joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140035320
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.140033fb0
mov ecx, dword [0x1400450d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140035398
test byte [rbx + 0x40], 0xc
jne 0x14003534f
mov eax, dword [0x14005a448]
test eax, eax
jne 0x140035360
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.140033190
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x140035383
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x140035383
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x1400353ac
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.140033480
call fcn.140034060
mov rbx, rax
test rax, rax
jne 0x14003533f
add rsp, 0x28
pop rbx
pop rsi
ret
and eax, 0xfffffff3
mov rcx, qword [rbx + 0x30]
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x1400353ca
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call fcn.140033480
call fcn.140035240
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x140035450
call fcn.140032f20
mov rsi, rax
mov eax, 0xfffffffe
cmp rax, rsi
jb 0x140035488
call fcn.140033fb0
mov ecx, dword [0x1400450d8]
mov edi, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x1400354e0
test esi, esi
je 0x140035466
call fcn.140035320
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1400354c0
mov edx, edi
call fcn.140032ff0
call fcn.140035320
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.140033fb0
mov ecx, dword [0x1400450d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400354d0
call fcn.140035320
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140035320
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.140033fb0
mov ecx, dword [0x1400450d8]
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140035425
call fcn.140034060
mov rbx, rax
jmp 0x140035425
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14003543e
call fcn.140034060
jmp 0x140035466
call fcn.140034060
mov rbx, rax
jmp 0x140035421
Function at 0x1400353e0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.140033fb0
mov ecx, dword [0x1400450d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140035398
test byte [rbx + 0x40], 0xc
jne 0x14003534f
mov eax, dword [0x14005a448]
test eax, eax
jne 0x140035360
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.140033190
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x140035383
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x140035383
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x1400353ac
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.140033480
call fcn.140034060
mov rbx, rax
test rax, rax
jne 0x14003533f
add rsp, 0x28
pop rbx
pop rsi
ret
and eax, 0xfffffff3
mov rcx, qword [rbx + 0x30]
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x1400353ca
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call fcn.140033480
call fcn.140035240
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x140035450
call fcn.140032f20
mov rsi, rax
mov eax, 0xfffffffe
cmp rax, rsi
jb 0x140035488
call fcn.140033fb0
mov ecx, dword [0x1400450d8]
mov edi, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x1400354e0
test esi, esi
je 0x140035466
call fcn.140035320
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1400354c0
mov edx, edi
call fcn.140032ff0
call fcn.140035320
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.140033fb0
mov ecx, dword [0x1400450d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400354d0
call fcn.140035320
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140035320
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.140033fb0
mov ecx, dword [0x1400450d8]
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140035425
call fcn.140034060
mov rbx, rax
jmp 0x140035425
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14003543e
call fcn.140034060
jmp 0x140035466
call fcn.140034060
mov rbx, rax
jmp 0x140035421

Function at 0x1400354f0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
call fcn.140033fb0
mov ecx, dword [0x1400450d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140035560
test esi, esi
je 0x140035540
call fcn.140035320
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140035570
mov edx, esi
call fcn.140032ff0
call fcn.140035320
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.140035320
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140035320
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.140034060
mov rbx, rax
jmp 0x140035511
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14003552a
Function at 0x140035b30
Capabilities:
Create thread
Get thread local storage value
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbp, rcx
mov rdi, rdx
mov rsi, r8
mov r12, r9
call fcn.140033d40
mov rbx, rax
test rax, rax
je 0x140035d67
test rbp, rbp
je 0x140035b6b
mov rax, qword [rax + 0x1d8]
mov qword [rbp], rax
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbx + 0x44], 1
mov dword [rbx + 0xbc], 0
mov qword [rbx + 0x28], 0xffffffffffffffff
mov r14, r13
mov qword [rbx + 8], r12
mov r12, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x10], rsi
xor esi, esi
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call r12
mov qword [rbx + 0x30], rax
test rax, rax
jne 0x140035be0
test esi, esi
jne 0x140035bd0
xor ecx, ecx
mov esi, 1
call r14
jmp 0x140035b9f
add esi, 1
mov ecx, 0x14
call r13
cmp esi, 5
jne 0x140035b9f
mov qword [rbx + 0x38], 0xffffffffffffffff
lea r12, [rbx + 0x68]
mov rcx, r12
call fcn.140033780
cmp eax, 1
je 0x140035db7
cmp qword [rbx + 0x30], 0
mov dword [rbx], 0xbab1f00d
mov qword [rbx + 0x68], 0xffffffffffffffff
mov dword [rbx + 0xc0], 0
mov dword [rbx + 0xb8], 0
je 0x140035d50
xor edx, edx
test rdi, rdi
je 0x140035c4d
mov eax, dword [rdi]
mov rsi, qword [rdi + 0x10]
mov dword [rbx + 0x44], eax
test al, 8
jne 0x140035d78
mov eax, dword [rdi + 0x18]
mov dword [rbx + 0xc0], eax
mov edx, esi
lea r8, [0x140034310]
mov r9, rbx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov rsi, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140035d18
mov eax, dword [rbx + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jge 0x140035cf0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [rbx + 0x44], 4
jne 0x140035cd0
mov qword [rbx + 0x28], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, rsi
mov qword [rbx + 0x28], 0
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140035cb7
mov edx, 0xfffffffe
cmp eax, 0xffffffff
jl 0x140035c91
mov edx, 2
cmp eax, edx
cmovle edx, eax
cmp eax, 0xf
mov eax, 0xf
cmovge edx, eax
jmp 0x140035c91
mov rcx, qword [rbx + 0x30]
lea rsi, [rbx + 0x38]
test rcx, rcx
je 0x140035d2b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.140033610
mov rcx, r12
call fcn.140033780
cmp eax, 1
je 0x140035db7
mov qword [rbx + 0x68], 0xffffffffffffffff
pxor xmm0, xmm0
movups xmmword [rbx + 0x28], xmm0
test rbp, rbp
je 0x140035d5d
mov qword [rbp], 0
cmp qword [rbx + 0x1d0], 0
je 0x140035da0
mov eax, 0xb
jmp 0x140035cc1
call fcn.140033fb0
mov ecx, dword [0x1400450d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140035db0
mov eax, dword [rax + 0xc0]
jmp 0x140035c45
mov rcx, rbx
call fcn.140033e10
jmp 0x140035d67
call fcn.140034060
jmp 0x140035d8e
call fcn.140033b00
nop
nop dword [rax]
Function at 0x140037760
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov ecx, 2
mov r8d, 0x2c
lea rdx, str._stack_smashing_detected_:_terminated_n
call sub.msvcrt.dll__write
mov ecx, 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
test eax, eax
je 0x140037790
mov ecx, 2
int 0x29
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x180001000
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x130
mov esi, ecx
test ecx, ecx
je 0x1800010b0
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
mov rbx, qword [rdx + 0x20]
test rbx, rbx
je 0x1800010b0
mov ebp, 0x103
nop dword [rax]
mov rdi, qword [rbx + 0x50]
test rdi, rdi
je 0x1800010b0
cmp word [rbx + 0x48], bp
jae 0x1800010a8
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.180002cb0
xor eax, eax
cmp word [rdi], ax
je 0x180001095
cmp eax, ebp
jae 0x180001095
movzx r9d, byte [rdi + rax*2]
lea r8d, [r9 - 0x61]
cmp r8b, 0x19
lea ecx, [r9 - 0x20]
movzx edx, cl
cmova edx, r9d
mov byte [rsp + rax + 0x20], dl
inc eax
mov rdi, qword [rbx + 0x50]
cmp word [rdi + rax*2], 0
jne 0x180001068
lea rcx, [rsp + 0x20]
mov byte [rsp + rax + 0x20], 0
call fcn.180003b10
cmp eax, esi
je 0x1800010cb
mov rbx, qword [rbx]
test rbx, rbx
jne 0x180001040
xor eax, eax
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rax, qword [rbx + 0x20]
jmp 0x1800010b2

Function at 0x1800010e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push r15
sub rsp, 0x28
mov r15d, edx
mov rbp, rcx
test rcx, rcx
je 0x18000119d
test edx, edx
je 0x18000119d
movsxd rax, dword [rcx + 0x3c]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
mov r8d, dword [rax + rcx + 0x88]
add r8, rcx
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x20], r14
xor r14d, r14d
mov ebx, dword [r8 + 0x20]
mov r12d, dword [r8 + 0x1c]
add rbx, rcx
mov edi, dword [r8 + 0x24]
add r12, rcx
mov esi, dword [r8 + 0x18]
add rdi, rcx
test esi, esi
je 0x180001179
nop word [rax + rax]
mov ecx, dword [rbx]
dec esi
add rcx, rbp
call fcn.180003b10
cmp eax, r15d
je 0x18000116f
add rbx, 4
add rdi, 2
test esi, esi
jne 0x180001150
jmp 0x180001179
movzx eax, word [rdi]
mov r14d, dword [r12 + rax*4]
add r14, rbp
mov r12, qword [rsp + 0x58]
mov rax, r14
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
pop r15
pop rbp
ret
xor eax, eax
add rsp, 0x28
pop r15
pop rbp
ret
Function at 0x1800011b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rdi
push r13
push r14
push r15
sub rsp, 0x30
mov rdi, r9
mov rbx, r8
mov r14, rdx
mov r13, rcx
test r8b, 0xf
jne 0x1800012cd
mov r15, rbx
shr r15, 4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi], rax
mov rbx, rax
test rax, rax
je 0x1800012cd
mov qword [rsp + 0x68], rsi
lea rsi, [r13 + 0xf0]
test r15, r15
je 0x1800012b9
mov qword [rsp + 0x60], rbp
mov rdi, rsi
mov qword [rsp + 0x70], r12
lea rbp, [rax + 0xf]
movaps xmmword [rsp + 0x20], xmm6
lea r12, [rsi + 0xf]
sub rdi, rax
nop dword [rax]
nop word [rax + rax]
movups xmm6, xmmword [r14]
mov r9, r14
mov r8, rbx
mov edx, 0xe
mov rcx, r13
call fcn.180001320
cmp rbx, r12
ja 0x180001282
cmp rbp, rsi
jb 0x180001282
mov rax, rbx
mov edx, 0x10
nop dword [rax]
movzx ecx, byte [rdi + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x180001270
jmp 0x180001291
movdqu xmm1, xmmword [rbx]
movdqu xmm0, xmmword [rsi]
xorps xmm1, xmm0
movdqu xmmword [rbx], xmm1
add rbx, 0x10
add rbp, 0x10
sub rdi, 0x10
add r14, 0x10
movups xmmword [rsi], xmm6
sub r15, 1
jne 0x180001240
movaps xmm6, xmmword [rsp + 0x20]
mov r12, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov al, 1
add rsp, 0x30
pop r15
pop r14
pop r13
pop rdi
pop rbx
ret
xor al, al
add rsp, 0x30
pop r15
pop r14
pop r13
pop rdi
pop rbx
ret
Function at 0x1800026b0
Capabilities:
Get common file path
Parse pe header

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x370
xorps xmm0, xmm0
lea rcx, [rsp + 0x60]
xor ebx, ebx
xor edx, edx
mov r8d, 0x100
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x30], xmm0
call fcn.180002cb0
xor edx, edx
lea rcx, [rsp + 0x160]
mov r8d, 0x208
call fcn.180002cb0
lea rax, [rsp + 0x160]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [rbx + 0xe]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rax, [0x1800026b0]
mov r8d, 0x5a4d
mov r9d, 0x20b
nop
cmp word [rax], r8w
jne 0x18000274b
movsxd rdx, dword [rax + 0x3c]
cmp dword [rdx + rax], 0x4550
jne 0x18000274b
test word [rdx + rax + 0x18], r9w
jne 0x180002750
dec rax
jmp 0x180002730
mov r9d, dword [rdx + rax + 0x98]
movzx r8d, word [r9 + rax + 0xe]
lea r10, [r9 + rax]
movzx ecx, word [r10 + 0xc]
add r8, rcx
je 0x1800028b5
mov ecx, dword [r10 + rbx*8 + 0x14]
test ecx, ecx
jns 0x1800028b5
btr ecx, 0x1f
add rcx, r9
mov edx, dword [rcx + rax + 0x14]
test edx, edx
jns 0x180002794
cmp word [rcx + rax + 0x10], 0x69
je 0x1800027a7
inc rbx
cmp rbx, r8
jb 0x180002770
xor eax, eax
add rsp, 0x370
pop rbx
ret
btr edx, 0x1f
mov qword [rsp + 0x390], rdi
add rdx, r9
mov ecx, dword [rdx + rax + 0x14]
btr ecx, 0x1f
add rcx, r9
mov ebx, dword [rcx + rax]
mov edi, dword [rcx + rax + 4]
add rbx, rax
je 0x1800028ad
test edi, edi
je 0x1800028ad
mov r8d, 0x20
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.180003d60
lea rdx, [rbx + 0x20]
mov r8d, 0x10
lea rcx, [rsp + 0x30]
call fcn.180003d60
call fcn.1800034e0
test eax, eax
je 0x1800028ad
call fcn.180003160
test eax, eax
je 0x1800028ad
call fcn.1800035c0
test eax, eax
je 0x1800028ad
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.180002990
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.1800012e0
lea eax, [rdi - 0x30]
mov r8d, eax
lea rdx, [rbx + 0x30]
lea r9, [rsp + 0x380]
mov edi, eax
lea rcx, [rsp + 0x60]
call fcn.1800011b0
test al, al
je 0x1800028ad
mov rcx, qword [rsp + 0x380]
lea r8, [rsp + 0x388]
mov edx, edi
call fcn.1800032a0
test eax, eax
je 0x1800028ad
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x380]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x388]
call fcn.180003430
mov rdi, qword [rsp + 0x390]
xor eax, eax
add rsp, 0x370
pop rbx
ret
jmp 0x1800026b0
Function at 0x1800028c0
Capabilities:
Get common file path
Parse pe header

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x370
xorps xmm0, xmm0
lea rcx, [rsp + 0x60]
xor ebx, ebx
xor edx, edx
mov r8d, 0x100
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x30], xmm0
call fcn.180002cb0
xor edx, edx
lea rcx, [rsp + 0x160]
mov r8d, 0x208
call fcn.180002cb0
lea rax, [rsp + 0x160]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [rbx + 0xe]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rax, [0x1800026b0]
mov r8d, 0x5a4d
mov r9d, 0x20b
nop
cmp word [rax], r8w
jne 0x18000274b
movsxd rdx, dword [rax + 0x3c]
cmp dword [rdx + rax], 0x4550
jne 0x18000274b
test word [rdx + rax + 0x18], r9w
jne 0x180002750
dec rax
jmp 0x180002730
mov r9d, dword [rdx + rax + 0x98]
movzx r8d, word [r9 + rax + 0xe]
lea r10, [r9 + rax]
movzx ecx, word [r10 + 0xc]
add r8, rcx
je 0x1800028b5
mov ecx, dword [r10 + rbx*8 + 0x14]
test ecx, ecx
jns 0x1800028b5
btr ecx, 0x1f
add rcx, r9
mov edx, dword [rcx + rax + 0x14]
test edx, edx
jns 0x180002794
cmp word [rcx + rax + 0x10], 0x69
je 0x1800027a7
inc rbx
cmp rbx, r8
jb 0x180002770
xor eax, eax
add rsp, 0x370
pop rbx
ret
btr edx, 0x1f
mov qword [rsp + 0x390], rdi
add rdx, r9
mov ecx, dword [rdx + rax + 0x14]
btr ecx, 0x1f
add rcx, r9
mov ebx, dword [rcx + rax]
mov edi, dword [rcx + rax + 4]
add rbx, rax
je 0x1800028ad
test edi, edi
je 0x1800028ad
mov r8d, 0x20
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.180003d60
lea rdx, [rbx + 0x20]
mov r8d, 0x10
lea rcx, [rsp + 0x30]
call fcn.180003d60
call fcn.1800034e0
test eax, eax
je 0x1800028ad
call fcn.180003160
test eax, eax
je 0x1800028ad
call fcn.1800035c0
test eax, eax
je 0x1800028ad
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.180002990
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.1800012e0
lea eax, [rdi - 0x30]
mov r8d, eax
lea rdx, [rbx + 0x30]
lea r9, [rsp + 0x380]
mov edi, eax
lea rcx, [rsp + 0x60]
call fcn.1800011b0
test al, al
je 0x1800028ad
mov rcx, qword [rsp + 0x380]
lea r8, [rsp + 0x388]
mov edx, edi
call fcn.1800032a0
test eax, eax
je 0x1800028ad
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x380]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x388]
call fcn.180003430
mov rdi, qword [rsp + 0x390]
xor eax, eax
add rsp, 0x370
pop rbx
ret
jmp 0x1800026b0
Function at 0x1800028e0
Capabilities:
Accept command line arguments
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp edx, 1
jne 0x180002971
xor esi, esi
mov dword [rsp + 0x48], esi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x48]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, esi
mov rdi, rax
cmp dword [rsp + 0x48], ebx
jle 0x18000293b
nop dword [rax]
mov rcx, qword [rdi]
call fcn.180003c70
cmp eax, 0xd3f89e8b
je 0x180002971
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x48]
jl 0x180002920
mov qword [rsp + 0x28], rsi
lea r8, [0x1800026b0]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
setne sil
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov eax, 1
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180003b10
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
mov r10, rcx
mov eax, 0xffffffff
movzx ecx, byte [rcx]
test cl, cl
je 0x180003c2a
nop dword [rax]
nop word [rax + rax]
movzx ecx, cl
lea r10, [r10 + 1]
mov edx, ecx
and ecx, 0xd5555555
shr edx, 1
add ecx, ecx
and edx, 0x55555555
or edx, ecx
mov ecx, edx
shr edx, 2
and ecx, 0xf3333333
and edx, 0x33333333
shl ecx, 2
or ecx, edx
lea edx, [rax + rax]
mov r8d, edx
mov r9d, ecx
shr ecx, 4
xor r8d, 0x4c11db7
and r9d, 0xff0f0f0f
shl r9d, 4
or r9d, ecx
bswap r9d
mov ecx, r9d
xor ecx, eax
cmovns r8d, edx
lea ecx, [r9 + r9]
lea eax, [r8 + r8]
mov edx, eax
xor edx, 0x4c11db7
xor r8d, ecx
cmovns edx, eax
add ecx, ecx
lea eax, [rdx + rdx]
mov r8d, eax
xor r8d, 0x4c11db7
xor edx, ecx
cmovns r8d, eax
add ecx, ecx
lea eax, [r8 + r8]
mov edx, eax
xor edx, 0x4c11db7
xor r8d, ecx
cmovns edx, eax
add ecx, ecx
lea eax, [rdx + rdx]
mov r8d, eax
xor r8d, 0x4c11db7
xor edx, ecx
cmovns r8d, eax
add ecx, ecx
lea eax, [r8 + r8]
mov edx, eax
xor edx, 0x4c11db7
xor r8d, ecx
cmovns edx, eax
add ecx, ecx
lea eax, [rdx + rdx]
mov r8d, eax
xor r8d, 0x4c11db7
xor edx, ecx
cmovns r8d, eax
add ecx, ecx
lea edx, [r8 + r8]
mov eax, edx
xor eax, 0x4c11db7
xor ecx, r8d
movzx ecx, byte [r10]
cmovns eax, edx
test cl, cl
jne 0x180003b30
not eax
mov ecx, eax
and eax, 0xd5555555
add eax, eax
shr ecx, 1
and ecx, 0x55555555
or ecx, eax
mov edx, ecx
shr ecx, 2
and edx, 0xf3333333
and ecx, 0x33333333
shl edx, 2
or edx, ecx
mov eax, edx
shr edx, 4
and eax, 0xff0f0f0f
and edx, 0xf0f0f0f
shl eax, 4
or eax, edx
bswap eax
ret

Function at 0x180003c70
Capabilities:
Encode data using xor

Disassembly:
mov r8, rcx
mov eax, 0xffffffff
movzx ecx, byte [rcx]
test cl, cl
je 0x180003d1c
movzx edx, cl
lea r8, [r8 + 1]
xor eax, edx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xed788320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xed788320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xed788320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xed788320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xed788320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xed788320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xed788320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xed788320
xor eax, ecx
movzx ecx, byte [r8]
test cl, cl
jne 0x180003c83
not eax
ret
Function at 0x140014ec0
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
movzx r13d, r9b
mov r12d, r8d
mov ebp, edx
mov rbx, rcx
xor edi, edi
mov qword [rcx], rdi
mov dword [rcx + 8], 0x4b
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 1
lea rax, [0x1400886d4]
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rdi
mov dword [rcx + 0x34], edi
mov dword [rcx + 0x38], 0x4c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, ebp
cmp ebp, eax
cmove edx, edi
lea ecx, [rdi + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbx + 0x40], rax
mov dword [rbx + 0x48], ebp
mov byte [rbx + 0x4c], dil
movzx ecx, byte [rsp + 0x90]
mov byte [rbx + 0x4d], cl
cmp rax, 0xffffffffffffffff
je 0x140015076
test ebp, ebp
je 0x140014f66
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp ebp, eax
je 0x140014f66
xor r14b, r14b
jmp 0x140014f69
mov r14b, 1
mov dword [rsp + 0x20], 0x1c
lea rdx, [rsp + 0x20]
mov rcx, qword [rbx + 0x40]
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x140015027
cmp dword [rsp + 0x20], 0x10
jb 0x140015009
cmp dword [rsp + 0x2c], ebp
jne 0x140015009
test r14b, r14b
je 0x140014fab
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, dword [rsp + 0x28]
cmp r8d, eax
je 0x140015009
jmp 0x140014fb0
mov r8d, dword [rsp + 0x28]
mov ecx, r12d
or ecx, 2
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x140015009
mov rdi, qword [rbx + 0x10]
inc rdi
mov rcx, qword [rbx + 0x18]
shr rcx, 1
cmp rdi, rcx
jbe 0x140014fe1
mov rcx, rbx
call fcn.140010fb0
mov qword [rbx + 0x10], rdi
mov rcx, qword [rbx]
add rcx, 0xfffffffffffffff8
lea rcx, [rcx + rdi*8]
test rcx, rcx
je 0x140014ff8
mov qword [rcx], rsi
lea rdx, [rsp + 0x28]
lea rcx, [rbx + 0x20]
call fcn.140015230
mov qword [rax], rsi
mov dword [rsp + 0x20], 0x1c
lea rdx, [rsp + 0x20]
mov rcx, qword [rbx + 0x40]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x140014f87
test r13b, r13b
je 0x140015076
cmp qword [rbx + 0x40], 0xffffffffffffffff
je 0x140015076
cmp byte [rbx + 0x4c], 0
jne 0x140015076
mov rdi, qword [rbx]
mov rax, qword [rbx + 0x10]
lea rcx, [rdi + rax*8]
cmp rdi, rcx
je 0x140015076
nop dword [rax]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
setne al
or byte [rbx + 0x4c], al
add rdi, 8
mov rcx, qword [rbx + 0x10]
mov rax, qword [rbx]
lea rcx, [rax + rcx*8]
cmp rdi, rcx
jne 0x140015050
mov rax, rbx
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret