joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6daaacc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6dacb5e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6daaae48
mov rax, qword [0x6dacb5e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6daaad0c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6daaad95
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6daaacf0
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6daaae7d
mov rax, qword [0x6dacb5e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6dacb5e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6daaae60
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6daaad8e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6daaadf0
add dword [0x6dacb5e4], 1
cmp edi, 8
jae 0x6daaadc3
test dil, 4
jne 0x6daaae34
test edi, edi
je 0x6daaadb8
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6daaae4f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6daaadb8
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6daaaddc
jmp 0x6daaadb8
add rsi, qword [0x6dacb5e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6daaad8e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6daaadb8
xor esi, esi
jmp 0x6daaad17
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6daaadb8
mov rax, qword [0x6dacb5e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6daab5d0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6dacb8c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6dacb8a0]
test rbx, rbx
je 0x6daab624
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6daab61b
test rsi, rsi
je 0x6daab61b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6daab600
lea rcx, [0x6dacb8c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x6daab860
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6daab870
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6daab880
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6daab8c1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6daab8b8
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6daab8c3
add rax, 0x28
cmp rax, r9
jne 0x6daab8a4
xor eax, eax
ret

Function at 0x6daab960
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6dac81f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6daab9cd
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6daab9cd
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6daab9cd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6daab9c4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6daab9cf
add rax, 0x28
cmp rax, r9
jne 0x6daab9b0
xor eax, eax
add rsp, 0x28
ret

Function at 0x6daabad0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6dac81f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6daabaf0
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6daabae8
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6daabb4d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6daabb44
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6daabb54
add rax, 0x28
cmp rax, r9
jne 0x6daabb30
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6daabb70
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6dac81f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6daabbde
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6daabbde
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6daabbde
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6daabbde
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6daabbd5
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6daabbe5
add rcx, 0x28
cmp rcx, rax
jne 0x6daabbc0
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6daabbf8
jmp 0x6daabbde
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6daabc06
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6daabbde
test r9d, r9d
jg 0x6daabbf0
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6daabf40
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1406b9058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1406b91df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406b9089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406b906f
add dl, dl
jne 0x1406b9096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406b90f6
xor eax, eax
add dl, dl
jne 0x1406b90a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406b91ad
add dl, dl
jne 0x1406b90b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406b90c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406b90d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406b90dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406b90ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406b907e
mov eax, 1
add dl, dl
jne 0x1406b9106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406b9113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406b90fb
sub eax, ebx
mov ebx, 1
jne 0x1406b914c
mov ecx, 1
add dl, dl
jne 0x1406b912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406b913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406b9123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406b907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406b9168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406b9175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406b915d
cmp eax, 0x7d00
jae 0x1406b919b
cmp eax, 0x500
jb 0x1406b9196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406b907e
cmp eax, 0x7f
ja 0x1406b919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406b907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406b91d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406b907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140004da0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140004dfd
lea rbx, [0x14003de80]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140004de4
cmp r10, 2
jb 0x140004de4
cmp byte [r9], r8b
jne 0x140004de4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140004dc0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140004e3f
lea rbx, [0x14003de80]
cmp r8b, 0x23
jne 0x140004e23
cmp byte [r9], r8b
jne 0x140004e23
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140004e10
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140004f80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x140004f9a
mov qword [r8], 0
lea rdx, [0x14003d9f0]
call fcn.140004e50
mov rbx, rax
test rax, rax
jne 0x140004fba
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140005091
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140005091
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140005091
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140005091
cmp rdi, 0xffffffffffffffff
je 0x140005091
mov rax, qword [0x140064c48]
test rax, rax
je 0x14000502e
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140005091
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x14000507e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140064c48]
test rax, rax
je 0x140005073
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000509a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x14000508c
mov qword [r14], rdi
mov rax, rsi
jmp 0x14000509c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140007f90
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xf0]
lea r11, [0x14003de80]
mov rax, qword [rcx + 0xf8]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x140008026
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.14001a580
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x140013b20
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140049010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140064c48]
mov edi, ecx
cmp byte [rbx + 0x4a75], 0
jne 0x140013b81
cmp byte [rbx + 0x4a76], 0
jne 0x140013b81
movsx r9d, word [rbx + 0x5b9a]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140004d20
test dil, 1
je 0x140013caf
jmp 0x140013c0a
movss xmm1, dword [rbx + 0x389c]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5b9a]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x140042b7c]
mulss xmm1, dword [0x140042b70]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xe08]
addss xmm1, dword [rbx + 0xe0c]
mov qword [rbx + 0x47c0], rax
mov dword [rbx + 0x47ac], 1
movss dword [rbx + 0x47b8], xmm0
movss dword [rbx + 0x47bc], xmm1
movss xmm0, dword [rbx + 0x38f8]
mulss xmm0, dword [0x140042ab8]
or dword [rbx + 0x47a8], 0x41
movss dword [rbx + 0x4808], xmm0
call fcn.140004d20
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140013c60
lea r11, [0x14003de80]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x140013c43
cmp byte [r8], r9b
jne 0x140013c43
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140013c30
not ecx
call fcn.14000b560
test rax, rax
je 0x140013caf
cmp byte [rax + 0xb6], 0
je 0x140013caf
mov byte [rax + 0xbb], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xbd], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xd8], 1
mov edx, 0x10
inc word [rbx + 0x5b9a]
movsx r9d, word [rbx + 0x5b9a]
call fcn.140004d20
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000dcb0
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140038e90
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140018ec0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c80], 0
lea rbx, [rcx + 0x5c88]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140018f67
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x140018f1a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14001b190
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1400053e0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c80]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5c90]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x140064c40]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x140018f6f
mov rcx, rbx
call fcn.1400053e0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1400193f0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x140064c48]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x140019453
mov qword [rsp], rbx
lea rbx, [0x14003de80]
nop dword [rax]
cmp r9b, 0x23
jne 0x140019433
cmp byte [r8], r9b
jne 0x140019433
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x140019420
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5bf8]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x140019487
mov r10, qword [r10 + 0x5c00]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x14001948e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x140019474
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x1400399d0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140039a1a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140039a1a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140039a1a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140039a1a
cmp dword [rcx + 0x84], 0xe
jbe 0x140039a1a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140039a1c
xor al, al
add rsp, 0x28
ret
Function at 0x140003110
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xa0
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x140007570], rbx
je 0x140003166
cmp rax, rbx
jne 0x140003159
mov edi, 1
jmp 0x140003166
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140003140
mov eax, dword [0x14000756c]
cmp eax, 1
jne 0x14000317b
lea ecx, [rax + 0x1e]
call sub.MSVCR80.dll__amsg_exit
jmp 0x1400031ba
mov eax, dword [0x14000756c]
test eax, eax
jne 0x1400031b0
mov dword [0x14000756c], 1
lea rdx, [0x140004718]
lea rcx, [0x140004700]
call fcn.140181000
test eax, eax
je 0x1400031ba
mov eax, 0xff
jmp 0x140003314
mov dword [0x140006fdc], 1
mov eax, dword [0x14000756c]
cmp eax, 1
jne 0x1400031e2
lea rdx, [0x1400046f8]
lea rcx, [0x1400046c0]
call sub.MSVCR80.dll__initterm
mov dword [0x14000756c], 2
test edi, edi
jne 0x1400031ef
xor eax, eax
xchg qword [0x140007570], rax
cmp qword [0x140007578], 0
je 0x140003218
lea rcx, [0x140007578]
call fcn.140003870
test eax, eax
je 0x140003218
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x140007578]
mov rax, qword [sym.imp.MSVCR80.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
nop
nop
movzx ecx, byte [rbx]
cmp cl, 0x20
ja 0x1400032aa
test cl, cl
je 0x140003240
test edi, edi
jne 0x1400032aa
movzx eax, byte [rbx]
test al, al
je 0x140003256
cmp al, 0x20
ja 0x140003256
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x140003240
test byte [rsp + 0x6c], 1
je 0x140003265
movzx r9d, word [rsp + 0x70]
jmp 0x14000326b
mov r9d, 0xa
mov r8, rbx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140003b2c
mov dword [0x140006fd8], eax
cmp dword [0x140006fbc], 0
jne 0x140003293
mov ecx, eax
call qword [sym.imp.MSVCR80.dll_exit]
cmp dword [0x140006fdc], 0
jne 0x1400032a8
call qword [sym.imp.MSVCR80.dll__cexit]
mov eax, dword [0x140006fd8]
jmp 0x14000330d
cmp cl, 0x22
jne 0x1400032bc
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
movzx ecx, cl
call qword [sym.imp.MSVCR80.dll__ismbblead]
test eax, eax
je 0x1400032d2
add rbx, 1
mov qword [rsp + 0x28], rbx
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x140003230
jmp 0x140003314
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
sub rsp, 0x28
call fcn.1400038f0
add rsp, 0x28
jmp 0x140003110
Function at 0x140003637
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400065f0]
jne 0x140002efa
rol rcx, 0x10
test cx, 0xffff
jne 0x140002ef6
repz ret
ror rcx, 0x10
jmp 0x140003590
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140007080]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140007178]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140003615
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140007080]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140003637
mov rax, qword [rsp + 0x88]
mov qword [0x140007178], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140007118], rax
mov rax, qword [0x140007178]
mov qword [0x140006ff0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140007100], rax
mov dword [0x140006fe0], 0xc0000409
mov dword [0x140006fe4], 1
mov rax, qword [0x1400065f0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400065f8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140007078], eax
mov ecx, 1
call sub.MSVCR80.dll___crt_debugger_hook
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140004aa8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140007078], 0
jne 0x1400036be
mov ecx, 1
call sub.MSVCR80.dll___crt_debugger_hook
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140073690
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x140118c30]
cmp rsi, 1
jbe 0x1400736b3
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14006d8f0
lea rcx, [0x140118c30]
call fcn.140046050
test al, al
je 0x1400736f9
mov qword [0x140118c38], 0
lea rdi, [0x140118c30]
lea rsi, [0x140118c38]
mov rcx, rsi
xor edx, edx
call fcn.1400464d0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.1400460f0
jmp 0x1400736a3
mov rsi, qword [0x140118c30]
jmp 0x1400736a3

Function at 0x14007d465
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rax, rax
sub rcx, 0xd55f
add rax, rcx
add rax, 0xd55f
add rcx, 0xd55f
sub rsp, 0x3f0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
and rcx, 0
add rcx, rsi
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x5aa1
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x441e
lea r9, [0x140079244]
add byte [rax - 0x7d], cl
invalid
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x14007d522
je 0x14007d539
insb byte [rdi], dx
cld
add byte [rax], al
je 0x14007d543
jne 0x14007d50d
lea rax, [0x14007ca36]
add rax, 0xb32
call rax
je 0x14007d4de
push rsp
ror byte [rax - 0x39], cl
shl dword [rsi], 0x3e
add byte [rax], al
mov rcx, 0x3e26
mov r9d, 0x8d68
mov r10d, 0x92819200
lea eax, [rax]
add byte [rcx - 0x46], al
add byte [rdx - 0xb76d7f], dl
leave
dec rcx
xor byte [rax + rcx], r9b
add r9d, r10d
rol r9d, 1
test rcx, rcx
jne 0x14007d54c
add rax, 0x1ebd
mov rsp, rbp
mov rbp, qword [rsp]
add rsp, 8
ret