joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140199750
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.140199ce0
mov qword [rsp + 0x28], 0
cmp qword [0x14028eba8], 0
jne 0x140199798
cmp qword [0x14028eba0], 0
je 0x140199798
mov rax, qword [0x14028eba0]
mov qword [0x14028eba8], rax
cmp qword [0x14028eba8], 0
je 0x14019983e
mov rax, qword [0x14028eba8]
cmp qword [rax + 0x10], 0
je 0x14019983e
mov rax, qword [0x14028eba8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x14019983e
mov rax, qword [0x14028eba8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x14019983e
mov rax, qword [0x14028eba8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x140199804
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x14019980b
xor eax, eax
jmp 0x1401999b5
mov rax, qword [0x14028eba8]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x1401999b5
mov rax, qword [0x14028eba0]
mov qword [0x14028eba8], rax
jmp 0x140199860
mov rax, qword [0x14028eba8]
mov rax, qword [rax + 8]
mov qword [0x14028eba8], rax
cmp qword [0x14028eba8], 0
je 0x1401998ad
cmp qword [0x14028eba8], 0
je 0x1401998ab
mov rax, qword [0x14028eba8]
cmp qword [rax + 0x10], 0
je 0x1401998ab
mov rax, qword [0x14028eba8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x1401998ab
mov rax, qword [0x14028eba8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x1401998ab
jmp 0x1401997dc
jmp 0x14019984e
mov rax, qword [rsp + 0x60]
and rax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.1401999c0
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1401999b3
mov rax, qword [rsp + 0x48]
mov qword [0x14028eba8], rax
mov rax, qword [0x14028eba8]
mov dword [rax], 0x52727464
mov rax, qword [0x14028eba8]
mov qword [rax + 0x10], 0
mov rax, qword [0x14028eba8]
mov rcx, qword [0x14028eba0]
mov qword [rax + 8], rcx
mov rax, qword [0x14028eba8]
mov qword [0x14028eba0], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x14028eba8]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x140199964
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x14019999e
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x14019995a
mov rax, qword [0x14028eba8]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x1401997dc
xor eax, eax
add rsp, 0x58
ret
Function at 0x14019a6d0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, Ordinal_50
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call sub.KERNEL32.dll_VirtualQuery
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14019a717
xor al, al
jmp 0x14019a7b9
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14019a741
xor al, al
jmp 0x14019a7b9
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x88], rax
jb 0x14019a7b1
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0xc
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx + 0x8c]
add rax, rcx
cmp qword [rsp + 0x88], rax
jae 0x14019a7b1
mov al, 1
jmp 0x14019a7b9
jmp 0x14019a7b7
xor al, al
add rsp, 0x78
ret

Function at 0x14019aac0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14028eba0]
mov qword [rsp + 0x28], rax
jmp 0x14019aae0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14019ab0f
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x14019ab0d
call sub.KERNEL32.dll_GetLastError
jmp 0x14019ab11
jmp 0x14019aad2
xor eax, eax
add rsp, 0x38
ret
Function at 0x14019b420
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x20], 0
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x14028ebb8], eax
je 0x14019b44d
mov eax, 0x10dd
jmp 0x14019b666
cmp dword [0x14028ebbc], 0
je 0x14019b461
mov eax, dword [0x14028ebbc]
jmp 0x14019b666
cmp qword [rsp + 0x78], 0
jne 0x14019b473
mov eax, 0x57
jmp 0x14019b666
cmp qword [rsp + 0x70], 0
jne 0x14019b485
mov eax, 6
jmp 0x14019b666
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
jne 0x14019b4b7
mov dword [rsp + 0x20], 6
mov eax, dword [rsp + 0x20]
mov dword [0x14028ebbc], eax
mov rax, qword [rsp + 0x70]
mov qword [0x14028ebc0], rax
mov eax, dword [rsp + 0x20]
jmp 0x14019b666
mov ecx, Ordinal_50
call fcn.140226268
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x14019b529
mov dword [rsp + 0x20], 8
mov eax, dword [rsp + 0x20]
mov dword [0x14028ebbc], eax
cmp qword [rsp + 0x30], 0
je 0x14019b514
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov edx, Ordinal_50
mov rcx, qword [rsp + 0x50]
call fcn.140225e3c
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x70]
mov qword [0x14028ebc0], rax
mov eax, dword [rsp + 0x20]
jmp 0x14019b666
xor edx, edx
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax]
call fcn.14019b3f0
mov qword [rsp + 0x38], rax
xor edx, edx
mov rcx, qword [rsp + 0x78]
call fcn.14019b3f0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 0x3e]
mov dword [rsp + 0x24], eax
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x48]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp dword [rsp + 0x24], 0
je 0x14019b586
movsxd rax, dword [rsp + 0x24]
cmp rax, 0x1e
jbe 0x14019b5a3
mov dword [rsp + 0x20], 9
cmp dword [0x14028ebb0], 0
je 0x14019b59e
jmp 0x14019b4ea
jmp 0x14019b4e0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x78]
cmp qword [rax + 0x50], rcx
je 0x14019b5d0
mov dword [rsp + 0x20], 9
cmp dword [0x14028ebb0], 0
je 0x14019b5cb
jmp 0x14019b4ea
jmp 0x14019b4e0
mov dword [rsp + 0x28], 0
movsxd rax, dword [rsp + 0x24]
lea r9, [rsp + 0x28]
mov r8d, 0x40
mov rdx, rax
mov rcx, qword [rsp + 0x40]
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x14019b607
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
jmp 0x14019b4e0
mov rax, qword [rsp + 0x30]
mov dword [rax + 8], 1
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x20], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x18], rcx
mov rax, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x28]
mov dword [rax + 0x28], ecx
mov rax, qword [rsp + 0x30]
mov rcx, qword [0x14028ebd0]
mov qword [rax], rcx
mov rax, qword [rsp + 0x30]
mov qword [0x14028ebd0], rax
xor eax, eax
add rsp, 0x68
ret
Function at 0x14019b760
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x14028ebb8], eax
je 0x14019b77b
mov eax, 0x10dd
jmp 0x14019b8a0
mov rax, qword [0x14028ebd0]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14019b825
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
call sub.KERNEL32.dll_VirtualProtect
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x14019b7f0
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 0
je 0x14019b7f0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x20]
call fcn.140199e20
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, Ordinal_50
mov rcx, qword [rsp + 0x38]
call fcn.140225e3c
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x14019b787
mov qword [0x14028ebd0], 0
call fcn.14019a880
mov rax, qword [0x14028ebc8]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14019b889
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call sub.KERNEL32.dll_ResumeThread
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov edx, reloc.WS2_32.dll_recv
mov rcx, qword [rsp + 0x48]
call fcn.140225e3c
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x14019b841
mov qword [0x14028ebc8], 0
mov dword [0x14028ebb8], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x14019bdd0
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x14028ebbc], 0
je 0x14019bded
mov eax, dword [0x14028ebbc]
jmp 0x14019beb3
call sub.KERNEL32.dll_GetCurrentThread
cmp qword [rsp + 0x50], rax
jne 0x14019be00
xor eax, eax
jmp 0x14019beb3
mov ecx, reloc.WS2_32.dll_recv
call fcn.140226268
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14019be6e
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x14019be53
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, reloc.WS2_32.dll_recv
mov rcx, qword [rsp + 0x38]
call fcn.140225e3c
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x14028ebbc], eax
mov qword [0x14028ebc0], 0
mov eax, dword [rsp + 0x20]
jmp 0x14019beb3
mov rcx, qword [rsp + 0x50]
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x14019be88
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
jmp 0x14019be29
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [0x14028ebc8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
mov qword [0x14028ebc8], rax
xor eax, eax
add rsp, 0x48
ret

Function at 0x14019c000
Capabilities:
Execute command
Terminate process

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov r9d, dword [rsp + 0x88]
mov r8d, dword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x38]
call fcn.14019c2f0
movzx eax, al
test eax, eax
jne 0x14019c114
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14019bfa0
mov qword [rsp + 0x30], rax
mov eax, 1
imul rax, rax, 0x1b
mov rcx, qword [rsp + 0x30]
movsx eax, byte [rcx + rax]
test eax, eax
je 0x14019c095
mov dword [rsp + 0x28], 1
jmp 0x14019c09d
mov dword [rsp + 0x28], 0
movzx eax, byte [rsp + 0x28]
test eax, eax
je 0x14019c0fb
mov dword [rsp + 0x24], 0
jmp 0x14019c0ba
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x1c
jge 0x14019c0fb
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x30]
movsx eax, byte [rcx + rax]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, gethostname
idiv ecx
mov eax, edx
add eax, 0x34
mov ecx, dword [rsp + 0x2c]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x30]
mov byte [rdx + rcx], al
jmp 0x14019c0b0
mov rax, qword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
add rsp, 0x60
pop rdi
ret
Function at 0x14019c120
Capabilities:
Execute command
Terminate process

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov r9d, dword [rsp + 0x88]
mov r8d, dword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x38]
call fcn.14019c2f0
movzx eax, al
test eax, eax
jne 0x14019c234
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14019bfd0
mov qword [rsp + 0x30], rax
mov eax, 1
imul rax, rax, 0x1b
mov rcx, qword [rsp + 0x30]
movsx eax, byte [rcx + rax]
test eax, eax
je 0x14019c1b5
mov dword [rsp + 0x28], 1
jmp 0x14019c1bd
mov dword [rsp + 0x28], 0
movzx eax, byte [rsp + 0x28]
test eax, eax
je 0x14019c21b
mov dword [rsp + 0x24], 0
jmp 0x14019c1da
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x1c
jge 0x14019c21b
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x30]
movsx eax, byte [rcx + rax]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, gethostname
idiv ecx
mov eax, edx
add eax, 0x34
mov ecx, dword [rsp + 0x2c]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x30]
mov byte [rdx + rcx], al
jmp 0x14019c1d0
mov rax, qword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
add rsp, 0x60
pop rdi
ret

Function at 0x14019c340
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
sub rsp, 0x40
mov rax, qword [0x140282140]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov r8d, 4
mov edx, 0x1000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rdi, qword [rsp + 0x28]
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140225770
add rsp, 0x40
pop rdi
ret

Function at 0x14019c3b0
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x28
mov rax, qword gs:[0x60]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
mov rax, qword [rax + 0x18]
mov ecx, 8
imul rcx, rcx, 1
mov rax, qword [rax + rcx + 8]
mov qword [rsp + 0x10], rax
xor eax, eax
mov ecx, 8
imul rcx, rcx, 0
add rax, rcx
mov rcx, qword [rsp + 0x10]
sub rcx, rax
mov rax, rcx
mov qword [rsp], rax
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp]
lea rax, [rcx + rax + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp]
mov rax, qword [rax + 0x30]
add rax, 0x100000
mov rcx, qword [rsp + 0x18]
mov dword [rcx], eax
add rsp, 0x28
ret
Function at 0x14019c430
Capabilities:
Get file size
Terminate process

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x288
mov rax, qword [0x140282140]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [rsp + 0x58], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x298]
mov dword [rsp + 0x48], eax
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x40], eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x40], eax
jb 0x14019c4ed
mov eax, dword [rsp + 0x48]
cmp dword [rsp + 0x40], eax
ja 0x14019c4ed
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140225770
add rsp, 0x288
ret

Function at 0x14019c510
Capabilities:
Check for debugger via api
Terminate process

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140282140]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov dword [rsp + 0x20], 0
cmp dword [rsp + 0x20], 0
je 0x14019c556
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140225770
add rsp, 0x38
ret

Function at 0x14019c570
Capabilities:
Terminate process

Disassembly:
push rdi
sub rsp, 0x30
mov r9d, 4
mov r8d, 0x1000
mov edx, 0x4d0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14019c627
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rdi, qword [rsp + 0x28]
xor eax, eax
mov ecx, 0x4d0
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x30], 0x100010
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdx, qword [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x14019c614
mov rax, qword [rsp + 0x20]
cmp qword [rax + 0x48], 0
jne 0x14019c60c
mov rax, qword [rsp + 0x20]
cmp qword [rax + 0x50], 0
jne 0x14019c60c
mov rax, qword [rsp + 0x20]
cmp qword [rax + 0x58], 0
jne 0x14019c60c
mov rax, qword [rsp + 0x20]
cmp qword [rax + 0x60], 0
je 0x14019c614
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
add rsp, 0x30
pop rdi
ret
Function at 0x14019c630
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows
Terminate process

Disassembly:
push rdi
sub rsp, 0x80
mov rax, qword [0x140282140]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, Ordinal_50
rep stosb byte [rdi], al
mov dword [rsp + 0x70], 0
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x44]
mov r9d, 0x40
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14019c6a9
xor eax, eax
jmp 0x14019c71a
mov r8d, 1
mov edx, 0xc3
mov rcx, qword [rsp + 0x20]
call sub.VCRUNTIME140.dll_memset
mov eax, dword [rsp + 0x44]
lea r9, [rsp + 0x70]
mov r8d, 0x140
mov edx, eax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14019c6e2
xor eax, eax
jmp 0x14019c71a
call qword [rsp + reloc.WLDAP32.dll_Ordinal_32]
jmp 0x14019c6ff
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140225770
add rsp, 0x80
pop rdi
ret

Function at 0x14019c800
Capabilities:
Print debug messages
Terminate process

Disassembly:
sub rsp, 0x38
mov dword [rsp + 0x2c], 0x3e8
mov dword [rsp + 0x20], 0
mov rax, qword [0x14028ebe8]
test rax, rax
jne 0x14019c83c
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x3e8
je 0x14019c83c
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
jmp 0x14019c814
cmp dword [rsp + 0x20], 0x3e8
jl 0x14019c84e
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov edx, 0x1388
mov rcx, qword [0x14028ebe8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x14019c873
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, dword [0x14028ebf4]
cmp eax, 0xdeadbeef
je 0x14019c888
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
lea rcx, str.All_seems_fine_for_TLSCallbackProcess.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [0x14028ebf4]
cmp eax, 0xdeadbeef
jne 0x14019c8ac
mov dword [rsp + 0x24], 0
jmp 0x14019c8b4
mov dword [rsp + 0x24], 1
mov eax, dword [rsp + 0x24]
add rsp, 0x38
ret
Function at 0x14019c8c0
Capabilities:
Create thread
Print debug messages
Terminate process

Disassembly:
sub rsp, 0x48
mov dword [rsp + 0x38], 0x3e8
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14019c7e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x14019c8fe
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [rsp + 0x30], 0
mov rax, qword [0x14028ebe0]
test rax, rax
jne 0x14019c92e
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x3e8
je 0x14019c92e
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
jmp 0x14019c906
cmp dword [rsp + 0x30], 0x3e8
jl 0x14019c94c
lea rcx, str.TLSCallbackThread_timeout_on_event_creation.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, 1
jmp 0x14019c986
mov edx, 0x1388
mov rcx, qword [0x14028ebe0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x14019c971
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, dword [0x14028ebf0]
cmp eax, 0xdeadbeef
je 0x14019c986
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
add rsp, 0x48
ret
Function at 0x14019ccc0
Capabilities:
Check for unexpected memory writes

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140282140]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x30], 0
mov r9d, 4
mov r8d, 0x3000
mov edx, 0x8000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x14019cd1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140236b70]
call fcn.14009ce78
mov eax, dword [rsp + 0x30]
jmp 0x14019ce2c
mov r9d, 4
mov r8d, 0x203000
mov edx, 0x1000000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x14019cd74
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140236b98]
call fcn.14009ce78
mov eax, dword [rsp + 0x30]
jmp 0x14019ce2c
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov dword [rcx + rax], 0x4d2
mov qword [rsp + 0x48], 0x1000
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x38]
mov r8d, 0x1000
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
test eax, eax
je 0x14019cde0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140236bc0]
call fcn.14009ce78
mov dword [rsp + 0x30], 0
jmp 0x14019ce02
cmp qword [rsp + 0x48], 1
je 0x14019cdf2
mov dword [rsp + 0x34], 1
jmp 0x14019cdfa
mov dword [rsp + 0x34], 0
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x30], eax
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140225770
add rsp, 0x68
ret