joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6c2a40
Capabilities:
Hide graphical window from taskbar

Disassembly:
push rbp
push rbx
sub rsp, 0x48
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov byte [rbp + 0x2f], dl
mov qword [rbp + 0x38], 0
nop
movzx rax, byte [rbp + 0x2f]
mov rcx, qword [rbp + 0x20]
cmp al, byte [rcx + 0x16b]
je 0x6c2c8b
movzx rax, byte [rbp + 0x2f]
mov rcx, qword [rbp + 0x20]
mov byte [rcx + 0x16b], al
mov rax, qword [rbp + 0x20]
cmp qword [rax + 0x88], 0
je 0x6c2bc4
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x88]
call fcn.005c8180
test al, al
je 0x6c2bc4
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x88]
movzx rax, word [rax + 0x34]
test ax, 0x10
jne 0x6c2bc4
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x88]
movzx rax, word [rax + 0x34]
test ax, 2
jne 0x6c2bc4
movzx rax, byte [rbp + 0x2f]
test al, al
je 0x6c2b2b
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x2a8]
xor rdx, rdx
xor r8, r8
call fcn.006acbb0
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x88]
call fcn.005c7b70
mov rcx, rax
mov dl, 1
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x88]
movzx r8, byte [rax + 0x99]
call fcn.006acbb0
jmp 0x6c2ba8
call sub.user32.dll_GetForegroundWindow
mov rbx, rax
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x88]
call fcn.005c7b70
cmp rbx, rax
sete bl
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x88]
call fcn.005c7b70
mov rcx, rax
xor rdx, rdx
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x88]
movzx r8, byte [rax + 0x99]
call fcn.006acbb0
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x2a8]
mov dl, 1
mov r8b, 1
call fcn.006acbb0
test bl, bl
je 0x6c2ba8
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x88]
call fcn.005c7b70
mov rcx, rax
call sub.user32.dll_SetForegroundWindow
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x88]
mov edx, 0xb033
xor r8, r8
xor r9, r9
call fcn.005bb5a0
movzx rax, byte [rbp + 0x2f]
test al, al
je 0x6c2c1d
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x2a8]
mov ecx, 0xffffffec
mov edx, ecx
mov rcx, rax
call sub.user32.dll_GetWindowLongPtrW
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx + 0x2a8]
mov edx, 0xffffffec
or rax, 0x80
mov r8, rax
call sub.user32.dll_SetWindowLongPtrW
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x2a8]
xor rdx, rdx
call sub.user32.dll_SetWindowTextW
jmp 0x6c2c8b
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x2a8]
mov ecx, 0xffffffec
mov edx, ecx
mov rcx, rax
call sub.user32.dll_GetWindowLongPtrW
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx + 0x2a8]
mov edx, 0xffffffec
and rax, 0xffffffffffffff7f
mov r8, rax
call sub.user32.dll_SetWindowLongPtrW
mov rax, qword [rbp + 0x20]
mov rbx, qword [rax + 0x2a8]
lea rcx, [rbp + 0x38]
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax + 0xf0]
call fcn.0040e020
mov rcx, qword [rbp + 0x38]
call fcn.0040ed00
mov rcx, rbx
mov rdx, rax
call sub.user32.dll_SetWindowTextW
nop
lea rcx, [rbp + 0x38]
call fcn.0040d970
lea rsp, [rbp + 0x48]
pop rbx
pop rbp
ret
Function at 0x6cb4e0
Capabilities:
Hide graphical window

