joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401b4870
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1401fd028]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x1401cd260]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.140146860
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.1401b9350
test al, al
je 0x1401b49c5
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x1401b493d
mov rcx, r14
call fcn.140146860
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0xf8
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.1401b9350
test al, al
je 0x1401b4986
cmp dword [rbx], 0x4550
jne 0x1401b49f6
mov sil, 1
test rdi, rdi
je 0x1401b49d5
mov qword [rdi], r14
jmp 0x1401b49d5
mov ecx, 1
call fcn.1400ea5c0
test al, al
je 0x1401b49d3
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.140066750
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x1401b4a6a
mov ecx, 1
call fcn.1400ea5c0
test al, al
je 0x1401b49d3
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.140066750
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x1401b4a64
mov ecx, 1
call fcn.1400ea5c0
test al, al
jne 0x1401b4a38
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.14010aeb0
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.1400ea5c0
test al, al
je 0x1401b49d3
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.140066750
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x1401b4a6a
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.140066750
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.140147010
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x1401b4a7f
and r8d, 0x7f
jmp 0x1401b4a86
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.140147010
mov rcx, rdi
call fcn.140066c80
jmp 0x1401b49d3
Function at 0x1400013bb
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001f47c
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14001f1d3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001f1d3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001f1d3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001f1d3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001f1d3
cmp dword [rcx + 0x84], 0xe
jbe 0x14001f1d3
cmp dword [rcx + 0xf8], 0
je 0x14001f1d3
mov ecx, ebx
call fcn.14001f364
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14001eec8
cmp dword [rbp + 0x20], 0
je 0x14001f220
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14001f258
int3
xor r8d, r8d
xor edx, edx
jmp 0x14001f16c

Function at 0x1400014ec
Capabilities:
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
jmp 0x140007ee0
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x198]
lea rcx, [0x1400b2035]
call fcn.14000424b
mov eax, dword [rbp + 0x168]
mov dword [rbp + 0x64], eax
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 0x18
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800e
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
xor r9d, r9d
mov r8d, 0x20
mov rdx, qword [rbp + 0x170]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rbp + 0x28]
mov edx, 0x6610
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
lea rax, [rbp + 0x64]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x160]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea rcx, [rbp - 0x30]
lea rdx, [0x1400890d0]
call fcn.14000392c
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x140001942
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x14006d120
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x140090b80]
mov ecx, 3
lea r8, [0x140090b78]
lea rdx, str.FlsAlloc
call fcn.14006c7cc
test rax, rax
je 0x14006d15c
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [0x1400b3020]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x140001f5a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x14007ae1c
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x1400a64b8]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor r10d, r10d
lea r11, [0x1400a9610]
test r9, r9
lea rdi, [0x14008acbc]
mov rax, rdx
mov r15, rdx
cmovne r11, r9
test rdx, rdx
lea ebp, [r10 + 1]
cmovne rdi, rdx
mov r14d, ebp
cmovne r14, r8
neg rax
sbb rsi, rsi
and rsi, rcx
test r14, r14
jne 0x14007ae85
mov rax, 0xfffffffffffffffe
jmp 0x14007afd3
cmp word [r11 + 6], r10w
jne 0x14007aef4
movzx r9d, byte [rdi]
inc rdi
test r9b, r9b
js 0x14007aeaf
test rsi, rsi
je 0x14007aea0
mov dword [rsi], r9d
test r9b, r9b
setne r10b
mov rax, r10
jmp 0x14007afd3
mov al, r9b
and al, 0xe0
cmp al, 0xc0
jne 0x14007aebd
mov r8b, 2
jmp 0x14007aedb
mov al, r9b
and al, 0xf0
cmp al, 0xe0
jne 0x14007aecb
mov r8b, 3
jmp 0x14007aedb
mov al, r9b
and al, 0xf8
cmp al, 0xf0
jne 0x14007afc1
mov r8b, 4
movzx eax, r8b
mov ecx, 7
sub ecx, eax
mov edx, ebp
shl edx, cl
mov bl, r8b
sub edx, ebp
and edx, r9d
jmp 0x14007af1d
mov r8b, byte [r11 + 4]
mov edx, dword [r11]
mov bl, byte [r11 + 6]
lea eax, [r8 - 2]
cmp al, 2
ja 0x14007afc1
cmp bl, bpl
jb 0x14007afc1
cmp bl, r8b
jae 0x14007afc1
movzx ebp, bl
cmp rbp, r14
mov r9d, ebp
cmovae r9, r14
jmp 0x14007af4a
movzx ecx, byte [rdi]
inc rdi
mov al, cl
and al, 0xc0
cmp al, 0x80
jne 0x14007afc1
mov eax, edx
and ecx, 0x3f
shl eax, 6
mov edx, ecx
or edx, eax
mov rax, rdi
sub rax, r15
cmp rax, r9
jb 0x14007af2c
cmp r9, rbp
jae 0x14007af76
movzx eax, r8b
sub bl, r9b
mov word [r11 + 4], ax
movzx eax, bl
mov word [r11 + 6], ax
mov dword [r11], edx
jmp 0x14007ae79
lea eax, [rdx - 0xd800]
cmp eax, 0x7ff
jbe 0x14007afc1
cmp edx, 0x110000
jae 0x14007afc1
movzx eax, r8b
mov dword [rsp + 0x20], 0x80
mov dword [rsp + 0x24], 0x800
mov dword [rsp + 0x28], 0x10000
cmp edx, dword [rsp + rax*4 + 0x18]
jb 0x14007afc1
test rsi, rsi
je 0x14007afb4
mov dword [rsi], edx
neg edx
mov qword [r11], r10
sbb rax, rax
and rax, rbp
jmp 0x14007afd3
mov qword [r11], r10
call fcn.1400022a2
mov dword [rax], 0x2a
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14000286a
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400023ce
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
jmp 0x140009b44
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x140009bd1
movsxd rcx, dword [0x14000003c]
lea rdx, [0x140000000]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140009bd1
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140009bd1
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x140009bb8
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140009bb2
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140009bba
add rdx, 0x28
jmp 0x140009b97
xor edx, edx
test rdx, rdx
jne 0x140009bc3
xor al, al
jmp 0x140009bd7
cmp dword [rdx + 0x24], 0
jge 0x140009bcd
xor al, al
jmp 0x140009bd7
mov al, 1
jmp 0x140009bd7
xor al, al
jmp 0x140009bd7
add rsp, 0x18
ret

Function at 0x140002478
Capabilities:
Get system information on windows

Disassembly:
jmp 0x140008050
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x26
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rcx, [0x1400b2035]
call fcn.14000424b
mov dword [rbp + 4], 0
lea rcx, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbp + 0x48]
mov dword [rbp + 0x74], eax
cmp dword [rbp + 0x74], 2
ja 0x1400080a0
mov dword [rbp + 4], 1
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x140089300]
call fcn.14000392c
mov eax, edi
lea rsp, [rbp + 0x158]
pop rdi
pop rbp
ret

Function at 0x1400026cb
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140035ce0
mov rax, rcx
neg rcx
test rax, 7
je 0x140035cfd
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x140035d58
test al, 7
jne 0x140035cf0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x140035d11
mov rdx, qword [rax - 8]
test dl, dl
je 0x140035d82
test dh, dh
je 0x140035d7c
shr rdx, 0x10
test dl, dl
je 0x140035d76
test dh, dh
je 0x140035d70
shr rdx, 0x10
test dl, dl
je 0x140035d6a
test dh, dh
je 0x140035d64
shr edx, 0x10
test dl, dl
je 0x140035d5e
test dh, dh
jne 0x140035d11
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x1400029dc
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140018940
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x14008bc78]
mov ecx, 2
lea r8, [0x14008bc70]
lea rdx, str.FlsGetValue
call fcn.140018410
mov ecx, ebx
test rax, rax
je 0x14001897a
add rsp, 0x20
pop rbx
jmp qword [0x1400b3020]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x140002b3f
Capabilities:
Query environment variable

Disassembly:
jmp 0x140066264
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
mov rbx, rax
test rax, rax
je 0x140066336
mov rsi, rax
cmp word [rax], r14w
je 0x1400662b7
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], r14w
jne 0x14006629f
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], r14w
jne 0x14006629b
mov qword [rsp + 0x38], r14
sub rsi, rbx
mov qword [rsp + 0x30], r14
add rsi, 2
sar rsi, 1
mov r8, rbx
mov r9d, esi
mov dword [rsp + 0x28], r14d
xor edx, edx
mov qword [rsp + 0x20], r14
xor ecx, ecx
call fcn.140003580
movsxd rbp, eax
test eax, eax
je 0x140066336
mov rcx, rbp
call fcn.140001023
mov rdi, rax
test rax, rax
je 0x140066329
mov qword [rsp + 0x38], r14
mov r9d, esi
mov qword [rsp + 0x30], r14
mov r8, rbx
mov dword [rsp + 0x28], ebp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.140003580
test eax, eax
je 0x140066329
mov rsi, rdi
mov rdi, r14
jmp 0x14006632c
mov rsi, r14
mov rcx, rdi
call fcn.14000116d
jmp 0x140066339
mov rsi, r14
test rbx, rbx
je 0x140066347
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140002b4e
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x140018890
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x14008bc38]
xor ecx, ecx
lea r8, [0x14008bc30]
lea rdx, str.FlsAlloc
call fcn.140018410
test rax, rax
je 0x1400188c9
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [0x1400b3020]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x140002bcb
Capabilities:
Get geographical location

Disassembly:
jmp 0x14006d3c0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, r9d
mov rdi, r8
mov esi, edx
lea r9, [0x140090c68]
mov rbp, rcx
lea r8, [0x140090c60]
lea rdx, str.GetLocaleInfoEx
mov ecx, 0xb
call fcn.14006c7cc
mov rcx, rbp
test rax, rax
je 0x14006d416
mov r9d, ebx
mov r8, rdi
mov edx, esi
call qword [0x1400b3020]
jmp 0x14006d42d
xor edx, edx
call fcn.140002423
mov ecx, eax
mov r9d, ebx
mov r8, rdi
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140002bd5
Capabilities:
Terminate process

Disassembly:
jmp 0x14000ba5c
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x140002d4c
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001f418
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x14001f16c

Function at 0x140002f0e
Capabilities:
Parse pe header

Disassembly:
jmp 0x140080a70
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140080a9a
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x140080a9a
mov ecx, 0x20b
cmp word [rax + 0x18], cx
jne 0x140080a9a
mov eax, 1
ret
xor eax, eax
ret

Function at 0x140003265
Capabilities:
Parse pe header

Disassembly:
jmp 0x14000a0f8
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000a143
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000a143
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000a143
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000a143
cmp dword [rcx + 0x84], 0xe
jbe 0x14000a143
cmp dword [rcx + 0xf8], 0
je 0x14000a143
mov al, 1
jmp 0x14000a145
xor al, al
add rsp, 0x28
ret
Function at 0x1400034ef
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x1400809b0
movsxd r8, dword [rcx + 0x3c]
xor r9d, r9d
add r8, rcx
mov r10, rdx
movzx eax, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rax, 0x18
add rax, r8
test r11d, r11d
je 0x1400809f1
mov edx, dword [rax + 0xc]
cmp r10, rdx
jb 0x1400809e5
mov ecx, dword [rax + 8]
add ecx, edx
cmp r10, rcx
jb 0x1400809f3
inc r9d
add rax, 0x28
cmp r9d, r11d
jb 0x1400809d3
xor eax, eax
ret

Function at 0x140003701
Capabilities:
Terminate process

Disassembly:
jmp 0x14005b29c
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14005b2b6
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
lea ecx, [r8 + 1]
call fcn.140003e9f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x1400037b5
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x14006d1d4
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x140090ba0]
mov ecx, 5
lea r8, [0x140090b98]
lea rdx, str.FlsGetValue
call fcn.14006c7cc
mov ecx, ebx
test rax, rax
je 0x14006d20e
add rsp, 0x20
pop rbx
jmp qword [0x1400b3020]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x140003b11
Capabilities:
Enumerate processes

Disassembly:
jmp 0x1400086e0
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x448
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x468]
lea rcx, [0x1400b2035]
call fcn.14000424b
mov dword [rbp + 4], 0
lea rax, [rbp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
mov dword [rbp + 0x30], 0x238
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x288], rax
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0x288]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140008782
mov eax, dword [rbp + 0x440]
cmp dword [rbp + 0x38], eax
jne 0x14000876e
mov eax, dword [rbp + 0x50]
mov dword [rbp + 4], eax
jmp 0x140008782
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0x288]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14000875b
mov rcx, qword [rbp + 0x288]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x1400894e0]
call fcn.14000392c
mov eax, edi
lea rsp, [rbp + 0x428]
pop rdi
pop rbp
ret

Function at 0x140003bed
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x14006d22c
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x140090bb0]
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 6
lea r8, [0x140090ba8]
call fcn.14006c7cc
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x14006d26c
call qword [0x1400b3020]
jmp 0x14006d272
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140003e13
Capabilities:
Get memory capacity

Disassembly:
jmp 0x140008350
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x2a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rcx, [0x1400b2035]
call fcn.14000424b
mov dword [rbp + 4], 0
mov dword [rbp + 0x30], 0x40
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor edx, edx
mov rax, qword [rbp + 0x38]
mov ecx, 0x400
div rcx
xor edx, edx
mov ecx, 0x400
div rcx
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0x800
jae 0x1400083c5
mov dword [rbp + 4], 1
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x140089380]
call fcn.14000392c
mov eax, edi
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret
Function at 0x140003f5d
Capabilities:
Enumerate processes

Disassembly:
jmp 0x1400084a0
push rbp
push rdi
sub rsp, 0x448
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rcx, [0x1400b2035]
call fcn.14000424b
mov dword [rbp + 4], 0
lea rax, str.vmtoolsd.exe
mov qword [rbp + 0x30], rax
lea rax, str.vmacthlp.exe
mov qword [rbp + 0x38], rax
lea rax, str.vmwaretray.exe
mov qword [rbp + 0x40], rax
lea rax, str.vmwareuser.exe
mov qword [rbp + 0x48], rax
lea rax, str.vboxserivce.exe
mov qword [rbp + 0x50], rax
lea rax, str.vboxtray.exe
mov qword [rbp + 0x58], rax
lea rax, str.vmsrvc.exe
mov qword [rbp + 0x60], rax
lea rax, str.vmusrvc.exe
mov qword [rbp + 0x68], rax
lea rax, str.vpcmap.exe
mov qword [rbp + 0x70], rax
lea rax, str.prl_tools_service.exe
mov qword [rbp + 0x78], rax
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x98], rax
cmp qword [rbp + 0x98], 0xffffffffffffffff
jne 0x140008565
xor eax, eax
jmp 0x140008645
mov dword [rbp + 0xc0], 0x130
lea rdx, [rbp + 0xc0]
mov rcx, qword [rbp + 0x98]
call sub.KERNEL32.dll_Process32First
mov dword [rbp + 0x204], eax
cmp dword [rbp + 0x204], 0
je 0x140008635
lea rax, [rbp + 0x30]
mov qword [rbp + 0x228], rax
mov rax, qword [rbp + 0x228]
mov qword [rbp + 0x248], rax
mov rax, qword [rbp + 0x228]
add rax, 0x50
mov qword [rbp + 0x268], rax
jmp 0x1400085d4
mov rax, qword [rbp + 0x248]
add rax, 8
mov qword [rbp + 0x248], rax
mov rax, qword [rbp + 0x268]
cmp qword [rbp + 0x248], rax
je 0x140008617
mov rax, qword [rbp + 0x248]
mov rax, qword [rax]
mov qword [rbp + 0x288], rax
lea rdx, [rbp + 0xec]
mov rcx, qword [rbp + 0x288]
call fcn.140004755
test eax, eax
jne 0x140008615
mov dword [rbp + 4], 1
jmp 0x140008617
jmp 0x1400085c2
lea rdx, [rbp + 0xc0]
mov rcx, qword [rbp + 0x98]
call sub.KERNEL32.dll_Process32Next
mov dword [rbp + 0x204], eax
jmp 0x140008588
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 4]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140089680]
call fcn.14000392c
mov rax, rdi
lea rsp, [rbp + 0x428]
pop rdi
pop rbp
ret

Function at 0x140003fa8
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x140018998
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x14008bc98]
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 3
lea r8, [0x14008bc90]
call fcn.140018410
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x1400189d8
call qword [0x1400b3020]
jmp 0x1400189de
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140003fee
Capabilities:
Write file on windows

Disassembly:
jmp 0x140008bf0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1a8]
lea rcx, [0x1400b2035]
call fcn.14000424b
mov rcx, qword [rbp + 0x160]
call fcn.140004728
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x160]
call fcn.1400026cb
xor edx, edx
mov ecx, 2
div rcx
mov qword [rbp + 0x28], rax
lea r8, str.Reversing.ID_ShellcodeLoader1337
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 8]
call fcn.1400014ec
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbp + 0x48], rax
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x64]
mov r8d, dword [rbp + 0x28]
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140008cd6
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x140008ce2
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x140089280]
call fcn.14000392c
mov rax, rdi
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret