joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000166cc
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
and qword [rsp + 0x58], 0
xor ebx, ebx
lea rax, [rsp + 0x58]
and dword [rsp + 0x48], ebx
lea rdx, [0x100004950]
lea r9d, [rbx + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_RegOpenKeyExW]
mov r9d, eax
test eax, eax
jne 0x1000167b9
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
lea rdx, [0x100004998]
xor r8d, r8d
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
test eax, eax
jne 0x10001675b
cmp dword [rsp + 0x50], 4
jne 0x100016756
cmp dword [rsp + 0x40], 4
je 0x10001675b
mov eax, 0xd
movzx r9d, ax
or r9d, 0x80070000
test eax, eax
cmovle r9d, eax
test r9d, r9d
jne 0x10001677a
cmp dword [rsp + 0x48], ebx
sete bl
jmp 0x1000167f9
cmp r9d, 0x80070002
je 0x1000167be
mov rcx, qword [0x10001c770]
lea rax, [0x10001c770]
cmp rcx, rax
je 0x1000167f9
test byte [rcx + 0x3c], 1
je 0x1000167f9
cmp byte [rcx + 0x39], 1
jb 0x1000167f9
mov rcx, qword [rcx + 0x30]
lea r8, [0x100001e70]
mov edx, 0x15
call fcn.100005080
jmp 0x1000167f9
cmp eax, 2
jne 0x1000167c5
mov ebx, 1
jmp 0x1000167f9
mov rcx, qword [0x10001c770]
lea rax, [0x10001c770]
cmp rcx, rax
je 0x1000167f9
test byte [rcx + 0x3c], 1
je 0x1000167f9
cmp byte [rcx + 0x39], 1
jb 0x1000167f9
mov rcx, qword [rcx + 0x30]
lea r8, [0x100001e70]
mov edx, 0x16
call fcn.100005080
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x100016809
call qword [sym.imp.KERNEL32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x10001730c
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov rbp, r8
xor r13d, r13d
lea rax, [r11 + 0x20]
mov rsi, rcx
xor r9d, r9d
mov r8d, 0x40000001
mov rcx, rbp
mov qword [r11 - 0x28], rax
mov r12, rdx
mov ebx, r13d
mov dword [r11 + 0x20], r13d
mov rdi, r13
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
cmp eax, r13d
jne 0x1000173b0
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r13d
cmovle ebx, eax
cmp ebx, 0x800700ea
cmove ebx, r13d
cmp ebx, r13d
jge 0x1000173b0
mov rcx, qword [0x10001c770]
lea rax, [0x10001c770]
cmp rcx, rax
je 0x1000174a7
test byte [rcx + 0x3c], 1
je 0x1000174a7
cmp byte [rcx + 0x39], 1
jb 0x1000174a7
lea edx, [r13 + 0xa]
jmp 0x100017484
mov ecx, dword [rsp + 0x68]
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.100015d2c
mov rdi, rax
cmp rax, r13
jne 0x100017416
mov ebx, 0x8007000e
mov rcx, qword [0x10001c770]
lea rax, [0x10001c770]
cmp rcx, rax
je 0x1000174a7
test byte [rcx + 0x3c], 1
je 0x1000174a7
cmp byte [rcx + 0x39], 1
jb 0x1000174a7
mov r9d, dword [rsp + 0x68]
mov edx, 0xb
add r9d, r9d
jmp 0x100017487
mov r8d, dword [rsp + 0x68]
xor edx, edx
mov rcx, rax
add r8, r8
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x68]
mov r9, rdi
mov r8d, 0x40000001
mov edx, r12d
mov rcx, rbp
mov qword [rsp + 0x20], r11
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
cmp eax, r13d
jne 0x100017499
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r13d
cmovle ebx, eax
mov rcx, qword [0x10001c770]
lea rax, [0x10001c770]
cmp rcx, rax
je 0x1000174a7
test byte [rcx + 0x3c], 1
je 0x1000174a7
cmp byte [rcx + 0x39], 1
jb 0x1000174a7
mov edx, 0xc
mov r9d, ebx
mov rcx, qword [rcx + 0x30]
lea r8, [0x100001e20]
call fcn.100005080
jmp 0x1000174a7
mov rcx, qword [rsi]
call fcn.100015d5c
mov qword [rsi], rdi
mov rdi, r13
mov rcx, rdi
call fcn.100015d5c
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret

Function at 0x100017d68
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x100017db5
cmp rcx, 0xffffffffffffffff
je 0x100017db5
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x100017dad
cmp dword [rcx + 0x3c], edx
jl 0x100017dad
cmp dword [rcx + 0x3c], 0x10000000
jae 0x100017dad
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x100017db5
mov rax, rdx
add rsp, 0x18
ret
Function at 0x18001113b
Capabilities:
Write file on windows

Disassembly:
jmp 0x18001ea60
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1800450fd]
call fcn.180011b9f
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x18001eab7
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x18001ebc3
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x18001eb5c
cmp qword [rbp + 0x28], 0
jle 0x18001eb5c
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x18001eafc
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.180011afa
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x18001ebb2
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x18001ebb2
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x180011677
Capabilities:
Terminate process

Disassembly:
jmp 0x18002a800
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x180011ab9
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x180020630
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x128]
mov rax, qword [0x18003b480]
xor rax, rbp
mov qword [rbp + 0xd8], rax
lea rcx, [0x18004525f]
call fcn.180011b9f
lea r9, [rbp + 4]
mov r8d, 0x40
mov edx, 8
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, 8
mov rdx, qword [rbp + 0x108]
mov rcx, qword [rbp + 0x100]
call fcn.180011578
lea r9, [rbp + 4]
mov r8d, dword [rbp + 4]
mov edx, 8
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [rbp - 0x20]
lea rdx, [0x1800347b0]
call fcn.18001198d
mov rcx, qword [rbp + 0xd8]
xor rcx, rbp
call fcn.180011573
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x180011b7c
Capabilities:
Write file on windows

Disassembly:
jmp 0x180019eb0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
mov rax, qword [0x18003b480]
xor rax, rbp
mov qword [rbp + 0x170], rax
lea rcx, [0x1800450fd]
call fcn.180011b9f
mov rax, qword [rbp + 0x1a0]
cmp qword [rax + 0x68], 0
je 0x180019f16
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x180019f1d
mov al, 1
jmp 0x18001a08d
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x158], rax
call fcn.180011320
mov dword [rbp + 0x160], eax
mov edx, dword [rbp + 0x160]
mov rcx, qword [rbp + 0x1a0]
call qword [rbp + 0x158]
mov dword [rbp + 0x164], eax
call fcn.180011320
mov dword [rbp + 0x168], eax
mov edx, dword [rbp + 0x164]
mov ecx, dword [rbp + 0x168]
call fcn.18001191a
movzx eax, al
test eax, eax
je 0x180019f80
xor al, al
jmp 0x18001a08d
mov qword [rbp + 8], 0x20
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax + 0x68]
mov qword [rbp + 0x158], rax
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1a0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x160], eax
cmp dword [rbp + 0x160], 0
je 0x180019ff3
cmp dword [rbp + 0x160], 1
je 0x180019ffe
cmp dword [rbp + 0x160], 3
je 0x18001a07c
jmp 0x18001a08b
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x18001a04e
mov rax, qword [rbp + 0x1a0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x18001a04e
xor al, al
jmp 0x18001a08d
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x18001a069
mov dword [rbp + 0x154], 1
jmp 0x18001a073
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x18001a08d
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x18001a08d
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x180033810]
call fcn.18001198d
mov rax, rdi
mov rcx, qword [rbp + 0x170]
xor rcx, rbp
call fcn.180011573
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x180024160
Capabilities:
Suspend thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, rsp
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
mov qword [rax], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 8], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 0xc], 0
mov rcx, qword [rsp + 0x40]
call fcn.180023f50
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x180024237
mov dword [rsp + 0x20], 0
jmp 0x1800241d4
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x20], eax
jae 0x180024237
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180024235
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, dword [rsp + 0x50]
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
call fcn.180023d30
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800241ca
add rsp, 0x30
pop rdi
ret

Function at 0x180024250
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, rsp
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x1800242f4
mov dword [rsp + 0x20], 0
jmp 0x18002428d
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x20], eax
jae 0x1800242dd
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800242db
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180024283
mov rax, qword [rsp + 0x40]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x18003bd68]
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x30
pop rdi
ret
Function at 0x180024300
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x70
mov rdi, rsp
mov ecx, 0x1c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x80]
mov eax, dword [rsp + 0x80]
imul rax, rax, 0x38
mov rcx, qword [0x18003c500]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], 5
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x180024384
mov rax, qword [rsp + 0x50]
sub rax, 5
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
add rax, 2
mov qword [rsp + 0x48], rax
lea r9, [rsp + 0x34]
mov r8d, 0x40
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1800243ad
mov eax, 0xa
jmp 0x1800244e7
cmp dword [rsp + 0x88], 0
je 0x18002441b
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov byte [rax], 0xe9
mov rax, qword [rsp + 0x50]
add rax, 5
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x58]
mov dword [rcx + 1], eax
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x180024419
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov byte [rax], 0xeb
mov rax, qword [rsp + 0x60]
mov byte [rax + 1], 0xf9
jmp 0x180024467
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x18002444b
mov rax, qword [rsp + 0x20]
add rax, 0x18
mov r8d, 7
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call fcn.180011578
jmp 0x180024467
mov rax, qword [rsp + 0x20]
add rax, 0x18
mov r8d, 5
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call fcn.180011578
lea r9, [rsp + 0x34]
mov r8d, dword [rsp + 0x34]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx eax, byte [rsp + 0x88]
and al, 1
shl al, 1
mov rcx, qword [rsp + 0x20]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfd
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x20]
mov byte [rcx + 0x20], al
movzx eax, byte [rsp + 0x88]
and al, 1
shl al, 2
mov rcx, qword [rsp + 0x20]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfb
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x20]
mov byte [rcx + 0x20], al
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1800351c0]
call fcn.18001198d
mov rax, rdi
add rsp, 0x70
pop rdi
ret
Function at 0x180026240
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x10
mov rdi, rsp
mov ecx, 4
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x20]
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
test eax, eax
je 0x1800262ae
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
cmp eax, 0x90
je 0x1800262ae
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
cmp eax, 0xcc
je 0x1800262ae
xor eax, eax
jmp 0x1800262f5
mov dword [rsp], 1
jmp 0x1800262bf
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp], eax
jae 0x1800262f0
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x20]
movzx ecx, byte [rdx + rcx]
cmp eax, ecx
je 0x1800262ee
xor eax, eax
jmp 0x1800262f5
jmp 0x1800262b7
mov eax, 1
add rsp, 0x10
pop rdi
ret

Function at 0x1400111ef
Capabilities:
Terminate process

Disassembly:
jmp 0x140014f10
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001126c
Capabilities:
Parse pe header

Disassembly:
jmp 0x140012c20
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140012c40
xor al, al
jmp 0x140012cc1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140012c53
xor al, al
jmp 0x140012cc1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140012c7d
xor al, al
jmp 0x140012cc1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140012c91
xor al, al
jmp 0x140012cc1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140012ca3
xor al, al
jmp 0x140012cc1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140012cbf
xor al, al
jmp 0x140012cc1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400111ef
Capabilities:
Terminate process

Disassembly:
jmp 0x140015280
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011276
Capabilities:
Parse pe header

Disassembly:
jmp 0x140012f90
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140012fb0
xor al, al
jmp 0x140013031
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140012fc3
xor al, al
jmp 0x140013031
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140012fed
xor al, al
jmp 0x140013031
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140013001
xor al, al
jmp 0x140013031
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140013013
xor al, al
jmp 0x140013031
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001302f
xor al, al
jmp 0x140013031
mov al, 1
add rsp, 0x38
ret
Function at 0x140004ae0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, qword [rcx]
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x140004b41
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140004b00
mov ecx, dword [r9]
jmp 0x140004c28
cmp ecx, 0x4e0
jb 0x140004c28
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140004b60
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140004bb0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret