joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404d9377
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
bswap eax
movsx eax, bp
mov qword [rsp + 0x18], rbp
cdqe
setge ah
nop
push rsi
setno al
movsx ax, r15b
push rdi
movzx eax, r14w
movzx rax, bx
push r14
mov eax, 0x1450
jmp 0x1404d93ab
call fcn.14044567a
sub rsp, rax
bts r10, r8
jmp 0x1404d93c0
mov rax, qword [0x1400b7288]
movsx edi, r8w
xor rax, rsp
shr rdi, cl
shl bpl, 0x31
sal r14b, 0x60
mov qword [rsp + 0x1440], rax
movsx rsi, r13w
movsxd r10, edx
mov rdi, rcx
mov rax, r10
xor bp, 0x4856
mov ebp, r9d
rcr r14b, 0x40
sar rax, 6
cmp r12w, r11w
cmc
lea rcx, [0x1400ba940]
and r10d, 0x3f
add esi, edx
neg dh
sal dx, cl
lea rbp, [rbp + r8]
mov rsi, r8
mov rax, qword [rcx + rax*8]
movzx r14w, dl
lea rdx, [r10 + r10*8]
and r14w, 0x638e
bt r14, 0x4e
mov r14, qword [rax + rdx*8 + 0x28]
clc
cmp bh, 0x2e
test r13b, dl
sub eax, eax
jmp 0x1404d9448
mov qword [rdi], rax
cmc
stc
mov dword [rdi + 8], eax
test r11b, 0xa0
cmp r8, rbp
jmp 0x1404d945c
jae 0x1404d9566
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jmp 0x1404d946f
jae 0x1404d94cf
mov al, byte [rsi]
jmp 0x1404d947c
inc rsi
cmp dil, 0x85
test bpl, 0x51
stc
cmp al, 0xa
jmp 0x1404d948f
jne 0x1404d94a8
inc dword [rdi + 8]
mov byte [rbx], 0xd
jmp 0x1404d94a0
inc rbx
jmp 0x1404d94a8
mov byte [rbx], al
inc rbx
shr al, 0x45
bsf ax, sp
cmp r15b, 0x57
lea rax, [rsp + 0x143f]
clc
cmp rbx, rax
jmp 0x1404d94c9
jb 0x1404d9467
and qword [rsp + 0x20], 0
sar dh, cl
lea rax, [rsp + 0x40]
sar rdx, 0xea
or r8w, bp
sub dl, r14b
sub ebx, eax
cdq
mov r8d, r14d
cwd
lea r9, [rsp + 0x30]
movsxd rcx, r15d
movzx ecx, r9w
mov r8d, ebx
xchg dh, dl
movzx ecx, r8w
lea rdx, [rsp + 0x40]
seto cl
movsx rcx, r14w
movzx rcx, r12w
mov rcx, r14
jmp 0x1404d951c
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404d9529
je 0x1404d9556
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp eax, ebx
jmp 0x1404d953d
jb 0x1404d9566
cmp rsi, rbp
jmp 0x1404d954b
jb 0x1404d9462
jmp 0x1404d9566
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
adc ax, 0xfa4
shl cx, 0x8f
mov rax, rdi
jmp 0x1404d9573
mov rcx, qword [rsp + 0x1440]
test r12b, 0x3a
clc
test bl, r12b
xor rcx, rsp
jmp 0x1404d958b
call fcn.14049cc19
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
bswap edi
mov r14w, ax
xchg sil, r14b
mov rbp, qword [r11 + 0x30]
not dil
movzx r14w, al
cmovno di, dx
mov rsp, r11
mov sil, 0x2d
bswap di
pop r14
movzx esi, r12w
cmovne edi, r11d
mov sil, sil
pop rdi
movzx rsi, r14w
movsx si, r12b
movzx esi, r9w
pop rsi
jmp 0x1404d95df
ret
Function at 0x1404d95e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
movzx rax, r11w
movzx ax, r11b
movsx eax, r10w
push rsi
cdqe
cbw
push rdi
cmovbe eax, eax
not al
push r14
mov eax, 0x1450
jmp 0x1404d960e
call fcn.14044567a
sub rsp, rax
btc r14d, 0x5b
mov rax, qword [0x1400b7288]
xor rax, rsp
test bp, 0x6193
shr r14b, 0xd9
mov qword [rsp + 0x1440], rax
shr sil, cl
dec si
movsxd r10, edx
seta r14b
jmp 0x1404d964d
mov rdi, rcx
mov rax, r10
sbb sil, 0x3c
mov ebp, r9d
sar rax, 6
lea rcx, [0x1400ba940]
sal r14b, 0xa
movzx si, r10b
and r10d, 0x3f
bt edx, 0x1c
add rbp, r8
sal sil, 0xbd
mov rsi, r8
neg dh
shrd r14, r8, 0xa4
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
jmp 0x1404d9697
mov r14, qword [rax + rdx*8 + 0x28]
test r13d, ebp
jmp 0x1404d96a4
sub eax, eax
test r10d, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
clc
cmp r8, rbp
jmp 0x1404d96b8
jae 0x1404d9801
