joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011b730
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x140953a80]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov qword [rax + 0x10], rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]

Function at 0x14011b850
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
sub rsp, 0x28
xor r8d, r8d
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [0x1409d58c0], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140953a80], eax
add rsp, 0x28
jmp fcn.14011bcb0

Function at 0x14011b880
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd rbp, ecx
mov esi, edx
mov ecx, dword [0x140953a80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
cmp esi, 0xffffffff
jne 0x14011b8b0
mov esi, dword [rax + 0x10]
mov eax, dword [rax + 0x10]
mov r8, qword [rbx + 8]
lea edx, [rax + rbp*2]
movsxd rax, edx
lea rcx, [r8 - 4]
cmp rax, rcx
jl 0x14011b8d1
lea eax, [rdx + 0x4000]
movsxd r9, eax
jmp 0x14011b8e3
mov eax, 0x100000
cmp r8, rax
jle 0x14011b900
cmp edx, eax
cmovl edx, eax
mov r9d, edx
mov r8, qword [rbx]
xor edx, edx
mov qword [rbx + 8], r9
add r9, 0xa
mov rcx, qword [0x1409d58c0]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rbx], rax
mov rax, qword [rbx]
movsxd rdx, esi
mov rsi, qword [rsp + 0x40]
add rax, rdx
lea rcx, [rdx + rbp*2]
mov rbp, qword [rsp + 0x38]
mov qword [rbx + 0x10], rcx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14011b930
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
mov ecx, dword [0x140953a80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ecx, [rbx + rbx]
movsxd rdx, ecx
sub qword [rax + 0x10], rdx
add rsp, 0x20
pop rbx
ret

Function at 0x14011ba60
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
movsxd rbx, ecx
mov ecx, dword [0x140953a80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edx, edx
mov qword [rax + 0x10], rbx
mov rax, qword [rax]
mov word [rbx + rax], dx
add rsp, 0x20
pop rbx
ret

Function at 0x14011ba90
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x140953a80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
cmp rbx, rcx
jb 0x14011bac4
mov rdx, qword [rax + 0x10]
add rdx, rcx
cmp rbx, rdx
ja 0x14011bac4
sub ebx, ecx
lea eax, [rbx + 1]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14011bad0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
movsxd rbx, ecx
mov ecx, dword [0x140953a80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
dec rbx
mov rax, qword [rax]
add rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x14011bb40
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
movsxd rbx, ecx
mov ecx, dword [0x140953a80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rbx, qword [rax]
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14011bcb0
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x1409d58c0]
xor edx, edx
mov r8d, 0x340
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [0x1409d58c0]
xor edx, edx
mov rbx, rax
lea r8d, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx + 8], SafeArrayGetLBound
mov rdx, rbx
mov qword [rbx], rax
xor eax, eax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x338], rax
mov ecx, dword [0x140953a80]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsSetValue]

Function at 0x140126580
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x388], 0
mov rdi, rcx
jne 0x1401266af
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
xor esi, esi
mov ebx, esi
nop dword [rax]
nop dword [rax + rax]
mov edx, 4
mov dword [rsp + 0x40], esi
lea rcx, [rsp + 0x40]
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140126630
mov edx, dword [rsp + 0x40]
mov rcx, rsi
nop
cmp rbx, 4
jae 0x1401265f1
mov eax, edx
shr eax, cl
add rcx, 8
mov byte [rsp + rbx + 0x48], al
inc rbx
cmp rcx, 0x20
jb 0x1401265d0
cmp rbx, 4
jb 0x1401265b0
lea rcx, str.EXPAT_ENTROPY_DEBUG
call fcn.1401e6604
mov ebx, dword [rsp + 0x48]
test rax, rax
je 0x14012669f
cmp byte [rax], 0x31
jne 0x14012669f
cmp byte [rax + 1], sil
jne 0x14012669f
mov ecx, 2
call fcn.140088d3c
lea r8, str.rand_s
jmp 0x14012667e
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ebx, dword [rsp + 0x48]
xor ebx, dword [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor eax, ebx
lea rcx, str.EXPAT_ENTROPY_DEBUG
imul ebx, eax, 0x7fffffff
call fcn.1401e6604
test rax, rax
je 0x14012669f
cmp byte [rax], 0x31
jne 0x14012669f
cmp byte [rax + 1], sil
jne 0x14012669f
mov ecx, 2
call fcn.140088d3c
lea r8, str.fallback_4_
mov dword [rsp + 0x28], 4
lea rdx, str.Entropy:__s_____0x_0lx___lu_bytes__n
mov r9d, 8
mov dword [rsp + 0x20], ebx
mov rcx, rax
call fcn.1401212f0
mov rsi, qword [rsp + 0x58]
mov dword [rdi + 0x388], ebx
mov rbx, qword [rsp + 0x50]
cmp byte [rdi + 0x1c8], 0
je 0x1401266cc
lea rdx, str.xmlhttp:__www.w3.org_XML_1998_namespace
mov rcx, rdi
add rsp, 0x30
pop rdi
jmp fcn.140125a80
mov al, 1
add rsp, 0x30
pop rdi
ret
Function at 0x140186c40
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push r14
push r15
sub rsp, 0x30
mov rbx, r9
mov r15, r8
mov ebp, edx
mov r14, rcx
test rcx, rcx
je 0x140186e5a
test rbx, rbx
je 0x140186e5a
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
mov rdi, qword [rsp + 0x78]
test rdi, rdi
je 0x140186c94
mov rax, qword [rdi + 8]
test rax, rax
je 0x140186ca6
mov rdx, qword [rdi]
mov ecx, gethostbyname
call rax
jmp 0x140186c9e
mov ecx, gethostbyname
call fcn.1401aea14
mov rsi, rax
test rax, rax
jne 0x140186cc4
mov eax, 0xfffffffc
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
mov rax, qword [rsp + 0x70]
mov qword [rsi + 8], rax
lea rax, [rsi + 0x10]
mov qword [rsi], rbx
xor ebx, ebx
test rax, rax
je 0x140186d3d
test rdi, rdi
je 0x140186d19
cmp qword [rdi], rbx
jne 0x140186cf7
cmp qword [rdi + 0x18], rbx
jne 0x140186cfd
cmp qword [rdi + 8], rbx
jne 0x140186cf7
cmp qword [rdi + 0x10], rbx
je 0x140186d19
cmp qword [rdi + 0x18], rbx
je 0x140186d3d
cmp qword [rdi + 8], rbx
jne 0x140186d09
cmp qword [rdi + 0x10], rbx
je 0x140186d3d
movups xmm0, xmmword [rdi]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rax + 0x10], xmm1
jmp 0x140186d3d
mov qword [rax], rbx
lea rcx, [0x14013a430]
mov qword [rax + 8], rcx
lea rcx, [0x14013a440]
mov qword [rax + 0x10], rcx
lea rcx, [0x14013a3b0]
mov qword [rax + 0x18], rcx
lea rax, [rsp + 0x50]
mov r9, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x140186f80]
mov rdx, r15
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [r14], rax
mov r8, rax
test rax, rax
jne 0x140186daf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140181370
mov ebx, eax
test eax, eax
je 0x140186e53
test rdi, rdi
je 0x140186da0
mov r8, qword [rdi + 0x18]
test r8, r8
je 0x140186da8
mov rdx, qword [rdi]
mov rcx, rsi
call r8
mov eax, ebx
jmp 0x140186cab
mov rcx, rsi
call fcn.1401aea1c
mov eax, ebx
jmp 0x140186cab
lea eax, [rbp + 5]
cmp eax, 6
ja case.0x140186dce.2
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x186e70]
add rcx, rdx
jmp rcx
mov ebx, 0xfffffff1
mov rcx, r8
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
jmp 0x140186cab
mov ebx, 0xfffffffe
mov rcx, r8
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
jmp 0x140186cab
mov ebx, 0xffffffff
mov rcx, r8
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
jmp 0x140186cab
mov ebx, 1
mov rcx, r8
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
jmp 0x140186cab
mov ebx, 2
mov rcx, r8
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
jmp 0x140186cab
mov ebx, SafeArrayGetLBound
mov edx, ebx
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
jmp 0x140186cab
mov rbx, qword [rsp + 0x68]
mov eax, 0xfffffffe
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
Function at 0x1401ada40
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
cmp dword [0x1409d4448], 0
lea rbx, [0x1409d4458]
mov r14, rdx
mov r15, rcx
jne 0x1401ada8d
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, rbx
mov dword [0x1409d444c], eax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x1409d4448], 1
mov ecx, dword [0x1409d444c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbp, rax
test rax, rax
jne 0x1401adb62
mov rcx, qword [0x140957d88]
lea edx, [rax + 8]
lea r8d, [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x1401adb8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x1409d4450]
test rax, rax
je 0x1401adadd
mov qword [rax], rbp
mov rcx, rbx
mov qword [rbp + 8], rax
mov qword [0x1409d4450], rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [rsp + 0x30], 0
lea r9, [rbp + 0x20]
and dword [rsp + 0x28], 0
mov rcx, rax
mov r8, rdi
mov dword [rsp + 0x20], 0x100000
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp + 0x18]
mov r9, rbp
mov dword [rsp + 0x28], 8
or dword [rsp + 0x20], 0xffffffff
lea r8, [0x1401adba8]
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
mov ecx, dword [0x1409d444c]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [0x140957d88]
xor edx, edx
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x1401adb8d
mov qword [rax + 8], r15
mov qword [rax + 0x10], r14
mov rcx, qword [rbp + 0x10]
mov qword [rax], rcx
mov qword [rbp + 0x10], rax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x1401e5870
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.1401ae5c0
sub rsp, rax
mov rax, qword [0x140952e48]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14008f7f8
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x1401e58bf
mov rax, rbp
jmp 0x1401e59c7
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x959820]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.1400931c4
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x959820]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x1401e59c3
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1401e59c3
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.1400931c4
test rax, rax
js 0x1401e59c3
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x1401e59c3
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x1401e59b5
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x1401e59b5
cmp byte [rcx], 0xd
jne 0x1401e599b
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x1401e59aa
cmp byte [rcx + 1], 0xa
jne 0x1401e59aa
inc rcx
jmp 0x1401e59aa
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x953740]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x1401e597d
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x1401e59c7
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1401ae160
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1401ef568
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1401ef57e
mov al, 1
jmp 0x1401ef5de
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1401ef58f
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1401ef5dc
mov ecx, dword [rcx + 0x18]
nop
call fcn.14007fd58
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1401ef5dc
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1401ef5dc
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1401ef5dc
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1401ef5de
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x1401f7900
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400931cc
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400931cc
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1401f7a50
cmp rax, 0xffffffffffffffff
je 0x1401f7a50
xor edi, edi
test rbp, rbp
jle 0x1401f79fb
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14007b728
mov rbx, rax
test rax, rax
jne 0x1401f7988
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1401f79f1
mov edx, 0x8000
mov ecx, r14d
call fcn.1400764c4
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400906b4
cmp eax, 0xffffffff
je 0x1401f79d1
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1401f7998
mov edx, r15d
mov ecx, r14d
call fcn.1400764c4
jmp 0x1401f79f1
cmp byte [rsi + 0x38], dil
je 0x1401f79e8
cmp dword [rsi + 0x34], 5
jne 0x1401f79e8
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], SafeArrayGetLBound
cmp byte [rsi + 0x30], dil
je 0x1401f79f1
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14007aef0
jmp 0x1401f7a64
jns 0x1401f7a64
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400931cc
cmp rax, 0xffffffffffffffff
jne 0x1401f7a1c
cmp byte [rsi + 0x30], dil
je 0x1401f7a64
mov edi, dword [rsi + 0x2c]
jmp 0x1401f7a64
mov ecx, r14d
call fcn.14007fd58
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1401f7a64
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, SafeArrayGetElemsize
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], SafeArrayGetLBound
jmp 0x1401f7a64
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1401f7a5d
mov eax, dword [rsi + 0x2c]
jmp 0x1401f7a62
mov eax, SafeArrayPutElement
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400931cc
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x141875959
Capabilities:
Encode data using xor

Disassembly:
movsb byte [rdi], byte [rsi]
adc eax, 0x369ad870
push rdx
adc ebp, dword [rdx]
test eax, 0xa9270536
pop rcx
leave
sar esp, cl
add dword [rax - 0x37], ebx
leave
call qword [rdi - 0x37]
invalid
leave
mov ch, 0xb6
out 0x4a, eax
leave
cmp al, 0x73
sbb dword [rbp - 0x37], eax
popfq
test esi, ecx
xor dword [rsi], 0x382474ff
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x40]
call fcn.14190ff46
push rdi
mov eax, 0x8291091f
jle 0x141460eb8
sub byte [rdi - 0x28cf85d6], ch
mov ah, 0xa5
cmp ah, dl
sub byte [0x147416d23], cl
loope 0x141460e73
int3
cmp qword [rsp + 0x10], 0x5cc01f6
jne 0x141460eca
call fcn.1414d4727
jbe 0x1418554d4
call fcn.1414bce0a
push rbx
push r13
movabs r13, 0x645d41ab517f05fd
lea r13, [r13*4 + 0x48335063]
lea r13, [r13*2 + 0x7a2876be]
movabs rbx, 0x2e300c6f65fb21b0
movzx r13w, bl
sti
outsd dx, dword gs:[rsi]
or al, 0x30
movzx r13w, bl
not r13d
mov rbx, qword [rsp + 8]
mov qword [rsp + 8], 0xffffffffe7db3145
push rdx
mov rdx, r13
pushfq
or r13b, dl
mov r13, qword [rsp + 0x10]
cmp rdx, 0x7b60482a
movabs rdx, 0x7bc26d062aae590b
popfq
call fcn.1414e38eb
cmpsd dword [rsi], dword [rdi]
loop 0x141875950
mov ch, 0xf2
in al, dx
wait
jg 0x141875a17
iretd
pop rbp
jns 0x1418759ea
cmp al, 0x47
push rdx
ror dword [rsi - 0x4f], cl
sbb al, 0x56
lodsb al, byte [rsi]
jo 0x141875985
mov bh, 0x1f
fiadd dword [rsi + 0xacc7c77]
xor eax, 0xb67c1ad8
jp 0x1418759fd
jp 0x1418759fd
or al, 2
or al, 0x17
xor dword [rsi - 0x79841ec5], 0xffffffb2
int3
test edi, esi
add byte [rbx + rcx*8], dh
scasb al, byte [rdi]
or eax, 0xe03dde0f
test eax, 0x4b1a806c
loopne 0x1418759df
or edi, dword [rcx - 0x50f22c6d]
jo 0x141875a45
sar byte [rdi - 0x7f7775], 1
invalid
stc
invalid
Function at 0x1400012e0
Capabilities:
Enumerate files on windows
Query environment variable

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x190
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov ebp, ecx
xor esi, esi
mov ebx, esi
mov ecx, 0x104
call fcn.1400855e4
mov rdi, rax
mov r8d, 0x104
mov rdx, rax
lea rcx, str.TEMP
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
movdqa xmm0, xmmword [0x140147f10]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], bl
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdi + r8], bl
jne 0x140001342
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140001610
nop
mov r8d, 2
lea rdx, [0x1400a5a2c]
lea rcx, [rsp + 0x20]
call fcn.140001760
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400013be
nop word [rax + rax]
inc ebx
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1400013a0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
cmp ebx, ebp
setl sil
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400013fd
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400013f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001418
call fcn.14007fc3c
mov eax, esi
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.14008556c
int3

Function at 0x140001420
Capabilities:
Enumerate process modules

Disassembly:
push r15
mov eax, 0x1040
call fcn.14007ffb0
sub rsp, rax
mov r15d, ecx
lea r8, [rsp + 0x1058]
lea rcx, [rsp + 0x20]
lea edx, [rax - 0x40]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
jne 0x14000145b
mov eax, 1
add rsp, 0x1040
pop r15
ret
mov qword [rsp + 0x1038], rbp
mov ebp, dword [rsp + 0x1058]
mov qword [rsp + 0x1030], rsi
mov qword [rsp + 0x1020], r14
xor r14d, r14d
shr rbp, 2
mov esi, r14d
test rbp, rbp
je 0x1400014ff
mov qword [rsp + 0x1050], rbx
mov ebx, r14d
mov qword [rsp + 0x1028], rdi
nop dword [rax]
mov r8d, dword [rsp + rbx*4 + 0x20]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1400014e7
lea rdx, [rsp + 0x1060]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1400014de
cmp dword [rsp + 0x1060], 0x103
jne 0x1400014de
inc esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc rbx
cmp rbx, rbp
jl 0x1400014a0
mov rdi, qword [rsp + 0x1028]
mov rbx, qword [rsp + 0x1050]
mov rbp, qword [rsp + 0x1038]
cmp esi, r15d
mov rsi, qword [rsp + 0x1030]
setle r14b
mov eax, r14d
mov r14, qword [rsp + 0x1020]
add rsp, 0x1040
pop r15
ret
Function at 0x14007e530
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 8
mov rax, qword gs:[0x30]
mov r13d, ecx
xor ebx, ebx
xor edi, edi
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov rdx, qword [rax + 0x10]
mov rax, qword [rdx]
mov rdx, qword [rax]
mov rsi, qword [rdx + 0x30]
movsxd rax, dword [rsi + 0x3c]
mov edx, dword [rax + rsi + 0x88]
add rdx, rsi
mov ecx, dword [rdx + 0x14]
mov r15d, dword [rdx + 0x1c]
mov eax, dword [rdx + 0x20]
add r15, rsi
mov r12d, dword [rdx + 0x24]
add rax, rsi
mov r8d, dword [rdx + 0x18]
add r12, rsi
mov dword [rsp + 0x48], r8d
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
test rcx, rcx
je 0x14007e64a
mov qword [rsp + 0x40], rbp
movzx ebp, word [0x1400c0c0c]
mov qword [rsp], r14
cmp dword [r15 + rdi*4], 0
je 0x14007e635
xor r9d, r9d
mov r14d, r8d
test r8d, r8d
je 0x14007e635
nop word [rax + rax]
movzx r11d, word [r12 + r9*2]
cmp r11, rdi
jne 0x14007e623
mov r8d, dword [rax + r9*4]
xor eax, eax
add r8, rsi
movzx r10d, byte [r8]
test r10b, r10b
je 0x14007e612
nop dword [rax]
mov edx, eax
lea r8, [r8 + 1]
mov ecx, ebp
shr edx, cl
mov ecx, eax
shl ecx, 0x19
mov eax, edx
or eax, ecx
movsx ecx, r10b
movzx r10d, byte [r8]
add eax, ecx
test r10b, r10b
jne 0x14007e5f0
cmp eax, r13d
mov rax, qword [rsp + 0x50]
jne 0x14007e623
mov ebx, dword [r15 + r11*4]
add rbx, rsi
inc r9
cmp r9, r14
jb 0x14007e5d0
mov rcx, qword [rsp + 0x58]
mov r8d, dword [rsp + 0x48]
inc rdi
cmp rdi, rcx
jb 0x14007e5b5
mov r14, qword [rsp]
mov rbp, qword [rsp + 0x40]
mov rax, rbx
add rsp, 8
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret