joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f360
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
call fcn.0040f350
mov ebx, eax
test ebx, ebx
je 0x40f3ab
cmp dword [0x0047c538], 0xffffffff
jne 0x40f384
mov ecx, 0xe2
call fcn.00409e90
mov ecx, ebx
call fcn.0040f330
test rax, rax
jne 0x40f39d
mov ecx, 0xe2
call fcn.00409e90
jmp 0x40f3ab
mov ecx, dword [0x0047c538]
mov rdx, rax
call sub.kernel32.dll_TlsSetValue
add rsp, 0x20
pop rbx
ret

Function at 0x40f3c0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp byte [0x0048ed54], 0
je 0x40f3fb
mov ecx, dword [0x0047c538]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x40f40f
call fcn.0040f360
mov ecx, dword [0x0047c538]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x40f40f
mov rax, qword [0x0048ed88]
jmp 0x40f40f
mov rax, qword gs:[0x58]
movsxd rcx, dword [0x0047c538]
mov rax, qword [rax + rcx*8]
add rsp, 0x28
ret

Function at 0x4222e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov esi, edx
xor rdi, rdi
mov rcx, rbx
call fcn.0040b300
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
mov r13d, eax
cmp r13d, 0xffffffff
je 0x4223e9
mov eax, r13d
test eax, 0x400
jne 0x42232a
test r13d, 0x10
setne dil
jmp 0x42240a
test sil, sil
je 0x42238a
mov rcx, rbx
call fcn.0040b300
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x2000000
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
cmp rax, 0xffffffffffffffff
je 0x42240a
mov rcx, rax
call sub.kernel32.dll_CloseHandle_1
test r13d, 0x10
setne dil
jmp 0x42240a
test r13d, 0x10
je 0x422398
mov dil, 1
jmp 0x42240a
mov rcx, rbx
call fcn.0040b300
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x2000000
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
cmp rax, 0xffffffffffffffff
je 0x4223e4
mov rcx, rax
call sub.kernel32.dll_CloseHandle_1
xor rdi, rdi
jmp 0x42240a
mov dil, 1
jmp 0x42240a
call sub.kernel32.dll_GetLastError_2
cmp eax, 2
je 0x422402
cmp eax, 3
je 0x422402
cmp eax, 0x7b
je 0x422402
cmp eax, 0x35
jne 0x422407
xor rdi, rdi
jmp 0x42240a
mov dil, 1
mov eax, edi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r13
ret

Function at 0x4226d0
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
call fcn.0040b300
mov rcx, rax
xor rdx, rdx
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x4226f0
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call fcn.0040b300
mov rcx, rax
call sub.kernel32.dll_RemoveDirectoryW
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x4287b0
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
sub rsp, 0x38
mov rbp, rsp
mov ebx, r8d
lea r8, [rbp + 0x2c]
mov r9d, 2
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x4287d7
movzx rax, word [rbp + 0x2c]
jmp 0x4287d9
mov eax, ebx
lea rsp, [rbp + 0x38]
pop rbx
pop rbp
ret
Function at 0x429a90
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x8e0
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rdx
mov qword [rbp + 0x58], 0
nop
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
lea r8, [rbp + 0x60]
mov r9d, 0x400
call fcn.00429840
mov ebx, eax
mov rax, qword [0x00489048]
cmp byte [rax], 0
je 0x429bc8
mov rcx, qword [0x00488d68]
call fcn.00406ab0
call fcn.00405b70
mov ecx, 1
xor rdx, rdx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte_1
mov esi, eax
lea rcx, [rbp + 0x58]
mov rdx, qword [0x00429a48]
mov r8d, 1
movsxd r9, esi
call fcn.0040ca70
mov ecx, 1
xor rdx, rdx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte_1
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle_1
mov rcx, rax
mov rdx, qword [rbp + 0x58]
mov r8d, esi
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile_1
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle_1
mov rcx, rax
lea rdx, [0x00429c64]
mov r8d, 2
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile_1
jmp 0x429c0e
mov rcx, qword [0x0048ed58]
call fcn.0040cbd0
mov rcx, rax
mov rax, qword [0x00488cf8]
mov edx, dword [rax + 8]
lea r8, [rbp + 0x860]
mov r9d, 0x40
call sub.user32.dll_LoadStringW_1
xor rcx, rcx
lea rdx, [rbp + 0x60]
lea r8, [rbp + 0x860]
mov r9d, 0x2010
call sub.user32.dll_MessageBoxW
nop
lea rcx, [rbp + 0x58]
mov rdx, qword [0x00429a48]
call fcn.0040cab0
lea rsp, [rbp + 0x8e0]
pop rbx
pop rsi
pop rbp
ret

Function at 0x42c380
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x240
mov rbp, rsp
mov rbx, rcx
mov rcx, rbx
call fcn.0040a840
mov r13d, eax
mov ecx, 0xfde9
xor rdx, rdx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call fcn.0040f000
mov esi, eax
cmp esi, 0x104
jbe 0x42c3dd
mov ecx, esi
add ecx, ecx
mov ecx, ecx
call fcn.00405840
mov rdi, rax
jmp 0x42c3e1
lea rdi, [rbp + 0x38]
mov ecx, 0xfde9
xor rdx, rdx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], esi
call fcn.0040f000
mov rax, rdi
mov rcx, rax
call sub.user32.dll_CharUpperW
xor rbx, rbx
xor rax, rax
mov ecx, esi
sub ecx, 1
cmp eax, ecx
jg 0x42c437
add ecx, 1
mov edx, ebx
shl edx, 5
shr ebx, 0x1b
or edx, ebx
mov ebx, edx
movsxd rdx, eax
movzx edx, word [rdi + rdx*2]
xor ebx, edx
add eax, 1
cmp eax, ecx
jne 0x42c41b
nop
lea rax, [rbp + 0x38]
cmp rdi, rax
je 0x42c449
mov rcx, rdi
call fcn.00405870
mov eax, ebx
lea rsp, [rbp + 0x240]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret
Function at 0x430720
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
call sub.kernel32.dll_GetCommandLineW_1
mov rsi, rax
xor rax, rax
movzx rcx, word [rsi]
sub cx, 1
cmp cx, 0xffff
je 0x430764
cmp cx, 0x20
jb 0x430753
sub cx, 0x21
test cx, cx
jne 0x43075e
jmp 0x430759
test al, al
je 0x430764
jmp 0x43075e
test al, al
sete al
add rsi, 2
jmp 0x430734
nop
jmp 0x43076b
add rsi, 2
movzx rcx, word [rsi]
lea rdx, [0x00430794]
call fcn.00420b20
test al, al
jne 0x430767
mov rcx, rbx
mov rdx, rsi
call fcn.0040b380
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x4308b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call fcn.0040b300
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4308ce
test eax, 0x10
je 0x4308d3
xor rax, rax
jmp 0x4308d5
mov al, 1
add rsp, 0x28
ret

Function at 0x430c60
Capabilities:
Encrypt data using rc6

Disassembly:
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rcx, qword [0x00493348]
lea rdx, [rsp + 0x20]
mov r8d, 0x40
call fcn.00405c00
mov dword [0x0049328c], 0xb7e15163
mov ebx, 1
lea rax, [0x0049328c]
movsxd rcx, ebx
lea rdx, [0x00493288]
movsxd r8, ebx
mov edx, dword [rdx + r8*4]
add edx, 0x9e3779b9
mov dword [rax + rcx*4], edx
add ebx, 1
cmp ebx, 0x2c
jne 0x430c93
nop
xor rbx, rbx
xor rsi, rsi
xor r13, r13
xor r14, r14
mov edi, 1
lea rax, [0x0049328c]
movsxd rcx, ebx
mov ecx, dword [rax + rcx*4]
add ecx, r13d
add ecx, r14d
mov edx, 3
call fcn.00430aa0
mov r13d, eax
lea rax, [0x0049328c]
movsxd rcx, ebx
mov dword [rax + rcx*4], r13d
movsxd rax, esi
mov ecx, dword [rsp + rax*4 + 0x20]
add ecx, r13d
add ecx, r14d
mov edx, r13d
add edx, r14d
call fcn.00430aa0
mov r14d, eax
movsxd rax, esi
mov dword [rsp + rax*4 + 0x20], r14d
mov eax, ebx
add eax, 1
mov ecx, 0x2c
cdq
idiv ecx
mov rbx, rdx
mov eax, esi
add eax, 1
mov ecx, 0x10
cdq
idiv ecx
mov rsi, rdx
add edi, 1
cmp edi, 0x85
jne 0x430ccf
nop
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop r13
pop r14
ret
Function at 0x471600
Capabilities:
Parse pe header

Disassembly:
push rsi
push rbx
mov rax, rcx
movsxd r10, dword [rax + 0x3c]
add rcx, r10
cmp word [rax], 0x5a4d
jne 0x47161b
cmp dword [rcx], 0x4550
je 0x471623
mov eax, 1
jmp 0x471677
lea rax, [rcx + 0x108]
xor r10, r10
xor r11, r11
xor rbx, rbx
movzx esi, word [rcx + 6]
sub esi, 1
cmp ebx, esi
jg 0x47165e
add esi, 1
cmp dword [rax + 0x14], r10d
jbe 0x471653
mov r10d, dword [rax + 0x14]
mov r11d, dword [rax + 0x14]
add r11d, dword [rax + 0x10]
add rax, 0x28
add ebx, 1
cmp ebx, esi
jne 0x471641
nop
mov dword [rdx], r11d
lea rax, [rcx + 0xa8]
mov ecx, dword [rax]
mov dword [r8], ecx
mov eax, dword [rax + 4]
mov dword [r9], eax
xor rax, rax
pop rbx
pop rsi
ret
Function at 0x471680
Capabilities:
Get file size
Read file via mapping

Disassembly:
push rbp
push rbx
sub rsp, 0x68
mov rbp, rsp
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x80], rcx
mov byte [rbp + 0x88], dl
mov qword [rbp + 0x90], r8
mov dword [rbp + 0x98], r9d
cmp byte [rbp + 0x88], 0
je 0x4716cc
mov rcx, qword [rbp + 0x80]
movzx rdx, byte [rbp + 0x88]
call fcn.00407e20
mov qword [rbp + 0x80], rax
nop
cmp qword [rbp + 0x90], 0
jbe 0x4718ea
cmp dword [rbp + 0xa0], 0
jne 0x4716f9
mov rcx, qword [rbp + 0x90]
xor rdx, rdx
call sub.kernel32.dll_GetFileSize
mov dword [rbp + 0xa0], eax
mov rcx, qword [rbp + 0x90]
xor rdx, rdx
mov r8d, 2
xor r9, r9
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
call sub.kernel32.dll_CreateFileMappingW
mov rcx, qword [rbp + 0x80]
mov qword [rcx + 0x28], rax
mov rax, qword [rbp + 0x80]
cmp qword [rax + 0x28], 0
jne 0x471765
mov rcx, qword [rbp + 0x80]
call fcn.00470d90
mov rcx, qword [0x00470098]
mov dl, 1
lea r8, [0x0047197c]
call fcn.00429c90
mov rcx, rax
call fcn.004093c0
mov rax, qword [rbp + 0x80]
mov rcx, qword [rax + 0x28]
mov edx, 4
xor r8, r8
xor r9, r9
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_MapViewOfFile
mov rcx, qword [rbp + 0x80]
mov qword [rcx + 8], rax
mov rax, qword [rbp + 0x80]
cmp qword [rax + 8], 0
jne 0x4717cc
mov rcx, qword [rbp + 0x80]
call fcn.00470d90
mov rcx, qword [0x00470098]
mov dl, 1
lea r8, [0x004719a4]
call fcn.00429c90
mov rcx, rax
call fcn.004093c0
mov rax, qword [rbp + 0x80]
mov rcx, qword [rax + 8]
lea rdx, [rbp + 0x54]
lea r8, [rbp + 0x50]
lea r9, [rbp + 0x4c]
call fcn.00471600
test eax, eax
jne 0x4717fb
cmp dword [rbp + 0x50], 0
jbe 0x4717fb
mov eax, dword [rbp + 0x50]
mov dword [rbp + 0xa0], eax
mov dword [rbp + 0x58], 0xffffffff
mov eax, dword [rbp + 0x98]
mov ecx, dword [rbp + 0xa0]
sub ecx, 5
mov dword [rbp + 0x5c], eax
cmp dword [rbp + 0x5c], ecx
jg 0x47184a
add ecx, 1
mov rax, qword [rbp + 0x80]
mov rax, qword [rax + 8]
movsxd rdx, dword [rbp + 0x5c]
mov eax, dword [rax + rdx]
add eax, 1
cmp eax, 0x4034b51
jne 0x471841
mov eax, dword [rbp + 0x5c]
mov dword [rbp + 0x58], eax
jmp 0x47184a
add dword [rbp + 0x5c], 1
cmp dword [rbp + 0x5c], ecx
jne 0x47181c
nop
cmp dword [rbp + 0x58], 0
jge 0x47189a
mov eax, dword [rbp + 0x98]
mov ecx, dword [rbp + 0xa0]
sub ecx, 5
mov dword [rbp + 0x5c], eax
cmp dword [rbp + 0x5c], ecx
jg 0x471899
add ecx, 1
mov rax, qword [rbp + 0x80]
mov rax, qword [rax + 8]
movsxd rdx, dword [rbp + 0x5c]
mov eax, dword [rax + rdx]
add eax, 1
cmp eax, 0x6054b51
jne 0x471890
mov eax, dword [rbp + 0x5c]
mov dword [rbp + 0x58], eax
jmp 0x471899
add dword [rbp + 0x5c], 1
cmp dword [rbp + 0x5c], ecx
jne 0x47186b
nop
cmp dword [rbp + 0x58], 0
jge 0x4718c9
mov rcx, qword [rbp + 0x80]
call fcn.00470d90
mov rcx, qword [0x00470098]
mov dl, 1
lea r8, [0x004719d0]
call fcn.00429c90
mov rcx, rax
call fcn.004093c0
mov rcx, qword [rbp + 0x80]
xor rdx, rdx
mov rax, qword [rbp + 0x80]
mov r8, qword [rax + 8]
mov r9d, dword [rbp + 0xa0]
call fcn.00470e10
cmp byte [rbp + 0x88], 0
je 0x471945
mov rcx, qword [rbp + 0x80]
call fcn.00407e60
mov qword [rbp + 0x80], rax
jmp 0x471945
mov rax, qword [rbp + 0x80]
lea rsp, [rbp + 0x68]
pop rbx
pop rbp
ret
Function at 0x472ea0
Capabilities:
Get common file path

Disassembly:
push rbp
mov byte [rsp - 0x60], 0
mov byte [rsp - 0x1060], 0
mov byte [rsp - 0x2060], 0
sub rsp, 0x2060
mov rbp, rsp
mov qword [rbp + 0x30], rcx
mov dword [rbp + 0x3c], edx
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
nop
mov eax, 1
movsxd rcx, eax
mov word [rbp + rcx*2 + 0x5e], 0x20
add eax, 1
cmp eax, 0x1001
jne 0x472eee
nop
mov eax, dword [rbp + 0x3c]
sub eax, 1
cmp eax, 0xffffffff
je 0x472f20
test eax, eax
je 0x472f52
sub eax, 1
test eax, eax
jne 0x472fab
jmp 0x472f92
mov ecx, 0x1000
lea rdx, [rbp + 0x60]
call sub.kernel32.dll_GetTempPathW
lea rcx, [rbp + 0x58]
lea rdx, [rbp + 0x60]
mov r8d, 0x1000
call fcn.0040a2e0
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x58]
call fcn.00420fc0
jmp 0x472fab
xor rcx, rcx
mov edx, 0x1c
xor r8, r8
xor r9, r9
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
call sub.SHFolder.dll_SHGetFolderPathW
lea rcx, [rbp + 0x50]
lea rdx, [rbp + 0x60]
mov r8d, 0x1000
call fcn.0040a2e0
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x50]
call fcn.00420fc0
jmp 0x472fab
lea rcx, [rbp + 0x48]
xor rdx, rdx
call fcn.00405eb0
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x48]
call fcn.00422500
lea rcx, [rbp + 0x40]
mov rax, qword [rbp + 0x30]
mov rdx, qword [rax]
call fcn.0042bcd0
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x40]
call fcn.0040a650
nop
lea rcx, [rbp + 0x40]
mov edx, 4
call fcn.0040a130
mov rax, qword [rbp + 0x30]
lea rsp, [rbp + 0x2060]
pop rbp
ret
Function at 0x473020
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x118
mov rbp, rsp
mov qword [rbp + 0x58], rcx
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
nop
lea rcx, [rbp + 0xf0]
mov edx, 0x18
xor r8, r8
call fcn.00406b40
lea rcx, [rbp + 0x88]
mov edx, 0x68
xor r8, r8
call fcn.00406b40
mov dword [rbp + 0x88], 0x68
mov dword [rbp + 0xf0], 0x18
mov dword [rbp + 0xc4], 1
mov word [rbp + 0xc8], 0
mov dword [rbp + 0x100], 0xffffffff
mov bl, 1
mov rcx, qword [rbp + 0x58]
call fcn.0040b300
xor rcx, rcx
mov rdx, rax
lea r8, [rbp + 0xf0]
lea r9, [rbp + 0xf0]
test bl, bl
setne al
movzx rax, al
neg eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
lea rax, [rbp + 0x88]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x48], rax
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x47314e
lea rcx, [rbp + 0x68]
lea rdx, [0x00472e80]
call fcn.0040ef30
lea rcx, [rbp + 0x60]
lea rdx, [0x004731d4]
call fcn.0040a6d0
mov rcx, qword [rbp + 0x68]
call fcn.0040b300
mov rbx, rax
mov rcx, qword [rbp + 0x60]
call fcn.0040b300
xor rcx, rcx
mov rdx, rbx
mov r8, rax
mov r9d, 0x40
call sub.user32.dll_MessageBoxW
jmp 0x47317c
mov rcx, qword [rbp + 0x70]
or edx, 0xffffffff
call sub.kernel32.dll_WaitForSingleObject
mov rcx, qword [rbp + 0x70]
lea rdx, [rbp + 0x10c]
call sub.kernel32.dll_GetExitCodeProcess
mov rcx, qword [rbp + 0x70]
call sub.kernel32.dll_CloseHandle_1
mov rcx, qword [rbp + 0x78]
call sub.kernel32.dll_CloseHandle_1
nop
lea rcx, [rbp + 0x60]
mov edx, 2
call fcn.0040a130
mov eax, dword [rbp + 0x10c]
lea rsp, [rbp + 0x118]
pop rbx
pop rbp
ret

Function at 0x473680
Capabilities:
Write file on windows

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0x60], rcx
mov qword [rbp + 0x68], rdx
mov rcx, qword [rbp + 0x68]
call fcn.0040a1e0
nop
mov rcx, qword [rbp + 0x68]
call fcn.0040b300
mov rcx, rax
mov edx, 0x40000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 2
mov dword [rsp + 0x28], 0x102
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rcx, qword [rbp + 0x60]
mov qword [rcx + 0x58], rax
nop
mov rax, qword [rbp + 0x60]
mov rcx, qword [rax + 0x58]
mov rax, qword [rbp + 0x60]
mov rdx, qword [rax + 0x60]
mov rax, qword [rbp + 0x60]
mov r8d, dword [rax + 0x68]
mov r9, qword [rbp + 0x60]
add r9, 0x54
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile_1
nop
mov rax, qword [rbp + 0x60]
mov rcx, qword [rax + 0x58]
call sub.kernel32.dll_CloseHandle_1
nop
lea rcx, [rbp + 0x68]
call fcn.0040a050
lea rsp, [rbp + 0x50]
pop rbp
ret
Function at 0x140002050
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x40
mov rsi, rdx
lea r14, [rsp + 0x48]
movabs rbp, 0xff00ff00ff00ff00
mov qword [r11 - 0x20], rbp
mov qword [r11 - 0x18], r14
mov rax, qword [r14]
xor rax, rbp
mov qword [r11 - 0x28], rax
mov qword [r14], 0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140002126
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140002126
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x811c9dc5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140002121
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140002100
cmp r8d, 0xfaba0065
je 0x14000212b
test r9d, r9d
jne 0x1400020e0
mov rax, qword [rax]
jmp 0x1400020b0
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov r8, rsi
lea rcx, section..text
call fcn.140008130
nop
mov rcx, qword [rsp + 0x20]
xor rcx, rbp
mov qword [r14], rcx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140002180
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x40
mov rsi, rdx
lea r14, [rsp + 0x48]
movabs rbp, 0xff00ff00ff00ff00
mov qword [r11 - 0x20], rbp
mov qword [r11 - 0x18], r14
mov rax, qword [r14]
xor rax, rbp
mov qword [r11 - 0x28], rax
mov qword [r14], 0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140002256
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140002256
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x811c9dc5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140002251
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140002230
cmp r8d, 0x9a9264ad
je 0x14000225b
test r9d, r9d
jne 0x140002210
mov rax, qword [rax]
jmp 0x1400021e0
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov r8, rsi
lea rcx, section..text
call fcn.140008130
nop
mov rcx, qword [rsp + 0x20]
xor rcx, rbp
mov qword [r14], rcx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400022b0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x40
mov rsi, rdx
lea r14, [rsp + 0x48]
movabs rbp, 0xff00ff00ff00ff00
mov qword [r11 - 0x20], rbp
mov qword [r11 - 0x18], r14
mov rax, qword [r14]
xor rax, rbp
mov qword [r11 - 0x28], rax
mov qword [r14], 0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140002386
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140002386
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x811c9dc5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140002381
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140002360
cmp r8d, 0x491e0a9c
je 0x14000238b
test r9d, r9d
jne 0x140002340
mov rax, qword [rax]
jmp 0x140002310
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov r8, rsi
lea rcx, section..text
call fcn.140008130
nop
mov rcx, qword [rsp + 0x20]
xor rcx, rbp
mov qword [r14], rcx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1400023e0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
lea rsi, [rsp + 0x48]
movabs rbp, 0xff00ff00ff00ff00
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x30], rsi
mov rax, qword [rsi]
xor rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsi], 0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400024a6
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400024a6
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x811c9dc5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400024a1
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140002480
cmp r8d, 0x98d87e10
je 0x1400024ab
test r9d, r9d
jne 0x140002460
mov rax, qword [rax]
jmp 0x140002430
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
lea rcx, section..text
call fcn.1400083a0
nop
mov rcx, qword [rsp + 0x20]
xor rcx, rbp
mov qword [rsi], rcx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400024f0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rsi, r9
mov ebp, r8d
mov r14, rdx
lea r15, [rsp + 0x68]
movabs r12, 0xff00ff00ff00ff00
mov qword [r11 - 0x30], r12
mov qword [r11 - 0x28], r15
mov rax, qword [r15]
xor rax, r12
mov qword [r11 - 0x38], rax
mov qword [r15], 0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400025c6
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400025c6
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x811c9dc5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400025c1
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x1400025a0
cmp r8d, 0x8466c438
je 0x1400025cb
test r9d, r9d
jne 0x140002580
mov rax, qword [rax]
jmp 0x140002550
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov qword [rsp + 0x20], rsi
mov r9d, ebp
mov r8, r14
lea rcx, section..text
call fcn.140008550
nop
mov rcx, qword [rsp + 0x30]
xor rcx, r12
mov qword [r15], rcx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret