joyce8/EMBER2024-capa huggingface dataset:
Function at 0x617c2aa0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x617c88c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x617c88a0]
test rbx, rbx
je 0x617c2af4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x617c2aeb
test r12, r12
je 0x617c2aeb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x617c2ad0
lea rcx, [0x617c88c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x617c2e30
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x617c52a0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x617c2ea9
mov rcx, r10
call fcn.617c2d00
test eax, eax
je 0x617c2ea9
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x617c2ea6
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x617c2e9d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x617c2ea9
add r8, 0x28
cmp r8, r9
jne 0x617c2e88
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x1400d164a
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
jmp 0x140123670
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x218
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x4e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x238]
mov rax, qword [0x1402f8118]
xor rax, rbp
mov qword [rbp + 0x1e8], rax
lea rcx, [0x1403161c6]
call fcn.1400d7112
mov qword [rbp + 8], 0
mov dword [rbp + 0x24], 0
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 0x24]
mov rdx, qword [rbp + 8]
mov ecx, 0xb
call fcn.1400d579a
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0xc0000004
jne 0x14012373b
cmp qword [rbp + 8], 0
je 0x140123703
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rbp + 0x24]
mov r9d, 4
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 8], rax
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 0x24]
mov rdx, qword [rbp + 8]
mov ecx, 0xb
call fcn.1400d579a
mov dword [rbp + 0x44], eax
jmp 0x1401236e1
cmp dword [rbp + 0x44], 0
jge 0x140123761
cmp qword [rbp + 8], 0
je 0x14012375a
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x140123897
mov rax, qword [rbp + 8]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x140123777
xor eax, eax
jmp 0x140123897
mov dword [rbp + 0x84], 0
jmp 0x140123791
mov eax, dword [rbp + 0x84]
inc eax
mov dword [rbp + 0x84], eax
mov rax, qword [rbp + 0x68]
mov eax, dword [rax]
cmp dword [rbp + 0x84], eax
jae 0x140123883
mov eax, dword [rbp + 0x84]
imul rax, rax, 0x128
mov rcx, qword [rbp + 0x68]
lea rax, [rcx + rax + 8]
mov ecx, dword [rbp + 0x84]
imul rcx, rcx, 0x128
mov rdx, qword [rbp + 0x68]
movzx ecx, word [rdx + rcx + 0x2e]
lea rax, [rax + rcx + 0x28]
mov rdx, rax
lea rcx, [rbp + 0xa8]
call fcn.1400d3c33
mov rcx, qword [rbp + 0x210]
call fcn.1400d191a
mov qword [rbp + 0x1d8], rax
lea rcx, [rbp + 0xa8]
call fcn.1400d191a
mov qword [rbp + 0x1e0], rax
mov rdx, qword [rbp + 0x1d8]
mov rcx, qword [rbp + 0x1e0]
call fcn.1400d3ef4
test eax, eax
jne 0x140123872
mov eax, dword [rbp + 0x84]
imul rax, rax, 0x128
mov rcx, qword [rbp + 0x68]
mov rax, qword [rcx + rax + 0x18]
mov qword [rbp + 0xe8], rax
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x1c8], rax
lea rcx, [rbp + 0xa8]
call fcn.1400d2234
mov rax, qword [rbp + 0x1c8]
jmp 0x140123897
lea rcx, [rbp + 0xa8]
call fcn.1400d2234
jmp 0x140123783
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1402a30d0]
call fcn.1400d5fdd
mov rax, rdi
mov rcx, qword [rbp + 0x1e8]
xor rcx, rbp
call fcn.1400d3ef9
lea rsp, [rbp + 0x1f8]
pop rdi
pop rbp
ret
Function at 0x1400d212b
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x140146430
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp], 0
jmp 0x140146458
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jae 0x1401464a2
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x20]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14014644d
mov rax, qword [rsp + 0x20]
add rsp, 0x18
ret

Function at 0x1400d28a1
Capabilities:
Delete file

Disassembly:
jmp 0x1401a88c0
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1401a88ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400d2cac
mov eax, 0xffffffff
jmp 0x1401a88ee
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400d2a9f
Capabilities:
Get common file path

Disassembly:
jmp 0x140123480
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x448
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x468]
mov rax, qword [0x1402f8118]
xor rax, rbp
mov qword [rbp + 0x410], rax
mov dword [rbp + 0x3f4], 0
lea rcx, [0x1403161c6]
call fcn.1400d7112
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rdx, [rbp + 0x10]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [rbp + 0x234], eax
cmp dword [rbp + 0x234], 0
je 0x14012350d
cmp dword [rbp + 0x234], 0x105
jbe 0x140123565
lea rdx, str.____Failed_to_get_temp_path
lea rcx, [0x1402fb200]
call fcn.1400d41ba
mov qword [rbp + 0x408], rax
lea rdx, [0x1400d3f3a]
mov rcx, qword [rbp + 0x408]
call fcn.1400d5bff
lea rdx, [0x14029bd84]
mov rcx, qword [rbp + 0x440]
call fcn.1400d30f8
mov eax, dword [rbp + 0x3f4]
or eax, 1
mov dword [rbp + 0x3f4], eax
mov rax, qword [rbp + 0x440]
jmp 0x1401235d5
lea rcx, [rbp + 0x10]
call fcn.1400d166d
movzx eax, word [rbp + rax*2 + 0xe]
cmp eax, 0x5c
jne 0x1401235af
lea rcx, [rbp + 0x10]
call fcn.1400d166d
lea rax, [rax + rax - 2]
mov qword [rbp + 0x3d8], rax
cmp qword [rbp + 0x3d8], 0x20a
jae 0x14012359c
jmp 0x1401235a1
call fcn.1400d559c
xor eax, eax
mov rcx, qword [rbp + 0x3d8]
mov word [rbp + rcx + 0x10], ax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x440]
call fcn.1400d30f8
mov eax, dword [rbp + 0x3f4]
or eax, 1
mov dword [rbp + 0x3f4], eax
mov rax, qword [rbp + 0x440]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1402a2ef0]
call fcn.1400d5fdd
mov rax, rdi
mov rcx, qword [rbp + 0x410]
xor rcx, rbp
call fcn.1400d3ef9
lea rsp, [rbp + 0x428]
pop rdi
pop rbp
ret
Function at 0x1400d312a
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x140123300
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x20]
lea rcx, [0x1403161c6]
call fcn.1400d7112
mov rcx, qword [rbp + 0x180]
call fcn.1400d3b9d
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x188]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x188]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
movzx eax, word [rax + 0x14]
mov rcx, qword [rbp + 0x28]
lea rax, [rcx + rax + 0x18]
mov qword [rbp + 0x48], rax
mov dword [rbp + 0x64], 0
jmp 0x14012337b
mov eax, dword [rbp + 0x64]
inc eax
mov dword [rbp + 0x64], eax
mov rax, qword [rbp + 0x28]
movzx eax, word [rax + 6]
cmp dword [rbp + 0x64], eax
jae 0x140123423
mov eax, dword [rbp + 0x64]
imul rax, rax, 0x28
mov rcx, qword [rbp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
mov r8, qword [rbp + 8]
mov rdx, qword [rbp + 0x180]
mov rcx, rax
call fcn.1400d346d
test eax, eax
jne 0x14012341e
mov rax, qword [rbp + 0x88]
mov rcx, rax
call fcn.1400d3b9d
cmp qword [rbp + 8], rax
jne 0x14012341e
mov rax, qword [rbp + 0x88]
cmp dword [rax + 0xc], 0
jne 0x1401233e8
xor eax, eax
jmp 0x140123425
cmp qword [rbp + 0x190], 0
je 0x140123405
mov rax, qword [rbp + 0x190]
mov rcx, qword [rbp + 0x88]
mov ecx, dword [rcx + 8]
mov dword [rax], ecx
mov rax, qword [rbp + 0x88]
mov eax, dword [rax + 0xc]
mov rcx, qword [rbp + 0x188]
add rcx, rax
mov rax, rcx
jmp 0x140123425
jmp 0x140123373
xor eax, eax
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret

Function at 0x1400d3b9d
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1401a01c0
mov rax, rcx
neg rcx
test rax, 7
je 0x1401a01dd
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1401a0238
test al, 7
jne 0x1401a01d0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1401a01f1
mov rdx, qword [rax - 8]
test dl, dl
je 0x1401a0262
test dh, dh
je 0x1401a025c
shr rdx, 0x10
test dl, dl
je 0x1401a0256
test dh, dh
je 0x1401a0250
shr rdx, 0x10
test dl, dl
je 0x1401a024a
test dh, dh
je 0x1401a0244
shr edx, 0x10
test dl, dl
je 0x1401a023e
test dh, dh
jne 0x1401a01f1
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret
Function at 0x1400d3bd4
Capabilities:
Query environment variable

Disassembly:
jmp 0x140254f30
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140254ab0
lea rcx, [rsp + 0x20]
call fcn.140254b00
movzx eax, al
test eax, eax
jne 0x140254f75
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.140254ae0
mov rax, qword [rsp + 0x40]
jmp 0x14025506f
lea rcx, [rsp + 0x20]
call fcn.140254c00
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.140254ba0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.1400d3ffd
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400d343b
lea rcx, [rsp + 0x28]
call fcn.1400d4575
movzx eax, al
test eax, eax
jne 0x14025500f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.1400d5d49
lea rcx, [rsp + 0x20]
call fcn.140254ae0
mov rax, qword [rsp + 0x50]
jmp 0x14025506f
lea rcx, [rsp + 0x20]
call fcn.140254c00
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.1400d6fe1
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.1400d3f21
lea rcx, [rsp + 0x28]
call fcn.1400d7aef
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.1400d5d49
lea rcx, [rsp + 0x20]
call fcn.140254ae0
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret
Function at 0x1400d41a6
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x14019c180
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.14019bb00
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14019c1bf
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140318020]
jmp 0x14019c1c9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret

Function at 0x1400d44a3
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x14019c0b0
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.14019ba80
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14019c0f1
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140318020]
jmp 0x14019c0f7
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret

Function at 0x1400d457f
Capabilities:
Get geographical location

Disassembly:
jmp 0x1402354b0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.1402343e0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140235517
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x140318030]
jmp 0x140235539
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.1400d35f8
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x1400d45a7
Capabilities:
Terminate process

Disassembly:
jmp 0x1401775d0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400d4999
Capabilities:
Print debug messages

Disassembly:
jmp 0x1402625e0
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x1402f8118]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x140262606
jmp 0x140262683
mov rcx, qword [rbp + 0x30]
call fcn.1400d3b9d
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x14026261f
jmp 0x140262683
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x14026263c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400d21e9
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.1400d2914
test eax, eax
jne 0x140262683
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.1400d3ef9
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x1400d4ec6
Capabilities:
Set environment variable

Disassembly:
jmp 0x140256de0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret
Function at 0x1400d5272
Capabilities:
Parse pe header

Disassembly:
jmp 0x140178f40
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140178f60
xor al, al
jmp 0x140178fe1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140178f73
xor al, al
jmp 0x140178fe1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140178f9d
xor al, al
jmp 0x140178fe1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140178fb1
xor al, al
jmp 0x140178fe1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140178fc3
xor al, al
jmp 0x140178fe1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140178fdf
xor al, al
jmp 0x140178fe1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400d5bfa
Capabilities:
Terminate process

Disassembly:
jmp 0x14019d150
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14019d17e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.1400d69bf
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400d6596
Capabilities:
Parse pe header

Disassembly:
jmp 0x14011e660
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x14031612e]
call fcn.1400d7112
mov rax, qword [rbp + 0x120]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14011e69c
xor eax, eax
jmp 0x14011e6c9
mov rax, qword [rbp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x120]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
cmp dword [rax], 0x4550
je 0x14011e6c5
xor eax, eax
jmp 0x14011e6c9
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1400d6a55
Capabilities:
Print debug messages

Disassembly:
jmp 0x140230ff0
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x1400d6aeb
Capabilities:
Get explorer pid

Disassembly:
jmp 0x140111110
push rbp
push rdi
sub rsp, 0x138
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1402f8118]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x140316096]
call fcn.1400d7112
mov dword [rbp + 4], 0
call qword [sym.imp.USER32.dll_GetShellWindow]
lea rdx, [rbp + 4]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call fcn.1400d78fb
mov dword [rbp + 0x24], eax
mov eax, dword [rbp + 4]
cmp dword [rbp + 0x24], eax
jne 0x1401111dd
lea rdx, str.___Pausing_to_allow_for_debugging
lea rcx, [0x1402fb200]
call fcn.1400d41ba
mov qword [rbp + 0xf8], rax
lea rdx, [0x1400d3f3a]
mov rcx, qword [rbp + 0xf8]
call fcn.1400d5bff
lea rdx, str.___Press_enter_to_close
lea rcx, [0x1402fb200]
call fcn.1400d41ba
mov qword [rbp + 0xf8], rax
lea rdx, [0x1400d3f3a]
mov rcx, qword [rbp + 0xf8]
call fcn.1400d5bff
lea rcx, [0x1402fb410]
call fcn.1400d3a12
lea rcx, [rbp - 0x20]
lea rdx, [0x14029fde0]
call fcn.1400d5fdd
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.1400d3ef9
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret

Function at 0x1400d6bea
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x14019c1f0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.14019bb40
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14019c239
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140318020]
jmp 0x14019c248
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret
Function at 0x1400d6dd9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140277fc0
mov word [rsp + 0x10], dx
mov qword [rsp + 8], rcx
sub rsp, 0x48
movzx eax, word [rsp + 0x58]
movd xmm0, eax
movdqa xmmword [rsp + 0x20], xmm0
pshuflw xmm0, xmmword [rsp + 0x20], 0
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [rsp + 0x20]
pshufd xmm0, xmm0, 0
movdqa xmmword [rsp + 0x20], xmm0
mov rax, qword [rsp + 0x50]
and rax, 0xfff
cmp rax, 0xff0
ja 0x1402780d1
mov rax, qword [rsp + 0x50]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [rsp + 0x10]
pxor xmm0, xmmword [rsp + 0x10]
movdqa xmmword [rsp + 0x10], xmm0
movdqa xmm0, xmmword [rsp + 0x10]
pcmpeqw xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x10], xmm0
movdqa xmm0, xmmword [rsp + 0x30]
pcmpeqw xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [rsp + 0x10]
por xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x10], xmm0
movdqa xmm0, xmmword [rsp + 0x10]
pmovmskb eax, xmm0
mov dword [rsp], eax
cmp dword [rsp], 0
je 0x1402780c1
mov eax, dword [rsp]
bsf eax, eax
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
add rax, qword [rsp + 0x50]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x58]
cmp eax, ecx
jne 0x1402780b1
mov rax, qword [rsp + 0x50]
mov qword [rsp + 8], rax
jmp 0x1402780ba
mov qword [rsp + 8], 0
mov rax, qword [rsp + 8]
jmp 0x14027810c
mov rax, qword [rsp + 0x50]
add rax, 0x10
mov qword [rsp + 0x50], rax
jmp 0x140278107
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x58]
cmp eax, ecx
jne 0x1402780e9
mov rax, qword [rsp + 0x50]
jmp 0x14027810c
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
test eax, eax
jne 0x1402780f9
xor eax, eax
jmp 0x14027810c
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
jmp 0x140277ffb
add rsp, 0x48
ret
Function at 0x1400d78fb
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140113f50
push rbp
push rdi
sub rsp, 0x468
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xb2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1402f8118]
xor rax, rbp
mov qword [rbp + 0x438], rax
lea rcx, [0x140316096]
call fcn.1400d7112
mov dword [rbp + 0x284], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp + 0x2a4], eax
xor edx, edx
mov ecx, 2
call fcn.1400d3e31
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x140113fbc
jmp 0x14011400e
mov r8d, 0x238
xor edx, edx
lea rcx, [rbp + 0x30]
call fcn.1400d583a
mov dword [rbp + 0x30], 0x238
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.1400d4a43
test eax, eax
jne 0x140113fe7
jmp 0x14011400e
mov eax, dword [rbp + 0x2a4]
cmp dword [rbp + 0x38], eax
jne 0x140113ffd
mov eax, dword [rbp + 0x50]
mov dword [rbp + 0x284], eax
jmp 0x14011400e
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.1400d62a3
test eax, eax
jne 0x140113fe7
cmp qword [rbp + 8], 0xffffffffffffffff
je 0x14011401f
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x284]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14029fd60]
call fcn.1400d5fdd
mov rax, rdi
mov rcx, qword [rbp + 0x438]
xor rcx, rbp
call fcn.1400d3ef9
lea rsp, [rbp + 0x448]
pop rdi
pop rbp
ret