joyce8/EMBER2024-capa huggingface dataset:
Function at 0x708578
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg r8, r9
mov r15w, 0x5a59
lea r14, [r10 + r13]
lea rdx, [rdi + r10]
jmp 0x708589
pop r14w
mov r14, rbp
std
mov r9b, 0x73
mov al, byte [rsp + 3]
jmp 0x708562
pop word [rsp + 2]
rdtsc
xchg dword [rsp], r9d
lea rsp, [rsp + 2]
lea r11, [0x1ce04ef5]
shl r14w, 2
jmp 0x708601
pop r11w
pop qword [rsp + 3]
push si
jmp 0x708637
mov rdx, 0xffffffffcb82d836
bsr rdx, r14
neg r14d
mov word [rsp + 0x16], dx
mov r9b, 0xd7
bswap r14d
jmp 0x7085ca
pushfq
setne r15b
sub rsp, 0x19
lea rbp, [r8 + riz + 0xb385]
lea rsi, [rcx + riz - 0x2a0dfc8b]
pop qword [rsp + 1]
jmp 0x7085e0
add rsp, 5
xchg r11w, dx
xchg r15, r8
sub rsp, 0x1e
jmp 0x70893e
mov r11, 0x122e28a5
setl r15b
clc
cld
pop r8
mov bp, r9w
jmp 0x708621
mov rsi, qword [rsp + 0x2f]
mov r11d, dword [rsp + 0x22]
dec r10d
jmp 0x708743
xchg r11, r14
xchg dword [rsp + 0x18], r15d
rcl r10, 0x15
xchg word [rsp], r8w
sub rsp, 9
mov dx, 0x7bd9
jmp 0x70867a
xchg qword [rsp + 0x32], rdx
mov r9, qword [rsp + 0x3b]
call fcn.007086e2
int 0x5a
enter 0x5aaf, 0xfffffffffffffff3
cmp edx, dword [rdx]
lea ebx, [rdi + rbp*2]
pop r14w
mov r11, qword [rsp + 0x39]
bswap r8
mov rdx, 0x7f182bb1
setg al
xchg byte [rsp + 0x26], bpl
jmp 0x7086ab
pop qword [rsp + 0x2a]
lea rdx, [r8 + riz - 0x1dd534fb]
pop r11
mov dl, 0xbc
xchg word [rsp + 0x39], r11w
not r10w
jmp 0x7086c5
sub rsp, 0x14
mov r10w, sp
pop r14w
push qword [rsp + 0xa]
mov word [rsp + 0x30], r12w
mov qword [rsp + 0x13], rsi
jmp 0x7086fb
rdtsc
push qword [rsp + 0x1e]
mov eax, edx
mov r10b, byte [rsp + 0x29]
mov ax, word [rsp + 0x2c]
lea r9, [rcx + rdx]
jmp 0x708690

Function at 0x708777
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg r14b, r10b
xchg byte [rsp + 0x20], r15b
neg r8
sbb edx, r9d
jmp 0x708792
mov r11b, al
jmp 0x708761
mov qword [rsp + 0x25], rsi
pop r15
mov al, r8b
xchg r11w, dx
jmp 0x708819
mov dword [rsp + 0x18], edi
shr r10d, 5
pop word [rsp + 0x23]
pop qword [rsp + 0x20]
xchg dword [rsp + 0x31], r10d
mov rax, r9
jmp 0x70877c
xchg r9, rbp
sete r10b
xchg byte [rsp], r15b
or r11, r14
pushfq
xchg r9b, r11b
jmp 0x7087cd
lea rsp, [rsp + 0x2d]
neg r14
add r9w, r11w
bsf bp, cx
mov r15b, byte [rsp]
setp r11b
jmp 0x7087e8
Function at 0x708cfb
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg rbp, rsi
rol dx, 0xc
mov bpl, byte [rsp]
mov byte [rsp], spl
bts eax, r10d
jmp 0x708c08
mov dword [rsp + 5], edx
rdtsc
xchg word [rsp + 2], si
mov eax, 0xa09838fe
add rsp, 8
lea r15, [0xffffffffc6c70f06]
jmp 0x708bd1
xchg edx, r15d
bt r8w, di
inc r8d
neg r15
xchg rsi, r14
mov al, byte [rsp]
jmp 0x708c60
xchg dword [rsp + 2], r10d
rdtsc
xchg r9w, dx
rcr r14, cl
xchg qword [rsp], r14
mov dword [rsp + 2], r12d
jmp 0x708bea
xchg word [rsp], r15w
bswap r15
lea rsp, [rsp]
xchg r8d, ebp
jmp 0x708c79
neg r9d
lea r10, [rdi + r13]
setae r15b
mov r11b, dil
mov al, byte [rsp + 1]
lea r15, [rbp + rbp]
jmp 0x708c4a
bswap esi
xchg word [rsp], ax
std
xchg byte [rsp], r10b
shl ax, 1
xchg byte [rsp], r10b
jmp 0x708ccb
xchg sil, dl
pop word [rsp + 2]
setg al
push word [rsp + 7]
xchg qword [rsp], r9
mov ax, r10w
jmp 0x708c31
bswap r9d
mov r11b, r9b
cmp sil, 0xdd
setbe r14b
jmp 0x708ce5
mov ebp, dword [rsp]
setl bpl
mov r11d, ebx
lea rsp, [rsp + 1]
mov r8, qword [rsp]
lea rsp, [rsp + 1]
jmp 0x708cb5
xchg rdx, r15
pushfq
neg r15d
mov r14, qword [rsp + 8]
not dx
jmp 0x708d1f
setns al
mov edx, 0x10b0695b
or r15b, 0xcf
jmp 0x708c98
lea rax, [rsi + riz + 0xc4]
lea rsp, [rsp + 2]
jmp 0x708d30
rdtsc
not r8w
xchg r9d, eax
mov esi, ebx
bswap ebp
push bx
jmp 0x708d09
mov rbp, qword [rsp + 0x10]
lea rax, [rdi + r13]
mov r9w, 0xc3f0
xchg r10, r8
push rbp
add rsp, 6
jmp 0x708edc
bts si, di
mov rax, qword [rsp + 0x48]
neg r9d
cmp r9, rax
jmp 0x708dda
mov r10w, r9w
mov r9, 0xffffffffe362294f
bswap r10d
bswap r10
sbb sil, 0xfb
jmp 0x708d6a
push rdx
lea rsp, [rsp + 1]
mov r15, qword [rsp + 0x40]
cld
mov r11, 0x5368ed6a
mov r11w, 0xb3d
jmp 0x708d80
cld
lea r9, [r13*8]
or dl, r10b
cld
bswap r11
mov r11d, dword [rsp]
jmp 0x708e16
xchg esi, r9d
stc
xchg sil, r11b
mov r9b, r15b
mov rsi, qword [rsp + 0x50]
xchg r11w, r10w
jmp 0x708db6
xchg r11b, r10b
mov dword [rsp], esi
mov r11, rbx
lea rsp, [rsp + 4]
mov r9, qword [rsp + 0x60]
bswap r10d
jmp 0x708e48
mov rdx, qword [rsp + 0x58]
bt r11d, r11d
lea r9, [r11 + riz]
push r11w
xchg r11w, r10w
push word [rsp + 1]
jmp 0x708def
lea r10, [r8 + r10]
bts r10d, r8d
bswap r10d
dec r10b
jmp 0x708e91
mov r10b, byte [rsp]
mov r10b, byte [rsp]
mov r10d, 0xf4750ba1
not r10w
jmp 0x708e32
xchg r15d, edx
sub rsp, 0x11
mov qword [rsp + 6], rdi
mov edx, r12d
not r11d
xchg r9b, sil
jmp 0x708d9c
mov r10, qword [rsp + 0x69]
lea r11, [rbx + r15]
mov r11w, 0x54ce
call fcn.00708e7b
lea rsp, [rsp + 8]
jmp 0x708f42
push r14
xchg rdx, rsi
lea rsp, [rsp + 2]
mov r8, qword [rsp + 0x20]
mov esi, r11d
bswap r11d
jmp 0x708e61
call fcn.00708f0e

Function at 0x70a5e6
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov rax, qword [rax + riz]
mov rax, qword [rax + riz + 0x10]
push rax
jmp 0x709027
mov rax, qword gs:[0x60]
mov rax, qword [rax + riz + 0x18]
mov rax, qword [rax + riz + 0x30]
jmp 0x709dfa
lea rsp, [rsp + 0x10]
jmp 0x709f2f
Function at 0x140002ee0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140004a40
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140004a40
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140002f50
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14000a0a4]
mov rbx, rcx
test esi, esi
jle 0x140003080
mov rax, qword [0x14000a0a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140002f9b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140003025
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140002f80
mov rcx, rbx
call fcn.1400039a0
mov rdi, rax
test rax, rax
je 0x1400030a2
mov rax, qword [0x14000a0a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140003ae0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000a0a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140003087
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14000301e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140003030
add dword [0x14000a0a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000a0a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000301e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140002ee0
nop dword [rax]
xor esi, esi
jmp 0x140002fa8
mov rax, qword [0x14000a0a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140002ee0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140002ee0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140003610
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14000a100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000a0e0]
test rbx, rbx
je 0x14000366c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140003663
test rsi, rsi
je 0x140003663
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140003648
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1400039a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140006ab0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400039c0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400039c8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400039c0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x140003a1d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140003a14
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400039c0
add rax, 0x28
cmp rax, r9
jne 0x140003a00
xor eax, eax
ret

Function at 0x140003a20
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006ab0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x140003a3f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140003a48
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x140003a3f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140003ae0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006ab0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140003aff
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140003b08
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140001960
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x140002030]
test rax, rax
je 0x1400019aa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400019aa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400019aa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400019aa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400019aa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400019ac
xor al, al
add rsp, 0x28
ret
Function at 0x140001d24
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0xe]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0xe
jb 0x140001d2a
mov rax, rcx
ret

Function at 0x140001d40
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x12]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x12
jb 0x140001d46
mov rax, rcx
ret

Function at 0x140001d5c
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x11]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x11
jb 0x140001d62
mov rax, rcx
ret

Function at 0x140001d78
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x10]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x10
jb 0x140001d7e
mov rax, rcx
ret

Function at 0x140001d94
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x15]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x15
jb 0x140001d9a
mov rax, rcx
ret

Function at 0x140001db0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x14]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x14
jb 0x140001db6
mov rax, rcx
ret

Function at 0x140001dcc
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 9]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 9
jb 0x140001dd2
mov rax, rcx
ret

Function at 0x140001de8
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0xa]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0xa
jb 0x140001dee
mov rax, rcx
ret

Function at 0x140001e04
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0xc]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0xc
jb 0x140001e0a
mov rax, rcx
ret

Function at 0x140001e20
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0xd]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0xd
jb 0x140001e26
mov rax, rcx
ret

Function at 0x140001e3c
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0xf]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0xf
jb 0x140001e42
mov rax, rcx
ret

Function at 0x140001e58
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x12]
inc r8d
xor al, byte [rdx]
movsx eax, al
mov word [rdx], ax
lea rdx, [rdx + 2]
cmp r8d, 9
jb 0x140001e5e
mov rax, rcx
ret
Function at 0x1400034fc
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 5]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 5
jb 0x140003502
mov rax, rcx
ret

Function at 0x140003518
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x2a]
inc r8d
xor al, byte [rdx]
movsx eax, al
mov word [rdx], ax
lea rdx, [rdx + 2]
cmp r8d, 0x15
jb 0x14000351e
mov rax, rcx
ret

Function at 0x14000353c
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x12c]
inc r8d
xor al, byte [rdx]
movsx eax, al
mov word [rdx], ax
lea rdx, [rdx + 2]
cmp r8d, 0x96
jb 0x140003542
mov rax, rcx
ret
Function at 0x140001da8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001df2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001df2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], reloc.api_ms_win_crt_math_l1_1_0.dll___setusermatherr
jne 0x140001df2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001df2
cmp dword [rcx + 0x84], 0xe
jbe 0x140001df2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001df4
xor al, al
add rsp, 0x28
ret
Function at 0x140001180
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x1401bd4a0]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
mov rax, qword gs:[0x30]
mov rsi, qword [rax + 8]
jmp 0x1400011c0
cmp rsi, rax
je 0x140001320
mov ecx, 0x3e8
call rbp
mov rax, rdi
lock cmpxchg qword [rbx], rsi
test rax, rax
jne 0x1400011b0
mov rsi, qword [0x1401bd4b0]
xor edi, edi
mov eax, dword [rsi]
cmp eax, 1
je 0x140001337
mov eax, dword [rsi]
test eax, eax
je 0x1400013a0
mov dword [0x1401c0008], 1
mov eax, dword [rsi]
cmp eax, 1
je 0x14000134c
test edi, edi
je 0x14000136d
mov rax, qword [0x1401bd410]
mov rax, qword [rax]
test rax, rax
je 0x140001223
xor r8d, r8d
mov edx, 2
xor ecx, ecx
call rax
call fcn.140149c70
mov rcx, qword [0x1401bd530]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rdx, qword [0x1401bd490]
lea rcx, section..text
mov qword [rdx], rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.140149a80
mov ebx, dword [0x1401c0028]
lea edi, [rbx + 1]
movsxd rdi, edi
shl rdi, 3
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r12, qword [0x1401c0020]
mov rbp, rax
test ebx, ebx
jle 0x1400013c0
sub rdi, 8
xor ebx, ebx
mov rcx, qword [r12 + rbx]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea rsi, [rax + 1]
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r8, rsi
mov qword [rbp + rbx], rax
mov rdx, qword [r12 + rbx]
mov rcx, rax
add rbx, 8
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
cmp rdi, rbx
jne 0x140001280
add rdi, rbp
mov qword [rdi], 0
mov qword [0x1401c0020], rbp
call fcn.140149880
mov rax, qword [0x1401bd420]
mov r8, qword [0x1401c0018]
mov ecx, dword [0x1401c0028]
mov rax, qword [rax]
mov qword [rax], r8
mov rdx, qword [0x1401c0020]
call fcn.14014aef0
mov ecx, dword [0x1401c000c]
mov dword [0x1401c0010], eax
test ecx, ecx
je 0x1400013c8
mov edx, dword [0x1401c0008]
test edx, edx
je 0x140001380
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [0x1401bd4b0]
mov edi, 1
mov eax, dword [rsi]
cmp eax, 1
jne 0x1400011e1
mov ecx, 0x1f
call fcn.14014aa20
mov eax, dword [rsi]
cmp eax, 1
jne 0x140001200
mov rdx, qword [0x1401bd4d0]
mov rcx, qword [0x1401bd4c0]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [rsi], 2
test edi, edi
jne 0x140001208
xor eax, eax
xchg qword [rbx], rax
jmp 0x140001208
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x1401c0010]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, qword [0x1401bd4f0]
mov rcx, qword [0x1401bd4e0]
mov dword [rsi], 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
jmp 0x1400011f5
mov rdi, rax
jmp 0x1400012b5
mov ecx, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
Function at 0x140149a90
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call fcn.14014a890
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
nop dword [rax]

Function at 0x140149b00
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1401c0474]
mov rbx, rcx
test esi, esi
jle 0x140149c30
mov rax, qword [0x1401c0478]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140149b4b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140149bd5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140149b30
mov rcx, rbx
call fcn.14014a570
mov rdi, rax
test rax, rax
je 0x140149c52
mov rax, qword [0x1401c0478]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.14014a6b0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1401c0478]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140149c37
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140149bce
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x140149be0
add dword [0x1401c0474], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1401c0478]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140149bce
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140149a90
nop dword [rax]
xor esi, esi
jmp 0x140149b58
mov rax, qword [0x1401c0478]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140149a90
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140149a90
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x14014a1e0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x1401c04e0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1401c04c0]
test rbx, rbx
je 0x14014a23c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x14014a233
test eax, eax
jne 0x14014a233
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14014a218
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x14014a570
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1401bd3e0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14014a590
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14014a598
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14014a590
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14014a5ed
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14014a5e4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14014a590
add rax, 0x28
cmp rax, r9
jne 0x14014a5d0
xor eax, eax
ret

Function at 0x14014a5f0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1401bd3e0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14014a60f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x14014a618
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14014a60f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x14014a6b0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1401bd3e0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14014a6cf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x14014a6d8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x14014aef0
Capabilities:
Authenticate hmac
Check mutex on windows
Encode data using base64
Encrypt data using chaskey
Get file size
Get system information on windows
Hash data using fnv
Identify system language via api
Move file
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x90
xor esi, esi
call fcn.140149880
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p__acmdln
mov rbx, qword [rax]
test rbx, rbx
jne 0x14014af3b
jmp 0x14014afb1
test cl, cl
je 0x14014af68
and esi, 1
je 0x14014af50
mov esi, 1
call sub.api_ms_win_crt_multibyte_l1_1_0.dll__ismbblead
test eax, eax
je 0x14014af37
cmp byte [rbx + 1], 1
sbb rbx, 0xffffffffffffffff
add rbx, 1
movsx ecx, byte [rbx]
cmp cl, 0x20
jle 0x14014af18
mov eax, esi
xor eax, 1
cmp cl, 0x22
cmove esi, eax
jmp 0x14014af26
test cl, cl
je 0x14014af68
nop dword [rax]
movzx eax, byte [rbx + 1]
add rbx, 1
test al, al
je 0x14014af68
cmp al, 0x20
jle 0x14014af58
lea rdx, [rsp + 0x20]
xor eax, eax
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov r9d, 0xa
test byte [rsp + 0x5c], 1
je 0x14014af96
movzx r9d, word [rsp + 0x60]
mov rcx, qword [0x1401bd3e0]
mov r8, rbx
xor edx, edx
add rsp, 0x90
pop rbx
pop rsi
pop rdi
jmp fcn.1400a38c0
lea rbx, [0x1401bd050]
jmp 0x14014af68
Function at 0x180003710
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18000376d
lea rbx, [0x18005c0c0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180003754
cmp r10, 2
jb 0x180003754
cmp byte [r9], r8b
jne 0x180003754
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180003730
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1800037af
lea rbx, [0x18005c0c0]
cmp r8b, 0x23
jne 0x180003793
cmp byte [r9], r8b
jne 0x180003793
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180003780
mov rbx, qword [rsp + 8]
not eax
ret