joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140108656
Capabilities:
Create pipe

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x188
mov rsi, rcx
mov rax, qword [0x1401c6b58]
xor rax, rsp
mov qword [rsp + 0x180], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [section..rdata]
movaps xmmword [rsp + 0x40], xmm0
test dl, dl
je 0x140108742
lea rdi, [rsp + 0x70]
xor ebx, ebx
mov r8d, 0x110
mov rcx, rdi
xor edx, edx
call fcn.14014b870
mov dword [rdi - 0xc], 0x11c
mov r14, qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call r14
mov rcx, rax
mov edx, 1
mov r8b, 3
call r14
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call r14
mov qword [rdi - 8], 6
mov word [rdi + 0x108], 0
lea rcx, [rsp + 0x64]
mov edx, 0x23
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov edi, 0x80003
test eax, eax
je 0x140108749
xorps xmm0, xmm0
lea rbx, [rsp + 0x40]
movaps xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov dword [rbx], 0x18
xor ecx, ecx
call fcn.1401087ac
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], 1
jmp 0x140108749
mov edi, 3
xor ebx, ebx
test byte [rsi], 1
je 0x140108754
mov rsi, qword [rsi + 0x10]
jmp 0x140108758
add rsi, 2
mov qword [rsp + 0x38], rbx
mov eax, 0x200
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x30], 0
mov rcx, rsi
mov edx, edi
mov r8d, 6
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rsi, rax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140148650
mov rax, rsi
add rsp, 0x188
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140108c18
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x1401c6b58]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140108cd0]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 8], rax
test rax, rax
je 0x140108c73
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140148650
nop
add rsp, 0x68
pop rdi
pop rsi
ret
lea rdx, str.Start
lea r8, str....._third_partycrashpadcrashpadutil_thread_thread_win.cc
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov r9d, 0x1b
call fcn.140059c00
lea rdx, str.platform_thread_
lea rdi, [rsp + 0x58]
mov rcx, rdi
mov r8, rsi
call fcn.140064760
lea rdx, [0x14019c5fa]
mov rcx, rdi
call fcn.14000ee10
mov rcx, rdi
call fcn.140064810
jmp 0x140108c5e
Function at 0x140109bd2
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1401c6b58]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov qword [rcx + 8], rdx
mov eax, dword [0x1401cd880]
mov ecx, dword [0x1401ca5a0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x40]
jg 0x140109e4f
mov rax, qword [0x1401cd878]
test rax, rax
je 0x140109cbd
lea rdx, [rsp + 0x174]
mov dword [rdx], 0xaaaaaaaa
mov rcx, rdi
call qword [0x1401de008]
test eax, eax
je 0x140109c67
cmp dword [rsp + 0x174], 0
setne byte [rsi + 0x81]
je 0x140109cc4
mov byte [rsi + 0x80], 0
mov dl, 1
jmp 0x140109cf9
mov ecx, 2
call fcn.140056eb0
test al, al
je 0x140109cbd
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r8d, 0x4b
mov r9d, 2
call fcn.1400581a0
lea rcx, [rsp + 0x40]
lea rdx, [0x1401972a8]
mov r8d, 0xe
call fcn.14000211d
mov rcx, rbx
call fcn.140058290
mov byte [rsi + 0x81], 0
movaps xmm0, xmmword [section..rdata]
lea rbx, [rsp + 0x30]
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [rbx], 9
sete byte [rsi + 0x80]
cmp byte [rsi + 0x81], 0
setne dl
lea rax, [rsi + 0x30]
lea r9, [rsi + 0x28]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov r8, rsi
call fcn.140109e96
test al, al
je 0x140109d2f
cmp byte [rsi + 0x80], 0
mov rdx, qword [rsi + 0x28]
mov rcx, rdi
mov r8, rsi
je 0x140109d78
call fcn.14010a0ca
jmp 0x140109d7d
mov ecx, 2
call fcn.140056eb0
test al, al
je 0x140109e30
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x21e
mov r9d, 2
call fcn.140056fb0
lea rcx, [rsp + 0x40]
lea rdx, str.GetProcessBasicInformation_failed
mov r8d, 0x21
jmp 0x140109e23
call fcn.14010a809
test al, al
je 0x140109de3
mov dl, byte [rsi + 0x80]
mov rcx, rdi
mov r8, rsi
call fcn.1401091e0
mov sil, 1
test al, al
jne 0x140109e32
mov ecx, 2
call fcn.140056eb0
test al, al
je 0x140109e30
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x22c
mov r9d, 2
call fcn.140056fb0
lea rcx, [rsp + 0x40]
lea rdx, str.ReadMemoryInfo_failed
mov r8d, 0x15
jmp 0x140109e23
mov ecx, 2
call fcn.140056eb0
test al, al
je 0x140109e30
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x227
mov r9d, 2
call fcn.140056fb0
lea rcx, [rsp + 0x40]
lea rdx, str.ReadProcessData_failed
mov r8d, 0x16
call fcn.14000211d
mov rcx, rsi
call fcn.1400574d0
xor esi, esi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.140148650
mov eax, esi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1401cd880]
call fcn.140148390
cmp dword [0x1401cd880], 0xffffffff
jne 0x140109c1d
lea rcx, [0x1401880a2]
lea rdx, str.::IsWow64Process
xor r8d, r8d
call fcn.140108ba8
mov qword [0x1401cd878], rax
lea rcx, [0x1401cd880]
call fcn.140148428
jmp 0x140109c1d
Function at 0x14010fe74
Capabilities:
Create pipe

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r14, qword [rsp + 0xc8]
mov rax, qword [0x1401c6b58]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [r14], 0xffffffffffffffff
mov esi, 5
cmp ecx, 3
jne 0x14010ff74
mov edi, dword [rsp + 0xc0]
mov r11d, dword [rsp + 0xb8]
mov ecx, dword [rsp + 0xb0]
mov eax, dword [rsp + 0xa8]
mov r10d, dword [rsp + 0xa0]
test byte [r8], 1
je 0x14010fedc
mov r8, qword [r8 + 0x10]
jmp 0x14010fee0
add r8, 2
mov rsi, qword [rdx]
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], ecx
mov qword [rsp + 0x38], 0
mov rcx, r8
mov edx, r9d
mov r8d, r10d
mov r9d, eax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp rax, 0xffffffffffffffff
je 0x14010ff5e
mov rdi, rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x40]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r15d, r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
mov dword [rsp + 0x30], 3
mov rcx, rax
mov rdx, rdi
mov r8, rsi
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp eax, 1
sbb r15, r15
or r15, qword [rbx]
jmp 0x14010ff65
mov r15, 0xffffffffffffffff
mov qword [r14], r15
xor eax, eax
cmp r15, 0xffffffffffffffff
sete al
lea esi, [rax + rax*4]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140148650
mov eax, esi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140111f00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov rsi, rcx
mov rax, qword [0x1401c6b58]
xor rax, rsp
mov qword [rsp + 0xb0], rax
test dl, dl
je 0x140111f8d
lea rax, [0x14012cd20]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
lea rdi, [0x1401a0d50]
lea r8, str.NtMapViewOfSection
mov rcx, rsi
mov rdx, rdi
mov r9d, 1
call fcn.1401118d6
lea rax, [0x14012cd90]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 1
lea r8, str.NtUnmapViewOfSection
mov rcx, rsi
mov rdx, rdi
mov r9d, 1
call fcn.1401118d6
jmp 0x140111f98
cmp qword [rsi + 0x18], 0
je 0x14011210e
mov rax, qword [rsi]
mov rdi, qword [rax]
mov dword [rsp + 0x20], 1
mov r13, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r8d, 0x10000
mov rcx, rdi
xor edx, edx
mov r9d, 0x2000
call r13
mov r14, rax
mov r12, qword [rsi + 0x18]
shl r12, 6
lea rbx, [r12 + 0x60]
mov rcx, rbx
call fcn.140111708
mov r15, rax
mov edx, r15d
and edx, 0xfffff000
add rdx, r14
and r15d, 0xfff
add r12, 0x105f
and r12, 0xfffffffffffff000
mov dword [rsp + 0x20], 0x40
mov rcx, rdi
mov r8, r12
mov r9d, 0x1000
call r13
mov r14, rax
test rax, rax
je 0x140112136
add r14, r15
movaps xmm0, xmmword [section..rdata]
lea r15, [rsp + 0x50]
movups xmmword [r15 + 0x10], xmm0
movups xmmword [r15 + 0x50], xmm0
movups xmmword [r15 + 0x40], xmm0
movups xmmword [r15 + 0x30], xmm0
movups xmmword [r15 + 0x20], xmm0
mov qword [r15], rbx
mov dword [r15 + 0x18], 0
mov qword [r15 + 8], 0x20
lea rcx, [0x1401cd910]
mov r8d, 0xd8
xor edx, edx
call fcn.14014b870
mov rcx, rsi
mov rdx, r14
mov r8, rbx
mov r9, r15
call fcn.140112528
mov ebp, eax
test eax, eax
jne 0x140112110
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rcx, [rsp + 0x40]
mov qword [rcx], rax
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x50]
mov r9d, 0x20
mov rcx, rdi
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebp, 0x2a
test eax, eax
je 0x140112110
cmp qword [rsp + 0x40], 0x20
jne 0x140112110
lea rax, [rsp + 0x3c]
mov dword [rax], 0xaaaaaaaa
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov rdx, r14
mov r8, rbx
mov r9d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [rsi]
lea rdx, str.g_originals
lea r8, [0x1401cd910]
mov r9d, 0xd8
call fcn.1400f24ee
mov ebp, eax
jmp 0x140112110
xor ebp, ebp
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140148650
mov eax, ebp
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, str.PatchNtdll
lea r8, str....._sandboxwin_srcinterception.cc
lea r12, [rsp + 0x50]
mov rcx, r12
mov r9d, 0x17e
call fcn.140059c00
lea rdx, str.thunk_base
lea r13, [rsp + 0x48]
mov rcx, r13
mov r8, r12
call fcn.140064660
mov rcx, r13
call fcn.140064810
jmp 0x140112020
Function at 0x140119ed1
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, r8
mov rax, qword [0x1401c6b58]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, 0xaaaaaaaa
lea rdi, [rsp + 0x44]
mov dword [rdi], eax
lea r8, [rsp + 0x40]
mov dword [r8], eax
lea rax, [rsp + 0x3c]
mov dword [rax], 4
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rdi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x140119f31
mov eax, dword [rsp + 0x40]
mov dword [rsi], eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140148650
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret

Function at 0x14011a080
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x1a0
mov rax, qword [0x1401c6b58]
xor rax, rsp
mov qword [rsp + 0x198], rax
movaps xmm0, xmmword [section..rdata]
lea rsi, [rsp + 0x160]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsi + 0x20], 0x100
jb 0x14011a113
mov ecx, 1
call fcn.140056eb0
test al, al
je 0x14011a113
lea rdx, str....._third_partycrashpadcrashpad_snapshotwin_system_snapshot_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x10a
mov r9d, 1
call fcn.140056fb0
lea rcx, [rsp + 0x38]
lea rdx, str.dwNumberOfProcessors_exceeds_uint8_t_storage
mov r8d, 0x2c
call fcn.14000211d
mov rcx, rsi
call fcn.1400574d0
mov eax, dword [rsp + 0x180]
cmp eax, 0x100
mov esi, 0xff
cmovb esi, eax
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.140148650
mov eax, esi
add rsp, 0x1a0
pop rsi
ret
Function at 0x14013b5c0
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1401c6b58]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [section..rdata]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.14013c07c
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.140145f6c
test al, al
je 0x14013b691
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x14013b6da
mov rcx, r14
call fcn.14013c07c
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0x108
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.140145f6c
test al, al
je 0x14013b723
cmp dword [rbx], 0x4550
jne 0x14013b766
mov sil, 1
test rdi, rdi
je 0x14013b7da
mov qword [rdi], r14
jmp 0x14013b7da
mov ecx, 1
call fcn.140056eb0
test al, al
je 0x14013b7d8
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.140056fb0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
jmp 0x14013b7a6
mov ecx, 1
call fcn.140056eb0
test al, al
je 0x14013b7d8
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.140056fb0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x14013b7a6
mov ecx, 1
call fcn.140056eb0
test al, al
je 0x14013b7d8
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.140056fb0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x14013b6cf
mov ecx, 1
call fcn.140056eb0
test al, al
je 0x14013b7d8
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.140056fb0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
call fcn.14000211d
movzx r8d, byte [rsi]
test r8b, 1
je 0x14013b7bf
mov r8, qword [rsi + 8]
mov rsi, qword [rsi + 0x10]
jmp 0x14013b7c5
shr r8d, 1
inc rsi
mov rcx, rax
mov rdx, rsi
call fcn.14000211d
mov rcx, rdi
call fcn.1400574d0
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.140148650
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14013b7fc
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1401c6b58]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [section..rdata]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.14013c07c
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.140145f6c
test al, al
je 0x14013b8cd
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x14013b916
mov rcx, r14
call fcn.14013c07c
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0xf8
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.140145f6c
test al, al
je 0x14013b95f
cmp dword [rbx], 0x4550
jne 0x14013b9a2
mov sil, 1
test rdi, rdi
je 0x14013ba16
mov qword [rdi], r14
jmp 0x14013ba16
mov ecx, 1
call fcn.140056eb0
test al, al
je 0x14013ba14
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.140056fb0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
jmp 0x14013b9e2
mov ecx, 1
call fcn.140056eb0
test al, al
je 0x14013ba14
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.140056fb0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x14013b9e2
mov ecx, 1
call fcn.140056eb0
test al, al
je 0x14013ba14
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.140056fb0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x14013b90b
mov ecx, 1
call fcn.140056eb0
test al, al
je 0x14013ba14
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.140056fb0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
call fcn.14000211d
movzx r8d, byte [rsi]
test r8b, 1
je 0x14013b9fb
mov r8, qword [rsi + 8]
mov rsi, qword [rsi + 0x10]
jmp 0x14013ba01
shr r8d, 1
inc rsi
mov rcx, rax
mov rdx, rsi
call fcn.14000211d
mov rcx, rdi
call fcn.1400574d0
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.140148650
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14013e662
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov dword [rcx + 0x78], 0x1003f
mov eax, dword [rdx + 0x234]
mov dword [rcx + 0x7c], eax
mov eax, dword [rdx + 0x238]
mov dword [rcx + 0x80], eax
mov eax, dword [rdx + 0x23c]
mov dword [rcx + 0x84], eax
mov eax, dword [rdx + 0x240]
mov dword [rcx + 0x88], eax
mov eax, dword [rdx + 0x24c]
mov dword [rcx + 0x8c], eax
mov eax, dword [rdx + 0x250]
mov dword [rcx + 0x90], eax
lea rdx, [rcx + 0x94]
lea rbx, [rdi + 0x34]
mov rcx, rbx
call fcn.14010ce18
movzx eax, word [rdi + 0x30]
mov dword [rsi + 0x104], eax
movzx eax, word [rdi + 0x2e]
mov dword [rsi + 0x108], eax
movzx eax, word [rdi + 0x2c]
mov dword [rsi + 0x10c], eax
movzx eax, word [rdi + 0x2a]
mov dword [rsi + 0x110], eax
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x114], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x118], eax
mov eax, dword [rdi + 4]
mov dword [rsi + 0x11c], eax
mov eax, dword [rdi + 0xc]
mov dword [rsi + 0x120], eax
mov eax, dword [rdi + 8]
mov dword [rsi + 0x124], eax
mov eax, dword [rdi]
mov dword [rsi + 0x128], eax
mov eax, dword [rdi + 0x18]
mov dword [rsi + 0x12c], eax
mov eax, dword [rdi + 0x20]
mov dword [rsi + 0x130], eax
movzx eax, word [rdi + 0x28]
mov dword [rsi + 0x134], eax
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x138], eax
mov eax, dword [rdi + 0x1c]
mov dword [rsi + 0x13c], eax
movzx eax, word [rdi + 0x32]
mov dword [rsi + 0x140], eax
add rsi, 0x144
mov r8d, 0x200
mov rcx, rsi
mov rdx, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14014b1c0

Function at 0x140140dca
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rax, r8
mov r8, rdx
mov rdi, rcx
mov rsi, qword [rsp + 0x98]
mov edx, dword [rsp + 0x90]
mov rcx, qword [0x1401c6b58]
xor rcx, rsp
mov qword [rsp + 0x40], rcx
xor r14d, r14d
mov qword [rsi], r14
mov rcx, qword [rdi]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], r9
xor edx, edx
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
lea rbx, [rsp + 0x38]
mov qword [rbx], r14
mov rcx, rbx
mov rdx, rax
call fcn.140002f00
mov rbx, qword [rbx]
lea rax, [rbx + 1]
cmp rax, 1
ja 0x140140e46
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140140e7d
mov rdi, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x30], 2
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea esi, [rcx + rcx*4]
lea rcx, [rsp + 0x38]
call fcn.140002f50
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140148650
mov eax, esi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14015bb84
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14015bccc
Function at 0x14015ed00
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x1401c6b58]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rdx, [0x1401a7118]
mov rbp, rcx
call fcn.1401785bc
xor edi, edi
test rax, rax
je 0x14015ede6
mov ebx, edi
call fcn.14015e99c
mov r14d, dword [rax]
call fcn.14015e99c
mov r8d, 0x104
lea rcx, [rsp + 0x30]
mov rdx, rbp
mov dword [rax], edi
call fcn.140164670
mov rsi, rax
test rax, rax
je 0x14015ed77
call fcn.14015e99c
mov dword [rax], r14d
jmp 0x14015eda1
call fcn.14015e99c
cmp dword [rax], 0x22
jne 0x14015edde
call fcn.14015e99c
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], r14d
call fcn.140164670
mov rbx, rax
mov rsi, rax
test rax, rax
je 0x14015edde
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], di
jne 0x14015eda5
cmp rax, 3
je 0x14015edc0
mov rcx, rsi
call fcn.14015ec5c
test al, al
je 0x14015edd1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x14015edd1
mov dil, 1
mov rcx, rbx
call fcn.140167d00
mov al, dil
jmp 0x14015ede8
mov rcx, rbx
call fcn.140167d00
xor al, al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140148650
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140160da0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x1401ce3a0]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x140160df7
cmp word [rdx], r13w
jne 0x140160df7
or byte [rax + rdi*8 + 0x38], cl
jmp 0x140160dfc
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x140160f21
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x140160f42
lea r9, [rdx + 2]
cmp cx, r11w
je 0x140160e35
mov rdx, r9
mov word [rbx], cx
jmp 0x140160e5c
cmp r9, r8
jae 0x140160e6c
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x140160e16
jmp 0x140160f21
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140160f16
cmp dword [rsp + 0x80], esi
je 0x140160f16
lea r8, [0x1401ce3a0]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x140160eee
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x140160ebe
mov word [rbx], r13w
jmp 0x140160f1e
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x140160ecb
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x140160f1e
cmp word [rsp + 0x70], r13w
jne 0x140160efb
cmp rbx, r14
je 0x140160eb8
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.140160008
cmp word [rsp + 0x70], r13w
je 0x140160f21
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1401ce3a0]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x140160f1b
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x140160f21
Function at 0x140179d78
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.1401738a4
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x140179e19
cmp ebx, dword [rsp + 0x30]
je 0x140179e12
test esi, esi
je 0x140179e12
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x140179ded
sub r8w, 0x61
cmp r8w, 0x19
ja 0x140179dfa
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x140179dd7
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x140179dfe
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x140179e1b
mov eax, 1
jmp 0x140179e1b
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret