joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450cc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x450d6f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00450dc0]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00457d80
xorps xmm15, xmm15
mov r14, qword [0x0054b120]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00457ec0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00450cc0
Function at 0x459d00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0054b1c0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0054af09], 0
je 0x459d36
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x0054b4a0]
aesenc xmm0, xmmword [0x0054b4b0]
aesenc xmm0, xmmword [0x0054b4c0]
movq rax, xmm0
ret
jmp 0x4085c0

Function at 0x45b9e0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x45ba14
mov rcx, 0x28
jmp 0x45ba1f
shl rcx, 3
add rcx, 0x1480
mov qword [0x0054b120], rcx
pop rbp
ret

Function at 0x461220
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4612ea
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00402fa0
xorps xmm15, xmm15
mov r14, qword [0x0054b120]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4612cf
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00472140]
xor ebx, ebx
mov rcx, rdx
call fcn.004431c0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.00461880
inc rbx
cmp rcx, rbx
jae 0x4612be
mov edi, 1
lea rsi, [0x00472140]
call fcn.004432a0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0049baf8]
lea rsi, [0x0049b778]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00457ec0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00461220
Function at 0x140018a94
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400258e0], eax
call fcn.140019344
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x1400258e0], 0
jne case.default.0x140018aea
mov ecx, 1
call fcn.140019344
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
sbb dword [rdx - 0x66441538], ebp
jbe 0x14003f68e
xor dl, byte [rsi + 0x16ea603c]
movabs al, byte [0x4216febfed3aea08]
xchg ebx, eax
iretd
invalid
Function at 0x140001000
Capabilities:
Capture screenshot
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov ecx, 0x4c
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x4d
mov r12d, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x4e
mov esi, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebp, eax
mov ecx, 0x4f
sub ebp, r12d
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, eax
xor ecx, ecx
sub edi, esi
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov r13, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r8d, edi
mov edx, ebp
mov rcx, r13
mov r14, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rdx, rax
mov rcx, r14
mov r15, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov dword [rsp + 0x40], 0xcc0020
mov r9d, ebp
mov dword [rsp + 0x38], esi
xor r8d, r8d
mov dword [rsp + 0x30], r12d
xor edx, edx
mov qword [rsp + 0x28], r13
mov rcx, r14
mov dword [rsp + 0x20], edi
mov rbx, rax
call qword [sym.imp.GDI32.dll_BitBlt]
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, r15
mov ecx, 2
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteObject]
lea r11, [rsp + 0x50]
xor eax, eax
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x140001a08
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001a52
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001a52
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001a52
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001a52
cmp dword [rcx + 0x84], 0xe
jbe 0x140001a52
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001a54
xor al, al
add rsp, 0x28
ret
Function at 0x2fc519ee0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc51a8e2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc53d108]
test eax, eax
je 0x2fc51a97a
lea rax, [0x2fc53d0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc53d110]
mov qword [rbp - 8], rax
jmp 0x2fc51a95e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc51a952
cmp qword [rbp - 0x10], 0
je 0x2fc51a952
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc51a918
lea rax, [0x2fc53d0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc51a97b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc51aa80
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc51aaa8
mov eax, 0
jmp 0x2fc51aaf6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc51aad1
mov eax, 0
jmp 0x2fc51aaf6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc51aaf1
mov eax, 0
jmp 0x2fc51aaf6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc51aafc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc51ab7a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc51ab71
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc51ab71
mov rax, qword [rbp - 8]
jmp 0x2fc51ab8f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc51ab44
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140009038
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov r9, rcx
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
mov rsi, rdx
movzx eax, byte [rbx + rcx + 0x10]
movabs rdx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdx
cmp rcx, 4
jb 0x14000905c
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, r8
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rbx
jne 0x1400090b3
cmp qword [rcx + rdx*8], rbx
jne 0x1400090a8
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400090ac
mov rax, qword [rbx + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400090c0
cmp qword [rcx + rdx*8], rbx
jne 0x1400090c0
mov rax, qword [rbx]
mov qword [rcx + rdx*8], rax
mov rax, qword [rbx + 8]
mov rdi, qword [rbx]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov rdx, qword [rbx + 0x30]
cmp rdx, 8
jb 0x1400090f5
mov rcx, qword [rbx + 0x18]
inc rdx
mov r8d, 2
call fcn.1400020a4
mov edx, 1
mov rcx, rbx
lea r8d, [rdx + 0x37]
call fcn.1400020a4
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b51c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_1.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400148a0], eax
call fcn.14000b2a4
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_UnhandledExceptionFilter]
cmp dword [0x1400148a0], 0
jne case.default.0x14000b572
mov ecx, 1
call fcn.14000b2a4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TerminateProcess]
or ah, byte [rsi]
invalid
jp 0x140020989
rol dword [rcx - 0xd], 1
rcr edx, cl
cdq
xlatb
call 0xf4f096d5
mov eax, 0x1c70e3ae
push rdi
mov eax, ecx
xchg esi, eax
ror ecx, 1
mov bl, 0x31
call 0x10165ea5c
je 0x140020a57
mov al, byte [rax - 0x10]
jnp 0x140020a56
mov ebx, 0xe6f3fdfd
or ebx, dword [rsi - 0x68]
jnp 0x140020a1d
invalid
loope 0x140020a9b
mov ebp, 0xfad5144b
mov edi, 0x96ef81da
rol esp, cl
invalid
out dx, eax
std
mov esi, esp
invalid
invalid
Function at 0x140001280
Capabilities:
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rax, qword [0x1400aac40]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp r8d, 2
sete byte [rsp + 0x2b]
mov rsi, rdx
mov rdi, rcx
xor eax, eax
test r8d, r8d
setne al
shl rax, 4
lea rcx, [0x1400ab77c]
lea rbx, [rax + rcx]
add rbx, 4
mov eax, 0x87ee77fb
lea r14, [rsp + 0x2c]
mov r15, qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x140001300
cmp qword [0x1400ab7a0], 0
mov eax, 0x218087bf
mov ecx, 0xd65bd745
cmove eax, ecx
nop word cs:[rax + rax]
cmp eax, 0x2a671377
jg 0x140001350
cmp eax, 0xfc063724
jle 0x140001380
cmp eax, 0xfc063725
je 0x140001404
cmp eax, 0xff515296
je 0x1400012dc
cmp eax, 0x218087bf
jne 0x140001300
mov r12, qword [0x1400ab7a0]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov rdx, rdi
mov r8d, r13d
call r12
mov eax, 0xd65bd745
jmp 0x140001300
cmp eax, 0x68c89ef9
jg 0x1400013c0
cmp eax, 0x3640b73d
je 0x140001439
cmp eax, 0x3bbba970
jne 0x1400014c0
mov eax, 0x2a671378
xor ebp, ebp
jmp 0x140001300
cmp eax, 0x87ee77fb
je 0x140001481
cmp eax, 0xd65bd745
jne 0x140001300
mov r8d, dword [rsp + 0x2c]
mov edx, r13d
mov rcx, rdi
mov r9, r14
call r15
mov eax, 0x2a671378
mov ebp, 1
jmp 0x140001300
cmp eax, 0x68c89efa
je 0x140001498
cmp eax, 0x7cb4fbdc
jne 0x140001300
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtFlushInstructionCache
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400ab7a0], rax
mov eax, 0xff515296
jmp 0x140001300
mov r13d, dword [0x1400ab77c]
mov dword [rsp + 0x2c], 0
mov rcx, rdi
mov rdx, r13
mov r8d, 0x40
mov r9, r14
call r15
test eax, eax
mov eax, 0x68c89efa
mov ecx, 0x3bbba970
cmove eax, ecx
jmp 0x140001300
mov dword [0x1400ab77c], 0x10
movups xmm0, xmmword [rdi]
movups xmmword [0x1400ab780], xmm0
movups xmm0, xmmword [rdi]
movups xmmword [0x1400ab790], xmm0
mov word [0x1400ab790], 0xba49
mov qword [0x1400ab792], rsi
mov word [0x1400ab79a], 0xff41
mov byte [0x1400ab79c], 0xe2
mov eax, 0xfc063725
jmp 0x140001300
cmp byte [rsp + 0x2b], 0
mov eax, 0xfc063725
mov ecx, 0x3640b73d
cmovne eax, ecx
jmp 0x140001300
mov r8d, r13d
mov rcx, rdi
mov rdx, rbx
call fcn.14004b540
cmp qword [0x1400ab7a0], 0
mov eax, 0xff515296
mov ecx, 0x7cb4fbdc
cmove eax, ecx
jmp 0x140001300
cmp eax, 0x2a671378
jne 0x140001300
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140001e00
mov eax, ebp
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400014f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov rcx, qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140001100]
mov r8d, 2
jmp fcn.140001280
Function at 0x140001530
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, r8
mov edi, edx
mov rbx, rcx
mov ecx, 0x40000
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov r15, rax
mov r8d, 0xa
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test edi, edi
setg byte [rsp + 0x37]
movsxd r12, edi
mov eax, 0xd12dd248
mov r13d, 0xa0e70b87
jmp 0x140001590
mov eax, 0x8a09c94b
nop dword [rax + rax]
cmp eax, 0xd12dd247
jle 0x1400015c0
cmp eax, 0x4b1c3315
jg 0x140001600
cmp eax, 0xd12dd248
je 0x140001653
cmp eax, 0x31fcfd6
jne 0x140001590
cmp ebp, edi
mov eax, 0x4b1c3316
cmovl eax, r13d
jmp 0x140001590
cmp eax, 0xa8a1ff68
jle 0x140001622
cmp eax, 0xa8a1ff69
je 0x14000166a
cmp eax, 0xb9bddb89
jne 0x140001590
mov rcx, r15
xor edx, edx
mov r8, r14
mov r9, r12
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov r14, rax
mov eax, 0xa8a1ff69
jmp 0x140001590
cmp eax, 0x4b1c3316
je 0x140001586
cmp eax, 0x795447ee
jne 0x140001590
inc ebp
mov eax, 0x31fcfd6
jmp 0x140001590
cmp eax, 0xa0e70b87
jne 0x140001676
movsxd rax, ebp
lea ecx, [rbp + 7]
test ebp, ebp
cmovns ecx, ebp
and ecx, 0xfffffff8
mov edx, ebp
sub edx, ecx
movsxd rcx, edx
movzx ecx, byte [rsi + rcx]
xor cl, byte [rbx + rax]
mov byte [r14 + rax], cl
mov eax, 0x795447ee
jmp 0x140001590
cmp byte [rsp + 0x37], 0
mov eax, 0xa8a1ff69
mov ecx, 0xb9bddb89
cmovne eax, ecx
jmp 0x140001590
mov eax, 0x31fcfd6
xor ebp, ebp
jmp 0x140001590
cmp eax, 0x8a09c94b
jne 0x140001590
call fcn.1400014f0
mov rcx, r14
call section..text
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140001510]
xor ecx, ecx
xor edx, edx
mov r9, r14
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400017d0
Capabilities:
Connect pipe
Create pipe
Write file on windows
Write pipe

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov esi, edx
mov rdi, rcx
mov rax, qword [0x1400aac40]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x4c], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea rcx, [0x1400ab7b0]
mov edx, 2
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov rbx, rax
test rax, rax
sete byte [rsp + 0x4b]
cmp rax, 0xffffffffffffffff
mov ebp, 0x68ba5f15
mov r15d, 0xef670717
cmove r15d, ebp
mov eax, 0xd732877e
mov r13d, 0x7dba8e13
mov r14d, 0xd2ccc885
mov r12, qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001880
mov eax, 0x63093a49
nop word cs:[rax + rax]
cmp eax, 0x30daa0e
jle 0x1400018c0
cmp eax, 0x54d171a7
jle 0x1400018f0
cmp eax, 0x68ba5f14
jle 0x14000195c
cmp eax, 0x68ba5f15
je 0x140001977
cmp eax, 0x7dba8e13
jne 0x1400019f1
mov eax, 0xc5f23152
jmp 0x140001880
cmp eax, 0xd2ccc884
jg 0x140001920
cmp eax, 0x85d569d3
je 0x140001981
cmp eax, 0xc5f23152
je 0x140001870
cmp eax, 0xcee47126
jne 0x140001880
mov eax, 0x54d171a8
jmp 0x140001880
cmp eax, 0x30daa0f
je 0x14000198b
cmp eax, 0x28fa0eaf
je 0x14000199b
cmp eax, 0x4a2ac85e
jne 0x140001880
mov eax, r15d
jmp 0x140001880
cmp eax, 0xd2ccc885
je 0x1400019ae
cmp eax, 0xd732877e
je 0x1400019df
cmp eax, 0xef670717
jne 0x140001880
mov rcx, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
mov eax, 0x85d569d3
cmove eax, r13d
jmp 0x140001880
cmp eax, 0x54d171a8
jne 0x1400019fe
mov rcx, rbx
call r12
mov eax, 0xc5f23152
jmp 0x140001880
mov eax, 0x63093a49
jmp 0x140001880
mov eax, 0x30daa0f
jmp 0x140001880
test esi, esi
mov eax, 0x54d171a8
cmovg eax, r14d
jmp 0x140001880
mov eax, dword [rsp + 0x4c]
add rdi, rax
sub esi, eax
mov eax, 0x30daa0f
jmp 0x140001880
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, rdi
mov r8d, esi
lea r9, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
mov eax, 0x28fa0eaf
mov ecx, 0xcee47126
cmove eax, ecx
jmp 0x140001880
cmp byte [rsp + 0x4b], 0
mov eax, 0x4a2ac85e
cmovne eax, ebp
jmp 0x140001880
cmp eax, 0x68bb7c6b
jne 0x140001880
jmp 0x140001a09
cmp eax, 0x63093a49
jne 0x140001880
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140001e00
nop
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140001a30
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov esi, edx
mov rdi, rcx
mov rax, qword [0x1400aac40]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea rcx, [0x1400ab7b0]
mov edx, 0x80000000
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
sete byte [rsp + 0x3b]
mov eax, 0x3c25b0
mov r12, qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r14, [rsp + 0x3c]
mov r13d, 0x1e6e9172
jmp 0x140001ad0
mov eax, dword [rsp + 0x3c]
add rdi, rax
sub esi, eax
mov eax, 0x7a26b29
xor r15d, r15d
nop word cs:[rax + rax]
cmp eax, 0x3c25af
jg 0x140001b00
cmp eax, 0xe620af55
jg 0x140001b30
cmp eax, 0x830c4e1f
je 0x140001ba0
cmp eax, 0xa76db43f
je 0x140001ab5
cmp eax, 0xb25454d6
je 0x140001b7b
jmp 0x140001ad0
cmp eax, 0x80e35c7
jle 0x140001b60
cmp eax, 0x80e35c8
je 0x140001bb4
cmp eax, 0x1e6e9172
je 0x140001bdf
cmp eax, 0x62893259
je 0x140001b96
jmp 0x140001ad0
cmp eax, 0xe620af56
je 0x140001bef
cmp eax, 0xedb6c7fb
jne 0x140001c10
mov eax, 0xec74b139
xor ebp, ebp
mov r15d, 1
jmp 0x140001ad0
cmp eax, 0x3c25b0
je 0x140001bf9
cmp eax, 0x7a26b29
jne 0x140001ad0
test r15d, r15d
je 0x140001b96
mov rcx, rbx
call r12
mov eax, 0xec74b139
mov r15d, 1
mov ebp, 1
jmp 0x140001ad0
mov eax, 0x830c4e1f
jmp 0x140001ad0
test esi, esi
mov eax, 0xb25454d6
mov ecx, 0x80e35c8
cmovg eax, ecx
jmp 0x140001ad0
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, rdi
mov r8d, esi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov eax, 0xa76db43f
cmove eax, r13d
jmp 0x140001ad0
mov eax, 0x7a26b29
mov r15d, 3
jmp 0x140001ad0
mov eax, 0x830c4e1f
jmp 0x140001ad0
cmp byte [rsp + 0x3b], 0
mov eax, 0xe620af56
mov ecx, 0xedb6c7fb
cmovne eax, ecx
jmp 0x140001ad0
cmp eax, 0xec74b139
jne 0x140001ad0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140001e00
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140001d00
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
movsxd rcx, dword [0x14005f004]
call fcn.1400203ac
mov rsi, rax
mov edi, 0x572589cb
mov rbx, qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 0x572589cb
nop word [rax + rax]
cmp eax, 0xcc76789b
je 0x140001cb3
cmp eax, 0xe2b3a7a9
je 0x140001ccd
cmp eax, 0x572589cb
jne 0x140001c90
mov ecx, 0x400
call rbx
mov eax, 0xcc76789b
jmp 0x140001c90
mov edx, dword [0x14005f004]
mov rcx, rsi
call fcn.140001a30
test eax, eax
mov eax, 0xe2b3a7a9
cmove eax, edi
jmp 0x140001c90
mov edx, dword [0x14005f004]
lea r8, [0x14005f008]
mov rcx, rsi
call fcn.140001530
mov rcx, rsi
call fcn.1400203a4
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
sub rsp, 0x68
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov edx, 0xd3e057bb
imul rdx, rcx
shr rdx, 0x2d
imul ecx, edx, 0x26aa
sub eax, ecx
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], 0x5c
mov dword [rsp + 0x48], 0x65
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x38], 0x69
mov dword [rsp + 0x30], 0x70
mov dword [rsp + 0x28], 0x5c
mov dword [rsp + 0x20], 0x2e
lea rcx, [0x1400ab7b0]
lea rdx, str._c_c_c_c_c_c_c_c_cnetsvc_d
mov r8d, 0x5c
mov r9d, 0x5c
call fcn.1400016d0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140001c40]
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
add rsp, 0x68
jmp 0x140001c60

Function at 0x140002ae8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002b32
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002b32
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002b32
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002b32
cmp dword [rcx + 0x84], 0xe
jbe 0x140002b32
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002b34
xor al, al
add rsp, 0x28
ret

Function at 0x14001be10
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001c0a0

Function at 0x140020440
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140020468
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140020468
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret