joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002c4d8
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x14002e020
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x2848
call fcn.14002c1cc
sub rsp, rax
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x88a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2868]
mov rax, qword [0x14009b300]
xor rax, rbp
mov qword [rbp + 0x2810], rax
mov rcx, qword [rbp + 0x2848]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x14002e08c
xor eax, eax
jmp 0x14002e1be
mov rdx, qword [rbp + 0x2850]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x14002e0af
xor eax, eax
jmp 0x14002e1be
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x28]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x68], 0
lea r9, [rbp + 0x20a4]
mov r8d, 0x2000
lea rdx, [rbp + 0x90]
mov rcx, qword [rbp + 0x2840]
call fcn.14002c0dc
test eax, eax
je 0x14002e1a5
mov dword [rbp + 0x20c4], 0
jmp 0x14002e10b
mov eax, dword [rbp + 0x20c4]
inc eax
mov dword [rbp + 0x20c4], eax
mov eax, dword [rbp + 0x20c4]
mov qword [rbp + 0x2808], rax
mov ecx, dword [rbp + 0x20a4]
xor edx, edx
mov eax, ecx
mov ecx, 8
div rcx
mov rcx, qword [rbp + 0x2808]
cmp rcx, rax
jae 0x14002e1a5
lea rax, [rbp + 0x20f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
mov eax, dword [rbp + 0x20c4]
mov r9d, 0x104
lea r8, [rbp + 0x20f0]
mov rdx, qword [rbp + rax*8 + 0x90]
mov rcx, qword [rbp + 0x2840]
call fcn.14002c055
test eax, eax
jbe 0x14002e1a0
mov rdx, qword [rbp + 0x2848]
lea rcx, [rbp + 0x20f0]
call qword [sym.imp.ucrtbased.dll__stricmp]
test eax, eax
jne 0x14002e1a0
mov eax, dword [rbp + 0x20c4]
mov rax, qword [rbp + rax*8 + 0x90]
mov qword [rbp + 0x68], rax
jmp 0x14002e1a5
jmp 0x14002e0fd
cmp qword [rbp + 0x68], 0
jne 0x14002e1b0
xor eax, eax
jmp 0x14002e1be
mov rax, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x68]
add rcx, rax
mov rax, rcx
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140087420]
call fcn.14002c848
mov rax, rdi
mov rcx, qword [rbp + 0x2810]
xor rcx, rbp
call fcn.14002c49c
lea rsp, [rbp + 0x2828]
pop rdi
pop rbp
ret

Function at 0x14002c587
Capabilities:
Terminate process

Disassembly:
jmp 0x14007eb20
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14002c6f4
Capabilities:
Parse pe header

Disassembly:
jmp 0x14007fe70
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14007fe90
xor al, al
jmp 0x14007ff11
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14007fea3
xor al, al
jmp 0x14007ff11
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14007fecd
xor al, al
jmp 0x14007ff11
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14007fee1
xor al, al
jmp 0x14007ff11
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14007fef3
xor al, al
jmp 0x14007ff11
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14007ff0f
xor al, al
jmp 0x14007ff11
mov al, 1
add rsp, 0x38
ret
Function at 0x14002c703
Capabilities:
Create thread
Inject thread

Disassembly:
jmp 0x14002e590
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x40]
mov rcx, qword [section..data]
call sym.Loader.exe_unsigned_long_int___cdecl_WANNALMAO_GetProcessIdByName_char_const____ptr64_
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jne 0x14002e5c0
lea rcx, str.error_getting_target_process_PID
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
mov r8d, dword [rbp + 4]
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14009b4c8], rax
cmp qword [0x14009b4c8], 0
jne 0x14002e5ee
lea rcx, str.error_getting_process_handle
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
lea r8, str.LoadLibraryA
lea rdx, str.kernel32.dll
mov rcx, qword [0x14009b4c8]
call sym.Loader.exe_unsigned_long_long_unsigned___int64____cdecl_WANNALMAO_GetFunctionAddress_void____ptr64__char_const____ptr64__char_const____ptr64_
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x14002e61f
lea rcx, str.error_getting_LoadLibraryA_address_in_target_process
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
lea rcx, [0x14009b4d0]
call fcn.14002c424
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, rax
xor edx, edx
mov rcx, qword [0x14009b4c8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x14002e662
lea rcx, str.error_allocating_memory_in_target_process
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
lea rcx, [0x14009b4d0]
call fcn.14002c424
mov qword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14009b4d0]
mov rdx, qword [rbp + 0x48]
mov rcx, qword [0x14009b4c8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14002e6a2
lea rcx, str.error_writing_to_target_process
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x28]
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x14009b4c8]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x14002e6e9
lea rcx, str.error_creating_remote_thread
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x14002c884
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x14002e8b0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x14002e8e1
xor eax, eax
jmp 0x14002e9b3
movzx eax, word [rbp + 0x1a0]
lea r8, str.VERYSUS
mov edx, eax
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x14002e90d
xor eax, eax
jmp 0x14002e9b3
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x14002e92d
xor eax, eax
jmp 0x14002e9b3
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x14002e946
xor eax, eax
jmp 0x14002e9b3
mov rdx, qword [rbp + 0x28]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rbp + 0x84], eax
mov eax, dword [rbp + 0x84]
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0xa8], rax
cmp qword [rbp + 0xa8], 0
jne 0x14002e97b
xor eax, eax
jmp 0x14002e9b3
mov eax, dword [rbp + 0x84]
mov ecx, dword [rbp + 0x84]
mov r9d, eax
mov r8, qword [rbp + 0x68]
mov edx, ecx
mov rcx, qword [rbp + 0xa8]
call fcn.14002f640
mov eax, dword [rbp + 0x84]
mov rcx, qword [rbp + 0x1a8]
mov qword [rcx], rax
mov rax, qword [rbp + 0xa8]
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x14002c8cf
Capabilities:
Print debug messages
Terminate process

Disassembly:
jmp 0x14002dfa0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov r9, qword [rbp + 0xe0]
lea r8, str.WANNALMAO:
lea rdx, str._s__s
mov rcx, rax
call fcn.14002c8a7
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x14002c8f2
Capabilities:
Write file on windows

Disassembly:
jmp 0x14002f170
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x14009b300]
xor rax, rbp
mov qword [rbp + 0xf8], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x14002f1f7
xor al, al
jmp 0x14002f23c
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14002f22c
mov eax, dword [rbp + 0x24]
cmp rax, qword [rbp + 0x130]
je 0x14002f230
xor al, al
jmp 0x14002f23c
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x140087120]
call fcn.14002c848
mov rax, rdi
mov rcx, qword [rbp + 0xf8]
xor rcx, rbp
call fcn.14002c49c
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x14002c929
Capabilities:
Execute command

Disassembly:
jmp 0x14002e760
push rbp
push rdi
sub rsp, 0x6a8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x112
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14009b300]
xor rax, rbp
mov qword [rbp + 0x678], rax
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
lea r8, str.powershell.exe__Command__Invoke_WebRequest__Uri_https:__dot.net_v1_dotnet_install.ps1__OutFile___TEMP__WANNALMAOdotnet_install.ps1_
mov edx, 0x400
lea rcx, [rbp + 0x10]
call fcn.14002c5d7
lea rcx, [rbp + 0x10]
call qword [sym.imp.ucrtbased.dll_system]
mov dword [rbp + 0x424], eax
cmp dword [rbp + 0x424], 0
je 0x14002e7d3
xor al, al
jmp 0x14002e839
lea r8, str.powershell.exe__ExecutionPolicy_Bypass__Command____TEMP__WANNALMAOdotnet_install.ps1__Architecture_amd64__InstallDir__env:TEMPWANNALMAO__Runtime_dotnet__Version_8.0.2_
mov edx, 0x400
lea rcx, [rbp + 0x10]
call fcn.14002c5d7
lea rcx, [rbp + 0x10]
call qword [sym.imp.ucrtbased.dll_system]
mov dword [rbp + 0x424], eax
cmp dword [rbp + 0x424], 0
je 0x14002e805
xor al, al
jmp 0x14002e839
lea r8, str.powershell.exe__ExecutionPolicy_Bypass__Command____TEMP__WANNALMAOdotnet_install.ps1__Architecture_amd64__InstallDir__env:TEMPWANNALMAO__Runtime_windowsdesktop__Version_8.0.2_
mov edx, 0x400
lea rcx, [rbp + 0x10]
call fcn.14002c5d7
lea rcx, [rbp + 0x10]
call qword [sym.imp.ucrtbased.dll_system]
mov dword [rbp + 0x424], eax
cmp dword [rbp + 0x424], 0
je 0x14002e837
xor al, al
jmp 0x14002e839
mov al, 1
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140087300]
call fcn.14002c848
mov rax, rdi
mov rcx, qword [rbp + 0x678]
xor rcx, rbp
call fcn.14002c49c
lea rsp, [rbp + 0x688]
pop rdi
pop rbp
ret
Function at 0x180735058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1807351df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180735089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18073506f
add dl, dl
jne 0x180735096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1807350f6
xor eax, eax
add dl, dl
jne 0x1807350a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1807351ad
add dl, dl
jne 0x1807350b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807350c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807350d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807350dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1807350ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18073507e
mov eax, 1
add dl, dl
jne 0x180735106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180735113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1807350fb
sub eax, ebx
mov ebx, 1
jne 0x18073514c
mov ecx, 1
add dl, dl
jne 0x18073512e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18073513b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180735123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18073507e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180735168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180735175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18073515d
cmp eax, 0x7d00
jae 0x18073519b
cmp eax, 0x500
jb 0x180735196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18073507e
cmp eax, 0x7f
ja 0x18073519e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18073507e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1807351d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18073507e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x123af24
Capabilities:
Encrypt data using speck

Disassembly:
push 0x68b89099
add r11, 2
add dword [rsp + 1], 0x39274a9b
shr edi, cl
call fcn.012f2459
shl edx, cl
cmc
or r14d, 0x69812d04
mov ecx, dword [rax + 4]
rol r14b, 0xa2
sub r14b, r12b
mov r14, rbx
shl edi, cl
mov rcx, qword [rsp + 0xa0]
jmp 0x12ff041
je 0x12efa85
movzx eax, byte [r9]
shl edi, 8
inc ecx
stc
clc
or edi, eax
jmp 0x12ce11a
mov dword [rsp + 0x80], r12d
jmp 0x12de1bf
inc r9
cmp spl, 0x18
jmp 0x12ec2f8
mov qword [rcx], rbx
mov eax, dword [rax + 4]
mov dword [rsp + 0x10], edx
bts ecx, esp
lea ecx, [rdi + rax]
bts ax, r8w
mov eax, 0x300
test dx, 0x58a
mov dword [rsp + 8], edi
shl eax, cl
clc
mov dword [rsp + 0x70], r12d
cmp sil, r10b
jmp 0x12c3031
add eax, 0x736
jmp 0x12e2be1
mov dword [rsp + 4], r12d
je 0x12e2c24
mov ecx, eax
cwde
movsx r13d, sp
mov eax, 0x400
movzx r9, r13w
xchg r13d, r9d
movzx r9d, r11w
mov rdi, r15
cmovb r9w, di
xchg r9d, r9d
mov r9b, 0x3a
movzx eax, ax
cmovne r13w, r14w
movzx r9d, si
rep stosw word [rdi], ax
inc r9w
mov r9, r8
mov rcx, rsp
or cl, 0xa7
seta cl
lea r13, [r8 - 1]
rol cx, 0x8f
sub cl, r13b
mov edi, ebx
or r8d, 0xffffffff
shl rcx, cl
mov ecx, ebx
clc
cmp r9, r13
jmp 0x12bff36
cmp ecx, 5
jl 0x12e2c47
mov qword [rsp + 0x28], rsi
not rsi
adc sil, 1
nop
movsx rax, r8w
stc
shl al, cl
mov eax, r10d
add rdi, 0xffffffffe80f5904
add rsp, 0x30
xchg r15b, r12b
pop r15
movsx r12d, bp
bswap r13w
pop r14
xchg ebx, r13d
movzx di, r12b
pop r13
xchg dil, r12b
movzx rbp, r15w
setle dil
pop r12
movsx edi, ax
cmovge bp, si
mov bpl, r15b
pop rdi
movsx bp, r14b
movsx ebp, r10w
pop rbp
jmp 0x12f235c
dec edx
bswap r10
dec edi
mov ebp, ebx
rcr r10b, 0x1d
rcl r10b, cl
mov r10d, r12d
test r13b, 0x2c
cmp cl, bh
mov dword [rsp + 0xc], edi
movsx edi, r8w
mov edi, dword [rax]
test r15b, al
mov qword [r9], rbx
stc
jmp 0x12d2c38
Function at 0x12cab94
Capabilities:
Encrypt data using speck

Disassembly:
ror r9d, 1
add r9d, eax
bt ax, 0xaa
bswap r9d
btr rax, r10
shr r8d, 0xc9
shr ax, 0x4e
adc r9, rbp
jmp 0x12bc3c1
inc r8
push rbx
mov qword [rsp + r8*4 - 0x90c3d0], rcx
xchg r10d, eax
mov qword [rsp + r8 - 0x24308c], rdi
ror rax, 0x3a
sub r10b, byte [rsp + r8 - 0x243113]
sbb r10w, ax
lea r10, [r11 + r8 - 0x243384]
and r10b, 0xf0
mov ebp, r8d
ror rax, 8
push rbp
mov rsp, r10
call fcn.012d7a60
mov ebx, 0x9d317391
mov eax, dword [r11 + riz]
mov ecx, dword [r11 + riz + 4]
movsx edx, bx
cpuid
jmp 0x12ee71e
jmp 0x12cdc6e
mov qword [rsp + r8*2 + 0x701186ae], r8
not word [rsp + r8 + 0x3808c359]
mov qword [rsp + r8*2 + 0x701186ae], r13
xchg r8d, ebx
push rdx
mov r10d, 0x9f14a621
jmp 0x12e2b5d
sub r11, 8
jmp 0x130158f
sub al, 1
int 0xe9
add al, 0
sti
lodsd eax, dword [rsi]
add dword [rdx], esi
fstp qword [rcx + 0x1b17800]
push rbx
invalid
js 0x12d435a
push rsi
je 0x12d4378
or dh, byte [rbp - 1]
mov bl, 0xb0
imul ebp, ecx, 0x261576c7
test dword fs:[rcx], 0x1502320
test dword [rcx], 0x1502320
jno 0x12d42e2
outsb dx, byte [rsi]
out dx, al
push rdi
xchg edi, eax
xchg edi, eax
je 0x12d4378
jne 0x12d4304
invalid
movzx bx, byte [r11 + riz]
call fcn.012e52cc
add byte [rcx], ah
sbb byte [rsi], al
add byte [rax], bl
je 0x12d43a9
add dword [rax], edx
push rsp
push rdi
add dword [rax], ecx
xor al, 0x5e
pop rsi
add ecx, esp
or al, byte [rcx]
add byte [rdx + 0xb], al
add dword [rax], eax
jl 0x12d4316
sub al, byte [rcx]
invalid
mov eax, 0x5a747ffb
pop rdx
adc byte [rbx + 0x7c7f34f5], dl
out 0xe5, al
call 0x3c500655
cmp edi, dword [rbx]
jne 0x12d43ad
add dh, byte [rbx - 0x2d0ea4e5]
invalid
push r10
pushfq
pop r11
mov qword [rsp + r8 - 0x48622608], r11
movsx r11d, r10w
imul r11w, r10w
movabs rbp, 0
add r10w, bx
sbb r8b, 0x22
push rax
bswap r10
bt r11, r8
lea r11, [rsp + r8 - 0x486226f6]
ror r10w, 0xa4
jb 0x12d4340
push r15
movzx eax, bl
and bx, ax
dec rax
push r9
mov qword [rsp + r8 - 0x48622676], rbp
inc r10w
dec r8
mov r9d, dword [rsp + rax*2 - 0xd0]
not r10b
ror r9d, 3
add r8b, r10b
setle al
sub r9d, eax
or ebx, r10d
or r8w, r8w
jns 0x12428d3
jmp 0x12c6003

Function at 0x12ee14c
Capabilities:
Encrypt data using speck

Disassembly:
call fcn.012e021d
push 0xffffffffd98d3493
mov dword [r11 + 8], ebx
mov dword [rsp + 0x1b], 0x9581ab02
mov dword [r11 + 4], ecx
jmp 0x12c9cf8
Function at 0x2fc53e710
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc53f7f0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc53f112
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc561108]
test eax, eax
je 0x2fc53f1aa
lea rax, [0x2fc5610e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc561110]
mov qword [rbp - 8], rax
jmp 0x2fc53f18e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc53f182
cmp qword [rbp - 0x10], 0
je 0x2fc53f182
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc53f148
lea rax, [0x2fc5610e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc53f1ab
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc53f2b0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc53f2d8
mov eax, 0
jmp 0x2fc53f326
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc53f301
mov eax, 0
jmp 0x2fc53f326
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc53f321
mov eax, 0
jmp 0x2fc53f326
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc53f32c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc53f3aa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc53f3a1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc53f3a1
mov rax, qword [rbp - 8]
jmp 0x2fc53f3bf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc53f374
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d4840
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d5920
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d5242
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f7108]
test eax, eax
je 0x2fc4d52da
lea rax, [0x2fc4f70e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f7110]
mov qword [rbp - 8], rax
jmp 0x2fc4d52be
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d52b2
cmp qword [rbp - 0x10], 0
je 0x2fc4d52b2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d5278
lea rax, [0x2fc4f70e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d52db
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d53e0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d5408
mov eax, 0
jmp 0x2fc4d5456
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d5431
mov eax, 0
jmp 0x2fc4d5456
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d5451
mov eax, 0
jmp 0x2fc4d5456
mov eax, 1
add rsp, 0x20
pop rbp
ret