joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140102580
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
cmp byte [rcx + 0xf1e], 0
movsxd r10, r9d
je 0x1401026a4
cmp r8d, 0xff
jne 0x1401025e1
lea eax, [r10 - 0xec]
cmp eax, 0x13
ja 0x1401025cb
lea r8, [0x140000000]
mov r9, qword [r8 + r10*8 + 0x142660]
mov r8, rdx
lea rdx, str._s_IAC__s_n
add rsp, 0x38
jmp fcn.1400debe0
mov r8, rdx
mov r9d, r10d
lea rdx, str._s_IAC__d_n
add rsp, 0x38
jmp fcn.1400debe0
cmp r8d, 0xfb
jne 0x1401025f3
lea r9, str.WILL
jmp 0x140102631
cmp r8d, 0xfc
jne 0x140102605
lea r9, str.WONT
jmp 0x140102631
cmp r8d, 0xfd
jne 0x140102617
lea r9, [0x140143084]
jmp 0x140102631
xor r9d, r9d
lea rax, str.DONT
cmp r8d, 0xfe
cmove r9, rax
test r9, r9
je 0x14010268d
cmp r10d, 0x27
jg 0x140102664
lea r8, [0x140000000]
mov r8, qword [r8 + r10*8 + 0x142c80]
test r8, r8
jne 0x140102674
mov r8, rdx
mov dword [rsp + 0x20], r10d
lea rdx, str._s__s__d_n
call fcn.1400debe0
add rsp, 0x38
ret
cmp r10d, 0xff
jne 0x14010264b
lea r8, str.EXOPL
mov qword [rsp + 0x20], r8
mov r8, rdx
lea rdx, str._s__s__s_n
call fcn.1400debe0
add rsp, 0x38
ret
mov r9d, r8d
mov dword [rsp + 0x20], r10d
mov r8, rdx
lea rdx, str._s__d__d_n
call fcn.1400debe0
add rsp, 0x38
ret

Function at 0x1401029f0
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, qword [rcx]
mov edi, r8d
mov esi, edx
mov byte [rax + 0x10], 0xff
xor r9d, r9d
mov byte [rax + 0x11], sil
mov rbx, rcx
mov byte [rax + 0x12], dil
mov rcx, qword [rcx + 0x4c0]
lea rdx, [rax + 0x10]
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x140102a4f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.1400dea60
mov rcx, qword [rbx]
lea rdx, str.SENT
mov r9d, edi
mov r8d, esi
call fcn.140102580
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140102c00
Capabilities:
Send data
Send data on socket

Disassembly:
cmp edx, 0x1f
jne 0x140102da8
push rbp
push rdi
push r14
sub rsp, 0x20
mov rbp, qword [rcx]
mov r14, rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], r15
mov rdi, qword [rbp + 0x1e0]
lea rsi, [rdi + 0x1cb8]
lea rbx, [rdi + 0x1eb8]
mov qword [rbx], rsi
cmp rsi, rbx
jae 0x140102c65
lea rax, [rsi + 1]
mov byte [rsi], 0xff
mov qword [rbx], rax
cmp rax, rbx
jae 0x140102c65
mov byte [rax], 0xfa
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x140102c65
mov byte [rax], dl
inc qword [rbx]
movzx ecx, word [rdi + 0x1ca8]
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rdi + 0x1caa]
movzx r15d, ax
mov word [rsp + 0x48], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r9, qword [rbx]
movzx ecx, ax
cmp r9, rbx
jae 0x140102c9c
mov byte [r9], r15b
inc qword [rbx]
mov r9, qword [rbx]
mov r15, qword [rsp + 0x58]
cmp r9, rbx
jae 0x140102cf2
movzx eax, byte [rsp + 0x49]
mov byte [r9], al
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x140102cf2
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x140102cf2
shr cx, 8
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x140102cf2
mov byte [r9], 0xff
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x140102cf2
mov byte [r9], 0xf0
mov r9, qword [rbx]
inc r9
mov qword [rdi + 0x1ec0], r9
lea r8, [rdi + 0x1cba]
sub r9, rsi
mov qword [rbx], rsi
sub r9, 2
mov edx, 0x3e
mov rcx, rbp
call fcn.1401026b0
mov rcx, qword [r14 + 0x4c0]
xor r9d, r9d
mov rdx, rsi
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
test eax, eax
jns 0x140102d54
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.1400dea60
lea rdx, [rdi + 0x1cbb]
mov r8d, 4
mov rcx, r14
call fcn.140102a80
mov rcx, qword [r14 + 0x4c0]
lea rdx, [rdi + 0x1cbf]
xor r9d, r9d
lea r8d, [r9 + 2]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x140102da0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.1400dea60
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x140104510
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x1401d0080]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa00]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x1401045a5
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x140104606
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.1400dea60
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1401181e0
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret
mov rdx, qword [rbx + 0x168]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x1401046c1
sub ecx, 1
je 0x140104734
sub ecx, 1
je 0x140104670
cmp ecx, 1
je 0x140104653
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x14014b6bc]
call fcn.1400dea60
jmp 0x140104734
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.140104240
test eax, eax
je 0x140104734
jmp 0x1401045da
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140104734
sub rax, rsi
cmp rax, rbp
jae 0x140104734
mov r8, rsi
lea rdx, str.TFTP_error:__s_n
mov rcx, rdi
call fcn.1400debe0
jmp 0x140104734
cmp r8d, 4
jle 0x140104734
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x140104734
lea eax, [r8 - 4]
mov rcx, r14
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.1400de980
mov esi, eax
test eax, eax
je 0x140104713
mov edx, 5
mov rcx, rbx
call fcn.140105200
mov eax, esi
jmp 0x1401045da
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.1400ed460
mov rcx, r14
call fcn.1400ed740
test eax, eax
je 0x1401045d8
mov edx, 5
mov rcx, rbx
call fcn.140105200
mov eax, Ordinal_46
jmp 0x1401045da
Function at 0x1401174d0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x140117512
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x140117559
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1401175b2
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x140117570
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1401175f3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x140146232]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x140146233]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1401175c0
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x1401186fc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140118746
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140118746
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140118746
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140118746
cmp dword [rcx + 0x84], 0xe
jbe 0x140118746
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140118748
xor al, al
add rsp, 0x28
ret
Function at 0x140001970
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rsi, rcx
xor ebp, ebp
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x1400019b3
xor edx, edx
mov qword [rsp + 0x60], rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsi + 8]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
mov qword [rsi + 8], rbp
mov rbx, qword [rsp + 0x60]
je 0x1400019e3
mov r9, qword [rsi]
lea rcx, [rsi + 8]
mov dword [rsp + 0x40], ebp
xor r8d, r8d
mov qword [rsp + 0x38], rbp
mov edx, 0x1fffff
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ntdll.dll_NtCreateProcessEx]
test eax, eax
jns 0x1400019f5
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov rax, qword [rsi + 8]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x1400026fc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002746
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002746
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002746
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002746
cmp dword [rcx + 0x84], 0xe
jbe 0x140002746
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002748
xor al, al
add rsp, 0x28
ret

Function at 0x1400092c0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400090ec

Function at 0x140015610
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140015638
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140015638
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14011c04f
Capabilities:
Set thread local storage value

Disassembly:
push rax
pushf
mov eax, 0x15ad50fe
pushf
not eax
add eax, 0xfd44963c
xor eax, 0xb3521783
rol eax, 0xb7
popf
pushf
not eax
add eax, 0xeb692734
xor eax, 0xb79617c4
rol eax, 0x1c
popf
pushf
not eax
add eax, 0xbd93e827
xor eax, 0xd9d95af2
rol eax, 0x75
popf
cmp eax, 2
jne 0x14011c09f
popf
pop rax
jmp 0x14011c235
cmp eax, 0
jne 0x14011c0ae
popf
pop rax
jmp 0x14011c0cc
cmp eax, 3
jne 0x14011c0bd
popf
pop rax
jmp 0x14011c294
cmp eax, 1
jne 0x14011c0cc
popf
pop rax
jmp 0x14011c22c
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x1978ec25f]
pushf
sub r9, 0x578c9cef
popf
mov edi, ecx
lea rdx, [0x19340b7a9]
pushf
sub rdx, 0x533e9239
popf
mov ecx, 0xe51e608e
pushf
not ecx
add ecx, 0xf404fbcb
xor ecx, 0x8811f166
rol ecx, 0x94
popf
pushf
not ecx
add ecx, 0xafa61c96
xor ecx, 0x9cb9ade5
rol ecx, 0xec
popf
pushf
not ecx
add ecx, 0xd8396613
xor ecx, 0xd1408c38
rol ecx, 0xee
popf
pushf
not ecx
add ecx, 0xfdc6146b
xor ecx, 0xb1a88210
rol ecx, 0xee
popf
lea r8, [0x1a87e8089]
pushf
sub r8, 0x687c5b21
popf
call fcn.14000cd8c
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x14011c1d2
push rax
pushf
mov eax, 0x4c950ebc
pushf
not eax
add eax, 0xb9fbba25
xor eax, 0xada7abe3
rol eax, 0x51
popf
pushf
not eax
add eax, 0xba7bc32e
xor eax, 0xd6d1d05b
rol eax, 0xde
popf
pushf
not eax
add eax, 0x97a65876
xor eax, 0xae561e1a
rol eax, 0xa5
popf
pushf
not eax
add eax, 0xa5e0eae6
xor eax, 0xe8032e7b
rol eax, 0x9c
popf
jmp 0x14011c090
push rax
pushf
mov eax, 0xffac0c05
pushf
not eax
add eax, 0xf5f8eed1
xor eax, 0xc2a73bc2
rol eax, 0xf4
popf
pushf
not eax
add eax, 0xcd01d9c0
xor eax, 0x90cf497f
rol eax, 0x69
popf
pushf
not eax
add eax, 0xf05e6b0c
xor eax, 0xf5ecb03e
rol eax, 0x99
popf
pushf
not eax
add eax, 0xa63134df
xor eax, 0x8d3ec91f
rol eax, 0xeb
popf
jmp 0x14011c090
call qword [0x140021320]
jmp 0x14011c294
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
push rax
pushf
mov eax, 0xfd0665e6
pushf
not eax
add eax, 0xa9e72b0a
xor eax, 0xd0b050e5
rol eax, 0x1b
popf
pushf
not eax
add eax, 0x9583121a
xor eax, 0xc236b0ee
rol eax, 0x6f
popf
pushf
not eax
add eax, 0xa73c0696
xor eax, 0xe72d0c4e
rol eax, 0xf0
popf
pushf
not eax
add eax, 0xec539d99
xor eax, 0xb3cf2e47
rol eax, 0xa0
popf
jmp 0x14011c090
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140135f71
Capabilities:
Execute syscall

Disassembly:
push rax
pushf
mov eax, 0xdff9e02f
pushf
not eax
add eax, 0x9dbeae58
xor eax, 0xa23ae1a1
rol eax, 0x4f
popf
pushf
not eax
add eax, 0xcc86336c
xor eax, 0xb58c0f85
rol eax, 0x92
popf
pushf
not eax
add eax, 0xf9bcab69
xor eax, 0xa1266956
rol eax, 0x1c
popf
pushf
not eax
add eax, 0xf4280ce9
xor eax, 0xa5b41ff2
rol eax, 0x99
popf
cmp eax, 0
jne 0x140135fd4
popf
pop rax
jmp 0x140135fd4
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xc100b551
pushf
not ecx
add ecx, 0xe8be7769
xor ecx, 0xbe7397b4
rol ecx, 0xb9
popf
pushf
not ecx
add ecx, 0x94f305fe
xor ecx, 0x9c2256ff
rol ecx, 0x24
popf
pushf
not ecx
add ecx, 0x89852d56
xor ecx, 0x9108614a
rol ecx, 0x1e
popf
call fcn.1401206fe
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140137acb
Capabilities:
Get thread local storage value

Disassembly:
push rax
pushf
mov eax, 0x6b32d725
pushf
not eax
add eax, 0xae375c1a
xor eax, 0xc236f06a
rol eax, 0x2a
popf
pushf
not eax
add eax, 0x96494d50
xor eax, 0xcc76d34b
rol eax, 0xfc
popf
cmp eax, 2
jne 0x140137b08
popf
pop rax
jmp 0x140137c3b
cmp eax, 0
jne 0x140137b17
popf
pop rax
jmp 0x140137b26
cmp eax, 1
jne 0x140137b26
popf
pop rax
jmp 0x140137c2f
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x1893d1796]
pushf
sub r9, 0x493af23e
popf
mov ecx, 0x2f15b308
pushf
not ecx
add ecx, 0xfd4119fe
xor ecx, 0xf2d00890
rol ecx, 0x8d
popf
pushf
not ecx
add ecx, 0xf2c2191f
xor ecx, 0xc6a40dee
rol ecx, 0xe
popf
pushf
not ecx
add ecx, 0xb37a5022
xor ecx, 0xeb8a9978
rol ecx, 0x51
popf
pushf
not ecx
add ecx, 0xc613f314
xor ecx, 0xf0287355
rol ecx, 0x86
popf
lea r8, [0x196c7b069]
pushf
sub r8, 0x56c58b19
popf
lea rdx, [0x189ce691a]
pushf
sub rdx, 0x49cc43c2
popf
call fcn.14000cd8c
mov ecx, ebx
test rax, rax
je 0x140137bfc
push rax
pushf
mov eax, 0xe2a71e03
pushf
not eax
add eax, 0xbcd95c0f
xor eax, 0xcc307e77
rol eax, 7
popf
pushf
not eax
add eax, 0x9a9e00c1
xor eax, 0x997dc2b1
rol eax, 0x3e
popf
jmp 0x140137af9
push rax
pushf
mov eax, 0x755e6b1c
pushf
not eax
add eax, 0xce38e5ae
xor eax, 0x81984597
rol eax, 0xe7
popf
pushf
not eax
add eax, 0x978159dd
xor eax, 0xf6619670
rol eax, 0x13
popf
jmp 0x140137af9
add rsp, 0x20
pop rbx
jmp qword [0x140021320]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x14013d889
Capabilities:
Allocate thread local storage

Disassembly:
push rax
pushf
mov eax, 0x7c902f0a
pushf
not eax
add eax, 0xd810320a
xor eax, 0xfce5acbd
rol eax, 0xd8
popf
pushf
not eax
add eax, 0xdf5075d0
xor eax, 0x9ca91021
rol eax, 0xb5
popf
cmp eax, 2
jne 0x14013d8c6
popf
pop rax
jmp 0x14013d9dd
cmp eax, 0
jne 0x14013d8d5
popf
pop rax
jmp 0x14013d8e4
cmp eax, 1
jne 0x14013d8e4
popf
pop rax
jmp 0x14013d9ce
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x1b2af62c5]
pushf
sub r9, 0x72ad3d95
popf
xor ecx, ecx
lea r8, [0x1aca4828d]
pushf
sub r8, 0x6ca25d65
popf
lea rdx, [0x1a4d5d1fd]
pushf
sub rdx, 0x64d3accd
popf
call fcn.14000cd8c
test rax, rax
je 0x14013d988
push rax
pushf
mov eax, 0x755281ba
pushf
not eax
add eax, 0x8ac14e87
xor eax, 0xac6daca1
rol eax, 5
popf
pushf
not eax
add eax, 0xe567aa4b
xor eax, 0xaa214a0e
rol eax, 0xdd
popf
pushf
not eax
add eax, 0x9e242d7d
xor eax, 0x892c361c
rol eax, 0xf1
popf
pushf
not eax
add eax, 0xc44f22a1
xor eax, 0xfae4afd7
rol eax, 0xf1
popf
jmp 0x14013d8b7
push rax
pushf
mov eax, 0xd96ce621
pushf
not eax
add eax, 0xdd2c953d
xor eax, 0xb71b7f55
rol eax, 0x5b
popf
pushf
not eax
add eax, 0xe2d9e41a
xor eax, 0xec38111d
rol eax, 0xfa
popf
pushf
not eax
add eax, 0xdac9306e
xor eax, 0xb0c4fdbf
rol eax, 0xdf
popf
jmp 0x14013d8b7
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [0x140021320]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]
Function at 0x14014efd0
Capabilities:
Terminate process

Disassembly:
push rax
pushf
mov eax, 0x40948bbc
pushf
not eax
add eax, 0xc5f80b37
xor eax, 0xa8d91283
rol eax, 0xf4
popf
pushf
not eax
add eax, 0x84a270ad
xor eax, 0xa50f9506
rol eax, 4
popf
cmp eax, 2
jne 0x14014f00d
popf
pop rax
jmp 0x14014f0b5
cmp eax, 0
jne 0x14014f01c
popf
pop rax
jmp 0x14014f02b
cmp eax, 1
jne 0x14014f02b
popf
pop rax
jmp 0x14014f0a3
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.140174c4e
test al, al
je 0x14014f06f
push rax
pushf
mov eax, 0x992698fb
pushf
not eax
add eax, 0xd3a2d8cd
xor eax, 0xad168cd7
rol eax, 0xf9
popf
pushf
not eax
add eax, 0xda4772d3
xor eax, 0xcd18996c
rol eax, 0xb6
popf
jmp 0x14014effe
push rax
pushf
mov eax, 0xa2c439d
pushf
not eax
add eax, 0xacf10b21
xor eax, 0x96c35183
rol eax, 0xad
popf
pushf
not eax
add eax, 0x87026080
xor eax, 0x944219ff
rol eax, 0xd3
popf
jmp 0x14014effe
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
jmp 0x14014f0af
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
call fcn.14014a9d4
mov ecx, ebx
jmp 0x14014f0bf
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140153c44
Capabilities:
Execute syscall

Disassembly:
push rax
pushf
mov eax, 0x9e656024
pushf
not eax
add eax, 0xcbb67e38
xor eax, 0xee237c6f
rol eax, 0xa1
popf
pushf
not eax
add eax, 0x85948ce3
xor eax, 0xb18a20b9
rol eax, 0x66
popf
pushf
not eax
add eax, 0x833f3108
xor eax, 0xb9c55cf4
rol eax, 0x7a
popf
cmp eax, 0
jne 0x140153c94
popf
pop rax
jmp 0x140153c94
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x82cba6dc
pushf
not ecx
add ecx, 0xeed2de4d
xor ecx, 0xc877c425
rol ecx, 0xc9
popf
pushf
not ecx
add ecx, 0xe2648a17
xor ecx, 0xadb1d23a
rol ecx, 0xcd
popf
pushf
not ecx
add ecx, 0x9f42e3a0
xor ecx, 0xde35a3fc
rol ecx, 0xc8
popf
pushf
not ecx
add ecx, 0xb92af078
xor ecx, 0x9db2d5b1
rol ecx, 0xb3
popf
call fcn.1401206fe
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret
Function at 0x1401583e4
Capabilities:
Execute syscall

Disassembly:
push rax
pushf
mov eax, 0xe359d057
pushf
not eax
add eax, 0xb9572c7f
xor eax, 0xd4dac0b4
rol eax, 0x2a
popf
pushf
not eax
add eax, 0xe819d602
xor eax, 0xea85c589
rol eax, 0x19
popf
pushf
not eax
add eax, 0xe3e2d4c1
xor eax, 0xa1f314cc
rol eax, 0x1f
popf
pushf
not eax
add eax, 0xf9e13853
xor eax, 0xcc2975e0
rol eax, 0x7d
popf
cmp eax, 0
jne 0x140158447
popf
pop rax
jmp 0x140158447
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x412201eb
pushf
not ecx
add ecx, 0x9c7e40e6
xor ecx, 0x8b65e136
rol ecx, 0x40
popf
pushf
not ecx
add ecx, 0xedf25937
xor ecx, 0xe986ae0a
rol ecx, 0x9f
popf
call fcn.1401206fe
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret
Function at 0x140167b73
Capabilities:
Execute syscall

Disassembly:
push rax
pushf
mov eax, 0xefc8df8e
pushf
not eax
add eax, 0x823b4288
xor eax, 0xb9aa624f
rol eax, 0x66
popf
pushf
not eax
add eax, 0xf7d3ecce
xor eax, 0xfe84af3a
rol eax, 0x19
popf
pushf
not eax
add eax, 0xcf2051b2
xor eax, 0xdb21a391
rol eax, 0x71
popf
cmp eax, 0
jne 0x140167bc3
popf
pop rax
jmp 0x140167bc3
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x93170772
pushf
not ecx
add ecx, 0xccc6d3f0
xor ecx, 0xf2753f65
rol ecx, 0xfe
popf
pushf
not ecx
add ecx, 0xd35183f1
xor ecx, 0xeffc9981
rol ecx, 0xb9
popf
pushf
not ecx
add ecx, 0xc9cfc200
xor ecx, 0xdf68acde
rol ecx, 0xba
popf
pushf
not ecx
add ecx, 0xa5584278
xor ecx, 0x8d522ec5
rol ecx, 0xd2
popf
call fcn.1401206fe
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret
Function at 0x1401734b6
Capabilities:
Execute syscall

Disassembly:
push rax
pushf
mov eax, 0x2032a6a1
pushf
not eax
add eax, 0xf57d652a
xor eax, 0xbad0ddea
rol eax, 0x87
popf
pushf
not eax
add eax, 0x8026e571
xor eax, 0xb2f53439
rol eax, 0x5a
popf
cmp eax, 0
jne 0x1401734f3
popf
pop rax
jmp 0x1401734f3
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xffb12e48
pushf
not ecx
add ecx, 0x9ea90a09
xor ecx, 0xba0c81e2
rol ecx, 0xa8
popf
pushf
not ecx
add ecx, 0xab30504b
xor ecx, 0xf5cb4e81
rol ecx, 0x73
popf
pushf
not ecx
add ecx, 0xd30c8a41
xor ecx, 0x86fa1317
rol ecx, 0xa9
popf
pushf
not ecx
add ecx, 0xdd24ebc3
xor ecx, 0x92e9ff15
rol ecx, 0x88
popf
call fcn.1401206fe
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret
Function at 0x140680c00
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword gs:[0x60]
movabs r11, 0x680c70
movabs r10, 0x680c74
mov r9, qword [rax + 0x10]
xor eax, eax
movsxd rcx, dword [r9 + 0x3c]
movsxd r11, dword [r9 + r11]
add rcx, r9
mov r10d, dword [r9 + r10]
movzx r8d, word [rcx + 0x14]
add r8, rcx
cmp dword [r8 + 0x20], eax
jbe 0x140680c66
mov edx, eax
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r8 + 0x24]
inc eax
add rcx, rdx
inc rdx
xor byte [rcx + r9], r10b
cmp eax, dword [r8 + 0x20]
jb 0x140680c50
lea rax, [r9 + r11]
jmp rax