joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b8680
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x4b8919
push rbp
mov rbp, rsp
sub rsp, 0x98
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xa8], rax
nop
lea rax, [0x004d4cc0]
call fcn.0040c6a0
mov qword [rsp + 0x70], rax
mov qword [rax + 8], 9
lea rcx, [0x004e06ea]
mov qword [rax], rcx
mov byte [rax + 0x10], 1
nop
lea rax, [0x004d4cc0]
call fcn.0040c6a0
mov qword [rsp + 0x68], rax
mov qword [rax + 8], 8
lea rcx, [0x004e047a]
mov qword [rax], rcx
mov byte [rax + 0x10], 1
nop
lea rax, [0x004d4c00]
call fcn.0040c6a0
cmp dword [0x00657030], 0
jne 0x4b8717
mov rcx, qword [rsp + 0x70]
jmp 0x4b8724
call fcn.00461320
mov rcx, qword [rsp + 0x70]
mov qword [r11], rcx
mov qword [rsp + 0x60], rax
mov qword [rax + 0x18], rcx
mov qword [rax + 8], 0xd
lea rcx, [0x004e14f7]
mov qword [rax], rcx
nop
lea rax, [0x004d4c00]
call fcn.0040c6a0
cmp dword [0x00657030], 0
jne 0x4b8760
mov rcx, qword [rsp + 0x68]
jmp 0x4b876d
call fcn.00461320
mov rcx, qword [rsp + 0x68]
mov qword [r11], rcx
mov qword [rsp + 0x58], rax
mov qword [rax + 0x18], rcx
mov qword [rax + 8], 0xc
lea rcx, [0x004e1077]
mov qword [rax], rcx
mov qword [rsp + 0x40], 0
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x48], rcx
lea rax, [0x004c5680]
call fcn.0040c6a0
mov rcx, qword [rsp + 0xb0]
mov qword [rax + 8], rcx
mov qword [rax + 0x10], 0x3000
mov qword [rax + 0x18], 0x40
mov rbx, rax
mov edi, 4
mov rax, qword [rsp + 0x58]
mov rcx, rdi
call fcn.004b1760
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
jbe 0x4b890e
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0x90], rcx
lea rax, [0x004c5620]
call fcn.0040c6a0
mov rcx, qword [rsp + 0x50]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x90]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0xb0]
mov qword [rax + 0x10], rcx
mov rbx, rax
mov ecx, 3
mov rdi, rcx
mov rax, qword [rsp + 0x60]
nop dword [rax]
call fcn.004b1760
movzx ecx, word [0x00656dc4]
mov word [rsp + 0x3e], cx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x88], rdx
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x80], rdx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x78], rdx
lea rax, [0x004c56e0]
nop dword [rax]
call fcn.0040c6a0
mov qword [rax], 0xffffffffffffffff
mov rcx, qword [rsp + 0x88]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], 0x20
mov rcx, qword [rsp + 0x78]
mov qword [rax + 0x20], rcx
movzx ecx, word [rsp + 0x3e]
mov word [rsp], cx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 5
mov qword [rsp + 0x18], 5
call fcn.004ac100
xorps xmm15, xmm15
mov r14, qword [0x00656ff0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x50]
xor ebx, ebx
mov rcx, rbx
mov rdi, rcx
mov rsi, rcx
nop dword [rax]
call fcn.0045dd60
add rsp, 0x98
pop rbp
ret
xor eax, eax
mov rcx, rax
call fcn.004616a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f420
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax]
jmp fcn.004b8680
Function at 0x1f48d4c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1f48d56
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1f48d7f
pop rbp
sub rbp, 0x33
sub rbp, 0x1b48d4c
sub rsp, 0x20
jmp 0x1f48d9e
mov rax, 0x1b48d4c
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffb7289099
xor byte [rax], dl
inc rax
dec rcx
jne 0x1f48dbd
jmp 0x1f48dd4
add byte [0xffffffffd2f79c80], bl
adc byte [rax + 0x12], dh
rcl dword [rax]
jo 0x1f48dea
adc byte [rbp - 0x2e666667], ah
sbb byte [rax - 0x6f], bl
cwde
cdq
cdq
rcr dword [rax + 0x595ed170], 1
xchg ecx, eax
cdq
cdq
cdq
rcr dword [rsi + 0x5b], 1
mov cl, 0x99
cdq
cdq
shr dword [rsi + 0x7b], 1
rcr dword [rax - 0x6ae7eda8], 1
cdq
cdq
cdq
rcr dword [rax - 0x2e36368f], 1
and dword [rcx + 0xf], ecx
mov al, 0x99
cdq
cdq
cdq
cdq
shl dword [rax], 1
loopne 0x1f48e83
adc ebx, dword [rax - 0x66666667]
rcr dword [rax + 0x3523d170], 1
push rbx
neg dword [rcx + 0x71999999]
pushfq
cdq
cdq
cdq
jo 0x1f48dbd
cdq
cdq
cdq
pop rax
jno 0x1f48dcf
test al, 0x88
rcr dword [rax], 1
pop rax
popfq
cdq
cdq
cdq
shl dword [rsi + 0x51], 1
xchg esi, eax
sbb al, 0x77
pop dx
rol ebx, 0xcb
leave
shl dword [rcx], 1
cmpxchg byte [r9 - 0x66666667], bl
shl dword [rax], 1
loopne 0x1f48ec8
adc ebx, dword [rax - 0x66666667]
rcr dword [rax - 0x66638e90], 1
cdq
cdq
jo 0x1f48e7d
wait
cdq
cdq
retf
test al, 0x4b
sbb dh, byte [rcx - 0x64]
shl dword [rsi + 0x51], 1
push cx
xchg esi, eax
sbb eax, 0x999999fd
xchg esi, eax
adc edi, eax
cdq
cdq
cdq
call qword [rdx]
test dword [rax - 0x698e9de7], esp
sbb eax, 0x99999985
sbb dword [rdx + 0x70], esp
xchg esi, eax
sbb eax, 0x9999998a
call [rax]
invalid
cdq
cdq
jo 0x1f48ef4
mov al, 0xcd
movabs al, byte [0x9999999f5818d19b]
rcr dword [rax], 1
jae 0x1f48e7b
cdq
cdq
cdq
rcr dword [rax], 1
jno 0x1f48e81
cdq
cdq
cdq
jo 0x1f48ef4
invalid
adc byte [rsi - 0x2f], cl
adc byte [rdi + 0x65], dl
sub ebx, dword [rcx]
adc ebx, dword [rdi - 0x67a0e72f]
cdq
cdq
cdq
adc dword [rsi - 0x67a1e72f], ebx
cdq
cdq
cdq
rcr dword [rsi + 0x5a], 1
wait
cdq
cdq
cdq
wait
xchg r14, rax
sbb al, 0x9e
cdq
cdq
cdq
adc ecx, dword [rdi - 0x74a0992f]
xchg r14, rax
sbb cl, byte [rbx + 0x66]
wait
xchg r14, rax
sbb al, 0x9e
cdq
cdq
cdq
adc ecx, dword [rdi - 0x74a0992f]
xchg r14, rax
sbb ah, dh
cdq
cdq
cdq
shr dword [rax - 0x69b464a7], 1
sbb al, 0x9e
cdq
cdq
cdq
adc ecx, dword [rdi - 0x74a0992f]
xchg r14, rax
sbb bh, bh
cwde
cdq
cdq
wait
xchg r14, rax
sbb al, 0x9e
cdq
cdq
cdq
adc ecx, dword [rdi - 0x74a0992f]
ror qword [r8 - 0x69b464a7], 1
sbb al, 0x9e
cdq
cdq
cdq
adc ecx, dword [rdi - 0x74a0992f]
ror qword [r8 - 0x69b464a7], 1
sbb al, 0x9e
cdq
cdq
cdq
adc ecx, dword [rdi - 0x74a0992f]
ror qword [r8 - 0x69b464a7], 1
sbb al, 0x9e
cdq
cdq
cdq
adc ecx, dword [rdi - 0x74a0992f]
ror qword [r8 - 0x6ee269a7], 1
cdq
cdq
cdq
rcl dword [rax]
invalid
Function at 0x140b06070
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140b0607d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140b0608d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140b06075
lea eax, [rcx + 1]
jmp 0x140b0609b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140b060ae
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140b06094
sub eax, 3
jb 0x140b060ce
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140b0611d
sar eax, 1
movsxd rbp, eax
jb 0x140b06104
jmp 0x140b060dc
add ebx, ebx
jne 0x140b060da
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140b06104
inc ecx
add ebx, ebx
jne 0x140b060ea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140b06104
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140b060fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140b060ec
add ecx, 2
jmp 0x140b06109
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140b06032
jmp 0x140b0607d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0xafd000]
mov eax, dword [rdi]
or eax, eax
je 0x140b0617d
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xb06708]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140b0612d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140b06177
mov qword [rbx], rax
add rbx, 8
jmp 0x140b0614d
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140b061c1
cmp al, 0xef
ja 0x140b061a9
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140b06189
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x140b06198
mov eax, dword [rdi]
add rdi, 4
jmp 0x140b06198
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140b06240], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140b06240
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140b06230
sub rsp, 0xffffffffffffff80
jmp 0x1400014d0

Function at 0x14013dbf1
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + rsi*2 - 0x416ae252], r11
lea rsi, [0x14015bc20]
push 0x49b069bb
movzx r11d, byte [r9]
dec dword [rsp]
xor r11d, ecx
and r11d, 0xff
mov r11d, dword [rsi + r11*4]
shr ecx, 8
xor ecx, r11d
inc r9
not dword [rsp + 1]
xor ecx, 0x72e8e39
dec r10
push 0xffffffffdd2a060b
lea rsp, [rsp + 0x10]
jne 0x14013dc00
push 0x48bd479b
mov r11, qword [rsp + 8]
pop rsi
pop rsi
pop rsi
Function at 0x140001160
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x140048018]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
xor edx, edx
mov ecx, 0x5c
call fcn.140001150
lea edx, [rcx - 0x5b]
mov word [rsp + 0x40], ax
call fcn.140001150
lea ecx, [rdx + 0x2d]
mov word [rsp + 0x42], ax
lea edx, [rcx - 0x2c]
call fcn.140001150
lea ecx, [rdx + 0x5a]
mov word [rsp + 0x44], ax
lea edx, [rcx - 0x59]
call fcn.140001150
lea ecx, [rdx + 0x42]
mov word [rsp + 0x46], ax
lea edx, [rcx - 0x41]
call fcn.140001150
lea ecx, [rdx + 0x45]
mov word [rsp + 0x48], ax
lea edx, [rcx - 0x44]
call fcn.140001150
lea ecx, [rdx + 0x4c]
mov word [rsp + 0x4a], ax
lea edx, [rcx - 0x4b]
call fcn.140001150
lea ecx, [rdx + 0x3e]
mov word [rsp + 0x4c], ax
lea edx, [rcx - 0x3d]
call fcn.140001150
lea ecx, [rdx + 0x4f]
mov word [rsp + 0x4e], ax
lea edx, [rcx - 0x4e]
call fcn.140001150
xor ecx, ecx
mov word [rsp + 0x50], ax
lea edx, [rcx + 9]
call fcn.140001150
lea edx, [rcx + 0xa]
mov word [rsp + 0x52], ax
movzx ecx, word [0x14004268c]
call fcn.140001150
movzx ecx, word [0x14004268e]
mov edx, 0xb
mov word [rsp + 0x54], ax
call fcn.140001150
movzx ecx, word [0x140042690]
mov edx, 0xc
mov word [rsp + 0x56], ax
call fcn.140001150
movzx ecx, word [0x140042692]
mov edx, 0xd
mov word [rsp + 0x58], ax
call fcn.140001150
movzx ecx, word [0x140042694]
mov edx, 0xe
mov word [rsp + 0x5a], ax
call fcn.140001150
movzx ecx, word [0x140042696]
mov edx, 0xf
mov word [rsp + 0x5c], ax
call fcn.140001150
movzx ecx, word [str.Unknown_exception]
mov edx, 0x10
mov word [rsp + 0x5e], ax
call fcn.140001150
movzx ecx, word [0x14004269a]
mov edx, 0x11
mov word [rsp + 0x60], ax
call fcn.140001150
movzx ecx, word [0x14004269c]
mov edx, 0x12
mov word [rsp + 0x62], ax
call fcn.140001150
mov word [rsp + 0x64], ax
mov r9d, 0x133
xor eax, eax
mov word [rsp + 0x66], ax
xor r10d, r10d
nop dword [rax]
movsxd rcx, eax
lea rdx, [rsp + 0x40]
lea rdx, [rdx + rcx*2]
lea ecx, [r9 + rax]
inc eax
xor word [rdx], cx
cmp eax, 0x13
jb 0x1400012f0
mov qword [rsp + 0x30], r10
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov dword [rsp + 0x28], r10d
mov edx, 0xc0000000
mov word [rsp + 0x66], r10w
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14000da10
add rsp, 0x70
pop rbx
ret
Function at 0x140003560
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140048018]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [rdx + 0x18], 8
mov rbx, rdx
mov rdi, rcx
mov r9, rdx
jb 0x140003591
mov r9, qword [rdx]
cmp qword [rcx + 0x18], 8
mov r8, rdi
jb 0x14000359e
mov r8, qword [rcx]
mov ecx, 0x72
xor edx, edx
call fcn.140001150
lea ecx, [rdx + 0x75]
mov word [rsp + 0x30], ax
lea edx, [rcx - 0x74]
call fcn.140001150
lea ecx, [rdx + 0x6d]
mov word [rsp + 0x32], ax
lea edx, [rcx - 0x6c]
call fcn.140001150
lea ecx, [rdx + 0x5f]
mov word [rsp + 0x34], ax
lea edx, [rcx - 0x5e]
call fcn.140001150
lea ecx, [rdx + 0x70]
mov word [rsp + 0x36], ax
lea edx, [rcx - 0x6f]
call fcn.140001150
xor ecx, ecx
mov word [rsp + 0x38], ax
lea edx, [rcx + 5]
call fcn.140001150
lea edx, [rcx + 6]
mov word [rsp + 0x3a], ax
movzx ecx, word [0x14004283c]
call fcn.140001150
movzx ecx, word [0x14004283e]
mov edx, 7
mov word [rsp + 0x3c], ax
call fcn.140001150
movzx ecx, word [0x140042840]
mov edx, 8
mov word [rsp + 0x3e], ax
call fcn.140001150
movzx ecx, word [0x140042842]
mov edx, 9
mov word [rsp + 0x40], ax
call fcn.140001150
movzx ecx, word [0x140042844]
mov edx, 0xa
mov word [rsp + 0x42], ax
call fcn.140001150
mov word [rsp + 0x44], ax
mov r10d, 0x133
xor eax, eax
mov word [rsp + 0x46], ax
xor esi, esi
nop dword [rax]
movsxd rcx, eax
lea rdx, [rsp + 0x30]
lea rdx, [rdx + rcx*2]
lea ecx, [r10 + rax]
inc eax
xor word [rdx], cx
cmp eax, 0xb
jb 0x140003680
mov dword [rsp + 0x28], esi
lea rdx, [rsp + 0x30]
xor ecx, ecx
mov qword [rsp + 0x20], rsi
mov word [rsp + 0x46], si
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x1400036f0
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400036eb
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003766
mov rcx, r8
call fcn.14000dee8
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 7
mov word [rdi], si
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14000373a
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003735
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003766
mov rcx, r8
call fcn.14000dee8
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000da10
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
call fcn.140017bac
int3
Function at 0x140003770
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
xor ebp, ebp
mov rdi, rcx
cmp qword [rcx + 0x18], 8
mov dword [rsp + 0x40], ebp
jb 0x140003792
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x140003826
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140003805
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140003800
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400038cf
mov rcx, r8
call fcn.14000dee8
mov al, 1
mov rsi, qword [rsp + 0x78]
mov word [rdi], bp
mov qword [rdi + 0x10], rbp
mov rbp, qword [rsp + 0x70]
mov qword [rdi + 0x18], 7
add rsp, 0x50
pop rdi
ret
cmp rsi, 0xffffffffffffffff
jne 0x14000386b
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140003867
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140003862
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400038cf
mov rcx, r8
call fcn.14000dee8
xor al, al
jmp 0x140003807
lea r9, [rsp + 0x40]
mov qword [rsp + 0x68], rbx
mov r8d, 0x41200
mov qword [rsp + 0x20], rbp
lea rdx, [0x14004b040]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x18]
test bl, bl
mov rbx, qword [rsp + 0x68]
jne 0x1400038b8
cmp rax, 8
jb 0x140003867
lea rdx, [rax*2 + 2]
jmp 0x14000383e
cmp rax, 8
jb 0x140003805
lea rdx, [rax*2 + 2]
jmp 0x1400037d8
call fcn.140017bac
int3
Function at 0x1400038e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
xor ebp, ebp
mov rdi, rcx
cmp qword [rcx + 0x18], 8
mov dword [rsp + 0x40], ebp
jb 0x140003902
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x140003996
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140003975
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140003970
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003a3f
mov rcx, r8
call fcn.14000dee8
mov al, 1
mov rsi, qword [rsp + 0x78]
mov word [rdi], bp
mov qword [rdi + 0x10], rbp
mov rbp, qword [rsp + 0x70]
mov qword [rdi + 0x18], 7
add rsp, 0x50
pop rdi
ret
cmp rsi, 0xffffffffffffffff
jne 0x1400039db
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x1400039d7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x1400039d2
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003a3f
mov rcx, r8
call fcn.14000dee8
xor al, al
jmp 0x140003977
lea r9, [rsp + 0x40]
mov qword [rsp + 0x68], rbx
mov r8d, 0x2400
mov qword [rsp + 0x20], rbp
lea rdx, [0x140048c40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x18]
test bl, bl
mov rbx, qword [rsp + 0x68]
jne 0x140003a28
cmp rax, 8
jb 0x1400039d7
lea rdx, [rax*2 + 2]
jmp 0x1400039ae
cmp rax, 8
jb 0x140003975
lea rdx, [rax*2 + 2]
jmp 0x140003948
call fcn.140017bac
int3
Function at 0x140004cc0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push r14
mov r14, rcx
mov rsi, r8
mov rbp, rdx
sub r14, qword [r8 + 0x30]
je 0x140004e42
test byte [r8 + 0x5e], 0x40
jne 0x140004ced
xor eax, eax
mov rbp, qword [rsp + 0x30]
pop r14
pop rsi
ret
movzx edx, word [rsi + 0x14]
movzx eax, word [rsi + 6]
add rdx, 0x18
mov r8d, dword [r8 + 0xb0]
add rdx, rsi
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp rdx, r9
jae 0x140004e42
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140004d26
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140004d3d
add rdx, 0x28
cmp rdx, r9
jb 0x140004d14
mov eax, 1
mov rbp, qword [rsp + 0x30]
pop r14
pop rsi
ret
mov qword [rsp + 0x18], rbx
mov ebx, dword [rdx + 0x14]
sub rbx, rcx
mov qword [rsp + 0x28], r15
mov r15d, dword [rsi + 0xb4]
add rbx, r8
add rbx, rbp
add r15, rbx
test rbx, rbx
je 0x140004e38
cmp rbx, r15
jae 0x140004e38
mov qword [rsp + 0x20], rdi
mov eax, dword [rbx + 4]
test eax, eax
je 0x140004e33
add eax, 0xfffffff8
shr eax, 1
je 0x140004e24
lea r11, [rbx + 8]
mov edi, eax
movzx r8d, word [r11]
movzx eax, r8w
shr ax, 0xc
and r8d, 0x80000fff
jge 0x140004db2
dec r8d
or r8d, 0xfffff000
inc r8d
cmp ax, 3
je 0x140004dbe
cmp ax, 0xa
jne 0x140004e16
movzx eax, word [rsi + 0x14]
movzx ecx, word [rsi + 6]
add rax, 0x18
mov r9d, dword [rbx]
add rax, rsi
lea rdx, [rcx + rcx*4]
lea r10, [rax + rdx*8]
cmp rax, r10
jae 0x140004e0b
nop dword [rax]
mov edx, dword [rax + 0xc]
cmp r9, rdx
jb 0x140004df2
mov ecx, dword [rax + 8]
add ecx, edx
cmp r9, rcx
jb 0x140004dfd
add rax, 0x28
cmp rax, r10
jb 0x140004de0
jmp 0x140004e0b
mov ecx, dword [rax + 0x14]
sub rcx, rdx
add rcx, r9
add rcx, rbp
jne 0x140004e0e
mov rcx, rbp
movzx eax, r8w
add qword [rax + rcx], r14
add r11, 2
sub rdi, 1
jne 0x140004d90
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, r15
jb 0x140004d74
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov r15, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov eax, 1
pop r14
pop rsi
ret
Function at 0x140004e50
Capabilities:
Enumerate pe sections

Disassembly:
mov dword [rsp + 8], ecx
push rbp
push rdi
push r13
sub rsp, 0x40
movzx eax, word [r8 + 0x14]
lea r10, [r8 + 0x18]
mov r11d, dword [r8 + 0x90]
add r10, rax
movzx eax, word [r8 + 6]
mov rbp, r8
mov r13, rdx
mov edi, ecx
lea r9, [rax + rax*4]
lea r8, [r10 + r9*8]
cmp r10, r8
jae 0x140004eb1
nop dword [rax]
mov ecx, dword [r10 + 0xc]
cmp r11, rcx
jb 0x140004ea8
mov eax, dword [r10 + 8]
add eax, ecx
cmp r11, rax
jb 0x140004f45
add r10, 0x28
cmp r10, r8
jb 0x140004e90
xor eax, eax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
test r11d, r11d
je 0x140004f1e
cmp dword [rbp + 0x94], 0
je 0x140004f1e
lea rbx, [rax + 0x10]
movzx edx, word [rbp + 0x14]
movzx eax, word [rbp + 6]
add rdx, 0x18
mov r8d, dword [rbx - 4]
add rdx, rbp
mov qword [rsp + 0x70], rbx
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp rdx, r9
jae 0x140004f1e
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140004f15
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140004f57
add rdx, 0x28
cmp rdx, r9
jb 0x140004f03
mov eax, 1
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r13
pop rdi
pop rbp
ret
mov eax, dword [r10 + 0x14]
sub rax, rcx
add rax, r11
add rax, r13
jmp 0x140004eb3
mov r15d, dword [rdx + 0x14]
sub r15, rcx
add r15, r8
add r15, r13
je 0x140004f1e
mov rdx, r15
mov ecx, edi
call fcn.1400041c0
mov r12, rax
test rax, rax
je 0x140005092
movzx edx, word [rbp + 0x14]
movzx eax, word [rbp + 6]
add rdx, 0x18
mov r8d, dword [rbx]
add rdx, rbp
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp rdx, r9
jae 0x140004fbb
nop dword [rax + rax]
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140004fb2
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140004fe0
add rdx, 0x28
cmp rdx, r9
jb 0x140004fa0
xor r14d, r14d
mov rdi, qword [r14]
test rdi, rdi
je 0x140005077
jns 0x140004fef
xor edx, edx
mov rcx, r15
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
movzx edx, di
jmp 0x140005040
mov r14d, dword [rdx + 0x14]
sub r14, rcx
add r14, r8
add r14, r13
jmp 0x140004fbe
movzx eax, word [rbp + 0x14]
movzx ecx, word [rbp + 6]
add rax, 0x18
add rax, rbp
lea rdx, [rcx + rcx*4]
lea r8, [rax + rdx*8]
cmp rax, r8
jae 0x14000502b
nop dword [rax + rax]
mov edx, dword [rax + 0xc]
cmp rdi, rdx
jb 0x140005022
mov ecx, dword [rax + 8]
add ecx, edx
cmp rdi, rcx
jb 0x140005084
add rax, 0x28
cmp rax, r8
jb 0x140005010
xor esi, esi
xor edx, edx
mov rcx, r15
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
lea rdx, [rsi + 2]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov rcx, rbx
sub rdi, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rax, [rdi + r12]
mov qword [r14], rax
add r14, 8
mov rdi, qword [r14]
test rdi, rdi
jne 0x140004fca
mov rbx, qword [rsp + 0x70]
mov edi, dword [rsp + 0x60]
add rbx, 0x14
jmp 0x140004ede
mov esi, dword [rax + 0x14]
sub rsi, rdx
add rsi, rdi
add rsi, r13
jmp 0x14000502d
jmp 0x140004f23