joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401a3280
Capabilities:
Parse pe header

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1401a3415
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
nop dword [rax + rax]
test rax, rax
je 0x1401a3409
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rax
mov rcx, rax
mov qword [rsp + 0x28], rax
nop dword [rax + rax]
test rbx, rbx
je 0x1401a32df
nop
lea rdx, [rcx + rbx]
lea rsi, [rcx + 0x40]
cmp rsi, rdx
jbe 0x1401a32df
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x1401f0d20]
call fcn.14000e4c0
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov qword [rax + 8], 0x40
mov rdx, qword [0x14046f068]
mov rbx, rax
mov edi, 2
mov rax, rdx
mov rcx, rdi
call fcn.140188ba0
test rax, rax
jne 0x1401a33fd
mov rcx, qword [rsp + 0x28]
cmp word [rcx], 0x5a4d
jne 0x1401a33f1
mov ecx, dword [rcx + 0x3c]
cmp ecx, 0x400
jg 0x1401a33e5
movsxd rcx, ecx
mov rdx, qword [rsp + 0x40]
add rcx, rdx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rcx
mov rsi, qword [rsp + 0x48]
test rsi, rsi
je 0x1401a337b
nop
add rsi, rdx
cmp rdx, 8
ja 0x1401a336f
cmp rsi, 0x100
jae 0x1401a337b
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x1401f0d20]
call fcn.14000e4c0
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
mov qword [rax + 8], 0x40
mov rcx, qword [0x14046f068]
mov rbx, rax
mov edi, 2
mov rax, rcx
mov rcx, rdi
call fcn.140188ba0
test rax, rax
jne 0x1401a33d9
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1401a33cf
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call fcn.140062180
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.1401a3280
Function at 0x1401a3580
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1401a3645
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
nop dword [rax + rax]
cmp ebx, 0x10
jae 0x1401a3639
mov dword [rsp + 0x38], ebx
mov byte [rsp + 0x3c], cl
mov qword [rsp + 0x10], rax
xor ebx, ebx
call fcn.1401a3280
nop dword [rax]
test rax, rax
je 0x1401a362d
mov qword [rsp + 0x18], rax
nop
mov rax, qword [rsp + 0x10]
call fcn.1401a3440
cmp ax, 0x20b
jne 0x1401a35f3
mov ecx, dword [rsp + 0x38]
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
lea rcx, [rdx + rcx*8]
lea rcx, [rcx + 0x88]
jmp 0x1401a3606
mov edx, dword [rsp + 0x38]
mov edx, edx
mov rbx, qword [rsp + 0x18]
lea rcx, [rbx + rdx*8]
lea rcx, [rcx + 0x78]
movzx edx, byte [rsp + 0x3c]
test dl, dl
jne 0x1401a3614
cmp dword [rcx], 0
je 0x1401a3621
mov rax, rcx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov byte [rsp + 0x14], cl
call fcn.140062180
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
movzx ecx, byte [rsp + 0x14]
jmp fcn.1401a3580

Function at 0x1401aad30
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1401b5ed0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.1401b5ed0
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x1401aada0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x1404c8434]
mov r12, rcx
test ebx, ebx
jle 0x1401aaed0
mov rax, qword [0x1404c8438]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x1401aadec
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x1401aae73
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x1401aadd0
mov rcx, r12
call fcn.1401ab740
mov rsi, rax
test rax, rax
je 0x1401aaef2
mov rax, qword [0x1404c8438]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call fcn.1401ab870
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1404c8438]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1401aaed7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1401aae6c
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1401aae80
add dword [0x1404c8434], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x1404c8438]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1401aae6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1401aad30
nop dword [rax]
xor ebx, ebx
jmp 0x1401aadf7
mov rax, qword [0x1404c8438]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1401aad30
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.1401aad30
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1401ab3b0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x1404c84a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1404c8480]
test rbx, rbx
je 0x1401ab404
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x1401ab3fb
test r12, r12
je 0x1401ab3fb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1401ab3e0
lea rcx, [0x1404c84a0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1401ab740
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14046b500]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1401ab760
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1401ab768
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1401ab760
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x1401ab7b5
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1401ab7ac
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1401ab760
add rax, 0x28
cmp rax, r9
jne 0x1401ab798
xor eax, eax
ret

Function at 0x1401ab7c0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14046b500]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1401ab7e0
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1401ab7e8
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x1401ab7e0
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x1401ab870
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14046b500]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1401ab890
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x1401ab898
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x1401ad1f0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [0x14046b580]
mov rax, qword [rsi]
test rax, rax
je 0x1401ad280
cmp qword [rax + 0x30], 0
jne 0x1401ad2a0
lea rbx, [0x1401d6308]
mov qword [rax + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx], eax
mov rax, qword [rsi]
test rax, rax
je 0x1401ad250
cmp qword [rax + 0x30], 0
jne 0x1401ad270
lea rdx, [0x1401d6308]
mov qword [rax + 0x30], rdx
mov rax, rdx
cmp dword [rax], 0xffffffff
je 0x1401b6060
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.1401b20f0
mov r8, rax
mov rax, qword [rsi]
cmp qword [r8 + 0x30], 0
je 0x1401ad232
test rax, rax
jne 0x1401ad270
call fcn.1401b20f0
nop dword [rax]
mov rax, qword [rax + 0x30]
jmp 0x1401ad240
call fcn.1401b20f0
cmp qword [rax + 0x30], 0
mov rax, qword [rsi]
je 0x1401ad210
test rax, rax
jne 0x1401ad2a0
call fcn.1401b20f0
nop dword [rax]
mov rbx, qword [rax + 0x30]
jmp 0x1401ad21b
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
mov rax, qword [pe_dos_header]
ud2
Function at 0x1401ad2b0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x98
movabs rax, 0x6c6320726f727245
movabs rdx, 0x7520676e696e6165
mov qword [rsp + 0x20], rax
movabs rax, 0x6b5f6e6970732070
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20726f6620737965
mov qword [rsp + 0x30], rax
movabs rax, 0x20646165726874
mov qword [rsp + 0x38], rdx
xor edx, edx
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov word [rsp + 0x88], ax
mov byte [rsp + 0x8a], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x47]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x1401ad3c2
mov eax, 0x28
lea rcx, [rsp + 0x20]
jmp 0x1401ad39a
add rax, 1
cmp rax, 0x6b
je 0x1401ad3b7
cmp byte [rcx + rax], 0
movsxd rdx, eax
jne 0x1401ad390
cmp edx, 0x6a
je 0x1401ad3b7
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rdx + 0x20], 0xa
mov byte [rsp + rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov eax, 0x28
mov edx, 0x27
lea rcx, [rsp + 0x20]
jmp 0x1401ad3ab
Function at 0x1401addd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, qword [0x14046b580]
mov rax, qword [rsi]
test rax, rax
je 0x1401adfc0
cmp qword [rax + 0x28], 0
jne 0x1401adfa8
lea rcx, [0x1404c8558]
cmp dword [rcx], 1
mov qword [rax + 0x28], rcx
je 0x1401adfb5
call fcn.1401ad3e0
mov rax, qword [rsi]
test rax, rax
je 0x1401ade50
cmp qword [rax + 0x30], 0
jne 0x1401ade70
lea rdx, [0x1401d6308]
mov qword [rax + 0x30], rdx
mov rax, rdx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x1401ade84
mov rax, r12
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call fcn.1401b20f0
cmp qword [rax + 0x30], 0
mov rax, qword [rsi]
je 0x1401ade20
test rax, rax
jne 0x1401ade70
call fcn.1401b20f0
nop dword [rax]
mov rax, qword [rax + 0x30]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
jne 0x1401ade3e
call fcn.1401acf20
cmp qword [0x1404cc050], 0
mov rbx, rax
je 0x1401ade3e
test rax, rax
je 0x1401ade3e
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rbx + 0x70], eax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x38], 0xffffffffffffffff
lea rcx, [rbx + 0x68]
mov qword [rbx + 0x30], rax
call fcn.1401b3f90
cmp eax, 1
je 0x1401ae02d
mov rbp, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x68], 0xffffffffffffffff
mov dword [rbx + 0xb8], 0
mov qword [rbx + 0x28], 0
call rbp
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r12, rax
call rbp
mov dword [rsp + 0x30], 2
mov r8, rdi
mov rdx, r12
mov dword [rsp + 0x28], 0
mov rcx, rax
lea r9, [rbx + 0x28]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1401b6066
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0xc0], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
mov rax, qword [rsi]
test rax, rax
je 0x1401ae008
cmp qword [rax + 0x30], 0
je 0x1401adff0
mov rax, qword [rax + 0x30]
mov ecx, dword [rax]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1401b6066
mov r12, rbx
mov rax, r12
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rax + 0x28]
cmp dword [rcx], 1
jne 0x1401ade0c
mov rax, qword [rsi]
jmp 0x1401ade19
call fcn.1401b20f0
cmp qword [rax + 0x28], 0
mov rax, qword [rsi]
je 0x1401addf8
test rax, rax
jne 0x1401adfa8
call fcn.1401b20f0
mov rcx, qword [rax + 0x28]
cmp dword [rcx], 1
jne 0x1401ade0c
jmp 0x1401ade11
lea rdx, [0x1401d6308]
mov qword [rax + 0x30], rdx
mov rax, rdx
jmp 0x1401adf7e
call fcn.1401b20f0
mov r8, rax
mov rax, qword [rsi]
cmp qword [r8 + 0x30], 0
je 0x1401adff0
test rax, rax
jne 0x1401adf7a
call fcn.1401b20f0
jmp 0x1401adf7a
call fcn.1401ad2b0
nop word cs:[rax + rax]
nop dword [rax]
mov rax, qword [0x14046b580]
mov rdx, qword [rax]
lea rax, [0x1404c8568]
mov qword [rdx + 0x10], rax
ret
Function at 0x1401b1f70
Capabilities:
Print debug messages

Disassembly:
push r12
push rbx
sub rsp, 0x58
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1401b1f90
add rsp, 0x58
pop rbx
pop r12
ret
lea rdx, [rsp + 0x48]
mov r9d, 0x400
mov r8d, eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdx
mov ecx, 0x1100
xor edx, edx
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x1401b1fd8
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1401b1f84
int3
mov rcx, qword [rsp + 0x48]
mov rbx, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rbx
mov rcx, r12
call rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1401b1fc5
Function at 0x1401b20f0
Capabilities:
Check mutex on windows

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [0x1404c8640]
mov dword [rsp + 0x2c], eax
lea rcx, [rsp + 0x2c]
lea r9, [rsp + 0x30]
movzx eax, byte [rcx]
add rcx, 1
add rdx, 2
mov r8d, eax
and eax, 0xf
shr r8b, 4
add eax, 0x61
add r8d, 0x41
mov byte [rdx - 1], al
mov byte [rdx - 2], r8b
cmp rcx, r9
jne 0x1401b2113
lea rax, [0x1404c8648]
mov ecx, 0x5f
lea rdx, str.__shmem3_winpthreads_tdm_
lea r8, [rax + 0x1a]
jmp 0x1401b215b
movzx ecx, byte [rdx]
add rax, 1
add rdx, 1
mov byte [rax - 1], cl
cmp rax, r8
jne 0x1401b2158
lea rax, [0x1404c8680]
mov ecx, 0x5f
lea rdx, str.__shmem3_winpthreads_tdm_
lea r8, [rax + 0x19]
jmp 0x1401b218b
movzx ecx, byte [rdx]
add rax, 1
add rdx, 1
mov byte [rax - 1], cl
cmp rax, r8
jne 0x1401b2188
xor ecx, ecx
mov byte [0x1404c8699], 0x2d
movabs rax, 0x6161616161616161
movabs rdx, 0x6161616161616161
mov qword [0x1404c86a2], rdx
lea r8, [0x1404c8640]
lea rbx, [0x1404c869a]
mov qword [0x1404c86b2], rdx
mov qword [0x1404c86c2], rdx
mov qword [0x1404c86d2], rdx
xor edx, edx
mov qword [0x1404c869a], rax
mov qword [0x1404c86aa], rax
mov qword [0x1404c86ba], rax
mov qword [0x1404c86ca], rax
mov byte [0x1404c86da], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, 0xffffffff
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1401b2366
lea rcx, [0x1404c8680]
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x1401b22b1
lea rsi, [0x1404c8580]
lea r8, [0x1404c86da]
mov rax, rbx
lea ecx, [rbx + 0x40]
nop dword [rax]
mov edx, ecx
sub edx, eax
bt rsi, rdx
jae 0x1401b225d
mov byte [rax], 0x41
add rax, 1
cmp r8, rax
jne 0x1401b2250
lea rcx, [0x1404c8680]
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
je 0x1401b2353
lea rcx, [0x1401b2000]
mov qword [0x1404c8580], rsi
call sub.msvcrt.dll__onexit
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x1404c8580]
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
mov r8d, 0x5b
lea rdx, [0x1404c8680]
movzx ecx, ax
call qword [sym.imp.KERNEL32.dll_GetAtomNameA]
lea r8, [0x1404c86da]
xor edx, edx
lea r10d, [rbx + 0x40]
mov r11d, eax
mov r9d, 1
mov rax, rbx
test r11d, r11d
je 0x1401b2386
nop dword [rax]
cmp byte [rax], 0x41
jne 0x1401b2303
mov ecx, r10d
mov rbx, r9
sub ecx, eax
shl rbx, cl
or rdx, rbx
add rax, 1
cmp r8, rax
jne 0x1401b22f0
mov rax, rdx
mov qword [0x1404c8580], rax
lea rsi, [0x1404c8580]
jmp 0x1401b2329
cmp rdx, rsi
je 0x1401b228f
mov rdx, rax
mov rax, qword [rax + 8]
test rax, rax
jne 0x1401b2320
cmp rdx, rsi
je 0x1401b228f
mov qword [rdx + 8], rsi
lea rcx, [0x1401b2000]
call sub.msvcrt.dll__onexit
jmp 0x1401b228f
lea rcx, str.failed_to_add_string_to_atom_table_n
call fcn.1401b1f70
xor eax, eax
jmp 0x1401b22a8
lea rcx, str.failed_to_to_lock_creation_mutex_n
call fcn.1401b1f70
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
lea rcx, str.failed_to_get_string_from_atom_n
call fcn.1401b1f70
xor eax, eax
jmp 0x1401b230f
Function at 0x140001070
Capabilities:
Create process on windows
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
xor ebx, ebx
mov dword [rbp - 0x4c], 0x3a0041
xor edx, edx
mov word [rbp - 0x48], bx
mov r8d, 0x208
lea rcx, [rbp - 0x40]
mov edi, 0x41
call sub.VCRUNTIME140.dll_memset
lea rsi, [0x1400022e0]
nop word [rax + rax]
lea rcx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
jne 0x140001197
mov dword [rsp + 0x38], ebx
lea r9, [rbp - 0x50]
mov qword [rsp + 0x30], rbx
lea rcx, [rbp - 0x4c]
mov qword [rsp + 0x28], rbx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x140001197
mov eax, dword [rbp - 0x50]
lea r8, str._c_xcopy__lc:_D:usbfile_10u__e__f__s__y__d__c__h
movzx r9d, word [rbp - 0x4c]
lea rcx, [rbp - 0x40]
mov edx, 0x104
mov dword [rsp + 0x20], eax
call fcn.140001010
xorps xmm0, xmm0
mov dword [rsp + 0x40], 0x70
xor eax, eax
lea rcx, [rsp + 0x40]
movups xmmword [rsp + 0x54], xmm0
mov qword [rbp - 0x5c], rax
movups xmmword [rsp + 0x64], xmm0
mov dword [rbp - 0x54], eax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x60], rax
movups xmmword [rsp + 0x44], xmm0
mov qword [rsp + 0x58], rsi
movups xmmword [rsp + 0x74], xmm0
mov dword [rsp + 0x70], ebx
movups xmmword [rbp - 0x7c], xmm0
movups xmmword [rbp - 0x6c], xmm0
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x140001197
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140001197
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx eax, word [rbp - 0x4c]
cmp ax, 0x5a
jne 0x1400011b5
mov word [rbp - 0x4c], di
jmp 0x1400010d0
inc ax
mov word [rbp - 0x4c], ax
cmp ax, 0x5b
jb 0x1400010d0
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.140001200
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x140001b08
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001b52
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b52
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b52
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b52
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b52
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b54
xor al, al
add rsp, 0x28
ret
Function at 0x140003fc0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x12e0]
mov eax, 0x13e0
call fcn.14001f4a0
sub rsp, rax
mov rax, qword [0x14002e180]
xor rax, rsp
mov qword [rbp + 0x12d0], rax
mov rbx, rcx
cmp dword [0x1400311d8], 0
je 0x1400041aa
cmp qword [0x1400311e0], 0
jne 0x1400041aa
call fcn.1400041e0
test al, al
je 0x1400041aa
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.140003ea0
nop
mov rdx, qword [rsp + 0x28]
mov r9, qword [rsp + 0x30]
cmp rdx, r9
je 0x1400041ca
mov r8, qword [rdx]
cmp rbx, r8
jbe 0x140004061
mov rcx, qword [rdx + 0x18]
add rcx, r8
cmp rbx, rcx
jb 0x140004067
add rdx, 0x30
jmp 0x140004044
mov qword [0x1400311e0], r8
mov rax, qword [rdx + 0x18]
mov qword [0x1400311e8], rax
mov byte [0x1400311f0], 0
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x12c4], 0xffffffff
mov dword [rsp + 0x44], eax
mov edx, 1
mov r8d, 0x270
nop
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x44], eax
inc rdx
cmp rdx, r8
jb 0x1400040a0
mov dword [rsp + 0x40], r8d
lea r9, [rsp + 0x48]
nop word [rax + rax]
mov edx, dword [r9 - 4]
xor edx, dword [r9]
btr edx, 0x1f
xor edx, dword [r9 - 4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x630]
shr edx, 1
xor ecx, edx
mov dword [r9 + 0x9bc], ecx
lea r9, [r9 + 4]
sub r8, 1
jne 0x1400040d0
mov r8d, dword [rsp + 0x40]
mov ecx, dword [rsp + r8*4 + 0x44]
mov eax, ecx
shr eax, 0xb
and eax, dword [rbp + 0x12c4]
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov dword [0x1400311f4], eax
mov r8, qword [rsp + 0x28]
test r8, r8
je 0x1400041aa
mov rcx, qword [rsp + 0x38]
sub rcx, r8
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 4
mov rax, r8
cmp rdx, 0x1000
jb 0x1400041a2
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400041a2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r8
call fcn.14001e42c
mov rcx, qword [rbp + 0x12d0]
xor rcx, rsp
call fcn.14001e3d0
mov rbx, qword [rsp + 0x13f8]
add rsp, 0x13e0
pop rbp
ret
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]