joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c694
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x14000c671
call fcn.14000b364
mov dword [rax], 0x16
call fcn.14000b244
or eax, 0xffffffff
jmp 0x14000c68e
sub dword [rcx + 0x10], 1
jns 0x14000c680
add rsp, 0x28
jmp 0x14000f270
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x14000c650
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x14000f110
call fcn.14000b364
mov dword [rax], 0x16
call fcn.14000b244
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14000f0f8
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x14000f0f8
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x14000f142
lock or dword [rax + 0x14], 0x10
jmp 0x14000f0f8
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x14000f15f
mov rcx, qword [rbp + 0x10]
call fcn.14000f278
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14000c494
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.140010b0c
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x14000f1b6
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x14000f0f8
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x14000f222
mov rcx, qword [rbp + 0x10]
call fcn.14000c494
cmp eax, 0xffffffff
je 0x14000f209
mov rcx, qword [rbp + 0x10]
call fcn.14000c494
cmp eax, 0xfffffffe
je 0x14000f209
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14000c494
movsxd rdi, eax
lea rsi, [0x140beeca0]
mov rcx, rbx
sar rdi, 6
call fcn.14000c494
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x14000f210
lea rax, [0x140bee0b0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14000f222
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x14000f258
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x14000f254
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x14000f254
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x14000f0fb
jmp 0x14000f0c8
Function at 0x1400124a0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x40
mov edi, edx
lea esi, [r9 - 0x1d1c]
mov rbx, rcx
lea eax, [r8 + 0x1ab]
mov ecx, dword [rsp + 0x78]
lea r14d, [r8 - 0x7b4]
add edx, 0xffffe0cc
add ecx, 0xfffffe55
lea r9d, [rdi - 0xb1b]
xor edi, 0x3d2
cmp ecx, eax
jge 0x140012632
lea eax, [rsi + 0x1ce6]
cmp ecx, eax
mov rax, qword [section..data]
jg 0x140012583
mov ecx, dword [rax + 0x68]
xor ecx, dword [rbx + 0x88]
mov r8d, dword [rbx + 0x150]
xor ecx, 0x146043
sub dword [rbx + 0x18], ecx
xor ecx, ecx
mov rax, qword [section..data]
lea r9d, [rcx + 0x40]
mov eax, dword [rax + 4]
xor eax, 0x953d41
add eax, dword [rbx + 0x18]
mov dword [rbx + 0x18], eax
xor r8d, dword [0x1404cd104]
sub r8d, 0x1c13f0
mov edx, eax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, qword [section..data]
add rax, 0x6000
mov qword [0x1404cd0f0], rax
mov eax, dword [0x1404cd0dc]
cmp dword [rcx + 0x30], eax
jb 0x140012632
mov eax, dword [rbx + 0x5c]
xor eax, dword [0x1404cd164]
mov dword [rbx + 0x74], eax
jmp 0x140012632
mov r8d, 0x1419
or ecx, r8d
sub ecx, edi
cmp dword [rax + 0x30], ecx
jbe 0x140012632
mov eax, dword [rbx + 0x24]
sub eax, dword [0x1404cd06c]
or eax, 0x1f34
cmp dword [rbx + 0x154], eax
ja 0x140012632
mov eax, r14d
or eax, esi
mov dword [rbx + 0x5c], eax
mov eax, edi
mov rcx, qword [section..data]
and eax, 0xd8e
xor eax, dword [rcx + 0x30]
sub dword [rcx + 0x110], eax
lea ecx, [r14 + rsi]
mov rax, qword [section..data]
mov r11d, dword [rbx + 0x120]
mov r10d, dword [rbx + 0x1c]
sub r11d, r8d
xor r10d, r9d
mov dword [rsp + 0x30], r11d
mov r9d, dword [rax + 0x100]
sub r9d, dword [rbx + 0x3c]
add r9d, dword [rbx + 0x11c]
mov r8d, dword [rax + 0x118]
imul r8d, edx
mov edx, dword [rbx + 0xc8]
xor edx, dword [rbx + 0xb4]
mov dword [rsp + 0x28], r10d
and edx, 0x12ab
mov dword [rsp + 0x20], r9d
mov r9, rbx
call fcn.140012cc4
mov rbx, qword [rsp + 0x50]
lea eax, [rdi - 0xbf8]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop r14
ret
Function at 0x140012e3c
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
lea r15d, [rdx - 0x1419]
mov rsi, rcx
lea ecx, [rdx + 0x400]
mov r14d, r15d
mov edx, dword [rsp + 0x98]
lea r13d, [r8 - 0x36]
mov r12d, edx
mov dword [rsp + 0x78], ecx
xor r12d, 0x58c
lea eax, [r15 + 0x196a]
lea ebp, [rdx - 0x196a]
cmp r13d, eax
je 0x140012eaf
mov eax, dword [rsi + 0x54]
sub eax, dword [rsi + 0xc8]
add eax, 0x41c1d942
mov dword [0x1404cd03c], eax
jmp 0x140012f37
mov eax, dword [rsi + 0x30]
and eax, dword [0x1404cd058]
xor eax, r15d
cmp r13d, eax
jne 0x140012f37
mov r10d, dword [rsi + 0xac]
lea eax, [rcx + rcx]
mov r9d, dword [rsi + 0x98]
mov r8d, ebp
movsxd rdi, eax
or r8d, r15d
mov rax, qword [section..data]
or r9d, 0x10c0
mov qword [rsp + 0x38], rdi
add r8d, r15d
imul r10d, r12d
mov ebx, dword [rax + 0x154]
mov edx, dword [rax + 0xac]
mov r11d, dword [rax + 0x24]
and ebx, dword [rsi + 0x24]
sub r11d, ecx
and edx, dword [rax + 0x38]
lea eax, [r12 - 0x271e]
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], r11d
movsxd rcx, eax
mov dword [rsp + 0x20], r10d
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov ecx, dword [rsp + 0x78]
mov edx, dword [rsp + 0x98]
lea eax, [rcx - 0x1a7]
cmp r13d, eax
jl 0x140012fe7
lea eax, [r15 + 0x10c0]
cmp ebp, eax
je 0x140012fc9
lea eax, [r15 + 0x1d1c]
mov ecx, r15d
mov dword [rsp + 0x30], eax
lea r9d, [r15 + 0xd8e]
mov dword [rsp + 0x28], edx
lea r8d, [r15 + 0x17a8]
mov rdx, qword [section..data]
xor ecx, 0x17a8
mov dword [rsp + 0x20], eax
call fcn.1400133b8
add r15d, 0x14f1
lea ecx, [r12 - 0x53e]
mov r8d, r15d
mov edx, r15d
xor r8d, 0x41f
xor edx, 0xce8
mov dword [rsp + 0x20], r8d
mov r13d, eax
lea r8, [0x1404cd010]
lea r9d, [r15 - 0x431]
call fcn.140015078
mov r14d, eax
jmp 0x140012fe3
mov ecx, dword [rsi + 0x138]
mov rdx, qword [section..data]
imul ecx, dword [rsi + 0x30]
mov eax, dword [rdx + 0x3c]
imul eax, ecx
mov dword [rdx + 0x3c], eax
mov ecx, dword [rsp + 0x78]
xor r14d, 0x1d45
cmp r15d, r14d
jle 0x14001302e
lea eax, [rcx - 0x7c3]
cmp ebp, eax
jg 0x14001302e
mov r8, qword [section..data]
lea eax, [r12 - 0x674]
mov r9d, r13d
mov dword [rsp + 0x20], eax
xor ebp, 0x10c0
lea edx, [r13 - 0x6d4]
xor r9d, 0xcb3
mov ecx, ebp
call fcn.1400152a0
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
lea eax, [r12 - 0xf58]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140013128
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
mov edi, dword [rsp + 0x30]
lea r14d, [r8 - 0x1744]
lea r10d, [rdx - 0x5a2]
add edi, 0xffffe0cc
lea edx, [r14 + 0x10ee]
mov r11d, ecx
lea eax, [rcx - 0x72b]
cmp eax, edx
jl 0x1400131c7
lea eax, [rdi + 0x1419]
cmp r10d, eax
jle 0x14001320d
cmp dword [r9 + 0xcc], 0x15572
ja 0x1400131a3
mov edx, dword [r9 + 0xf4]
lea ecx, [rdx + 0x1c43fe]
add ecx, dword [r9 + 0x88]
imul ecx, edx
mov dword [r9 + 0xf4], ecx
mov rdx, qword [section..data]
mov ecx, dword [r9 + 0x114]
cmp ecx, dword [rdx + 0x68]
jae 0x1400131ce
mov eax, dword [rdx + 0x38]
xor eax, 0x1c5519
or eax, ecx
mov dword [r9 + 0x114], eax
mov rdx, qword [section..data]
lea eax, [r10 - 0x499]
cmp edi, eax
jg 0x140013263
mov eax, dword [r9 + 0xc8]
cmp dword [r9 + 0x104], eax
jae 0x14001329d
mov ecx, dword [r9 + 0x13c]
add ecx, 0xfffa26f5
add ecx, dword [r9 + 0x68]
mov dword [rdx + 0x10c], ecx
jmp 0x14001329d
mov r8d, r14d
mov ebx, r10d
and r8d, 0xfda
sub r8d, r10d
cmp r10d, r8d
jle 0x1400131c7
mov esi, dword [0x1404cd100]
add esi, dword [0x1404cd0e0]
mov rdx, qword [section..data]
cmp r10d, esi
jae 0x140013256
mov eax, dword [rdx + 0x40]
mov ecx, esi
or eax, 0x12ab
imul ebp, eax, 0x10ee
sub ecx, r10d
xor r11d, ebp
sub rcx, 1
jne 0x14001324d
add ebx, 2
cmp ebx, r8d
jg 0x140013235
jmp 0x1400131ce
mov ecx, dword [rdx + 0xf8]
add ecx, r10d
jmp 0x140013298
mov eax, r11d
xor eax, r14d
and eax, 0xfda
cmp dword [r9 + 0x88], eax
je 0x140013294
mov eax, dword [r9 + 0x98]
imul eax, dword [r9 + 0x150]
or r11d, eax
add r10d, 3
cmp r10d, ecx
jne 0x14001326e
mov rbx, qword [rsp + 0x10]
lea eax, [rdi + 0x1d1c]
mov rdi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop r14
ret
Function at 0x140014170
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, dword [rsp + 0x90]
lea r15d, [rdx - 0x698]
mov ebx, edx
lea eax, [r15 + 0x83f]
xor ebx, 0x1672
lea esi, [rdx - 0x1672]
xor r12d, 0x41f
lea ebp, [r8 - 0x5ff]
lea r14d, [rdx - 0x181]
mov rdi, rcx
lea r13d, [r9 - 0xd8e]
cmp esi, eax
jg 0x140014289
mov eax, dword [rcx + 0x54]
lea edx, [r15 + 0x43f]
add eax, dword [rcx + 0x1c]
sub r14d, 0xd8
xor eax, 0xffef0581
mov r9d, r14d
sub dword [rcx + 0x28], eax
xor r13d, 0x10ee
mov rcx, qword [section..data]
xor esi, 0x1d1c
lea eax, [r14 + 0x551]
xor r9d, 0x26b
mov dword [rsp + 0x28], eax
sub ebp, 0x72b
lea r8d, [r13 + 0x584]
mov dword [r11 - 0x48], r8d
mov r8d, esi
call fcn.140012e3c
mov r12d, eax
lea ecx, [r15 + 0x517]
lea eax, [rbp - 0x114]
mov r10d, r13d
mov dword [rsp + 0x30], eax
mov r9d, ebx
mov r8d, r14d
mov qword [rsp + 0x28], rdi
xor r10d, 0x429
lea edx, [r12 + 0xf8e]
xor r9d, 0x1819
mov dword [rsp + 0x20], r10d
xor r8d, 0x4d9
call fcn.140013788
mov esi, eax
sub r15d, 0x2c7
jmp 0x1400142db
mov eax, ebx
xor eax, 0x1419
imul eax, dword [rcx + 0x48]
cmp ebx, eax
jne 0x1400142db
mov eax, dword [rcx + 0x114]
and eax, r12d
cmp ebx, eax
jae 0x1400142db
mov edx, dword [0x1404cd0dc]
mov ecx, dword [0x1404cd048]
and edx, ebp
mov eax, esi
and edx, 0x1056
or rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, ebp
sub eax, r13d
sub eax, 0x1744
or dword [rdi + 0x138], eax
mov eax, esi
xor eax, ebp
sub dword [rdi + 0x38], eax
mov eax, r13d
xor eax, 0x1f34
cmp ebp, eax
jl 0x140014398
lea eax, [rbx + 0x1ab2]
cmp r15d, eax
jg 0x140014350
mov eax, dword [0x1404cd14c]
lea r8d, [r15 + 0xd9f]
sub eax, dword [rdi + 0x150]
lea r9d, [rsi + 0x3b2]
xor r8d, 0x4aa
lea edx, [rsi + 0x5ca]
xor eax, 0x19e0
mov dword [rdi + 0x18], eax
lea eax, [r13 + 0x584]
mov dword [rsp + 0x28], eax
lea ecx, [r8 - 0x670]
xor r8d, 0xadf
mov dword [rsp + 0x20], ecx
mov rcx, qword [section..data]
call fcn.1400124a0
jmp 0x140014398
xor r14d, ebp
cmp ebx, r14d
je 0x140014398
mov rax, qword [section..data]
mov r9, rdi
mov edx, dword [rdi + 0x150]
and edx, dword [rdi + 0x104]
and edx, ebp
mov r8d, dword [rax + 0x11c]
mov eax, esi
imul r8d, dword [rdi + 0x54]
or esi, r12d
xor eax, ebx
sub esi, r15d
xor eax, 0x1744
mov ecx, esi
mov dword [rsp + 0x20], eax
call fcn.140013520
mov ebx, eax
lea r11, [rsp + 0x40]
xor ebx, 0x1672
mov rbp, qword [r11 + 0x38]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400145c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r8d, dword [rsp + 0x78]
lea r9d, [rdx - 0x12ab]
mov edi, dword [rsp + 0x80]
lea ebp, [rdx - 0x51d]
mov esi, dword [rsp + 0x70]
mov r14d, r8d
mov r11d, edx
xor r14d, 0x1bc3
lea ebx, [r8 + 0x76a]
add edi, 0xffffed55
lea eax, [rbx - 0xd2]
xor r11d, 0x12ab
xor esi, 0xd4a
mov r10, rcx
cmp r9d, eax
jge 0x14001464d
mov rax, qword [section..data]
lea rcx, [0x1402f4b10]
add r11d, 0x1419
add r9d, 0x17a8
mov qword [rax + 0x90], rcx
lea eax, [r11 - 0x359]
cmp ebx, eax
je 0x14001479e
xor ebx, 0xdf6
xor esi, 0x1dd8
xor r15d, r15d
mov rax, qword [r10 + 0x90]
mov r8d, dword [r15 + rax]
add r15, 4
mov eax, dword [r10 + 0x138]
lea ecx, [rax - 0x10]
imul ecx, eax
mov dword [r10 + 0x138], ecx
mov rax, qword [section..data]
imul r8d, dword [rax + 0x34]
mov eax, dword [rax + 0xb4]
xor dword [r10 + 0x54], eax
movsxd rcx, dword [r10 + 0x74]
mov rax, qword [r10 + 0xd8]
mov edx, r8d
shr edx, 0x18
mov byte [rcx + rax], dl
mov edx, r8d
inc dword [r10 + 0x74]
mov eax, dword [r10 + 0xd0]
sub eax, 0x1218e
shr edx, 0x10
or dword [r10 + 0x70], eax
movsxd rcx, dword [r10 + 0x74]
mov rax, qword [0x1404cd0e8]
mov byte [rcx + rax], dl
mov edx, r8d
inc dword [r10 + 0x74]
mov eax, dword [0x1404cd148]
mov rcx, qword [section..data]
xor eax, 0x11
shr edx, 8
sub dword [rcx + 0x30], eax
mov eax, 0xa
sub eax, dword [r10 + 0x110]
sub eax, dword [r10 + 0x104]
add dword [0x1404cd0dc], eax
mov rax, qword [section..data]
movsxd rcx, dword [rax + 0x74]
mov rax, qword [rax + 0xd8]
mov byte [rcx + rax], dl
mov rax, qword [section..data]
inc dword [rax + 0x74]
movsxd rcx, dword [r10 + 0x74]
mov rax, qword [0x1404cd0e8]
mov byte [rcx + rax], r8b
inc dword [r10 + 0x74]
mov eax, dword [0x1404cd104]
mov ecx, dword [r10 + 0xd0]
add eax, 0xfffede72
add ecx, eax
mov dword [0x1404cd104], ecx
cmp r15, 0x1c2300
jl 0x14001466b
mov eax, dword [r10 + 0xc8]
cmp dword [r10 + 0x1c], eax
jbe 0x140014786
mov dword [r10 + 0x34], 0x97115
jmp 0x14001479e
mov ecx, dword [r10 + 0xcc]
add ecx, 0x14d60
add ecx, dword [r10 + 0xc4]
add dword [r10 + 0x40], ecx
cmp r9d, r11d
je 0x1400147cd
xor edi, 0xfda
lea r9d, [rsi + 0x332]
xor ebp, 0x14e4
lea edx, [rsi + 0xa8b]
mov r8d, edi
mov dword [rsp + 0x20], ebp
mov rcx, r10
call fcn.140012444
jmp 0x14001483e
mov rax, qword [section..data]
mov ecx, dword [rax + 0x48]
xor ecx, dword [r10 + 0x20]
cmp dword [r10 + 0x3c], ecx
jbe 0x14001483e
mov r9d, dword [0x1404cd058]
mov eax, dword [0x1404cd0a8]
xor r9d, edi
mov ecx, dword [r10 + 0x110]
add r9d, 0x1819
or ecx, dword [r10 + 0x104]
mov r8d, dword [r10 + 0xfc]
imul ecx, dword [r10 + 0x44]
xor r8d, r11d
imul eax, r14d
mov dword [rsp + 0x28], r9d
mov r9, r10
xor ebx, eax
mov eax, dword [0x1404cd070]
mov edx, ebx
or eax, edi
xor edx, edi
mov dword [rsp + 0x20], eax
and edx, dword [0x1404cd10c]
call fcn.140001dac
mov rbp, qword [rsp + 0x58]
lea eax, [rbx + 0x234]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x140002720
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
mov r9, rdx
mov r8, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x140002749
add rsp, 0x38
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x38
ret

Function at 0x140002760
Capabilities:
Create thread
Resume thread

Disassembly:
push rbx
sub rsp, 0x30
mov r9, rdx
mov qword [rsp + 0x28], 0
mov r8, rcx
mov dword [rsp + 0x20], 4
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
jne 0x140002795
add rsp, 0x30
pop rbx
ret
mov edx, 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x30
pop rbx
ret

Function at 0x140002a50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rcx + rbx], 0
jne 0x140002a64
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140003a20
Capabilities:
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x4f0
mov rax, qword [0x1400b7708]
mov rbx, rdx
mov rdi, rcx
cmp rax, 0xffffffffffffffff
jne 0x14000280c
xor edx, edx
lea rcx, str.kernel32
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
lea rdx, str.QueueUserAPC2
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400b7708], rax
test rax, rax
je 0x140002868
mov rcx, rbx
call fcn.140003d20
test al, al
jne 0x1400028b6
mov dl, 1
mov rcx, rbx
call fcn.140003d30
mov r9d, 0x10001
lea rcx, [0x140002ab0]
mov r8, rbx
mov rdx, rdi
call qword [0x1400b7708]
test eax, eax
jne 0x1400028b6
xor edx, edx
mov rcx, rbx
call fcn.140003d30
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1400028b6
mov qword [0x1400b7708], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x1400028b6
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x50], 0x40100003
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1400028ad
mov eax, dword [rsp + 0x50]
test eax, eax
jns 0x1400028ad
test eax, 0x18000000
jne 0x1400028ad
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [0x1400bb848]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rsp + 0x500]
add rsp, 0x4f0
pop rdi
ret
cmp qword [rcx + 0x60], 0xffffffffffffffff
je 0x140003a47
mov eax, dword [rcx + 0x38]
shr eax, 5
test al, 1
jne 0x140003a47
mov eax, dword [rcx + 0x38]
shr eax, 7
test al, 1
jne 0x140003a47
mov rdx, rcx
mov rcx, qword [rcx + 0x60]
jmp 0x1400027c0
ret
Function at 0x1400047e0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rdx
mov rdx, rcx
mov rcx, rax
jmp 0x14001a120
mov rax, qword gs:[0x30]
mov r10, rcx
mov r8, qword [rax + 0x60]
mov r9, qword [r8 + 0x18]
add r9, 0x20
mov rax, qword [r9]
nop dword [rax + rax]
cmp qword [rax + 0x20], rdx
je 0x14001a15d
test rdx, rdx
je 0x14001a15d
mov rax, qword [rax]
cmp rax, r9
jne 0x14001a140
mov qword [rcx], 0
xor eax, eax
ret
mov rcx, qword [rax + 0x40]
mov qword [r10], rcx
movzx eax, word [rax + 0x38]
shr eax, 1
ret
Function at 0x140008af0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x290
movdqa xmmword [rsp + 0x2f0], xmm6
movdqa xmmword [rsp + 0x300], xmm7
movdqa xmmword [rsp + 0x310], xmm8
movdqa xmmword [rsp + 0x320], xmm9
movdqa xmmword [rsp + 0x330], xmm10
movdqa xmmword [rsp + 0x340], xmm11
movdqa xmmword [rsp + 0x350], xmm12
movdqa xmmword [rsp + 0x360], xmm13
movdqa xmmword [rsp + 0x370], xmm14
movdqa xmmword [rsp + 0x380], xmm15
mov eax, dword [0x1400bddc0]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x290]
mov qword [rdx + 8], r8
call fcn.140106330
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x1400bddc0]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x140008c80
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x140008c9c
cmp rcx, r8
jl 0x140008c8f
mov qword [rdx + 0x80], rcx
test dword [0x1400bd9e0], 1
je 0x140008ccb
cmp byte [rsp + 0xd0], 0
je 0x140008ccb
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x1400087f0
mov rsp, r8
jmp rax