joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f5320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rdi
push rsi
push rbx
movzx r10d, word [rcx + 0x1d2]
movzx eax, word [rcx + 0x98]
mov r9, qword [rcx + 0x10]
cmp r10d, 0x8000
mov r11, rax
lea rsi, [r9 + rax*8]
jbe 0x4f53ff
movzx ebp, word [rsi]
movzx edi, word [rsi + 2]
movzx r8d, byte [rsi + 5]
jmp 0x4f5372
movzx r10d, word [rax + 6]
cmp r10d, 0x8000
jbe 0x4f53ff
mov eax, r10d
lea rax, [r9 + rax*8]
movzx edx, word [rax]
lea rdx, [r9 + rdx*8]
cmp byte [rdx + 5], r8b
jne 0x4f5360
cmp word [rdx], bp
movzx ebx, word [rdx + 2]
je 0x4f53f0
xor ebx, edi
test bl, bl
jne 0x4f5360
movzx eax, word [rcx + 0x1c4]
cmp r10d, eax
jae 0x4f53e5
lea r8, [r9 + rax*8]
movzx edx, word [r8]
cmp r11w, dx
je 0x4f53e0
mov ebx, dword [rsi]
jmp 0x4f53ce
movzx edx, word [r8 + 6]
movzx eax, dx
cmp r10d, eax
jae 0x4f53e5
lea r8, [r9 + rdx*8]
movzx edx, word [r8]
cmp r11w, dx
je 0x4f53e0
lea rdx, [r9 + rdx*8]
cmp dword [rdx], ebx
jne 0x4f53b3
movzx edi, byte [rsi + 5]
cmp byte [rdx + 5], dil
jne 0x4f53b3
pop rbx
pop rsi
pop rdi
pop rbp
ret
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.a.out.exe_lj_ir_emit
cmp bx, di
jne 0x4f5360
movzx eax, word [rax + 2]
jmp 0x4f53e0
mov r10d, 0x8000
jmp 0x4f5395
Function at 0x4f5410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
movzx r10d, word [rcx + 0x98]
movzx r8d, word [rcx + 0x1d2]
mov rdx, qword [rcx + 0x10]
movzx edi, word [rcx + 0x9a]
lea rbx, [rcx + 0x1d2]
cmp r10d, r8d
lea rax, [rdx + r10*8]
jae 0x4f5471
movzx r12d, word [rax]
movzx ebp, word [rax + 2]
movzx r11d, byte [rax + 5]
mov eax, r8d
lea rax, [rdx + rax*8]
movzx r9d, word [rax]
lea r9, [rdx + r9*8]
cmp byte [r9 + 5], r11b
je 0x4f5480
movzx r8d, word [rax + 6]
lea rbx, [rax + 6]
cmp r10d, r8d
jb 0x4f544e
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.a.out.exe_lj_ir_emit
cmp word [r9], r12w
movzx esi, word [r9 + 2]
je 0x4f54a0
xor esi, ebp
test sil, sil
jne 0x4f5463
movzx r8d, word [rax + 2]
cmp edi, r8d
je 0x4f5463
jmp 0x4f5471
cmp si, bp
jne 0x4f5463
movzx r9d, word [rax + 2]
cmp edi, r9d
je 0x4f54e1
movzx r9d, word [rcx + 0x162]
cmp r9d, r8d
jae 0x4f5471
mov r9d, dword [rcx + 8]
sub r9d, 1
lea rdx, [rdx + r9*8]
cmp rax, rdx
jb 0x4f54d9
jmp 0x4f54f0
sub rdx, 8
cmp rax, rdx
jae 0x4f54f0
cmp byte [rdx + 4], 0
jns 0x4f54d0
jmp 0x4f5471
mov eax, 4
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
movzx edx, word [rax + 6]
xor r11d, r11d
xor esi, esi
add r8d, 1
mov word [rbx], dx
xor ebx, ebx
mov byte [rax + 5], 0xc
mov byte [rax + 4], 0
mov word [rax + 2], r11w
mov word [rax], bx
mov word [rax + 6], si
cmp r8d, dword [rcx + 8]
jae 0x4f5471
cmp byte [rax + 0xd], 0x53
jne 0x4f5471
movzx eax, word [rax + 8]
cmp r10d, eax
jne 0x4f5471
movzx edx, word [rcx + 0x1e6]
mov r10, qword [rcx + 0x10]
cmp r8d, edx
lea r9, [r10 + rdx*8]
jb 0x4f5553
jmp 0x4f5593
mov r9, rdx
movzx edx, word [r9 + 6]
mov rax, rdx
lea rdx, [r10 + rdx*8]
cmp r8d, eax
jb 0x4f5550
lea rax, [r9 + 6]
movzx r8d, word [rdx + 6]
xor r9d, r9d
mov word [rax], r8w
xor eax, eax
xor r8d, r8d
mov byte [rdx + 5], 0xc
mov byte [rdx + 4], 0
mov word [rdx + 2], ax
mov word [rdx], r8w
mov word [rdx + 6], r9w
jmp 0x4f5471
lea rax, [rcx + 0x1e6]
mov rdx, r9
jmp 0x4f5568
Function at 0x4f5e50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rdi
push rsi
push rbx
movzx eax, dx
lea rsi, [rcx + rax*2]
movzx r9d, word [rsi + 0x14e]
cmp r9d, r8d
jbe 0x4f5f00
mov r10, qword [rcx + 0x10]
lea rax, [r10 + r9*8]
movzx r11d, word [rax]
cmp r8d, r11d
mov r9, r11
je 0x4f5f40
mov r11d, r8d
lea rbx, [r10 + r11*8]
jmp 0x4f5ea4
lea rax, [r10 + rax*8]
movzx r11d, word [rax]
cmp r8d, r11d
mov r9, r11
je 0x4f5f40
test byte [rax + 4], 0x1f
jne 0x4f5ef3
cmp dx, 0x40
movzx r9d, word [r10 + r9*8 + 2]
movzx r11d, word [rbx + 2]
je 0x4f5ed3
movzx edi, r9w
movzx ebp, r11w
movzx edi, byte [r10 + rdi*8 + 4]
xor dil, byte [r10 + rbp*8 + 4]
and edi, 0x1f
jne 0x4f5ef3
cmp r9d, r11d
sete dil
cmp r9d, 0x7fff
seta r9b
or dil, r9b
jne 0x4f5f38
cmp r11d, 0x7fff
ja 0x4f5f38
movzx eax, word [rax + 6]
movzx r9d, ax
cmp r8d, r9d
jb 0x4f5e90
movzx edx, word [rsi + 0x140]
cmp r8d, edx
jae 0x4f5f38
mov rcx, qword [rcx + 0x10]
lea rax, [rcx + rdx*8]
movzx edx, word [rax]
cmp r8d, edx
jne 0x4f5f2c
jmp 0x4f5f40
lea rax, [rcx + rax*8]
movzx edx, word [rax]
cmp r8d, edx
je 0x4f5f40
movzx eax, word [rax + 6]
movzx edx, ax
cmp r8d, edx
jb 0x4f5f20
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
ret
test byte [rax + 4], 0x1f
setne al
movzx eax, al
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x4fb760
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov ecx, dword [0x0060ab84]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x4fb878
mov rax, qword [0x0060ab88]
xor ebx, ebx
add rax, 8
mov rdx, qword [rax]
cmp rsi, rdx
jb 0x4fb7ac
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rsi, rdx
jb 0x4fb85e
add ebx, 1
add rax, 0x18
cmp ebx, ecx
jne 0x4fb790
mov rcx, rsi
call fcn.004fc3c0
test rax, rax
mov r12, rax
je 0x4fb8b0
movsxd rbx, ebx
lea rbx, [rbx + rbx*2]
shl rbx, 3
mov r13, rbx
add r13, qword [0x0060ab88]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call fcn.004fc510
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
mov qword [r13 + 8], rax
mov rax, qword [0x0060ab88]
lea rdx, [rsp + 0x20]
mov rcx, qword [rax + rbx + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4fb893
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x4fb857
sub eax, 4
and eax, 0xfffffffb
je 0x4fb857
add rbx, qword [0x0060ab88]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4fb87f
add dword [0x0060ab84], 1
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.004fca10
xor ebx, ebx
jmp 0x4fb7b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.004fb6f0
mov rax, qword [0x0060ab88]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rbx + 8]
call fcn.004fb6f0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call fcn.004fb6f0
nop
Function at 0x4fc030
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0060ae60]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0060ae40]
test rbx, rbx
je 0x4fc084
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x4fc07b
test rsi, rsi
je 0x4fc07b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4fc060
lea rcx, [0x0060ae60]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x4fc3c0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x005cace0]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
je 0x4fc3e0
mov rax, rdx
add rsp, 0x28
ret
mov rcx, r9
call fcn.004fc2a0
test eax, eax
je 0x4fc3d8
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add rax, r9
movzx edx, word [rax + 0x14]
lea rdx, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x4fc43d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x4fc434
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x4fc3d8
add rdx, 0x28
cmp rdx, r9
jne 0x4fc420
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret
Function at 0x1400f80f0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1400f80fd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400f810d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1400f80f5
lea eax, [rcx + 1]
jmp 0x1400f811b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1400f812e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1400f8114
sub eax, 3
jb 0x1400f814e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400f819d
sar eax, 1
movsxd rbp, eax
jb 0x1400f8184
jmp 0x1400f815c
add ebx, ebx
jne 0x1400f815a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400f8184
inc ecx
add ebx, ebx
jne 0x1400f816a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400f8184
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1400f817d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1400f816c
add ecx, 2
jmp 0x1400f8189
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1400f80b2
jmp 0x1400f80fd
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x1f200
mov dl, 0x12
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400f81ed
cmp rsi, rcx
jae 0x1400f81f5
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400f81d4
cmp al, 0x8f
ja 0x1400f81d4
cmp byte [rsi - 2], 0xf
je 0x1400f81da
sub al, 0xe8
cmp al, 1
ja 0x1400f81be
cmp rsi, rcx
jae 0x1400f81f5
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400f81c4
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400f81f5
lodsb al, byte [rsi]
jmp 0x1400f81d4
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xe4000]
mov eax, dword [rdi]
or eax, eax
je 0x1400f8252
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xf865c]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1400f8202
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1400f824c
mov qword [rbx], rax
add rbx, 8
jmp 0x1400f8222
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1400f828c
cmp al, 0xef
ja 0x1400f827e
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1400f825e
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x1400f826d
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x257]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1400f82e0
sub rsp, 0xffffffffffffff80
jmp 0x14000c5a0
Function at 0x14000147f
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1400104a0]
mov dword [rax], 1
mov rax, qword [0x1400104b0]
mov dword [rax], 1
mov rax, qword [0x1400104c0]
mov dword [rax], 1
mov rax, qword [0x140010460]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014d0
mov eax, 0
jmp 0x14000157d
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400014fc
mov eax, 0
jmp 0x14000157d
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x140001522
cmp eax, 0x20b
je 0x140001549
jmp 0x140001578
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x140001535
mov eax, 0
jmp 0x14000157d
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000157d
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x140001564
mov eax, 0
jmp 0x14000157d
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000157d
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001f64
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
lea r12, [0x1400150c0]
xor ebx, ebx
mov rsi, rcx
mov rdi, rdx
lea r13, [rsp + 0x20]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbp, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, 1
cmp rbx, rdi
jl 0x140001fdf
call rbp
mov r8d, 1
mov edx, 1
lea rcx, [0x14000f19c]
mov r9, rax
call sub.ucrtbase.dll_fwrite
mov ecx, 1
call rbp
mov rcx, rax
call sub.ucrtbase.dll_fflush
mov rcx, r12
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rbp
xor r8d, r8d
mov rdx, r13
mov rcx, rax
mov rax, rbx
shl rax, 4
movups xmm0, xmmword [rsi + rax]
movaps xmmword [rsp + 0x20], xmm0
call fcn.140001e3e
mov rcx, qword [0x140010440]
call fcn.140007bb0
cmp byte [rax], 0
jne 0x140002018
inc rbx
jmp 0x140001f94
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x140002130
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
mov rsi, rcx
mov rbx, rdx
test rdx, rdx
je 0x14000214f
mov rcx, rdx
call sub.ucrtbase.dll_strlen
mov r8, rax
mov rcx, rbx
mov r9, rsi
mov edx, 1
call sub.ucrtbase.dll_fwrite
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp sub.ucrtbase.dll_fflush

Function at 0x1400032d6
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov rsi, rcx
mov ecx, 2
call qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov r8, qword [rsp + 0x28]
mov rcx, rsi
mov edx, 1
mov rbx, rax
mov r9, rax
call sub.ucrtbase.dll_fwrite
mov rcx, rbx
add rsp, 0x38
pop rbx
pop rsi
jmp sub.ucrtbase.dll_fflush
Function at 0x140003315
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp qword [0x140015108], 0
jne 0x14000332b
add rsp, 0x40
pop rbx
jmp fcn.1400032d6
lea rbx, [rsp + 0x30]
mov rdx, rcx
mov rcx, rbx
call fcn.14000324f
movaps xmm0, xmmword [rsp + 0x30]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call qword [0x140015108]
mov rcx, rbx
call fcn.14000219a
lea rcx, [0x14000e100]
call fcn.140007bb0
cmp byte [rax], 0
je 0x14000338c
mov byte [rax], 0
lea rcx, [0x14000e060]
call fcn.140007bb0
mov rcx, rax
mov rax, qword [rax]
mov rdx, qword [rax + 0x38]
add rsp, 0x40
pop rbx
jmp fcn.14000257a
add rsp, 0x40
pop rbx
ret

Function at 0x14000346b
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
lea rsi, [0x14000f37f]
mov rbp, qword [rcx]
mov rdi, qword [rcx + 8]
mov ecx, 2
call rbx
lea rdx, str.could_not_load:
mov rcx, rax
call fcn.140002130
test rbp, rbp
je 0x1400034a7
lea rsi, [rdi + 8]
mov ecx, 2
call rbx
mov rdx, rsi
mov rcx, rax
call fcn.140002130
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xc1
jne 0x1400034dc
mov ecx, 2
call rbx
lea rdx, str._n_bad_format__library_may_be_wrong_architecture_
mov rcx, rax
call fcn.140002130
mov ecx, 2
call rbx
lea rdx, [0x14000f3c2]
mov rcx, rax
call fcn.140002130
mov ecx, 1
call sub.ucrtbase.dll_exit
nop

Function at 0x1400034fd
Capabilities:
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov rsi, rcx
mov ecx, 2
call rbx
lea rdx, str.could_not_import:
mov rcx, rax
call fcn.140002130
mov ecx, 2
call rbx
mov rdx, rsi
mov rcx, rax
call fcn.140002130
mov ecx, 2
call rbx
lea rdx, [0x14000f3c2]
mov rcx, rax
call fcn.140002130
mov ecx, 1
call sub.ucrtbase.dll_exit
nop

Function at 0x140003ec9
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, [0x14000e100]
call fcn.140007bb0
cmp byte [rax], 0
je 0x140003f10
lea rcx, [0x14000e060]
call fcn.140007bb0
mov rcx, qword [rax]
mov rbx, rax
test rcx, rcx
je 0x140003f10
call fcn.140003ea4
mov rcx, rbx
xor edx, edx
call fcn.140002382
mov ecx, 1
call sub.ucrtbase.dll_exit
nop
add rsp, 0x20
pop rbx
ret
push rbx
sub rsp, 0x30
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400036ae
movups xmm0, xmmword [rsp + 0x20]
movaps xmmword [0x140015310], xmm0
call fcn.1400059f8
mov rcx, qword [0x140010440]
call fcn.140007bb0
cmp byte [rax], 0
mov rbx, rax
jne 0x140006467
mov word [0x140015304], 0xaa
lea rcx, [0x140015304]
call fcn.140005db3
cmp byte [rbx], 0
jne 0x140006467
lea rcx, [0x140015310]
call fcn.140003855
nop
add rsp, 0x30
pop rbx
jmp 0x140003ec9
sub rsp, 0x28
call fcn.1400063e6
nop
add rsp, 0x28
jmp 0x14000640a
Function at 0x1400059f8
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
xor edi, edi
lea rbp, str.ntdll.dll
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
xor eax, eax
mov rbx, qword [rsi + 0x30]
test rbx, rbx
je 0x140005a89
movsxd rax, dword [rbx + 0x3c]
add rax, rbx
jo 0x140005a46
movsxd rax, dword [rax + 0x88]
test eax, eax
je 0x140005a69
add rax, rbx
jno 0x140005a5b
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.14000220e
movsxd rcx, dword [rax + 0xc]
mov rdi, rax
add rcx, rbx
jno 0x140005a71
jmp 0x140005a46
mov rsi, qword [rsi]
mov rax, rbx
jmp 0x140005a24
cmp rcx, rbp
je 0x140005a8c
test rcx, rcx
je 0x140005a6c
mov rdx, rbp
call sub.ucrtbase.dll_strcmp
test eax, eax
jne 0x140005a6c
jmp 0x140005a8c
mov rbx, rax
movsxd rbp, dword [rdi + 0x1c]
mov eax, dword [rdi + 0x18]
add rbp, rbx
mov dword [rsp + 0x24], eax
jo 0x140005a46
movsxd rax, dword [rdi + 0x20]
add rax, rbx
jo 0x140005a46
movsxd rdi, dword [rdi + 0x24]
mov esi, dword [rax]
add rdi, rbx
jo 0x140005a46
xor r14d, r14d
mov r15d, 0x80000000
mov eax, dword [rsp + 0x24]
cmp r14d, eax
jle 0x140005b06
xor eax, eax
mov r9d, 1
lea r8, [rsp + 0x40]
mov rdx, qword [0x140015310]
mov qword [rsp + 0x58], rax
lea rax, [0x140005910]
mov qword [rsp + 0x50], rax
mov rax, qword [0x140015318]
movaps xmm1, xmmword [rsp + 0x50]
lea rcx, [rax + 8]
movaps xmmword [rsp + 0x40], xmm1
call fcn.140004476
jmp 0x140005bdf
movsxd rsi, esi
mov r13, rbx
add r13, rsi
mov qword [rsp + 0x28], r13
jo 0x140005a46
mov ax, word [rdi]
mov rcx, qword [0x140010440]
mov word [rsp + 0x22], ax
call fcn.140007bb0
cmp byte [rax], 0
mov r12, rax
jne 0x140005bdf
test r13, r13
mov rdx, r13
je 0x140005b4d
mov rcx, r13
call sub.ucrtbase.dll_strlen
mov rdx, rax
inc rdx
mov ecx, 0xffffffff
movsxd rdx, edx
add rsi, rdx
lea rax, [rsi + r15]
cmp rcx, rax
jb 0x140005a46
lea rdx, [0x14000fa8a]
mov rcx, r13
add rdi, 2
call fcn.1400040b0
cmp byte [r12], 0
jne 0x140005bdf
test al, al
je 0x140005bca
xorps xmm0, xmm0
mov rcx, r13
movaps xmmword [rsp + 0x50], xmm0
call fcn.1400059b3
cmp byte [r12], 0
jne 0x140005bdf
movzx edx, word [rsp + 0x22]
mov qword [rsp + 0x50], rax
lea rcx, [0x140015310]
mov edx, dword [rbp + rdx*4]
mov dword [rsp + 0x58], edx
movaps xmm2, xmmword [rsp + 0x50]
lea rdx, [rsp + 0x30]
movaps xmmword [rsp + 0x30], xmm2
call fcn.1400036dd
cmp r14d, 0x7fffffff
je 0x140005a46
inc r14d
jmp 0x140005ab9
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140005bf0
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
xor eax, eax
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x40], rax
lea rdi, [rsp + 0x40]
mov qword [rsp + 0x48], rax
call fcn.14000586d
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rcx, qword [0x140010440]
call fcn.140007bb0
cmp byte [rax], 0
mov rbx, rax
jne 0x140005c96
mov qword [rsp + 0x40], rbp
dec rbp
mov qword [rsp + 0x48], rsi
jle 0x140005cfd
cmp qword [rsi + 8], 5
jne 0x140005cfd
mov rax, qword [rsi + 0x10]
mov r8d, 5
lea rdx, [0x14000fc98]
lea rcx, [rax + 8]
call sub.ucrtbase.dll_memcmp
test eax, eax
jne 0x140005cfd
movups xmm0, xmmword [rsi + 0x18]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call fcn.1400048f2
cmp byte [rbx], 0
mov rsi, rax
jne 0x140005c96
mov rcx, rdi
call fcn.14000386a
jmp 0x140005d04
mov rcx, rdi
xor esi, esi
call fcn.14000386a
cmp byte [rbx], 0
je 0x140005d04
mov rcx, qword [0x140010430]
call fcn.140007bb0
mov rax, qword [rax]
mov rax, qword [rax]
mov rdi, qword [rax + 0x18]
test rdi, rdi
je 0x140005d04
mov rcx, rdi
call sub.ucrtbase.dll_strlen
cmp rax, 0x2c
jbe 0x140005d04
lea rcx, [rdi + rax - 0x2d]
mov r8d, 0x2d
lea rdx, str.ValueErrorCatchableErrorExceptionRootObj
call sub.ucrtbase.dll_memcmp
test eax, eax
jne 0x140005d04
mov byte [rbx], 0
mov edx, 1
lea rcx, [0x14000fc50]
call fcn.140001f64
xor ecx, ecx
call sub.ucrtbase.dll_exit
mov rax, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x140005d10
Capabilities:
Execute syscall

Disassembly:
push rcx
push rdx
push r8
push r9
sub rsp, 0x20
mov rcx, 0xdc07230
call fcn.140005922
add rsp, 0x20
pop r9
pop r8
pop rdx
pop rcx
mov r10, rcx
syscall
ret

Function at 0x140005d38
Capabilities:
Execute syscall

Disassembly:
push rcx
push rdx
push r8
push r9
sub rsp, 0x20
mov rcx, 0x2421bd37
call fcn.140005922
add rsp, 0x20
pop r9
pop r8
pop rdx
pop rcx
mov r10, rcx
syscall
ret

Function at 0x140005d60
Capabilities:
Execute syscall

Disassembly:
push rcx
push rdx
push r8
push r9
sub rsp, 0x20
mov rcx, 0xd0d9f24
call fcn.140005922
add rsp, 0x20
pop r9
pop r8
pop rdx
pop rcx
mov r10, rcx
syscall
ret

Function at 0x140005d88
Capabilities:
Execute syscall

Disassembly:
push rcx
push rdx
push r8
push r9
sub rsp, 0x20
movabs rcx, 0xdb05a7f6
call fcn.140005922
add rsp, 0x20
pop r9
pop r8
pop rdx
pop rcx
mov r10, rcx
syscall
ret
Function at 0x14000640a
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, [0x14000e100]
call fcn.140007bb0
cmp byte [rax], 0
je 0x140003f10
lea rcx, [0x14000e060]
call fcn.140007bb0
mov rcx, qword [rax]
mov rbx, rax
test rcx, rcx
je 0x140003f10
call fcn.140003ea4
mov rcx, rbx
xor edx, edx
call fcn.140002382
mov ecx, 1
call sub.ucrtbase.dll_exit
nop
add rsp, 0x20
pop rbx
ret
push rbx
sub rsp, 0x30
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400036ae
movups xmm0, xmmword [rsp + 0x20]
movaps xmmword [0x140015310], xmm0
call fcn.1400059f8
mov rcx, qword [0x140010440]
call fcn.140007bb0
cmp byte [rax], 0
mov rbx, rax
jne 0x140006467
mov word [0x140015304], 0xaa
lea rcx, [0x140015304]
call fcn.140005db3
cmp byte [rbx], 0
jne 0x140006467
lea rcx, [0x140015310]
call fcn.140003855
nop
add rsp, 0x30
pop rbx
jmp 0x140003ec9
sub rsp, 0x28
call fcn.1400063e6
nop
add rsp, 0x28
jmp 0x14000640a

Function at 0x140006473
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, [0x14000e100]
call fcn.140007bb0
cmp byte [rax], 0
je 0x140003f10
lea rcx, [0x14000e060]
call fcn.140007bb0
mov rcx, qword [rax]
mov rbx, rax
test rcx, rcx
je 0x140003f10
call fcn.140003ea4
mov rcx, rbx
xor edx, edx
call fcn.140002382
mov ecx, 1
call sub.ucrtbase.dll_exit
nop
add rsp, 0x20
pop rbx
ret
push rbx
sub rsp, 0x30
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400036ae
movups xmm0, xmmword [rsp + 0x20]
movaps xmmword [0x140015310], xmm0
call fcn.1400059f8
mov rcx, qword [0x140010440]
call fcn.140007bb0
cmp byte [rax], 0
mov rbx, rax
jne 0x140006467
mov word [0x140015304], 0xaa
lea rcx, [0x140015304]
call fcn.140005db3
cmp byte [rbx], 0
jne 0x140006467
lea rcx, [0x140015310]
call fcn.140003855
nop
add rsp, 0x30
pop rbx
jmp 0x140003ec9
sub rsp, 0x28
call fcn.1400063e6
nop
add rsp, 0x28
jmp 0x14000640a

Function at 0x1400067c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.ucrtbase.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.ucrtbase.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.ucrtbase.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.14000d7e0
call sub.ucrtbase.dll_abort
nop