joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001ab0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov eax, dword [rcx + 0x204]
mov rdi, rcx
movzx r11d, byte [rcx + 0x209]
mov rsi, rdx
mov rcx, r8
sub rsi, rax
sub rcx, rax
mov rbx, r8
lea r10d, [rax + r9]
cmp eax, r10d
jae 0x180001b42
sub rsi, rcx
nop dword [rax + rax]
movzx r9d, al
lea rbx, [rbx + 1]
inc eax
movzx r8d, byte [r9 + rdi + 0x100]
add r11b, r8b
movzx edx, r11b
movzx ecx, byte [rdx + rdi + 0x100]
mov byte [r9 + rdi + 0x100], cl
mov byte [rdx + rdi + 0x100], r8b
add r8b, byte [r9 + rdi + 0x100]
movzx ecx, r8b
movzx edx, byte [rcx + rdi + 0x100]
xor dl, byte [rsi + rbx - 1]
mov byte [rbx - 1], dl
cmp eax, r10d
jb 0x180001af0
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov byte [rdi + 0x209], r11b
mov dword [rdi + 0x204], eax
mov rdi, qword [rsp + 0x18]
ret

Function at 0x180001b60
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov ebx, 2
mov dword [rcx + 0x200], 1
mov r10d, ebx
mov dword [rcx + 0x204], 1
mov esi, r8d
mov word [rcx + 0x208], 0
mov rbp, rdx
lea r9, [0x180005130]
xor dil, dil
mov rax, rcx
nop dword [rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [r9]
lea r9, [r9 + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm1, xmmword [r9 - 0x70]
movups xmmword [rax - 0x70], xmm1
movups xmm0, xmmword [r9 - 0x60]
movups xmmword [rax - 0x60], xmm0
movups xmm1, xmmword [r9 - 0x50]
movups xmmword [rax - 0x50], xmm1
movups xmm0, xmmword [r9 - 0x40]
movups xmmword [rax - 0x40], xmm0
movups xmm1, xmmword [r9 - 0x30]
movups xmmword [rax - 0x30], xmm1
movups xmm0, xmmword [r9 - 0x20]
movups xmmword [rax - 0x20], xmm0
movups xmm1, xmmword [r9 - 0x10]
movups xmmword [rax - 0x10], xmm1
sub r10, 1
jne 0x180001bb0
mov r11, rcx
nop
movzx r9d, byte [r11]
lea r11, [r11 + 1]
xor edx, edx
mov eax, r10d
div esi
movzx eax, r9b
inc r10d
add al, byte [rdx + rbp]
add dil, al
movzx edx, dil
movzx eax, byte [rdx + rcx]
mov byte [r11 - 1], al
mov byte [rdx + rcx], r9b
cmp r10d, 0x100
jb 0x180001c10
lea rax, [rcx + 0x100]
nop dword [rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm1, xmmword [rcx - 0x70]
movups xmmword [rax - 0x70], xmm1
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x60], xmm0
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x50], xmm1
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x40], xmm0
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x30], xmm1
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x20], xmm0
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x10], xmm1
sub rbx, 1
jne 0x180001c50
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x180003000
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rdi, rcx
xor esi, esi
xor ecx, ecx
mov qword [rsp + 0x80], rsi
call fcn.1800042e0
mov rbx, rax
test rax, rax
je 0x180003260
lea rax, [0x180006170]
mov qword [0x180006170], rsi
lea r9d, [rsi + 0xe]
mov qword [rsp + 0x20], rax
mov r8b, 0xcc
mov qword [0x180006178], rsi
lea rdx, [0x1800050e8]
lea rcx, str.PAGELK
call fcn.180001000
test eax, eax
js 0x180003086
mov rcx, qword [0x180006170]
movsxd rax, dword [rcx + rbx + 3]
lea rdx, [rcx + 7]
add rdx, rbx
add rdx, rax
mov qword [0x180006170], rdx
jmp 0x18000308d
mov rdx, qword [0x180006170]
test rdx, rdx
je 0x180003260
lea rax, [0x180006178]
mov r9d, 0xe
mov r8b, 0xcc
mov qword [rsp + 0x20], rax
lea rdx, [0x180005100]
lea rcx, str..text
call fcn.180001000
test eax, eax
js 0x1800030e1
mov rcx, qword [0x180006178]
movsxd rax, dword [rcx + rbx + 7]
lea rdx, [rcx + 0xb]
add rdx, rbx
add rdx, rax
mov qword [0x180006178], rdx
jmp 0x1800030e8
mov rdx, qword [0x180006178]
test rdx, rdx
je 0x180003260
movabs rax, 0xfffff6fb40000000
mov qword [0x180006160], rax
movabs rax, 0xfffff68000000000
mov qword [0x180006168], rax
mov rax, qword [rdi + 0x28]
mov rcx, qword [rax + 0x30]
mov qword [0x1800060e0], rcx
mov rcx, qword [rdi + 0x28]
call fcn.180004080
test eax, eax
js 0x180003265
xorps xmm0, xmm0
lea rdx, str.DeviceDriverMapper
mov ebx, 0x7fff
mov rax, rdx
movups xmmword [rsp + 0x40], xmm0
mov ecx, ebx
nop dword [rax]
cmp word [rax], si
je 0x180003161
add rax, 2
sub rcx, 1
jne 0x180003150
jmp 0x18000317d
mov rax, rbx
mov qword [rsp + 0x48], rdx
sub rax, rcx
add ax, ax
mov word [rsp + 0x40], ax
add ax, 2
mov word [rsp + 0x42], ax
lea rax, [rsp + 0x80]
mov r9d, 0x8005
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x40]
mov byte [rsp + 0x28], sil
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x20], esi
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
js 0x180003265
mov rax, qword [rdi + 0x28]
lea rdx, str.DosDevicesDriverMapper
xorps xmm0, xmm0
mov rcx, rbx
mov word [rax + 0x58], si
mov rax, qword [rdi + 0x28]
mov word [rax + 0x5a], si
lea rax, section.PAGE
mov qword [rdi + 0xe0], rax
mov qword [rdi + 0x80], rax
mov qword [rdi + 0x70], rax
lea rax, [0x180001170]
mov qword [rdi + 0x68], rax
mov rax, rdx
movups xmmword [rsp + 0x50], xmm0
nop word [rax + rax]
cmp word [rax], si
je 0x180003211
add rax, 2
sub rcx, 1
jne 0x180003200
jmp 0x18000322a
sub rbx, rcx
mov qword [rsp + 0x58], rdx
add bx, bx
mov word [rsp + 0x50], bx
add bx, 2
mov word [rsp + 0x52], bx
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov ebx, eax
test eax, eax
jns 0x18000324e
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov eax, 0xc0000225
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x180004150
Capabilities:
Access pe header

Disassembly:
push rdi
push r14
sub rsp, 0x68
mov r14, rcx
mov rcx, qword [rcx]
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov rdi, rax
test rax, rax
jne 0x180004179
mov eax, 0xc000007b
add rsp, 0x68
pop r14
pop rdi
ret
mov rax, qword [0x180006170]
mov edx, 0xffffffff
mov ecx, dword [rdi + 0x50]
mov qword [rsp + 0x90], rbp
mov rbp, qword [0x180006178]
mov qword [rsp + 0x60], rsi
call rax
mov rsi, rax
test rax, rax
je 0x1800042d9
mov r8d, dword [rdi + 0x50]
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x88], rbx
call fcn.180002100
mov r8d, dword [rdi + 0x54]
mov rcx, rsi
mov rdx, qword [r14]
call fcn.180001e40
movzx eax, word [rdi + 6]
lea rbx, [rdi + 0x108]
lea rax, [rax + rax*4]
lea rax, [rax + 0x21]
lea rax, [rdi + rax*8]
cmp rbx, rax
jae 0x18000421e
nop dword [rax + rax]
mov edx, dword [rbx + 0x14]
mov ecx, dword [rbx + 0xc]
add rdx, qword [r14]
add rcx, rsi
mov r8d, dword [rbx + 0x10]
call fcn.180001e40
movzx eax, word [rdi + 6]
add rbx, 0x28
lea rax, [rax + rax*4]
lea rax, [rax + 0x21]
lea rax, [rdi + rax*8]
cmp rbx, rax
jb 0x1800041f0
mov r9d, 0xc000007b
xor edx, edx
mov rcx, rsi
lea r8d, [r9 - 0x63]
call fcn.1800019c0
mov edx, dword [rdi + 0x50]
mov r8d, 0x40
mov rcx, rsi
mov ebx, eax
call rbp
test ebx, ebx
js 0x1800042ba
cmp dword [rdi + 0x28], 0
je 0x1800042ac
mov eax, dword [rdi + 0x50]
mov rcx, qword [0x1800060e0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
lea rdx, [rsp + 0x20]
mov ecx, dword [rax + 8]
mov rax, qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [rsp + 0x38], rax
mov rax, qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov qword [rsp + 0x40], rax
mov eax, dword [r14 + 0x10]
mov dword [rsp + 0x48], eax
mov rax, qword [r14 + 0x18]
mov qword [rsp + 0x50], rax
mov eax, dword [rdi + 0x28]
mov dword [rsp + 0x30], ecx
add rax, rsi
mov rcx, rsi
call rax
mov ebx, eax
test eax, eax
js 0x1800042bc
mov r8d, dword [rdi + 0x54]
xor edx, edx
mov rcx, rsi
call fcn.180002100
mov eax, ebx
mov rbx, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x60]
add rsp, 0x68
pop r14
pop rdi
ret
mov eax, 0xc00000a0
jmp 0x1800042c4
Function at 0x1800042e0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rsi, rcx
cmp qword [0x1800060e8], rbx
mov dword [rsp + 0x48], ebx
je 0x180004329
test rcx, rcx
je 0x180004455
mov eax, dword [0x1800060f0]
mov dword [rcx], eax
mov rax, qword [0x1800060e8]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
xorps xmm0, xmm0
lea r8, str.NtOpenFile
mov edx, 0x7fff
mov rax, r8
movups xmmword [rsp + 0x20], xmm0
mov ecx, edx
cmp word [rax], bx
je 0x180004353
add rax, 2
sub rcx, 1
jne 0x180004342
jmp 0x18000436c
sub rdx, rcx
mov qword [rsp + 0x28], r8
add dx, dx
mov word [rsp + 0x20], dx
add dx, 2
mov word [rsp + 0x22], dx
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov rdi, rax
test rax, rax
je 0x18000446c
mov r8d, dword [rsp + 0x48]
lea r9, [rsp + 0x48]
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x18000446c
mov edx, eax
mov qword [rsp + 0x40], r14
xor ecx, ecx
mov r8d, 0x656c6946
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov rcx, rax
mov r14, rax
call fcn.180002100
mov r8d, dword [rsp + 0x48]
lea r9, [rsp + 0x48]
mov rdx, r14
mov ecx, 0xb
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
test eax, eax
js 0x18000443d
mov r8d, dword [r14]
test r8d, r8d
je 0x18000443d
lea rcx, [r14 + 0x20]
mov rdx, qword [rcx - 8]
cmp rdi, rdx
jb 0x180004406
mov eax, dword [rcx]
add rax, rdx
cmp rdi, rax
jb 0x180004416
inc ebx
add rcx, 0x128
cmp ebx, r8d
jb 0x1800043f3
jmp 0x18000443d
mov eax, ebx
imul rcx, rax, 0x128
mov rax, qword [rcx + r14 + 0x18]
mov qword [0x1800060e8], rax
mov eax, dword [rcx + r14 + 0x20]
mov dword [0x1800060f0], eax
test rsi, rsi
je 0x18000443d
mov dword [rsi], eax
test r14, r14
je 0x180004450
mov edx, 0x656c6946
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov r14, qword [rsp + 0x40]
mov rax, qword [0x1800060e8]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140002bc0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140003c50
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140003c50
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140002c30
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400080a4]
mov rbx, rcx
test esi, esi
jle 0x140002d60
mov rax, qword [0x1400080a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140002c7b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140002d05
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140002c60
mov rcx, rbx
call fcn.140003680
mov rdi, rax
test rax, rax
je 0x140002d82
mov rax, qword [0x1400080a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.1400037c0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400080a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140002d67
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140002cfe
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140002d10
add dword [0x1400080a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1400080a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140002cfe
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140002bc0
nop dword [rax]
xor esi, esi
jmp 0x140002c88
mov rax, qword [0x1400080a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140002bc0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140002bc0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400032f0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140008100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400080e0]
test rbx, rbx
je 0x14000334c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140003343
test rsi, rsi
je 0x140003343
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140003328
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140003680
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140005560]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400036a0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400036a8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400036a0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400036fd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400036f4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400036a0
add rax, 0x28
cmp rax, r9
jne 0x1400036e0
xor eax, eax
ret

Function at 0x140003700
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140005560]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000371f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140003728
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000371f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400037c0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140005560]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400037df
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400037e8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x14000c980
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000c9cc
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000c9c4
cmp dword [rcx + 0x3c], edx
jl 0x14000c9c4
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14000c9c4
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14000c9cc
mov rax, rdx
add rsp, 0x18
ret

Function at 0x1419b70b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1419b7237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1419b70e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1419b70c7
add dl, dl
jne 0x1419b70ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1419b714e
xor eax, eax
add dl, dl
jne 0x1419b70fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1419b7205
add dl, dl
jne 0x1419b710e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1419b711b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1419b7128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1419b7135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1419b7142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1419b70d6
mov eax, 1
add dl, dl
jne 0x1419b715e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1419b716b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1419b7153
sub eax, ebx
mov ebx, 1
jne 0x1419b71a4
mov ecx, 1
add dl, dl
jne 0x1419b7186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1419b7193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1419b717b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1419b70d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1419b71c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1419b71cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1419b71b5
cmp eax, 0x7d00
jae 0x1419b71f3
cmp eax, 0x500
jb 0x1419b71ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1419b70d6
cmp eax, 0x7f
ja 0x1419b71f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1419b70d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1419b722a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1419b70d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140003c90
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140003cc4
cmp word [rcx], 0x5a4d
jne 0x140003cc4
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140003cc4
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003cc4
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140003bd0
test eax, eax
jne 0x140003ce0
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140003c40
test rax, rax
je 0x140003cd5
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.14000448f
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x140004390
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140004330
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1400047f4
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x14055f618]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x14055f614]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x140004842
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14000483a
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140004929
inc ebx
add rax, 0x28
jmp 0x14000481a
mov rcx, r12
call fcn.140005021
mov rbp, rax
test rax, rax
jne 0x140004861
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140004790
movsxd rbx, ebx
mov rax, qword [0x14055f618]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.1400050cf
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14055f618]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1400048c3
mov rax, qword [0x14055f618]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140004790
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140004923
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140004923
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14055f618]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140004923
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140004790
inc dword [0x14055f614]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140004d50
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x14055f680]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14055f660]
test rbx, rbx
je 0x140004d9c
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140004d96
test eax, eax
jne 0x140004d96
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x140004d6e
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140004f50
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140004f73
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140004f73
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140004f74
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x140004fae
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x140004fa5
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140004fb0
inc r8d
add rax, 0x28
jmp 0x140004f8c
xor eax, eax
ret

Function at 0x140005021
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x14055b710]
mov r8, rcx
mov rcx, r9
call fcn.140004f50
test eax, eax
je 0x14000504d
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140004f74
xor eax, eax
add rsp, 0x28
ret