joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14012b3c8
Capabilities:
Execute syscall
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
std
invalid
pushfq
rcl edi, 0x57
lea r13d, [rbx + 0x3609]
jmp rcx
sub byte [rax], al
add dl, al
adc byte [rax], al
jmp rax
jne 0x14012b3a0
jl 0x14012b411
lea edx, [rbx + 0x89dc]
popfq
test r11, rcx
lea esi, [rbp - 0x8b3c]
test edx, 0x594d9d41
cmpsb byte [rsi], byte [rdi]
ja 0x14012adcd
and ebx, 0xd7cc471e
mul r14
call rax
jno 0x14012b613
pause
ja 0x14012bc21
jmp rax
or dword [rdi + rax - 1], esi
ror dword [rcx - 9], 1
mul r8
invalid
mov ecx, 0x48e620eb
adc dword [rbx], esi
lodsd eax, dword [rsi]
pop rbx
je 0x14012aa02
pop r11
cmp rbx, rdx
popf
rcl ecx, 0x96
lea r10d, [rdi - 0x66e0]
ret 0x18
sbb dword [rcx + 0x1a7d60f1], eax
invalid
dec dword [rax - 0x42]
jmp 0x14012b2b8
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
je 0x14012bc25
jne 0x14012bc25
ror r9d, 0xc
jnp 0x14012bd24
ror r8d, 0x8c
movabs r9, 0x3fe0da747a4d62eb
jnp 0x14012b478
enter 0x498c, 0xffffffffffffffb9
jmp 0x14012bc89
jmp rcx
je 0x14012bca5
mov r9d, dword [rbx + 0x18]
test r9d, r9d
jmp 0x14012bcfd
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
jmp 0x14012bc77
test r9d, r9d
jne 0x14012bd12
mov rax, qword [rax]
jmp 0x14012bcad
jmp 0x14012bc09
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14012bc9c
nop
jmp 0x14012bcef
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x14012bcef
cmp edx, 0xeed19381
je 0x14012bd27
jmp 0x14012bc9c
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
jmp 0x14012bccb
je 0x14012bca5
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0xf80f49f9
jmp 0x14012bcb2
invalid
mov eax, dword [rbx + 0x24]
mov ecx, dword [rbx + 0x1c]
add rax, r10
jne 0x14012bd85
je 0x14012bd85
popf
inc r15
test r8d, 0x2995104a
test rsi, rdi
jne 0x14012bb29
lea ebp, [rcx + 0x9682]
lea r9d, [rbx - 0x57a6]
test rcx, rbp
syscall
lea r11d, [rbx - 0xe8fc]
lea r12d, [rdx - 0x5a27]
cmp r11d, 0x4cde083c
lea r13d, [rbp - 0x794]
add ecx, 0x938570f
mov r10d, 0x140a52d
movabs r15, 0x2b8aa8c255b961eb
or r13d, 0x54c57360
ret
jmp 0x14012bde8
mov dword [rsp + 0x63], 0x6e383c3d
mov word [rsp + 0x5c], 0xf6f6
mov word [rsp + 0x67], 0x7676
mov r12d, dword [rcx + rdx*4]
jne 0x14012bdd1
je 0x14012bdd1
ror ebp, 0x64
cmp rdi, rbp
bswap r14
jmp rax
jmp 0x14012bf26
add rcx, r10
mov dword [rsp + 0x54], 0xf6f6f6f6
mov dword [rsp + 0x5f], 0x7c6f7d7f
mov dword [rsp + 0x58], 0xf6f6f6f6
movzx edx, word [rax + r9*2]
jmp 0x14012bd98
nop dword [rax]
xchg r11, rdx
mov r11, r15
xchg r11, rdx
add r12, r10
xor eax, eax
mov byte [rsp + 0x69], al
jmp 0x14012be66
Function at 0x180001390
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
je 0x1800013a6
xor eax, eax
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rax
lea r8, [0x1800124a0]
lea rdx, str.CONOUT_
lea rcx, [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor ecx, ecx
lea r8, [0x180002080]
mov qword [rsp + 0x28], rcx
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x180009850
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
mov ebp, 0xfffd
nop word [rax + rax]
movzx ecx, word [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp ax, 9
ja 0x180009933
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x180009933
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x180009951
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x180009923
cmp word [rax], 0x5c
jne 0x18000991c
lea rdx, [rax + 2]
cmp rdx, rcx
je 0x18000991c
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x180009907
movzx ecx, word [rdx]
sub cx, 0x28
cmp cx, 1
jbe 0x180009919
test r8b, 0x10
jne 0x18000991c
movzx ecx, word [rdx]
sub cx, 0x7b
test bp, cx
jne 0x18000991c
mov rax, rdx
add rax, 2
mov qword [rbx], rax
mov rcx, rbx
call fcn.18000bce0
test edi, edi
jne 0x180009880
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
mov rcx, rbx
call fcn.18000ad40
int3

Function at 0x18000c230
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
movabs rax, 0xcbf29ce484222325
sar r8, 1
mov r9d, 0
add r8, r8
je 0x18000c274
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x18000c260
ret
Function at 0x18000ce90
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x30
mov r8d, dword [0x180017e3c]
mov esi, ecx
xor ecx, ecx
mov ebx, ecx
test r8d, r8d
je 0x18000ced7
mov rax, qword [0x180017e30]
add rax, 0x20
nop word [rax + rax]
movzx edx, byte [rax]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x18000cee4
inc ebx
add rax, 0x38
cmp ebx, r8d
jb 0x18000cec0
mov eax, ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
cmp ebx, 0xffffffff
je 0x18000ced7
test esi, esi
mov qword [rsp + 0x48], rdi
mov edx, 0xffffffff
setne cl
mov r8d, ecx
lea rcx, [rsp + 0x20]
call fcn.18000d380
mov edi, eax
test eax, eax
jne 0x18000cfcd
mov r9d, dword [0x180017e3c]
cmp ebx, r9d
jae 0x18000cf5c
nop dword [rax + rax]
mov ecx, ebx
imul rdx, rcx, 0x38
mov rcx, qword [0x180017e30]
movzx r8d, byte [rdx + rcx + 0x20]
shr r8d, 1
and r8d, 1
cmp r8d, esi
je 0x18000cf55
mov edx, esi
mov ecx, ebx
call fcn.18000d100
mov edi, eax
test eax, eax
jne 0x18000cf5c
mov r9d, dword [0x180017e3c]
inc ebx
cmp ebx, r9d
jb 0x18000cf20
cmp qword [rsp + 0x20], 0
je 0x18000cfcb
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x18000cfb7
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18000cfa8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x18000cf80
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1800177c0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
Function at 0x18000d100
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov eax, ecx
lea r9, [rsp + 0x30]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x180017e30]
mov r8, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [r8 - 5]
cmove rdi, r8
mov r8d, 0x40
lea rbp, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18000d164
mov eax, 0xa
jmp 0x18000d1f7
test esi, esi
je 0x18000d186
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x18000d1a9
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x18000d1a9
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x18000d1a2
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x18000d1a9
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx ecx, sil
shl sil, 2
add cl, cl
xor cl, byte [rbx + 0x20]
and cl, 2
xor cl, byte [rbx + 0x20]
xor sil, cl
and sil, 4
xor sil, cl
mov byte [rbx + 0x20], sil
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x18000d210
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180017240]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
xor esi, esi
xor edx, edx
lea ecx, [rsi + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x18000d35c
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x18000d353
mov esi, 1
mov qword [rsp + 0x68], rbx
cmp dword [rsp + 0x20], 0x10
jb 0x18000d30a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x18000d30a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x18000d30a
mov rdx, qword [rdi]
test rdx, rdx
jne 0x18000d2cb
mov dword [rdi + 8], 0x80
mov r8d, 0x200
mov rcx, qword [0x1800177c0]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi], rax
mov rdx, rax
test rax, rax
je 0x18000d332
lea rbx, [rdi + 0xc]
jmp 0x18000d2ff
mov eax, dword [rdi + 8]
lea rbx, [rdi + 0xc]
cmp dword [rbx], eax
jb 0x18000d2ff
add eax, eax
mov r8, rdx
mov r9d, eax
xor edx, edx
mov dword [rdi + 8], eax
mov rcx, qword [0x1800177c0]
shl r9, 2
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x18000d332
mov qword [rdi], rax
mov ecx, dword [rbx]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
inc dword [rbx]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rbp
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x18000d271
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x18000d34e
mov r8, qword [rdi]
xor esi, esi
test r8, r8
je 0x18000d34e
mov rcx, qword [0x1800177c0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rdi], rsi
mov rbx, qword [rsp + 0x68]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180010940
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x18000d380
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov ebp, r8d
mov qword [rcx], 0
mov r14d, edx
mov qword [rcx + 8], 0
mov rdi, rcx
call fcn.18000d210
test eax, eax
jne 0x18000d3c7
mov eax, 9
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rdi], 0
je 0x18000d43e
mov qword [rsp + 0x30], rbx
xor ebx, ebx
cmp dword [rdi + 0xc], ebx
jbe 0x18000d426
mov qword [rsp + 0x38], rsi
nop
mov r8, qword [rdi]
xor edx, edx
mov r8d, dword [r8 + rbx*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18000d41a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rsi
call fcn.18000d860
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [rdi + 0xc]
jb 0x18000d3e0
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rbp, qword [rsp + 0x40]
xor eax, eax
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x18000da10
Capabilities:
Resume thread

Disassembly:
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rdi, rcx
je 0x18000da7f
mov qword [rsp + 0x30], rbx
xor ebx, ebx
cmp dword [rcx + 0xc], ebx
jbe 0x18000da68
mov qword [rsp + 0x38], rsi
mov r8, qword [rdi]
xor edx, edx
mov r8d, dword [r8 + rbx*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18000da5c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [rdi + 0xc]
jb 0x18000da30
mov rsi, qword [rsp + 0x38]
mov r8, qword [rdi]
xor edx, edx
mov rcx, qword [0x1800177c0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18000db40
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
cmp rdi, 0x40000000
jbe 0x18000db80
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x180017e20]
lea r15, [rdi + 0x40000000]
cmp rcx, r15
cmovbe r15, rcx
sub r15, 0xfff
test rsi, rsi
je 0x18000dbbe
cmp rsi, r14
jb 0x18000dbb6
cmp rsi, r15
jae 0x18000dbb6
cmp qword [rsi + 8], 0
jne 0x18000dd87
mov rsi, qword [rsi]
test rsi, rsi
jne 0x18000dba1
mov qword [rsp + 0xa0], rbx
mov rbx, rdi
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0xb0], r12
mov r12d, 0x40
cmp rdi, r14
jb 0x18000dc52
nop dword [rax]
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x18000dc49
nop word [rax + rax]
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18000dc49
cmp dword [rsp + 0x70], 0x10000
je 0x18000dccb
mov rbx, qword [rsp + 0x58]
cmp rbx, rbp
jb 0x18000dc49
sub rbx, rbp
cmp rbx, r14
jae 0x18000dc10
test rsi, rsi
jne 0x18000dd30
cmp rdi, r15
ja 0x18000dd6f
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x18000dd6f
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18000dd6f
cmp dword [rsp + 0x70], 0x10000
je 0x18000dd01
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x68]
add rdi, qword [rsp + 0x50]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x18000dc82
jmp 0x18000dd6f
test rbx, rbx
je 0x18000dc49
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x18000dd30
cmp rbx, r14
jae 0x18000dbf0
jmp 0x18000dc52
test rdi, rdi
je 0x18000dd6f
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x18000dd30
cmp rdi, r15
jbe 0x18000dc60
jmp 0x18000dd6f
xor edx, edx
lea rcx, [rsi + 0x40]
mov dword [rsi + 0x10], edx
nop dword [rax]
mov qword [rcx], rdx
mov rax, rcx
mov qword [rsi + 8], rcx
add r12, 0x40
add rcx, 0x40
mov rdx, rax
cmp r12, 0xfc0
jbe 0x18000dd40
mov rax, qword [0x180017e20]
mov qword [rsi], rax
mov qword [0x180017e20], rsi
mov r12, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
mov rax, rsi
mov rsi, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140022d90]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140022da0]
mov dword [rax], 1
mov rax, qword [0x140022db0]
mov dword [rax], 1
mov rax, qword [0x140022d40]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140022d80]
mov dword [0x14002600c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x140022e60]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x140022e40]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x140022cf0]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x140001450
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
xor esi, esi
movsxd rax, dword [rcx + 0x3c]
mov edi, dword [rcx + rax + 0x88]
add rdi, rcx
mov rbx, rcx
mov rbp, rdx
mov r12d, dword [rdi + 0x20]
mov r13d, dword [rdi + 0x18]
add r12, rcx
cmp esi, r13d
jae 0x1400014bc
mov edx, dword [r12 + rsi*4]
mov rcx, rbp
add rdx, rbx
call sym.strcmp
mov edx, eax
lea rax, [rsi + 1]
test edx, edx
jne 0x1400014b7
mov eax, dword [rdi + 0x24]
add rsi, rsi
add rsi, rbx
movzx edx, word [rsi + rax]
mov eax, dword [rdi + 0x1c]
lea rdx, [rbx + rdx*4]
mov eax, dword [rdx + rax]
add rax, rbx
jmp 0x1400014be
mov rsi, rax
jmp 0x14000147d
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x1400014cb
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
mov dword [rsp + 0x78], edx
mov rbx, rcx
mov rsi, r8
mov edi, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x38]
mov r9d, 0x18
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140001509
or eax, 0xffffffff
jmp 0x1400015ba
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140001501
xor r9d, r9d
mov rcx, qword [rsp + 0x40]
mov r8d, edi
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140001501
lea rax, [rsp + 0x48]
xor r9d, r9d
mov r8, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov edx, 0x6610
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x140001501
lea rax, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140001501
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
xor eax, eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret

Function at 0x1400018a0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]
Function at 0x140001910
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400260a4]
mov rbx, rcx
test esi, esi
jle 0x140001a40
mov rax, qword [0x1400260a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14000195b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x1400019e5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140001940
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
mov rdi, rax
test rax, rax
je 0x140001a62
mov rax, qword [0x1400260a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call dbg._GetPEImageBase
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400260a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140001a47
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400019de
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1400019f0
add dword [0x1400260a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1400260a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400019de
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop dword [rax]
xor esi, esi
jmp 0x140001968
mov rax, qword [0x1400260a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140001fd0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140026100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400260e0]
test rbx, rbx
je 0x14000202c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140002023
test rsi, rsi
je 0x140002023
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140002008
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140002240
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140002258
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140002260
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret