joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b80f0
Capabilities:
Encode data using xor
Encrypt data using dpapi
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor esi, esi
lea r9, [rsp + 0x60]
mov dword [rsp + 0x30], esi
mov r8, rax
mov dword [rsp + 0x28], esi
mov rdx, rbx
mov rcx, rdi
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1400b8239
mov rcx, qword [rsp + 0x60]
lea edx, [rsi + 4]
xor r9d, r9d
mov qword [rsp + 0x20], 0x61c
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
je 0x1400b8220
mov edx, 0x610
lea ecx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x1400b8215
mov rcx, rax
lea rdx, [rdi + 0xc]
mov r8d, 0x610
call fcn.1400e84c0
mov edx, 0x610
lea r8d, [rsi + 1]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_SystemFunction041]
test eax, eax
jne 0x1400b8200
mov eax, dword [rbx + 0x400]
lea r9, [rbx + 0x404]
test eax, eax
je 0x1400b81d2
mov rdx, r9
mov r8d, eax
mov cl, byte [rdx]
mov al, cl
xor al, sil
mov sil, cl
xor al, 0x43
mov byte [rdx], al
inc rdx
sub r8, 1
jne 0x1400b81bb
mov eax, dword [rbx + 0x604]
lea r8, [rbx + 0x200]
mov dword [rsp + 0x28], eax
lea rcx, str._Username__:__s_n_Domain____:__s_n_Password__:__.s_n_flags_type:_0x_08x_n
mov qword [rsp + 0x20], r9
mov rdx, rbx
mov r9d, dword [rbx + 0x400]
call fcn.14000b9e4
jmp 0x1400b820c
lea rcx, str.BigBad_:_Citrix_SSO_Program_FileMapping___ERROR
call fcn.14000b9e4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x1400b822c
lea rcx, str.BigBad_:_Citrix_SSO_Program_FileMapping___ERROR
call fcn.14000b9e4
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400b8245
lea rcx, str.BigBad_:_Citrix_SSO_Program_FileMapping___ERROR
call fcn.14000b9e4
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1400bed24
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x40
xor ebp, ebp
xor r9d, r9d
and qword [rax - 0x38], rbp
mov edx, 0x80000000
and dword [rax - 0x40], ebp
lea r8d, [rbp + 3]
mov dword [rax - 0x48], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1400bee41
lea rdx, [rsp + 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400bee2a
mov r12d, 0x10000000
lea ecx, [rbp + 0x40]
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x1400bee36
mov rax, qword [rsp + 0x80]
xor ecx, ecx
test rax, rax
jle 0x1400bee1f
lea r14, [rcx + 0x10000000]
mov rbx, rax
sub rbx, rcx
mov rdx, rcx
cmp r14, rax
mov rcx, rdi
cmovl rbx, r12
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400bee03
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov r8d, ebx
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400bee03
mov edx, dword [rsp + 0x78]
mov rcx, rsi
call fcn.1400bec1c
add ebp, eax
jmp 0x1400bee0f
lea rcx, str.BigBad_:_kuhl_m_seKuRlSa_sk_search_file___ERROR
call fcn.14000b9e4
mov rax, qword [rsp + 0x80]
mov rcx, r14
cmp r14, rax
jl 0x1400bedab
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400bee36
lea rcx, str.BigBad_:_kuhl_m_seKuRlSa_sk_search_file___ERROR
call fcn.14000b9e4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400bee4d
lea rcx, str.BigBad_:_kuhl_m_seKuRlSa_sk_search_file___ERROR
call fcn.14000b9e4
mov rbx, qword [rsp + 0x70]
mov eax, ebp
add rsp, 0x40
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400c1e28
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x1400c1ea0
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x1400c1ea0
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x1400c1ea0
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x1400c1e94
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x1400c1eb2
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x1400c1e82
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x1400c1ea2

Function at 0x1400c2ae4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400c2b2e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400c2b2e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400c2b2e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400c2b2e
cmp dword [rcx + 0x84], 0xe
jbe 0x1400c2b2e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400c2b30
xor al, al
add rsp, 0x28
ret
Function at 0x1400d98a0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400d9690
Function at 0x1400df6a4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1400df3bd
call fcn.1400da534
mov dword [rax], Ordinal_26
call fcn.1400da3f8
jmp 0x1400df519
mov eax, dword [rcx + 0x14]
shr eax, 0xd
mov ebp, 1
test bpl, al
je 0x1400df519
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test bpl, al
jne 0x1400df519
mov eax, dword [rcx + 0x14]
shr eax, 1
test bpl, al
je 0x1400df3f4
lock or dword [rcx + 0x14], 0x10
jmp 0x1400df519
lock or dword [rcx + 0x14], ebp
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1400df407
call fcn.1400e4f34
mov r14d, dword [rbx + 0x10]
cmp r14d, ebp
jne 0x1400df418
mov rax, qword [rbx]
mov r15b, byte [rax]
jmp 0x1400df41b
xor r15b, r15b
mov rsi, qword [rbx + 8]
mov rcx, rbx
mov edi, dword [rbx + 0x20]
mov qword [rbx], rsi
call fcn.1400cd55c
mov r8d, edi
mov rdx, rsi
mov ecx, eax
call fcn.1400e3f94
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x1400df507
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x1400df4ae
mov rcx, rbx
call fcn.1400cd55c
cmp eax, 0xffffffff
je 0x1400df499
mov rcx, rbx
call fcn.1400cd55c
cmp eax, 0xfffffffe
je 0x1400df499
mov rcx, rbx
call fcn.1400cd55c
movsxd rdi, eax
lea rsi, [0x140144e60]
mov rcx, rbx
sar rdi, 6
call fcn.1400cd55c
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [rsi + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x1400df4a0
lea rdx, [0x14013e350]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400df4ae
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x1400df4d4
mov eax, dword [rbx + 0x14]
shr eax, 6
test bpl, al
je 0x1400df4d4
mov eax, dword [rbx + 0x14]
shr eax, 8
test bpl, al
jne 0x1400df4d4
mov dword [rbx + 0x20], 0x1000
mov rdx, qword [rbx]
cmp r14d, ebp
jne 0x1400df4ef
movzx ecx, byte [rdx]
shl cx, 8
movzx eax, r15b
or cx, ax
dec dword [rbx + 0x10]
jmp 0x1400df4fb
movzx ecx, word [rdx]
mov ebp, 2
add dword [rbx + 0x10], 0xfffffffe
lea rax, [rdx + rbp]
mov qword [rbx], rax
movzx eax, cx
jmp 0x1400df51e
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
jmp 0x1400df388
Function at 0x1400e0980
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400e0a07
mov rsi, rbx
cmp word [rax], bp
je 0x1400e09c6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400e09b0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400e09ac
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400da590
mov rdi, rax
test rax, rax
je 0x1400e09f4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400e84c0
mov rbp, rdi
xor ecx, ecx
call fcn.1400da554
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400e3ae8
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x140144e60]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x1400e3b46
cmp word [rdx], r12w
jne 0x1400e3b46
or byte [rax + r8*8 + 0x38], cl
jmp 0x1400e3b4c
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x1400e3ca7
mov r9d, reloc.WLDAP32.dll_Ordinal_26
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x1400e3c82
lea r9, [rcx + 2]
cmp ax, r13w
je 0x1400e3b85
mov rcx, r9
jmp 0x1400e3ba8
cmp r9, rdx
jae 0x1400e3bbf
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, reloc.WLDAP32.dll_Ordinal_26
add rbx, 2
cmp rcx, rdx
jb 0x1400e3b69
jmp 0x1400e3ca7
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400e3c7c
cmp dword [rsp + 0x80], edi
je 0x1400e3c7c
mov rdx, r14
lea r11, [0x140144e60]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x1400e3c55
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x1400e3c28
mov word [rbx], r12w
jmp 0x1400e3ca3
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x1400e3c31
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x1400e3ca3
cmp word [rsp + 0x70], r12w
jne 0x1400e3c62
cmp rbx, rsi
je 0x1400e3c22
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.1400e3a08
cmp word [rsp + 0x70], r12w
je 0x1400e3ca7
mov word [rbx], r13w
jmp 0x1400e3ca3
lea r11, [0x140144e60]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x1400e3c9f
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x1400e3ca7
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400e671c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400e3a08
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400e3a08
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400e686c
cmp rax, 0xffffffffffffffff
je 0x1400e686c
xor edi, edi
test rbp, rbp
jle 0x1400e6817
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400dca88
mov rbx, rax
test rax, rax
jne 0x1400e67a4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400e680d
mov edx, 0x8000
mov ecx, r14d
call fcn.1400cd47c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400ddd00
cmp eax, 0xffffffff
je 0x1400e67ed
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400e67b4
mov edx, r15d
mov ecx, r14d
call fcn.1400cd47c
jmp 0x1400e680d
cmp byte [rsi + 0x38], dil
je 0x1400e6804
cmp dword [rsi + 0x34], 5
jne 0x1400e6804
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.Cabinet.dll_FCIFlushCabinet
cmp byte [rsi + 0x30], dil
je 0x1400e680d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400da554
jmp 0x1400e6880
jns 0x1400e6880
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400e3a08
cmp rax, 0xffffffffffffffff
jne 0x1400e6838
cmp byte [rsi + 0x30], dil
je 0x1400e6880
mov edi, dword [rsi + 0x2c]
jmp 0x1400e6880
mov ecx, r14d
call fcn.1400de8c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400e6880
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, reloc.Cabinet.dll_FCIFlushCabinet
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.Cabinet.dll_FCIFlushCabinet
jmp 0x1400e6880
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400e6879
mov eax, dword [rsi + 0x2c]
jmp 0x1400e687e
mov eax, Ordinal_26
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400e3a08
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400e75c0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400e75e8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400e75e8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1419c753b
Capabilities:
Encode data using xor

Disassembly:
sti
push rbx
xor qword [r14], r11
mov byte [rbp - 0x5607616], bh
push qword fs:[rsp + 0x48]
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x50]
call fcn.141d3bf5e
call fcn.141bd6dbe
add al, byte fs:[rax]
add byte [rbx - 0x713fb9d6], al
xchg esp, eax
mov esp, dword [rbp + 0x236186f3]
or al, 0x4c
enter 0xffffffffffff948e, 0xfffffffffffffff3
jns 0x1419c752f
xchg bl, dh
invalid
Function at 0x14000ba10
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140015de0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140015de0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x14000ba80
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1401ab094]
test esi, esi
mov rbx, rcx
jle 0x14000bbb0
mov rax, qword [0x1401ab098]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14000bacb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x14000bb55
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x14000bab0
mov rcx, rbx
call fcn.14000c4f0
test rax, rax
mov rdi, rax
je 0x14000bbd2
mov rax, qword [0x1401ab098]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.14000c630
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1401ab098]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000bbb7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14000bb4e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x14000bb60
add dword [0x1401ab094], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov r8d, 0x40
mov eax, 4
mov rcx, qword [rsp + 0x20]
cmove r8d, eax
mov rdx, qword [rsp + 0x38]
add rbx, qword [0x1401ab098]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000bb4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.14000ba10
nop dword [rax]
xor esi, esi
jmp 0x14000bad8
mov rax, qword [0x1401ab098]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [rdi + 8]
mov r8, qword [rax + rbx + 0x18]
call fcn.14000ba10
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.14000ba10
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x14000c140
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x1401ab100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1401ab0e0]
test rbx, rbx
je 0x14000c19c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x14000c193
test rsi, rsi
je 0x14000c193
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14000c178
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x14000c3b0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.msvcrt.dll_exit]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [sym.imp.msvcrt.dll__exit]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x14000c3e8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x14000c3f0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x14000c3c0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.msvcrt.dll_exit]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [sym.imp.msvcrt.dll__exit]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x14000c3e8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x14000c3f0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x14000c3d0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.msvcrt.dll_exit]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [sym.imp.msvcrt.dll__exit]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x14000c3e8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x14000c3f0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x14000c4f0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14018dd90]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14000c510
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14000c518
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14000c510
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000c56d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x14000c564
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14000c510
add rax, 0x28
cmp rax, r9
jne 0x14000c550
xor eax, eax
ret

Function at 0x14000c570
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14018dd90]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000c58f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x14000c598
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000c58f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x14000c630
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14018dd90]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000c64f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x14000c658
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140099240
Capabilities:
Encode data using xor

Disassembly:
mov r11, rdx
mov rax, rcx
mov r10, rdx
and r11, 0xfffffffffffffff8
add r11, rcx
movabs rcx, 0xc6a4a7935bd1e995
imul r10, rcx
xor r10, r8
cmp rax, r11
je 0x140099298
nop word cs:[rax + rax]
mov r9, qword [rax]
add rax, 8
imul r9, rcx
mov r8, r9
shr r8, 0x2f
xor r8, r9
imul r8, rcx
xor r8, r10
mov r10, r8
imul r10, rcx
cmp r11, rax
jne 0x140099270
and edx, 7
je 0x1400992cd
sub edx, 1
movsxd rax, edx
xor edx, edx
nop dword [rax]
movzx ecx, byte [r11 + rax]
shl rdx, 8
sub rax, 1
add rdx, rcx
test eax, eax
jns 0x1400992a8
xor rdx, r10
movabs r10, 0xc6a4a7935bd1e995
imul r10, rdx
movabs rax, 0xc6a4a7935bd1e995
mov rdx, r10
shr rdx, 0x2f
xor rdx, r10
imul rdx, rax
mov rax, rdx
shr rax, 0x2f
xor rax, rdx
ret

Function at 0x14009c890
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x140187780]
jmp 0x14000d350

Function at 0x14009c8a0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x140187780]
jmp 0x14000d350
Function at 0x14002cd38
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push r14
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [0x14009b028]
lea r14, [0x14009b028]
cmp rcx, r14
je 0x14002cd7f
test byte [rcx + 0x1c], 4
je 0x14002cd7f
cmp byte [rcx + 0x19], 5
jb 0x14002cd7f
mov rcx, qword [rcx + 0x10]
lea r8, [0x140088d30]
mov edx, 0x14
call fcn.140001024
lea rcx, [0x14009f0f0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov rax, qword [rbx + 8]
mov rcx, qword [rbx]
mov qword [rax], rcx
mov qword [rcx + 8], rax
and qword [rbx], 0
and qword [rbx + 8], 0
mov eax, dword [rbx + 0x18]
test eax, eax
jne 0x14002cdca
cmp dword [rbx + 0x2c], eax
jne case.default.0x14002cf7b
lea rcx, [0x14009f008]
call fcn.140036078
jmp case.default.0x14002cf7b
cmp eax, 2
jne 0x14002ce45
mov rcx, qword [rbx + 0x38]
cmp rcx, 0xffffffffffffffff
je case.default.0x14002cf7b
call qword [sym.imp.KERNEL32.dll_FindClose]
nop dword [rax + rax]
test eax, eax
jne case.default.0x14002cf7b
mov rax, qword [0x14009b028]
cmp rax, r14
je case.default.0x14002cf7b
test byte [rax + 0x1c], 4
je case.default.0x14002cf7b
cmp byte [rax + 0x19], 2
jb case.default.0x14002cf7b
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x14009b028]
lea r8, [0x140088d30]
mov r9d, eax
mov edx, 0x15
mov rcx, qword [rcx + 0x10]
call fcn.140001050
jmp case.default.0x14002cf7b
cmp eax, 3
jne case.default.0x14002cf7b
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test eax, eax
jne 0x14002cea5
mov rax, qword [0x14009b028]
cmp rax, r14
je 0x14002cea5
test byte [rax + 0x1c], 4
je 0x14002cea5
cmp byte [rax + 0x19], 2
jb 0x14002cea5
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x14009b028]
lea r8, [0x140088d30]
mov r9d, eax
mov edx, 0x16
mov rcx, qword [rcx + 0x10]
call fcn.140001050
cmp dword [rbx + 0x660], 0
je 0x14002cf0c
cmp dword [rbx + 0x65c], 0
je 0x14002cf15
lea rcx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x14002cf0c
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x14009b028]
cmp rcx, r14
je 0x14002cf0c
test byte [rcx + 0x1c], 4
je 0x14002cf0c
cmp byte [rcx + 0x19], 2
jb 0x14002cf0c
mov rcx, qword [rcx + 0x10]
lea r9, [rbx + 0x40]
mov edx, 0x17
mov dword [rsp + 0x20], eax
lea r8, [0x140088d30]
call fcn.140001328
cmp dword [rbx + 0x65c], 0
jne case.default.0x14002cf7b
cmp qword [rbx + 0x668], 0
je case.default.0x14002cf7b
lea rcx, [0x14009f180]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x668]
mov edx, 1
mov r9d, edx
mov r8d, edx
call fcn.14003e6a0
lea rcx, [0x14009f180]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, rbx
call fcn.1400670c4
lea rcx, [0x14009f0f0]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop r14
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
invalid
pop rdi
invalid
fisttp dword [rbx - 0x54]
cld
ret 0xf72d
invalid