_tdm_
lea r8, [rax + 0x1a]
jmp 0x140008fcb
movzx ecx, byte [rdx]
add rax, 1
add rdx, 1
mov byte [rax - 1], cl
cmp rax, r8
jne 0x140008fc8
lea rax, [0x14001f300]
mov ecx, 0x5f
lea rdx, str.__shmem3_winpthreads_tdm_
lea r8, [rax + 0x19]
jmp 0x140008ffb
movzx ecx, byte [rdx]
add rax, 1
add rdx, 1
mov byte [rax - 1], cl
cmp rax, r8
jne 0x140008ff8
xor ecx, ecx
mov byte [0x14001f319], 0x2d
movabs rax, 0x6161616161616161
movabs rdx, 0x6161616161616161
mov qword [0x14001f322], rdx
lea r8, [0x14001f2c0]
lea rbx, [0x14001f31a]
mov qword [0x14001f332], rdx
mov qword [0x14001f342], rdx
mov qword [0x14001f352], rdx
xor edx, edx
mov qword [0x14001f31a], rax
mov qword [0x14001f32a], rax
mov qword [0x14001f33a], rax
mov qword [0x14001f34a], rax
mov byte [0x14001f35a], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, 0xffffffff
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1400091d6
lea rcx, [0x14001f300]
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x140009121
lea rsi, [0x14001f200]
lea r8, [0x14001f35a]
mov rax, rbx
lea ecx, [rbx + 0x40]
nop dword [rax]
mov edx, ecx
sub edx, eax
bt rsi, rdx
jae 0x1400090cd
mov byte [rax], 0x41
add rax, 1
cmp r8, rax
jne 0x1400090c0
lea rcx, [0x14001f300]
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
je 0x1400091c3
lea rcx, [0x140008e70]
mov qword [0x14001f200], rsi
call sub.msvcrt.dll__onexit
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x14001f200]
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
mov r8d, 0x5b
lea rdx, [0x14001f300]
movzx ecx, ax
call qword [sym.imp.KERNEL32.dll_GetAtomNameA]
lea r8, [0x14001f35a]
xor edx, edx
lea r10d, [rbx + 0x40]
mov r11d, eax
mov r9d, 1
mov rax, rbx
test r11d, r11d
je 0x1400091f6
nop dword [rax]
cmp byte [rax], 0x41
jne 0x140009173
mov ecx, r10d
mov rbx, r9
sub ecx, eax
shl rbx, cl
or rdx, rbx
add rax, 1
cmp r8, rax
jne 0x140009160
mov rax, rdx
mov qword [0x14001f200], rax
lea rsi, [0x14001f200]
jmp 0x140009199
cmp rdx, rsi
je 0x1400090ff
mov rdx, rax
mov rax, qword [rax + 8]
test rax, rax
jne 0x140009190
cmp rdx, rsi
je 0x1400090ff
mov qword [rdx + 8], rsi
lea rcx, [0x140008e70]
call sub.msvcrt.dll__onexit
jmp 0x1400090ff
lea rcx, str.failed_to_add_string_to_atom_table_n
call fcn.140008de0
xor eax, eax
jmp 0x140009118
lea rcx, str.failed_to_to_lock_creation_mutex_n
call fcn.140008de0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
lea rcx, str.failed_to_get_string_from_atom_n
call fcn.140008de0
xor eax, eax
jmp 0x14000917f
Function at 0x140024750
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], 0x42f7423f
push r10
movabs r10, 0x79e57e7918c95562
push rsi
movabs rsi, 0x2a6506a944295473
pushfq
movabs r12, 0x6fb727f80ce972a9
mov r12, qword [rsp + 0x20]
xor rsi, 0x59c1652e
and si, 0x5aef
jb 0x140024765
or esi, 0x1ad6067a
mov r10, qword [rsp + 0x10]
lea rsi, [rsi + 0x4dd048a8]
setbe sil
setno sil
sub rsi, rsi
lea rsi, [rsi + rsi*2 + 0x6fb41b23]
not esi
mov rsi, qword [rsp + 8]
push qword [rsp]
popfq
lea rsp, [rsp + 0x30]
call fcn.1402440ba

Function at 0x140029e93
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], 0xffffffff8c6c091e
add qword [rsp], 0xffffffffbffc3260
push r11
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.1403601b6

Function at 0x14002c550
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbp, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14002c57c
xor al, al
jmp 0x14002c6a0
movdqa xmm0, xmmword [0x14004cae0]
movdqa xmm1, xmmword [0x14004caf0]
mov rax, qword [r9]
xor r11d, r11d
mov qword [rsp + 0x50], r12
mov rcx, r8
movdqa xmmword [rsp], xmm0
movdqa xmm0, xmmword [0x14004cb00]
movdqa xmmword [rsp + 0x10], xmm1
lea r12, [r8 + rax]
mov edx, r11d
movdqa xmm1, xmmword [0x14004cb10]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmmword [rsp + 0x30], xmm1
test rbx, rbx
je 0x14002c692
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x14002c5f9
mov r11d, 2
jmp 0x14002c61d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x14002c613
mov r11d, 1
jmp 0x14002c61d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, r12
ja 0x14002c6b5
mov eax, r10d
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov eax, r10d
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14002c65a
mov byte [rcx + 2], 0x3d
jmp 0x14002c66a
shr r10, 6
and r10d, 0x3f
movzx eax, byte [rsp + r10]
mov byte [rcx + 2], al
add rcx, 3
add r8, 3
test r11, r11
je 0x14002c67c
mov byte [rcx], 0x3d
jmp 0x14002c683
movzx eax, byte [rsp + r9]
mov byte [rcx], al
inc rcx
inc r8
cmp rdx, rbx
jb 0x14002c5e0
sub rcx, rsi
mov al, 1
mov qword [rbp], rcx
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
xor al, al
jmp 0x14002c69b

Function at 0x14002ebba
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp + 0x18], 0xf265
xchg qword [rsp + rsi - 0x3023ff97], rax
neg qword [rsp + 0x40]
push rbx
jb 0x1401f78d0
push rdx
pushfq
movabs rdx, 0x3d2a19265c5b4cb1
push r15
mov rdx, qword [rsp + 0x10]
mov qword [rsp + 0x10], 0xffffffffbff0f892
movabs r15, 0x2ec7012a4dfc5a01
lea r15, [r15 + r15*2 + 0x482d5c38]
xor r15d, 0x79da546a
and r15, 0x6d36496f
test r15, 0x35a206a9
jbe 0x14002ec05
mov r15, qword [rsp]
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
call fcn.1402d3ca0
Function at 0x1400387b0
Capabilities:
Encode data using xor

Disassembly:
push r9
pushfq
movabs r9, 0x234e2de25e59050c
mov qword [rsp + 0x10], 0xffffffffc2f0d7f2
mov r9b, 0xb8
xor r9w, 0x4a51
not r9w
neg r9w
mov r9, qword [rsp + 8]
jo 0x1400387b2
call fcn.140026808

Function at 0x1400ff00a
Capabilities:
Encode data using xor

Disassembly:
mov rbp, rcx
lea rbp, [rbp + 0xcfc73c3]
mov rbp, qword [rsp + 0x20]
lea rcx, [rcx*2 + 0x38440f47]
movsx ecx, cl
lea rcx, [rcx*8 + 0x35d37e93]
not cl
call fcn.140048ab5
mov bh, 0x4b
fisttp word [rax]
idiv esi
insd dword [rdi], dx
add eax, 0xfe0f3d55
mov ecx, 0x42b61e0
pop rsi
rcr ecx, 1
add rax, 0xfffffffffe94194e
mov ecx, 0xbac0092a
cli
out 2, al
pop rbp
cld
xchg r11d, eax
rcr byte [rbx + rbx*2 + 0x28f97b05], 1
clc
mov ecx, 0xbad76448
cli
xor al, 0x8d
cmpsb byte [rsi], byte [rdi]
cli
mov bl, 0x52
je 0x1400ff02e
cli
mov ecx, esi
invalid

Function at 0x14010f5c5
Capabilities:
Encode data using xor

Disassembly:
xchg ebx, eax
invalid
cmp byte [0x10071cc85], cl
xor edx, r12d
mov edi, 0x8dc3f749
jle 0x14010f56d
jbe 0x14010f5f8
mov dword [rsp + 0xa8], ebx
lea rdx, [r10 + rdx*2 + 0x39c74592]
mov rdx, qword [rsp + 0x48]
call fcn.14019b953
and dword [rsp + 0x70], r13d
mov dl, byte [rsp + 0x58]
not r13
mov r13, qword [rsp + 0x60]
xor byte [rsp + 0x58], 0x32
xor edx, edx
cmovle dx, word [rsp + 0x73]
mov rdx, qword [rsp + 0x68]
call fcn.1400adf01
js 0x14010f59a
int 0x7c
mov eax, dword [rax + 0x1f]
jmp [rbx]
loopne 0x14010f626
invalid
invalid

Function at 0x140155e12
Capabilities:
Encode data using xor

Disassembly:
movabs rdx, 0x9625902253576d3
push r12
mov r12, rdx
lea rax, [rax + 2]
bswap r12
pushfq
or dl, 0xd4
add qword [rsp + 0x28], 0xfffffffffff6c133
or rdx, 0x505f55a5
mov dl, dh
not r12b
add r12, r12
mov qword [rsp + 0x38], rax
sub r12, rdx
xor r12w, dx
movabs rdx, 0x7a1240ba6b192ee7
push r12
jb 0x1401cbdf4
push r10
nop
bswap edx
not r12
mov r10, rdx
push rdx
call fcn.14012a148

Function at 0x140157543
Capabilities:
Encode data using xor

Disassembly:
test r11w, di
mov qword [rsp + 0x18], r11
push rbx
call int.1400368b4

Function at 0x1401aac93
Capabilities:
Resume thread

Disassembly:
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [r12 + 0x44], 4
jne 0x1400082b0
mov qword [r12 + 0x28], r13
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
call qword [0x14002057c]
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov qword [r12 + 0x28], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000827f
not byte [rsp + 0x48]
jle 0x140008263
neg byte [rsp + 0x48]
cmp qword [rsp + 0x48], 0x4e7a49b8
call fcn.14002dec1
adc al, 0xf0
in eax, 0xbf
xor al, 0x51
cli
push rbp
test eax, 0xbc239750
enter 0x19bc, 0x4d
or cl, cl
cmp dword [rsi + 0x69], esi
or byte [rdi], ah
cmc
movabs al, byte [0xcf352149bc6758cf]
xor eax, 0x58da3b4
pop rdi
adc bl, dh
out 0x9e, al
faddp st(1)
cmp dword [rbx - 0x5f], eax
adc al, ch
xlatb
pop rcx
xor byte [rcx - 0x30e1130a], cl
invalid
Function at 0x1401d98e0
Capabilities:
Encode data using xor

Disassembly:
mov r8, qword [rsp + 0x10]
test r8w, r9w
call fcn.1400b3494
Function at 0x1400020b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov eax, dword [rcx + 0x48]
lea rbx, [rcx + 0x28]
mov rsi, qword [rcx]
lea r11, [rcx + 0x28]
add rbx, rax
mov rdi, rcx
movabs rbp, 0x9e3779b185ebca87
movabs r15, 0x27d4eb2f165667c5
movabs r14, 0xc2b2ae3d27d4eb4f
movabs r12, 0x7a1435883d4d519d
cmp rsi, 0x20
jb 0x1400021ab
mov rcx, qword [rcx + 8]
mov r8, qword [rdi + 0x18]
mov r9, qword [rdi + 0x20]
mov rax, r8
mov rdx, qword [rdi + 0x10]
mov r10, r9
rol r10, 0x12
rol rax, 0xc
add r10, rax
mov rax, rdx
rol rax, 7
add r10, rax
mov rax, rcx
rol rax, 1
add r10, rax
movabs rax, 0x85ebca77c2b2ae63
imul rcx, r14
imul rdx, r14
imul r8, r14
imul r9, r14
rol rcx, 0x1f
imul rcx, rbp
rol rdx, 0x1f
xor r10, rcx
rol r8, 0x1f
imul r10, rbp
imul rdx, rbp
imul r8, rbp
sub r10, r12
rol r9, 0x1f
xor r10, rdx
imul r10, rbp
imul r9, rbp
sub r10, r12
xor r10, r8
imul r10, rbp
sub r10, r12
xor r10, r9
imul r10, rbp
add rax, r10
add rax, rsi
jmp 0x1400021b3
lea rax, [rsi + r15]
add rax, qword [rcx + 0x18]
lea rdx, [rdi + 0x30]
cmp rdx, rbx
ja 0x1400021ea
nop dword [rax]
mov rcx, qword [r11]
add rdx, 8
imul rcx, r14
add r11, 8
rol rcx, 0x1f
imul rcx, rbp
xor rax, rcx
rol rax, 0x1b
imul rax, rbp
sub rax, r12
cmp rdx, rbx
jbe 0x1400021c0
lea rdx, [r11 + 4]
movabs r8, 0x165667b19e3779f9
cmp rdx, rbx
ja 0x140002215
mov ecx, dword [r11]
mov r11, rdx
imul rcx, rbp
xor rax, rcx
rol rax, 0x17
imul rax, r14
add rax, r8
cmp r11, rbx
jae 0x14000223b
nop word [rax + rax]
movzx ecx, byte [r11]
inc r11
imul rcx, r15
xor rax, rcx
rol rax, 0xb
imul rax, rbp
cmp r11, rbx
jb 0x140002220
mov rbx, qword [rsp + 0x20]
mov rcx, rax
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
shr rcx, 0x21
xor rcx, rax
imul rcx, r14
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
pop r12
ret

Function at 0x14000a3e0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x14002e008]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, r8
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000a425
xor al, al
jmp 0x14000a472
cmp word [rbx], 0
je 0x14000a43d
nop dword [rax + rax]
add rbx, 2
dec rdi
cmp word [rbx], 0
jne 0x14000a430
cmp word [rsp + 0x30], 0
je 0x14000a46b
lea rcx, [rsp + 0x30]
sub rcx, rbx
nop dword [rax]
cmp rdi, 1
jb 0x14000a493
movzx eax, word [rcx + rbx]
dec rdi
mov word [rbx], ax
add rbx, 2
cmp word [rcx + rbx], 0
jne 0x14000a450
xor eax, eax
mov word [rbx], ax
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000b4d0
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
call fcn.14000f5a4
int3
Function at 0x14000a980
Capabilities:
Read file on windows

Disassembly:
test rdx, rdx
je 0x14000ab0c
push rbp
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x60], r14
xor sil, sil
xor r14d, r14d
mov qword [rsp + 0x50], rbx
mov rdi, rdx
mov rbp, rcx
nop word [rax + rax]
mov rax, qword [0x1400365d8]
mov rcx, qword [0x1400365e0]
sub rax, rcx
je 0x14000a9f4
mov rdx, qword [0x1400365d0]
cmp rdi, rax
mov rbx, rdi
cmovae rbx, rax
add rdx, rcx
mov r8, rbx
mov rcx, rbp
call fcn.14000d370
add rbp, rbx
sub rdi, rbx
add qword [0x1400365e0], rbx
jmp 0x14000aaf2
mov rax, qword [0x1400345c0]
mov rcx, qword [0x1400345b8]
cmp rax, rcx
jb 0x14000aaa0
test sil, sil
jne 0x14000aaa0
cmp rcx, rax
jne 0x14000ab0d
mov rcx, qword [0x1400345c8]
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, qword [0x1400365e8]
mov eax, eax
sub rcx, rax
je 0x14000aaf2
mov rdx, qword [0x1400345b0]
lea r9, [rsp + 0x58]
mov ebx, 0x20003
mov qword [rsp + 0x20], r14
cmp rcx, rbx
cmovb rbx, rcx
mov rcx, qword [0x1400345c8]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000ab13
mov eax, dword [rsp + 0x58]
cmp rax, rbx
jne 0x14000ab13
add qword [0x140034590], rbx
mov qword [0x1400345c0], r14
mov qword [0x1400345b8], rbx
jmp 0x14000aaf2
mov rcx, qword [0x1400345a8]
lea r8, [0x1400345b0]
lea rdx, [0x1400365d0]
mov qword [0x1400365e0], r14
mov qword [0x1400365d8], 0x20000
call fcn.140006fb0
mov rcx, qword [0x1400365e0]
cmp rcx, qword [0x1400365d8]
sete sil
cmp rax, 0xffffffffffffff88
ja 0x14000ab0d
mov qword [0x1400365d8], rcx
mov qword [0x1400365e0], r14
test rdi, rdi
jne 0x14000a9b0
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
call fcn.14000a880
int3
call fcn.14000a8c0
int3

Function at 0x14000ab20
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x80
mov rcx, qword [0x1400345a0]
xor ebx, ebx
test rcx, rcx
je 0x14000abb5
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
test eax, eax
jne 0x14000ab96
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], rbx
xor edx, edx
mov r8d, eax
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x90]
mov r9d, 0x400
mov ecx, 0x1300
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
lea rcx, str.Failed_to_send_CTRL_C_to_child_process.
call fcn.14000fc44
mov rcx, qword [rsp + 0x90]
call fcn.14000fc44
mov rcx, qword [0x1400345a0]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x1400345a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x1400365f0], bl
je 0x14000ac05
lea rax, [0x1400345d0]
mov qword [rsp + 0x40], rbx
lea rcx, [0x1400298c0]
mov qword [rsp + 0x50], rax
mov eax, 0x414
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x70], rcx
lea rcx, [rsp + 0x40]
mov word [rsp + 0x60], ax
mov dword [rsp + 0x48], 3
mov dword [rsp + 0x64], ebx
mov qword [rsp + 0x68], rbx
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
add rsp, 0x80
pop rbx
ret
Function at 0x14000bda4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000bdee
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000bdee
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000bdee
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000bdee
cmp dword [rcx + 0x84], 0xe
jbe 0x14000bdee
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000bdf0
xor al, al
add rsp, 0x28
ret

Function at 0x14000f598
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000f403
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000f403
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000f403
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000f403
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000f403
cmp dword [rcx + 0x84], 0xe
jbe 0x14000f403
cmp dword [rcx + 0xf8], 0
je 0x14000f403
mov ecx, ebx
call fcn.14000f4b4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000f290
nop
cmp dword [rbp + 0x20], 0
je 0x14000f451
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000f45c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000f394
Function at 0x140019154
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400191db
mov rsi, rbx
cmp word [rax], bp
je 0x14001919a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140019184
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140019180
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140016830
mov rdi, rax
test rax, rax
je 0x1400191c8
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14000d370
mov rbp, rdi
xor ecx, ecx
call fcn.140015854
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret