joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180051900
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.180066200
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x18008fbb0]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x180051af2
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x180051a46
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x180051a46
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x180051a2b
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x1800519c8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180051ab2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x180051b11
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x180051aed
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x180051b11
jmp 0x18005199e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.18000c480
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x180051b30
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.180066200
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x18008fbb0]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x180051d3d
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x180051c89
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x180051c89
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x180051c69
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x180051bf8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180051cfd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x180051d5c
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x180051d38
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x180051d5c
jmp 0x180051bce
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.18000c480
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x180065a28
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x18000003c]
lea rsi, [0x180000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x180065aa0
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x180065aa0
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x180065aa0
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x180065a94
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x180065ab2
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x180065a82
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x180065aa2
Function at 0x180067140
Capabilities:
Check if file exists
Create thread
Get file attributes
Inject dll
Inject thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
cmp qword [rsp + 0x70], 0
jne 0x180067161
mov eax, 1
jmp 0x1800672e6
mov rcx, qword [rsp + 0x78]
call fcn.1800308c0
test rax, rax
jne 0x180067187
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 2
jmp 0x1800672e6
mov rcx, qword [rsp + 0x78]
call fcn.1800308c0
cmp rax, 0x104
jbe 0x1800671ae
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 3
jmp 0x1800672e6
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1800671d3
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 7
jmp 0x1800672e6
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.LoadLibraryW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x78]
call fcn.1800308c0
lea rax, [rax + rax + 2]
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, rax
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x180067244
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 4
jmp 0x1800672e6
mov rcx, qword [rsp + 0x78]
call fcn.1800308c0
lea rax, [rax + rax + 2]
mov qword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x18006728a
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 5
jmp 0x1800672e6
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x40]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x1800672d9
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 6
jmp 0x1800672e6
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x60
pop rdi
ret
Function at 0x180067300
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x4f0
lea rdi, [rsp + 0x30]
mov ecx, 0x130
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x500]
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x4e8], rax
lea rax, [rsp + 0x268]
mov qword [rsp + 0x20], rax
mov r9d, 0x104
lea r8, [rsp + 0x500]
lea rdx, [rsp + 0x40]
xor ecx, ecx
call fcn.1800090c0
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x278], rax
cmp qword [rsp + 0x278], 0xffffffffffffffff
jne 0x180067386
xor eax, eax
jmp 0x180067438
mov dword [rsp + 0x290], 0x238
lea rdx, [rsp + 0x290]
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov dword [rsp + 0x4d4], eax
cmp dword [rsp + 0x4d4], 0
je 0x180067428
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x2bc]
call fcn.180030910
test eax, eax
jne 0x180067409
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x298]
call fcn.180067470
mov qword [rsp + 0x4d8], rax
cmp qword [rsp + 0x4d8], 0
jne 0x1800673ff
xor eax, eax
jmp 0x180067438
mov rax, qword [rsp + 0x4d8]
jmp 0x180067438
lea rdx, [rsp + 0x290]
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
mov dword [rsp + 0x4d4], eax
jmp 0x1800673ae
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, [0x180083fa0]
call fcn.180068160
mov rax, rdi
mov rcx, qword [rsp + 0x4e8]
xor rcx, rsp
call fcn.18000c480
add rsp, 0x4f0
pop rdi
ret
Function at 0x1400012e0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx], 0x78f69851
mov rsi, rcx
je 0x140001304
mov eax, 0xc0000001
jmp 0x1400013b7
xor edi, edi
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], edi
lea rdx, [rsp + 0x30]
mov ebx, edi
lea ecx, [rdi + 0x42]
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1400013b5
test rbx, rbx
je 0x14000133d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, dword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
mov ecx, 0x42
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14000132d
test rbx, rbx
je 0x1400013b5
mov r8d, dword [rbx]
test r8d, r8d
je 0x1400013aa
mov eax, edi
lea rcx, [rax + rax*2]
mov rdx, qword [rbx + rcx*8 + 8]
and rdx, 0xfffffffffffffffe
test byte [rbx + rcx*8 + 8], 1
je 0x1400013a3
cmp qword [rbx + rcx*8 + 0x10], 0x200000
jne 0x1400013a3
cmp dword [rbx + rcx*8 + 0x18], 0x546e6f43
je 0x1400013c7
inc edi
cmp edi, r8d
jb 0x140001378
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rsi + 8]
mov qword [rax], rdx
jmp 0x1400013b5

Function at 0x1400013d0
Capabilities:
Find process by pid

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx], 0x78f69851
mov rdi, rcx
jne 0x140001495
movsxd rax, dword [rcx + 4]
test eax, eax
je 0x140001495
and qword [r11 + 8], 0
lea rdx, [r11 + 8]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140001495
call fcn.1400014ac
mov rcx, qword [rsp + 0x40]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rdx, qword [rdi + 8]
mov rcx, rbx
mov rsi, qword [rdi + 0x18]
call fcn.1400016d0
test rax, rax
je 0x140001495
mov ecx, eax
mov edx, 0x1000
and ecx, 0xfff
sub edx, ecx
mov rcx, qword [rdi + 0x10]
cmp edx, esi
cmovl esi, edx
and qword [rsp + 0x48], 0
cmp byte [rdi + 0x20], 0
movsxd r8, esi
je 0x140001478
mov rdx, rcx
lea r9, [rsp + 0x48]
mov rcx, rax
call fcn.140001884
jmp 0x140001491
lea rdx, [rsp + 0x48]
mov r9d, 1
mov qword [rsp + 0x20], rdx
mov rdx, rax
call qword [sym.imp.ntoskrnl.exe_MmCopyMemory]
xor eax, eax
jmp 0x14000149a
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x100411cb0
Capabilities:
Encode data using xor

Disassembly:
popfq
xor byte [rax + 0x30], dl
jbe 0x100411ce6
cdq
xor byte [rax + rsi + 0x30a33095], bl
xor byte [rax], dh
jo 0x100411cf2
movabs dword [0x9c309c3095309830], eax
xor byte [rbx + 0x30], ah
invalid
xor byte [rax], dh
xor byte [rax + 0x30306130], bl
xor byte [rax], dh
xor byte [rax], dh
jns 0x100411d71
jns 0x100411d71
xchg ebp, eax
add dword [rax + 0x30], 0x798a7f7d
jl 0x100411d7a
scasb al, byte [rdi]
invalid
xor byte [rdi], bl
out dx, al
jns 0x100411df3
xchg ebx, eax
cmp dword [rcx + 0x7d], 0x305e8193
xor byte [rax], dh
xlatb
add dh, byte [rbx]
xor byte [rax], dh
xor byte [0x130714dbb], dh
xchg ebx, eax
sbb dword [rsi + 0x30], 0x2d73030
xor esi, dword [rax]
xor byte [rax], dh
xor eax, 0x30303030
xor byte [rax], dh
xor byte [rax], dh
xor byte [rax], dh
xor byte [rax], dh
xor byte [rax], dh
xor byte [rax], dh
xor byte [rbp - 0x69cfe287], cl
xor byte [rcx - 0x6acf5dd0], bl
xor byte [rsi - 0x57cf60d0], dl
xor byte [rsi + 0x30], bl
xchg ebp, eax
jns 0x100411db6
xor byte [rsi - 0x5dcf66d0], dl
xor byte [rbp - 0x60cf69d0], dl
xor byte [rax - 0x6acfa1d0], ch
xor byte [rax + 0x30309530], ch
xor byte [rdx + 0x30], cl
xor byte [rax], dh
mov esi, dword [rax]
xor byte [rax], dh
xor byte [rax], r14b
xor byte [rcx], dh
xor byte [rax], dh
xor byte [rax + rsi + 0x30], cl
xor byte [rbp + 0x30], bl
xor byte [rax], dh
xor byte [rax], dh
xor byte [rax], dh
mov dh, byte [rax]
xor byte [rax], dh
xor byte [r8], sil
xor byte [rbx], dh
xor byte [rax], dh
xor byte [rbp + 0x403261df], dl
xor byte [rax], dh
xor byte [rax], dh
jae 0x100411e4f
mov word [rax - 0x5d68605e], es
xchg ecx, eax
popfq
push rax
jbe 0x100411d89
pushfq
xchg ebp, eax
movabs dword [0x919c9c99aa9f7d8c], eax
push rax
jbe 0x100411d97
invalid
movabs byte [0xa299968ca89f9695], al
xchg ebp, eax
xchg esi, eax
lahf
test al, 0x5e
xchg ebp, eax
test al, 0x95
xor byte [rax], dh
push 0x5e305e30
xor byte [rax + rsi + 0x305e305e], cl
invalid
lahf
xor byte [rdx - 0x63cf66d0], ch
xor byte [rax + rsi + 0x30503091], bl
jbe 0x100411e8f
cdq
xor byte [rdx - 0x69cf6ad0], ah
xor byte [rdi - 0x73cf57d0], bl
xor byte [rsi - 0x5dcf66d0], dl
xor byte [rbp - 0x60cf69d0], dl
xor byte [rax - 0x6acfa1d0], ch
xor byte [rax + 0x50309530], ch
xor byte [rbx + 0x30], dh
push 0x30
invalid
lahf
xor byte [rdi - 0x6ecf5dd0], dl
xor byte [rbp + 0x76305030], bl
xor byte [rcx - 0x6acf63d0], bl
xor byte [rbx + 0x7d308c30], ah
xor byte [rdi - 0x66cf55d0], bl
xor byte [rax + rsi + 0x3091309c], bl
push rax
xor byte [rsi + 0x30], dh
cdq
xor byte [rdx - 0x69cf6ad0], ah
xor byte [rdi - 0x6fcf57d0], bl
xor byte [rax], dh
xor byte [rbx], dh
xor byte [rax + rsi + 0x309f307d], cl
stosb byte [rdi], al
xor byte [rcx - 0x63cf63d0], bl
xor byte [rcx + 0x76305030], dl
xor byte [rcx - 0x6acf5dd0], bl
xor byte [rsi - 0x57cf60d0], dl
xor byte [rax + 0x33303030], dl
xor byte [rax], dh
ror byte [rax + 0x30303030], 1
xor byte [rax], dh
xor byte [rbp + rdx*4 - 0x605b645d], dl
movabs al, byte [0x9397a2916892a65d]
xor byte [rsi - 0x9e76d4f], cl
or ebx, dword [rcx]
jbe 0x100411ea4
in eax, dx
cmp esp, dword [rax]
pushfq
xor eax, 0xa948020a
jno 0x100411e7e
invalid
Function at 0x1400025c8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002612
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002612
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002612
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002612
cmp dword [rcx + 0x84], 0xe
jbe 0x140002612
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002614
xor al, al
add rsp, 0x28
ret

Function at 0x140006708
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140006573
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006573
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140006573
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140006573
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140006573
cmp dword [rcx + 0x84], 0xe
jbe 0x140006573
cmp dword [rcx + 0xf8], 0
je 0x140006573
mov ecx, ebx
call fcn.140006624
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140006400
nop
cmp dword [rbp + 0x20], 0
je 0x1400065c1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400065cc
int3
xor r8d, r8d
xor edx, edx
jmp 0x140006504
Function at 0x1400116c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x1400297d0]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x140011717
cmp word [rdx], r13w
jne 0x140011717
or byte [rax + rdi*8 + 0x38], cl
jmp 0x14001171c
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x140011841
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x140011862
lea r9, [rdx + 2]
cmp cx, r11w
je 0x140011755
mov rdx, r9
mov word [rbx], cx
jmp 0x14001177c
cmp r9, r8
jae 0x14001178c
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x140011736
jmp 0x140011841
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140011836
cmp dword [rsp + 0x80], esi
je 0x140011836
lea r8, [0x1400297d0]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x14001180e
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x1400117de
mov word [rbx], r13w
jmp 0x14001183e
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x1400117eb
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x14001183e
cmp word [rsp + 0x70], r13w
jne 0x14001181b
cmp rbx, r14
je 0x1400117d8
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.140016d20
cmp word [rsp + 0x70], r13w
je 0x140011841
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1400297d0]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x14001183b
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x140011841
Function at 0x140013560
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400135e7
mov rsi, rbx
cmp word [rax], bp
je 0x1400135a6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140013590
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14001358c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14000d9b8
mov rdi, rax
test rax, rax
je 0x1400135d4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14001a2a0
mov rbp, rdi
xor ecx, ecx
call fcn.14000d97c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140016718
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001672e
mov al, 1
jmp 0x14001678e
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001673f
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001678c
mov ecx, dword [rcx + 0x18]
nop
call fcn.140013aa8
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001678c
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001678c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001678c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001678e
xor al, al
add rsp, 0x20
pop rbx
ret