lea rbx, [rsp + 0x40]
jmp 0x1404d96c8
cmp rsi, rbp
jmp 0x1404d96d0
jae 0x1404d9759
movzx eax, word [rsi]
cmp rdx, r13
stc
jmp 0x1404d96e2
add rsi, 2
jmp 0x1404d96ef
cmp ax, 0xa
jmp 0x1404d96f8
jne 0x1404d9733
add dword [rdi + 8], 2
xor ecx, 0x3b0f35ed
bsr ecx, r13d
mov ecx, 0xd
test ax, r11w
mov word [rbx], cx
cmp rdx, 0x20474769
stc
test edi, 0x74752e9f
add rbx, 2
test r10b, r10b
cmp r15w, 0x6764
mov word [rbx], ax
add rbx, 2
rcl ah, cl
cmc
bsf rax, r12
lea rax, [rsp + 0x143e]
cmc
stc
cmp rbx, rax
jmp 0x1404d9753
jb 0x1404d96c8
and qword [rsp + 0x20], 0
cdqe
ror r8b, cl
or cx, 0x1f15
lea rax, [rsp + 0x40]
sub rbx, rax
lea r9, [rsp + 0x30]
shl r8w, cl
shr dl, 0x94
sar rbx, 1
shl dl, cl
lea rdx, [rsp + 0x40]
add ebx, ebx
jmp 0x1404d9793
mov rcx, r14
movzx r8w, r14b
not r8b
mov r8d, ebx
jmp 0x1404d97a6
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404d97b3
je 0x1404d97e8
mov eax, dword [rsp + 0x30]
test r8b, spl
stc
add dword [rdi + 4], eax
cmp dil, 0xff
cmp eax, ebx
jmp 0x1404d97cf
jb 0x1404d9801
cmp rsi, rbp
jmp 0x1404d97dd
jb 0x1404d96be
jmp 0x1404d9801
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
test r15d, 0x30cd1f0c
rol cl, 0x43
or rcx, 0x4ad54075
mov rax, rdi
adc rcx, r8
bsf cx, sp
mov rcx, qword [rsp + 0x1440]
jmp 0x1404d9818
xor rcx, rsp
call fcn.14049cc19
lea r11, [rsp + 0x1450]
jmp 0x1404d9833
mov rbx, qword [r11 + 0x20]
sete r14b
mov rbp, qword [r11 + 0x30]
cmovle edi, r13d
movsx di, al
not esi
mov rsp, r11
movzx r14, dx
mov sil, 0xb0
pop r14
movsxd rdi, r13d
xchg edi, edi
mov si, r14w
pop rdi
movzx rsi, bx
movsxd rsi, r10d
pop rsi
jmp 0x1404d986c
ret
Function at 0x1404d986d
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
movsx ax, bl
cdqe
push rsi
mov al, sil
push rdi
push r12
movzx eax, r11w
movzx rax, r15w
cdqe
push r14
push r15
not ax
movsx rax, cx
mov eax, 0x1470
jmp 0x1404d98a3
call fcn.14044567a
sub rsp, rax
mov rax, qword [0x1400b7288]
sbb ebx, esi
xor rax, rsp
bt r10d, 0xcf
adc bx, r9w
mov qword [rsp + 0x1460], rax
add r10, rdi
xchg bl, r12b
movsxd r10, edx
test r13d, eax
mov rbx, rcx
shl cx, cl
or cl, spl
rol dx, cl
mov rax, r10
sal ch, 0x23
mov r14d, r9d
sar rax, 6
ror dh, cl
lea rcx, [0x1400ba940]
bswap r12
movzx edx, r8w
and r10d, 0x3f
lea r14, [r14 + r8]
cmc
shrd edx, esp, 0xab
test r11, r15
mov r15, r8
bswap dx
setno r12b
mov rdi, r8
xchg r12b, dl
movzx dx, sil
mov rax, qword [rcx + rax*8]
and dl, 0x3e
not edx
cqo
lea rdx, [r10 + r10*8]
test cx, si
adc r12b, r9b
mov r12, qword [rax + rdx*8 + 0x28]
xor eax, eax
mov qword [rbx], rax
jmp 0x1404d9949
cmp r8, r14
jmp 0x1404d9951
mov dword [rbx + 8], eax
jae 0x1404d9af3
lea rax, [rsp + 0x50]
clc
cmp rdi, r14
jmp 0x1404d9968
jae 0x1404d99b6
movzx ecx, word [rdi]
add rdi, 2
cmp cx, 0xa
jne 0x1404d998c
mov edx, 0xd
mov word [rax], dx
add rax, 2
clc
mov word [rax], cx
shl ecx, 0x73
ror ch, 0x1a
add rax, 2
or cl, bh
shr cl, 0x76
lea rcx, [rsp + 0x6f8]
clc
test r12w, 0x2ee9
cmp rax, rcx
jb 0x1404d9960
and qword [rsp + 0x38], 0
bt rcx, 0x4f
lea rcx, [rsp + 0x50]
sar r9, cl
shr r8b, cl
and qword [rsp + 0x30], 0
movzx r9, r14w
bts r9w, r13w
lea r8, [rsp + 0x50]
sub rax, rcx
mov dword [rsp + 0x28], 0xd55
sar r9, 0x9d
lea rcx, [rsp + 0x700]
shrd r9, r10, 0x95
ror r9, cl
sar rax, 1
btr r9w, si
movsxd r9, ecx
mov qword [rsp + 0x20], rcx
mov r9d, eax
jmp 0x1404d9a1a
mov ecx, 0xfde9
xor edx, edx
jmp 0x1404d9a26
call fcn.1404c6710
mov ebp, eax
clc
jmp 0x1404d9a33
test eax, eax
jmp 0x1404d9a3a
je 0x1404d9ae6
xor esi, esi
cmp sil, dl
test r14b, cl
jmp 0x1404d9a4d
test eax, eax
jmp 0x1404d9a54
je 0x1404d9ac5
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x700]
test ax, 0x1128
inc r8d
mov ecx, esi
lea r9, [rsp + 0x40]
test esp, 0x70c34901
btr r8w, bx
mov r8d, ebp
stc
add rdx, rcx
mov rcx, r12
cmp cx, sp
sub r8d, esi
jmp 0x1404d9a96
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404d9aa3
je 0x1404d9ae6
add esi, dword [rsp + 0x40]
cmp r14d, r12d
test ah, 0x9e
jmp 0x1404d9ab8
cmp esi, ebp
jmp 0x1404d9abf
jb 0x1404d9a5a
mov eax, edi
cmc
sub eax, r15d
mov dword [rbx + 4], eax
test ch, 0xf3
jmp 0x1404d9ad9
cmp rdi, r14
jmp 0x1404d9ae1
jmp 0x1404d9954
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
bts cx, r10w
mov rax, rbx
mov rcx, qword [rsp + 0x1460]
cmp r13b, r13b
cmp dx, 0x1105
jmp 0x1404d9b0b
xor rcx, rsp
jmp 0x1404d9b13
call fcn.14049cc19
lea r11, [rsp + 0x1470]
movzx si, bl
movsx edi, r8w
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
movsx r12w, al
mov rsp, r11
setne r15b
pop r15
jmp 0x1404d9b4b
pop r14
mov r12b, r12b
xchg r12b, sil
pop r12
cmovp si, bp
movsx rdi, r12w
bswap di
pop rdi
movsxd rsi, esi
not esi
pop rsi
jmp 0x1404d9b6c
ret
Function at 0x1404dd17a
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
movzx r9d, ax
mov rbx, rcx
cmp r12b, sil
bsr r8d, ebp
lea r9, [0x1400c8e90]
add dh, 0xbe
cwd
not dx
xor ecx, ecx
cdq
mov r8d, 0xd4050c5
lea r8, [0x1400c8e88]
movsxd rdx, ebp
not dh
lea rdx, [0x1400cfb70]
jmp 0x1404dd1be
call fcn.1404dd466
test rax, rax
jmp 0x1404dd1cb
je 0x1404dd1e7
mov rcx, rbx
add rsp, 0x20
not bl
pop rbx
jmp 0x1404dd1e0
push qword [0x1400b8d90]
ret
add rsp, 0x20
movsx bx, bpl
mov rbx, r15
xchg ebx, ebx
pop rbx
jmp 0x1404dd1fb
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1404dd306
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
bsf r9w, r11w
push rdi
bts r8w, bx
add r8w, dx
jmp 0x1404dd31f
sub rsp, 0x20
mov rbx, rdx
movzx r8w, sil
cmovp di, r12w
movzx edx, r14w
lea r9, [0x1400c8ea8]
movsx rdx, si
xchg di, dx
mov edi, ecx
lea rdx, [0x1400cf748]
jmp 0x1404dd354
mov ecx, 3
setge r8b
lea r8, [0x1400c8ea0]
jmp 0x1404dd369
call fcn.1404dd466
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x1404dd387
call qword [0x1400b8d90]
jmp 0x1404dd38d
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
movsx edi, r13w
mov dil, dil
add rsp, 0x20
pop rdi
ret
Function at 0x1404e1512
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub r10b, 0x70
sal r10b, 0x6d
stc
sub rsp, 0x30
sub eax, eax
sbb r10b, bl
bt r10d, 6
sub r10b, 0xbb
mov r10d, ecx
test rdx, rdx
jmp 0x1404e153a
jne 0x1404e1575
call fcn.1404b26aa
mov ebx, 0x16
jmp 0x1404e154f
mov dword [rax], ebx
jmp 0x1404e1556
call fcn.1404b331d
mov eax, ebx
adc bl, r12b
add rsp, 0x30
mov bl, 0x99
movzx bx, bh
movsx ebx, r13w
pop rbx
jmp 0x1404e1574
ret
test r8, r8
jmp 0x1404e157d
je 0x1404e1540
movzx ecx, byte [rsp + 0x60]
mov word [rdx], ax
inc ah
xor ah, 0xb1
movsx eax, dx
lea rax, [rcx + 1]
stc
cmp r8, rax
jmp 0x1404e15a0
ja 0x1404e15ba
call fcn.1404b26aa
mov ebx, 0x22
jmp 0x1404e15b5
jmp 0x1404e154f
lea eax, [r9 - 2]
shld ebx, r15d, 0xc2
or bh, 0x46
mov ebx, 0x22
cmp eax, ebx
jmp 0x1404e15d2
ja 0x1404e1540
mov byte [rsp + 0x60], cl
adc bh, 0xed
movzx rbx, bp
mov ecx, r10d
cmp r15b, dil
or bl, r10b
add rsp, 0x30
pop rbx
jmp 0x1404e15f6
mov qword [rsp + 8], rbx
xchg bh, bl
or rbx, 0x272905a0
mov qword [rsp + 0x10], rbp
shld r10w, r15w, 0x3f
sub bp, bp
btc r10w, 0x4f
mov qword [rsp + 0x18], rsi
stc
push rdi
push r14
adc ebx, r10d
shr bx, 0x27
btr ebx, r15d
push r15
inc r10d
sub rsp, 0x20
btc rbp, 0x96
mov bp, r9w
sub r15d, r15d
or ebp, r12d
mov ebp, r9d
mov bx, 0x24a1
mov rdi, r8
bt r11d, r12d
mov r11, rdx
mov r10, rdx
mov ebx, r15d
cmc
test ebp, esp
cmp byte [rsp + 0x60], r15b
jmp 0x1404e1668
je 0x1404e168c
lea eax, [r15 + 0x2d]
neg ecx
stc
mov word [rdx], ax
lea ebx, [rax - 0x2c]
shl r8, cl
lea r10, [rdx + 2]
cmp r12b, 0x25
add r8b, 0xfd
ror esi, cl
mov r8, r10
rcl ax, 0xb5
sub r9b, 0xf9
cwde
sub edx, edx
cmc
adc ah, 0x33
lea rsi, [r10 + 2]
shr r14w, 0x5e
btr r9d, 0x2a
rcr r9b, cl
mov eax, ecx
sal ch, 0x50
bt ecx, r15d
not cx
mov r9, r10
sal ch, 0x9b
div ebp
bt r14w, 0xc6
add r14d, 0x37fc6829
mov ecx, eax
movsxd rax, r8d
or al, r14b
sub eax, r8d
cmp edx, 9
cbw
mov r14d, r14d
mov eax, 0x57
setl r14b
lea r14d, [rax - 0x27]
jmp 0x1404e16f5
cmovbe ax, r14w
jmp 0x1404e16ff
inc rbx
add ax, dx
test dx, si
cmp sil, r8b
mov word [r10], ax
stc
test ecx, ecx
jmp 0x1404e1717
je 0x1404e172e
mov r10, rsi
cmp rbx, rdi
jmp 0x1404e1728
jb 0x1404e1698
cmp rbx, rdi
jmp 0x1404e1736
jb 0x1404e176c
mov word [r11], r15w
jmp 0x1404e1745
call fcn.1404b26aa
mov ebx, 0x22
jmp 0x1404e1754
mov dword [rax], ebx
jmp 0x1404e175b
call fcn.1404b331d
mov eax, ebx
jmp 0x1404e1767
jmp 0x1404e17c0
mov word [rsi], r15w
movsx rcx, r12w
add ax, 0x6b65
shr al, 0x7a
movzx eax, word [r8]
mov cl, r14b
bswap cx
movzx ecx, word [r9]
test rbp, r14
cmc
mov word [r9], ax
stc
cmc
sub r9, 2
mov word [r8], cx
stc
add r8, 2
test r15b, r13b
jmp 0x1404e17ab
cmp r8, r9
jb 0x1404e177b
sub eax, eax
shr rbx, 0xff
mov ebp, r12d
ror r14b, cl
mov rbx, qword [rsp + 0x40]
btc edi, edx
btc r15d, 0x7d
cmp di, 0x77c4
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
movsx rdi, sp
btr r14w, 0xd8
add rsp, 0x20
mov r15b, 0x1a
pop r15
movsxd r14, edx
pop r14
pop rdi
ret
Function at 0x1400037b0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x1400037e4
cmp word [rcx], 0x5a4d
jne 0x1400037e4
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x1400037e4
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400037e4
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.1400036f0
test eax, eax
jne 0x140003800
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140003760
test rax, rax
je 0x1400037f5
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.140003fa6
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x140003eb0
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140003e50
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140004314
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x140983398]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x140983394]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x140004362
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14000435a
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140004449
inc ebx
add rax, 0x28
jmp 0x14000433a
mov rcx, r12
call fcn.140004b41
mov rbp, rax
test rax, rax
jne 0x140004381
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.1400042b0
movsxd rbx, ebx
mov rax, qword [0x140983398]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.140004bef
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x140983398]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1400043e3
mov rax, qword [0x140983398]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400042b0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140004443
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140004443
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x140983398]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140004443
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400042b0
inc dword [0x140983394]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140004870
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x140983400]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1409833e0]
test rbx, rbx
je 0x1400048bc
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x1400048b6
test eax, eax
jne 0x1400048b6
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x14000488e
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140004a70
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140004a93
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140004a93
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140004a94
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x140004ace
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x140004ac5
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140004ad0
inc r8d
add rax, 0x28
jmp 0x140004aac
xor eax, eax
ret

Function at 0x140004b41
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x140980610]
mov r8, rcx
mov rcx, r9
call fcn.140004a70
test eax, eax
je 0x140004b6d
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140004a94
xor eax, eax
add rsp, 0x28
ret
Function at 0x140002de0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140004850
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140004850
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140002e50
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14000a0a4]
mov rbx, rcx
test esi, esi
jle 0x140002f80
mov rax, qword [0x14000a0a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140002e9b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140002f25
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140002e80
mov rcx, rbx
call fcn.1400038a0
mov rdi, rax
test rax, rax
je 0x140002fa2
mov rax, qword [0x14000a0a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.1400039e0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000a0a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140002f87
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140002f1e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140002f30
add dword [0x14000a0a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000a0a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140002f1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140002de0
nop dword [rax]
xor esi, esi
jmp 0x140002ea8
mov rax, qword [0x14000a0a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140002de0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140002de0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140003510
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14000a100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000a0e0]
test rbx, rbx
je 0x14000356c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140003563
test rsi, rsi
je 0x140003563
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140003548
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1400038a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140006b00]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400038c0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400038c8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400038c0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000391d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140003914
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400038c0
add rax, 0x28
cmp rax, r9
jne 0x140003900
xor eax, eax
ret

Function at 0x140003920
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006b00]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000393f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140003948
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000393f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400039e0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006b00]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400039ff
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140003a08
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x180001000
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
mov al, byte [rdx]
mov byte [rcx], al
mov al, byte [rdx + 1]
mov byte [rcx + 1], al
mov al, byte [rdx + 2]
mov byte [rcx + 2], al
mov al, byte [rdx + 3]
mov byte [rcx + 3], al
mov al, byte [rdx + 4]
mov byte [rcx + 4], al
mov al, byte [rdx + 5]
mov byte [rcx + 5], al
mov al, byte [rdx + 6]
mov byte [rcx + 6], al
mov al, byte [rdx + 7]
mov byte [rcx + 7], al
mov al, byte [rdx + 8]
mov byte [rcx + 8], al
mov al, byte [rdx + 9]
mov byte [rcx + 9], al
mov al, byte [rdx + 0xa]
mov byte [rcx + 0xa], al
mov al, byte [rdx + 0xb]
mov byte [rcx + 0xb], al
mov al, byte [rdx + 0xc]
mov byte [rcx + 0xc], al
mov al, byte [rdx + 0xd]
mov byte [rcx + 0xd], al
mov al, byte [rdx + 0xe]
mov byte [rcx + 0xe], al
mov al, byte [rdx + 0xf]
mov byte [rcx + 0xf], al
mov al, byte [rdx + 0x10]
mov byte [rcx + 0x10], al
mov al, byte [rdx + 0x11]
mov byte [rcx + 0x11], al
mov al, byte [rdx + 0x12]
mov byte [rcx + 0x12], al
mov al, byte [rdx + 0x13]
mov byte [rcx + 0x13], al
mov al, byte [rdx + 0x14]
mov byte [rcx + 0x14], al
mov al, byte [rdx + 0x15]
mov byte [rcx + 0x15], al
mov al, byte [rdx + 0x16]
mov byte [rcx + 0x16], al
mov al, byte [rdx + 0x17]
mov byte [rcx + 0x17], al
mov al, byte [rdx + 0x18]
mov byte [rcx + 0x18], al
mov al, byte [rdx + 0x19]
mov byte [rcx + 0x19], al
mov al, byte [rdx + 0x1a]
mov byte [rcx + 0x1a], al
mov al, byte [rdx + 0x1b]
mov byte [rcx + 0x1b], al
mov al, byte [rdx + 0x1c]
mov byte [rcx + 0x1c], al
mov al, byte [rdx + 0x1d]
mov byte [rcx + 0x1d], al
mov al, byte [rdx + 0x1e]
mov byte [rcx + 0x1e], al
mov al, byte [rdx + 0x1f]
mov byte [rcx + 0x1f], al
mov eax, 8
lea r9, str.cw
lea r8, [0x18001f440]
jmp 0x180001121
movzx ebx, byte [r15 + r9]
movzx r10d, byte [r14 + r9]
movzx r11d, byte [rsi + r9]
movzx edx, byte [rdi + r9]
xor bl, byte [rcx + rax*4 - 0x20]
mov byte [rcx + rax*4], bl
xor r10b, byte [rcx + rax*4 - 0x1f]
mov byte [rcx + rax*4 + 1], r10b
xor r11b, byte [rcx + rax*4 - 0x1e]
mov byte [rcx + rax*4 + 2], r11b
xor dl, byte [rcx + rax*4 - 0x1d]
mov byte [rcx + rax*4 + 3], dl
add rax, 1
cmp rax, 0x3c
je 0x180001173
movzx ebx, byte [rcx + rax*4 - 4]
movzx r10d, byte [rcx + rax*4 - 3]
movzx r15d, bl
movzx r14d, r10b
movzx r11d, byte [rcx + rax*4 - 2]
movzx esi, r11b
movzx edx, byte [rcx + rax*4 - 1]
movzx edi, dl
mov ebp, eax
and ebp, 7
cmp ebp, 4
je 0x1800010e0
test ebp, ebp
jne 0x1800010f4
movzx r10d, byte [rsi + r9]
movzx r11d, byte [rdi + r9]
movzx edx, byte [r15 + r9]
mov esi, eax
shr esi, 3
movzx ebx, byte [rsi + r8]
xor bl, byte [r14 + r9]
jmp 0x1800010f4
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret