joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009e400
Capabilities:
Get file size
Read file on windows
Read file via mapping

Disassembly:
push rbx
push rbp
sub rsp, 0x48
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
jne 0x14009e41c
lea eax, [rcx + 0x28]
add rsp, 0x48
pop rbp
pop rbx
ret
mov qword [rsp + 0x68], rsi
xor r9d, r9d
mov qword [rsp + 0x40], r14
mov edx, 0x80000000
xor r14d, r14d
mov rcx, rbp
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r14 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14009e470
mov r14, qword [rsp + 0x40]
lea eax, [rsi + 2]
mov rsi, qword [rsp + 0x68]
add rsp, 0x48
pop rbp
pop rbx
ret
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x78], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14009e595
mov rax, qword [rsp + 0x70]
cmp rax, 0x7fffffff
jg 0x14009e595
test rax, rax
je 0x14009e595
xor r9d, r9d
mov qword [rsp + 0x28], r14
xor edx, edx
mov dword [rsp + 0x20], r14d
mov rcx, rsi
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
test rax, rax
je 0x14009e595
mov ecx, dword [rsp + 0x70]
xor r9d, r9d
mov dword [rbx + 8], ecx
xor r8d, r8d
mov rcx, rax
mov dword [rbx + 0xc], r14d
mov qword [rsp + 0x20], r14
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rdi
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx], r14
je 0x14009e50a
lea rax, [0x14009e5f0]
jmp 0x14009e563
mov rcx, qword [rbx + 0x30]
xor edx, edx
movsxd r8, dword [rbx + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
test rax, rax
je 0x14009e595
mov edi, r14d
nop dword [rax + rax]
mov r8d, dword [rbx + 8]
lea r9, [rsp + 0x60]
mov edx, edi
sub r8d, edi
add rdx, qword [rbx]
mov rcx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14009e583
add edi, dword [rsp + 0x60]
cmp edi, dword [rbx + 8]
jne 0x14009e530
lea rax, [0x14009e5c0]
mov rcx, rsi
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx]
mov qword [rbx + 0x10], rax
xor eax, eax
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x20], r14
jmp 0x14009e5aa
mov rcx, qword [rbx + 0x30]
xor edx, edx
mov r8, qword [rbx]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x51
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop rbp
pop rbx
ret
Function at 0x14009fb80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rdx
test rdx, rdx
jne 0x14009fb8b
xor eax, eax
ret
lea r11, [0x1400c1fb0]
not ecx
cmp r8d, 8
jb 0x14009fc61
mov r10d, r8d
shr r10, 3
nop word [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r8d, 0xfffffff8
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 4]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 5]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 6]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 7]
add r9, 8
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x14009fbb0
test r8d, r8d
je 0x14009fc8d
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
add r8d, 0xffffffff
jne 0x14009fc70
not ecx
mov eax, ecx
ret
Function at 0x1400a488c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400a48d6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400a48d6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400a48d6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400a48d6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400a48d6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400a48d8
xor al, al
add rsp, 0x28
ret
Function at 0x1400014ec
Capabilities:
Move file

Disassembly:
jmp 0x140099a70
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r8d, 2
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x140099aac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140001e9c
mov eax, 0xffffffff
jmp 0x140099aae
xor eax, eax
add rsp, 0x28
ret

Function at 0x140001929
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x140098ad0
mov qword [rsp + 8], rcx
sub rsp, 0x38
call fcn.140097b20
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140098b07
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
call qword [0x140177020]
jmp 0x140098b0d
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x38
ret

Function at 0x140002626
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1400391d0
mov rax, rcx
neg rcx
test rax, 7
je 0x1400391ed
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x140039248
test al, 7
jne 0x1400391e0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x140039201
mov rdx, qword [rax - 8]
test dl, dl
je 0x140039272
test dh, dh
je 0x14003926c
shr rdx, 0x10
test dl, dl
je 0x140039266
test dh, dh
je 0x140039260
shr rdx, 0x10
test dl, dl
je 0x14003925a
test dh, dh
je 0x140039254
shr edx, 0x10
test dl, dl
je 0x14003924e
test dh, dh
jne 0x140039201
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x14000294b
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1400382b0
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140037c30
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400382ef
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140177020]
jmp 0x1400382f9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x140002a95
Capabilities:
Query environment variable

Disassembly:
jmp 0x1400a3c50
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
mov rbx, rax
test rax, rax
je 0x1400a3d38
mov rsi, rax
cmp word [rax], r14w
je 0x1400a3ca3
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], r14w
jne 0x1400a3c8b
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], r14w
jne 0x1400a3c87
mov qword [rsp + 0x38], r14
sub rsi, rbx
mov qword [rsp + 0x30], r14
add rsi, 2
sar rsi, 1
mov r8, rbx
mov r9d, esi
mov dword [rsp + 0x28], r14d
xor edx, edx
mov qword [rsp + 0x20], r14
xor ecx, ecx
call fcn.140003495
movsxd rbp, eax
test eax, eax
je 0x1400a3d38
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov rcx, rbp
lea edx, [r9 - 0x64]
call fcn.140002851
mov rdi, rax
test rax, rax
je 0x1400a3d26
mov qword [rsp + 0x38], r14
mov r9d, esi
mov qword [rsp + 0x30], r14
mov r8, rbx
mov dword [rsp + 0x28], ebp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.140003495
test eax, eax
je 0x1400a3d26
mov rsi, rdi
mov rdi, r14
jmp 0x1400a3d29
mov rsi, r14
mov edx, 2
mov rcx, rdi
call fcn.14000188e
jmp 0x1400a3d3b
mov rsi, r14
test rbx, rbx
je 0x1400a3d49
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140002a9f
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1400381e0
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.140037bb0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140038221
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140177020]
jmp 0x140038227
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret

Function at 0x140002b17
Capabilities:
Get geographical location

Disassembly:
jmp 0x140098da0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.140097d20
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140098df3
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
call qword [0x140177020]
jmp 0x140098e15
xor edx, edx
mov rcx, qword [rsp + 0x50]
call fcn.140002388
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x48
ret
Function at 0x140002b21
Capabilities:
Terminate process

Disassembly:
jmp 0x140014c00
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140002d38
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400b9170
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x140166608]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x1400b9196
jmp 0x1400b9213
mov rcx, qword [rbp + 0x30]
call fcn.140002626
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x1400b91af
jmp 0x1400b9213
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x1400b91cc
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400018bb
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.140001cb2
test eax, eax
jne 0x1400b9213
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.1400027d9
lea rsp, [rbp + 0x20]
pop rbp
ret

Function at 0x140002e4b
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400d4c80
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov rax, qword [rsp]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400d4ca4
xor eax, eax
jmp 0x1400d4cf2
mov rax, qword [rsp]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp]
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
cmp dword [rax], 0x4550
je 0x1400d4ccc
xor eax, eax
jmp 0x1400d4cf2
mov rax, qword [rsp + 8]
add rax, 0x18
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
movzx eax, word [rax]
cmp eax, 0x20b
je 0x1400d4ced
xor eax, eax
jmp 0x1400d4cf2
mov eax, 1
add rsp, 0x28
ret
Function at 0x14000318e
Capabilities:
Parse pe header

Disassembly:
jmp 0x140016530
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140016550
xor al, al
jmp 0x1400165d1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140016563
xor al, al
jmp 0x1400165d1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001658d
xor al, al
jmp 0x1400165d1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400165a1
xor al, al
jmp 0x1400165d1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400165b3
xor al, al
jmp 0x1400165d1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400165cf
xor al, al
jmp 0x1400165d1
mov al, 1
add rsp, 0x38
ret
Function at 0x14000340e
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x1400d4af0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x10], rax
mov dword [rsp], 0
mov rax, qword [rsp + 0x10]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x10]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 8], rax
jmp 0x1400d4b4e
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov rax, qword [rsp + 8]
add rax, 0x28
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x10]
movzx eax, word [rax + 6]
cmp dword [rsp], eax
jae 0x1400d4b8d
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0xc]
cmp qword [rsp + 0x38], rax
jb 0x1400d4b8b
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 8]
add eax, dword [rcx + 8]
mov eax, eax
cmp qword [rsp + 0x38], rax
jae 0x1400d4b8b
mov rax, qword [rsp + 8]
jmp 0x1400d4b8f
jmp 0x1400d4b38
xor eax, eax
add rsp, 0x28
ret

Function at 0x140003602
Capabilities:
Terminate process

Disassembly:
jmp 0x140038ec0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x140038eee
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.140003d5a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400036ac
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140098b90
mov dword [rsp + 8], ecx
sub rsp, 0x38
call fcn.140097ba0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140098bc5
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov ecx, dword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
call qword [0x140177020]
jmp 0x140098bcf
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x38
ret

Function at 0x140003b07
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x140098bf0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x38
call fcn.140097be0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140098c2f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
call qword [0x140177020]
jmp 0x140098c3e
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x38
ret

Function at 0x140003daf
Capabilities:
Print debug messages

Disassembly:
jmp 0x14009c6a0
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x140003e40
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x140038320
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140037c70
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140038369
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140177020]
jmp 0x140038378
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret
Function at 0x140003e7c
Capabilities:
Write file on windows

Disassembly:
jmp 0x14000d610
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x208
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x42
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x228]
lea rcx, [0x140176028]
call fcn.1400040cf
mov ecx, 0x19
call fcn.14000151e
add eax, 0x49
mov ecx, eax
call fcn.140002748
add eax, 0x35
mov ecx, eax
call fcn.140001d0c
add eax, 0x60
mov ecx, eax
call fcn.140004377
mov rcx, qword [rbp + 0x1e0]
call fcn.140002626
xor edx, edx
mov ecx, 2
div rcx
mov qword [rbp + 8], rax
mov ecx, 0x19
call fcn.14000151e
add eax, 0x49
mov ecx, eax
call fcn.140002748
add eax, 0x35
mov ecx, eax
call fcn.140001d0c
add eax, 0x60
mov ecx, eax
call fcn.140004377
mov rcx, qword [rbp + 8]
call fcn.140002d10
mov qword [rbp + 0x28], rax
mov ecx, 0x19
call fcn.14000151e
add eax, 0x49
mov ecx, eax
call fcn.140002748
add eax, 0x35
mov ecx, eax
call fcn.140001d0c
add eax, 0x60
mov ecx, eax
call fcn.140004377
mov qword [rbp + 0x48], 0
jmp 0x14000d701
mov rax, qword [rbp + 0x48]
inc rax
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 8]
cmp qword [rbp + 0x48], rax
jae 0x14000d760
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x48]
lea rax, [rax + rcx*2]
mov r8d, 2
mov rdx, rax
lea rcx, [rbp + 0x68]
call fcn.140001500
lea rcx, [rbp + 0x68]
call fcn.14000146a
mov r8d, 0x10
xor edx, edx
mov rcx, rax
call fcn.140002e19
mov rcx, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x28]
add rdx, rcx
mov rcx, rdx
mov byte [rcx], al
lea rcx, [rbp + 0x68]
call fcn.1400018ed
jmp 0x14000d6f6
mov ecx, 0x19
call fcn.14000151e
add eax, 0x49
mov ecx, eax
call fcn.140002748
add eax, 0x35
mov ecx, eax
call fcn.140001d0c
add eax, 0x60
mov ecx, eax
call fcn.140004377
lea rax, str.2r4tTcnZh8WYnM1124cyWqlkQJcrG2eR
mov qword [rbp + 0xa8], rax
mov r8, qword [rbp + 0xa8]
mov edx, dword [rbp + 8]
mov rcx, qword [rbp + 0x28]
call fcn.140003ee0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbp + 0xc8], rax
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0xe4]
mov r8d, dword [rbp + 8]
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000d821
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x14000d830
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.140003814
mov rax, rdi
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret
Function at 0x140003ee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x14000d8e0
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x20]
lea rcx, [0x140176028]
call fcn.1400040cf
mov dword [rbp + 4], 0
mov eax, dword [rbp + 0x178]
dec eax
mov dword [rbp + 0x24], eax
jmp 0x14000d92c
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
mov eax, dword [rbp + 0x24]
dec eax
mov dword [rbp + 0x24], eax
mov eax, dword [rbp + 0x24]
cmp dword [rbp + 4], eax
jge 0x14000d978
movsxd rax, dword [rbp + 4]
mov rcx, qword [rbp + 0x170]
movzx eax, byte [rcx + rax]
mov byte [rbp + 0x44], al
movsxd rax, dword [rbp + 0x24]
movsxd rcx, dword [rbp + 4]
mov rdx, qword [rbp + 0x170]
mov r8, qword [rbp + 0x170]
movzx eax, byte [r8 + rax]
mov byte [rdx + rcx], al
movsxd rax, dword [rbp + 0x24]
mov rcx, qword [rbp + 0x170]
movzx edx, byte [rbp + 0x44]
mov byte [rcx + rax], dl
jmp 0x14000d91c
mov dword [rbp + 0x64], 0
jmp 0x14000d989
mov eax, dword [rbp + 0x64]
inc eax
mov dword [rbp + 0x64], eax
mov eax, dword [rbp + 0x178]
cmp dword [rbp + 0x64], eax
jae 0x14000da0d
movsxd rax, dword [rbp + 0x64]
mov rcx, qword [rbp + 0x170]
movzx eax, byte [rcx + rax]
mov dword [rbp + 0x134], eax
mov ecx, dword [rbp + 0x64]
add ecx, 5
movsxd rcx, ecx
mov qword [rbp + 0x138], rcx
mov rcx, qword [rbp + 0x180]
call fcn.140002626
mov qword [rbp + 0x140], rax
xor edx, edx
mov rcx, qword [rbp + 0x138]
mov rax, rcx
mov rcx, qword [rbp + 0x140]
div rcx
mov rax, rdx
mov rcx, qword [rbp + 0x180]
movsx eax, byte [rcx + rax]
mov ecx, dword [rbp + 0x134]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rbp + 0x64]
mov rdx, qword [rbp + 0x170]
mov byte [rdx + rcx], al
jmp 0x14000d981
lea rsp, [rbp + 0x158]
pop rdi
pop rbp
ret

Function at 0x140003eea
Capabilities:
Set environment variable

Disassembly:
jmp 0x1400bc120
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
lea rcx, [rsp + 0x70]
call fcn.14000226b
lea rcx, [rsp + 0x40]
call fcn.14000226b
call fcn.140002a45
mov r8d, eax
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0xb0]
call fcn.1400020a4
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1400bc18f
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x40]
call fcn.140002540
lea rcx, [rsp + 0x70]
call fcn.140002540
mov eax, dword [rsp + 0x24]
jmp 0x1400bc21c
call fcn.140002a45
mov r8d, eax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0xb8]
call fcn.1400020a4
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x1400bc1d6
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x40]
call fcn.140002540
lea rcx, [rsp + 0x70]
call fcn.140002540
mov eax, dword [rsp + 0x2c]
jmp 0x1400bc21c
lea rcx, [rsp + 0x40]
call fcn.1400021ee
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x70]
call fcn.1400021ee
mov rcx, qword [rsp + 0x38]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x40]
call fcn.140002540
lea rcx, [rsp + 0x70]
call fcn.140002540
mov eax, dword [rsp + 0x30]
add rsp, 0xa8
ret