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbx, rcx
cmp qword [rbx + 0xc0], 0
jne 0x6cb596
mov rcx, qword [rbx + 0x10]
call fcn.005c7b70
mov rcx, qword [0x005e23d0]
mov dl, 1
mov r8, rax
call fcn.005be7d0
mov qword [rbx + 0xc0], rax
mov rsi, qword [rbx + 0xc0]
mov rcx, rsi
xor rdx, rdx
call fcn.005f4160
lea rax, [rsi + 0x498]
mov qword [rax + 8], rbx
lea rcx, [0x006cab50]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xc0]
call fcn.005c7b70
mov rsi, rax
mov ecx, 3
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor rdx, rdx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xc0]
call fcn.005c7b70
mov rcx, rax
xor rdx, rdx
call sub.user32.dll_ShowWindow
cmp qword [rbx + 0xe0], 0
jne 0x6cb641
mov rcx, qword [rbx + 0x10]
call fcn.005c7b70
mov rcx, qword [0x005e23d0]
mov dl, 1
mov r8, rax
call fcn.005be7d0
mov qword [rbx + 0xe0], rax
mov rsi, qword [rbx + 0xe0]
mov rcx, rsi
mov dl, 1
call fcn.005f4160
lea rax, [rsi + 0x498]
mov qword [rax + 8], rbx
lea rcx, [0x006cabb0]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xe0]
call fcn.005c7b70
mov rsi, rax
mov ecx, 2
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor rdx, rdx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xe0]
call fcn.005c7b70
mov rcx, rax
xor rdx, rdx
call sub.user32.dll_ShowWindow
cmp qword [rbx + 0xd0], 0
jne 0x6cb6dd
mov rcx, qword [rbx + 0x10]
call fcn.005c7b70
mov rcx, qword [0x005e3390]
mov dl, 1
mov r8, rax
call fcn.005be7d0
mov qword [rbx + 0xd0], rax
mov rax, qword [rbx + 0xd0]
mov byte [rax + 0x468], 1
mov rcx, qword [rbx + 0xd0]
call fcn.005c7b70
mov rsi, rax
mov ecx, 2
call sub.user32.dll_GetSystemMetrics
mov edi, eax
mov ecx, 3
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor rdx, rdx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xd0]
call fcn.005c7b70
mov rcx, rax
xor rdx, rdx
call sub.user32.dll_ShowWindow
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret

Function at 0x701330
Capabilities:
Delete file

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x80], rcx
mov rcx, qword [rbp + 0x80]
call fcn.0040db00
nop
lea rcx, [rbp + 0x38]
mov edx, 0x38
xor r8, r8
call fcn.00409c10
mov dword [rbp + 0x40], 3
mov word [rbp + 0x58], 0x14
lea rcx, [rbp + 0x28]
mov rdx, qword [rbp + 0x80]
lea r8, [0x0070141c]
call fcn.0040f130
mov rcx, qword [rbp + 0x28]
call fcn.0040ed00
mov qword [rbp + 0x48], rax
lea rcx, [rbp + 0x38]
call sub.shell32.dll_SHFileOperationW
test eax, eax
sete al
mov byte [rbp + 0x27], al
nop
lea rcx, [rbp + 0x28]
call fcn.0040d970
lea rcx, [rbp + 0x80]
call fcn.0040d970
movzx rax, byte [rbp + 0x27]
lea rsp, [rbp + 0x70]
pop rbp
ret
Function at 0x7451c0
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x24], 0xca
jne 0x74520f
mov rcx, qword [rsp + 0x40]
call fcn.00745fd0
mov r11, qword [rsp + 0x40]
cmp dword [r11 + 0x58], 0
je 0x745203
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x24], 0xcf
mov eax, 1
jmp 0x745359
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x24], 0xcb
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x24], 0xcb
jne 0x745310
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x240]
cmp dword [rax + 0x20], 0
je 0x7452f8
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x10], 0
je 0x745253
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov rcx, qword [rsp + 0x40]
call qword [rax]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x240]
mov rcx, qword [rsp + 0x40]
call qword [rax]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x745278
xor eax, eax
jmp 0x745359
cmp dword [rsp + 0x20], 2
jne 0x745281
jmp 0x7452f8
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x10], 0
je 0x7452f3
cmp dword [rsp + 0x20], 3
je 0x74529b
cmp dword [rsp + 0x20], 1
jne 0x7452f3
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov ecx, dword [rax + 8]
add ecx, 1
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov dword [rax + 8], ecx
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x10]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov eax, dword [rax + 0xc]
cmp dword [rcx + 8], eax
jl 0x7452f3
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov ecx, dword [rax + 0xc]
mov rax, qword [rsp + 0x40]
add ecx, dword [rax + 0x1a4]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov dword [rax + 0xc], ecx
jmp 0x745237
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xac]
mov dword [rcx + 0xb4], eax
jmp 0x74534f
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x24], 0xcc
je 0x74534f
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov dword [rax + 0x28], 0x14
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x24]
mov dword [rcx + 0x2c], eax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
call qword [rax]
mov rcx, qword [rsp + 0x40]
call fcn.00745370
add rsp, 0x38
ret
Function at 0x745370
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x24], 0xcc
je 0x7453b6
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x220]
mov rcx, qword [rsp + 0x40]
call qword [rax]
mov r11, qword [rsp + 0x40]
mov dword [r11 + 0xa8], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x24], 0xcc
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x220]
cmp dword [rax + 0x10], 0
je 0x7454bd
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x8c]
cmp dword [rcx + 0xa8], eax
jae 0x745481
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x10], 0
je 0x745432
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x10]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xa8]
mov dword [rcx + 8], eax
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x10]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x8c]
mov dword [rcx + 0xc], eax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov rcx, qword [rsp + 0x40]
call qword [rax]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xa8]
mov dword [rsp + 0x20], eax
mov r8, qword [rsp + 0x40]
add r8, 0xa8
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x228]
xor r9d, r9d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [rax + 8]
mov r11, qword [rsp + 0x40]
mov eax, dword [rsp + 0x20]
cmp dword [r11 + 0xa8], eax
jne 0x74547c
xor eax, eax
jmp 0x7454eb
jmp 0x7453cc
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x220]
mov rcx, qword [rsp + 0x40]
call qword [rax + 8]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x220]
mov rcx, qword [rsp + 0x40]
call qword [rax]
mov r11, qword [rsp + 0x40]
mov dword [r11 + 0xa8], 0
jmp 0x7453b6
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x5c], 0
je 0x7454d2
mov dword [rsp + 0x24], 0xce
jmp 0x7454da
mov dword [rsp + 0x24], 0xcd
mov rcx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x24]
mov dword [rcx + 0x24], eax
mov eax, 1
add rsp, 0x38
ret
Function at 0x7734a0
Capabilities:
Get common file path

Disassembly:
push rbp
push rbx
sub rsp, 0x238
mov rbp, rsp
mov rbx, rcx
mov rcx, rbx
call fcn.0040d970
mov rax, qword [0x007e1318]
mov rax, qword [rax]
mov rcx, qword [rax + 0x2a8]
xor rdx, rdx
lea r8, [rbp + 0x228]
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp qword [rbp + 0x228], 0
je 0x773508
mov rcx, qword [rbp + 0x228]
lea rdx, [rbp + 0x20]
call sub.shell32.dll_SHGetPathFromIDListW
test eax, eax
je 0x773508
mov rcx, rbx
lea rdx, [rbp + 0x20]
mov r8d, 0x104
call fcn.0040edd0
mov rax, rbx
lea rsp, [rbp + 0x238]
pop rbx
pop rbp
ret
Function at 0x140003bd0
Capabilities:
Get token membership

Disassembly:
sub rsp, 0x78
mov eax, dword [0x140024004]
test eax, eax
jne 0x140004980
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
int3
mov dword [rsp + 0x64], 0
movzx ecx, word [0x1400220a4]
mov word [rsp + 0x6c], cx
mov ecx, dword [0x1400220a0]
mov dword [rsp + 0x68], ecx
test eax, eax
jne 0x14000573e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cld
mov ecx, 0x47e901b4
stc
mov dl, 1
jmp 0x141b2a670
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x68]
mov dl, 2
mov r8d, 0x20
mov r9d, 0x220
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov ecx, dword [0x140024004]
test eax, eax
je 0x1400070ce
test ecx, ecx
jne 0x14000641d
nop
nop
nop
nop
nop
nop
nop
nop
nop
popfq
mov ebp, 0x8e68e900
cmpsb byte [rsi], byte [rdi]
add cl, ch
movabs dword [0x4be9ae5ee9006db9], eax
invalid
mov rdx, qword [rsp + 0x70]
lea r8, [rsp + 0x64]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x140007c31
cmp dword [0x140024004], 0
jne 0x1400070ba
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
or al, 0x81
mov es, word [rcx]
jmp 0x1418ae150
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rsp + 0x64]
jmp 0x140007c2c
xor eax, eax
test ecx, ecx
jne 0x140007c2c
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x1413e2a10
add rsp, 0x78
ret
mov dword [rsp + 0x64], 0
cmp dword [0x140024004], 0
jne 0x1400070ba
jmp 0x140006444
Function at 0x140007c50
Capabilities:
Create process on windows
Terminate process

Disassembly:
push rsi
sub rsp, 0x1a0
cmp dword [0x140024004], 0
jne 0x1400088db
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
in al, dx
in al, 0x83
add ecx, ebp
invalid
call fcn.140003bd0
test eax, eax
jne 0x14000af09
cmp dword [0x140024004], 0
jne 0x14000956b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add cl, ch
stosb byte [rdi], al
jmp [rsi + 0x7c85e900]
lea rsi, [rsp + 0x90]
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14000af09
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x20], 0x70
lea rax, str.runas
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x50], 1
cmp dword [0x140024004], 0
jne 0x14000a262
nop
nop
nop
nop
jmp 0x141965ea0
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x14000ba73
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x140024004], 0
jne 0x14000aefe
nop
nop
nop
nop
nop
nop
nop
nop
add cl, ch
sub al, byte [rbp + rsi*2]
jmp 0x1406267c0
cmp eax, 0x4c7
je 0x14000c6fb
cmp dword [0x140024004], 0
jne 0x14000ba6a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dh, 0x99
add ecx, ebp
or byte [rcx], ch
xchg esp, eax
add ecx, ebp
rcr dword [rsi], cl
xchg ebx, eax
add ecx, ebp
sahf
cmp dword [rdi], ebp
jmp 0x14060f4b0
add rsp, 0x1a0
pop rsi
ret
cmp dword [0x140024004], 0
jne 0x14000d37e
jmp 0x140811200
cmp dword [0x140024004], 0
jne 0x14000d37e
nop
nop
nop
nop
nop
nop
nop
nop
add ecx, ebp
stosb byte [rdi], al
mov byte [rdx - 0x2cfa16ff], ch
lahf
add ecx, ebp
or ch, 0x9b
add dword [rsi], ebx
add ecx, r13d
push 0xffffffffe9013cc6
push rbx
ja 0x14000c747
add ecx, ebp
outsb dx, byte [rsi]
outsb dx, byte [rsi]
insb byte [rdi], dx
loope 0x14000c76b
add ecx, ebp
push rdi
xor dword [rsi], esp
add ecx, ebp
invalid
push rbx
mov ch, 0
jmp 0x1408534e0
jmp 0x140a68a60
xor ecx, ecx
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
ud2
Function at 0x140020050
Capabilities:
Allocate or change rwx memory

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov r14, r8
mov r15, rdx
mov rsi, rcx
movsxd rax, dword [0x1400246d0]
test rax, rax
jle 0x1400200bb
mov rcx, qword [0x1400246c8]
add rcx, 0x20
mov rdx, rax
jmp 0x14002009a
add rcx, 0x28
add rdx, 0xffffffffffffffff
je 0x1400200b6
mov rbx, qword [rcx - 8]
cmp rbx, rsi
ja 0x140020090
mov rdi, qword [rcx]
mov edi, dword [rdi + 8]
add rbx, rdi
cmp rbx, rsi
jbe 0x140020090
jmp 0x14002017f
mov r12d, eax
jmp 0x1400200be
xor r12d, r12d
mov rcx, rsi
call fcn.140020d10
test rax, rax
je 0x14002019c
mov rdi, rax
mov rax, qword [0x1400246c8]
lea rcx, [r12*8]
lea rbx, [rcx + rcx*4]
mov qword [rax + rbx + 0x20], rdi
mov dword [rax + rbx], 0
call fcn.140020e30
mov ecx, dword [rdi + 0xc]
add rcx, rax
mov rax, qword [0x1400246c8]
mov qword [rax + rbx + 0x18], rcx
lea rdx, [rsp + 0x28]
mov r8d, 0x30
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400201ad
mov eax, dword [rsp + 0x4c]
lea ecx, [rax - 4]
cmp ecx, 0x3c
ja 0x14002013e
movabs rdx, 0x1000000000000011
bt rdx, rcx
jb 0x140020178
cmp eax, 0x80
je 0x140020178
mov rcx, qword [rsp + 0x28]
mov rax, qword [0x1400246c8]
lea rbx, [r12 + r12*4]
lea r9, [rax + rbx*8]
mov qword [rax + rbx*8 + 8], rcx
mov rdx, qword [rsp + 0x40]
mov qword [rax + rbx*8 + 0x10], rdx
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400201ce
add dword [0x1400246d0], 1
mov rcx, rsi
mov rdx, r15
mov r8, r14
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call fcn.1400201f0
ud2
mov edx, dword [rdi + 8]
mov rax, qword [0x1400246c8]
lea rcx, [r12 + r12*4]
mov r8, qword [rax + rcx*8 + 0x18]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.1400201f0
ud2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400201f0
ud2

Function at 0x1400201f0
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call fcn.140021000
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
ud2
Function at 0x140020c80
Capabilities:
Parse pe header

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
xor edi, edi
cmp rax, 8
ja 0x140020d02
mov rax, qword [0x140022010]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x140020d02
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140020d00
add rax, rcx
movzx ecx, word [rax + 0x18]
cmp ecx, 0x20b
jne 0x140020d00
movzx ebx, word [rax + 6]
test ebx, ebx
je 0x140020d00
movzx ecx, word [rax + 0x14]
lea rdi, [rcx + rax]
add rdi, 0x18
xor ebp, ebp
nop dword [rax]
mov r8d, 8
mov rcx, rdi
mov rdx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strncmp
test eax, eax
je 0x140020d02
add ebp, 1
add rdi, 0x28
cmp ebp, ebx
jb 0x140020ce0
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x140020d10
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r8, qword [0x140022010]
movzx edx, word [r8]
cmp edx, 0x5a4d
jne 0x140020d7d
movsxd rdx, dword [r8 + 0x3c]
cmp dword [r8 + rdx], 0x4550
jne 0x140020d7d
add r8, rdx
movzx edx, word [r8 + 0x18]
cmp edx, 0x20b
jne 0x140020d7d
movzx edx, word [r8 + 6]
test edx, edx
je 0x140020d7d
sub rcx, qword [0x140022010]
movzx eax, word [r8 + 0x14]
add rax, r8
add rax, 0x18
jmp 0x140020d69
add rax, 0x28
add edx, 0xffffffff
je 0x140020d7d
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x140020d60
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x140020d60
jmp 0x140020d7f
xor eax, eax
ret

Function at 0x140020d80
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x140022010]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x140020db6
movsxd r8, dword [rcx + 0x3c]
cmp dword [rcx + r8], 0x4550
jne 0x140020db6
movzx edx, word [rcx + r8 + 0x18]
cmp edx, 0x20b
jne 0x140020db6
movzx eax, word [rcx + r8 + 6]
ret

Function at 0x140020dc0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140022010]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x140020e2d
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x140020e2d
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x140020e2d
movzx r8d, word [rax + 6]
test r8d, r8d
je 0x140020e2d
movzx edx, word [rax + 0x14]
add rax, rdx
add rax, 0x18
xor edx, edx
test byte [rax + 0x27], 0x20
jne 0x140020e22
nop dword [rax + rax]
add edx, 1
add rax, 0x28
cmp edx, r8d
jae 0x140020e2d
test byte [rax + 0x27], 0x20
je 0x140020e10
test rcx, rcx
je 0x140020e2f
add rcx, 0xffffffffffffffff
jmp 0x140020e10
xor eax, eax
ret

Function at 0x140020e30
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140022010]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x140020e5c
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140020e5c
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x140020e5e
xor eax, eax
ret
Function at 0x14028c8b0
Capabilities:
Terminate process

Disassembly:
or eax, 0xfe34921b
cli
std
invalid
cld
pop r11
jmp 0x14028c8bd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14028c8cd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14028c8b5
lea eax, [rcx + 1]
jmp 0x14028c8db
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14028c8ee
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14028c8d4
sub eax, 3
jb 0x14028c90e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14028c95d
sar eax, 1
movsxd rbp, eax
jb 0x14028c944
jmp 0x14028c91c
add ebx, ebx
jne 0x14028c91a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14028c944
inc ecx
add ebx, ebx
jne 0x14028c92a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14028c944
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14028c93d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14028c92c
add ecx, 2
jmp 0x14028c949
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14028c872
jmp 0x14028c8bd
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x28a000]
mov eax, dword [rdi]
or eax, eax
je 0x14028c9b9
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x28c1dc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14028c969
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14028c9b3
mov qword [rbx], rax
add rbx, 8
jmp 0x14028c989
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14028c9fd
cmp al, 0xef
ja 0x14028c9e5
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14028c9c5
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x14028c9d4
mov eax, dword [rdi]
add rdi, 4
jmp 0x14028c9d4
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x16f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.14028ca7c], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.14028ca7c
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14028ca6c
sub rsp, 0xffffffffffffff80
jmp 0x1401c19da

Function at 0x1400018e4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000192e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000192e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000192e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000192e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000192e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001930
xor al, al
add rsp, 0x28
ret