joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002a4dc
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1400163d0
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14002a566
cmp byte [rbp - 0x21], r15b
je 0x14002a561
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14002a59c
call fcn.14001eb14
test eax, eax
jne 0x14002a588
cmp byte [rbp - 0x21], r15b
je 0x14002a580
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14002a59c
cmp byte [rbp - 0x21], r15b
je 0x14002a599
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1400169c4
test eax, eax
jne 0x14002a63c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400163d0
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14002a5db
cmp byte [rbp - 0x21], r15b
je 0x14002a610
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14002a610
call fcn.14001eb14
test eax, eax
jne 0x14002a5fc
cmp byte [rbp - 0x21], r15b
je 0x14002a5f5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14002a610
cmp byte [rbp - 0x21], r15b
je 0x14002a60d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1400169c4
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14002a63c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14002a63f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14002a64d
mov rcx, rdi
call fcn.14001a664
cmp byte [rbp + 0x3f], r15b
je 0x14002a65c
mov rcx, qword [rbp + 0x27]
call fcn.14001a664
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14002c2f0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002c318
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002c318
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1401b7b90
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1401b7b9d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1401b7bad
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1401b7b95
lea eax, [rcx + 1]
jmp 0x1401b7bbb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1401b7bce
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1401b7bb4
sub eax, 3
jb 0x1401b7bee
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1401b7c3d
sar eax, 1
movsxd rbp, eax
jb 0x1401b7c24
jmp 0x1401b7bfc
add ebx, ebx
jne 0x1401b7bfa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1401b7c24
inc ecx
add ebx, ebx
jne 0x1401b7c0a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1401b7c24
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1401b7c1d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1401b7c0c
add ecx, 2
jmp 0x1401b7c29
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1401b7b52
jmp 0x1401b7b9d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x55a00
mov dl, 0x13
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1401b7c89
cmp rsi, rcx
jae 0x1401b7c91
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1401b7c70
cmp al, 0x8f
ja 0x1401b7c70
cmp byte [rsi - 2], 0xf
je 0x1401b7c76
sub al, 0xe8
cmp al, 1
ja 0x1401b7c5a
cmp rsi, rcx
jae 0x1401b7c91
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1401b7c60
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1401b7c91
lodsb al, byte [rsi]
jmp 0x1401b7c70
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x1b3000]
mov eax, dword [rdi]
or eax, eax
je 0x1401b7cfa
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1b71e4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1401b7c9e
jns 0x1401b7cd3
movzx rdx, word [rdi]
add rdi, 2
jmp 0x1401b7cdd
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1401b7cf4
mov qword [rbx], rax
add rbx, 8
jmp 0x1401b7cbe
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1401b7d3e
cmp al, 0xef
ja 0x1401b7d26
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1401b7d06
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x1401b7d15
mov eax, dword [rdi]
add rdi, 4
jmp 0x1401b7d15
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x237]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1401b7d92
sub rsp, 0xffffffffffffff80
jmp 0x140055878
Function at 0x18113f058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.18113f1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x18113f089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18113f06f
add dl, dl
jne 0x18113f096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18113f0f6
xor eax, eax
add dl, dl
jne 0x18113f0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18113f1ad
add dl, dl
jne 0x18113f0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18113f0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18113f0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18113f0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x18113f0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18113f07e
mov eax, 1
add dl, dl
jne 0x18113f106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18113f113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18113f0fb
sub eax, ebx
mov ebx, 1
jne 0x18113f14c
mov ecx, 1
add dl, dl
jne 0x18113f12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18113f13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18113f123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18113f07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x18113f168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18113f175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18113f15d
cmp eax, 0x7d00
jae 0x18113f19b
cmp eax, 0x500
jb 0x18113f196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18113f07e
cmp eax, 0x7f
ja 0x18113f19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18113f07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x18113f1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18113f07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1805e2058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1805e21df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1805e2089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1805e206f
add dl, dl
jne 0x1805e2096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1805e20f6
xor eax, eax
add dl, dl
jne 0x1805e20a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1805e21ad
add dl, dl
jne 0x1805e20b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1805e20c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1805e20d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1805e20dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1805e20ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1805e207e
mov eax, 1
add dl, dl
jne 0x1805e2106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1805e2113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1805e20fb
sub eax, ebx
mov ebx, 1
jne 0x1805e214c
mov ecx, 1
add dl, dl
jne 0x1805e212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1805e213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1805e2123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1805e207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1805e2168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1805e2175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1805e215d
cmp eax, 0x7d00
jae 0x1805e219b
cmp eax, 0x500
jb 0x1805e2196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1805e207e
cmp eax, 0x7f
ja 0x1805e219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1805e207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1805e21d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1805e207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400039e0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003a2a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003a2a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003a2a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003a2a
cmp dword [rcx + 0x84], 0xe
jbe 0x140003a2a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003a2c
xor al, al
add rsp, 0x28
ret
Function at 0x1800153d0
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [r11 - 0x40], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x180058090]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rdi, rcx
mov qword [r11 - 0x38], rcx
or esi, 0xffffffff
mov qword [r11 - 0x58], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
lea edx, [rsi + 5]
lea r8d, [rsi + 3]
lea rcx, str.C:WindowsTempiislog.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800154b3
lea r9d, [rsi + 3]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x1800154a9
lea r8, [0x18004d1e4]
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.18000d360
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor esi, esi
lea rcx, [rsp + 0x58]
call fcn.180001c80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, rdi
call fcn.180001c80
mov eax, esi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.18001add0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x180015f20
Capabilities:
Timestomp file

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180058090]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x48], 0x407e6
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x4e], 0x90007
mov dword [rsp + 0x52], 0x170025
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
cmp qword [0x18005ab40], 8
lea rcx, [0x18005ab28]
mov qword [rsp + 0x30], 0
mov edx, 0x100
cmovae rcx, qword [0x18005ab28]
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180015fd4
lea r9, [rsp + 0x40]
mov rcx, rax
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18001add0
add rsp, 0x60
pop rbx
ret
Function at 0x1800178f0
Capabilities:
Read .ini file

Disassembly:
push rbp
push rsi
push rdi
mov eax, 0x2070
call fcn.18001bcc0
sub rsp, rax
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x20a8], rbx
mov rax, qword [0x180058090]
xor rax, rsp
mov qword [rsp + 0x2060], rax
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
xor edx, edx
mov r8d, 0x2000
lea rcx, [rsp + 0x60]
call fcn.18001e3f0
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.180015700
lea rcx, [0x18005ab28]
cmp qword [0x18005ab40], 8
cmovae rcx, qword [0x18005ab28]
cmp qword [rax + 0x18], 8
jb 0x180017973
mov rax, qword [rax]
cmp qword [rsi + 0x18], 8
jb 0x18001797d
mov rsi, qword [rsi]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x1000
lea r9, [rsp + 0x60]
lea r8, [0x18004d39c]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ebx, eax
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x1800179c1
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.18000a9c0
test ebx, ebx
je 0x180017a28
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], bp
lea rax, [rsp + 0x60]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], bp
jne 0x1800179e1
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.180009fd0
nop
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.180015780
nop
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x180017a49
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.18000a9c0
jmp 0x180017a49
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov word [rdi], bp
xor r8d, r8d
lea rdx, [0x18004d404]
mov rcx, rdi
call fcn.180009fd0
mov rax, rdi
mov rcx, qword [rsp + 0x2060]
xor rcx, rsp
call fcn.18001add0
mov rbx, qword [rsp + 0x20a8]
add rsp, 0x2070
pop rdi
pop rsi
pop rbp
ret
Function at 0x18001eac8
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, [0x180042038]
xor ecx, ecx
lea r8, [0x180042030]
lea rdx, str.FlsAlloc
call fcn.18001e8f0
mov rbx, rax
test rax, rax
je 0x18001eb08
mov rcx, rax
call fcn.18001bbac
mov rcx, rdi
call rbx
jmp 0x18001eb0e
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18001eb70
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x180042048]
mov ecx, 2
lea r8, [0x180042040]
lea rdx, str.FlsGetValue
call fcn.18001e8f0
mov rdi, rax
test rax, rax
je 0x18001ebb1
mov rcx, rax
call fcn.18001bbac
mov ecx, ebx
call rdi
jmp 0x18001ebb9
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18001ebc4
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x180042050]
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 3
lea r8, [0x180042048]
call fcn.18001e8f0
mov rsi, rax
test rax, rax
je 0x18001ec10
mov rcx, rax
call fcn.18001bbac
mov rdx, rbx
mov ecx, edi
call rsi
jmp 0x18001ec1b
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400010b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp dword [rsp + 0x60], 2
jne 0x140001245
mov eax, 8
imul rax, rax, 1
lea r8, [0x140003270]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rcx + rax]
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x14000122f
cmp qword [rsp + 0x40], 0
je 0x14000122f
mov rcx, qword [rsp + 0x40]
call fcn.140001000
mov dword [rsp + 0x24], eax
mov edx, dword [rsp + 0x24]
lea rcx, str._Info__Reading_Shellcode_length:__d_n
call fcn.140001270
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x24]
inc eax
cdqe
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14000121a
mov eax, dword [rsp + 0x24]
inc eax
cdqe
mov r9, qword [rsp + 0x40]
mov r8d, 1
mov rdx, rax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov dword [rsp + 0x20], 0
jmp 0x1400011ad
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x24]
inc eax
cmp dword [rsp + 0x20], eax
jge 0x1400011db
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movsx eax, byte [rcx + rax]
xor eax, 0xfa
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov byte [rdx + rcx], al
jmp 0x1400011a3
lea rcx, str._INFO__Running_Shellcode_XORed_..
call fcn.140001270
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
call qword [rsp + 0x38]
lea rcx, str._INFO__Shell_Loading_Done.
call fcn.140001270
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x140001256
lea rcx, str._ERROR__Could_not_allocate_memory_for_buffer.
call fcn.140001270
mov eax, 1
jmp 0x140001256
lea rcx, str._ERROR__Cant_load_the_shellcode.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov eax, 1
jmp 0x140001256
lea rcx, str.loadFromBinaryWithC.exe__mane.bin_
call fcn.140001270
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140001370
add rsp, 0x58
ret

Function at 0x140001c30
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001c7a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001c7a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001c7a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001c7a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001c7a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001c7c
xor al, al
add rsp, 0x28
ret
Function at 0x4019d8
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x1c
mov ecx, 0x11385def
call fcn.004018ef
add rsp, 0x1c
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x401c98
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x1c
mov ecx, 0x42cdb7dd
call fcn.004018ef
add rsp, 0x1c
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x401d18
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x1c
mov ecx, 0xf798ed1a
call fcn.004018ef
add rsp, 0x1c
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x401d58
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x1c
mov ecx, 0xf768efe9
call fcn.004018ef
add rsp, 0x1c
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x401d98
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x1c
mov ecx, 0x3910913
call fcn.004018ef
add rsp, 0x1c
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1000017b8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x100001805
cmp rcx, 0xffffffffffffffff
je 0x100001805
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1000017fd
cmp dword [rcx + 0x3c], edx
jl 0x1000017fd
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1000017fd
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x100001805
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140670058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1406701df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140670089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14067006f
add dl, dl
jne 0x140670096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406700f6
xor eax, eax
add dl, dl
jne 0x1406700a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406701ad
add dl, dl
jne 0x1406700b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406700c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406700d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406700dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406700ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14067007e
mov eax, 1
add dl, dl
jne 0x140670106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140670113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406700fb
sub eax, ebx
mov ebx, 1
jne 0x14067014c
mov ecx, 1
add dl, dl
jne 0x14067012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14067013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140670123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14067007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140670168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140670175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14067015d
cmp eax, 0x7d00
jae 0x14067019b
cmp eax, 0x500
jb 0x140670196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14067007e
cmp eax, 0x7f
ja 0x14067019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14067007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406701d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14067007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20