joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14010a888
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov eax, 0xf000000
push rdi
ror byte [rdi], 0x29
sub dword [rsp + 0x50], eax
movups xmmword [rsp + 0xa8], xmm0
test al, 0
add byte [rax], al
movups xmmword [rsp + 0x98], xmm0
movups xmmword [rsp + 0x88], xmm0
mov byte [rax], al
add byte [rax], al
movups xmmword [rsp + 0x78], xmm0
js 0x14010a885
and al, 0x68
push 4
mov dword [rsp + 0xb0], 0x400010
adc byte [rax], al
add byte [rax - 0x75], cl
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x14010a8eb
invalid
mov edx, dword [rcx + 0x28]
mov dword [rsp + 0x90], edx
mov qword [rsp + 0x98], rax
add byte [rax], al
invalid
mov rax, qword [rcx + 0x30]
test rax, rax
je 0x14010a921
mov r8, qword [rcx + 0x40]
xor edx, edx
test r8, r8
je 0x14010a91a
lea r9, [0x1401f9598]
xor r10d, r10d
movzx r11d, byte [rax + r10]
or edx, dword [r9 + r11*4]
adc al, 0x99
inc r10
cmp r8, r10
jne 0x14010a909
mov dword [rsp + 0xa0], edx
mov r15, qword [rcx + 0x10]
lea rsi, [r15*8]
add byte [rbp - 0x7b], cl
invalid
je 0x14010a972
mov rax, r15
shr rax, 0x3c
jne 0x14010aa34
mov rbx, qword [rcx]
mov ecx, 8
mov rdx, rsi
mov edx, esi
call fcn.14010a250
test rax, rax
test eax, eax
je 0x14010aa3b
mov rdi, rax
xor eax, eax
mov rcx, qword [rbx + rax*8]
mov qword [rdi + rax*8], rcx
inc rax
cmp r15, rax
jne 0x14010a95d
invalid
mov eax, r15d
jmp 0x14010a979
xor eax, eax
mov edi, 8
lea rcx, [rsp + 0x68]
mov dword [rcx + 4], eax
mov qword [rcx + 8], rdi
lea rax, [rsp + 0x50]
and al, 0x50
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rcx
and qword [rsp + 0x40], 0
lea rdx, [0x1401cd433]
adc eax, 0xc2a8a
xor ecx, ecx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.secur32.dll_AcquireCredentialsHandleA]
test eax, eax
je 0x14010a9d0
mov ebx, eax
shl rbx, 0x20
or rbx, 2
mov r14d, 1
jmp 0x14010aa08
mov r14, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov ecx, 8
add byte [rax], al
add byte [rdx + 0x20], bh
call fcn.14010a250
test rax, rax
je 0x14010aa45
mov rbx, rax
mov eax, 1
mov qword [rbx], rax
add ecx, dword [rax - 0x77]
or byte [r9 + r9*4 + 0x73], cl
adc byte [rcx + rcx*4 + 0x63], cl
sbb byte [rbp + 0x31], al
invalid
test r15, r15
je 0x14010aa1d
mov edx, 8
mov rcx, rdi
stc
mov r8, rsi
call fcn.140002a42
mov rax, r14
mov rdx, rbx
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.140027030
ud2
mov ecx, 8
mov rdx, rsi
jmp 0x14010aa4f
mov ecx, 8
mov edx, 0x20
call fcn.14012dc60
ud2

Function at 0x14010b08b
Capabilities:
Get remote cert context via schannel

Disassembly:
sub rsp, 0x28
lea r8, [rsp + 0x20]
and qword [r8], 0
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
Function at 0x14010bf1b
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov eax, edx
lea r9, [rsp + 0x34]
mov dword [r9], r8d
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, eax
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x14010bf48
xor eax, eax
jmp 0x14010bf4d
call fcn.14005257a
nop
add rsp, 0x38
ret

