joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14012c500
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [r15]
xor ebx, dword [r15 + 4]
xor ecx, dword [r15 + 8]
xor edx, dword [r15 + 0xc]
mov r13d, dword [r15 + 0xf0]
sub r13d, 1
jmp 0x14012c520
movzx esi, al
movzx edi, bl
movzx ebp, cl
mov r10d, dword [r14 + rsi*8]
mov r11d, dword [r14 + rdi*8]
mov r12d, dword [r14 + rbp*8]
movzx esi, dh
movzx edi, ah
movzx ebp, dl
xor r10d, dword [r14 + rsi*8 + 3]
xor r11d, dword [r14 + rdi*8 + 3]
mov r8d, dword [r14 + rbp*8]
movzx esi, bh
shr eax, 0x10
movzx ebp, ch
xor r12d, dword [r14 + rsi*8 + 3]
shr edx, 0x10
xor r8d, dword [r14 + rbp*8 + 3]
shr ebx, 0x10
lea r15, [r15 + 0x10]
shr ecx, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
xor r10d, dword [r14 + rsi*8 + 2]
xor r11d, dword [r14 + rdi*8 + 2]
xor r12d, dword [r14 + rbp*8 + 2]
movzx esi, bh
movzx edi, ch
movzx ebp, bl
xor r10d, dword [r14 + rsi*8 + 1]
xor r11d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 2]
movzx esi, dh
mov edx, dword [r15 + 0xc]
movzx ebp, ah
xor r12d, dword [r14 + rsi*8 + 1]
mov eax, dword [r15]
xor r8d, dword [r14 + rbp*8 + 1]
xor eax, r10d
mov ebx, dword [r15 + 4]
mov ecx, dword [r15 + 8]
xor ecx, r12d
xor ebx, r11d
xor edx, r8d
sub r13d, 1
jne 0x14012c520
lea r14, [r14 + 0x800]
movzx esi, al
movzx edi, bl
movzx ebp, cl
movzx r10d, byte [r14 + rsi]
movzx r11d, byte [r14 + rdi]
movzx r12d, byte [r14 + rbp]
movzx esi, dl
movzx edi, dh
movzx ebp, ah
movzx r8d, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl edi, 8
shl ebp, 8
xor r10d, edi
xor r11d, ebp
shr edx, 0x10
movzx esi, bh
movzx edi, ch
shr eax, 0x10
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
shl esi, 8
shl edi, 8
shr ebx, 0x10
xor r12d, esi
xor r8d, edi
shr ecx, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl esi, 0x10
shl edi, 0x10
shl ebp, 0x10
xor r10d, esi
xor r11d, edi
xor r12d, ebp
movzx esi, bl
movzx edi, bh
movzx ebp, ch
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl esi, 0x10
shl edi, 0x18
shl ebp, 0x18
xor r8d, esi
xor r10d, edi
xor r11d, ebp
movzx esi, dh
movzx edi, ah
mov edx, dword [r15 + 0x1c]
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
mov eax, dword [r15 + 0x10]
shl esi, 0x18
shl edi, 0x18
xor r12d, esi
xor r8d, edi
mov ebx, dword [r15 + 0x14]
mov ecx, dword [r15 + 0x18]
lea r14, [r14 - 0x800]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
repz ret

Function at 0x14012f570
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, dword [0x14034f5bc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x14012f5a0
Capabilities:
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov ebp, ecx
lea rcx, [0x14034f5b0]
lea rdx, [0x14012f540]
call fcn.14012f3e0
cmp dword [0x14034f5b8], 0
je 0x14012f5d7
mov rcx, rsi
call rdi
xor eax, eax
jmp 0x14012f614
call fcn.14012f570
mov rbx, rax
test rax, rax
je 0x14012f61f
lea r14, [0x14034f5c0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
movsxd rbp, ebp
lea rax, [0x14034f5d0]
mov qword [rax + rbp*8], rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov qword [rbx + rbp*8], rsi
mov eax, 1
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov ecx, 0x18
call fcn.14012f1d0
test rax, rax
je 0x14012f5ce
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov ecx, dword [0x14034f5bc]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x14012f5e4
mov rcx, rbx
call fcn.14012f200
jmp 0x14012f5ce

Function at 0x1401372d0
Capabilities:
Encode data using xor

Disassembly:
lea r11, [0x140137e80]
movdqu xmm7, xmmword [rcx]
lea rcx, [rcx + 0x10]
movdqa xmm0, xmmword [r11]
movdqa xmm1, xmmword [r11 + 0x10]
movdqa xmm2, xmmword [r11 + 0x20]
movdqa xmm3, xmmword [r11 + 0x30]
movdqa xmm4, xmmword [r11 + 0x40]
pcmpeqd xmm5, xmm5
movdqu xmm6, xmmword [rcx]
movdqa xmmword [rax], xmm7
lea rax, [rax + 0x10]
dec r10d
jmp 0x140137320
pshufb xmm6, xmm4
movdqa xmm8, xmm0
movdqa xmm9, xmm1
pand xmm8, xmm6
pand xmm9, xmm6
movdqa xmm10, xmm2
pcmpeqb xmm8, xmm0
psllq xmm0, 4
movdqa xmm11, xmm3
pcmpeqb xmm9, xmm1
psllq xmm1, 4
pand xmm10, xmm6
pand xmm11, xmm6
movdqa xmm12, xmm0
pcmpeqb xmm10, xmm2
psllq xmm2, 4
movdqa xmm13, xmm1
pcmpeqb xmm11, xmm3
psllq xmm3, 4
movdqa xmm14, xmm2
movdqa xmm15, xmm3
pxor xmm8, xmm5
pxor xmm9, xmm5
pand xmm12, xmm6
pand xmm13, xmm6
movdqa xmmword [rax], xmm8
pcmpeqb xmm12, xmm0
psrlq xmm0, 4
movdqa xmmword [rax + 0x10], xmm9
pcmpeqb xmm13, xmm1
psrlq xmm1, 4
lea rcx, [rcx + 0x10]
pand xmm14, xmm6
pand xmm15, xmm6
movdqa xmmword [rax + 0x20], xmm10
pcmpeqb xmm14, xmm2
psrlq xmm2, 4
movdqa xmmword [rax + 0x30], xmm11
pcmpeqb xmm15, xmm3
psrlq xmm3, 4
movdqu xmm6, xmmword [rcx]
pxor xmm13, xmm5
pxor xmm14, xmm5
movdqa xmmword [rax + 0x40], xmm12
movdqa xmmword [rax + 0x50], xmm13
movdqa xmmword [rax + 0x60], xmm14
movdqa xmmword [rax + 0x70], xmm15
lea rax, [rax + 0x80]
dec r10d
jne 0x140137320
movdqa xmm7, xmmword [r11 + 0x50]
repz ret
Function at 0x14013b840
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [rcx - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [rbp - 1]
vmovups xmm15, xmmword [rcx - 0x70]
lea r12, [rcx - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x14013b960
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x14013b8a0
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x14013b8a0
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rdi]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rdi + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rdi + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rdi + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rdi + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rdi + 0x50]
lea rdi, [rdi + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rsi], xmm9
vmovups xmmword [rsi + 0x10], xmm10
vmovups xmmword [rsi + 0x20], xmm11
vmovups xmmword [rsi + 0x30], xmm12
vmovups xmmword [rsi + 0x40], xmm13
vmovups xmmword [rsi + 0x50], xmm14
lea rsi, [rsi + 0x60]
repz ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x14013b8a0
Function at 0x140145e40
Capabilities:
Compare security identifiers

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rax, qword [0x140324948]
xor rax, rsp
mov qword [rsp + 0x90], rax
cmp byte [rcx + 0x54], 0
je 0x140145fa9
mov rsi, rdx
mov rdi, rcx
lea rdx, [rcx + 0x48]
lea rbx, [rsp + 0x38]
lea r9, [rsp + 0x44]
mov rcx, rbx
mov r8d, 2
call fcn.140145ff0
mov r13, qword [rbx]
test r13, r13
je 0x140145fb0
mov qword [rsp + 0x28], rdi
cmp dword [r13], 0
je 0x140145f94
lea rbx, [r13 + 8]
mov rax, qword [rsp + 0x28]
lea rax, [rax + 0x30]
mov qword [rsp + 0x30], rax
xor r12d, r12d
mov r14, qword [sym.imp.ADVAPI32.dll_EqualSid]
mov rbp, r12
shl rbp, 4
test dword [rbx + rbp + 8], 0xc0000020
jne 0x140145f84
add rbp, rbx
test rsi, rsi
je 0x140145f42
mov rax, qword [rsi]
cmp qword [rsi + 8], rax
je 0x140145f42
mov r15d, 1
xor ecx, ecx
mov rdi, qword [rbp]
mov rdx, rcx
shl rdx, 6
lea rcx, [rdx + rcx*4]
add rcx, rax
call fcn.1400519f0
mov rcx, rax
mov rdx, rdi
call r14
test eax, eax
jne 0x140145f84
mov ecx, r15d
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
sub rdx, rax
sar rdx, 2
movabs rdi, 0xf0f0f0f0f0f0f0f1
imul rdx, rdi
inc r15d
cmp rdx, rcx
ja 0x140145ef7
mov rdx, qword [rbp]
lea rbp, [rsp + 0x48]
mov rcx, rbp
call fcn.140146750
mov rdi, qword [rsp + 0x28]
mov rcx, qword [rdi + 0x38]
cmp rcx, qword [rdi + 0x40]
jae 0x140145f77
mov r8d, 0x44
mov rdx, rbp
call fcn.140193590
add qword [rdi + 0x38], 0x44
jmp 0x140145f84
mov rcx, qword [rsp + 0x30]
mov rdx, rbp
call fcn.1401075c0
inc r12
mov eax, dword [r13]
cmp r12, rax
jb 0x140145ec9
mov qword [rsp + 0x38], 0
mov rcx, r13
call fcn.1401908b0
xor esi, esi
jmp 0x140145fbd
mov esi, 0x3f0
jmp 0x140145fbd
mov esi, dword [rsp + 0x44]
mov qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140190ca0
mov eax, esi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140149270
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.1400a06f0
test al, al
je 0x14014929e
mov rcx, qword [rsi]
mov edx, gethostbyname
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea rdi, [rsi + 0x38]
mov rcx, rdi
xor edx, edx
call fcn.140149310
mov rcx, qword [rsi + 0x58]
test rcx, rcx
je 0x1401492be
mov qword [rsi + 0x60], rcx
call fcn.140190860
mov rcx, qword [rsi + 0x50]
xor eax, eax
mov qword [rsi + 0x50], rax
test rcx, rcx
je 0x1401492d2
call fcn.1400a1350
mov rcx, rdi
xor edx, edx
call fcn.140149310
lea rcx, [rsi + 0x28]
call fcn.140004790
lea rcx, [rsi + 0x20]
call fcn.140004790
lea rcx, [rsi + 0x18]
call fcn.140004790
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400a05d0
Function at 0x140149780
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov r14d, r9d
mov rbx, r8
mov r13, rdx
mov r12, rcx
mov rbp, qword [rsp + 0xc8]
mov ecx, dword [rsp + 0xc0]
mov rax, qword [0x140324948]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea eax, [rcx + r14]
lea rdi, [r12 + 0x28]
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x28], 0
xor r15d, r15d
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8d, 0x8000004
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, rdi
mov rdx, rax
call fcn.140004730
mov rsi, qword [r12 + 0x28]
lea rax, [rsi + 1]
mov ecx, 1
cmp rax, rcx
ja 0x140149837
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp], eax
mov ebx, 0x19
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140190ca0
mov eax, ebx
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x40], r14
mov rbp, qword [r12]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 7
lea r9, [rsp + 0x48]
mov rcx, rax
mov rdx, rsi
mov r8, rbp
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x14014997e
mov rcx, qword [rdi]
mov qword [rsp + 0x20], 0
mov edx, 6
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x140149998
mov rbp, rax
mov esi, dword [rsp + 0x40]
mov eax, dword [rsp + 0xc0]
mov r14d, eax
test rbx, rbx
je 0x1401498e1
test eax, eax
je 0x1401498e1
lea rdi, [rsi + rbp]
mov rcx, rdi
mov rdx, rbx
mov r8, r14
call fcn.140193590
xor eax, eax
mov rcx, qword [rdi + rax*8]
test rcx, rcx
je 0x1401498d8
sub rcx, rbx
mov qword [rdi + rax*8], rcx
inc rax
cmp rax, 0x40
jne 0x1401498c8
mov rax, qword [rsp + 0x48]
mov qword [0x14034ecc0], rax
lea r8, [0x14034ecc0]
mov r9d, 8
mov rcx, r12
call fcn.140149700
mov qword [0x14034ecc0], 0
test eax, eax
jne 0x140149967
mov qword [0x14034f668], rsi
lea r8, [0x14034f668]
mov r9d, 8
mov rcx, r12
call fcn.140149700
mov qword [0x14034f668], 0
test eax, eax
jne 0x140149967
mov qword [0x14034f670], r14
lea r8, [0x14034f670]
mov r9d, 8
mov rcx, r12
call fcn.140149700
mov qword [0x14034f670], 0
test eax, eax
je 0x1401499b2
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0xc8]
mov dword [rcx], eax
jmp 0x140149817
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0xc8]
mov dword [rcx], eax
mov ebx, 0x1a
jmp 0x140149817
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0xc8]
mov dword [rcx], eax
mov ebx, 0x1b
jmp 0x140149817
lea rsi, [r12 + 0x38]
mov ecx, 0x40
call fcn.140190820
mov rdi, rax
mov r9, qword [r12 + 0x40]
mov r8d, dword [r12 + 0x10]
mov rdx, qword [r12]
mov qword [rsp + 0x20], r13
mov rcx, rax
call fcn.140175220
mov rcx, rsi
mov rdx, rdi
call fcn.140149310
mov rcx, qword [r12 + 0x38]
mov rdx, rbp
mov r8, qword [rsp + 0x40]
mov r9d, 0x400
call fcn.1401752e0
mov ebx, 4
test al, al
je 0x140149817
mov rcx, r12
call fcn.1400a0910
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
jmp 0x140149817
Function at 0x140149a30
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.1400a06f0
test al, al
je 0x140149a52
mov rcx, qword [rsi]
xor edx, edx
add rsp, 0x20
pop rsi
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x20
pop rsi
ret

Function at 0x14014c4d0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
call fcn.14014cdf0
mov rcx, rax
call fcn.14008d540
test rax, rax
je 0x14014c533
mov rsi, rax
call fcn.14014c7e0
mov rdi, rax
mov rcx, rax
mov rdx, rax
call fcn.14008d580
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 1
call qword [rax]
call fcn.14014cdf0
mov rcx, rax
xor edx, edx
call fcn.14008d580
mov rcx, rdi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14008d580
nop
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x14014d7c0
Capabilities:
Get thread local storage value

Disassembly:
add rcx, 0x10
mov rdx, rcx
jmp fcn.14008d580

Function at 0x140168800
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x140168800
sub rsp, 0x1c8
mov rax, qword [0x140324948]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
lea rdx, [rsp + 0x28]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140168854
movzx eax, byte [rsp + 0x29]
shl eax, 8
cmp eax, 0x200
jne 0x14016886a
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140190ca0
nop
add rsp, 0x1c8
ret
lea rdx, str.WSAStartup_failed_with_error:__d_n
mov ecx, 0xfffffffd
mov r8d, eax
call fcn.1400c46f0
jmp 0x140168881
lea rdx, str.Could_not_find_a_usable_version_of_Winsock.dll_n
mov ecx, 0xfffffffd
call fcn.1400c46f0
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, 0xffffffff
call fcn.14019eb80
ud2
Function at 0x14016a3c0
Capabilities:
Resume thread

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
lea rdx, [rcx + 0x10]
mov rcx, qword [rcx + 8]
call fcn.140045d00
mov rcx, qword [rsi + 8]
add rsp, 0x20
pop rsi
jmp fcn.140047240

Function at 0x14016a6d0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov eax, dword [0x14034f8e8]
mov ecx, dword [0x14034d688]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x10]
jg 0x14016a753
lea rcx, [0x14034f8e0]
call fcn.14008d540
test rax, rax
jne 0x14016a742
mov ecx, 4
call fcn.140190820
mov rsi, rax
mov dword [rax], 0
lea rcx, [0x14034f8e0]
call fcn.14008d540
test rax, rax
je 0x14016a733
mov rcx, rax
call fcn.140190860
lea rcx, [0x14034f8e0]
mov rdx, rsi
call fcn.14008d580
lea rcx, [0x14034f8e0]
add rsp, 0x20
pop rsi
jmp fcn.14008d540
lea rcx, [0x14034f8e8]
call fcn.140190a20
cmp dword [0x14034f8e8], 0xffffffff
jne 0x14016a6f6
mov qword [0x14034f8e0], 0
lea rcx, [0x14034f8e0]
lea rdx, [0x14006dcb0]
call fcn.14008d5d0
lea rcx, [0x14034f8e8]
call fcn.140190ac0
jmp 0x14016a6f6

Function at 0x140171670
Capabilities:
Create pipe

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r15, qword [rsp + 0xc8]
mov rax, qword [0x140324948]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [r15], 0xffffffffffffffff
mov esi, 5
cmp ecx, 3
jne 0x140171758
mov edi, dword [rsp + 0xc0]
mov ebx, dword [rsp + 0xb8]
mov ecx, dword [rsp + 0xb0]
mov r10d, dword [rsp + 0xa8]
mov eax, dword [rsp + 0xa0]
cmp byte [r8 + 0x17], 0
jns 0x1401716d5
mov r8, qword [r8]
mov rsi, qword [rdx]
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ecx
mov qword [rsp + 0x38], 0
mov rcx, r8
mov edx, r9d
mov r8d, eax
mov r9d, r10d
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp rax, 0xffffffffffffffff
je 0x140171742
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor ebx, ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x30], 3
lea r14, [rsp + 0x40]
mov rcx, rax
mov rdx, rdi
mov r8, rsi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp eax, 1
sbb rbx, rbx
or rbx, qword [r14]
jmp 0x140171749
mov rbx, 0xffffffffffffffff
mov qword [r15], rbx
xor eax, eax
cmp rbx, 0xffffffffffffffff
sete al
lea esi, [rax + rax*4]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140190ca0
mov eax, esi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140171ba0
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov r12d, ecx
mov rax, qword [0x140324948]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea eax, [r12 - 5]
mov ebp, 5
cmp eax, 1
ja 0x140171d4d
mov rbx, r8
mov r15, rdx
mov rbp, qword [rsp + 0x130]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
xor edi, edi
mov qword [rsp + 0xb0], rdi
mov dword [rsp + 0x50], WSAGetLastError
cmp byte [r9 + 0x17], dil
jns 0x140171c2e
mov r9, qword [r9]
mov rcx, r9
call fcn.1401a9c30
mov r14, rax
movzx eax, byte [rbp + 0x17]
test al, al
jns 0x140171c49
mov rax, qword [rbp + 8]
mov rbp, qword [rbp]
mov rsi, qword [rsp + 0x138]
test rax, rax
cmove rbp, rax
cmp byte [rbx + 0x17], dil
jns 0x140171c61
mov rbx, qword [rbx]
mov r15, qword [r15]
mov qword [rsp + 0x48], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebp, 5
test eax, eax
je 0x140171d40
cmp r12d, 6
mov r13d, 0x1fffff
mov edi, 0x101c01
cmove edi, r13d
mov rbx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0
mov rcx, rax
mov rdx, rbx
mov r8, r15
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rbx, qword [rsi + 8]
test eax, eax
je 0x140171d37
add rsi, 8
cmp r12d, 6
mov edi, 0x100c43
cmove edi, r13d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0
mov rcx, rax
mov rdx, rbx
mov r8, r15
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea ebp, [rcx + rcx*4]
jmp 0x140171d40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x140171d4d
mov rcx, r14
call fcn.1400a1350
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140190ca0
mov eax, ebp
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140171d80
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rax, r8
mov r8, rdx
mov rdi, rcx
mov rsi, qword [rsp + 0x90]
mov edx, dword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
mov qword [rsi], 0
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], r9
xor r14d, r14d
xor edx, edx
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x140171e18
mov rbx, rax
mov rdi, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x30], 3
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea eax, [rcx + rcx*4]
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x140174410
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x180
mov r12, rcx
mov rax, qword [0x140324948]
xor rax, rsp
mov qword [rsp + 0x178], rax
test dl, dl
je 0x14017449c
lea rax, [0x14017d1a0]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
lea rdi, [0x1402ee080]
lea r8, str.NtMapViewOfSection
mov rcx, r12
mov rdx, rdi
mov r9d, 1
call fcn.140173dc0
lea rax, [0x14017d210]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 1
lea r8, str.NtUnmapViewOfSection
mov rcx, r12
mov rdx, rdi
mov r9d, 1
call fcn.140173dc0
jmp 0x1401744a8
cmp qword [r12 + 0x18], 0
je 0x14017460a
mov rax, qword [r12]
mov r14, qword [rax]
mov dword [rsp + 0x20], 1
mov r13, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r8d, 0x10000
mov rcx, r14
xor edx, edx
mov r9d, 0x2000
call r13
mov rdi, rax
mov rsi, qword [r12 + 0x18]
shl rsi, 6
lea r15, [rsi + 0x60]
mov rcx, r15
call fcn.140173c00
mov rbx, rax
and rax, 0xfffffffffffff000
lea rdx, [rax + rdi]
and ebx, 0xfff
add rsi, 0x105f
and rsi, 0xfffffffffffff000
mov dword [rsp + 0x20], 0x40
mov rcx, r14
mov r8, rsi
mov r9d, 0x1000
call r13
mov rdi, rax
test rax, rax
jne 0x140174553
lea rdx, str..._.._sandbox_win_src_interception.cc
lea r9, str.thunk_base
lea rsi, [rsp + 0x48]
mov rcx, rsi
mov r8d, 0x1a8
call fcn.1400764f0
mov rcx, rsi
call fcn.140076600
add rdi, rbx
lea rsi, [rsp + 0x48]
mov qword [rsi], r15
mov dword [rsi + 0x18], 0
mov qword [rsi + 8], 0x20
lea rcx, [0x14034f980]
mov r8d, 0x148
xor edx, edx
call fcn.140193a00
mov rcx, r12
mov rdx, rdi
mov r8, r15
mov r9, rsi
call fcn.140174890
mov ebx, eax
test eax, eax
jne 0x14017460c
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x48]
mov r9d, 0x20
mov rcx, r14
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, 0x2a
test eax, eax
je 0x14017460c
cmp qword [rsp + 0x40], 0x20
jne 0x14017460c
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
mov rcx, r14
mov rdx, rdi
mov r8, r15
mov r9d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [r12]
lea rdx, str.g_originals
lea r8, [0x14034f980]
mov r9d, 0x148
call fcn.140149700
mov ebx, eax
jmp 0x14017460c
xor ebx, ebx
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.140190ca0
mov eax, ebx
add rsp, 0x180
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret