joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418be0
Capabilities:
Hijack thread execution

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x4f8
mov rsi, rcx
call sym.__pth_gpointer_locked
test rax, rax
mov rbx, rax
je 0x418c09
mov rcx, qword [rax + 0x28]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
jbe 0x418c20
mov eax, 3
add rsp, 0x4f8
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdi, [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x418c09
lea rbp, [rbx + 0x38]
mov rcx, rbp
call sym.pthread_mutex_lock
call sym.__pthread_self_lite
test rax, rax
je 0x418dc5
mov rax, qword [rax + 0x1d8]
cmp rsi, rax
je 0x418cc3
mov eax, dword [rbx + 0x44]
and eax, 3
cmp eax, 3
movzx eax, byte [rbx + 0x40]
je 0x418d20
test al, 3
jne 0x418caa
and eax, 0xfffffffc
or eax, 1
mov byte [rbx + 0x40], al
mov rax, qword [0x0049c500]
test rax, rax
je 0x418dcc
lock add dword [rax], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x418c9b
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbp
call sym.pthread_mutex_unlock
xor eax, eax
jmp 0x418c0e
mov rcx, rbp
call sym.pthread_mutex_unlock
test byte [rbx + 0x40], 0xc
jne 0x418c09
xor eax, eax
jmp 0x418c0e
movzx eax, byte [rbx + 0x40]
test al, 3
jne 0x418caa
and eax, 0xfffffffc
or eax, 1
mov byte [rbx + 0x40], al
mov rax, qword [0x0049c500]
test rax, rax
je 0x418dec
lock add dword [rax], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x418cf7
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [rbx + 0x44]
and eax, 3
cmp eax, 3
jne 0x418c9b
movzx eax, byte [rbx + 0x40]
and dword [rbx + 0x44], 0xfffffffe
mov rcx, rbp
and eax, 0xfffffff3
or eax, 4
mov byte [rbx + 0x40], al
call sym.pthread_mutex_unlock
call sym._pthread_invoke_cancel
test al, 0xc
jne 0x418caa
test al, 0xf
jne 0x418c09
mov rcx, qword [rbx + 0x28]
mov dword [rsp + 0x50], 0x100001
call qword [sym.imp.KERNEL32.dll_SuspendThread]
xor edx, edx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x418c9b
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rax, [sym._pthread_invoke_cancel]
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
mov qword [rsp + 0x118], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
movzx eax, byte [rbx + 0x40]
and dword [rbx + 0x44], 0xfffffffe
and eax, 0xfffffff0
or eax, 5
mov byte [rbx + 0x40], al
mov rax, qword [0x0049c500]
test rax, rax
je 0x418e0c
lock add dword [rax], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x418dae
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbp
call sym.pthread_mutex_unlock
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x418c9b
xor eax, eax
jmp 0x418c53
lea rcx, str._pthread_cancelling_shmem
xor r8d, r8d
mov edx, 4
call sym.__shmem_winpthreads_grab
mov qword [0x0049c500], rax
jmp 0x418c88
lea rcx, str._pthread_cancelling_shmem
xor r8d, r8d
mov edx, 4
call sym.__shmem_winpthreads_grab
mov qword [0x0049c500], rax
jmp 0x418ce4
lea rcx, str._pthread_cancelling_shmem
xor r8d, r8d
mov edx, 4
call sym.__shmem_winpthreads_grab
mov qword [0x0049c500], rax
jmp 0x418d9b
Function at 0x418e30
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [0x0049c4b8]
mov edi, edx
test rcx, rcx
je 0x418f10
call sym.pthread_mutex_lock
mov rcx, rbx
call sym.__pthread_get_pointer
test rax, rax
je 0x418e6a
mov rsi, qword [rax + 0x1d8]
cmp rsi, rbx
je 0x418e90
mov rcx, qword [0x0049c4b8]
test rcx, rcx
je 0x418ee0
mov ebx, 3
call sym.pthread_mutex_unlock
mov eax, ebx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
test byte [rax + 0x40], 0xc
jne 0x418e6a
mov ebx, dword [rax + 0xbc]
test ebx, ebx
jne 0x418e6a
mov rax, qword [rax + 0x28]
test rax, rax
je 0x418e6a
cmp rax, 0xffffffffffffffff
je 0x418e6a
mov rcx, qword [0x0049c4b8]
test rcx, rcx
je 0x418f37
call sym.pthread_mutex_unlock
test edi, edi
je 0x418e80
sub edi, 2
mov ebx, 0x16
cmp edi, 0x15
ja 0x418e80
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.pthread_cancel
lea rcx, str.mtx_pthr_locked_shmem
lea r8, [sym.__shmem_winpthreads_init_mtx_pthr_locked_shmem]
mov edx, 8
call sym.__shmem_winpthreads_grab
mov qword [0x0049c4b8], rax
mov rcx, rax
jmp 0x418e76
lea rcx, str.mtx_pthr_locked_shmem
lea r8, [sym.__shmem_winpthreads_init_mtx_pthr_locked_shmem]
mov edx, 8
call sym.__shmem_winpthreads_grab
mov qword [0x0049c4b8], rax
mov rcx, rax
jmp 0x418e4c
lea rcx, str.mtx_pthr_locked_shmem
lea r8, [sym.__shmem_winpthreads_init_mtx_pthr_locked_shmem]
mov edx, 8
call sym.__shmem_winpthreads_grab
mov qword [0x0049c4b8], rax
mov rcx, rax
jmp 0x418ebb
Function at 0x4191b0
Capabilities:
Create thread
Resume thread

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
xor r15d, r15d
movabs r14, 0x1feedbab1
mov r12, rcx
mov rdi, rdx
mov rbx, r8
mov rsi, r9
call sym.pop_pthread_mem
test rax, rax
mov rbp, rax
je 0x419373
test r12, r12
je 0x4191fa
mov rax, qword [rax + 0x1d8]
mov qword [r12], rax
mov qword [rbp + 8], rsi
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov rsi, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbp + 0x10], rbx
mov ebx, 1
mov dword [rbp + 0xbc], 0
mov dword [rbp + 0x44], 1
mov qword [rbp + 0x28], 0xffffffffffffffff
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
call rsi
test rax, rax
mov qword [rbp + 0x30], rax
jne 0x419410
cmp ebx, 1
je 0x419261
mov ecx, 0x14
call r13
cmp ebx, 5
je 0x419270
add ebx, 1
jmp 0x41922e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41925c
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x38], 0xffffffffffffffff
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x68], r14
mov dword [rbp], 0xbab1f00d
mov dword [rbp + 0xc0], 0
test rax, rax
mov dword [rbp + 0xb8], 0
je 0x419358
test rdi, rdi
je 0x419450
mov eax, dword [rdi]
mov rbx, qword [rdi + 0x10]
test al, 8
mov dword [rbp + 0x44], eax
jne 0x4193e3
mov eax, dword [rdi + 0x18]
mov edx, ebx
mov dword [rbp + 0xc0], eax
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
mov r9, rbp
lea r8, [sym.pthread_create_wrapper]
call qword [sym.imp.msvcrt.dll__beginthreadex]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x419330
test rax, rax
je 0x419330
mov edx, dword [rbp + 0xc0]
cmp edx, 0xfffffff2
jl 0x419390
cmp edx, 0xffffffff
jl 0x419400
cmp edx, 0xe
jg 0x419440
cmp edx, 2
mov eax, 2
cmovge edx, eax
jmp 0x419395
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x41933f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x38]
call sym.pthread_mutex_destroy
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x68], r14
mov qword [rbp + 0x30], 0
test r12, r12
je 0x419365
mov qword [r12], 0
cmp qword [rbp + 0x1d0], 0
je 0x419457
mov eax, 0xb
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov edx, 0xfffffff1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [rbp + 0x44], 4
je 0x4193d4
mov rcx, rbx
mov qword [rbp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
jmp 0x419378
mov qword [rbp + 0x28], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x4193c8
call sym.__pthread_self_lite
mov eax, dword [rax + 0xc0]
mov edx, ebx
mov dword [rbp + 0xc0], eax
jmp 0x4192cd
mov edx, 0xfffffffe
jmp 0x419395
mov qword [rbp + 0x38], 0xffffffffffffffff
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x68], r14
mov dword [rbp], 0xbab1f00d
mov dword [rbp + 0xc0], 0
mov dword [rbp + 0xb8], 0
jmp 0x4192a8
mov edx, 0xf
jmp 0x419395
xor edx, edx
jmp 0x4192cd
mov rcx, rbp
call sym.push_pthread_mem.part.0
nop
jmp 0x419373
Function at 0x4199d0
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str.dummy_concurrency_level_shmem
xor r8d, r8d
mov edx, 4
jmp sym.__shmem_winpthreads_grab

Function at 0x419f00
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_mutex_global_shmem]
lea rcx, str.mutex_global_shmem
mov edx, 0x10
jmp sym.__shmem_winpthreads_grab

Function at 0x419f20
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_mutex_global_static_shmem]
lea rcx, str.mutex_global_static_shmem
mov edx, 0x10
jmp sym.__shmem_winpthreads_grab

Function at 0x41a020
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_mxattr_recursive_shmem]
lea rcx, str.mxattr_recursive_shmem
mov edx, 4
jmp sym.__shmem_winpthreads_grab

Function at 0x41a040
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_mxattr_errorcheck_shmem]
lea rcx, str.mxattr_errorcheck_shmem
mov edx, 4
jmp sym.__shmem_winpthreads_grab

Function at 0x41aa90
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_cond_locked_shmem_cond]
lea rcx, str.cond_locked_shmem_cond
mov edx, 0x10
jmp sym.__shmem_winpthreads_grab
Function at 0x41ba70
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x80]
mov r15, rcx
movsxd r12, edx
mov r13, r8
call sym.strlen
mov r14, rax
lea ebx, [rax + 0xf]
lea eax, [rax + 0x51]
cdqe
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.0040b4d0
sub rsp, rax
movsxd rdi, r14d
movabs rax, 0x656d68732d636367
lea rsi, [rsp + 0x20]
lea rcx, [rsp + 0x2f]
mov r8, rdi
mov rdx, r15
mov qword [rsp + 0x20], rax
mov eax, 0x326d
mov dword [rsp + 0x28], 0x64742d6d
mov word [rsp + 0x2c], ax
lea r15d, [r14 + 0x50]
mov byte [rsp + 0x2e], 0x2d
movsxd rbx, ebx
call sym.memcpy
lea rax, [rsi + rdi + 0x10]
movabs rdx, 0x6161616161616161
xor ecx, ecx
mov r8, rsi
mov qword [rax], rdx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], rdx
mov qword [rax + 0x28], rdx
mov qword [rax + 0x30], rdx
mov qword [rax + 0x38], rdx
movsxd rax, r15d
xor edx, edx
mov byte [rsp + rax + 0x20], 0
mov byte [rsp + rbx + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov byte [rsp + rbx + 0x20], 0x2d
mov rdi, rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41bb59
int3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x41bbf2
mov rcx, r12
add r14d, 0x10
call sym.malloc
mov r10d, 0x40
mov rbx, rax
bt rbx, r10
jae 0x41bb94
mov r11d, r15d
sub r11d, r10d
movsxd r11, r11d
mov byte [rsi + r11], 0x41
sub r10d, 1
jne 0x41bb80
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
je 0x41bbef
mov rdx, rsi
movzx ecx, ax
mov r9d, r14d
mov r8d, r15d
call sym.get_ptr_from_atom_1
cmp rax, rbx
mov rsi, rax
je 0x41bc09
mov rcx, rbx
call sym.free
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
lea rsp, [rbp - 0x58]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
int3
lea r9d, [r14 + 0x10]
mov rdx, rsi
movzx ecx, ax
mov r8d, r15d
call sym.get_ptr_from_atom_1
mov rsi, rax
jmp 0x41bbc9
xor edx, edx
mov r8, r12
mov rcx, rbx
call sym.memset
test r13, r13
je 0x41bbc9
mov rcx, rbx
call r13
jmp 0x41bbc9

Function at 0x41bc50
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_spin_locked_shmem]
lea rcx, str.spin_locked_shmem
mov edx, 0x10
jmp sym.__shmem_winpthreads_grab

Function at 0x41c780
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_rwl_global_shmem]
lea rcx, str.rwl_global_shmem
mov edx, 0x10
jmp sym.__shmem_winpthreads_grab

Function at 0x41c850
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_cond_locked_shmem_rwlock]
lea rcx, str.cond_locked_shmem_rwlock
mov edx, 0x10
jmp sym.__shmem_winpthreads_grab

Function at 0x41d5a0
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_init_init]
lea rcx, str.init
mov edx, 8
jmp dbg.__shmem_grab

Function at 0x41d5c0
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str.eh_globals
xor r8d, r8d
mov edx, 0x10
jmp dbg.__shmem_grab
Function at 0x41dc70
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_init___terminate_handler_sh]
lea rcx, str.__terminate_handler_sh
mov edx, 8
jmp dbg.__shmem_grab

Function at 0x41dc90
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_init___unexpected_handler_sh]
lea rcx, str.__unexpected_handler_sh
mov edx, 8
jmp dbg.__shmem_grab

Function at 0x41ed70
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov rsi, rdx
mov rbx, rcx
mov edx, 1
mov rcx, rsi
call sym.fread
test rax, rax
jle 0x41eda1
movzx edx, byte [rsi + rax - 1]
mov dword [rbx + 0x48], edx
add rsp, 0x28
pop rbx
pop rsi
ret
mov dword [rbx + 0x48], 0xffffffff
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x41f490
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp byte [0x0047dd30], 0
jne 0x41f558
mov byte [0x0047dd30], 1
call sym.__cxa_current_exception_type
test rax, rax
je 0x41f5eb
mov rax, qword [rax + 8]
xor esi, esi
lea r9, [rsp + 0x2c]
cmp byte [rax], 0x2a
mov dword [rsp + 0x2c], 0xffffffff
sete sil
xor r8d, r8d
xor edx, edx
add rsi, rax
mov rcx, rsi
call sym.__cxa_demangle
mov rbx, qword [sym.imp.msvcrt.dll___iob_func]
mov rdi, rax
call rbx
lea rcx, str.terminate_called_after_throwing_an_instance_of_
lea r9, [rax + 0x60]
mov r8d, 0x30
mov edx, 1
call sym.fwrite
cmp dword [rsp + 0x2c], 0
je 0x41f548
call rbx
lea rdx, [rax + 0x60]
mov rcx, rsi
call sym.fputs
call rbx
lea rcx, [0x0047f241]
lea r9, [rax + 0x60]
mov r8d, 2
mov edx, 1
call sym.fwrite
cmp dword [rsp + 0x2c], 0
je 0x41f57e
call sym.__cxa_rethrow
call rbx
lea rdx, [rax + 0x60]
mov rcx, rdi
call sym.fputs
jmp 0x41f51f
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.terminate_called_recursively_n
lea r9, [rax + 0x60]
mov r8d, 0x1d
mov edx, 1
call sym.fwrite
call sym.abort
mov rcx, rdi
call sym.free
jmp 0x41f543
call sym.abort
nop dword [rax + rax]
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.terminate_called_without_an_active_exception_n
lea r9, [rax + 0x60]
mov r8d, 0x2d
mov edx, 1
call sym.fwrite
jmp 0x41f5e6

Function at 0x449e80
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rbp, rcx
mov rdi, rdx
mov esi, r8d
mov rcx, rbp
call method.std::__basic_file_char_.fd__
mov r8d, esi
mov rdx, rdi
mov ecx, eax
call sym.read
movsxd rbx, eax
cmp rbx, 0xffffffffffffffff
je 0x449ed0
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x449e9a
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x1404746ff
Capabilities:
Encode data using xor

Disassembly:
rol rdx, 0x4f
neg cl
add dx, dx
sal rdx, 0xc5
jp 0x14046505c
cmp ebx, 4
jne 0x1404884e9
mov r9d, 0x437d426
lea r9, [r9 - 0xf5ffb49]
mov r9, rax
call fcn.140487c28
mov rsi, qword [r8]
mov r9d, 0x5c9679a3
mov r9, qword [r8 + r9 - 0x5c96799b]
call fcn.140485243
mov r10w, word [r10]
lea rsp, [rsp + 8]
jmp fcn.1404747aa
ror cl, 1
call fcn.14044cede
call fcn.1404619a4
jmp 0x1404874dd
ror r9w, 0x8b
lea r9, [0x14048afe0]
mov ebx, 0x4d9b931c
dec rbx
movzx ebx, byte [rdx + rbx - 0x4d9b931b]
push 0x5fabb123
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [r9 + rbx*4]
shr ecx, 8
xor ecx, ebx
inc rdx
rol qword [rsp], 4
xor ecx, 0xd8086923
dec rax
lea rsp, [rsp + 8]
jne 0x140467c6e
call fcn.14048853f
add rdi, 0xa
call fcn.14045bf39
test rax, rax
lea rsp, [rsp + 0x10]
je 0x140488549
mov r9d, 0x36223e80
push rbx
rol r9w, 0x29
jb 0x140467c62
mov r9, rsi
jmp 0x140467550
jg 0x140486c38
mov dword [r8], r11d
mov qword [rsp], 0xffffffff97038a32
lea rsp, [rsp + 0x10]
jmp fcn.14047dc22
mov ecx, 0xa99cca0d
movzx ebp, cx
mov rcx, qword [r11 + rbp*2 - 0x1941a]
inc rbp
sets bpl
mov rbp, qword [r11 + rbp*4 - 0x327f8]
jne 0x14047f294
mov edx, 0xe50b2c91
sub r11, 1
movsx ecx, dl
movzx ecx, byte [r11]
or rdx, rdx
xor cl, bpl
inc cl
jmp 0x14045118e
push 0xffffffffd088a839
add r11, 0x10
call fcn.14044b384
call fcn.1404569b7
mov r8w, word [rdi + 8]
jmp 0x14047148d
call fcn.1404541c9
jmp 0x1404822dd
mov eax, 0x8705e9b2
add rax, rax
setg al
mov rax, qword [rbp + rbx*8 + 0x20]
push rax
call fcn.14045a793
push 0x8a2b5bc
not ecx
call fcn.1404502db
Function at 0x140142e80
Capabilities:
Encode data using xor

Disassembly:
test r10, r10
not dword [rsp + 8]
lea rsp, [rsp + 0x10]
je 0x140178449
jmp 0x1401450a8

Function at 0x14014c56e
Capabilities:
Encode data using xor

Disassembly:
lea rbx, [0x140178d08]
lea rsp, [rsp + 8]
mov eax, 0xf325feb8
movzx eax, byte [r8]
push 0xffffffffae0bbe1f
xor eax, ebp
and eax, 0xff
sar byte [rsp + 6], 0x26
mov eax, dword [rbx + rax*4]
shr ebp, 8
xor ebp, eax
push 0xffffffff8430c99e
inc r8
xor ebp, 0xc28a71d
push 0xffffffffec8a1a3d
dec rcx
push 0x20276216
lea rsp, [rsp + 0x20]
jne 0x14014c57a
call fcn.140171110
call fcn.1401789d4
mov esi, 0xff197989
sub rbp, 8
mov rsi, qword [rbp + riz]
push 0x4f9bb203
xor rsi, r8
ror rsi, 1
jmp 0x14016cb4b
call fcn.140151ce7
Function at 0x14001125d
Capabilities:
Terminate process

Disassembly:
jmp 0x1400154b0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112f3
Capabilities:
Create thread
Terminate process
Terminate thread

Disassembly:
jmp 0x140013d90
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x30]
lea rcx, [0x1400260f7]
call fcn.14001142e
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov r9d, 0x34
lea r8, str.CursorDraw__NoSkid_
lea rdx, str.WARNING____r_nYoure_About_To_Run_A_Malware_Named_CursorDraw1.5__NoSkid__r_nIt_Doesnt_Delete_All_Your_Data
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x140013dea
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov r9d, 0x34
lea r8, [0x14001d560]
lea rdx, [0x14001d5f0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x140013e18
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011091]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
call fcn.140011497
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14001128f]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x28], rax
call fcn.1400112a8
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011181]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x48], rax
call fcn.1400111b3
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140013f14
xor eax, eax
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x1400112fd
Capabilities:
Parse pe header

Disassembly:
jmp 0x140016800
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140016820
xor al, al
jmp 0x1400168a1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140016833
xor al, al
jmp 0x1400168a1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001685d
xor al, al
jmp 0x1400168a1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140016871
xor al, al
jmp 0x1400168a1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140016883
xor al, al
jmp 0x1400168a1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001689f
xor al, al
jmp 0x1400168a1
mov al, 1
add rsp, 0x38
ret
Function at 0x140001070
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x130
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rbx, rdx
mov edi, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test rax, rax
je 0x1400010aa
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
movaps xmm0, xmmword [str.C:WindowsSystem32_notepad.exe]
movaps xmm1, xmmword [0x1400022a0]
movaps xmmword [rsp + 0xe0], xmm0
movaps xmm0, xmmword [0x1400022b0]
movaps xmmword [rsp + 0xf0], xmm1
movaps xmm1, xmmword [0x1400022c0]
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0x110], xmm1
cmp edi, 1
je 0x1400010ff
mov rdx, qword [rbx]
lea rcx, str.Usage:__s_n
call fcn.140001010
jmp 0x1400011ce
xorps xmm0, xmm0
mov dword [rsp + 0x70], 0x68
xor eax, eax
lea rdx, [rsp + 0xe0]
mov dword [rsp + 0xd4], eax
xor r9d, r9d
mov qword [rsp + 0x60], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
movups xmmword [rsp + 0x74], xmm0
movups xmmword [rsp + 0x84], xmm0
movups xmmword [rsp + 0x94], xmm0
movups xmmword [rsp + 0xa4], xmm0
movups xmmword [rsp + 0xb4], xmm0
movups xmmword [rsp + 0xc4], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp qword [sym.imp.KERNEL32.dll_CreateProcessW], 0
jne 0x1400011a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateProcess_failed___d_._n
call fcn.140001010
jmp 0x1400011ce
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140001210
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rdi
ret

Function at 0x140001ad0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001b1a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b1a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b1a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b1a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b1a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b1c
xor al, al
add rsp, 0x28
ret