joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140039080
Capabilities:
Write file on windows

Disassembly:
cmp rcx, 0xffffffffffffffff
je 0x1400390d4
push rbx
sub rsp, 0x30
cmp dword [0x1400b2a08], 0
mov rbx, rcx
jle 0x1400390cf
lea rcx, [0x1400b2a30]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, eax
lea rdx, [0x1400b2a30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [0x1400b2a08], 0
add rsp, 0x30
pop rbx
ret

Function at 0x1400390e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x60
lea rax, [rcx - 1]
mov r8, rdx
mov rbx, rcx
cmp rax, 0xfffffffffffffffd
ja 0x1400391a7
mov eax, dword [0x1400b2a08]
mov qword [rsp + 0x58], rdi
lea rdi, [0x1400b2a30]
cmp eax, 0x1c00
jle 0x140039154
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, eax
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8, qword [rsp + 0x78]
xor eax, eax
mov dword [0x1400b2a08], eax
cdqe
lea r9, [rsp + 0x80]
mov qword [rsp + 0x30], r9
mov edx, 0x2000
mov qword [rsp + 0x28], r8
sub rdx, rax
xor r9d, r9d
mov qword [rsp + 0x40], 0
lea rcx, [rax + rdi]
mov dword [rsp + 0x20], 0
lea r8, [rsp + 0x40]
call fcn.1400358e0
test eax, eax
js 0x1400391a2
mov eax, dword [rsp + 0x40]
sub eax, edi
mov dword [0x1400b2a08], eax
mov rdi, qword [rsp + 0x58]
add rsp, 0x60
pop rbx
ret

Function at 0x140039b40
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xd0
mov rdi, rcx
mov rbx, r8
lea rcx, [rsp + 0x20]
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x24]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0xc8], 1
test rsi, rsi
jne 0x140039b98
test rbx, rbx
je 0x140039bfd
cmp dword [rbx + 4], esi
jne 0x140039bfd
mov dword [rbx + 4], 0x2000003
jmp 0x140039bfd
xor eax, eax
nop word [rax + rax]
cmp qword [rsp + rax*8 + 0x58], rdi
je 0x140039bc2
inc rax
cmp rax, 1
jb 0x140039ba0
test rbx, rbx
je 0x140039bc2
cmp dword [rbx + 4], 0
jne 0x140039bc2
mov dword [rbx + 4], 0x2000002
xor edx, edx
mov rax, 0xffffffffffffffff
div rsi
cmp rax, rdi
jae 0x140039be5
test rbx, rbx
je 0x140039be5
cmp dword [rbx + 4], 0
jne 0x140039be5
mov dword [rbx + 4], 0x1000001
cmp rax, 1
jae 0x140039bfd
test rbx, rbx
je 0x140039bfd
cmp dword [rbx + 4], 0
jne 0x140039bfd
mov dword [rbx + 4], 0x2000001
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140039c60
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r15
sub rsp, 0xe0
mov rdi, rcx
mov r12d, r9d
lea rcx, [rsp + 0x30]
mov rsi, r8
mov r15, rdx
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x34]
lea r9, [rsp + 0x60]
mov rbx, qword [rsp + 0x120]
mov r8, rsi
mov rdx, r15
mov qword [rsp + 0x60], rax
mov rcx, rdi
mov qword [rsp + 0x68], rax
mov qword [rsp + 0xd8], 1
mov qword [rsp + 0x20], rbx
call fcn.140039a60
mov rdx, rbx
mov ecx, r12d
call fcn.140039e50
test rdi, rdi
je 0x140039cff
xor edx, edx
mov rax, 0xffffffffffffffff
div rdi
cmp rax, rsi
jae 0x140039cff
test rbx, rbx
je 0x140039cff
cmp dword [rbx + 4], 0
jne 0x140039cff
mov dword [rbx + 4], 0x2000001
mov eax, dword [rsp + 0x58]
mov rbp, rdi
imul rbp, rsi
cmp rbp, rax
jbe 0x140039d4d
mov rcx, rdi
dec rsi
not rcx
cmp rcx, rsi
jb 0x140039d37
lea rcx, [rsi + r15]
test rdi, rdi
je 0x140039d78
xor edx, edx
mov rax, 0xffffffffffffffff
div rdi
cmp rax, rcx
jae 0x140039d78
test rbx, rbx
je 0x140039d49
cmp dword [rbx + 4], 0
jne 0x140039d49
mov dword [rbx + 4], 0x2000001
xor edx, edx
jmp 0x140039da3
test rdi, rdi
je 0x140039d75
xor edx, edx
mov rax, 0xffffffffffffffff
div rdi
cmp rax, r15
jae 0x140039d75
test rbx, rbx
je 0x140039d75
cmp dword [rbx + 4], 0
jne 0x140039d75
mov dword [rbx + 4], 0x1000001
mov rcx, r15
mov rax, rdi
imul rax, rcx
movabs rcx, 0x7fffffff0000
mov rdx, rax
cmp rax, rcx
jb 0x140039da3
test rbx, rbx
je 0x140039da3
cmp dword [rbx + 4], 0
jne 0x140039da9
mov dword [rbx + 4], 0x1000001
cmp dword [rbx + 4], 0
je 0x140039dad
xor eax, eax
jmp 0x140039e27
xor ecx, ecx
mov qword [rsp + 0x100], r14
mov r8d, 0x2000
lea r9d, [rcx + 1]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
test rax, rax
jne 0x140039dde
mov rdx, rbx
lea ecx, [rax + 4]
call fcn.140039ee0
xor eax, eax
jmp 0x140039e1f
lea rsi, [rbp - 1]
mov qword [rsp + 0x20], rbx
add rsi, r14
neg rbp
and rsi, rbp
mov r9d, r12d
mov rcx, rsi
mov r8, r15
mov rdx, rdi
call sym.UnityCrashHandler64.exe_PAL_Memory_SetPageState
cmp dword [rbx + 4], 0
je 0x140039e1c
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x140039e1f
mov rax, rsi
mov r14, qword [rsp + 0x100]
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r12
pop rdi
ret
Function at 0x14003a060
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbx
push rbp
push rdi
push r14
push r15
sub rsp, 0x80
mov rdi, qword [rsp + 0xd0]
mov r15, r9
mov r14, r8
mov ebp, edx
mov rbx, rcx
test rcx, rcx
jne 0x14003a098
test rdi, rdi
je 0x14003a098
cmp dword [rdi + 4], ecx
jne 0x14003a098
mov dword [rdi + 4], 0x1000003
test r14, r14
jne 0x14003a0b3
test rdi, rdi
je 0x14003a0b3
cmp dword [rdi + 4], r14d
jne 0x14003a27a
mov dword [rdi + 4], 0x1000003
cmp dword [rdi + 4], 0
jne 0x14003a27a
call sub.KERNEL32.dll_GetCurrentThreadId
mov ecx, dword [rbx + 0x10]
cmp ecx, eax
je 0x14003a0e9
cmp dword [rdi + 4], 0
jne 0x14003a27a
mov dword [rdi + 4], 0x1000004
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
mov qword [rsp + 0xb8], rsi
lea rcx, [rsp + 0xd0]
cmp ebp, 0xffffffff
mov esi, 0xfffffffe
cmovne esi, ebp
xor eax, eax
mov qword [rsp + 0xd0], rax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0xd0]
mov rcx, r15
mov qword [rsp + 0x28], rax
call r14
test al, al
jne 0x14003a272
movaps xmmword [rsp + 0x70], xmm6
movsd xmm6, qword [0x140082880]
movaps xmmword [rsp + 0x60], xmm7
xorps xmm7, xmm7
movaps xmmword [rsp + 0x50], xmm8
xorps xmm8, xmm8
movaps xmmword [rsp + 0x40], xmm9
movsd xmm9, qword [0x140088a30]
mov eax, esi
movaps xmmword [rsp + 0x30], xmm10
movsd xmm10, qword [0x140088a28]
movsd qword [rsp + 0xc0], xmm7
cvtsi2sd xmm8, rax
nop dword [rax]
mov eax, 1
lock xadd dword [rbx + 0x14], eax
xor ecx, ecx
mov qword [rsp + 0xb0], rcx
lea rcx, [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0xb0]
xorps xmm1, xmm1
sub rax, qword [rsp + 0xd0]
cvtsi2sd xmm1, rax
jns 0x14003a1c0
addsd xmm1, xmm6
mulsd xmm1, qword [0x1400b4b38]
lea rax, [rsp + 0x20]
mov rcx, qword [rbx]
lea rsi, [rsp + 0xc0]
movaps xmm0, xmm8
divsd xmm1, xmm9
subsd xmm0, xmm1
addsd xmm0, xmm10
comisd xmm7, xmm0
movsd qword [rsp + 0x20], xmm0
cmovbe rsi, rax
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
je 0x14003a2a4
cvttsd2si rdx, qword [rsi]
mov rcx, qword [rbx + 8]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov esi, eax
cmp eax, 0xffffffff
jne 0x14003a227
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [rbx]
xor r8d, r8d
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
jne 0x14003a2a4
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [rbx + 0x10], eax
test esi, esi
jne 0x14003a289
mov rcx, r15
call r14
test al, al
je 0x14003a180
movaps xmm9, xmmword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x70]
movaps xmm10, xmmword [rsp + 0x30]
mov rsi, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
cmp dword [rdi + 4], 0
jne 0x14003a256
xor eax, eax
cmp esi, 0x102
setne al
add eax, 0x1000006
mov dword [rdi + 4], eax
jmp 0x14003a256
mov ecx, 0x1000007
int3
jmp 0x14003a060
Function at 0x14003a7b0
Capabilities:
Get system information on windows

Disassembly:
test rcx, rcx
je 0x14003a7e0
push rbx
sub rsp, 0x50
mov rbx, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x24]
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x78], 1
add rsp, 0x50
pop rbx
ret
Function at 0x14003acc0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbx
push rbp
push rdi
push r14
push r15
sub rsp, 0x80
mov rdi, qword [rsp + 0xd0]
mov r15, r9
mov r14, r8
mov ebp, edx
mov rbx, rcx
test rcx, rcx
jne 0x14003a098
test rdi, rdi
je 0x14003a098
cmp dword [rdi + 4], ecx
jne 0x14003a098
mov dword [rdi + 4], 0x1000003
test r14, r14
jne 0x14003a0b3
test rdi, rdi
je 0x14003a0b3
cmp dword [rdi + 4], r14d
jne 0x14003a27a
mov dword [rdi + 4], 0x1000003
cmp dword [rdi + 4], 0
jne 0x14003a27a
call sub.KERNEL32.dll_GetCurrentThreadId
mov ecx, dword [rbx + 0x10]
cmp ecx, eax
je 0x14003a0e9
cmp dword [rdi + 4], 0
jne 0x14003a27a
mov dword [rdi + 4], 0x1000004
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
mov qword [rsp + 0xb8], rsi
lea rcx, [rsp + 0xd0]
cmp ebp, 0xffffffff
mov esi, 0xfffffffe
cmovne esi, ebp
xor eax, eax
mov qword [rsp + 0xd0], rax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0xd0]
mov rcx, r15
mov qword [rsp + 0x28], rax
call r14
test al, al
jne 0x14003a272
movaps xmmword [rsp + 0x70], xmm6
movsd xmm6, qword [0x140082880]
movaps xmmword [rsp + 0x60], xmm7
xorps xmm7, xmm7
movaps xmmword [rsp + 0x50], xmm8
xorps xmm8, xmm8
movaps xmmword [rsp + 0x40], xmm9
movsd xmm9, qword [0x140088a30]
mov eax, esi
movaps xmmword [rsp + 0x30], xmm10
movsd xmm10, qword [0x140088a28]
movsd qword [rsp + 0xc0], xmm7
cvtsi2sd xmm8, rax
nop dword [rax]
mov eax, 1
lock xadd dword [rbx + 0x14], eax
xor ecx, ecx
mov qword [rsp + 0xb0], rcx
lea rcx, [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0xb0]
xorps xmm1, xmm1
sub rax, qword [rsp + 0xd0]
cvtsi2sd xmm1, rax
jns 0x14003a1c0
addsd xmm1, xmm6
mulsd xmm1, qword [0x1400b4b38]
lea rax, [rsp + 0x20]
mov rcx, qword [rbx]
lea rsi, [rsp + 0xc0]
movaps xmm0, xmm8
divsd xmm1, xmm9
subsd xmm0, xmm1
addsd xmm0, xmm10
comisd xmm7, xmm0
movsd qword [rsp + 0x20], xmm0
cmovbe rsi, rax
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
je 0x14003a2a4
cvttsd2si rdx, qword [rsi]
mov rcx, qword [rbx + 8]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov esi, eax
cmp eax, 0xffffffff
jne 0x14003a227
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [rbx]
xor r8d, r8d
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
jne 0x14003a2a4
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [rbx + 0x10], eax
test esi, esi
jne 0x14003a289
mov rcx, r15
call r14
test al, al
je 0x14003a180
movaps xmm9, xmmword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x70]
movaps xmm10, xmmword [rsp + 0x30]
mov rsi, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
cmp dword [rdi + 4], 0
jne 0x14003a256
xor eax, eax
cmp esi, 0x102
setne al
add eax, 0x1000006
mov dword [rdi + 4], eax
jmp 0x14003a256
mov ecx, 0x1000007
int3
jmp 0x14003a060
Function at 0x14003ae00
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14003ae1d
mov ecx, 0x1000001
call fcn.1400399b0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14003ae40
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x130
cmp dword [rdx + 4], 0
mov rdi, rdx
mov rbx, rcx
jne 0x14003afb3
test rcx, rcx
je 0x14003afac
cmp dword [rcx], 0x3a51337
jne 0x14003afac
cmp qword [rcx + 0x20], 0
jne 0x14003ae8f
mov dword [rdx + 4], 0x3000002
jmp 0x14003afb3
mov ecx, 0x20
call fcn.14004c18c
mov rsi, rax
test rax, rax
je 0x14003afd1
mov rax, qword [rbx + 0x20]
lea r8, [0x14003a380]
mov rcx, qword [rbx + 0x28]
xor ebp, ebp
mov qword [rsi + 8], rax
mov r9, rsi
mov qword [rsi + 0x10], rcx
lea rax, [rsp + 0x148]
mov qword [rsi], rbp
xor ecx, ecx
mov qword [rsi + 0x18], rbp
mov rdx, qword [rbx + 0x18]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 0x18], rax
mov rcx, rax
test rax, rax
jne 0x14003af36
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x14003af20
cmp eax, 0xa4
je 0x14003af20
cmp dword [rdi + 4], ebp
jne 0x14003af2c
mov rcx, rsi
mov dword [rdi + 4], 0x1000007
call fcn.14004c178
jmp 0x14003afb5
cmp dword [rdi + 4], ebp
jne 0x14003af2c
mov dword [rdi + 4], 0x1000002
mov rcx, rsi
call fcn.14004c178
jmp 0x14003afb5
mov eax, dword [rsp + 0x148]
mov qword [rsi], rax
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x14003af7c
mov rax, qword [rbx + 0x10]
lea rcx, [rsp + 0x30]
mov ebx, 0xff
cmp rax, rbx
cmovb rbx, rax
mov r8, rbx
call fcn.1400438a0
lea rdx, [rsp + 0x30]
mov byte [rsp + rbx + 0x30], bpl
mov rcx, rsi
call fcn.14003a3a0
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x14003afa7
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.14004c178
cmp dword [rdi + 4], ebp
jne 0x14003afb5
mov dword [rdi + 4], 0x1000007
jmp 0x14003afb5
mov rbp, rsi
jmp 0x14003afb5
mov dword [rdx + 4], 0x3000001
xor ebp, ebp
lea r11, [rsp + 0x130]
mov rax, rbp
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov ecx, 0x1000001
call sym.UnityCrashHandler64.exe_PAL_Process_Abort
int3
Function at 0x14003b170
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbx
sub rsp, 0x60
mov ebx, ecx
movaps xmmword [rsp + 0x50], xmm6
xor eax, eax
movaps xmmword [rsp + 0x40], xmm7
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x78], rax
xorps xmm6, xmm6
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp ebx, 0xffffffff
mov eax, 0xfffffffe
xorps xmm7, xmm7
cmovne eax, ebx
cvtsi2sd xmm7, rax
comisd xmm7, xmm6
jbe 0x14003b23f
mov rbx, qword [rsp + 0x78]
movaps xmmword [rsp + 0x30], xmm8
movsd xmm8, qword [0x140082880]
movaps xmmword [rsp + 0x20], xmm9
movsd xmm9, qword [0x140088a30]
nop word [rax + rax]
movaps xmm0, xmm7
mov edx, 1
subsd xmm0, xmm6
cvttsd2si rcx, xmm0
call qword [sym.imp.KERNEL32.dll_SleepEx]
xor eax, eax
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x78]
xorps xmm6, xmm6
sub rax, rbx
cvtsi2sd xmm6, rax
jns 0x14003b220
addsd xmm6, xmm8
mulsd xmm6, qword [0x1400b4b38]
divsd xmm6, xmm9
comisd xmm7, xmm6
ja 0x14003b1e0
movaps xmm9, xmmword [rsp + 0x20]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
add rsp, 0x60
pop rbx
ret
Function at 0x14003ff4d
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14003ff6b
je 0x14003ff76
call 0x14003ffc5
mov bl, 0xc7
lahf
pop rsi
jne 0x14003ff56
call 0x14003ff6e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x14003ff56
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x14003ffa4
je 0x14003ffe2
invalid
je 0x14003fff3
jne 0x14003ff56
lea rax, [0x14003fe7c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14003bbdd]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140040094
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x1400400ed
je 0x1400400f3
call 0x1400400e4
fild qword [rdi - 0x7c]
jmp 0x174f7c866
jne 0x1400400b6
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x140040076
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x14003ff60
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14003ff6b
je 0x14003ff76
call 0x14003ffc5
mov bl, 0xc7
lahf
pop rsi
jne 0x14003ff56
call 0x14003ff6e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x14003ff56
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x14003ffa4
je 0x14003ffe2
invalid
je 0x14003fff3
jne 0x14003ff56
lea rax, [0x14003fe7c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14003bbdd]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140040094
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x1400400ed
je 0x1400400f3
call 0x1400400e4
fild qword [rdi - 0x7c]
jmp 0x174f7c866
jne 0x1400400b6
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x140040076
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x14003ff8c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14003ff6b
je 0x14003ff76
call 0x14003ffc5
mov bl, 0xc7
lahf
pop rsi
jne 0x14003ff56
call 0x14003ff6e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x14003ff56
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x14003ffa4
je 0x14003ffe2
invalid
je 0x14003fff3
jne 0x14003ff56
lea rax, [0x14003fe7c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14003bbdd]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140040094
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x1400400ed
je 0x1400400f3
call 0x1400400e4
fild qword [rdi - 0x7c]
jmp 0x174f7c866
jne 0x1400400b6
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x140040076
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x14003ffc5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14003ff6b
je 0x14003ff76
call 0x14003ffc5
mov bl, 0xc7
lahf
pop rsi
jne 0x14003ff56
call 0x14003ff6e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x14003ff56
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x14003ffa4
je 0x14003ffe2
invalid
je 0x14003fff3
jne 0x14003ff56
lea rax, [0x14003fe7c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14003bbdd]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140040094
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x1400400ed
je 0x1400400f3
call 0x1400400e4
fild qword [rdi - 0x7c]
jmp 0x174f7c866
jne 0x1400400b6
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x140040076
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret

Function at 0x140063d68
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140063d7b
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.140064388
lea rdx, [0x1400ad350]
lea rcx, [rsp + 0x20]
call fcn.140043cd8
int3

Function at 0x14006ef9c
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1400b62b8]
jmp fcn.140063d68

Function at 0x14007abe4
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x14007aca0]
mov r9, qword [r9 + 8]
jmp fcn.14006bfbc

Function at 0x14007ac78
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x14007acb0]
mov r9, qword [r9 + 8]
jmp fcn.14006bfbc