joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001bfe0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov eax, dword [rdx + 8]
movzx ebp, r9b
and eax, 0x1fffffff
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
cmp eax, 3
jae 0x18001c018
mov eax, 0xffffffff
jmp 0x18001c0cc
mov dl, 1
call fcn.180012b70
mov r11, qword [rbx]
mov eax, dword [r11]
cmp eax, 0x4e534942
je 0x18001c0bb
and eax, 0x80808080
xor r9d, r9d
cmp eax, 0x80808080
jne 0x18001c0e1
mov r10d, dword [rbx + 8]
add r11, 4
and r10d, 0x1fffffff
sub r10d, 4
mov eax, r10d
movzx ecx, r10b
shr eax, 8
movzx edi, al
imul edi, ecx
test r10d, r10d
je 0x18001c0bb
nop dword [rax + rax]
movzx eax, r9b
movzx ecx, dil
and al, 0x7e
lea r11, [r11 + 1]
movzx r8d, al
imul r8d, ecx
movzx ecx, byte [r11 - 1]
movzx eax, cl
add r8b, r9b
sub al, r8b
add cl, r8b
test r9b, 1
movzx r8d, cl
movzx eax, al
cmove r8d, eax
inc r9d
xor r8b, dil
not r8b
sub r8b, bpl
mov byte [r11 - 1], r8b
cmp r9d, r10d
jb 0x18001c070
mov r8d, 4
mov rdx, rbx
mov rcx, rsi
call fcn.18001a360
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call fcn.18001a660
neg eax
jmp 0x18001c0cc
Function at 0x18001c5a0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x60
mov edx, dword [rcx + 0x3c]
xor esi, esi
mov rbp, rcx
mov r11d, esi
movzx eax, word [rdx + rcx + 0x14]
lea edi, [rdx + 0x18]
movzx ebx, word [rdx + rcx + 6]
add edi, eax
add rdi, rcx
test ebx, ebx
je 0x18001c68f
lea r14, str..rsrc
mov r10, rdi
sub r10, r14
nop dword [rax]
mov eax, r11d
cmp r14, rax
je 0x18001c63a
mov r8, rsi
nop dword [rax + rax]
lea rcx, [r8 + r14]
movzx edx, byte [r10 + rcx]
movzx r9d, dl
lea eax, [rdx - 0x61]
cmp al, 0x19
ja 0x18001c617
add dl, 0xe0
movzx ecx, byte [rcx]
lea eax, [rcx - 0x61]
cmp al, 0x19
ja 0x18001c624
add cl, 0xe0
cmp dl, cl
jne 0x18001c6ac
test r9b, r9b
je 0x18001c63a
inc r8
cmp r8, 8
jl 0x18001c600
mov ebx, dword [rdi + 0xc]
mov eax, dword [rdi + 8]
add rbx, rbp
cmp eax, 0x40
jbe 0x18001c68f
movups xmm0, xmmword [str.FileVersion]
add eax, 0xffffffc0
mov edi, eax
movups xmmword [rsp + 0x20], xmm0
add rdi, rbx
movsd xmm0, qword [0x180044128]
movsd qword [rsp + 0x30], xmm0
cmp rbx, rdi
jae 0x18001c68f
nop
mov r8d, socket
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180008d30
test eax, eax
je 0x18001c6c2
inc rbx
cmp rbx, rdi
jb 0x18001c670
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
inc r11d
add rdi, 0x28
add r10, 0x28
cmp r11d, ebx
jb 0x18001c5f0
jmp 0x18001c68f
add rbx, 0x18
cmp byte [rbx], sil
jne 0x18001c6d8
nop dword [rax + rax]
inc rbx
cmp byte [rbx], sil
je 0x18001c6d0
xorps xmm0, xmm0
mov edx, esi
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
cmp word [rbx], dx
je 0x18001c68f
nop dword [rax]
cmp edx, 3
jge 0x18001c71a
movzx ecx, word [rbx]
cmp cx, 0x2c
je 0x18001c68f
cmp cx, 0x2e
jne 0x18001c708
inc edx
jmp 0x18001c710
mov eax, esi
inc esi
mov byte [rsp + rax + 0x38], cl
add rbx, 2
cmp word [rbx], 0
jne 0x18001c6f0
test esi, esi
je 0x18001c68f
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.180009f20
jmp 0x18001c691
Function at 0x18001c780
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x20], r14
push r15
mov rax, qword gs:[0x30]
mov r15, r8
mov r11, rcx
