joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140049644
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
jle 0x14004969f
mov rax, qword [rcx + 8]
mov r10, qword [rcx]
mov r8, qword [rcx + 0x18]
mov r9, qword [rcx + 0x10]
mov r11d, edx
add r10, rax
add r9, r8
rol rax, 0xd
xor rax, r10
rol r8, 0x10
xor r8, r9
rol r10, 0x20
add r9, rax
add r10, r8
rol rax, 0x11
rol r8, 0x15
xor rax, r9
xor r8, r10
rol r9, 0x20
sub r11, 1
jne 0x14004965a
mov qword [rcx + 8], rax
mov qword [rcx], r10
mov qword [rcx + 0x18], r8
mov qword [rcx + 0x10], r9
ret

Function at 0x140065320
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140065345
xor eax, eax
jmp 0x140065455
cmp qword [rcx + 0x68], 0
je 0x140065359
lfence
call fcn.14000deb0
jmp 0x140065455
mov rax, qword [rcx + 0x38]
mov rbp, rdi
mov qword [rsp + 0x60], rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x140065375
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140065377
xor ecx, ecx
movsxd rax, ecx
mov rbx, rdi
test ecx, ecx
je 0x1400653b1
cmp rax, rdi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.140089be0
mov rax, qword [rsi + 0x50]
sub rbp, rbx
add r14, rbx
mov qword [rsp + 0x60], rbp
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
mov rbx, rbp
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14006544a
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400653ec
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov r15d, 0xfff
cmp rbx, r15
jbe 0x140065426
mov r9, qword [rsi + 0x80]
mov r8, r15
mov edx, 1
mov rcx, r14
call fcn.140094434
sub rbp, rax
add r14, rax
mov qword [rsp + 0x60], rbp
mov rbx, rbp
cmp rax, r15
jne 0x14006544a
cmp rbp, r15
ja 0x1400653f7
test rbx, rbx
je 0x14006544a
mov r9, qword [rsi + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, r14
call fcn.140094434
sub rbx, rax
mov qword [rsp + 0x60], rbx
lfence
sub rdi, qword [rsp + 0x60]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140065850
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x30]
call fcn.140089ff0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [rsp + 0x20]
cmp ecx, 5
ja 0x1400658c9
je 0x1400658c0
test ecx, ecx
je 0x1400658b7
sub ecx, 1
je 0x1400658ae
sub ecx, 1
je 0x1400658a5
sub ecx, 1
je 0x14006589c
cmp ecx, 1
jne 0x1400658e2
lea rax, [0x1400d1348]
jmp 0x140065916
lea rax, [0x1400d1340]
jmp 0x140065916
lea rax, str.ALPHA
jmp 0x140065916
lea rax, str.MIPS
jmp 0x140065916
lea rax, [0x1400d1318]
jmp 0x140065916
lea rax, [0x1400d1350]
jmp 0x140065916
sub ecx, 6
je 0x14006590f
sub ecx, 1
je 0x140065906
sub ecx, 1
je 0x1400658fd
sub ecx, 1
je 0x1400658f4
cmp ecx, 1
je 0x1400658eb
lea rax, str.UNKNOWN
jmp 0x140065916
lea rax, str.IA32_ON_WIN64
jmp 0x140065916
lea rax, str.AMD64
jmp 0x140065916
lea rax, str.MSIL
jmp 0x140065916
lea rax, str.ALPHA64
jmp 0x140065916
lea rax, str.IA64
add rsp, 0x58
ret
Function at 0x14006f31c
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14006f32f
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.14006f948
lea rdx, [0x1401230a0]
lea rcx, [rsp + 0x20]
call fcn.14008a248
int3

Function at 0x140079d6c
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x14012b670]
xor edx, edx
jmp fcn.14006f31c

Function at 0x14007a73c
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x14012b670]
jmp fcn.14006f31c

Function at 0x140086690
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x140086750]
mov r9, qword [r9 + 8]
jmp fcn.1400776d4

Function at 0x140086724
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x140086760]
mov r9, qword [r9 + 8]
jmp fcn.1400776d4

Function at 0x1400a3f04
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400a3d30
Function at 0x1400bd460
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
mov esi, edi
test rcx, rcx
je 0x1400bd523
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebp, eax
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rbx + rdx*2], si
jne 0x1400bd494
lea ecx, [rax + 1]
add rdx, rcx
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x1400bd526
mov edx, ebp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r8d, eax
lea ecx, [r8 - 1]
cmp word [rsi + rcx*2], 0x5c
je 0x1400bd4df
mov eax, 0x5c
mov word [rsi + r8*2], ax
inc r8d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], di
jne 0x1400bd4e3
test rax, rax
je 0x1400bd523
mov rdx, rdi
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rbx + rdx*2]
lea ecx, [rdi + r8]
inc edi
mov word [rsi + rcx*2], ax
mov edx, edi
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400bd514
cmp rdx, rax
jb 0x1400bd500
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400bddc0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rax, qword [0x140130b60]
xor esi, esi
mov rbx, r8
mov r14, rdx
mov ebp, ecx
test rax, rax
jne 0x1400bde09
xor edx, edx
lea rcx, str.Setupapi.dll
call fcn.1400bead0
mov qword [0x140130b60], rax
test rax, rax
je 0x1400bdee6
cmp qword [0x140130b68], rsi
jne 0x1400bde39
lea rdx, [0x1400e6a10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130b68], rax
test rax, rax
je 0x1400bdee6
mov rax, qword [0x140130b60]
cmp qword [0x140130b70], rsi
jne 0x1400bde69
lea rdx, [0x1400e6a28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130b70], rax
test rax, rax
je 0x1400bdee6
mov rax, qword [0x140130b60]
cmp qword [0x140130b80], rsi
jne 0x1400bde95
lea rdx, [0x1400e68e0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130b80], rax
test rax, rax
je 0x1400bdee6
mov rax, qword [0x140130b60]
cmp qword [0x140130b78], rsi
jne 0x1400bdec1
lea rdx, [0x1400e6a40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130b78], rax
test rax, rax
je 0x1400bdee6
mov rax, qword [0x140130b60]
cmp qword [0x1401308d8], rsi
jne 0x1400bdeed
lea rdx, [0x1400e6908]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401308d8], rax
test rax, rax
jne 0x1400bdeed
xor eax, eax
jmp 0x1400bdf8d
mov r9d, 6
mov qword [rsp + 0x30], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [0x140130b68]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400bdf86
xor eax, eax
mov r8, rbx
mov qword [rbx], rax
xor edx, edx
mov qword [rbx + 8], rax
mov rcx, rdi
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov dword [rbx], 0x20
call qword [0x140130b70]
test eax, eax
je 0x1400bdf7d
nop word [rax + rax]
mov r8, rbx
mov rdx, rdi
mov ecx, ebp
call fcn.1400be410
cmp eax, 1
je 0x1400bdfa3
xor eax, eax
inc esi
mov qword [rbx], rax
mov r8, rbx
mov qword [rbx + 8], rax
mov edx, esi
mov qword [rbx + 0x10], rax
mov rcx, rdi
mov qword [rbx + 0x18], rax
mov dword [rbx], 0x20
call qword [0x140130b70]
test eax, eax
jne 0x1400bdf40
mov rcx, rdi
call qword [0x1401308d8]
xor eax, eax
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [r14], rdi
mov eax, 1
jmp 0x1400bdf88
Function at 0x1400bf680
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x30
mov rbx, rcx
xor ebp, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rbx, rbx
je 0x1400bf8a5
xor edx, edx
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], dx
jne 0x1400bf6a6
test rax, rax
je 0x1400bf6e4
xor ecx, ecx
nop word [rax + rax]
movzx r8d, word [rbx + rcx*2]
cmp r8w, 0x5c
je 0x1400bf8a5
cmp r8w, 0x2f
je 0x1400bf8a5
inc edx
mov ecx, edx
cmp rcx, rax
jb 0x1400bf6c0
mov qword [rsp + 0x40], rsi
mov rcx, rbx
mov qword [rsp + 0x48], rdi
call fcn.1400bf8c0
mov rsi, rax
test rax, rax
je 0x1400bf7d5
mov qword [rsp + 0x50], r14
call fcn.1400c0120
mov r14, rax
test rax, rax
je 0x1400bf7c2
mov rcx, rsi
call fcn.1400bd2c0
test eax, eax
je 0x1400bf7ab
lea rax, str.system32_
mov qword [rsp + 0x20], rax
lea rdi, [rsp + 0x20]
lea rax, str.SystemRoot_system32_
mov qword [rsp + 0x28], rax
nop word [rax + rax]
mov rdx, qword [rdi]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdx + rbx*2], bp
jne 0x1400bf757
mov r8, rbx
mov rcx, rsi
call fcn.1400952a0
test eax, eax
je 0x1400bf77f
add rdi, 8
lea rax, [rsp + 0x30]
cmp rdi, rax
jb 0x1400bf750
jmp 0x1400bf78e
lea rdx, [rsi + rbx*2]
mov rcx, r14
call fcn.1400bed20
mov rbp, rax
lea rax, [rsp + 0x30]
cmp rdi, rax
jne 0x1400bf7b9
mov rcx, rsi
call fcn.1400bd260
test eax, eax
je 0x1400bf7b9
mov rbp, rsi
xor esi, esi
jmp 0x1400bf7b9
mov rdx, rsi
mov rcx, r14
call fcn.1400bed20
mov rbp, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r14, qword [rsp + 0x50]
jmp 0x1400bf871
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7e
jne 0x1400bf87a
mov rcx, rbx
call fcn.1400bd140
mov rdi, rax
test rax, rax
je 0x1400bf87a
mov ecx, 0x37e4
call fcn.1400be8b0
test eax, eax
je 0x1400bf80f
xor ecx, ecx
call fcn.1400bfdc0
jmp 0x1400bf814
call fcn.1400c0120
mov rbx, rax
test rax, rax
je 0x1400bf868
mov rdx, rdi
mov rcx, rax
call fcn.1400bed20
mov rbp, rax
test rax, rax
je 0x1400bf85f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400bf841
test al, 0x50
je 0x1400bf85f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1400bf854
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ebp, ebp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rbp, rbp
je 0x1400bf87a
xor ecx, ecx
jmp 0x1400bf887
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400bf88d
lea ecx, [rax + 0x7e]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [rsp + 0x48]
mov rax, rbp
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x30
pop rbp
ret
Function at 0x1400c0120
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
mov ecx, 0x40
add rdx, rdx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x1400c0182
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1400c0177
cmp edi, eax
jb 0x1400c0177
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400c3e60
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov byte [r9], 1
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
call fcn.1400c39b8
test al, al
je 0x1400c3ed4
mov rcx, rbx
call fcn.1400c39c0
test al, al
je 0x1400c3ed4
mov eax, 0xffffffff
cmp rsi, rax
ja 0x1400c3ed4
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x58]
and dword [rsp + 0x58], 0
mov r8d, esi
and qword [rsp + 0x20], 0
mov rdx, rbp
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400c3ece
mov byte [rdi], 0
mov eax, dword [rsp + 0x58]
jmp 0x1400c3ed6
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400c4000
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov byte [r9], 1
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
call fcn.1400c39b8
test al, al
je 0x1400c4074
mov rcx, rbx
call fcn.1400c39c8
test al, al
je 0x1400c4074
mov eax, 0xffffffff
cmp rsi, rax
ja 0x1400c4074
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x58]
and dword [rsp + 0x58], 0
mov r8d, esi
and qword [rsp + 0x20], 0
mov rdx, rbp
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400c406e
mov byte [rdi], 0
mov eax, dword [rsp + 0x58]
jmp 0x1400c4076
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140003130
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1400043d0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.1400043d0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x1400031a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400090a4]
mov rbx, rcx
test esi, esi
jle 0x1400032d0
mov rax, qword [0x1400090a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x1400031eb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140003275
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x1400031d0
mov rcx, rbx
call fcn.140003bf0
mov rdi, rax
test rax, rax
je 0x1400032f2
mov rax, qword [0x1400090a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140003d30
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400090a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400032d7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14000326e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140003280
add dword [0x1400090a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1400090a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000326e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140003130
nop dword [rax]
xor esi, esi
jmp 0x1400031f8
mov rax, qword [0x1400090a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140003130
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140003130
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140003860
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140009100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400090e0]
test rbx, rbx
je 0x1400038bc
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x1400038b3
test rsi, rsi
je 0x1400038b3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140003898
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140003bf0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140006690]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140003c10
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140003c18
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140003c10
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x140003c6d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140003c64
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140003c10
add rax, 0x28
cmp rax, r9
jne 0x140003c50
xor eax, eax
ret

Function at 0x140003c70
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006690]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x140003c8f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140003c98
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x140003c8f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140003d30
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006690]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140003d4f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140003d58
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x14001a3d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14001a460
cmp r10, r11
jb 0x14001a4d6
cmp r10, rdx
ja 0x14001a4ea
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x14001a462
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14001a440
jmp 0x14001a4c4
ja 0x14001a46a
mov r11, r10
cmp rax, r8
jne 0x14001a404
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14001a4a0
mov rdi, r8
sub ecx, edx
jns 0x14001a4bb
jmp 0x14001a4c6
cmp r8, rsi
je 0x14001a4fb
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14001a4c6
xor al, 1
cmp rdi, rsi
jne 0x14001a480
jmp 0x14001a4c6
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, [0x1413ba808]
mov rcx, r11
mov rdx, r10
call fcn.140053840
ud2
lea r8, [0x1413ba808]
mov rcx, r10
call fcn.1400535c0
ud2
lea rcx, [0x1413beea8]
lea r8, [0x1413ba7f0]
mov edx, 0x2b
call fcn.140053640
ud2
Function at 0x1400216c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r9, qword [rcx]
test r9, r9
je 0x14002171b
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x14002171b
movzx eax, byte [r9 + rcx]
cmp eax, 0x49
je 0x140021736
cmp eax, 0x42
jne 0x14002171b
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x1400217e6
cmp byte [r9 + r11], 0x5f
jne 0x1400217e6
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x14002184e
mov rcx, rsi
xor edx, edx
call fcn.14001cbb0
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.14001cbb0
test al, al
jne 0x1400218e1
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140021772
lea rdx, [0x1413be7a3]
mov r8d, 1
call fcn.1400184d0
test al, al
jne 0x1400218e1
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x14002172a
xor r14d, r14d
lea rbx, [0x1413beb58]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x1400217a4
cmp byte [rax + rcx], 0x45
je 0x14002190a
sub r14, 1
jb 0x1400217c9
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x1400217c9
mov r8d, 2
mov rdx, rbx
call fcn.1400184d0
test al, al
jne 0x1400218e1
mov rcx, rsi
call fcn.14001e4c0
test al, al
jne 0x1400218e1
mov rax, qword [rsi]
test rax, rax
jne 0x140021790
jmp 0x14002172a
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r8b, 1
cmp r11, r10
jae 0x1400218a8
movzx edx, byte [r9 + r11]
cmp dl, 0x5f
je 0x140021842
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x14002182c
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x14002181b
add dl, 0xa9
jmp 0x14002182a
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x1400218a8
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x1400218a8
movzx edx, bl
add rax, rdx
jae 0x1400217f0
jmp 0x1400218a8
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x1400218a8
cmp rax, rcx
jae 0x1400218a5
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x1400218e9
cmp qword [rsi + 0x20], 0
je 0x140021903
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.1400216c0
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x14002172c
mov r8b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x1400218f8
lea rax, [0x1413beb08]
lea rdx, [0x1413beb18]
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
or r8, 0x10
call fcn.1400184d0
test al, al
je 0x1400218f8
mov dil, 2
jmp 0x14002172a
mov dil, 1
xor r8d, r8d
mov rcx, qword [rsi + 0x20]
test rcx, rcx
jne 0x1400218b3
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x14002172a
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x14002172a
Function at 0x1400261a0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x1413c1590]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140026213
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x14002624a
test eax, eax
js 0x140026224
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14002623d
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, [0x1413c15f0]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.140024090
mov rcx, rax
call fcn.140024200
mov ecx, 7
int 0x29
ud2