joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cc61c
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
xor r9d, r9d
mov esi, edx
mov r10d, edx
mov rbx, rcx
shr r10d, 4
mov r11, r8
mov edi, r9d
movabs rbp, 0x87c37b91114253d5
movabs r14, 0x4cf5ad432745937f
test r10d, r10d
je 0x1400cc6b5
lea edx, [rdi + rdi]
inc edi
mov rcx, qword [rbx + rdx*8]
lea eax, [rdx + 1]
mov rax, qword [rbx + rax*8]
imul rax, r14
imul rcx, rbp
rol rax, 0x21
imul rax, rbp
rol rcx, 0x1f
xor rax, r11
imul rcx, r14
rol rax, 0x1f
xor rcx, r8
add rax, 0xb41def1
rol rcx, 0x1b
add rcx, r11
lea r8, [rcx*4 + 0x52dce729]
add r8, rcx
add rax, r8
lea r11, [rax + rax*4]
cmp edi, r10d
jb 0x1400cc65f
shl r10d, 4
mov eax, esi
mov ecx, r10d
and eax, 0xf
add rcx, rbx
cmp eax, 8
ja 0x1400cc713
je 0x1400cc790
sub eax, 1
je 0x1400cc7db
sub eax, 1
je 0x1400cc7d0
sub eax, 1
je 0x1400cc7c5
sub eax, 1
je 0x1400cc7ba
sub eax, 1
je 0x1400cc7af
sub eax, 1
je 0x1400cc7a4
cmp eax, 1
je 0x1400cc799
jmp 0x1400cc7f0
sub eax, 9
je 0x1400cc77a
sub eax, 1
je 0x1400cc76f
sub eax, 1
je 0x1400cc764
sub eax, 1
je 0x1400cc759
sub eax, 1
je 0x1400cc74e
sub eax, 1
je 0x1400cc743
cmp eax, 1
jne 0x1400cc7f0
movzx r9d, byte [rcx + 0xe]
shl r9, 0x30
movzx eax, byte [rcx + 0xd]
shl rax, 0x28
xor r9, rax
movzx eax, byte [rcx + 0xc]
shl rax, 0x20
xor r9, rax
movzx eax, byte [rcx + 0xb]
shl rax, 0x18
xor r9, rax
movzx eax, byte [rcx + 0xa]
shl rax, 0x10
xor r9, rax
movzx eax, byte [rcx + 9]
shl rax, 8
xor r9, rax
movzx eax, byte [rcx + 8]
xor rax, r9
imul rax, r14
rol rax, 0x21
imul rax, rbp
xor r11, rax
movzx r9d, byte [rcx + 7]
shl r9, 0x38
movzx eax, byte [rcx + 6]
shl rax, 0x30
xor r9, rax
movzx eax, byte [rcx + 5]
shl rax, 0x28
xor r9, rax
movzx eax, byte [rcx + 4]
shl rax, 0x20
xor r9, rax
movzx eax, byte [rcx + 3]
shl rax, 0x18
xor r9, rax
movzx eax, byte [rcx + 2]
shl rax, 0x10
xor r9, rax
movzx eax, byte [rcx + 1]
shl rax, 8
xor r9, rax
movzx eax, byte [rcx]
xor rax, r9
imul rax, rbp
rol rax, 0x1f
imul rax, r14
xor r8, rax
mov rbx, qword [rsp + 0x10]
xor r11, rsi
mov rbp, qword [rsp + 0x18]
movabs rdx, 0xff51afd7ed558ccd
mov rdi, qword [rsp + 0x28]
mov rax, rsi
mov rsi, qword [rsp + 0x20]
xor rax, r8
add rax, r11
mov rcx, rax
add r11, rax
shr rcx, 0x21
xor rcx, rax
mov rax, r11
imul rcx, rdx
shr rax, 0x21
mov r8, rcx
xor rax, r11
imul rax, rdx
shr r8, 0x21
xor r8, rcx
mov rdx, rax
shr rdx, 0x21
movabs rcx, 0xc4ceb9fe1a85ec53
xor rdx, rax
imul rdx, rcx
imul r8, rcx
mov rax, rdx
shr rax, 0x21
xor rdx, rax
mov rcx, r8
shr rcx, 0x21
xor rcx, r8
add rcx, rdx
lea rax, [rdx + rcx]
xor rax, rcx
pop r14
ret
Function at 0x1400cd074
Capabilities:
Clear file content
Write file on windows

Disassembly:
mov r11, rsp
push rbp
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], rdi
mov rax, qword [0x1401a7d98]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, r8
mov rcx, rdx
and qword [r11 - 0x58], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400cd12d
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x1400cd0f3
mov eax, 0x36fd
jmp 0x1400cd104
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x1400cd104
int3
lea rcx, str.onecore_basewcp_toolsmtcommonmt_util.cpp
mov qword [rbp - 0x40], rcx
lea rcx, str.SetFileContents
mov qword [rbp - 0x38], rcx
mov dword [rbp - 0x30], 0xf6
lea rcx, str.FileHandle_____HANDLE__LONG_PTR__1_
jmp 0x1400cd206
and dword [rbp - 0x18], 0
and qword [rsp + 0x20], 0
lea r9, [rbp - 0x18]
mov r8d, dword [rdi]
mov rdx, qword [rdi + 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
test eax, eax
jne 0x1400cd1a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x1400cd16c
mov eax, 0x36fd
jmp 0x1400cd17d
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x1400cd17d
int3
lea rcx, str.onecore_basewcp_toolsmtcommonmt_util.cpp
mov qword [rbp - 0x40], rcx
lea rcx, str.SetFileContents
mov qword [rbp - 0x38], rcx
mov dword [rbp - 0x30], 0xff
lea rcx, str.EnsureBOOL_::WriteFile__FileHandle__FileContents__Buffer___DWORD__FileContents__Length__dwWrote__0__
jmp 0x1400cd206
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
nop dword [rax + rax]
test eax, eax
jne 0x1400cd24a
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x1400cd1d1
mov eax, 0x36fd
jmp 0x1400cd1e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x1400cd1e2
int3
lea rcx, str.onecore_basewcp_toolsmtcommonmt_util.cpp
mov qword [rbp - 0x40], rcx
lea rcx, str.SetFileContents
mov qword [rbp - 0x38], rcx
mov dword [rbp - 0x30], 0x104
lea rcx, str.EnsureBOOL_::SetEndOfFile_FileHandle__
mov qword [rbp - 0x28], rcx
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.14009dbd4
mov edi, eax
mov r8d, eax
lea rcx, [rbp - 0x40]
call fcn.1400c81b4
nop
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400cd246
mov rcx, rbx
call qword [sym.imp.NTDLL.dll_NtClose]
nop dword [rax + rax]
nop
mov eax, edi
jmp 0x1400cd261
test rbx, rbx
je 0x1400cd25f
mov rcx, rbx
call qword [sym.imp.NTDLL.dll_NtClose]
nop dword [rax + rax]
nop
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140109af0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400d30b0
Capabilities:
Hash data via wincrypt

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1401a7d98]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
mov r14d, 0xffffffff
cmp rbx, r14
jbe 0x1400d30e3
mov edi, r14d
jmp 0x1400d30ee
mov edi, ebx
cmp rbx, rdi
jne 0x1400d317c
mov rcx, qword [rbp + 0x10]
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
nop dword [rax + rax]
test eax, eax
je 0x1400d3119
mov eax, edi
add rsi, rax
sub rbx, rax
jne 0x1400d30d9
xor eax, eax
jmp 0x1400d3181
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x1400d3138
int3
lea rax, str.onecore_basewcphashcryptohash.cpp
mov dword [rsp + 0x30], SystemTimeToVariantTime
mov qword [rsp + 0x20], rax
lea rax, str.Windows::Hash::Implementation::Rtl::CCryptHash::Update
mov qword [rsp + 0x28], rax
lea rax, str.::CryptHashData__m_Hash__pbData__dwToHash__0_
mov qword [rsp + 0x38], rax
call fcn.14009dbd4
mov r8d, eax
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.1400c81b4
mov eax, ebx
jmp 0x1400d3181
mov eax, 0xc00000e5
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140109af0
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400d33c0
Capabilities:
Initialize hashing via wincrypt

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1401a7d98]
xor rax, rsp
mov qword [rsp + 0x58], rax
and qword [rsp + 0x50], 0
mov rcx, r9
mov rsi, r9
mov edi, r8d
mov rbx, rdx
call fcn.1400d2b9c
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, edi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
nop dword [rax + rax]
test eax, eax
jne 0x1400d347b
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x80090008
je 0x1400d348b
test eax, eax
jne 0x1400d342b
int3
lea rcx, str.onecore_basewcphashcryptohash.cpp
mov dword [rsp + 0x40], 0x118
mov qword [rsp + 0x30], rcx
lea rcx, str.Windows::Hash::Implementation::Rtl::CCryptHash::CreateHashFromProvider
mov qword [rsp + 0x38], rcx
lea rcx, str.dwWin32Error
mov qword [rsp + 0x48], rcx
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.14009dbd4
mov r8d, eax
lea rcx, [rsp + 0x30]
mov ebx, eax
call fcn.1400c81b4
jmp 0x1400d348d
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsi]
mov qword [rsp + 0x50], rax
mov qword [rsi], rcx
xor ebx, ebx
lea rcx, [rsp + 0x50]
call fcn.1400d2b9c
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140109af0
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400d4444
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process filename
Get process heap force flags

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rsi, rdx
mov rdi, rcx
mov rax, qword gs:[0x60]
xor edx, edx
lea r8d, [rdx + 0x18]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400d44a8
and qword [rax + 8], 0
mov dword [rax + 0x10], 1
mov rcx, rsi
call fcn.1400f7308
mov qword [rbx], rax
jmp 0x1400d44aa
xor ebx, ebx
mov qword [rdi], rbx
test rbx, rbx
je 0x1400d44c6
mov rax, rdi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov ecx, 0x8007000e
call fcn.1400f72d8
int3

Function at 0x1400d44d8
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process filename
Get process heap force flags

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov rsi, rdx
mov rdi, rcx
mov rax, qword gs:[0x60]
xor edx, edx
lea r8d, [rdx + 0x18]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1400d454d
and qword [rax + 8], 0
mov dword [rax + 0x10], 1
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
nop dword [rax + rax]
mov qword [rbx], rax
test rax, rax
jne 0x1400d454f
test rsi, rsi
jne 0x1400d4576
jmp 0x1400d454f
xor ebx, ebx
mov qword [rdi], rbx
test rbx, rbx
je 0x1400d456b
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, 0x8007000e
call fcn.1400f72d8
nop
mov ecx, 0x8007000e
call fcn.1400f72d8
int3

Function at 0x1400d4588
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov rsi, rdx
mov rdi, rcx
test rdx, rdx
je 0x1400d45d2
mov rbx, qword [rcx]
test rbx, rbx
je 0x1400d45cb
mov rax, qword [rbx + 8]
test rax, rax
jne 0x1400d45cd
mov rcx, qword [rbx]
call fcn.1400f74b8
mov qword [rbx + 8], rax
jmp 0x1400d45cd
xor eax, eax
cmp rax, rsi
je 0x1400d4629
mov rcx, rdi
call fcn.1400d3c1c
mov rax, qword gs:[0x60]
xor edx, edx
lea r8d, [rdx + 0x18]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1400d461f
and qword [rax + 8], 0
mov dword [rax + 0x10], 1
mov rcx, rsi
call fcn.1400f7308
mov qword [rbx], rax
jmp 0x1400d4621
xor ebx, ebx
mov qword [rdi], rbx
test rbx, rbx
je 0x1400d463d
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov ecx, 0x8007000e
call fcn.1400f72d8
int3
Function at 0x1400d4650
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov rsi, rdx
mov rdi, rcx
test rdx, rdx
je 0x1400d4688
mov rax, qword [rcx]
test rax, rax
je 0x1400d4681
mov rcx, qword [rax]
jmp 0x1400d4683
xor ecx, ecx
cmp rcx, rsi
je 0x1400d46f0
mov rcx, rdi
call fcn.1400d3c1c
mov rax, qword gs:[0x60]
xor edx, edx
lea r8d, [rdx + 0x18]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1400d46e6
and qword [rax + 8], 0
mov dword [rax + 0x10], 1
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
nop dword [rax + rax]
mov qword [rbx], rax
test rax, rax
jne 0x1400d46e8
test rsi, rsi
jne 0x1400d470f
jmp 0x1400d46e8
xor ebx, ebx
mov qword [rdi], rbx
test rbx, rbx
je 0x1400d4704
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov ecx, 0x8007000e
call fcn.1400f72d8
nop
mov ecx, 0x8007000e
call fcn.1400f72d8
int3

Function at 0x1400d4720
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rdi
sub rsp, 0x30
mov qword [rax - 0x10], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rdi, r8
mov rbx, rdx
and dword [rax - 0x18], 0
mov rax, qword [rcx]
mov qword [rdx], rax
test rax, rax
je 0x1400d4751
lock inc dword [rax + 0x10]
mov dword [rsp + 0x20], 1
mov rax, qword gs:[0x60]
xor edx, edx
lea r8d, [rdx + 0x18]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400d4795
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.1400d47c8
mov rdi, rax
jmp 0x1400d4797
xor edi, edi
test rdi, rdi
je 0x1400d47b6
mov rcx, rbx
call fcn.1400d3c1c
mov qword [rbx], rdi
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov ecx, 0x8007000e
call fcn.1400f72d8
int3
Function at 0x1400e0654
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x490
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1401a7d98]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rsi, rcx
mov qword [rsp + 0x50], rcx
mov rbx, qword [rcx + 0xc8]
test rbx, rbx
je 0x1400e06b0
mov rcx, qword [rbx + 8]
test rcx, rcx
jne 0x1400e06b2
mov rcx, qword [rbx]
call fcn.1400f74b8
mov qword [rbx + 8], rax
mov rcx, rax
jmp 0x1400e06b2
xor ecx, ecx
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
nop dword [rax + rax]
mov rdi, rax
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
jne 0x1400e06f7
call fcn.1400de160
jmp 0x1400e07e9
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x40], eax
and qword [rsp + 0x70], 0
lea ecx, [rax + 1]
mov r8d, ecx
test ecx, ecx
je 0x1400e074e
xor edx, edx
or rax, 0xffffffffffffffff
div r8
cmp rax, 1
jb 0x1400e080f
cmp r8, 0x400
jbe 0x1400e074e
mov rdx, r8
lea rcx, [rsp + 0x70]
call fcn.1400e6cfc
mov rdx, qword [rsp + 0x70]
jmp 0x1400e0758
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x70], rdx
jmp 0x1400e076d
test rdx, rdx
jne 0x1400e0779
mov ebx, 0x8007000e
jmp 0x1400e07c1
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop dword [rax + rax]
test eax, eax
jne 0x1400e07a5
call fcn.1400de160
mov ebx, eax
test eax, eax
js 0x1400e07c1
mov edx, dword [rsp + 0x68]
mov rax, qword [rsp + 0x70]
mov byte [rdx + rax], 0
mov rdx, qword [rsp + 0x70]
mov rcx, rsi
call fcn.1400e0824
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x1400e07e7
lea rcx, [rsp + 0x70]
call fcn.1400e56b0
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.140109af0
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov ecx, 0x80070057
call fcn.1400de138
int3
Function at 0x1400e3928
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x40
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
and dword [rax - 0x28], 0
mov qword [rax - 0x10], rcx
mov rax, qword gs:[0x60]
xor edx, edx
lea r8d, [rdx + 0x28]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x1400e39a0
mov byte [rax + 0x20], 0xff
mov qword [rsp + 0x28], rax
movsx rcx, byte [rsi + 0x20]
inc rcx
mov r8, rsi
lea rdx, [rsp + 0x28]
call fcn.1400ed42c
nop
jmp 0x1400e39a2
xor ebx, ebx
mov qword [rdi], rbx
mov dword [rsp + 0x20], 1
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1400e8ad4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rbp, rdx
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor eax, eax
mov dword [rsp + 0x20], eax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 7
mov word [rcx], ax
mov dword [rsp + 0x20], 1
mov rax, qword [rdx + 0x10]
inc rax
mov rsi, qword [rcx + 0x10]
cmp rsi, rax
ja 0x1400e8bb1
cmp qword [rcx + 0x18], rax
je 0x1400e8bb1
jae 0x1400e8b43
sub rax, rsi
mov rdx, rax
call fcn.1400ed634
mov qword [rbx + 0x10], rsi
jmp 0x1400e8bb1
cmp rax, 8
jae 0x1400e8bb1
cmp qword [rcx + 0x18], 8
jb 0x1400e8bb1
mov rdi, qword [rcx]
lea r8, [rsi*2 + 2]
mov rdx, rdi
call fcn.14010b910
mov rax, qword [rbx + 0x18]
lea rax, [rax*2 + 2]
cmp rax, 0x1000
jb 0x1400e8b8b
mov rcx, qword [rdi - 8]
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x1400e8bdc
mov rdi, rcx
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov qword [rbx + 0x18], 7
mov rdx, rbp
mov rcx, rbx
call fcn.1400e3cb8
lea rdx, [0x14016999c]
mov rcx, rbx
call fcn.1400e3c24
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
call fcn.1400fdd0c
int3
Function at 0x1400ec8f0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rbx, rdx
mov rdi, rcx
mov rax, qword gs:[0x60]
xor edx, edx
lea r8d, [rdx + 0x18]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1400ec950
mov ecx, 1
mov dword [rax + 8], ecx
mov dword [rax + 0xc], ecx
lea rcx, [0x14012d8d8]
mov qword [rax], rcx
mov qword [rax + 0x10], rbx
mov qword [rdi], rbx
mov qword [rdi + 8], rax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400ee5c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x40
mov qword [rax - 0x20], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rsi, rdx
mov rdi, rcx
mov qword [rax - 0x18], rcx
and dword [rax - 0x28], 0
mov rax, qword gs:[0x60]
xor edx, edx
lea r8d, [rdx + 0x28]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1400ee624
mov byte [rax + 0x20], 0xff
mov rdx, rsi
mov rcx, rax
call fcn.1400e6838
nop
jmp 0x1400ee626
xor ebx, ebx
mov qword [rdi], rbx
mov dword [rsp + 0x20], 1
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x1400ee79c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
nop dword [rax + rax]
xor r14d, r14d
test rax, rax
je 0x1400ee82a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x1400ee82a
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
nop dword [rax + rax]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x1400ee81a
cmp rbx, rcx
jae 0x1400ee82a
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x1400ee805
cmp rbx, rcx
jae 0x1400ee82a
cmp word [rbx], r14w
je 0x1400ee82a
mov rax, rbx
jmp 0x1400ee82c
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400f4814
Capabilities:
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
and qword [rax + 0x10], 0
lea rsi, [rax + 0x10]
test rdx, rdx
mov rdi, r8
cmovne rsi, rdx
and qword [rax - 0x10], 0
and dword [rax - 0x18], 0
xor r9d, r9d
xor edx, edx
and qword [rsi], 0
and qword [r8], 0
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
nop dword [rax + rax]
mov qword [rsi], rax
test rax, rax
jne 0x1400f4881
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1400f48aa
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
nop dword [rax + rax]
mov qword [rdi], rax
test rax, rax
je 0x1400f4865
xor ebx, ebx
test ebx, ebx
jns 0x1400f48d3
mov rcx, rsi
call fcn.1400f47e4
mov rcx, qword [rdi]
and qword [rdi], 0
lea rdx, [rcx - 1]
cmp rdx, 0xfffffffffffffffd
ja 0x1400f48d3
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
nop dword [rax + rax]
lea rcx, [rsp + 0x48]
call fcn.1400f47e4
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400f48f8
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
and dword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
and qword [rdi + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetFileSize]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1400f494b
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
je 0x1400f494b
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1400f4962
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x38], ebx
xor ebx, ebx
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x38]
mov qword [rdi + 0x20], rax
test ebx, ebx
js 0x1400f4981
mov rcx, qword [rdi + 0x10]
lea r8, [rdi + 0x28]
lea rdx, [rdi + 0x18]
call fcn.1400f4814
mov ebx, eax
test eax, eax
js 0x1400f4981
xor ebx, ebx
jmp 0x1400f4989
mov rcx, rdi
call fcn.1400f4a68
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14010a55c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1401a90c0], eax
call fcn.14010a2a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1401a90c0], 0
jne 0x14010a59f
mov ecx, 1
call fcn.14010a2a0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]