joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40dd80
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x70], r8
mov rcx, qword [rbp + 0x70]
call fcn.00409960
nop
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx ecx, ax
mov edx, 3
lea r8, [rbp + 0x48]
mov r9d, 4
call sub.kernel32.dll_GetLocaleInfoW
lea rcx, [rbp + 0x38]
lea rdx, [rbp + 0x48]
mov r8d, 4
call fcn.0040ab80
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x38]
call fcn.0040aec0
mov rcx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x28]
mov rdx, qword [rax]
call fcn.0040dbd0
test al, al
jne 0x40de4e
mov word [rbp + 0x4c], 0
lea rcx, [rbp + 0x30]
lea rdx, [rbp + 0x48]
mov r8d, 4
call fcn.0040ab80
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x30]
call fcn.0040aec0
mov rcx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x28]
mov rdx, qword [rax]
call fcn.0040dbd0
test al, al
jne 0x40de4e
mov rcx, qword [rbp + 0x28]
call fcn.004097d0
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.004098b0
lea rcx, [rbp + 0x70]
call fcn.004097d0
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x50]
pop rbp
ret
Function at 0x40dea0
Capabilities:
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x88], rdx
mov qword [rbp + 0x90], r8
mov rcx, qword [rbp + 0x88]
call fcn.00409960
mov rcx, qword [rbp + 0x90]
call fcn.00409960
nop
mov rcx, qword [rbp + 0x28]
call fcn.004097d0
cmp qword [rbp + 0x90], 0
je 0x40e060
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x90]
call fcn.00409e80
xor eax, eax
mov rcx, qword [rbp + 0x90]
test rcx, rcx
je 0x40df4b
mov eax, dword [rcx - 4]
cmp eax, 1
jl 0x40df85
mov rcx, qword [rbp + 0x90]
movsxd rdx, eax
cmp word [rcx + rdx*2 - 2], 0x2e
jne 0x40df7e
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x90]
mov r8d, 1
mov r9d, eax
call fcn.0040b0e0
jmp 0x40df85
sub eax, 1
test eax, eax
jne 0x40df50
nop
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x88]
call fcn.0040dad0
cmp qword [rbp + 0x68], 0
je 0x40dfc3
mov rcx, rbp
lea rdx, [rbp + 0x58]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x68]
call fcn.0040dc60
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x58]
call fcn.00409e00
jmp 0x40e05f
call sub.kernel32.dll_GetUserDefaultUILanguage
lea rcx, [rbp + 0x48]
mov edx, eax
call fcn.0040d260
mov rcx, rbp
lea rdx, [rbp + 0x50]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x48]
call fcn.0040dc60
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x50]
call fcn.00409e00
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jne 0x40e038
cmp byte [0x00467ee8], 0
jne 0x40e038
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea rcx, [rbp + 0x38]
mov edx, eax
call fcn.0040d260
mov rcx, rbp
lea rdx, [rbp + 0x40]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x38]
call fcn.0040dc60
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x40]
call fcn.00409e00
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jne 0x40e05f
mov rcx, rbp
lea rdx, [rbp + 0x30]
mov r8, qword [rbp + 0x60]
call fcn.0040dd80
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x30]
call fcn.00409e00
nop
lea rcx, [rbp + 0x30]
mov edx, 8
call fcn.004098b0
lea rcx, [rbp + 0x88]
mov edx, 2
call fcn.004098b0
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x70]
pop rbp
ret

Function at 0x4103a0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret

Function at 0x4103c0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
call sub.kernel32.dll_GetVersion
mov ecx, eax
and ecx, 0xff
and eax, 0xff00
shr eax, 8
cmp ecx, 5
jne 0x4103e4
cmp eax, 1
jae 0x4103e9
cmp ecx, 5
jbe 0x4103f5
mov dword [0x00463a20], 0x7f
jmp 0x4103ff
mov dword [0x00463a20], 0x409
add rsp, 0x28
ret
Function at 0x410800
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
call fcn.004107f0
mov ebx, eax
test ebx, ebx
je 0x41084b
cmp dword [0x0045d7c4], 0xffffffff
jne 0x410824
mov ecx, 0xe2
call fcn.00409670
mov ecx, ebx
call fcn.004107d0
test rax, rax
jne 0x41083d
mov ecx, 0xe2
call fcn.00409670
jmp 0x41084b
mov ecx, dword [0x0045d7c4]
mov rdx, rax
call sub.kernel32.dll_TlsSetValue
add rsp, 0x20
pop rbx
ret

Function at 0x4108a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
lea rax, [0x230]
test rax, rax
je 0x4108df
cmp dword [0x0045d7c4], 0xffffffff
je 0x4108df
mov ecx, dword [0x0045d7c4]
call sub.kernel32.dll_TlsGetValue
test rax, rax
je 0x4108df
mov rcx, rax
call sub.kernel32.dll_LocalFree
mov ecx, dword [0x0045d7c4]
xor edx, edx
call sub.kernel32.dll_TlsSetValue
add rsp, 0x28
ret

Function at 0x410920
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp byte [0x00469260], 0
je 0x41095b
mov ecx, dword [0x0045d7c4]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x41096e
call fcn.00410800
mov ecx, dword [0x0045d7c4]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x41096e
mov rax, qword [0x004692a0]
jmp 0x41096e
mov rax, qword gs:[0x58]
mov ecx, dword [0x0045d7c4]
mov rax, qword [rax + rcx*8]
add rsp, 0x28
ret

Function at 0x420010
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
sub rsp, 0x38
mov rbp, rsp
mov ebx, r8d
lea r8, [rbp + 0x2c]
mov r9d, 2
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x420037
movzx rax, word [rbp + 0x2c]
jmp 0x420039
mov eax, ebx
lea rsp, [rbp + 0x38]
pop rbx
pop rbp
ret
Function at 0x421ab0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x8e0
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rdx
mov qword [rbp + 0x58], 0
nop
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
lea r8, [rbp + 0x60]
mov r9d, 0x400
call fcn.00421860
mov ebx, eax
mov rax, qword [0x00462228]
cmp byte [rax], 0
je 0x421be6
mov rcx, qword [0x00462058]
call fcn.00405d30
call fcn.004058d0
mov ecx, 1
xor edx, edx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte_1
mov esi, eax
lea rcx, [rbp + 0x58]
mov rdx, qword [0x00421a70]
mov r8d, 1
movsxd r9, esi
call fcn.0040c5a0
mov ecx, 1
xor edx, edx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte_1
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle_1
mov rcx, rax
mov rdx, qword [rbp + 0x58]
mov r8d, esi
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile_1
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle_1
mov rcx, rax
lea rdx, [0x00421c7c]
mov r8d, 2
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile_1
jmp 0x421c2b
mov rcx, qword [0x00469268]
call fcn.0040c8c0
mov rcx, rax
mov rax, qword [0x00462008]
mov edx, dword [rax + 8]
lea r8, [rbp + 0x860]
mov r9d, 0x40
call sub.user32.dll_LoadStringW_1
xor ecx, ecx
lea rdx, [rbp + 0x60]
lea r8, [rbp + 0x860]
mov r9d, 0x2010
call sub.user32.dll_MessageBoxW
nop
lea rcx, [rbp + 0x58]
mov rdx, qword [0x00421a70]
call fcn.0040c770
lea rsp, [rbp + 0x8e0]
pop rbx
pop rsi
pop rbp
ret
Function at 0x4237a0
Capabilities:
Get file version info

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x80], rcx
mov qword [rbp + 0x88], rdx
mov qword [rbp + 0x90], r8
mov qword [rbp + 0x98], r9
nop
mov byte [rbp + 0x67], 0
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x80]
call fcn.00409e80
lea rcx, [rbp + 0x58]
call fcn.0040a0c0
mov rcx, qword [rbp + 0x58]
call fcn.0040aab0
mov rcx, rax
lea rdx, [rbp + 0x50]
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [rbp + 0x54], eax
cmp dword [rbp + 0x54], 0
je 0x4238b0
mov ecx, dword [rbp + 0x54]
call fcn.004055e0
mov qword [rbp + 0x68], rax
nop
mov rcx, qword [rbp + 0x58]
call fcn.0040aab0
mov rcx, rax
mov edx, dword [rbp + 0x50]
mov r8d, dword [rbp + 0x54]
mov r9, qword [rbp + 0x68]
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x4238a6
mov rcx, qword [rbp + 0x68]
lea rdx, [0x00423908]
lea r8, [rbp + 0x48]
lea r9, [rbp + 0x44]
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x4238a6
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x10]
mov dword [rbp + 0x40], eax
mov rax, qword [rbp + 0x88]
mov ecx, dword [rbp + 0x40]
shr ecx, 0x10
movzx ecx, cx
mov dword [rax], ecx
mov rax, qword [rbp + 0x90]
mov rcx, qword [rbp + 0x48]
movzx ecx, word [rcx + 0x10]
mov dword [rax], ecx
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x14]
mov dword [rbp + 0x3c], eax
mov rax, qword [rbp + 0x98]
mov ecx, dword [rbp + 0x3c]
shr ecx, 0x10
movzx ecx, cx
mov dword [rax], ecx
mov byte [rbp + 0x67], 1
nop
mov rcx, qword [rbp + 0x68]
call fcn.00405610
nop
lea rcx, [rbp + 0x58]
call fcn.004097d0
movzx rax, byte [rbp + 0x67]
lea rsp, [rbp + 0x70]
pop rbp
ret

Function at 0x424750
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x240
mov rbp, rsp
mov rbx, rcx
mov rcx, rbx
call fcn.00409fa0
mov r13d, eax
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call fcn.00410380
mov esi, eax
cmp esi, 0x104
jbe 0x4247ac
mov ecx, esi
add ecx, ecx
mov ecx, ecx
call fcn.004055e0
mov rdi, rax
jmp 0x4247b0
lea rdi, [rbp + 0x38]
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], esi
call fcn.00410380
mov rcx, rdi
call sub.user32.dll_CharUpperW
xor ebx, ebx
xor ecx, ecx
mov edx, esi
sub edx, 1
mov eax, ecx
cmp eax, edx
jg 0x424807
sub edx, ecx
add edx, 1
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movsxd rcx, eax
movzx ecx, word [rdi + rcx*2]
xor ebx, ecx
add eax, 1
sub edx, 1
test edx, edx
jne 0x4247e8
nop
lea rax, [rbp + 0x38]
cmp rdi, rax
je 0x424819
mov rcx, rdi
call fcn.00405610
mov eax, ebx
lea rsp, [rbp + 0x240]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret
Function at 0x2fc4d0160
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d1240
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d0b62
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f3108]
test eax, eax
je 0x2fc4d0bfa
lea rax, [0x2fc4f30e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f3110]
mov qword [rbp - 8], rax
jmp 0x2fc4d0bde
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d0bd2
cmp qword [rbp - 0x10], 0
je 0x2fc4d0bd2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d0b98
lea rax, [0x2fc4f30e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d0bfb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d0d00
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d0d28
mov eax, 0
jmp 0x2fc4d0d76
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d0d51
mov eax, 0
jmp 0x2fc4d0d76
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d0d71
mov eax, 0
jmp 0x2fc4d0d76
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d0d7c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d0dfa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d0df1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d0df1
mov rax, qword [rbp - 8]
jmp 0x2fc4d0e0f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d0dc4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d2550
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d3630
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d2f52
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f5108]
test eax, eax
je 0x2fc4d2fea
lea rax, [0x2fc4f50e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f5110]
mov qword [rbp - 8], rax
jmp 0x2fc4d2fce
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d2fc2
cmp qword [rbp - 0x10], 0
je 0x2fc4d2fc2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d2f88
lea rax, [0x2fc4f50e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d2feb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d30f0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d3118
mov eax, 0
jmp 0x2fc4d3166
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d3141
mov eax, 0
jmp 0x2fc4d3166
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d3161
mov eax, 0
jmp 0x2fc4d3166
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d316c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d31ea
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d31e1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d31e1
mov rax, qword [rbp - 8]
jmp 0x2fc4d31ff
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d31b4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140005170
Capabilities:
Parse pe header

Disassembly:
test rcx, rcx
je 0x1400051a0
mov eax, 0
cmp word [rcx], 0x5a4d
jne 0x14000519f
mov eax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x1400051a5
cdqe
add rax, rcx
cmp dword [rax], 0x4550
mov edx, 0
cmovne rax, rdx
ret
mov rax, rcx
jmp 0x14000519f
mov eax, 0
jmp 0x14000519f

Function at 0x140005820
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.1400057d0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x14000fa00
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x14056b090]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x14000fa6f
mov rcx, r9
call fcn.14000f8d0
test eax, eax
je 0x14000fa6f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x14000fa6d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x14000fa64
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x14000fa6f
add rdx, 0x28
cmp rdx, r9
jne 0x14000fa50
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret

Function at 0x140f5f658
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f5f662
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f5f68b
pop rbp
sub rbp, 0x33
sub rbp, 0xf5f658
sub rsp, 0x20
jmp 0x140f5f6aa
mov rax, 0xf5f658
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x1691d48c
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f5f6c9
jmp 0x140f5f6e0
invalid
Function at 0x1800018c8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rcx + 8], rdx
lea r9, [rcx + 0x10]
mov r8d, 1
mov r10d, 0x138
mov rax, rdx
shr rax, 0x3e
xor rax, rdx
movabs rdx, 0x5851f42d4c957f2d
imul rdx, rax
add rdx, r8
inc r8
mov qword [r9], rdx
lea r9, [r9 + 8]
cmp r8, r10
jb 0x1800018dc
mov dword [rcx], r10d
ret

Function at 0x1800034d8
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov rsi, rcx
mov rdx, qword [rax + 0x60]
mov rdi, qword [rdx + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x180003524
test rcx, rcx
je 0x180003536
mov rdx, qword [rbx + 0x50]
mov rcx, rsi
call fcn.180028e54
test eax, eax
je 0x180003536
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x18000350c
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
jmp 0x180003526

Function at 0x1800037ac
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r10 + r8]
mov byte [r8], al
inc r8
cmp r9d, 0x16
jl 0x1800037b8
ret

Function at 0x1800037e4
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r10 + r8]
mov byte [r8], al
inc r8
cmp r9d, 0x15
jl 0x1800037f0
ret

Function at 0x18000381c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r10 + r8]
mov byte [r8], al
inc r8
cmp r9d, 0x1c
jl 0x180003828
ret

Function at 0x180003854
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r10 + r8]
mov byte [r8], al
inc r8
cmp r9d, 0x14
jl 0x180003860
ret

Function at 0x18000388c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r10 + r8]
mov byte [r8], al
inc r8
cmp r9d, 0x11
jl 0x180003898
ret

Function at 0x1800038c4
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r10 + r8]
mov byte [r8], al
inc r8
cmp r9d, 0x18
jl 0x1800038d0
ret