joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e97f0
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rbx, r8
mov r14, rdx
mov rdi, rcx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], r8
mov rcx, qword [0x00576170]
test rcx, rcx
jne 0x4e9830
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x4e98e1
mov rcx, rax
mov qword [0x00576170], rax
mov r8d, 0x10
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x4e98e1
mov rsi, rax
mov qword [rax], r14
mov qword [rax + 8], rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x004e9940]
xor ebx, ebx
xor ecx, ecx
mov rdx, rdi
mov r9, rax
call sub.kernel32.dll_CreateThread
mov rdx, rax
test rax, rax
jne 0x4e98d4
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
call qword [rax]
mov rax, qword [rsi + 8]
cmp qword [rax + 8], 0
je 0x4e98af
mov r8, qword [rsi]
cmp qword [rax + 0x10], 0x11
jb 0x4e98a1
mov r8, qword [r8 - 8]
mov rcx, qword [0x00576170]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov rcx, qword [0x00576170]
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
call sub.kernel32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov ebx, 1
mov rax, rbx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ecx, 0x10
mov edx, 8
call fcn.004043b0
ud2

Function at 0x4ea950
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov ecx, dword [0x005021c0]
test ecx, ecx
je 0x4ea983
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x4ea99c
mov rbx, rax
cmp qword [rax], 0
je 0x4ea99c
add rbx, 8
jmp 0x4eaab1
lea rcx, [0x005021a8]
call fcn.004dae70
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x4ea971
mov ecx, dword [0x005021c0]
test ecx, ecx
je 0x4eaa92
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x4eaaaf
mov rdi, rax
test rax, rax
jne 0x4eaa3e
mov qword [rsp + 0x20], 0
lea rax, [0x005021a8]
mov qword [rsp + 0x38], rax
mov rcx, qword [0x00576170]
test rcx, rcx
jne 0x4ea9fc
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x4eaacf
mov rcx, rax
mov qword [0x00576170], rax
mov r8d, 0x20
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x4eaacf
mov rdi, rax
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov ecx, dword [0x005021c0]
test ecx, ecx
je 0x4eaabc
dec ecx
mov rdx, rdi
call sub.kernel32.dll_TlsSetValue
test rsi, rsi
je 0x4eaa5f
mov rax, qword [rsi]
mov qword [rsi], 0
mov rdx, rax
test rax, rax
je 0x4eaa63
mov rax, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
jmp 0x4eaa63
xor eax, eax
xor edx, edx
lea rbx, [rdi + 8]
cmp qword [rdi], 0
mov rcx, qword [rdi + 0x10]
mov qword [rdi], 1
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rdx
je 0x4eaab1
test rcx, rcx
je 0x4eaab1
lock dec qword [rcx]
jne 0x4eaab1
call fcn.004e0950
jmp 0x4eaab1
lea rcx, [0x005021a8]
call fcn.004dae70
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x4ea9bb
xor ebx, ebx
mov rax, rbx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x005021a8]
call fcn.004dae70
mov ecx, eax
jmp 0x4eaa36
mov ecx, 0x20
mov edx, 8
call fcn.004043b0
ud2
Function at 0x4eabe0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov ecx, dword [0x00502108]
test ecx, ecx
je 0x4eac0f
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x4eac28
mov rdi, rax
cmp qword [rax], 0
je 0x4eac28
add rdi, 8
jmp 0x4ead14
lea rcx, [0x005020f0]
call fcn.004dae70
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x4eabfd
mov ecx, dword [0x00502108]
test ecx, ecx
je 0x4eacf5
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x4ead12
mov rsi, rax
test rax, rax
jne 0x4eacc6
mov qword [rsp + 0x20], 0
lea rax, [0x005020f0]
mov qword [rsp + 0x30], rax
mov rcx, qword [0x00576170]
test rcx, rcx
jne 0x4eac88
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x4ead2e
mov rcx, rax
mov qword [0x00576170], rax
mov r8d, 0x18
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x4ead2e
mov rsi, rax
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm0
mov ecx, dword [0x00502108]
test ecx, ecx
je 0x4ead1e
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
lea rdi, [rsi + 8]
mov rcx, qword [rsi + 8]
cmp qword [rsi], 0
mov qword [rsi], 1
mov qword [rsi + 8], 0
je 0x4ead14
test rcx, rcx
je 0x4ead14
lock dec qword [rcx]
jne 0x4ead14
call fcn.004e08b0
jmp 0x4ead14
lea rcx, [0x005020f0]
call fcn.004dae70
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x4eac47
xor edi, edi
mov rax, rdi
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, [0x005020f0]
call fcn.004dae70
mov ecx, eax
jmp 0x4eacbe
mov ecx, 0x18
mov edx, 8
call fcn.004043b0
ud2

Function at 0x4ead60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x00502150]
test ecx, ecx
je 0x4ead8c
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x4eada5
cmp qword [rax], 0
je 0x4eada5
add rax, 8
add rsp, 0x20
pop rsi
ret
lea rcx, [0x00502138]
call fcn.004dae70
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x4ead7c
mov ecx, dword [0x00502150]
test ecx, ecx
je 0x4eae44
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x4eae61
mov rsi, rax
test rax, rax
jne 0x4eae2b
mov rcx, qword [0x00576170]
test rcx, rcx
jne 0x4eadf0
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x4eae79
mov rcx, rax
mov qword [0x00576170], rax
mov r8d, 0x18
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x4eae79
mov rsi, rax
mov qword [rax], 0
lea rax, [0x00502138]
mov qword [rsi + 0x10], rax
mov ecx, dword [0x00502150]
test ecx, ecx
je 0x4eae69
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
lea rax, [rsi + 8]
mov qword [rsi], 1
mov qword [rsi + 8], 0
add rsp, 0x20
pop rsi
ret
lea rcx, [0x00502138]
call fcn.004dae70
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x4eadc4
xor eax, eax
add rsp, 0x20
pop rsi
ret
lea rcx, [0x00502138]
call fcn.004dae70
mov ecx, eax
jmp 0x4eae23
mov ecx, 0x18
mov edx, 8
call fcn.004043b0
ud2
Function at 0x4ec0f9
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
lea rcx, [0x005021c8]
call fcn.00459f35
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x4ec127
mov rsi, rax
mov rax, qword [rax]
test rax, rax
cmove rsi, rax
jne 0x4ec191
lea rdi, [0x005021c8]
mov rcx, rdi
call fcn.00459f35
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x4ec18f
mov rsi, rax
test rax, rax
jne 0x4ec172
mov ecx, 0x10
call fcn.0043a319
mov rsi, rax
and qword [rax], 0
mov qword [rax + 8], rdi
mov rcx, rdi
call fcn.00459f35
mov ecx, eax
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
call fcn.004ebf46
mov rcx, qword [rsi]
mov qword [rsi], rax
test rcx, rcx
je 0x4ec191
lock dec qword [rcx]
jne 0x4ec191
call fcn.004f04d2
jmp 0x4ec191
xor esi, esi
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x4ed884
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x4ed88b
test al, 1
je 0x4ed8aa
test al, 2
jne 0x4ed8bf
xor rax, 3
add rsp, 0x28
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x0053baa8]
mov edx, 0x23
jmp 0x4ed8d2
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x0053bae8]
mov edx, 0x25
call fcn.0042f210
ud2

Function at 0x4eed56
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, edx
call fcn.004f219e
movzx ecx, bl
lea r9, [rsp + 0x2c]
mov dword [r9], ecx
mov rcx, qword [rax + 8]
mov dword [rsp + 0x20], 4
mov edx, 6
mov r8d, 1
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x4eed92
xor eax, eax
jmp 0x4eed9f
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x30
pop rbx
ret
Function at 0x4eeda5
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rdi, r9
mov rbx, r8
mov r14, rdx
mov qword [rsp + 0x28], rcx
mov rax, qword [rsp + 0xc0]
lea rbp, [rdx + 0x10]
lea r15, [rsp + 0x42]
xor r12d, r12d
cmp qword [rdx + 8], 0xffffffffffffffff
cmovne r12, rdx
mov r13d, 0x7fffffff
cmp rax, r13
cmovb r13, rax
mov qword [rsp + 0x30], r12
mov rdx, qword [r14 + 0x20]
lea rcx, [rsp + 0x38]
mov r8, rbx
call fcn.004ec67d
mov al, byte [rsp + 0x41]
cmp al, 3
je 0x4eef09
mov rcx, qword [rsp + 0x38]
cmp al, 2
je 0x4eef17
mov dl, byte [rsp + 0x40]
movzx r8d, word [r15 + 4]
lea r9, [rsp + 0x52]
mov word [r9 + 4], r8w
mov r8d, dword [r15]
mov dword [r9], r8d
mov qword [rsp + 0x48], rcx
mov byte [rsp + 0x50], dl
mov byte [rsp + 0x51], al
mov rcx, r12
lea rdx, str._usr_local_cargo_registry_src_index.crates.io_6f17d22bba15001f_tokio_1.40.0_src_io_poll_evented.rs
call fcn.004f21b5
mov rcx, qword [r12 + 8]
mov rdx, rdi
mov r8d, r13d
xor r9d, r9d
call sub.ws2_32.dll_send
cmp eax, 0xffffffff
jne 0x4eef29
call sub.ws2_32.dll_WSAGetLastError
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov rcx, rsi
call fcn.00457bb8
cmp al, 0xd
jne 0x4eeee3
mov rax, qword [r12]
test rax, rax
je 0x4eeee3
mov rcx, qword [rax + 8]
mov rdx, qword [rax + 0x10]
lock inc qword [rdx]
jle 0x4eef5b
mov r12, r13
mov r13, rbx
add rcx, 0x10
mov r8, qword [rax]
mov r9b, byte [rax + 0x18]
call fcn.00457aa2
mov rbx, rax
xor ecx, ecx
call fcn.00457bf8
test rbx, rbx
je 0x4eeed8
mov ecx, 1
mov rdx, rsi
call fcn.00457c02
mov rsi, rbx
mov rbx, r13
mov r13, r12
mov r12, qword [rsp + 0x30]
mov rcx, rsi
call fcn.00457bb8
cmp al, 0xd
jne 0x4eef3a
mov rcx, rbp
lea rdx, [rsp + 0x48]
call fcn.004ec8a5
mov rcx, rsi
call fcn.004f1be9
jmp 0x4eedf2
mov rax, qword [rsp + 0x28]
mov qword [rax], 2
jmp 0x4eef4a
mov rax, qword [rsp + 0x28]
mov qword [rax], 1
mov qword [rax + 8], rcx
jmp 0x4eef4a
cdqe
mov rcx, qword [rsp + 0x28]
and qword [rcx], 0
mov qword [rcx + 8], rax
jmp 0x4eef4a
mov rax, qword [rsp + 0x28]
mov qword [rax], 1
mov qword [rax + 8], rsi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
Function at 0x4f1d3f
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov r14, rcx
lea rcx, [0x005021f0]
call fcn.00459f35
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x4f1d7e
mov rbx, rax
mov rax, qword [rax]
add rbx, 8
test rax, rax
cmove rbx, rax
jne 0x4f1e4a
lea rsi, [0x005021f0]
mov rcx, rsi
call fcn.00459f35
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x4f1df2
mov rbx, rax
test rax, rax
jne 0x4f1dc9
mov ecx, 0x58
call fcn.0043a319
mov rbx, rax
and qword [rax], 0
mov qword [rax + 0x50], rsi
mov rcx, rsi
call fcn.00459f35
mov ecx, eax
mov rdx, rbx
call sub.kernel32.dll_TlsSetValue
test r14, r14
je 0x4f1e00
lea rax, [rsp + 0x20]
mov ecx, 0xa
mov rdi, rax
mov rsi, r14
rep movsq qword [rdi], qword [rsi]
and qword [r14], 0
cmp qword [rax], 0
je 0x4f1df6
lea rsi, [rsp + 0x28]
jmp 0x4f1e07
xor ebx, ebx
jmp 0x4f1e4a
lea rcx, [rsp + 0x20]
call fcn.004eda54
lea rsi, [0x0053bdc0]
lea rdi, [rsp + 0x70]
mov ecx, 9
rep movsq qword [rdi], qword [rsi]
lea rax, [rsp + 0x20]
mov ecx, 0xa
mov rdi, rax
mov rsi, rbx
rep movsq qword [rdi], qword [rsi]
mov qword [rbx], 1
add rbx, 8
lea rsi, [rsp + 0x70]
mov ecx, 9
mov rdi, rbx
rep movsq qword [rdi], qword [rsi]
mov rcx, rax
call fcn.004eda54
mov rax, rbx
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x500b60
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00501890
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.00501890
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x500bd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x00576274]
mov r12, rcx
test ebx, ebx
jle 0x500d00
mov rax, qword [0x00576278]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x500c1c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x500ca3
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x500c00
mov rcx, r12
call fcn.00501580
mov rsi, rax
test rax, rax
je 0x500d22
mov rax, qword [0x00576278]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call fcn.005016b0
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00576278]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x500d07
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x500c9c
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x500cb0
add dword [0x00576274], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x00576278]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x500c9c
call qword [sym.imp.kernel32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00500b60
nop dword [rax]
xor ebx, ebx
jmp 0x500c27
mov rax, qword [0x00576278]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.00500b60
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.00500b60
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x5011f0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x005762e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x005762c0]
test rbx, rbx
je 0x501244
mov rdi, qword [sym.imp.kernel32.dll_TlsGetValue]
mov rsi, qword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x50123b
test r12, r12
je 0x50123b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x501220
lea rcx, [0x005762e0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x501580
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x00563e00]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x5015a0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x5015a8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x5015a0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x5015f5
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x5015ec
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x5015a0
add rax, 0x28
cmp rax, r9
jne 0x5015d8
xor eax, eax
ret

Function at 0x501600
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x00563e00]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x501620
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x501628
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x501620
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x5016b0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x00563e00]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x5016d0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x5016d8
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x14013331e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [rbp + 8], 0xf6f6f6f6
mov dword [rbp + 0x5c], 0x7d78732a
mov dword [rbp + 0xc], 0xf6f6f6f6
mov dword [rbp + 0x60], 0x76766b7e
jne 0x1401330ea
je 0x1401330ea
lea r8d, [rcx + 0x43a0]
div r11
popfq
pop rdi
jmp rax
jmp 0x140133104
mov word [rbp + 0x10], 0xf6f6
mov dword [rbp + 0x64], 0x386e6f
mov byte [rbp + 0x12], 0xf6
nop word [rax + rax]
movzx eax, byte [rbp + rdx + 0x14]
movzx ecx, byte [rbp + rdx - 0x40]
add cl, al
je 0x14013314f
jne 0x14013314f
jnp 0x140133729
call rcx
lea ecx, [rdi - 0xef27]
cmp r14d, 0xc6149678
call rax
mov r10d, 0xc28e592b
rol r8d, 0xeb
ret
jmp 0x1401332a9
jb 0x140133383
nop
mov byte [rsp + rsi + 0x36], 0
inc rsi
cmp rsi, 5
jmp 0x1401332ca
mov dword [rbp - 4], 0xf6f6f6f6
mov dword [rbp + 0x50], 0x6b7e7f6c
mov dword [rbp], 0xf6f6f6f6
mov dword [rbp + 0x54], 0x7d6f766c
mov dword [rbp + 4], 0xf6f6f6f6
mov dword [rbp + 0x58], 0x6f7c6b2a
jmp 0x1401330ba
lea r8, [rsp + 0x36]
lea rdx, [rbp + 0x14]
xor ecx, ecx
call r13
mov rax, rsi
jmp 0x140133378
mov dword [rbp - 0x38], 0xf6f6f6f6
mov dword [rbp + 0x1c], 0x78732a79
mov dword [rbp - 0x34], 0xf6f6f6f6
mov dword [rbp + 0x20], 0x6b737e73
jmp 0x1401333d6
mov dword [rbp - 0x24], 0xf6f6f6f6
mov dword [rbp + 0x30], 0x2a6f756b
mov dword [rbp - 0x20], 0xf6f6f6f6
mov dword [rbp + 0x34], 0x6f7c7f7d
mov dword [rbp - 0x1c], 0xf6f6f6f6
jmp 0x140133394
mov dword [rbp - 0x40], 0xf6f6f6f6
mov rdx, rsi
mov dword [rbp + 0x14], 0x76736b50
mov dword [rbp - 0x3c], 0xf6f6f6f6
mov dword [rbp + 0x18], 0x7e2a6e6f
jmp 0x140133214
mov dword [rbp + 0x44], 0x2a35354d
mov dword [rbp - 0xc], 0xf6f6f6f6
mov dword [rbp + 0x48], 0x736e6f5c
mov dword [rbp - 8], 0xf6f6f6f6
mov dword [rbp + 0x4c], 0x737c7e7d
jmp 0x1401331c3
mov byte [rbp + rdx + 0x14], cl
mov byte [rbp + rdx - 0x40], sil
inc rdx
cmp rdx, 0x53
jb 0x14013311b
mov r9d, 0x10
jmp 0x1401331f2
jb 0x1401331b2
movzx eax, byte [rsp + rdx + 0x36]
movzx ecx, byte [rsp + rdx + 0x30]
add cl, al
mov byte [rsp + rdx + 0x36], cl
jne 0x140133343
je 0x140133343
and r12d, 0x5853ef73
lea ecx, [rbp + 0x463f]
jmp rax
jmp 0x140133361
mov byte [rsp + rdx + 0x30], sil
inc rdx
cmp rdx, 5
jb 0x14013330e
jmp 0x14013325d
nop word [rax + rax]
mov byte [rbp + rax + 0x14], sil
inc rax
cmp rax, 0x53
jmp 0x1401331aa
mov dword [rbp + 0x38], 0x6f727e2a
mov dword [rbp - 0x18], 0xf6f6f6f6
mov dword [rbp + 0x3c], 0x7d73602a
mov dword [rbp - 0x14], 0xf6f6f6f6
mov dword [rbp + 0x40], 0x2a766b7f
mov dword [rbp - 0x10], 0xf6f6f6f6
jmp 0x140133281
mov dword [rbp - 0x30], 0xf6f6f6f6
mov dword [rbp + 0x24], 0x6f847376
mov dword [rbp - 0x2c], 0xf6f6f6f6
mov dword [rbp + 0x28], 0x55572a44
mov dword [rbp - 0x28], 0xf6f6f6f6
mov dword [rbp + 0x2c], 0x57143c4c
jmp 0x140133235
loopne 0x14013372a
call rcx
lea r9d, [rdx + 0xf9c1]
call rcx
lea r9d, [rbx + 0x4350]
rol dword [rbp + rcx*4 - 0x76], 1
sar ecx, 0
add bh, bh
rol dword [rbp + rcx*4 - 0x75], 1
push rax
add byte [r8], al
movabs r11, 0xf11fefffffe89e9
ror r9d, 0x36
int3
Function at 0x140007d80
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rcx, qword [0x1400420c0]
test rcx, rcx
je 0x140007dbb
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140007de0
mov rcx, qword [0x1400420c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x1400430e0], 0
jne 0x140007df8
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, qword [0x1400420c0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x140007dae
mov edx, 0x414
lea r12, [rsp + 0x20]
lea rsi, [0x14001e3f2]
mov qword [rsp + 0x20], 0
lea rdi, [0x140043100]
movq xmm0, rsi
mov rcx, r12
mov dword [rsp + 0x28], 3
movq xmm6, rdi
mov word [rsp + 0x40], dx
mov rbp, qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, 0x14
punpcklqdq xmm6, xmm0
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], rsi
movaps xmmword [rsp + 0x30], xmm6
call rbp
mov r13, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140007ec4
test al, 0x10
je 0x140007dc4
mov ecx, 0x64
call r14
mov eax, 0x414
mov qword [rsp + 0x50], rsi
mov rcx, r12
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 3
mov word [rsp + 0x40], ax
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
movaps xmmword [rsp + 0x30], xmm6
call rbp
sub ebx, 1
je 0x140007dc4
mov rcx, rdi
call r13
cmp eax, 0xffffffff
jne 0x140007e70
jmp 0x140007dc4

Function at 0x14000e530
Capabilities:
Create directory

Disassembly:
push rdi
mov eax, 0x2020
push rsi
push rbx
call fcn.1400159f0
sub rsp, rax
mov eax, dword [0x140047100]
mov rsi, rcx
test eax, eax
je 0x14000e5d0
xor ebx, ebx
lea rdi, [0x140045100]
test eax, eax
jg 0x14000e56c
jmp 0x14000e580
add rbx, 1
cmp dword [0x140047100], ebx
jle 0x14000e580
mov rdx, qword [rdi + rbx*8]
mov rcx, rsi
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x14000e560
jmp 0x14000e5b7
mov rcx, rsi
call sub.msvcrt.dll_wcslen
cmp rax, 2
jne 0x14000e595
cmp word [rsi + 2], 0x3a
je 0x14000e5b7
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14000e620
movsxd rbx, dword [0x140047100]
cmp ebx, 0x3ff
jle 0x14000e638
mov eax, 1
add rsp, 0x2020
pop rbx
pop rsi
pop rdi
ret
lea rdi, [rsp + 0x20]
lea rbx, str.HOME
mov r8d, 0x1000
mov rdx, rbx
mov rcx, rdi
call fcn.140007540
test al, al
je 0x14000e65a
movsxd rbx, dword [0x140047100]
mov rcx, rdi
lea rdi, [0x140045100]
call sub.msvcrt.dll__wcsdup
mov qword [rdi + rbx*8], rax
mov eax, dword [0x140047100]
add eax, 1
mov dword [0x140047100], eax
jmp 0x14000e551
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000e5a4
xor eax, eax
jmp 0x14000e5bc
mov rcx, rsi
call sub.msvcrt.dll__wcsdup
add dword [0x140047100], 1
mov rdx, rax
lea rax, [0x140045100]
mov qword [rax + rbx*8], rdx
jmp 0x14000e5b7
mov rcx, rbx
call fcn.140007cc0
nop
nop word cs:[rax + rax]
nop
Function at 0x180001394
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rbx, rcx
je 0x1800013f8
xor edi, edi
cmp dword [rcx + 0xc], edi
jbe 0x1800013e6
mov rax, qword [rbx]
xor edx, edx
mov r8d, dword [rax + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1800013df
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x1800013b3
mov r8, qword [rbx]
xor edx, edx
mov rcx, qword [0x18001ce38]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180001408
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov dword [rax + 0x10], edx
push rdi
sub rsp, 0x20
mov eax, ecx
imul rdi, rax, 0x38
add rdi, qword [0x18001ee80]
mov rdx, qword [rdi]
mov cl, byte [rdi + 0x20]
mov rsi, rdx
lea rbx, [rdx - 5]
and cl, 1
je 0x180001441
mov rsi, rbx
movzx eax, cl
lea r9, [rsp + 0x38]
test cl, cl
mov r8d, 0x40
cmove rbx, rdx
lea rbp, [rax*2 + 5]
mov rcx, rbx
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180001474
mov eax, 0xa
jmp 0x1800014c1
mov byte [rbx], 0xe9
mov eax, dword [rdi + 8]
sub eax, esi
sub eax, 5
mov dword [rbx + 1], eax
test byte [rdi + 0x20], 1
je 0x180001490
mov rax, qword [rdi]
mov word [rax], 0xf9eb
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [rdi + 0x20], 6
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x180001828
Capabilities:
Check for software breakpoints

Disassembly:
mov r8b, byte [rcx]
mov r9d, edx
test r8b, r8b
je 0x18000183f
cmp r8b, 0x90
je 0x18000183f
cmp r8b, 0xcc
jne 0x180001861
mov r10d, 1
mov edx, r10d
cmp r9d, r10d
jbe 0x18000185d
mov eax, edx
cmp byte [rax + rcx], r8b
jne 0x180001861
add edx, r10d
cmp edx, r9d
jb 0x18000184d
mov eax, r10d
ret
xor eax, eax
ret