joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400014a1
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library

Disassembly:
push rbp
sub rsp, 0x1e0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x170], rcx
mov dword [rbp + 0x178], edx
mov qword [rbp + 0x158], 0xffffffffffffffff
lea rax, [rbp - 0x50]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0
je 0x14000150e
mov eax, dword [rbp + 0x154]
mov edx, eax
lea rax, str.WSAStartup_failed:__d_n
mov rcx, rax
call sym.printf
mov eax, 1
jmp 0x140001656
mov r8d, 6
mov edx, 1
mov ecx, 2
mov rax, qword [sym.imp.WS2_32.dll_socket]
call rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x158], 0xffffffffffffffff
jne 0x140001565
mov rax, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rax
mov edx, eax
lea rax, str.Error_at_socket__:__d_n
mov rcx, rax
call sym.printf
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 1
jmp 0x140001656
lea rax, [rbp - 0x60]
mov r8d, 0x10
mov edx, 0
mov rcx, rax
call sym.memset
mov word [rbp - 0x60], 2
mov eax, dword [rbp + 0x178]
movzx eax, ax
mov ecx, eax
mov rax, qword [sym.imp.WS2_32.dll_htons]
call rax
mov word [rbp - 0x5e], ax
mov rcx, qword [rbp + 0x170]
mov rax, qword [sym.imp.WS2_32.dll_inet_addr]
call rax
mov dword [rbp - 0x5c], eax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0x158]
mov r8d, 0x10
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_connect]
call rax
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0xffffffff
jne 0x140001616
mov rax, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rax
mov edx, eax
lea rax, str.Unable_to_connect_to_server:__d_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp + 0x158]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 1
jmp 0x140001656
mov eax, dword [rbp + 0x178]
mov r8d, eax
mov rdx, qword [rbp + 0x170]
lea rax, str.Successfully_connected_to_the_server_at__s:_d_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp + 0x158]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 0
add rsp, 0x1e0
pop rbp
ret

Function at 0x14000194c
Capabilities:
Check for sandbox username or hostname
Get hostname

Disassembly:
push rdi
push rbx
sub rsp, 0x158
lea rax, str.vbox
mov ecx, 0x3c
mov qword [rsp + 0x28], rax
lea rax, [0x140027183]
lea rdi, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea rax, str.virtual
lea rdx, [rsp + 0x24]
mov qword [rsp + 0x38], rax
lea rax, str.sandbox
mov qword [rsp + 0x40], rax
xor eax, eax
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x50]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov rcx, rdi
mov dword [rsp + 0x24], 0x100
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x1400019e8
xor ebx, ebx
mov rdx, qword [rsp + rbx*8 + 0x28]
mov rcx, rdi
call sym.strstr
test rax, rax
jne 0x1400019e3
inc rbx
cmp rbx, 5
jne 0x1400019c6
jmp 0x1400019e8
mov eax, 1
add rsp, 0x158
pop rbx
pop rdi
ret
Function at 0x1400019f2
Capabilities:
Get session user name

Disassembly:
push r12
mov eax, 0x80f0
push rbp
push rdi
push rsi
push rbx
call fcn.140003f70
sub rsp, rax
lea rsi, str.admin
mov ecx, 0x30
xor ebx, ebx
lea r12, [rsp + 0xf1]
mov dword [rsp + 0x2c], 0x7fff
lea rdi, [rsp + 0x30]
rep movsd dword [rdi], dword [rsi]
lea rdx, [rsp + 0x2c]
mov rcx, r12
lea rbp, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov rdi, qword [sym.imp.msvcrt.dll__strnicmp]
mov rsi, qword [rbp + rbx*8]
or r8, 0xffffffffffffffff
mov rcx, r12
mov rdx, rsi
call rdi
test eax, eax
jne 0x140001a72
mov r8, rsi
mov rdx, r12
lea rcx, str._nComputer_name:_s_Username__s_n
call sym.printf_1
mov eax, 1
jmp 0x140001a7d
inc rbx
cmp rbx, 0x18
jne 0x140001a44
xor eax, eax
add rsp, 0x80f0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140001a8b
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
cmp dword [rsp + 0x40], 1
setbe al
add rsp, 0x58
ret

Function at 0x140001aa9
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x28
xor edx, edx
lea rcx, [dbg.EnumWindowsProc]
call qword [sym.imp.USER32.dll_EnumWindows]
mov edx, dword [0x14002d030]
lea rcx, str.total_windows_found:__d_n
call sym.printf_1
xor eax, eax
cmp dword [0x14002d030], 0xb
setle al
add rsp, 0x28
ret
Function at 0x140001c56
Capabilities:
Enumerate disk properties

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
mov r9d, 2
xor r8d, r8d
xor edx, edx
lea rcx, [0x140028430]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140001dc3
mov dword [rsp + 0x50], 0x20
mov rdi, qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
xor r12d, r12d
xor ebx, ebx
mov dword [rsp + 0x4c], 0
lea rsi, [rsp + 0x50]
mov edx, ebx
mov rcx, r14
mov r8, rsi
call rdi
mov r13d, eax
test eax, eax
je 0x140001d8e
mov rbp, qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
mov r13, qword [sym.imp.KERNEL32.dll_LocalFree]
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x20], r12
mov rdx, rsi
mov rcx, r14
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x4c]
lea r9, [rsp + 0x48]
mov r8d, 1
mov dword [rsp + 0x28], eax
call rbp
test eax, eax
jne 0x140001d06
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x140001d0d
test r12, r12
jne 0x140001d37
jmp 0x140001d32
test r12, r12
je 0x140001d18
mov rcx, r12
call r13
mov eax, dword [rsp + 0x4c]
mov ecx, 0x40
lea edx, [rax + rax]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r12, rax
test rax, rax
jne 0x140001ccd
xor r12d, r12d
jmp 0x140001d87
lea rdx, str.vbox
mov rcx, r12
call sym.strstr
test rax, rax
jne 0x140001d95
lea rdx, str.vmware
mov rcx, r12
call sym.strstr
test rax, rax
jne 0x140001d95
lea rdx, str.qemu
mov rcx, r12
call sym.strstr
test rax, rax
jne 0x140001d95
lea rdx, str.virtual
mov rcx, r12
call sym.strstr
test rax, rax
jne 0x140001d95
inc ebx
jmp 0x140001ca5
test r12, r12
je 0x140001da4
jmp 0x140001d9b
mov r13d, 1
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r14
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov rbx, qword [sym.imp.KERNEL32.dll_GetLastError]
call rbx
test eax, eax
je 0x140001dc6
call rbx
cmp eax, 0x103
je 0x140001dc6
xor r13d, r13d
mov eax, r13d
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x140001ef0
Capabilities:
Identify system language via api

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
lea rcx, [0x140026c20]
lea r8, [rcx + 0x40]
movzx edx, ax
cmp edx, dword [rcx]
jne 0x140001f1f
lea rcx, [0x1400272d8]
call sym.printf_1
mov eax, 1
jmp 0x140001f2a
add rcx, 4
cmp rcx, r8
jne 0x140001f08
xor eax, eax
add rsp, 0x28
ret

Function at 0x140001f2f
Capabilities:
Get geographical location

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
mov rbx, qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x59
mov ecx, 0x800
call rbx
movsxd rcx, eax
mov dword [rsp + 0x2c], ecx
call sym.malloc
mov r9d, dword [rsp + 0x2c]
mov edx, 0x59
mov ecx, 0x800
mov r12, rax
mov r8, rax
call rbx
lea rbx, [0x140026ba0]
lea rsi, [rbx + 0x80]
mov rdx, qword [rbx]
mov rcx, r12
call sym.stricmp
test eax, eax
jne 0x140001fa7
mov rcx, r12
call sym.puts
mov rcx, r12
call sym.free
mov eax, 1
jmp 0x140001fba
add rbx, 8
cmp rbx, rsi
jne 0x140001f81
mov rcx, r12
call sym.free
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
Function at 0x140001fc3
Capabilities:
Get keyboard layout

Disassembly:
sub rsp, 0x78
mov ecx, 9
lea rdx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
test eax, eax
jne 0x140001fe9
lea rcx, str.Failed_to_retrieve_keyboard_layouts._n
call sym.printf_1
jmp 0x140002009
lea rax, [0x140026c20]
movzx edx, word [rsp + 0x28]
lea rcx, [rax + 0x40]
cmp edx, dword [rax]
jne 0x140002010
lea rcx, str.Language:__d_n
call sym.printf_1
mov eax, 1
jmp 0x14000201b
add rax, 4
cmp rax, rcx
jne 0x140001ff9
xor eax, eax
add rsp, 0x78
ret

Function at 0x140002020
Capabilities:
Get keyboard layout

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
lea rcx, [0x140026c20]
lea r8, [rcx + 0x40]
movzx edx, ax
cmp edx, dword [rcx]
jne 0x140002051
lea rcx, str.Language:__d_n
call sym.printf_1
mov eax, 1
jmp 0x14000205c
add rcx, 4
cmp rcx, r8
jne 0x14000203a
xor eax, eax
add rsp, 0x28
ret

Function at 0x140002061
Capabilities:
Identify system language via api

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
lea rcx, [0x140026c20]
lea r8, [rcx + 0x40]
movzx edx, ax
cmp edx, dword [rcx]
jne 0x140002090
lea rcx, [0x1400272d8]
call sym.printf_1
mov eax, 1
jmp 0x14000209b
add rcx, 4
cmp rcx, r8
jne 0x140002079
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400020a0
Capabilities:
Identify system language via api

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
lea rcx, [0x140026c20]
lea r8, [rcx + 0x40]
movzx edx, ax
cmp edx, dword [rcx]
jne 0x1400020cf
lea rcx, [0x1400272d8]
call sym.printf_1
mov eax, 1
jmp 0x1400020da
add rcx, 4
cmp rcx, r8
jne 0x1400020b8
xor eax, eax
add rsp, 0x28
ret

Function at 0x140002143
Capabilities:
Check mutex on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rbx, str.Frz_State
mov rdi, qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov r12, qword [sym.imp.KERNEL32.dll_GetLastError]
lea rsi, [rbx + 0x20]
xor ecx, ecx
call rdi
xor edx, edx
xor ecx, ecx
mov r8, qword [rbx]
call rbp
call r12
cmp eax, 0xb7
je 0x140002191
add rbx, 8
cmp rbx, rsi
jne 0x14000216d
xor eax, eax
jmp 0x140002196
mov eax, 1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140002303
Capabilities:
Get disk information

Disassembly:
sub rsp, 0x58
xor edx, edx
xor ecx, ecx
mov r8d, 1
mov dword [rsp + 0x38], 1
lea r9, [rsp + 0x4c]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov edx, dword [rsp + 0x4c]
cmp edx, 0xcd1a40
sete al
cmp edx, 0x70144646
sete dl
or eax, edx
movzx eax, al
add rsp, 0x58
ret
Function at 0x1400023da
Capabilities:
Get system firmware table

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x52534d42
mov rbx, qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
call rbx
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, r12d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
test rax, rax
jne 0x14000241f
xor eax, eax
jmp 0x1400025e9
xor edx, edx
mov r9d, r12d
mov r8, rax
mov ecx, 0x52534d42
call rbx
cmp r12d, eax
jne 0x140002418
lea r8, str.VirtualBox
mov rcx, r8
call sym.strlen
lea r8, str.VirtualBox
mov edx, r12d
mov rcx, r13
mov r9d, eax
call sym.supScanDump
test eax, eax
je 0x140002465
mov eax, 1
jmp 0x1400025e9
lea r8, str.VMware
mov rcx, r8
call sym.strlen
lea r8, str.VMware
mov edx, r12d
mov rcx, r13
mov r9d, eax
call sym.supScanDump
test eax, eax
jne 0x14000245b
lea r8, str.Oracle
mov rcx, r8
call sym.strlen
lea r8, str.Oracle
mov edx, r12d
mov rcx, r13
mov r9d, eax
call sym.supScanDump
test eax, eax
jne 0x14000245b
lea r8, str.innotek
mov rcx, r8
call sym.strlen
lea r8, str.innotek
mov edx, r12d
mov rcx, r13
mov r9d, eax
call sym.supScanDump
test eax, eax
jne 0x14000245b
lea r8, str.Parallels_R_
mov rcx, r8
call sym.strlen
lea r8, str.Parallels_R_
mov edx, r12d
mov rcx, r13
mov r9d, eax
call sym.supScanDump
test eax, eax
jne 0x14000245b
lea r8, str.S3_Corp.
mov rcx, r8
call sym.strlen
lea r8, str.S3_Corp.
mov edx, r12d
mov rcx, r13
mov r9d, eax
call sym.supScanDump
test eax, eax
jne 0x14000245b
lea r8, str.VMware__Inc.
mov rcx, r8
call sym.strlen
lea r8, str.VMware__Inc.
mov edx, r12d
mov rcx, r13
mov r9d, eax
call sym.supScanDump
test eax, eax
jne 0x14000245b
lea r8, str.VS2005R2
mov rcx, r8
call sym.strlen
lea r8, str.VS2005R2
mov edx, r12d
mov rcx, r13
mov r9d, eax
call sym.supScanDump
test eax, eax
jne 0x14000245b
lea r8, str.Parallels_Software_International
mov rcx, r8
call sym.strlen
lea r8, str.Parallels_Software_International
mov edx, r12d
mov rcx, r13
mov r9d, eax
call sym.supScanDump
test eax, eax
jne 0x14000245b
lea r8, str.Virtual
mov rcx, r8
call sym.strlen
lea r8, str.Virtual
mov edx, r12d
mov rcx, r13
mov r9d, eax
call sym.supScanDump
test eax, eax
setne al
movzx eax, al
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
Function at 0x14000260a
Capabilities:
Get local ipv4 addresses

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x48
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rbx, [rsp + 0x34]
mov rsi, rcx
xor ecx, ecx
mov dword [rsp + 0x34], 0
mov qword [rsp + 0x20], rbx
call sym.GetAdaptersAddresses
cmp eax, 0x6f
jne 0x1400026c0
mov edx, dword [rsp + 0x34]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r12, rax
test rax, rax
je 0x1400026c0
mov qword [rsp + 0x20], rbx
mov r9, rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov rbx, r12
lea rdi, [rsp + 0x3a]
call sym.GetAdaptersAddresses
cmp dword [rbx + 0x58], 6
jne 0x1400026ae
mov eax, dword [rbx + 0x50]
mov r8d, 3
mov rdx, rdi
mov rcx, rsi
mov dword [rsp + 0x3a], eax
mov ax, word [rbx + 0x54]
mov word [rsp + 0x3e], ax
call sym.memcmp
test eax, eax
jne 0x1400026ae
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
jmp 0x1400026c2
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x140002673
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop r12
ret

Function at 0x1400026cc
Capabilities:
Get mac address on windows

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov ecx, 0x2c0
mov dword [rsp + 0x28], 0x2c0
call sym.malloc
mov r12, rax
mov rbx, rax
or eax, 0xffffffff
test r12, r12
je 0x140002783
lea r13, [rsp + 0x28]
mov rcx, r12
mov rdx, r13
call sym.GetAdaptersInfo
cmp eax, 0x6f
jne 0x140002730
mov rcx, r12
call sym.free
mov ecx, dword [rsp + 0x28]
call sym.malloc
mov rbx, rax
mov eax, 1
test rbx, rbx
je 0x140002783
mov rdx, r13
mov rcx, rbx
call sym.GetAdaptersInfo
mov r8d, eax
xor eax, eax
test r8d, r8d
jne 0x140002783
mov eax, dword [rsi]
lea rsi, [rsp + 0x2c]
mov dword [rsp + 0x2c], eax
cmp dword [rbx + 0x194], 6
jne 0x140002772
lea rdx, [rbx + 0x198]
mov r8d, 3
mov rcx, rsi
call sym.memcmp
test eax, eax
je 0x14000277e
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140002750
xor eax, eax
jmp 0x140002783
mov eax, 1
add rsp, 0x38
pop rbx
pop rsi
pop r12
pop r13
ret

Function at 0x140002896
Capabilities:
Get disk size

Disassembly:
sub rsp, 0x38
xor r9d, r9d
xor edx, edx
lea rcx, [0x14002740b]
lea r8, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x1400028ca
movabs rax, 0xf3fffffff
cmp qword [rsp + 0x28], rax
setbe al
movzx eax, al
add rsp, 0x38
ret

Function at 0x1400028cf
Capabilities:
Check for debugger via api

Disassembly:
sub rsp, 0x38
mov dword [rsp + 0x2c], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x2c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
test eax, eax
je 0x1400028fd
xor eax, eax
cmp dword [rsp + 0x2c], 0
setne al
add rsp, 0x38
ret

Function at 0x140002902
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x68
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor eax, eax
cmp qword [rsp + 0x28], 0x7fffffff
setbe al
add rsp, 0x68
ret
Function at 0x140002971
Capabilities:
Get disk size

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x50
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str..PhysicalDrive0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rax, 0xffffffffffffffff
mov r13, rax
jne 0x1400029c9
or rcx, 0xffffffffffffffff
xor r12d, r12d
call rbx
jmp 0x140002a25
lea rax, [rsp + 0x44]
xor r9d, r9d
xor r8d, r8d
mov rcx, r13
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
mov edx, 0x7405c
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, r13
mov r12d, eax
call rbx
test r12d, r12d
je 0x140002a25
movabs rax, 0xf3fffffff
xor r12d, r12d
cmp qword [rsp + 0x48], rax
setle r12b
mov eax, r12d
add rsp, 0x50
pop rbx
pop r12
pop r13
ret

Function at 0x140002dcb
Capabilities:
Enumerate processes

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x150
xor eax, eax
xor edx, edx
lea rbp, [rsp + 0x20]
mov rbx, rcx
mov ecx, 0x4c
mov rdi, rbp
rep stosd dword [rdi], eax
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov r12, rax
xor eax, eax
cmp r12, 0xffffffffffffffff
je 0x140002e63
mov rdx, rbp
mov rcx, r12
mov dword [rsp + 0x20], 0x130
call sym.Process32First
test eax, eax
je 0x140002e58
lea rsi, [rsp + 0x4c]
mov rdi, qword [sym.imp.msvcrt.dll__stricmp_1]
mov rdx, rbx
mov rcx, rsi
call rdi
test eax, eax
jne 0x140002e41
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x140002e63
mov rdx, rbp
mov rcx, r12
call sym.Process32Next
test eax, eax
je 0x140002e58
mov rdx, rbx
mov rcx, rsi
jmp 0x140002e2c
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x150
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400031c0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]
Function at 0x140003230
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x14002d0b4]
mov r12, rcx
test ebx, ebx
jle 0x140003360
mov rax, qword [0x14002d0b8]
xor r9d, r9d
add rax, 0x18
nop dword [rax + rax]
mov r8, qword [rax]
cmp r8, r12
ja 0x14000327b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp r12, r8
jb 0x140003305
add r9d, 1
add rax, 0x28
cmp r9d, ebx
jne 0x140003260
mov rcx, r12
call dbg.__mingw_GetSectionForAddress
mov rsi, rax
test rax, rax
je 0x140003382
mov rax, qword [0x14002d0b8]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call dbg._GetPEImageBase
mov edx, dword [rsi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14002d0b8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140003367
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400032fe
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140003310
add dword [0x14002d0b4], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x14002d0b8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400032fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop dword [rax]
xor ebx, ebx
jmp 0x140003288
mov rax, qword [0x14002d0b8]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140003900
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r13, [0x14002d120]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14002d100]
test rbx, rbx
je 0x14000395c
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x140003953
test r12, r12
je 0x140003953
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140003938
mov rcx, r13
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140003b90
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140003ba8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140003bb0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret
Function at 0x140003bc0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x140003c05
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp r8, rdx
ja 0x140003bfc
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x140003c07
add rax, 0x28
cmp rax, r9
jne 0x140003be8
xor eax, eax
ret

Function at 0x140003c10
Capabilities:
Parse pe header

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.strlen
cmp rax, 8
ja 0x140003ca0
mov rdx, qword [0x140027d20]
xor r12d, r12d
cmp word [rdx], 0x5a4d
jne 0x140003c8e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x140003c8e
cmp word [rax + 0x18], 0x20b
jne 0x140003c8e
movzx edx, word [rax + 0x14]
lea r12, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x140003ca0
sub eax, 1
lea rax, [rax + rax*4]
lea rsi, [r12 + rax*8 + 0x28]
jmp 0x140003c79
add r12, 0x28
cmp r12, rsi
je 0x140003ca0
mov r8d, 8
mov rdx, rbx
mov rcx, r12
call sym.strncmp
test eax, eax
jne 0x140003c70
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
xor r12d, r12d
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret

Function at 0x140003cb0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140027d20]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140003cd0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140003cd8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140003cd0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x140003d25
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140003d1c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140003cd0
add rax, 0x28
cmp rax, r9
jne 0x140003d08
xor eax, eax
ret

Function at 0x140003d30
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140027d20]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140003d50
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140003d58
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x140003d50
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x140003d70
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x140027d20]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x140003d90
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x140003d98
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140003d90
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x140003dd8
sub edx, 1
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x140003dcf
test rcx, rcx
je 0x140003d90
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x140003dc0
xor eax, eax
ret