Function at 0x14010d9c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov rsi, rcx
test r9, r9
leave
Function at 0x140114460
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
in al, dx
test al, 0
add byte [rax], al
invalid
Function at 0x140116fe0
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x140203298]
mov ecx, 0x10
mov edx, 8
call fcn.140122420
test rax, rax
je 0x1401170b7
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x140117150]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1401170a9
mov rcx, qword [rbx]
mov qword [rbp - 0x18], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x10], rax
call qword [rax]
mov rax, qword [rbp - 0x10]
cmp qword [rax + 8], 0
je 0x140117086
mov rdx, qword [rax + 0x10]
mov rcx, qword [rbp - 0x20]
call fcn.1401224b0
mov edx, 8
mov rcx, qword [rbp - 0x18]
call fcn.1401224b0
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], rdi
mov ecx, 8
mov edx, 0x10
call fcn.14012dc60
ud2

Function at 0x140117280
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x1401172c3
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, case.0x1400cf188.1110
mov qword [rbp - 0x28], rax
lea rax, str.fallback_RNG_broken:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.14012df70
ud2

Function at 0x14011a410
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x14011a445
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x14011a44a
call fcn.140117280
nop
add rsp, 0x38
ret

Function at 0x14011fa4e
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x14011fa55
test al, 1
je 0x14011fa74
test al, 2
jne 0x14011fa89
xor rax, 3
add rsp, 0x28
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1401d3018]
mov edx, 0x23
jmp 0x14011fa9c
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1401d3058]
mov edx, 0x25
call fcn.14012e130
ud2
Function at 0x14012033f
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, edx
call fcn.14011f363
mov rcx, qword [rax]
movzx eax, bl
lea r9, [rsp + 0x2c]
mov dword [r9], eax
mov dword [rsp + 0x20], 4
mov edx, 6
mov r8d, 1
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x14012037b
xor eax, eax
jmp 0x140120389
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
add rsp, 0x30
pop rbx
ret
Function at 0x1401205e6
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rdi, r9
mov rbx, r8
mov r14, rdx
mov qword [rsp + 0x28], rcx
mov rax, qword [rsp + 0xc0]
lea rbp, [rsp + 0x3a]
lea r13, [rsp + 0x52]
xor ecx, ecx
cmp qword [rdx + 0x18], 0xffffffffffffffff
lea r15, [rdx + 0x18]
cmove r15, rcx
mov r12d, 0x7fffffff
cmp rax, r12
cmovb r12, rax
lea rsi, [rsp + 0x30]
mov qword [rsp + 0x40], r15
mov rdx, qword [r14 + 0x10]
mov rcx, rsi
mov r8, rbx
call fcn.140120337
mov al, byte [rsp + 0x39]
cmp al, 3
je 0x140120758
mov rcx, qword [rsp + 0x30]
cmp al, 2
je 0x140120766
mov dl, byte [rsp + 0x38]
movzx r8d, word [rbp + 4]
mov word [r13 + 4], r8w
mov r8d, dword [rbp]
mov dword [r13], r8d
mov qword [rsp + 0x48], rcx
mov byte [rsp + 0x50], dl
mov byte [rsp + 0x51], al
mov rcx, r15
lea rdx, str.C:Usersmadf0x.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.35.1_srciopoll_evented.rsP
call fcn.1400463f1
mov rcx, qword [r15]
mov rdx, rdi
mov r8d, r12d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
jne 0x140120778
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov rcx, rsi
call fcn.140034738
cmp al, 0xd
jne 0x140120728
mov rax, qword [r15 + 8]
test rax, rax
je 0x140120728
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
lock inc qword [rdx]
jle 0x1401207aa
mov r15, r14
mov r14, rbx
add rcx, 0x10
mov r8, qword [rax + 0x10]
mov r9b, byte [rax + 0x18]
call fcn.140052dc7
mov rbx, rax
xor ecx, ecx
call fcn.140051580
test rbx, rbx
je 0x14012071d
mov ecx, 1
mov rdx, rsi
call fcn.140052eec
mov rsi, rbx
mov rbx, r14
mov r14, r15
mov r15, qword [rsp + 0x40]
mov rcx, rsi
call fcn.14011b457
cmp al, 0xd
jne 0x140120789
mov qword [rsp + 0x30], rsi
mov rcx, r14
lea rdx, [rsp + 0x48]
call fcn.1401200d4
lea rsi, [rsp + 0x30]
mov rcx, rsi
call fcn.14011b6d0
jmp 0x14012063c
mov rax, qword [rsp + 0x28]
mov qword [rax], 2
jmp 0x140120799
mov rax, qword [rsp + 0x28]
mov qword [rax], 1
mov qword [rax + 8], rcx
jmp 0x140120799
cdqe
mov rcx, qword [rsp + 0x28]
and qword [rcx], 0
mov qword [rcx + 8], rax
jmp 0x140120799
mov rax, qword [rsp + 0x28]
mov qword [rax], 1
mov qword [rax + 8], rsi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
Function at 0x2fc4d96f0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4da0f2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fc108]
test eax, eax
je 0x2fc4da18a
lea rax, [0x2fc4fc0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fc110]
mov qword [rbp - 8], rax
jmp 0x2fc4da16e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4da162
cmp qword [rbp - 0x10], 0
je 0x2fc4da162
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4da128
lea rax, [0x2fc4fc0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4da18b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4da290
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4da2b8
mov eax, 0
jmp 0x2fc4da306
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4da2e1
mov eax, 0
jmp 0x2fc4da306
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4da301
mov eax, 0
jmp 0x2fc4da306
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4da30c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4da38a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4da381
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4da381
mov rax, qword [rbp - 8]
jmp 0x2fc4da39f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4da354
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140004884
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.140012b50
mov r15, qword [0x140020514]
cmp r15, 1
jne 0x140004953
push qword [0x140020604]
pop rcx
call fcn.14000dd04
mov r15, rax
and r15, r15
jle 0x1400048e9
mov rcx, qword [0x140020604]
call fcn.14000dd0c
mov rcx, qword [0x140020604]
call fcn.14000dd20
or rax, rax
je 0x1400048e9
mov rbp, qword [0x14002060c]
push qword [rbp + 0x10]
pop rcx
call fcn.14000e1bc
jmp 0x1400048c6
push qword [0x1400205f4]
pop rcx
call fcn.14000dd04
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x140004953
push 5
push 0
push 1
push qword [0x1400205f4]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140009060
mov rcx, qword [0x1400205f4]
call fcn.14000dd0c
mov rcx, qword [0x1400205f4]
call fcn.14000dd20
or rax, rax
je 0x140004953
mov rbp, qword [0x1400205fc]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
jmp 0x140004930
mov rax, 1
jmp 0x14000495f
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140006b38
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f190]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021210]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020640]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020640]
call fcn.1400123b8
lea rcx, [0x140021210]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movsd dword [rdi], dword ds:[rsi]
pop rbx
xor bh, byte [rbx + 9]
jne 0x14003f6a3
cmp bh, byte [rdx + 0x65362cc0]
invalid
fstp qword [rsi + 0x432e5dc5]
outsb dx, byte [rsi]
cmp al, cl
leave
jne 0x14003f6d4
jl 0x14003f6e9
test r11, r13
test r11, r13
leave
sbb dword [rcx - 0x3c], 0x935a78ad
invalid
xchg edx, eax
scasd eax, dword [rdi]
mov edi, 0xe991ede3
movlps qword [rcx - 0x33752243], xmm3
movabs eax, dword [0xc04dc0ef5a8289cc]
invalid
invalid
invalid
rol r14b, 0x71
fbstp tbyte [rsi]
push 0xffffffffc75f400c
and byte [rsi - 0x32276e93], ah
in al, dx
xchg byte [rdi + 0x8acd17a], dh
mov byte [0xf14ecc19], dh
dec byte [rsp + rax*4 + 0x4b88c31f]
test byte [rdi], bl
ret
mov byte [rbx - 0x50], cl
insd dword [rdi], dx
mov word [rdi + rbx - 0x4fb4773d], es
insd dword [rdi], dx
test byte [rdi], bl
ret
and ah, cl
invalid
int3
lodsd eax, dword [rsi]
add al, byte [rcx + 0x204a647]
jmp 0x19ca60365
invalid
pop rsp
push 0xffffffffffffffdc
invalid
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140032b70]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140032b80]
mov dword [rax], 1
mov rax, qword [0x140032b90]
mov dword [rax], 1
mov rax, qword [0x140032b20]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140032b60]
mov dword [0x14003700c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x140032c40]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x140032c20]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x140032ac0]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x140001540
Capabilities:
Hide graphical window

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov dword [rsp + 0x24], 0
mov edx, dword [rsp + 0x24]
call qword [sym.imp.USER32.dll_ShowWindow]
nop
add rsp, 0x28
ret
Function at 0x1400020e0
Capabilities:
Enumerate processes

Disassembly:
sub rsp, 0x178
mov qword [rsp + 0x168], rcx
mov dword [rsp + 0x2c], 0
mov dword [rsp + 0x24], 2
mov edx, dword [rsp + 0x24]
mov ecx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x160], rax
mov rax, 0xffffffffffffffff
cmp rax, qword [rsp + 0x160]
jne 0x140002137
mov dword [rsp + 0x174], 0
jmp 0x1400021c0
mov dword [rsp + 0x30], 0x130
mov rcx, qword [rsp + 0x160]
lea rdx, [rsp + 0x30]
call sub.KERNEL32.dll_Process32First
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x1400021a7
mov rcx, qword [rsp + 0x168]
lea rdx, [rsp + 0x30]
add rdx, 0x2c
call sub.msvcrt.dll_strcmp
cmp eax, 0
jne 0x14000218c
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x2c], eax
jmp 0x1400021a7
mov rcx, qword [rsp + 0x160]
lea rdx, [rsp + 0x30]
call sub.KERNEL32.dll_Process32Next
mov dword [rsp + 0x28], eax
jmp 0x140002155
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x2c]
mov dword [rsp + 0x174], eax
mov eax, dword [rsp + 0x174]
add rsp, 0x178
ret

Function at 0x1400036d0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x18], rdx
mov dword [rsp + 0x14], 0
cmp dword [rsp + 0x14], 4
jae 0x140003794
mov dword [rsp + 0x10], 0
cmp dword [rsp + 0x10], 4
jae 0x14000377f
mov rax, qword [rsp + 0x18]
mov ecx, dword [rsp + 0x14]
shl rcx, 2
add rax, rcx
mov ecx, dword [rsp + 0x10]
mov al, byte [rax + rcx]
mov byte [rsp + 0xf], al
movzx eax, byte [rsp + 0xf]
mov ecx, 0x10
cdq
idiv ecx
movsxd rcx, eax
lea rax, str.cw
shl rcx, 4
add rax, rcx
mov qword [rsp], rax
movzx eax, byte [rsp + 0xf]
mov ecx, 0x10
cdq
idiv ecx
mov rax, qword [rsp]
movsxd rcx, edx
mov dl, byte [rax + rcx]
mov rax, qword [rsp + 0x18]
mov ecx, dword [rsp + 0x14]
shl rcx, 2
add rax, rcx
mov ecx, dword [rsp + 0x10]
mov byte [rax + rcx], dl
mov eax, dword [rsp + 0x10]
add eax, 1
mov dword [rsp + 0x10], eax
jmp 0x1400036f9
jmp 0x140003784
mov eax, dword [rsp + 0x14]
add eax, 1
mov dword [rsp + 0x14], eax
jmp 0x1400036e6
add rsp, 0x28
ret

Function at 0x140003a00
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x18], rdx
mov dword [rsp + 0x14], 0
cmp dword [rsp + 0x14], 4
jae 0x140003ac4
mov dword [rsp + 0x10], 0
cmp dword [rsp + 0x10], 4
jae 0x140003aaf
mov rax, qword [rsp + 0x18]
mov ecx, dword [rsp + 0x14]
shl rcx, 2
add rax, rcx
mov ecx, dword [rsp + 0x10]
mov al, byte [rax + rcx]
mov byte [rsp + 0xf], al
movzx eax, byte [rsp + 0xf]
mov ecx, 0x10
cdq
idiv ecx
movsxd rcx, eax
lea rax, [0x140032080]
shl rcx, 4
add rax, rcx
mov qword [rsp], rax
movzx eax, byte [rsp + 0xf]
mov ecx, 0x10
cdq
idiv ecx
mov rax, qword [rsp]
movsxd rcx, edx
mov dl, byte [rax + rcx]
mov rax, qword [rsp + 0x18]
mov ecx, dword [rsp + 0x14]
shl rcx, 2
add rax, rcx
mov ecx, dword [rsp + 0x10]
mov byte [rax + rcx], dl
mov eax, dword [rsp + 0x10]
add eax, 1
mov dword [rsp + 0x10], eax
jmp 0x140003a29
jmp 0x140003ab4
mov eax, dword [rsp + 0x14]
add eax, 1
mov dword [rsp + 0x14], eax
jmp 0x140003a16
add rsp, 0x28
ret
Function at 0x140003b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x48], 0
cmp qword [rsp + 0x48], 4
jae 0x140003b94
mov rax, qword [rsp + 0x48]
lea rcx, [rsp + 0x50]
shl rax, 2
add rcx, rax
xor edx, edx
mov r8d, 4
call sub.msvcrt.dll_memset
mov rax, qword [rsp + 0x48]
add rax, 1
mov qword [rsp + 0x48], rax
jmp 0x140003b57
mov qword [rsp + 0x40], 0
cmp qword [rsp + 0x40], 4
jae 0x140003c81
mov qword [rsp + 0x38], 0
cmp qword [rsp + 0x38], 4
jae 0x140003c69
mov qword [rsp + 0x30], 0
cmp qword [rsp + 0x30], 4
jae 0x140003c51
mov rcx, qword [rsp + 0x40]
lea rax, [0x140032180]
shl rcx, 2
add rax, rcx
mov rcx, qword [rsp + 0x38]
movzx eax, byte [rax + rcx]
mov ecx, eax
lea rax, [0x140031180]
shl rcx, 8
add rax, rcx
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x38]
shl rdx, 2
add rcx, rdx
mov rdx, qword [rsp + 0x30]
movzx ecx, byte [rcx + rdx]
movzx r8d, byte [rax + rcx]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
shl rcx, 2
add rax, rcx
mov rcx, qword [rsp + 0x30]
movzx edx, byte [rax + rcx]
xor edx, r8d
mov byte [rax + rcx], dl
mov rax, qword [rsp + 0x30]
add rax, 1
mov qword [rsp + 0x30], rax
jmp 0x140003bc7
jmp 0x140003c56
mov rax, qword [rsp + 0x38]
add rax, 1
mov qword [rsp + 0x38], rax
jmp 0x140003bb2
jmp 0x140003c6e
mov rax, qword [rsp + 0x40]
add rax, 1
mov qword [rsp + 0x40], rax
jmp 0x140003b9d
mov qword [rsp + 0x28], 0
cmp qword [rsp + 0x28], 4
jae 0x140003cbf
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x28]
mov edx, dword [rsp + rdx*4 + 0x50]
mov dword [rax + rcx*4], edx
mov rax, qword [rsp + 0x28]
add rax, 1
mov qword [rsp + 0x28], rax
jmp 0x140003c8a
add rsp, 0x78
ret

Function at 0x140003d80
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub rsp, 0x20
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x10], rdx
mov dword [rsp + 0xc], 0
cmp dword [rsp + 0xc], 4
jge 0x140003e09
mov rax, qword [rsp + 0x10]
movsxd rcx, dword [rsp + 0xc]
movzx eax, byte [rax + rcx]
mov ecx, 0x10
cdq
idiv ecx
movsxd rcx, eax
lea rax, str.cw
shl rcx, 4
add rax, rcx
mov qword [rsp], rax
mov rax, qword [rsp + 0x10]
movsxd rcx, dword [rsp + 0xc]
movzx eax, byte [rax + rcx]
mov ecx, 0x10
cdq
idiv ecx
mov rax, qword [rsp]
movsxd rcx, edx
mov dl, byte [rax + rcx]
mov rax, qword [rsp + 0x10]
movsxd rcx, dword [rsp + 0xc]
mov byte [rax + rcx], dl
mov eax, dword [rsp + 0xc]
add eax, 1
mov dword [rsp + 0xc], eax
jmp 0x140003d96
add rsp, 0x20
ret