joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180072eb0
Capabilities:
Write file on windows

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rsi
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x38], r14
mov rax, qword [0x180141040]
xor rax, rbp
mov qword [rbp], rax
movzx eax, word [rdx]
xor ebx, ebx
mov rdi, rdx
mov r14, rcx
test ax, ax
je 0x180072f17
mov ecx, 0x80
mov r8d, 0x800
lea rdx, [rdx + 2]
cmp ax, cx
jae 0x180072f04
mov eax, 1
jmp 0x180072f0d
cmp ax, r8w
sbb eax, eax
add eax, 3
add ebx, eax
movzx eax, word [rdx]
test ax, ax
jne 0x180072ef4
xor edx, edx
movsxd rsi, ebx
lea rax, [rsi + 1]
lea rcx, [rax + 0x10]
cmp rcx, rax
cmova rdx, rcx
test rdx, rdx
je 0x180072f8c
cmp rdx, 0x400
ja 0x180072f6f
lea rax, [rdx + 0xf]
cmp rax, rdx
ja 0x180072f4c
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1800d7ba0
sub rsp, rax
lea r10, [rsp + 0x30]
test r10, r10
je 0x180072f8f
mov dword [r10], 0xcccc
add r10, 0x10
jmp 0x180072f8f
mov rcx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r10, rax
test rax, rax
je 0x180072f8f
mov dword [rax], 0xdddd
add r10, 0x10
jmp 0x180072f8f
xor r10d, r10d
lea r9, [r10 + rsi]
mov rcx, r10
cmp r10, r9
jae 0x180072fc6
nop dword [rax + rax]
movzx eax, word [rdi]
test ax, ax
je 0x180072fc6
lea rdx, [r9 + 1]
mov r8d, eax
sub rdx, rcx
add rdi, 2
dec rdx
call fcn.18005d200
add rcx, rax
cmp rcx, r9
jb 0x180072fa0
mov byte [rcx], 0
xor r9d, r9d
mov rcx, qword [0x180141318]
mov r8d, ebx
mov rdx, r10
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, r14
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.1800d7380
mov rbx, qword [rbp + 0x20]
mov rsi, qword [rbp + 0x28]
mov rdi, qword [rbp + 0x30]
mov r14, qword [rbp + 0x38]
lea rsp, [rbp + 0x10]
pop rbp
ret
Function at 0x180086f40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x50
mov rax, qword [rcx + 8]
mov ebp, r8d
mov ecx, 0x3e80000
mov rbx, qword [rax + 0x2d8]
mov rax, qword [rdx + 0x80]
movzx edx, word [rdx + 0x68]
movzx edi, word [rax + 0x18]
mov eax, 0x40000
shl edi, 0x10
cmp edi, eax
cmovl edi, eax
shl edx, 0x10
call fcn.180075eb0
mov dword [rsp + 0x24], eax
mov ecx, eax
cmp eax, 0x28f
jge 0x180086f96
xor eax, eax
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
mov eax, dword [rbx + 0x24]
mov qword [rsp + 0x80], rsi
mov esi, dword [rbx + 0x28]
mov qword [rsp + 0x48], r12
mov r12d, dword [rbx + 0x3c]
mov qword [rsp + 0x40], r13
mov r13d, dword [rbx + 0x38]
mov dword [rsp + 0x88], eax
mov eax, dword [rbx + 0x2c]
mov qword [rsp + 0x38], r14
mov r14d, dword [rbx + 0x40]
mov dword [rsp + 0x70], eax
mov eax, dword [rbx + 0x34]
mov qword [rsp + 0x30], r15
mov r15d, dword [rbx + 0x30]
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x20], r12d
test ebp, ebp
jg 0x180086fed
mov ebp, 0x4b0000
jmp 0x180086ffb
shl ebp, 0x10
mov edx, ecx
mov ecx, ebp
call fcn.180078430
mov ebp, eax
bsr ecx, ebp
bsr eax, edi
shl r12d, 0x10
add eax, ecx
cmp eax, 0x2e
jl 0x180087011
mov eax, r12d
jmp 0x18008701a
mov edx, edi
mov ecx, ebp
call fcn.180078430
mov r9d, dword [rsp + 0x88]
mov ecx, r9d
shl ecx, 0x10
cmp eax, ecx
jge 0x180087036
shl esi, 0x10
mov ecx, esi
jmp 0x180087125
mov r8d, dword [rsp + 0x70]
mov edx, r8d
shl edx, 0x10
mov dword [rsp + 0x88], edx
cmp eax, edx
jge 0x180087094
mov ebx, r8d
mov edx, edi
sub ebx, r9d
call fcn.180075eb0
mov ecx, ebp
sub ecx, eax
test ebx, ebx
je 0x180087084
sub r15d, esi
mov r8d, ebx
mov edx, r15d
call fcn.180078300
shl esi, 0x10
mov edx, edi
mov ecx, esi
mov ebx, eax
call fcn.180075eb0
add ebx, eax
jmp 0x18008712e
mov esi, dword [rsp + 0x78]
mov ebx, esi
mov r8d, dword [rsp + 0x70]
shl ebx, 0x10
jmp 0x1800870a1
mov esi, dword [rsp + 0x78]
mov ebx, esi
shl ebx, 0x10
cmp eax, ebx
jge 0x1800870e0
mov ecx, dword [rsp + 0x88]
mov r12d, esi
mov edx, edi
sub r12d, r8d
call fcn.180075eb0
mov ecx, ebp
sub ecx, eax
test r12d, r12d
je 0x1800870e5
sub r13d, r15d
mov r8d, r12d
mov edx, r13d
call fcn.180078300
shl r15d, 0x10
mov edx, edi
mov ecx, r15d
mov ebx, eax
call fcn.180075eb0
add ebx, eax
jmp 0x18008712e
cmp eax, r12d
jge 0x18008711e
mov r15d, dword [rsp + 0x20]
mov edx, edi
mov ecx, ebx
call fcn.180075eb0
sub ebp, eax
sub r15d, esi
je 0x18008711e
sub r14d, r13d
mov r8d, r15d
mov edx, r14d
mov ecx, ebp
call fcn.180078300
shl r13d, 0x10
mov edx, edi
mov ecx, r13d
mov ebx, eax
call fcn.180075eb0
add ebx, eax
jmp 0x18008712e
shl r14d, 0x10
mov ecx, r14d
mov edx, edi
call fcn.180075eb0
mov ebx, eax
mov edx, dword [rsp + 0x24]
mov ecx, ebx
call fcn.180075eb0
mov r15, qword [rsp + 0x30]
add eax, 0x8000
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x80]
shr eax, 0x10
cwde
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
Function at 0x1800bfb20
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rax, qword [rcx + 0x20]
xor r14d, r14d
sub rax, 0x34
mov qword [rcx + 0x78], r14
mov qword [rcx + 0x28], rax
mov ebp, edx
mov rax, qword [rcx + 0x30]
mov rbx, rcx
mov word [rcx + 0x6a], r14w
mov esi, r14d
mov dword [rcx + 0x3c], r14d
mov qword [rcx + 0x70], rax
mov qword [rax + 0x10], rax
mov word [rcx + 0x68], r14w
cmp r14w, word [rcx + 0xb8]
jge 0x1800bfc6b
movzx r10d, r14w
mov edi, r14d
mov rax, qword [rbx + 0xd0]
mov r9d, ebp
mov dword [rbx + 0x88], r14d
movzx edx, r10w
mov qword [rbx + 0x80], r14
mov rcx, rbx
movzx r8d, word [rdi + rax]
call fcn.1800bffe0
test al, al
jne 0x1800bfd06
mov rax, qword [rbx + 0xd0]
mov r8d, dword [rbx + 4]
mov edx, dword [rbx + 0x5c]
movzx r10d, word [rdi + rax]
lea eax, [r8 - 1]
test edx, eax
jne 0x1800bfbfb
cmp edx, dword [rbx + 0x60]
jl 0x1800bfbfb
cmp edx, dword [rbx + 0x64]
jg 0x1800bfbfb
mov rcx, qword [rbx + 0x80]
test rcx, rcx
je 0x1800bfbfb
mov rax, qword [rbx + 0x70]
movzx ecx, byte [rcx + 0x18]
xor cl, byte [rax + 0x18]
test cl, 8
jne 0x1800bfbfb
add qword [rbx + 0x30], 0xfffffffffffffffc
mov r9, qword [rbx + 0x70]
mov rax, qword [r9 + 0x10]
cmp qword [rbx + 0x30], rax
je 0x1800bfc1e
test byte [r9 + 0x18], 8
je 0x1800bfc1e
neg r8d
and r8d, edx
sub edx, r8d
cmp edx, dword [rbx + 8]
jmp 0x1800bfc2f
lea eax, [r8 - 1]
neg r8d
add eax, edx
and eax, r8d
sub eax, edx
cmp eax, dword [rbx + 8]
setge dl
mov rcx, rbx
call fcn.1800c09a0
test al, al
jne 0x1800bfd06
mov rax, qword [rbx + 0x80]
test rax, rax
je 0x1800bfc52
mov qword [r9 + 0x28], rax
movsx eax, word [rbx + 0xb8]
inc esi
add rdi, 2
inc r10w
cmp esi, eax
jl 0x1800bfb84
movzx edi, word [rbx + 0x68]
mov rdx, qword [rbx + 0x78]
cmp di, 1
jbe 0x1800bfd0a
test rdx, rdx
je 0x1800bfd0a
mov ebp, 0xffff
nop dword [rax + rax]
lea rsi, [rdx + 8]
cmp di, 1
jbe 0x1800bfca8
movsxd rcx, dword [rdx + 0x1c]
mov rax, qword [rdx + 0x10]
lea r10, [rax + rcx*4]
jmp 0x1800bfcab
mov r10, r14
mov qword [rsi], r10
test byte [rdx + 0x18], 8
mov r11d, dword [rdx + 0x20]
mov r8d, r11d
mov eax, dword [rdx + 0x1c]
je 0x1800bfcc6
dec r11d
add r11d, eax
jmp 0x1800bfcdd
sub r8d, eax
inc r8d
dec eax
mov dword [rdx + 0x20], r8d
movsxd rcx, eax
shl rcx, 2
add qword [rdx + 0x10], rcx
mov edx, r8d
mov rcx, rbx
call fcn.1800c0c60
test al, al
jne 0x1800bfd06
lea edx, [r11 + 1]
mov rcx, rbx
call fcn.1800c0c60
test al, al
jne 0x1800bfd06
mov rdx, qword [rsi]
add di, bp
jne 0x1800bfc90
jmp 0x1800bfd0e
mov al, 1
jmp 0x1800bfd19
mov qword [rbx + 0x78], r14
mov rax, qword [rbx + 0x28]
cmp qword [rbx + 0x30], rax
setae al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14001af90]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x14001afa0]
mov dword [rax], 1
mov rax, qword [0x14001afb0]
mov dword [rax], 1
mov rax, qword [0x14001af80]
mov dword [rax], 1
mov rax, qword [0x14001ae20]
cmp word [rax], 0x5a4d
jne 0x140001067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010d0
mov rax, qword [0x14001af70]
mov dword [0x14001e020], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010c0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x14001af30]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x14001af10]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x14001adb0]
cmp dword [rax], 1
je 0x140001108
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001120
cmp dx, 0x20b
jne 0x140001067
cmp dword [rax + 0x84], 0xe
jbe 0x140001067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x140001067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x140001067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x140001067

Function at 0x140001950
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]
Function at 0x140002270
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
mov r8, rdx
lea rdx, [rax + rcx]
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x1400022bc
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov ecx, dword [rax + 0xc]
mov rdx, rcx
cmp rcx, r8
ja 0x1400022b3
add edx, dword [rax + 8]
cmp rdx, r8
ja 0x1400022be
add rax, 0x28
cmp rax, r9
jne 0x1400022a0
xor eax, eax
ret

Function at 0x1400022c0
Capabilities:
Parse pe header

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.strlen
cmp rax, 8
ja 0x140002350
mov rdx, qword [0x14001ae20]
xor r12d, r12d
cmp word [rdx], 0x5a4d
jne 0x14000233e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x14000233e
cmp word [rax + 0x18], 0x20b
jne 0x14000233e
movzx edx, word [rax + 0x14]
lea r12, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x140002350
sub eax, 1
lea rax, [rax + rax*4]
lea rsi, [r12 + rax*8 + 0x28]
jmp 0x140002329
add r12, 0x28
cmp r12, rsi
je 0x140002350
mov r8d, 8
mov rdx, rbx
mov rcx, r12
call sym.strncmp
test eax, eax
jne 0x140002320
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
xor r12d, r12d
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret

Function at 0x140002360
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14001ae20]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002380
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002388
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002380
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x1400023d5
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400023cc
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002380
add rax, 0x28
cmp rax, r9
jne 0x1400023b8
xor eax, eax
ret

Function at 0x1400023e0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14001ae20]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140002400
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002408
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x140002400
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x140002420
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x14001ae20]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x140002440
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x140002448
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140002440
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x140002488
sub edx, 1
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x14000247f
test rcx, rcx
je 0x140002440
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x140002470
xor eax, eax
ret
Function at 0x140002490
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14001ae20]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1400024b0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x1400024b8
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x1400024d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x14001ae20]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1400024f0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x1400024f8
mov eax, r8d
ret
cmp word [rdx + 0x18], 0x20b
jne 0x1400024f0
sub rcx, rax
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x1400024f0
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002534
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002548
add rax, 0x28
cmp r9, rax
jne 0x140002520
xor r8d, r8d
mov eax, r8d
ret
mov r8d, dword [rax + 0x24]
not r8d
shr r8d, 0x1f
mov eax, r8d
ret

Function at 0x140002560
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x14001ae20]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140002582
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140002590
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002582
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140002582
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x140002582
sub r8d, 1
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop dword [rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x1400025dd
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x1400025f0
add rdx, 0x28
cmp r10, rdx
jne 0x1400025c8
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x1400025ff
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x14000260f
mov edx, dword [rax + 0xc]
test edx, edx
je 0x1400025e6
test ecx, ecx
jg 0x1400025f8
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret

Function at 0x140003c80
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [0x14001aea0]
mov rax, qword [rsi]
test rax, rax
je 0x140003d10
cmp qword [rax + 0x30], 0
jne 0x140003d30
lea rbx, [0x140019078]
mov qword [rax + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx], eax
mov rax, qword [rsi]
test rax, rax
je 0x140003ce0
cmp qword [rax + 0x30], 0
jne 0x140003d00
lea rdx, [0x140019078]
mov qword [rax + 0x30], rdx
mov rax, rdx
cmp dword [rax], 0xffffffff
je sym.pthread_tls_init.cold
add rsp, 0x28
pop rbx
pop rsi
ret
call sym.__shmem3_winpthreads_tdm_init_local_region
mov r8, rax
mov rax, qword [rsi]
cmp qword [r8 + 0x30], 0
je 0x140003cc2
test rax, rax
jne 0x140003d00
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rax, qword [rax + 0x30]
jmp 0x140003cd0
call sym.__shmem3_winpthreads_tdm_init_local_region
cmp qword [rax + 0x30], 0
mov rax, qword [rsi]
je 0x140003ca0
test rax, rax
jne 0x140003d30
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rbx, qword [rax + 0x30]
jmp 0x140003cab
Function at 0x140007900
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x14001aea0]
mov rax, qword [rbx]
mov r12, rcx
mov esi, edx
test rax, rax
je 0x1400079d0
cmp qword [rax + 0x60], 0
jne 0x1400079f0
lea rcx, [0x140019068]
mov qword [rax + 0x60], rcx
call sym.pthread_mutex_lock
mov rcx, r12
call sym.__pthread_get_pointer
test rax, rax
je 0x140007a00
cmp qword [rax + 0x1d8], r12
jne 0x140007a00
test byte [rax + 0x40], 0xc
jne 0x140007a00
mov edx, dword [rax + 0xbc]
test edx, edx
jne 0x140007a00
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x140007a00
mov rax, qword [rbx]
test rax, rax
je 0x140007a60
cmp qword [rax + 0x60], 0
jne 0x140007a80
lea rcx, [0x140019068]
mov qword [rax + 0x60], rcx
call sym.pthread_mutex_unlock
test esi, esi
je 0x140007a90
lea edx, [rsi - 2]
cmp edx, 0x15
ja 0x140007a98
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
jmp sym.pthread_cancel
call sym.__shmem3_winpthreads_tdm_init_local_region
cmp qword [rax + 0x60], 0
mov rax, qword [rbx]
je 0x14000792b
test rax, rax
jne 0x1400079f0
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rcx, qword [rax + 0x60]
jmp 0x140007936
mov rax, qword [rbx]
test rax, rax
je 0x140007a30
cmp qword [rax + 0x60], 0
jne 0x140007a50
lea rcx, [0x140019068]
mov qword [rax + 0x60], rcx
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
call sym.__shmem3_winpthreads_tdm_init_local_region
mov r8, rax
mov rax, qword [rbx]
cmp qword [r8 + 0x60], 0
je 0x140007a0f
test rax, rax
jne 0x140007a50
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rcx, qword [rax + 0x60]
jmp 0x140007a1a
call sym.__shmem3_winpthreads_tdm_init_local_region
cmp qword [rax + 0x60], 0
mov rax, qword [rbx]
je 0x14000799a
test rax, rax
jne 0x140007a80
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rcx, qword [rax + 0x60]
jmp 0x1400079a5
xor eax, eax
jmp 0x140007a24
mov eax, 0x16
jmp 0x140007a24
Function at 0x140001230
Capabilities:
Enumerate processes

Disassembly:
push rsi
sub rsp, 0x160
mov rax, qword [0x140014040]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rsi, rdx
test rdx, rdx
jne 0x14000125a
xor eax, eax
jmp 0x1400012fc
mov qword [rsp + 0x170], rbx
xor edx, edx
mov qword [rsp + 0x180], rbp
mov ecx, 2
mov qword [rsp + 0x188], rdi
xor edi, edi
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x1400012e2
nop
mov rdx, rsi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
jne 0x1400012d0
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x1400012d0
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400012b0
mov rbp, qword [rsp + 0x180]
mov eax, edi
mov rdi, qword [rsp + 0x188]
mov rbx, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140009880
add rsp, 0x160
pop rsi
ret
Function at 0x14000a524
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000a56e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000a56e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000a56e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000a56e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000a56e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000a570
xor al, al
add rsp, 0x28
ret
Function at 0x140002584
Capabilities:
Create thread
Inject thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x140037010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdx
mov rcx, rdx
call fcn.1400028dc
test al, al
jne 0x1400025c2
call fcn.140002748
mov r8d, eax
test r8d, r8d
jne 0x1400025d3
lea rdx, str.Invalid_Process_Name
jmp 0x140002716
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
jne 0x14000260b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1400025ff
lea rdx, str.Invalid_Process_ID
jmp 0x140002716
lea rdx, str.OpenProcess___Failed._Try_to_run_SMI_elevated_
jmp 0x140002716
mov rcx, rdi
call fcn.14000364c
mov r8, rax
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbp, rax
test rax, rax
jne 0x140002643
lea rdx, str.VirtualAllocEx___Failed
jmp 0x140002716
mov rcx, rdi
call fcn.14000364c
mov r9, rax
call fcn.140002a68
and qword [rsp + 0x20], 0
mov r8, rax
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140002678
lea rdx, str.WriteProcessMemory___Failed
jmp 0x140002716
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov qword [rsp + 0x20], rbp
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov r14, rax
test rax, rax
jne 0x1400026ae
lea rdx, str.CreateRemoteThread___Failed
jmp 0x140002716
or edx, 0xffffffff
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
and dword [rsp + 0x50], 0
lea rdx, [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test eax, eax
jne 0x1400026f8
lea rdx, str.VirtualFreeEx___Failed
jmp 0x140002716
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x50], 0
lea rdx, str.Injecting_Module_Failed
je 0x140002716
lea rdx, str.Module_Successfully_Injected
call fcn.140002adc
nop
mov rcx, rdi
call fcn.140002ae8
nop
mov rcx, rbx
call fcn.1400029c8
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002b2d0
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140002748
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x140037010]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov dword [rsp + 0x20], 0x238
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000278a
xor eax, eax
jmp 0x1400027d0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
lea rdx, [rsp + 0x4c]
mov rcx, rdi
call fcn.1400028ac
mov rcx, rbx
test eax, eax
je 0x1400027c6
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140002798
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002786
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14002b2d0
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
Function at 0x140007a2c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
not r8d
mov r9d, 4
movzx eax, byte [rcx]
inc rcx
movzx edx, r8b
xor rdx, rax
shr r8d, 8
lea rax, [0x14002e0a0]
xor r8d, dword [rax + rdx*4]
sub r9, 1
jne 0x140007a35
not r8d
mov eax, r8d
ret

Function at 0x140007a60
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x140007aba
mov r11b, 0x23
lea rdi, [0x14002e0a0]
movzx ebx, byte [r10]
dec rdx
inc r10
cmp bl, r11b
jne 0x140007aa4
cmp rdx, 2
jb 0x140007aa4
cmp byte [r10], r11b
jne 0x140007aa4
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rbx
shr r9d, 8
xor r9d, dword [rdi + rcx*4]
test rdx, rdx
jne 0x140007a82
jmp 0x140007afb
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x140007afb
mov r11b, 0x23
lea rdi, [0x14002e0a0]
cmp dl, r11b
jne 0x140007adf
cmp byte [r10], r11b
jne 0x140007adf
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rdi + rcx*4]
test dl, dl
jne 0x140007acd
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret

Function at 0x140009310
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x28
add rcx, 0xc8
mov r9, rdx
call fcn.140015660
xor edx, edx
mov rcx, r9
mov r8d, dword [rax]
add rsp, 0x28
jmp fcn.140007a60