mov rax, qword [rax + 0x60]
test rcx, rcx
jne 0x18001c7ee
mov r8, qword [rax + 0x10]
test rdx, rdx
je 0x18001c7e3
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x18]
add rcx, 0x20
mov rax, qword [rcx]
cmp rax, rcx
je 0x18001c7e3
cmp r8, qword [rax + 0x20]
je 0x18001c7de
mov rax, qword [rax]
cmp rax, rcx
jne 0x18001c7c5
mov rax, r8
mov r14, qword [rsp + 0x28]
pop r15
ret
mov ecx, dword [rax + 0x30]
mov dword [rdx], ecx
mov rax, r8
mov r14, qword [rsp + 0x28]
pop r15
ret
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
test r15, r15
je 0x18001c80d
mov edi, dword [r8]
inc edi
jmp 0x18001c80f
xor edi, edi
mov r8, qword [rcx + 0x20]
lea rsi, [rcx + 0x20]
xor ebx, ebx
cmp r8, rsi
je 0x18001c865
nop
movzx ecx, word [r8 + 0x48]
test cx, cx
je 0x18001c85b
mov r10, qword [r8 + 0x50]
test r10, r10
je 0x18001c85b
cmp ebx, edi
jl 0x18001c85b
xor eax, eax
mov r9d, ecx
shr r9d, 1
je 0x18001c854
movsx ecx, byte [rax + r11]
cmp word [r10 + rax*2], cx
jne 0x18001c85b
inc eax
cmp eax, r9d
jb 0x18001c841
cmp byte [rax + r11], 0
je 0x18001c87e
mov r8, qword [r8]
inc ebx
cmp r8, rsi
jne 0x18001c820
xor eax, eax
mov rsi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
pop r15
ret
test r15, r15
je 0x18001c886
mov dword [r15], ebx
test rdx, rdx
je 0x18001c891
mov ecx, dword [r8 + 0x30]
mov dword [rdx], ecx
mov rax, qword [r8 + 0x20]
jmp 0x18001c867
Function at 0x18001c900
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov r11, rsp
sub rsp, 0x128
mov qword [r11 + 8], 0
test rcx, rcx
je 0x18001ca6f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18001ca6f
mov eax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x18001ca6f
mov r8d, 0x20b
xor r9d, r9d
cmp word [rax + rcx + 0x18], r8w
lea r8, [r11 + 8]
jne 0x18001c955
call fcn.18000eb10
jmp 0x18001c95a
call fcn.18000e750
test rax, rax
je 0x18001ca49
mov r9, qword [rsp + 0x130]
test r9, r9
je 0x18001ca49
mov qword [rsp + 0x138], rbx
xor ecx, ecx
mov qword [rsp + 0x120], rdi
xor edi, edi
cmp byte [r9], cl
je 0x18001c9b8
movzx edx, byte [r9]
mov r8, r9
nop dword [rax]
nop dword [rax + rax]
cmp dl, 0x2e
lea r8, [r8 + 1]
movzx edx, byte [r8]
mov eax, ecx
cmovne eax, edi
inc ecx
mov edi, eax
test dl, dl
jne 0x18001c9a0
movsxd rbx, edi
lea rcx, [rsp + 0x20]
mov r8, rbx
mov rdx, r9
call fcn.180008d80
mov rax, qword gs:[0x30]
xor r11d, r11d
mov byte [rsp + rbx + 0x20], 0
mov rcx, qword [rax + 0x60]
mov rbx, qword [rcx + 0x18]
add rbx, 0x20
mov r9, qword [rbx]
cmp r9, rbx
je 0x18001ca37
movzx ecx, word [r9 + 0x48]
test cx, cx
je 0x18001ca2c
mov r10, qword [r9 + 0x50]
test r10, r10
je 0x18001ca2c
test r11d, r11d
js 0x18001ca2c
xor eax, eax
mov r8d, ecx
shr r8d, 1
je 0x18001ca25
movsx ecx, byte [rsp + rax + 0x20]
cmp word [r10 + rax*2], cx
jne 0x18001ca2c
inc eax
cmp eax, r8d
jb 0x18001ca12
cmp byte [rsp + rax + 0x20], 0
je 0x18001ca51
mov r9, qword [r9]
inc r11d
cmp r9, rbx
jne 0x18001c9f0
xor eax, eax
mov rbx, qword [rsp + 0x138]
mov rdi, qword [rsp + 0x120]
add rsp, 0x128
ret
mov rcx, qword [r9 + 0x20]
test rcx, rcx
je 0x18001ca37
lea eax, [rdi + 1]
movsxd rdx, eax
add rdx, qword [rsp + 0x130]
call fcn.18001c900
jmp 0x18001ca39
xor eax, eax
add rsp, 0x128
ret
Function at 0x180026a20
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x40
mov rdi, rcx
movabs rax, 0x5ec168a5ae0c6104
mov qword [r11 - 0x28], rax
movabs rcx, 0x5ec10dc9c9620e40
xor rax, rcx
mov r14, rdx
mov rcx, qword [rsp + 0x70]
lea rdx, [r11 - 0x28]
mov qword [r11 - 0x28], rax
mov rbx, r9
mov rbp, r8
call fcn.18001c4e0
mov rsi, rax
test rax, rax
jne 0x180026a82
lea eax, [rsi - 1]
jmp 0x180026b74
movabs rax, 0x15a479a8bf0b7c10
xor r10d, r10d
mov qword [rsp + 0x28], rax
movabs r11, 0xf427de46c6d3be37
movabs rax, 0x39017b0437545ced
mov qword [rsp + 0x30], rax
nop dword [rax]
mov rax, qword [rsp + r10*8 + 0x28]
mov r9d, r10d
neg r9d
mov r8, r11
and r9d, 0xf
rol r8, 3
not r8
rol r11, 1
mov rdx, r8
mov ecx, r9d
neg ecx
and ecx, 0x3f
shl rdx, cl
mov ecx, r9d
shr r8, cl
or rdx, r8
xor rdx, rax
mov qword [rsp + r10*8 + 0x28], rdx
inc r10
cmp r10, 2
jb 0x180026ab0
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.18001c4e0
test rax, rax
jne 0x180026b0d
mov eax, 0xfffffffe
jmp 0x180026b74
mov rdx, rbp
mov rcx, rax
call fcn.18001c4e0
test rax, rax
jne 0x180026b24
mov eax, 0xfffffffd
jmp 0x180026b74
mov rdx, qword [rax + 0x20]
test rdx, rdx
je 0x180026b6f
cmp byte [rdx], 0
je 0x180026b6f
mov r8d, dword [rdx - 4]
shr r8d, 1
lea eax, [r8 - 1]
cmp eax, 0x7ff
ja 0x180026b6f
mov r9b, 0x20
mov rcx, rdi
call fcn.18000abe0
mov dword [r14], eax
test rbx, rbx
je 0x180026b6b
mov r9d, 3
mov r8d, eax
mov rdx, rdi
mov rcx, rbx
call fcn.18001b0d0
xor eax, eax
jmp 0x180026b74
mov eax, 0xfffffffc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x18002c680
Capabilities:
Enumerate pe sections

Disassembly:
mov r8d, dword [rcx + 0x3c]
mov r10d, edx
movzx eax, word [r8 + rcx + 0x14]
movzx r11d, word [r8 + rcx + 6]
add r8d, 0x18
add eax, r8d
xor r8d, r8d
add rax, rcx
test r11d, r11d
je 0x18002c6c5
mov r9d, dword [rax + 0xc]
cmp r9d, r10d
ja 0x18002c6b9
mov edx, dword [rax + 8]
add edx, r9d
cmp edx, r10d
ja 0x18002c6c8
inc r8d
add rax, 0x28
cmp r8d, r11d
jl 0x18002c6a5
xor eax, eax
ret
sub r10d, r9d
cmp r10d, dword [rax + 0x10]
jae 0x18002c6c5
mov eax, dword [rax + 0x14]
add eax, r10d
ret
Function at 0x180032050
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov ebp, dword [rdx + 8]
mov r14, rdx
mov r13, rcx
and ebp, 0x1fffffff
mov rcx, r14
movzx r12d, r8b
lea edi, [rbp + 4]
mov edx, edi
call fcn.18002c560
xor esi, esi
test rax, rax
jne 0x180032098
mov r15d, esi
jmp 0x1800320da
mov r15d, dword [r14 + 8]
mov rcx, r14
mov rdi, qword [r14]
mov eax, r15d
mov ebx, r15d
and ebx, 0x1fffffff
add ebx, 4
xor eax, ebx
mov edx, ebx
and eax, 0x1fffffff
xor eax, r15d
mov dword [r14 + 8], eax
call fcn.18002d6c0
mov rax, qword [r14]
and r15d, 0x1fffffff
add r15, rdi
lea edi, [rbp + 4]
mov byte [rbx + rax], sil
xor eax, eax
mov rdx, r14
mov dword [r15], eax
mov rcx, r13
mov rax, qword [r14]
mov dword [rbp + rax], 0x4e534942
mov r8d, dword [r14 + 8]
and r8d, 0x1fffffff
call fcn.18001ade0
mov r10d, eax
test r12b, r12b
je 0x180032196
mov rcx, qword [r14]
or r13d, 0x80808080
mov r9d, edi
add r9, rcx
mov dword [rbp + rcx], r13d
mov r11d, dword [r14 + 8]
and r11d, 0x1fffffff
sub r11d, ebp
sub r11d, 4
mov eax, r11d
movzx ecx, r11b
shr eax, 8
movzx ebx, al
imul ebx, ecx
test r11d, r11d
je 0x180032193
nop dword [rax + rax]
movzx ecx, bl
lea r9, [r9 + 1]
movzx eax, sil
and al, 0x7e
movzx r8d, al
imul r8d, ecx
movzx ecx, r12b
add cl, byte [r9 - 1]
not cl
xor cl, bl
add r8b, sil
lea eax, [r8 + rcx]
sub cl, r8b
test sil, 1
movzx ecx, cl
movzx eax, al
cmove ecx, eax
inc esi
mov byte [r9 - 1], cl
cmp esi, r11d
jb 0x180032150
mov eax, r10d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800327c0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x30
cmp qword [0x180039e20], 0
mov rdi, rcx
je 0x1800327db
mov al, 1
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x28], rbp
mov ebp, 0x20b
test rdi, rdi
je 0x18003285d
movabs rax, 0x5ec179a083166b27
movabs rcx, 0x5ec10dc9c9620e40
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
xor rax, rcx
mov qword [rsp + 0x50], rax
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x180032854
mov eax, dword [rdi + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x180032854
xor r9d, r9d
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, rdi
cmp word [rax + rdi + 0x18], bp
jne 0x18003284a
call fcn.18000eb10
mov rbx, rax
jmp 0x180032856
call fcn.18000e750
mov rbx, rax
jmp 0x180032856
xor ebx, ebx
test rbx, rbx
jne 0x1800328a3
jmp 0x18003288b
lea rcx, str.clrjit.dll
call qword [0x1800420b0]
mov rdi, rax
test rax, rax
jne 0x18003288b
lea rcx, str.mscorjit.dll
call qword [0x1800420b0]
mov rdi, rax
test rax, rax
je 0x180032919
lea rdx, str.getJit
mov rcx, rdi
call qword [0x1800420b8]
mov rbx, rax
test rax, rax
je 0x180032919
call rbx
test rax, rax
jne 0x180032952
mov ecx, dword [rdi + 0x3c]
mov qword [rsp + 0x20], rsi
mov esi, dword [rcx + rdi + 0x50]
cmp word [rcx + rdi + 0x18], bp
mov rcx, rdi
jne 0x1800328cb
call fcn.18000bbf0
jmp 0x1800328d0
call fcn.18000bbf0
lea r9, [rbx + 0x20]
lea r8, [rdi + rsi]
mov rsi, qword [rsp + 0x20]
cmp rbx, r9
jae 0x180032919
nop dword [rax]
nop word [rax + rax]
movsxd rax, dword [rbx]
lea rdx, [rbx + 4]
add rdx, rax
cmp rdx, rdi
jbe 0x180032911
cmp rdx, r8
jae 0x180032911
mov rcx, qword [rdx]
cmp rcx, rdi
jbe 0x180032911
cmp rcx, r8
jb 0x18003292b
inc rbx
cmp rbx, r9
jb 0x1800328f0
mov rbx, qword [rsp + 0x40]
xor al, al
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
pop rdi
ret
mov rax, qword [rcx]
cmp rax, rdi
jb 0x180032938
cmp rax, r8
jb 0x18003293b
mov rcx, rdx
test rcx, rcx
jne 0x18003295a
mov rbx, qword [rsp + 0x40]
xor al, al
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rax]
test rcx, rcx
je 0x180032919
mov rax, qword [rcx]
lea rdx, [rsp + 0x58]
mov qword [0x180039e20], rax
mov r9b, 1
lea rax, [0x18002b6a0]
mov r8d, 8
mov qword [rsp + 0x58], rax
call fcn.180008ab0
mov rbx, qword [rsp + 0x40]
mov al, 1
mov rbp, qword [rsp + 0x28]
mov byte [reloc.WS2_32.dll_accept], 0
add rsp, 0x30
pop rdi
ret
Function at 0x140001000
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0xf0
mov eax, 0x5a4d
mov rbp, rdx
mov rbx, rcx
cmp word [rcx], ax
jne 0x140001147
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x140001147
movups xmm0, xmmword [rax + 0x18]
lea r8, [rsp]
xor r9d, r9d
movups xmm1, xmmword [rax + 0x28]
movups xmmword [r8], xmm0
movups xmm0, xmmword [rax + 0x38]
movups xmmword [r8 + 0x10], xmm1
movups xmm1, xmmword [rax + 0x48]
movups xmmword [r8 + 0x20], xmm0
movups xmm0, xmmword [rax + 0x58]
movups xmmword [r8 + 0x30], xmm1
movups xmm1, xmmword [rax + 0x68]
movups xmmword [r8 + 0x40], xmm0
movups xmm0, xmmword [rax + 0x78]
movups xmmword [r8 + 0x50], xmm1
movups xmmword [r8 + 0x60], xmm0
lea r8, [r8 + 0x80]
movups xmm0, xmmword [rax + 0x88]
sub rax, 0xffffffffffffff68
movups xmmword [r8 - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movups xmmword [r8], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [r8 + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [r8 + 0x20], xmm1
movups xmm1, xmmword [rax + 0x40]
movups xmmword [r8 + 0x30], xmm0
movups xmm0, xmmword [rax + 0x50]
movups xmmword [r8 + 0x40], xmm1
movups xmm1, xmmword [rax + 0x60]
movups xmmword [r8 + 0x50], xmm0
movups xmmword [r8 + 0x60], xmm1
mov eax, dword [rsp + 0x70]
add rax, rcx
mov r10d, dword [rax + 0x20]
mov r14d, dword [rax + 0x1c]
add r10, rcx
mov r11d, dword [rax + 0x24]
add r14, rcx
mov esi, dword [rax + 0x14]
add r11, rcx
test esi, esi
je 0x140001147
movzx eax, word [r11]
mov r8d, dword [r10]
add r8, rbx
mov edi, dword [r14 + rax*4]
mov rax, rbp
add rdi, rbx
sub r8, rbp
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140001133
inc rax
test ecx, ecx
jne 0x140001120
test edx, edx
je 0x140001167
inc r9d
add r11, 2
add r10, 4
cmp r9d, esi
jb 0x140001102
xor eax, eax
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov rax, rdi
jmp 0x140001149
Function at 0x140001a30
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x450
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdi, qword [rcx + 0x20]
test rdi, rdi
je 0x140001b71
lea r15, str.NTDLL.DLL
xor r12d, r12d
nop word [rax + rax]
cmp word [rdi + 0x48], r12w
je 0x140001b65
mov rbp, qword [rdi + 0x50]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, r15
movsxd rsi, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r14, eax
cmp esi, 0x104
jge 0x140001b65
cmp r14d, 0x104
jge 0x140001b65
mov rbx, r12
test rsi, rsi
jle 0x140001afb
nop dword [rax + rax]
movzx ecx, word [rbp + rbx*2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov word [rsp + rbx*2 + 0x230], ax
inc rbx
cmp rbx, rsi
jl 0x140001ae0
add rbx, rbx
cmp rbx, 0x208
jae 0x140001c7c
mov word [rsp + rbx + 0x230], r12w
mov rbx, r12
test r14d, r14d
jle 0x140001b38
nop dword [rax]
movzx ecx, word [r15 + rbx*2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov word [rsp + rbx*2 + 0x20], ax
inc rbx
cmp rbx, r14
jl 0x140001b20
add rbx, rbx
cmp rbx, 0x208
jae 0x140001c7c
lea rdx, [rsp + 0x20]
mov word [rsp + rbx + 0x20], r12w
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140001bbc
mov rdi, qword [rdi]
test rdi, rdi
jne 0x140001a90
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Could_not_retrieve_DLL._Error:__lu_n
call fcn.140001180
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140001ca0
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
mov rdi, qword [rdi + 0x20]
test rdi, rdi
je 0x140001b71
lea rdx, str.NtAllocateVirtualMemory
mov rcx, rdi
call section..text
lea rdx, str.NtProtectVirtualMemory
mov qword [0x140005698], rax
mov rcx, rdi
mov rbx, rax
call section..text
lea rdx, str.NtWriteVirtualMemory
mov qword [0x1400056a0], rax
mov rcx, rdi
mov r14, rax
call section..text
lea rdx, str.NtQueueApcThread
mov qword [0x140005688], rax
mov rcx, rdi
mov rbp, rax
call section..text
lea rdx, str.NtResumeThread
mov qword [0x140005690], rax
mov rcx, rdi
mov rsi, rax
call section..text
mov qword [0x140005680], rax
test rbx, rbx
je 0x140001c6b
test r14, r14
je 0x140001c6b
test rbp, rbp
je 0x140001c6b
test rsi, rsi
je 0x140001c6b
test rax, rax
je 0x140001c6b
lea rcx, str.___Native_Functions_should_work_n
call fcn.140001180
xor eax, eax
jmp 0x140001b8a
lea rcx, str.____Failed_to_declare_NTAPIs_n
call fcn.140001180
jmp 0x140001b85
call fcn.140001dc8
int3
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140005440]
mov dword [rax], 1
mov rax, qword [0x140005450]
mov dword [rax], 1
mov rax, qword [0x140005460]
mov dword [rax], 1
mov rax, qword [0x140005400]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001a70
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x140002742
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140009168]
test eax, eax
je 0x1400027da
lea rax, [0x140009140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140009170]
mov qword [rbp - 8], rax
jmp 0x1400027be
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1400027b2
cmp qword [rbp - 0x10], 0
je 0x1400027b2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140002778
lea rax, [0x140009140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1400027db
nop
add rsp, 0x30
pop rbp
ret
Function at 0x140009380
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1401945d8]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140194c58]
mov esi, edx
mov edi, ecx
cmp byte [rbx + 0x20d5], 0
jne 0x1400093e7
cmp byte [rbx + 0x20d6], 0
jne 0x1400093e7
mov r9d, dword [rbx + 0x3178]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140019ce0
test sil, 1
je 0x14000951c
jmp 0x140009486
movss xmm1, dword [rbx + 0x16ec]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400f3e7c]
xor eax, eax
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x1400f3e74]
addss xmm0, dword [rbx + 0x120]
addss xmm1, dword [rbx + 0x124]
or dword [rbx + 0x1dc0], 1
mov qword [rbx + 0x1ddc], rax
movss dword [rbx + 0x1dd4], xmm0
mov dword [rbx + 0x1dc4], 1
movss dword [rbx + 0x1dd8], xmm1
mov byte [rbx + 0x1dfc], 1
movss xmm0, dword [rbx + 0x1748]
mov rax, qword [0x140194c58]
mulss xmm0, dword [0x1400f3e0c]
or dword [rax + 0x1dc0], 0x40
movss dword [rax + 0x1e20], xmm0
mov r9d, dword [rbx + 0x3178]
call fcn.140019ce0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400094d6
lea r11, [0x1400ed0f0]
cmp r9b, 0x23
jne 0x1400094b9
cmp byte [r8], r9b
jne 0x1400094b9
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400094a6
not ecx
call fcn.140018080
test rax, rax
je 0x14000951c
cmp byte [rax + 0xcf], 0
je 0x14000951c
mov byte [rax + 0xd6], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xf0], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x3178]
mov edx, reloc.WS2_32.dll_recv
mov r9d, dword [rbx + 0x3178]
call fcn.140019ce0
or edi, 0x22c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.140005150
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400e80c0
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret