joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140124ae0
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x18]
mov rbx, rcx
mov ecx, dword [rcx + 0xa0]
lea rdi, [rbx + 0xb1]
mov r10, qword [rax + 0x20]
cmp r10d, ecx
je 0x140124b4c
lea eax, [rcx + 1]
mov edx, ecx
lea rdi, [rbx + 0xc1]
mov byte [rbx + rdx + 0x90], pe_nt_image_headers64
cmp r10d, eax
jbe 0x140124b4c
mov esi, r10d
mov edx, eax
sub esi, ecx
lea rax, [rbx + rdx + 0x90]
mov ecx, esi
sub ecx, 2
lea rcx, [rdx + rcx + 0x91]
add rcx, rbx
nop dword [rax]
mov byte [rax], 0
add rax, 1
cmp rax, rcx
jne 0x140124b40
mov r9d, r10d
lea rcx, [rbx + 0x90]
cmp r9, 7
jbe 0x140124c78
lea rsi, [r9 - 8]
mov r8, rdi
mov rax, rsi
shr rax, 3
lea rdx, [rcx + rax*8 + 8]
mov rax, rcx
nop word cs:[rax + rax]
add rax, 8
add r8, 8
mov r11, qword [r8 - 8]
xor qword [rax - 8], r11
cmp rax, rdx
jne 0x140124b80
mov rdx, rsi
mov r11, r10
and rdx, 0xfffffffffffffff8
add rdx, 8
lea rax, [rcx + rdx]
add rdx, rdi
and r11d, 7
je 0x140124c96
add r11, rax
nop word [rax + rax]
add rdx, 1
add rax, 1
movzx r8d, byte [rdx - 1]
xor byte [rax - 1], r8b
cmp r11, rax
jne 0x140124bc0
cmp r9, 7
lea rdx, [rbx + 0x70]
jbe 0x140124c91
lea rsi, [r9 - 8]
mov rax, rsi
mov r8, rcx
shr rax, 3
lea r11, [rdx + rax*8 + 8]
mov rax, rdx
nop word [rax + rax]
add rax, 8
add r8, 8
mov r9, qword [r8 - 8]
xor qword [rax - 8], r9
cmp rax, r11
jne 0x140124c00
and rsi, 0xfffffffffffffff8
and r10d, 7
add rsi, 8
mov r9, r10
lea rax, [rdx + rsi]
add rcx, rsi
test r9, r9
je 0x140124c49
add r9, rax
add rcx, 1
add rax, 1
movzx r8d, byte [rcx - 1]
xor byte [rax - 1], r8b
cmp rax, r9
jne 0x140124c33
mov rax, qword [rbx + 0x18]
lea rcx, [rbx + 0x280]
mov r8, rdx
call qword [rax + 0x40]
test eax, eax
je 0x140124c66
lea ecx, [rax + 0x20]
call fcn.1400eab70
mov dword [rbx + 0xa0], 0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
test r9, r9
jne 0x140124c83
lea rdx, [rbx + 0x70]
jmp 0x140124c49
mov rdx, rdi
mov rax, rcx
mov r11, r9
jmp 0x140124bb4
mov rax, rdx
jmp 0x140124c2b
lea rdx, [rbx + 0x70]
jmp 0x140124be8
Function at 0x140126340
Capabilities:
Encode data using xor

Disassembly:
push rbx
cmp r9, 7
jbe 0x14012638a
lea rbx, [r9 - 8]
mov rax, rbx
shr rax, 3
lea r11, [rax*8 + 8]
xor eax, eax
nop dword [rax]
mov r10, qword [rdx + rax]
xor r10, qword [r8 + rax]
mov qword [rcx + rax], r10
add rax, 8
cmp rax, r11
jne 0x140126360
and rbx, 0xfffffffffffffff8
and r9d, 7
lea rax, [rbx + 8]
add r8, rax
add rdx, rax
add rcx, rax
xor eax, eax
test r9, r9
je 0x1401263a7
movzx r10d, byte [rdx + rax]
xor r10b, byte [r8 + rax]
mov byte [rcx + rax], r10b
add rax, 1
cmp r9, rax
jne 0x140126391
pop rbx
ret

Function at 0x1401265a0
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x1401265d0
je 0x140126692
tzcnt r8d, r8d
cmp r8d, 0xf
jg 0x14012669d
movsxd r8, r8d
lea rdx, [r8 + 0xd]
shl rdx, 4
lea rax, [rcx + rdx]
ret
shr r8, 0x20
xor r11d, r11d
mov eax, 0x30
tzcnt r11d, r8d
add r11d, 0x10
test r8, r8
cmove r11d, eax
lea rax, [rcx + 0x1c0]
cmp rdx, rax
je 0x14012660d
mov r9, qword [rcx + 0x1c0]
mov r10, qword [rcx + 0x1c8]
mov qword [rdx], r9
mov qword [rdx + 8], r10
mov r9, qword [rdx]
mov rax, qword [rdx + 8]
bswap r9
bswap rax
lea r10, [r9 + r9]
mov rcx, rax
sar r9, 0x3f
lea r8, [rax + rax]
shr rcx, 0x3f
and r9d, 0x87
xor r10, rcx
xor r9, r8
bswap r10
test r11d, r11d
bswap r9
mov qword [rdx], r10
mov qword [rdx + 8], r9
je 0x14012668e
nop dword [rax]
bswap r10
bswap r9
mov r8, r10
mov rax, r9
lea r10, [r10 + r10]
sar r8, 0x3f
add r9, r9
shr rax, 0x3f
and r8d, 0x87
xor r10, rax
xor r8, r9
sub r11d, 1
bswap r10
mov r9, r8
bswap r9
jne 0x140126650
mov qword [rdx], r10
mov qword [rdx + 8], r9
mov rax, rdx
ret
mov r11d, 0x10
jmp 0x1401265ec
lea r11d, [r8 - 0x10]
jmp 0x1401265ec
Function at 0x14013aa30
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
mov r10, qword [rsp + 0xf0]
mov edi, dword [rcx + 0x1e0]
mov rbx, rcx
mov r11, rdx
mov rbp, rsp
movdqu xmmword [rsp], xmm6
movdqu xmmword [rsp + 0x10], xmm7
movdqu xmmword [rsp + 0x20], xmm8
movdqu xmmword [rsp + 0x30], xmm9
movdqu xmmword [rsp + 0x40], xmm10
movdqu xmmword [rsp + 0x50], xmm11
movdqu xmmword [rsp + 0x60], xmm12
movdqu xmmword [rsp + 0x70], xmm13
movdqu xmmword [rsp + 0x80], xmm14
movdqu xmmword [rsp + 0x90], xmm15
lea rcx, [0x140139d20]
movdqa xmm9, xmmword [rcx]
movdqa xmm10, xmmword [rcx + 0x30]
movdqa xmm11, xmmword [rcx + 0x40]
movdqa xmm13, xmmword [rcx + 0x270]
movdqa xmm12, xmmword [rcx + 0x280]
movdqa xmm15, xmmword [rcx + 0x290]
movdqa xmm14, xmmword [rcx + 0x2b0]
movdqa xmm8, xmmword [rcx + 0x2d0]
movdqu xmm7, xmmword [r9]
sub edi, 1
add rbx, 0xf0
test r10, r10
je 0x14013ab2e
nop
nop word cs:[rax + rax]
movdqu xmm0, xmmword [r8]
movdqa xmm6, xmm0
mov eax, edi
mov rdx, rbx
call fcn.140139840
pxor xmm0, xmm7
movdqu xmmword [r11], xmm0
movdqu xmm7, xmm6
add r11, 0x10
add r8, 0x10
sub r10, 1
jne 0x14013ab00
movdqu xmmword [r9], xmm7
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
pxor xmm4, xmm4
pxor xmm5, xmm5
movdqu xmm6, xmmword [rbp]
movdqu xmm7, xmmword [rbp + 0x10]
movdqu xmm8, xmmword [rbp + 0x20]
movdqu xmm9, xmmword [rbp + 0x30]
movdqu xmm10, xmmword [rbp + 0x40]
movdqu xmm11, xmmword [rbp + 0x50]
movdqu xmm12, xmmword [rbp + 0x60]
movdqu xmm13, xmmword [rbp + 0x70]
movdqu xmm14, xmmword [rbp + 0x80]
movdqu xmm15, xmmword [rbp + 0x90]
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x1401489e0
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xe0
mov edx, dword [0x1402a4108]
mov r12, rcx
lea rbx, [rcx + 0x258]
test edx, edx
je 0x140148bd3
lea rsi, [rsp + 0x20]
lea rdi, [r12 + 0x244]
mov rcx, rsi
call fcn.14010e380
mov rax, qword [r12 + 0x244]
mov rcx, rsi
mov qword [r12 + 0x258], rax
mov rax, qword [rdi + 8]
mov qword [rbx + 8], rax
mov eax, dword [rdi + 0x10]
mov dword [rbx + 0x10], eax
mov rdx, qword [r12]
mov qword [r12 + 0x26c], rdx
mov rdx, qword [r12 + 8]
mov qword [r12 + 0x274], rdx
mov rdx, qword [r12 + 0x10]
mov qword [r12 + 0x27c], rdx
mov rdx, qword [r12 + 0x18]
mov qword [r12 + 0x284], rdx
mov rdx, qword [r12 + 0x20]
mov qword [r12 + 0x28c], rdx
mov edx, dword [r12 + 0x28]
mov dword [r12 + 0x294], edx
mov rdx, rbx
call fcn.14010e390
mov ebp, eax
mov rax, qword [r12 + 0x258]
mov qword [r12], rax
mov rax, qword [rbx + 8]
mov qword [r12 + 8], rax
mov eax, dword [rbx + 0x10]
mov dword [r12 + 0x10], eax
mov eax, dword [0x1402a40d4]
test eax, eax
je 0x140148aca
cmp r12, qword [0x1402a4168]
je 0x140148b8f
lea r13, [r12 + 0x298]
mov r14, r12
lea rcx, [r14 + 0x40]
mov rax, rbx
mov rdx, r14
cmp rbx, rcx
ja 0x140148b4c
cmp rbx, rdx
cmovbe rdx, r12
add rax, 1
mov rcx, rdx
lea rdx, [rdx + 1]
movzx ecx, byte [rcx]
mov byte [rax - 1], cl
cmp r13, rax
jne 0x140148ae4
mov rdx, rbx
mov rcx, rsi
add r14, 0x14
call fcn.14010e390
mov rax, qword [rbx]
cmp rdi, r14
mov qword [r14], rax
mov rax, qword [rbx + 8]
mov qword [r14 + 8], rax
mov eax, dword [rbx + 0x10]
mov dword [r14 + 0x10], eax
jne 0x140148ad5
cmp r12, qword [0x1402a4168]
je 0x140148baf
mov ecx, ebp
call fcn.1400eab70
add rsp, 0xe0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rax, qword [r14]
mov qword [rbx], rax
mov rax, qword [r14 + 8]
mov qword [rbx + 8], rax
mov rax, qword [r14 + 0x10]
mov qword [rbx + 0x10], rax
mov rax, qword [r14 + 0x18]
mov qword [rbx + 0x18], rax
mov rax, qword [r14 + 0x20]
mov qword [rbx + 0x20], rax
mov rax, qword [r14 + 0x28]
mov qword [rbx + 0x28], rax
mov rax, qword [r14 + 0x30]
mov qword [rbx + 0x30], rax
mov rax, qword [r14 + 0x38]
mov qword [rbx + 0x38], rax
jmp 0x140148b01
lea rdx, [0x1402a40c0]
xor eax, eax
movzx ecx, byte [rdx + rax]
xor byte [r12 + rax], cl
add rax, 1
cmp rax, 0x14
jne 0x140148b98
jmp 0x140148aca
lea rcx, [0x1402a40c0]
mov r8d, 0x258
mov rdx, r12
call fcn.14010e3e0
mov dword [0x1402a40d4], 1
jmp 0x140148b33
lea r9, str.mix_pool
lea rdx, str.random_csprng.c
lea rcx, str.pool_is_locked
mov r8d, 0x260
call fcn.1400ea260
nop
nop
nop word cs:[rax + rax]
Function at 0x14014d440
Capabilities:
Get file size
Read file on windows

Disassembly:
jmp 0x140156960
sub rsp, 0x28
movzx edx, cx
and ch, 0x80
mov ecx, edx
je 0x140156a60
call fcn.14014d480
test eax, eax
mov edx, 0x3ffe
mov ecx, 0x3ffe
jne 0x140156ab0
lea eax, [rdx - 0x2c7]
cmp eax, 7
jbe 0x140156ad5
lea eax, [rdx - 0x2d1]
cmp eax, 8
jbe 0x140156ac0
lea eax, [rdx - 0x2ee]
cmp eax, 2
jbe 0x140156af0
lea eax, [rdx - 0x2f2]
cmp eax, 0x1c
jbe 0x140156b08
lea eax, [rdx - 0x310]
cmp eax, 5
jbe 0x140156b20
lea eax, [rdx - 0x320]
cmp eax, 4
jbe 0x140156b38
lea eax, [rdx - 0x32f]
cmp eax, 7
jbe 0x140156b50
lea eax, [rdx - 0x340]
cmp eax, 7
jbe 0x140156b68
cmp ecx, 0x34c
je 0x140156b98
cmp ecx, 0x350
je 0x140156ba2
lea eax, [rdx - 0x371]
cmp eax, 0xa
jbe 0x140156b80
lea eax, [rdx - 0x400]
cmp eax, 0xf
jbe 0x140156bac
lea eax, [rdx - 0x3ffd]
mov edx, 0x219e
cmp eax, 2
ja 0x140156a73
lea eax, [rcx - 0x3e6f]
lea rdx, [0x14027fb40]
cdqe
movsxd rdx, dword [rdx + rax*4]
jmp 0x140156a73
cmp edx, 0xd5
ja 0x140156a90
lea rax, [0x14027fb40]
movsxd rdx, dword [rax + rdx*4]
lea rax, str.Success
lea rcx, str.libgpg_error
add rdx, rax
add rsp, 0x28
jmp fcn.140158f40
lea eax, [rdx - 0xd9]
cmp eax, 0x36
ja 0x140156bc4
sub edx, 3
movsxd rdx, edx
jmp 0x140156a68
mov ecx, eax
add rsp, 0x28
jmp fcn.14016b498
lea eax, [rcx - 0x1a4]
lea rdx, [0x14027fb40]
cdqe
movsxd rdx, dword [rdx + rax*4]
jmp 0x140156a73
lea eax, [rcx - 0x1a2]
lea rdx, [0x14027fb40]
cdqe
movsxd rdx, dword [rdx + rax*4]
jmp 0x140156a73
lea eax, [rcx - 0x1b8]
lea rdx, [0x14027fb40]
cdqe
movsxd rdx, dword [rdx + rax*4]
jmp 0x140156a73
lea eax, [rcx - 0x1b9]
lea rdx, [0x14027fb40]
cdqe
movsxd rdx, dword [rdx + rax*4]
jmp 0x140156a73
lea eax, [rcx - 0x1ba]
lea rdx, [0x14027fb40]
cdqe
movsxd rdx, dword [rdx + rax*4]
jmp 0x140156a73
lea eax, [rcx - 0x1c4]
lea rdx, [0x14027fb40]
cdqe
movsxd rdx, dword [rdx + rax*4]
jmp 0x140156a73
lea eax, [rcx - 0x1ce]
lea rdx, [0x14027fb40]
cdqe
movsxd rdx, dword [rdx + rax*4]
jmp 0x140156a73
lea eax, [rcx - 0x1d7]
lea rdx, [0x14027fb40]
cdqe
movsxd rdx, dword [rdx + rax*4]
jmp 0x140156a73
lea eax, [rcx - 0x1fe]
lea rdx, [0x14027fb40]
cdqe
movsxd rdx, dword [rdx + rax*4]
jmp 0x140156a73
mov edx, 0x1e81
jmp 0x140156a73
mov edx, 0x1e9e
jmp 0x140156a73
lea eax, [rcx - 0x282]
lea rdx, [0x14027fb40]
cdqe
movsxd rdx, dword [rdx + rax*4]
jmp 0x140156a73
lea eax, [rdx - 0x111]
cmp eax, 8
ja 0x140156be5
sub edx, 4
lea rax, [0x14027fb40]
movsxd rdx, edx
movsxd rdx, dword [rax + rdx*4]
jmp 0x140156a73
lea eax, [rdx - 0x12c]
cmp eax, 0xd
ja 0x140156c06
sub edx, 0x16
lea rax, [0x14027fb40]
movsxd rdx, edx
movsxd rdx, dword [rax + rdx*4]
jmp 0x140156a73
cmp edx, 0x29a
jne 0x140156989
mov edx, 0x16af
jmp 0x140156a73
Function at 0x14014ea60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [0x1401714c0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x14014ea82
mov rax, rbx
add rsp, 0x20
pop rbx
ret
mov edx, 4
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
mov rbx, rax
je 0x14014eab8
mov ecx, dword [0x1401714c0]
mov rdx, rax
mov dword [rax], 0
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
call sub.msvcrt.dll_abort
nop
nop
nop
Function at 0x140156960
Capabilities:
Get file size
Read file on windows

Disassembly:
jmp 0x140156960
sub rsp, 0x28
movzx edx, cx
and ch, 0x80
mov ecx, edx
je 0x140156a60
call fcn.14014d480
test eax, eax
mov edx, 0x3ffe
mov ecx, 0x3ffe
jne 0x140156ab0
lea eax, [rdx - 0x2c7]
cmp eax, 7
jbe 0x140156ad5
lea eax, [rdx - 0x2d1]
cmp eax, 8
jbe 0x140156ac0
lea eax, [rdx - 0x2ee]
cmp eax, 2
jbe 0x140156af0
lea eax, [rdx - 0x2f2]
cmp eax, 0x1c
jbe 0x140156b08
lea eax, [rdx - 0x310]
cmp eax, 5
jbe 0x140156b20
lea eax, [rdx - 0x320]
cmp eax, 4
jbe 0x140156b38
lea eax, [rdx - 0x32f]
cmp eax, 7
jbe 0x140156b50
lea eax, [rdx - 0x340]
cmp eax, 7
jbe 0x140156b68
cmp ecx, 0x34c
je 0x140156b98
cmp ecx, 0x350
je 0x140156ba2
lea eax, [rdx - 0x371]
cmp eax, 0xa
jbe 0x140156b80
lea eax, [rdx - 0x400]
cmp eax, 0xf
jbe 0x140156bac
lea eax, [rdx - 0x3ffd]
mov edx, 0x219e
cmp eax, 2
ja 0x140156a73
lea eax, [rcx - 0x3e6f]
lea rdx, [0x14027fb40]
cdqe
movsxd rdx, dword [rdx + rax*4]
jmp 0x140156a73
cmp edx, 0xd5
ja 0x140156a90
lea rax, [0x14027fb40]
movsxd rdx, dword [rax + rdx*4]
lea rax, str.Success
lea rcx, str.libgpg_error
add rdx, rax
add rsp, 0x28
jmp fcn.140158f40
lea eax, [rdx - 0xd9]
cmp eax, 0x36
ja 0x140156bc4
sub edx, 3
movsxd rdx, edx
jmp 0x140156a68
mov ecx, eax
add rsp, 0x28
jmp fcn.14016b498
lea eax, [rcx - 0x1a4]
lea rdx, [0x14027fb40]
cdqe
movsxd rdx, dword [rdx + rax*4]
jmp 0x140156a73
lea eax, [rcx - 0x1a2]
lea rdx, [0x14027fb40]
cdqe
movsxd rdx, dword [rdx + rax*4]
jmp 0x140156a73
lea eax, [rcx - 0x1b8]
lea rdx, [0x14027fb40]
cdqe
movsxd rdx, dword [rdx + rax*4]
jmp 0x140156a73
lea eax, [rcx - 0x1b9]
lea rdx, [0x14027fb40]
cdqe
movsxd rdx, dword [rdx + rax*4]
jmp 0x140156a73
lea eax, [rcx - 0x1ba]
lea rdx, [0x14027fb40]
cdqe
movsxd rdx, dword [rdx + rax*4]
jmp 0x140156a73
lea eax, [rcx - 0x1c4]
lea rdx, [0x14027fb40]
cdqe
movsxd rdx, dword [rdx + rax*4]
jmp 0x140156a73
lea eax, [rcx - 0x1ce]
lea rdx, [0x14027fb40]
cdqe
movsxd rdx, dword [rdx + rax*4]
jmp 0x140156a73
lea eax, [rcx - 0x1d7]
lea rdx, [0x14027fb40]
cdqe
movsxd rdx, dword [rdx + rax*4]
jmp 0x140156a73
lea eax, [rcx - 0x1fe]
lea rdx, [0x14027fb40]
cdqe
movsxd rdx, dword [rdx + rax*4]
jmp 0x140156a73
mov edx, 0x1e81
jmp 0x140156a73
mov edx, 0x1e9e
jmp 0x140156a73
lea eax, [rcx - 0x282]
lea rdx, [0x14027fb40]
cdqe
movsxd rdx, dword [rdx + rax*4]
jmp 0x140156a73
lea eax, [rdx - 0x111]
cmp eax, 8
ja 0x140156be5
sub edx, 4
lea rax, [0x14027fb40]
movsxd rdx, edx
movsxd rdx, dword [rax + rdx*4]
jmp 0x140156a73
lea eax, [rdx - 0x12c]
cmp eax, 0xd
ja 0x140156c06
sub edx, 0x16
lea rax, [0x14027fb40]
movsxd rdx, edx
movsxd rdx, dword [rax + rdx*4]
jmp 0x140156a73
cmp edx, 0x29a
jne 0x140156989
mov edx, 0x16af
jmp 0x140156a73
Function at 0x140159440
Capabilities:
Create thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x60
mov edx, 0x1078
mov rdi, rcx
mov ecx, 1
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
lea rsi, [rsp + 0x40]
mov dword [rsp + 0x40], 0x18
call sub.msvcrt.dll_calloc
test rax, rax
mov rbx, rax
je 0x140159540
mov qword [rax], rdi
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov rcx, rsi
mov rdi, qword [sym.imp.KERNEL32.dll_CreateEventA]
call rdi
test rax, rax
mov qword [rbx + 0x50], rax
je 0x140159590
xor r9d, r9d
xor edx, edx
mov r8d, 1
mov rcx, rsi
call rdi
test rax, rax
mov qword [rbx + 0x58], rax
je 0x140159550
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov edx, 1
call rdi
mov rcx, qword [rbx + 0x50]
mov qword [rbx + 0x60], rax
test rcx, rcx
je 0x14015955f
cmp qword [rbx + 0x58], 0
je 0x140159559
test rax, rax
je 0x140159559
lea rdi, [rbx + 0x10]
call fcn.1401593c0
mov rcx, rdi
mov qword [rbx + 0x50], rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rax, [rsp + 0x3c]
xor edx, edx
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x140158fc0]
mov rcx, rsi
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [rbx + 8], rax
je 0x14015959d
mov rax, rbx
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x14015956e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x14015956e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x60]
test rcx, rcx
je 0x14015957d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
xor ebx, ebx
call fcn.14014e820
jmp 0x140159540
cmp qword [rbx + 0x58], 0
jne 0x1401594d1
jmp 0x14015956e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, qword [rbx + 0x50]
test rcx, rcx
jne 0x140159559
jmp 0x14015955f
Function at 0x1401595c0
Capabilities:
Create thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x60
mov edx, 0x1068
mov rdi, rcx
mov ecx, 1
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
lea rsi, [rsp + 0x40]
mov dword [rsp + 0x40], 0x18
call sub.msvcrt.dll_calloc
test rax, rax
mov rbx, rax
je 0x1401596c7
mov qword [rax], rdi
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov rcx, rsi
mov rdi, qword [sym.imp.KERNEL32.dll_CreateEventA]
call rdi
test rax, rax
mov qword [rbx + 0x48], rax
je 0x140159710
xor r9d, r9d
mov r8d, 1
mov edx, 1
mov rcx, rsi
call rdi
test rax, rax
mov qword [rbx + 0x50], rax
je 0x1401596d2
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov rcx, rsi
call rdi
mov qword [rbx + 0x58], rax
mov rax, qword [rbx + 0x48]
test rax, rax
je 0x1401596e4
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x1401596db
cmp qword [rbx + 0x58], 0
je 0x1401596db
lea rdi, [rbx + 0x10]
call fcn.1401593c0
mov rcx, rdi
mov qword [rbx + 0x50], rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rax, [rsp + 0x3c]
xor edx, edx
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x1401591a0]
mov rcx, rsi
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [rbx + 8], rax
je 0x14015971d
mov rax, rbx
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
mov rax, qword [rbx + 0x48]
test rax, rax
je 0x1401596f3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x1401596f3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x140159702
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
xor ebx, ebx
call fcn.14014e820
jmp 0x1401596c7
cmp qword [rbx + 0x50], 0
jne 0x140159654
jmp 0x1401596f3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x1401596e4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1401596e4
Function at 0x14015a390
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov ecx, dword [0x1402a4aa4]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x14015a4b0
mov rax, qword [0x1402a4aa8]
xor ebx, ebx
add rax, 0x18
mov rdx, qword [rax]
cmp rsi, rdx
jb 0x14015a3dc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rsi, rdx
jb 0x14015a496
add ebx, 1
add rax, 0x28
cmp ebx, ecx
jne 0x14015a3c0
mov rcx, rsi
call fcn.14015afd0
test rax, rax
mov r12, rax
je 0x14015a4e8
movsxd rbx, ebx
lea rbx, [rbx + rbx*4]
shl rbx, 3
mov r13, rbx
add r13, qword [0x1402a4aa8]
mov qword [r13 + 0x20], rax
mov dword [r13], 0
call fcn.14015b120
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 0x18], rax
mov rax, qword [0x1402a4aa8]
mov rcx, qword [rax + rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14015a4cb
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x14015a48f
sub eax, 0x40
and eax, 0xffffffbf
je 0x14015a48f
add rbx, qword [0x1402a4aa8]
mov rcx, qword [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14015a4b7
add dword [0x1402a4aa4], 1
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.msvcrt.dll_memcpy
xor ebx, ebx
jmp 0x14015a3e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.14015a320
mov rax, qword [0x1402a4aa8]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.14015a320
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call fcn.14015a320
nop
nop dword [rax + rax]

Function at 0x14015ac40
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x1402a4d80]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1402a4d60]
test rbx, rbx
je 0x14015ac94
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x14015ac8b
test rsi, rsi
je 0x14015ac8b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14015ac70
lea rcx, [0x1402a4d80]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x14015afd0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x140284030]
xor edx, edx
mov r8, rcx
cmp word [r9], 0x5a4d
je 0x14015aff0
mov rax, rdx
add rsp, 0x28
ret
mov rcx, r9
call fcn.14015aeb0
test eax, eax
je 0x14015afe8
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add rax, r9
movzx edx, word [rax + 0x14]
lea rdx, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x14015b04d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x14015b044
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x14015afe8
add rdx, 0x28
cmp rdx, r9
jne 0x14015b030
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret

Function at 0x14015b460
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8d, 0xffff
mov dword [0x1402a4de0], 0xffffffff
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov qword [0x1402a4de8], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x14015b4b0
lea rdx, [0x14015b380]
mov ecx, eax
mov dword [0x1402a4dd8], eax
call fcn.14016c100
test eax, eax
jne 0x14015b4b8
add rsp, 0x28
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14015b4a7
call sub.msvcrt.dll_abort
nop
nop