joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404d52d6
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
cmp r10w, 0x5537
jmp 0x1404d52ef
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
cmc
cmp bl, r10b
mov qword [rax + 0x18], rsi
stc
cmc
test r10b, r8b
mov qword [rax + 0x20], rdi
test dil, 0xcc
push r14
jmp 0x1404d5314
sub rsp, 0x40
jmp 0x1404d531d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub r14d, r14d
dec bh
shl bh, 0xd3
and bx, 0x62ea
mov rbx, rax
jmp 0x1404d533c
test rax, rax
je 0x1404d54a8
mov rsi, rax
stc
cmp word [rax], r14w
jmp 0x1404d5352
je 0x1404d5394
or rax, 0xffffffffffffffff
jmp 0x1404d5361
inc rax
cmc
cmp word [rsi + rax*2], r14w
jmp 0x1404d536f
jne 0x1404d5361
lea rsi, [rsi + rax*2]
jmp 0x1404d5381
add rsi, 2
cmp word [rsi], r14w
jmp 0x1404d538e
jne 0x1404d5358
mov qword [rsp + 0x38], r14
rcl r8b, 0x5e
add r9, rbx
sbb r9b, 0x72
sub rsi, rbx
btr r8w, 0xd6
rcr r8b, 0xc1
mov qword [rsp + 0x30], r14
ror r8b, 0x9b
rcl r9, 0x2f
add rsi, 2
sar rsi, 1
and r9b, 0x2e
mov r8, rbx
mov r9d, esi
test r8b, 8
stc
mov dword [rsp + 0x28], r14d
sub edx, edx
mov qword [rsp + 0x20], r14
xor ecx, ecx
call fcn.1404c5aca
movsxd rbp, eax
test eax, eax
jmp 0x1404d53f1
je 0x1404d54a8
mov rcx, rbp
jmp 0x1404d53ff
call fcn.1404c5a05
mov rdi, rax
stc
test r14d, 0x35a828f1
test rax, rax
jmp 0x1404d5417
je 0x1404d5488
mov qword [rsp + 0x38], r14
shr r8w, cl
adc r8b, 0x8f
cmovl r9w, r11w
mov r9d, esi
mov qword [rsp + 0x30], r14
rcl r8b, cl
cmp dil, r9b
adc r8b, 0x9a
mov r8, rbx
clc
cmc
mov dword [rsp + 0x28], ebp
jmp 0x1404d544f
xor edx, edx
cmc
clc
sub ecx, ecx
mov qword [rsp + 0x20], rax
jmp 0x1404d545f
call fcn.1404c5aca
test eax, eax
jmp 0x1404d546b
je 0x1404d5488
mov rsi, rdi
bswap di
movsx rdi, r8w
mov rdi, r14
jmp 0x1404d5483
jmp 0x1404d5496
mov rsi, r14
movzx ecx, sp
cmovne rcx, r14
movzx cx, ch
mov rcx, rdi
jmp 0x1404d549e
call fcn.1404c598b
jmp 0x1404d54ae
mov rsi, r14
test r15b, r14b
test rbx, rbx
je 0x1404d54c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
mov rax, rsi
setns dil
mov rsi, qword [rsp + 0x60]
btr edi, ebx
rol r14b, cl
mov rbp, qword [rsp + 0x58]
bt rdi, r14
cmp sp, 0x4c44
not dil
mov rdi, qword [rsp + 0x68]
sub r14, 0x2064c8e
rcr r14, 0x8b
add rsp, 0x40
pop r14
ret
Function at 0x1404d54ff
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
cmp r12w, 0x5246
stc
test dil, 0xde
mov qword [rsp + 0x18], rsi
clc
stc
push rdi
test r13b, 0x2a
stc
clc
sub rsp, 0x20
jmp 0x1404d552b
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
movsx rbx, ax
mov rbx, rax
jmp 0x1404d553f
test rax, rax
jmp 0x1404d5547
je 0x1404d561d
mov rbp, rax
cmp word [rax], si
jmp 0x1404d5558
je 0x1404d559d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jmp 0x1404d556f
jne 0x1404d5562
lea rbp, [rbp + rax*2]
jmp 0x1404d558a
add rbp, 2
cmp word [rbp], si
jmp 0x1404d5597
jne 0x1404d555e
sub rbp, rbx
rcr ecx, 0x75
or cx, r9w
cmp r8b, dl
add rbp, 2
sar rbp, 1
rol ch, 3
shr ch, 0x6f
add rbp, rbp
cmovg cx, r13w
movsx rcx, di
not rcx
mov rcx, rbp
jmp 0x1404d55ce
call fcn.1404c5a05
mov rdi, rax
test rax, rax
je 0x1404d5608
mov r8, rbp
seto dh
not ch
cdq
mov rdx, rbx
movzx ecx, sp
cmovno rcx, rdi
mov rcx, rax
jmp 0x1404d55fa
call fcn.14049fa7b
mov rsi, rdi
cmp ebx, 0x517007d8
xor ecx, ecx
jmp 0x1404d560f
call fcn.1404c598b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
shr ax, 0x40
mov rax, rsi
test sil, 0x8c
mov rsi, qword [rsp + 0x40]
or bpl, 0xfc
shr bpl, cl
mov rbp, qword [rsp + 0x38]
btc edi, 6
add rsp, 0x20
movsx rdi, r8w
pop rdi
jmp 0x1404d5650
ret
Function at 0x1404d8459
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movsxd rax, edi
mov qword [rsp + 0x18], rbp
movsx eax, bp
push rsi
push rdi
movzx eax, dx
cwde
mov al, 0xd0
push r14
cdqe
bswap ax
mov eax, 0x1450
jmp 0x1404d8486
call fcn.140444dde
sub rsp, rax
sub r10b, 0x10
mov rax, qword [0x1400b7288]
xor rax, rsp
adc edi, ebx
mov qword [rsp + 0x1440], rax
movsxd r10, edx
bt r14d, 0x74
bsr di, r15w
cbw
mov rdi, rcx
mov rax, r10
mov ebp, r9d
sar rax, 6
not dx
lea rcx, [0x1400ba940]
not r14w
and r10d, 0x3f
rcl sil, cl
inc r14
lea rbp, [rbp + r8]
bsr r14w, r14w
stc
bts edx, edx
mov rsi, r8
sal r14b, 0xaa
and r14d, r12d
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
shl r14b, cl
and r14, rdx
mov r14, qword [rax + rdx*8 + 0x28]
sub eax, eax
mov qword [rdi], rax
test rdx, rax
mov dword [rdi + 8], eax
stc
cmp r8, rbp
jmp 0x1404d8519
jae 0x1404d8612
lea rbx, [rsp + 0x40]
jmp 0x1404d852c
cmp rsi, rbp
jmp 0x1404d8534
jae 0x1404d8591
mov al, byte [rsi]
jmp 0x1404d8541
inc rsi
jmp 0x1404d8549
cmp al, 0xa
jmp 0x1404d8550
jne 0x1404d8569
inc dword [rdi + 8]
mov byte [rbx], 0xd
jmp 0x1404d8561
inc rbx
jmp 0x1404d8569
mov byte [rbx], al
cmovne ax, si
mov rax, 0x39b652ff
xchg al, ah
inc rbx
lea rax, [rsp + 0x143f]
cmp rbx, rax
jmp 0x1404d858b
jb 0x1404d852c
and qword [rsp + 0x20], 0
shl dl, cl
sbb rcx, 0x11bf148f
lea rax, [rsp + 0x40]
sub ebx, eax
xchg r9d, r9d
movsx r8d, r14w
movzx edx, ax
lea r9, [rsp + 0x30]
mov r8d, ebx
lea rdx, [rsp + 0x40]
mov rcx, r14
jmp 0x1404d85c6
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404d85d3
je 0x1404d8601
mov eax, dword [rsp + 0x30]
cmc
clc
stc
add dword [rdi + 4], eax
test di, dx
cmp eax, ebx
jb 0x1404d8612
cmp rsi, rbp
jmp 0x1404d85f6
jb 0x1404d851f
jmp 0x1404d8612
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
bt rcx, rbx
add al, dil
ror cl, cl
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
test r9w, 0x3c01
test r10b, sil
stc
xor rcx, rsp
jmp 0x1404d862f
call fcn.14049bea6
lea r11, [rsp + 0x1450]
movzx rdi, r8w
mov rbx, qword [r11 + 0x20]
movzx si, r15b
mov rbp, qword [r11 + 0x30]
bswap r14w
mov rsp, r11
movzx di, al
mov dil, 0xdb
pop r14
xchg di, di
bswap si
movsx edi, r15w
pop rdi
movsx si, bpl
pop rsi
jmp 0x1404d8673
ret
Function at 0x1404d8674
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
bswap eax
mov ah, 0x36
push rsi
sets al
bswap eax
cmovb ax, r11w
push rdi
jmp 0x1404d86a1
push r14
cdqe
movsx ax, r15b
not rax
mov eax, 0x1450
jmp 0x1404d86b7
call fcn.140444dde
sub rsp, rax
bswap r14d
ror dil, 0x53
movzx rbp, r12w
mov rax, qword [0x1400b7288]
rcl bpl, cl
neg bpl
mov r14w, 0x596d
xor rax, rsp
sbb bpl, 0x19
sar bp, cl
test r10b, 0xf0
mov qword [rsp + 0x1440], rax
movsxd r10, edx
bts di, bp
rol dh, 0x8a
shl dil, 0x2b
mov rdi, rcx
rdtsc
xchg si, si
shl si, cl
mov rax, r10
mov ebp, r9d
sar rax, 6
dec r14w
inc ch
lea rcx, [0x1400ba940]
mov dh, 0x7a
and r10d, 0x3f
add rbp, r8
or r14b, 0x60
bt r14w, r8w
mov rsi, r8
add dh, 0xb3
not r14d
mov rax, qword [rcx + rax*8]
mov dx, 0x491e
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
sub eax, eax
cmp r8w, cx
mov qword [rdi], rax
cmc
cmp esi, r9d
mov dword [rdi + 8], eax
test si, cx
cmp r8, rbp
jmp 0x1404d876a
jae 0x1404d8878
lea rbx, [rsp + 0x40]
cmp r11, rbx
test r9w, r10w
cmp rsi, rbp
jae 0x1404d87df
movzx eax, word [rsi]
add rsi, 2
cmp ax, 0xa
jmp 0x1404d8795
jne 0x1404d87c0
add dword [rdi + 8], 2
ror ecx, 0x99
not ecx
rcr cl, 0x16
mov ecx, 0xd
test r15w, ax
clc
cmp r13b, 0x41
mov word [rbx], cx
test r14b, 9
add rbx, 2
mov word [rbx], ax
add rbx, 2
or al, 0xa3
lea rax, [rsp + 0x143e]
cmp rbx, rax
jmp 0x1404d87d9
jb 0x1404d877c
and qword [rsp + 0x20], 0
bt ax, ax
lea rax, [rsp + 0x40]
sub rbx, rax
or cx, r11w
lea r9, [rsp + 0x30]
stc
sar rbx, 1
sal r8w, 0x19
test r8d, 0x1da05aba
jmp 0x1404d880f
lea rdx, [rsp + 0x40]
sub r8b, bpl
adc cx, di
add ebx, ebx
mov rcx, r14
mov r8d, ebx
jmp 0x1404d8827
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404d8834
je 0x1404d886d
mov eax, dword [rsp + 0x30]
test r9b, 0x26
test r14b, r13b
add dword [rdi + 4], eax
jmp 0x1404d884d
cmp eax, ebx
jmp 0x1404d8854
jb 0x1404d8878
cmp rsi, rbp
jmp 0x1404d8862
jb 0x1404d8770
jmp 0x1404d8878
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
ror ch, 0x1d
mov rax, rdi
movzx ecx, r10w
btc cx, r13w
rol cl, 0xc9
mov rcx, qword [rsp + 0x1440]
cmp r9b, 0xf0
xor rcx, rsp
jmp 0x1404d889b
call fcn.14049bea6
lea r11, [rsp + 0x1450]
not bp
mov bl, r13b
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
movzx r14d, r13w
mov rsp, r11
pop r14
pop rdi
movzx si, dil
jmp 0x1404d88ce
pop rsi
ret
Function at 0x1404dc1af
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
cqo
sub rsp, 0x20
add bl, 0xed
mov rbx, rcx
or r8w, 0x3469
lea r9, [0x1400c8e90]
xor r8w, 0x4b6e
cmp r12d, r15d
xor ecx, ecx
movsx r8d, bp
movzx edx, cx
lea r8, [0x1400c8e88]
cwd
lea rdx, [0x1400cfb70]
jmp 0x1404dc1f1
call fcn.1404dc4c7
test rax, rax
jmp 0x1404dc1fe
je 0x1404dc229
mov rcx, rbx
adc bx, 0x4458
add rsp, 0x20
movzx rbx, dx
bswap rbx
movzx bx, sil
pop rbx
jmp 0x1404dc222
push qword [0x1400b8d90]
ret
add rsp, 0x20
movsxd rbx, r8d
movsx bx, bpl
bswap bx
pop rbx
jmp 0x1404dc23e
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1404dc354
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
rol r8b, cl
test r12w, r14w
push rdi
sub rsp, 0x20
movzx rbx, r8w
movsx r8d, bx
mov rbx, rdx
mov dil, 2
cqo
lea r9, [0x1400c8ea8]
movsx edi, r15w
bswap dx
movzx rdx, sp
mov edi, ecx
lea rdx, [0x1400cf748]
not ecx
xchg r8, rcx
cmovns r8, r15
mov ecx, 3
mov r8d, 0x3b653f97
movzx r8w, bl
lea r8, [0x1400c8ea0]
jmp 0x1404dc3b5
call fcn.1404dc4c7
mov rdx, rbx
and cl, 0xaf
xor ch, 0xdb
bts cx, cx
mov ecx, edi
test r10d, 0x11272e30
test rax, rax
je 0x1404dc3e4
call qword [case.0x1404c7a96.0]
jmp 0x1404dc3ea
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov dil, 0xd4
test r14b, spl
ror edi, cl
add rsp, 0x20
pop rdi
ret
Function at 0x1404e04f6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x30
not r10b
movzx r10d, r12w
sub eax, eax
inc r10w
movsxd r10, r12d
mov r10d, ecx
test rdx, rdx
jmp 0x1404e0517
jne 0x1404e054b
call fcn.1404b187f
mov ebx, 0x16
jmp 0x1404e052c
mov dword [rax], ebx
jmp 0x1404e0533
call fcn.1404b2539
mov eax, ebx
add rsp, 0x30
not rbx
movzx ebx, bp
pop rbx
jmp 0x1404e054a
ret
test r8, r8
jmp 0x1404e0553
je 0x1404e051d
movzx ecx, byte [rsp + 0x60]
mov word [rdx], ax
lea rax, [rcx + 1]
test r10b, 0x9f
stc
cmp r8, rax
jmp 0x1404e0572
ja 0x1404e058c
call fcn.1404b187f
mov ebx, 0x22
jmp 0x1404e0587
jmp 0x1404e052c
lea eax, [r9 - 2]
mov ebx, 0x22
cmp eax, ebx
jmp 0x1404e059c
ja 0x1404e051d
mov byte [rsp + 0x60], cl
rcl bl, 0x99
mov ecx, r10d
and bh, ch
add rsp, 0x30
xchg bl, bl
pop rbx
jmp 0x1404e05ba
jmp 0x1404e05bf
mov qword [rsp + 8], rbx
neg bh
rcr bh, cl
mov qword [rsp + 0x10], rbp
rcr r10b, cl
xchg bx, bp
mov qword [rsp + 0x18], rsi
push rdi
neg r10w
rol bl, 0xab
push r14
stc
rol r11b, cl
add rdi, r10
push r15
not r11w
sub rsp, 0x20
adc bp, 0x28c7
sub r15d, r15d
mov ebp, r9d
ror dil, cl
shl bx, cl
cmp al, 0x2b
mov rdi, r8
btc r10d, r14d
mov r11, rdx
mov r10, rdx
bts ebx, edi
or ebx, 0x5dea20fb
add bl, r8b
mov ebx, r15d
cmp bh, bh
cmp byte [rsp + 0x60], r15b
jmp 0x1404e062e
je 0x1404e0657
lea eax, [r15 + 0x2d]
neg ecx
sal r8w, 0x45
adc r10d, 0xd63200b
sar rbx, 0xf9
mov word [rdx], ax
lea ebx, [rax - 0x2c]
sal r8b, cl
lea r10, [rdx + 2]
mov r8, r10
and eax, ebp
sub edx, edx
bts r9d, r13d
adc si, 0x455a
btr r9, r12
lea rsi, [r10 + 2]
adc r9d, 0x70dd4e12
cmp r10, 0x3ef25af
rcr ax, 0x8e
mov eax, ecx
mov r9, r10
div ebp
mov ecx, eax
cmp edx, 9
movzx r14w, r11b
movsx r14, r13w
jmp 0x1404e069b
mov eax, 0x57
lea r14d, [rax - 0x27]
jmp 0x1404e06a9
cmovbe ax, r14w
jmp 0x1404e06b3
inc rbx
test r14w, 0x3da3
add ax, dx
test r14w, sp
jmp 0x1404e06c9
mov word [r10], ax
cmc
clc
test ecx, ecx
jmp 0x1404e06d6
je 0x1404e06ee
mov r10, rsi
stc
cmp rbx, rdi
jmp 0x1404e06e8
jb 0x1404e065c
cmp rbx, rdi
jmp 0x1404e06f6
jb 0x1404e0727
mov word [r11], r15w
jmp 0x1404e0705
call fcn.1404b187f
mov ebx, 0x22
jmp 0x1404e0714
mov dword [rax], ebx
call fcn.1404b2539
mov eax, ebx
jmp 0x1404e0722
jmp 0x1404e076c
mov word [rsi], r15w
btc ax, 0xd7
movzx eax, word [r8]
movzx ecx, word [r9]
mov word [r9], ax
cmp dil, spl
cmc
sub r9, 2
mov word [r8], cx
stc
clc
add r8, 2
cmp esi, 0x182125d4
test r9d, ebx
cmp r8, r9
jmp 0x1404e075f
jb 0x1404e0730
xor eax, eax
movzx r15w, r8b
mov rbx, qword [rsp + 0x40]
ror rbp, cl
mov rbp, qword [rsp + 0x48]
ror dil, 0xf3
rcr r15w, 5
and r15b, 0x88
mov rsi, qword [rsp + 0x50]
xor r14b, 0x8f
and r15b, 0xbf
add rsp, 0x20
not r14
pop r15
movsx r14d, r9w
xchg r14w, di
pop r14
xchg dil, dil
movsx edi, dx
pop rdi
jmp 0x1404e07b2
ret
Function at 0x14000cec0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14000cecd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14000cedd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14000cec5
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14000cef5
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14000cee2
sub eax, 3
jb 0x14000cf0f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14000cf46
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14000cf36
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14000cf34
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14000cf23
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14000ce82
jmp 0x14000cecd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xc00
mov dl, 1
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14000cf92
cmp rsi, rcx
jae 0x14000cf9a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14000cf79
cmp al, 0x8f
ja 0x14000cf79
cmp byte [rsi - 2], 0xf
je 0x14000cf7f
sub al, 0xe8
cmp al, 1
ja 0x14000cf63
cmp rsi, rcx
jae 0x14000cf9a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14000cf69
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14000cf9a
lodsb al, byte [rsi]
jmp 0x14000cf79
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xa000]
mov eax, dword [rdi]
or eax, eax
je 0x14000cff7
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x11720]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14000cfa7
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14000cff1
mov qword [rbx], rax
add rbx, 8
jmp 0x14000cfc7
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14000d031
cmp al, 0xef
ja 0x14000d023
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14000d003
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14000d012
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x217]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14000d085
sub rsp, 0xffffffffffffff80
jmp 0x140001870
Function at 0x140011131
Capabilities:
Hide thread from debugger

Disassembly:
jmp 0x140011ec0
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x20]
lea rcx, [0x140025100]
call fcn.1400113de
mov dword [rbp + 4], 0x11
mov qword [rbp + 0x28], 0
mov dword [rbp + 0x64], 0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbp + 0x88], rax
lea rdx, str.NtSetInformationThread
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x11
mov rcx, rax
call qword [rbp + 0x28]
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
je 0x140011f44
mov dword [rbp + 0x64], 1
mov eax, dword [rbp + 0x64]
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret

Function at 0x14001120d
Capabilities:
Terminate process

Disassembly:
jmp 0x140014400
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400112a3
Capabilities:
Parse pe header

Disassembly:
jmp 0x140015750
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140015770
xor al, al
jmp 0x1400157f1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140015783
xor al, al
jmp 0x1400157f1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400157ad
xor al, al
jmp 0x1400157f1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400157c1
xor al, al
jmp 0x1400157f1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400157d3
xor al, al
jmp 0x1400157f1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400157ef
xor al, al
jmp 0x1400157f1
mov al, 1
add rsp, 0x38
ret

Function at 0x1400112e4
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
jmp 0x1400121c0
push rbp
push rdi
sub rsp, 0x1d8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x3e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001f040]
xor rax, rbp
mov qword [rbp + 0x1a8], rax
lea rcx, [0x140025100]
call fcn.1400113de
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbp + 0x28]
mov dword [rbp + 0xb4], eax
cmp dword [rbp + 0xb4], 2
jae 0x140012220
mov eax, 1
jmp 0x14001226b
mov dword [rbp + 0x60], 0x40
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor edx, edx
mov rax, qword [rbp + 0x68]
mov ecx, 0x400
div rcx
xor edx, edx
mov ecx, 0x400
div rcx
xor edx, edx
mov ecx, 0x400
div rcx
mov dword [rbp + 0xd4], eax
cmp dword [rbp + 0xd4], 2
jae 0x140012269
mov eax, 1
jmp 0x14001226b
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001bee0]
call fcn.14001135c
mov rax, rdi
mov rcx, qword [rbp + 0x1a8]
xor rcx, rbp
call fcn.1400111cc
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret

Function at 0x1400112ee
Capabilities:
Check if process is running under wine

Disassembly:
jmp 0x1400122d0
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x140025100]
call fcn.1400113de
lea rcx, [0x14001c3c0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x14001230d
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x14001232e
lea rdx, str.wine_get_unix_file_name
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140012329
xor eax, eax
jmp 0x14001232e
mov eax, 1
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x140009670
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x1400096b2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x1400096ba
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x1400096cb
jmp 0x1400096e2
xor r10d, r10d
jmp 0x14000976d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x1400096e2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x1400096f9
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140009719
add r11, r8
jmp 0x14000984a
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x1400097e2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140009790
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x140009800
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140009812
jmp 0x14000982c
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14000982c
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140009846
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret