joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800a3268
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rbp, rcx
cmp edx, 1
jne 0x1800a3406
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x1800a3310
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x1800a3310
mov r14d, dword [r9 + 0x20]
dec r10d
mov edi, 0x722b58ca
lea rcx, [r14 + r10*4]
mov r11d, dword [rcx + r8]
add r11, r8
mov bl, byte [r11]
inc r11
test bl, bl
je 0x1800a330b
movsx ecx, bl
sub bl, 0x41
mov edx, ecx
or edx, 0x20
cmp bl, 0x19
mov bl, byte [r11]
cmova edx, ecx
inc r11
xor edx, edi
imul edi, edx, 0x1000193
test bl, bl
jne 0x1800a32e0
cmp edi, 0x8a04594a
je 0x1800a3315
test r10d, r10d
jne 0x1800a32c3
mov rax, qword [rax]
jmp 0x1800a329e
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
mov rcx, rbp
add rax, r8
call rax
mov rax, qword [0x1800c4a70]
test rax, rax
jne 0x1800a33eb
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x1800a33c6
mov r11d, dword [r9 + 0x18]
test r11d, r11d
je 0x1800a33c6
mov r14d, dword [r9 + 0x20]
dec r11d
mov esi, 0xf886c476
lea rcx, [r14 + r11*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov bl, byte [r10]
inc r10
test bl, bl
je 0x1800a33c1
movsx ecx, bl
sub bl, 0x41
mov edx, ecx
or edx, 0x20
cmp bl, 0x19
mov bl, byte [r10]
cmova edx, ecx
inc r10
xor edx, esi
imul esi, edx, 0x1000193
test bl, bl
jne 0x1800a3396
cmp esi, 0x57059286
je 0x1800a33cb
test r11d, r11d
jne 0x1800a3379
mov rax, qword [rax]
jmp 0x1800a3354
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r11*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
mov qword [0x1800c4a70], rax
and qword [rsp + 0x28], 0
lea r8, [0x1800a3254]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov rbx, qword [rsp + 0x40]
mov eax, 1
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x2fc502cb0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc5036b2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc528108]
test eax, eax
je 0x2fc50374a
lea rax, [0x2fc5280e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc528110]
mov qword [rbp - 8], rax
jmp 0x2fc50372e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc503722
cmp qword [rbp - 0x10], 0
je 0x2fc503722
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc5036e8
lea rax, [0x2fc5280e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc50374b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc503850
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc503878
mov eax, 0
jmp 0x2fc5038c6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc5038a1
mov eax, 0
jmp 0x2fc5038c6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc5038c1
mov eax, 0
jmp 0x2fc5038c6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc5038cc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc50394a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc503941
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc503941
mov rax, qword [rbp - 8]
jmp 0x2fc50395f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc503914
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x180072b4f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x18007e7b0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x20]
lea rcx, [0x1801a9139]
call fcn.1800751fb
mov rcx, qword [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x18007e7f0
xor eax, eax
jmp 0x18007e86e
mov r8d, 0x10
mov edx, 1
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x18007e814
xor eax, eax
jmp 0x18007e86e
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x18007e831
xor eax, eax
jmp 0x18007e86e
mov rax, qword [rbp + 0x148]
mov rcx, qword [rbp + 0x48]
mov ecx, dword [rcx + 0x30]
mov dword [rax], ecx
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x34]
shr eax, 0x10
mov rcx, qword [rbp + 0x148]
mov word [rcx + 4], ax
mov rax, qword [rbp + 0x148]
mov rcx, qword [rbp + 0x48]
movzx ecx, word [rcx + 0x34]
mov word [rax + 6], cx
mov eax, 1
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret

Function at 0x1800730ae
Capabilities:
Get common file path

Disassembly:
jmp 0x18007cc40
push rbp
push rdi
sub rsp, 0x3f8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x96
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x180197280]
xor rax, rbp
mov qword [rbp + 0x3c8], rax
lea rcx, [0x1801a90a9]
call fcn.1800751fb
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov edx, 0x104
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, str.termsrv.dll
lea rcx, [rbp + 0x10]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbp + 0x238], rax
cmp qword [rbp + 0x238], 0
jne 0x18007ccdb
lea rcx, str.Error:_Failed_to_load_Terminal_Services_library_r_n
call fcn.1800735a4
xor al, al
jmp 0x18007cd85
lea rdx, [0x180164310]
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180198550], rax
lea rdx, [0x180164320]
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180198558], rax
mov rax, qword [rbp + 0x238]
mov rcx, qword [0x180198558]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rbp + 0x238]
mov rdx, qword [0x180198550]
sub rdx, rcx
mov rcx, rdx
mov r9, rax
mov r8, rcx
mov rdx, qword [rbp + 0x238]
lea rcx, str.Base_addr:__0x_p_r_nSvcMain:____termsrv.dll0x_p_r_nSvcGlobals:_termsrv.dll0x_p_r_n
call fcn.1800735a4
lea r8, [0x180198540]
lea rdx, [0x180198538]
mov rcx, qword [rbp + 0x238]
call fcn.1800734aa
movzx eax, al
test eax, eax
jne 0x18007cd83
lea rcx, str.Error:_Failed_to_get_Terminal_Services_library_information_r_n
call fcn.1800735a4
xor al, al
jmp 0x18007cd85
mov al, 1
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x180163880]
call fcn.180074968
mov rax, rdi
mov rcx, qword [rbp + 0x3c8]
xor rcx, rbp
call fcn.180073897
lea rsp, [rbp + 0x3d8]
pop rdi
pop rbp
ret
Function at 0x1800736cb
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1800a4d30
mov rax, rcx
neg rcx
test rax, 7
je 0x1800a4d4d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1800a4da8
test al, 7
jne 0x1800a4d40
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1800a4d61
mov rdx, qword [rax - 8]
test dl, dl
je 0x1800a4dd2
test dh, dh
je 0x1800a4dcc
shr rdx, 0x10
test dl, dl
je 0x1800a4dc6
test dh, dh
je 0x1800a4dc0
shr rdx, 0x10
test dl, dl
je 0x1800a4dba
test dh, dh
je 0x1800a4db4
shr edx, 0x10
test dl, dl
je 0x1800a4dae
test dh, dh
jne 0x1800a4d61
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x180073883
Capabilities:
Print debug messages
Write file on windows

Disassembly:
jmp 0x18007ef20
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x180197280]
xor rax, rbp
mov qword [rbp + 0xf8], rax
lea rcx, [0x1801a9139]
call fcn.1800751fb
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 3
mov edx, 0x40000000
lea rcx, str.c:_rdpwrap.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0xffffffffffffffff
jne 0x18007efb7
jmp 0x18007f003
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, qword [rbp + 0x120]
call fcn.1800736cb
mov qword [rsp + 0x20], 0
lea r9, [rbp + 4]
mov r8d, eax
mov rdx, qword [rbp + 0x120]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x40]
lea rdx, [0x1801649e0]
call fcn.180074968
mov rcx, qword [rbp + 0xf8]
xor rcx, rbp
call fcn.180073897
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x180073a13
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1800a4660
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1800a3fe0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1800a469f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1801aa020]
jmp 0x1800a46a9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x180073b62
Capabilities:
Query environment variable

Disassembly:
jmp 0x18012b9a0
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.18012b7d0
lea rcx, [rsp + 0x40]
call fcn.18012b950
movzx eax, al
test eax, eax
jne 0x18012b9e8
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.18012b800
mov rax, qword [rsp + 0x70]
jmp 0x18012bbb9
lea rcx, [rsp + 0x40]
call fcn.18012b920
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.18012b8c0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.18012b920
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.1800745cb
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x18012ba8e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.18012b800
mov rax, qword [rsp + 0x80]
jmp 0x18012bbb9
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.18007390f
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1800737de
lea rcx, [rsp + 0x48]
call fcn.180073487
movzx eax, al
test eax, eax
jne 0x18012baf5
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.1800727a3
lea rcx, [rsp + 0x40]
call fcn.18012b800
mov rax, qword [rsp + 0x88]
jmp 0x18012bbb9
lea rcx, [rsp + 0x48]
call fcn.180073e41
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.18012b920
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.1800745cb
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x18012bb8b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.1800727a3
lea rcx, [rsp + 0x40]
call fcn.18012b800
mov rax, qword [rsp + 0xa0]
jmp 0x18012bbb9
lea rcx, [rsp + 0x48]
call fcn.1800737bb
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.1800727a3
lea rcx, [rsp + 0x40]
call fcn.18012b800
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret

Function at 0x180073b71
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1800a4590
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1800a3f60
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1800a45d1
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1801aa020]
jmp 0x1800a45d7
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret
Function at 0x180073bee
Capabilities:
Get geographical location

Disassembly:
jmp 0x18012f7b0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.18012e6e0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x18012f817
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x1801aa030]
jmp 0x18012f839
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.18007342d
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x180073c02
Capabilities:
Terminate process

Disassembly:
jmp 0x180080b30
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x180073d9c
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
jmp 0x18007eae0
mov byte [rsp + 8], cl
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
movzx ecx, byte [rsp + 0x1c8]
mov rax, qword [0x180197280]
xor rax, rbp
mov qword [rbp + 0x178], rax
lea rcx, [0x1801a9139]
call fcn.1800751fb
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbp + 0x44], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp + 0x64], eax
xor edx, edx
mov ecx, 4
call fcn.180073824
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
je 0x18007ebed
mov dword [rbp + 0x88], 0x1c
lea rdx, [rbp + 0x88]
mov rcx, qword [rbp + 8]
call fcn.180073f18
mov eax, dword [rbp + 0x44]
cmp dword [rbp + 0x90], eax
je 0x18007ebcf
mov eax, dword [rbp + 0x64]
cmp dword [rbp + 0x94], eax
jne 0x18007ebcf
mov r8d, dword [rbp + 0x90]
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0xffffffffffffffff
je 0x18007ebcf
movzx eax, byte [rbp + 0x1a0]
test eax, eax
je 0x18007ebbb
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x18007ebc5
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x88]
mov rcx, qword [rbp + 8]
call fcn.18007258c
test eax, eax
jne 0x18007eb6f
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x20]
lea rdx, [0x180164be0]
call fcn.180074968
mov rcx, qword [rbp + 0x178]
xor rcx, rbp
call fcn.180073897
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x180073df6
Capabilities:
Print debug messages

Disassembly:
jmp 0x180143f50
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x180197280]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x180143f76
jmp 0x180143ff3
mov rcx, qword [rbp + 0x30]
call fcn.1800736cb
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x180143f8f
jmp 0x180143ff3
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x180143fac
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1800728e3
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.180072ce9
test eax, eax
jne 0x180143ff3
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.180073897
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x180074756
Capabilities:
Terminate process

Disassembly:
jmp 0x180110240
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x18011026e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.180074e72
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x180074ed1
Capabilities:
Print debug messages

Disassembly:
jmp 0x180123c90
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x180074f76
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1800a46d0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1800a4020
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1800a4719
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1801aa020]
jmp 0x1800a4728
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x1800754c6
Capabilities:
Get file size
Read file on windows

Disassembly:
jmp 0x180078e80
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1a8]
mov rax, qword [0x180197280]
xor rax, rbp
mov qword [rbp + 0x138], rax
lea rcx, [0x1801a907a]
call fcn.1800751fb
mov dword [rbp + 4], 0
mov dword [rbp + 0x24], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
mov edx, 0x80000000
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0xffffffffffffffff
jne 0x180078f20
jmp 0x180078fbb
xor edx, edx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, qword [rbp + 0x160]
mov dword [rcx], eax
mov rax, qword [rbp + 0x160]
cmp dword [rax], 0xffffffff
jne 0x180078f43
jmp 0x180078fbb
mov rax, qword [rbp + 0x160]
mov eax, dword [rax]
mov ecx, eax
call fcn.18007363f
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x160]
mov rcx, qword [rbp + 0x128]
mov qword [rax + 8], rcx
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x24]
mov rax, qword [rbp + 0x160]
mov r8d, dword [rax]
mov rax, qword [rbp + 0x160]
mov rdx, qword [rax + 8]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jne 0x180078fa3
jmp 0x180078fbb
mov rcx, qword [rbp + 0x160]
call fcn.180072dbb
mov rcx, qword [rbp + 0x160]
call fcn.180072f82
mov rax, qword [rbp + 0x160]
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x180162c40]
call fcn.180074968
mov rax, rdi
mov rcx, qword [rbp + 0x138]
xor rcx, rbp
call fcn.180073897
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret