joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180016e4c
Capabilities:
Write file on windows

Disassembly:
jmp 0x180026420
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
mov rax, qword [0x180054018]
xor rax, rbp
mov qword [rbp + 0x1a0], rax
lea rcx, [0x18005d010]
call fcn.180016e79
mov rax, qword [rbp + 0x1d0]
cmp qword [rax + 0x68], 0
je 0x180026486
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x18002648d
mov al, 1
jmp 0x1800265e7
call fcn.1800163e3
mov rcx, qword [rbp + 0x1d0]
mov rcx, qword [rcx]
mov qword [rbp + 0x198], rcx
mov edx, eax
mov rcx, qword [rbp + 0x1d0]
mov rax, qword [rbp + 0x198]
call qword [rax + 0x18]
mov dword [rbp + 0x164], eax
call fcn.1800163e3
mov dword [rbp + 0x184], eax
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x184]
call fcn.180016c1c
movzx eax, al
test eax, eax
je 0x1800264e8
xor al, al
jmp 0x1800265e7
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1d0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x1d0]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x194], eax
cmp dword [rbp + 0x194], 0
je 0x18002654d
cmp dword [rbp + 0x194], 1
je 0x180026558
cmp dword [rbp + 0x194], 3
je 0x1800265d6
jmp 0x1800265e5
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x1800265a8
mov rax, qword [rbp + 0x1d0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x1800265a8
xor al, al
jmp 0x1800265e7
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1800265c3
mov dword [rbp + 0x194], 1
jmp 0x1800265cd
mov dword [rbp + 0x194], 0
movzx eax, byte [rbp + 0x194]
jmp 0x1800265e7
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x1800265e7
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x18004ad70]
call fcn.180016bf4
mov rax, rdi
mov rcx, qword [rbp + 0x1a0]
xor rcx, rbp
call fcn.1800166e0
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret
Function at 0x180016f5a
Capabilities:
Enumerate processes

Disassembly:
jmp 0x18003d0e0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x428
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x448]
mov rax, qword [0x180054018]
xor rax, rbp
mov qword [rbp + 0x3f8], rax
lea rcx, [0x18005d032]
call fcn.180016e79
mov qword [rbp + 8], 0
lea rax, [rbp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
xor edx, edx
mov ecx, 2
call fcn.1800166b8
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x18003d15c
xor eax, eax
jmp 0x18003d1ad
mov dword [rbp + 0x30], 0x238
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.1800168ed
test eax, eax
je 0x18003d1a1
lea rdx, [rbp + 0x5c]
mov rcx, qword [rbp + 0x420]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x18003d18e
mov eax, dword [rbp + 0x38]
jmp 0x18003d1ad
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.180016c76
test eax, eax
jne 0x18003d174
jmp 0x18003d1ab
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x18004cef0]
call fcn.180016bf4
mov rax, rdi
mov rcx, qword [rbp + 0x3f8]
xor rcx, rbp
call fcn.1800166e0
lea rsp, [rbp + 0x408]
pop rdi
pop rbp
ret
Function at 0x140002504
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140091ae0
mov rax, rcx
neg rcx
test rax, 7
je 0x140091afd
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x140091b58
test al, 7
jne 0x140091af0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x140091b11
mov rdx, qword [rax - 8]
test dl, dl
je 0x140091b82
test dh, dh
je 0x140091b7c
shr rdx, 0x10
test dl, dl
je 0x140091b76
test dh, dh
je 0x140091b70
shr rdx, 0x10
test dl, dl
je 0x140091b6a
test dh, dh
je 0x140091b64
shr edx, 0x10
test dl, dl
je 0x140091b5e
test dh, dh
jne 0x140091b11
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x140002531
Capabilities:
Query environment variable

Disassembly:
jmp 0x1400abe50
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1400ab9d0
lea rcx, [rsp + 0x20]
call fcn.1400aba20
movzx eax, al
test eax, eax
jne 0x1400abe95
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.1400aba00
mov rax, qword [rsp + 0x40]
jmp 0x1400abf8f
lea rcx, [rsp + 0x20]
call fcn.1400abb20
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.1400abac0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.14000272f
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400021bc
lea rcx, [rsp + 0x28]
call fcn.1400029d7
movzx eax, al
test eax, eax
jne 0x1400abf2f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.140003521
lea rcx, [rsp + 0x20]
call fcn.1400aba00
mov rax, qword [rsp + 0x50]
jmp 0x1400abf8f
lea rcx, [rsp + 0x20]
call fcn.1400abb20
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.140003e4f
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.1400026c1
lea rcx, [rsp + 0x28]
call fcn.14000434a
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.140003521
lea rcx, [rsp + 0x20]
call fcn.1400aba00
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret

Function at 0x14000280b
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140022260
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140021be0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14002229f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140127020]
jmp 0x1400222a9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x140002955
Capabilities:
Query environment variable

Disassembly:
jmp 0x1400abba0
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400ab9d0
lea rcx, [rsp + 0x40]
call fcn.1400abb50
movzx eax, al
test eax, eax
jne 0x1400abbe8
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.1400aba00
mov rax, qword [rsp + 0x70]
jmp 0x1400abdb9
lea rcx, [rsp + 0x40]
call fcn.1400abb20
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.1400abac0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.1400abb20
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.14000330a
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x1400abc8e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.1400aba00
mov rax, qword [rsp + 0x80]
jmp 0x1400abdb9
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.14000272f
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140002603
lea rcx, [rsp + 0x48]
call fcn.1400022fc
movzx eax, al
test eax, eax
jne 0x1400abcf5
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.140001749
lea rcx, [rsp + 0x40]
call fcn.1400aba00
mov rax, qword [rsp + 0x88]
jmp 0x1400abdb9
lea rcx, [rsp + 0x48]
call fcn.140002c02
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.1400abb20
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.14000330a
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x1400abd8b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.140001749
lea rcx, [rsp + 0x40]
call fcn.1400aba00
mov rax, qword [rsp + 0xa0]
jmp 0x1400abdb9
lea rcx, [rsp + 0x48]
call fcn.1400025e0
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.140001749
lea rcx, [rsp + 0x40]
call fcn.1400aba00
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret

Function at 0x140002964
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x140022190
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.140021b60
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400221d1
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140127020]
jmp 0x1400221d7
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret
Function at 0x1400029e1
Capabilities:
Get geographical location

Disassembly:
jmp 0x140096ce0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.140095c10
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140096d47
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x140127030]
jmp 0x140096d69
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.1400022ac
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x1400029f5
Capabilities:
Terminate process

Disassembly:
jmp 0x1400095d0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140002bad
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400c5e30
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x140117010]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x1400c5e56
jmp 0x1400c5ed3
mov rcx, qword [rbp + 0x30]
call fcn.140002504
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x1400c5e6f
jmp 0x1400c5ed3
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x1400c5e8c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140001889
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.140001c2b
test eax, eax
jne 0x1400c5ed3
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.1400026b7
lea rsp, [rbp + 0x20]
pop rbp
ret

Function at 0x140002cd4
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400d9f90
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov rax, qword [rsp]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400d9fb4
xor eax, eax
jmp 0x1400da002
mov rax, qword [rsp]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp]
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
cmp dword [rax], 0x4550
je 0x1400d9fdc
xor eax, eax
jmp 0x1400da002
mov rax, qword [rsp + 8]
add rax, 0x18
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
movzx eax, word [rax]
cmp eax, 0x20b
je 0x1400d9ffd
xor eax, eax
jmp 0x1400da002
mov eax, 1
add rsp, 0x28
ret

Function at 0x140002e3c
Capabilities:
Set environment variable

Disassembly:
jmp 0x1400add00
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret

Function at 0x140002ff9
Capabilities:
Parse pe header

Disassembly:
jmp 0x14000a960
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14000a980
xor al, al
jmp 0x14000aa01
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14000a993
xor al, al
jmp 0x14000aa01
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14000a9bd
xor al, al
jmp 0x14000aa01
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14000a9d1
xor al, al
jmp 0x14000aa01
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14000a9e3
xor al, al
jmp 0x14000aa01
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14000a9ff
xor al, al
jmp 0x14000aa01
mov al, 1
add rsp, 0x38
ret
Function at 0x140003283
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x1400d9e00
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x10], rax
mov dword [rsp], 0
mov rax, qword [rsp + 0x10]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x10]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 8], rax
jmp 0x1400d9e5e
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov rax, qword [rsp + 8]
add rax, 0x28
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x10]
movzx eax, word [rax + 6]
cmp dword [rsp], eax
jae 0x1400d9e9d
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0xc]
cmp qword [rsp + 0x38], rax
jb 0x1400d9e9b
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 8]
add eax, dword [rcx + 8]
mov eax, eax
cmp qword [rsp + 0x38], rax
jae 0x1400d9e9b
mov rax, qword [rsp + 8]
jmp 0x1400d9e9f
jmp 0x1400d9e48
xor eax, eax
add rsp, 0x28
ret

Function at 0x140003481
Capabilities:
Terminate process

Disassembly:
jmp 0x1400924d0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1400924fe
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.140003b4d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140003ba7
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400a55d0
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x140003c47
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1400222d0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140021c20
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140022319
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140127020]
jmp 0x140022328
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x140003d3c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1400dab70
mov word [rsp + 0x10], dx
mov qword [rsp + 8], rcx
sub rsp, 0x48
movzx eax, word [rsp + 0x58]
movd xmm0, eax
movdqa xmmword [rsp + 0x20], xmm0
pshuflw xmm0, xmmword [rsp + 0x20], 0
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [rsp + 0x20]
pshufd xmm0, xmm0, 0
movdqa xmmword [rsp + 0x20], xmm0
mov rax, qword [rsp + 0x50]
and rax, 0xfff
cmp rax, 0xff0
ja 0x1400dac81
mov rax, qword [rsp + 0x50]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [rsp + 0x10]
pxor xmm0, xmmword [rsp + 0x10]
movdqa xmmword [rsp + 0x10], xmm0
movdqa xmm0, xmmword [rsp + 0x10]
pcmpeqw xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x10], xmm0
movdqa xmm0, xmmword [rsp + 0x30]
pcmpeqw xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [rsp + 0x10]
por xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x10], xmm0
movdqa xmm0, xmmword [rsp + 0x10]
pmovmskb eax, xmm0
mov dword [rsp], eax
cmp dword [rsp], 0
je 0x1400dac71
mov eax, dword [rsp]
bsf eax, eax
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
add rax, qword [rsp + 0x50]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x58]
cmp eax, ecx
jne 0x1400dac61
mov rax, qword [rsp + 0x50]
mov qword [rsp + 8], rax
jmp 0x1400dac6a
mov qword [rsp + 8], 0
mov rax, qword [rsp + 8]
jmp 0x1400dacbc
mov rax, qword [rsp + 0x50]
add rax, 0x10
mov qword [rsp + 0x50], rax
jmp 0x1400dacb7
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x58]
cmp eax, ecx
jne 0x1400dac99
mov rax, qword [rsp + 0x50]
jmp 0x1400dacbc
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
test eax, eax
jne 0x1400daca9
xor eax, eax
jmp 0x1400dacbc
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
jmp 0x1400dabab
add rsp, 0x48
ret
Function at 0x140008b20
Capabilities:
Create thread

Disassembly:
jmp 0x140008b20
push rbx
sub rsp, 0x50
mov rax, qword [0x140117010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rdx
cmp ecx, 3
je 0x140008bfd
mov rdx, qword [rdx]
lea rcx, str._nUsage:__S__efsId___command__n_n
call fcn.140002630
lea rcx, str.The_available_efsIds_are_as_follows:__n
call fcn.140002630
lea rcx, str._____0__EfsRpcOpenFileRaw_n
call fcn.140002630
lea rcx, str._____1__EfsRpcEncryptFileSrv_n
call fcn.140002630
lea rcx, str._____2__EfsRpcDecryptFileSrv_n
call fcn.140002630
lea rcx, str._____3__EfsRpcQueryUsersOnFile_n
call fcn.140002630
lea rcx, str._____4__EfsRpcQueryRecoveryAgents_n
call fcn.140002630
lea rcx, str._____5__EfsRpcRemoveUsersFromFile__Failed__n
call fcn.140002630
lea rcx, str._____6__EfsRpcAddUsersToFile_n
call fcn.140002630
lea rcx, str._____7__EfsRpcFileKeyInfo_n
call fcn.140002630
lea rcx, str._____8__EfsRpcDuplicateEncryptionInfoFile__Failed__n
call fcn.140002630
lea rcx, str._____9__EfsRpcAddUsersToFileEx_n
call fcn.140002630
lea rcx, str._____10__EfsRpcFileKeyInfoEx__Failed__n
call fcn.140002630
lea rcx, str._____11__EfsRpcGetEncryptedFileMetadata__Failed__n
call fcn.140002630
lea rcx, str._____12__EfsRpcSetEncryptedFileMetadata__Failed__n
call fcn.140002630
jmp 0x140008d2c
mov r9, qword [rdx + 0x10]
lea r8, [0x1400010eb]
mov qword [rsp + 0x60], rdi
xor edx, edx
xor edi, edi
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rbx + 8]
call fcn.140001091
mov ecx, 0x3e8
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
lea r8, str.127.0.0.1
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea rdx, str.ncacn_np
lea rcx, str.df1941c5_fe89_4e79_bf10_463657acf44d
call qword [sym.imp.RPCRT4.dll_RpcStringBindingComposeW]
test eax, eax
je 0x140008c77
lea rbx, str.____RpcStringBindingComposeW___Error:__i_n
jmp 0x140008ce7
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x30]
call qword [sym.imp.RPCRT4.dll_RpcBindingFromStringBindingW]
test eax, eax
je 0x140008c94
lea rbx, str.____RpcBindingFromStringBindingW___Error:__i_n
jmp 0x140008ce7
mov rcx, qword [rsp + 0x30]
lea rdx, str.127.0.0.1
mov r9d, 9
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea r8d, [r9 - 3]
call qword [sym.imp.RPCRT4.dll_RpcBindingSetAuthInfoW]
test eax, eax
je 0x140008cc6
lea rbx, str.____RpcBindingSetAuthInfoW___Error:__i_n
jmp 0x140008ce7
mov rcx, qword [rsp + 0x30]
mov edx, 0xc
mov r8d, 0x4c4b40
call qword [sym.imp.RPCRT4.dll_RpcBindingSetOption]
test eax, eax
je 0x140008d05
lea rbx, str.____RpcBindingSetOption___Error:__i_n
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140002630
lea rcx, str.____Create_rpc_binding_failed:__i_n
call fcn.140002630
jmp 0x140008d27
lea rcx, [rsp + 0x38]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
mov rcx, qword [rsp + 0x30]
mov edx, ebx
call fcn.1400023a1
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdi, qword [rsp + 0x60]
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400026b7
add rsp, 0x50
pop rbx
ret
Function at 0x140022260
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140022260
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140021be0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14002229f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140127020]
jmp 0x1400222a9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret