joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008eed0
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov eax, 0x4448
call fcn.140091330
sub rsp, rax
lea rdx, [0x140178ca8]
lea rcx, [rsp + 0x40]
call fcn.14006cc50
mov rsi, qword [0x140181578]
movsxd rdi, dword [0x140181584]
mov rbx, qword [rsp + 0x48]
xor r14d, r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, [0x1400c67c0]
nop word [rax + rax]
mov edx, dword [rcx + r14*4 + 0x10]
cmp edx, eax
je 0x14008ef67
mov edx, dword [rcx + r14*4 + 0x14]
cmp edx, eax
je 0x14008ef58
mov edx, dword [rcx + r14*4 + 0x18]
cmp edx, eax
je 0x14008ef5d
mov edx, dword [rcx + r14*4 + 0x1c]
cmp edx, eax
je 0x14008ef63
add r14, 4
cmp r14, 0x80
jne 0x14008ef20
mov eax, 0xffffffff
jmp 0x14008ef6a
inc r14
jmp 0x14008ef67
add r14, 2
jmp 0x14008ef67
add r14, 3
mov eax, r14d
lea rdx, [rdi + rbx]
add rbx, rdi
inc rbx
shl rax, 4
mov r8, qword [rax + rcx + 0x210]
mov r9, qword [rax + rcx + 0x218]
lea r14, [r8 + r9]
add rdx, r9
inc rdx
mov qword [rax + rcx + 0x218], rdx
movzx eax, byte [0x14017d0bd]
mov byte [r8 + r9], al
lea rcx, [r8 + r9 + 1]
mov rdx, qword [rsp + 0x40]
mov r15, qword [rsp + 0x48]
mov r8, r15
call fcn.140091e40
lea rcx, [r15 + r14]
inc rcx
mov rdx, rsi
mov r8, rdi
call fcn.140091e40
mov rcx, rbx
mov rdx, r14
call fcn.1400069a0
vmovq r14, xmm0
cmp r14, qword [0x14017d0b0]
jne 0x14008eff6
movzx eax, byte [0x14017d0c2]
test al, al
je 0x14008f103
mov byte [0x14017d0c2], 0
mov dword [0x14017d0b8], 0
mov byte [0x14017d0bf], 0
nop
movzx eax, byte [0x14017d0c0]
test al, al
je 0x14008f01f
pause
jmp 0x14008f010
mov byte [0x14017d0c1], 0
mov rax, qword [0x140178b20]
movsxd r15, dword [0x140178b2c]
shl r15, 4
add r15, rax
mov r12, qword [0x140178b20]
cmp r12, r15
jae 0x14008f0a2
lea rsi, [rsp + 0x40]
lea rdi, [rsp + 0x30]
lea rbx, [0x140178ca8]
nop dword [rax + rax]
vmovdqu xmm0, xmmword [r12]
vmovdqa xmmword [rsp + 0x30], xmm0
mov rcx, rsi
mov rdx, rdi
call fcn.14006acc0
mov rcx, rbx
mov rdx, rsi
call fcn.14006afe0
test al, al
jne 0x14008f091
add r12, 0x10
cmp r12, r15
jb 0x14008f060
jmp 0x14008f0a2
mov word [rsp + 0x4440], 0
mov byte [0x14017d0c1], 1
mov byte [0x14017d0bf], 1
vmovdqu xmm0, xmmword [0x1400a89f0]
vmovdqa xmmword [rsp + 0x40], xmm0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x140071380]
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x14008f0f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [0x14017d0b0], r14
mov byte [0x14017d0be], 1
add rsp, 0x4448
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x14009d0fc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14009ceec
Function at 0x1400a139c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400a13cc
xor eax, eax
jmp 0x1400a148f
mov rbp, rbx
cmp word [rax], si
je 0x1400a13f1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400a13d8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400a13d4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400a12ec
movsxd r14, eax
test eax, eax
jne 0x1400a142f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400a13c5
mov rcx, r14
call fcn.14009f5d0
mov rdi, rax
test rax, rax
jne 0x1400a1448
xor ecx, ecx
call fcn.14009f630
jmp 0x1400a1424
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400a12ec
test eax, eax
jne 0x1400a1479
mov rcx, rdi
call fcn.14009f630
jmp 0x1400a1483
xor ecx, ecx
call fcn.14009f630
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00409940]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x00409950]
mov dword [rax], 1
mov rax, qword [0x00409960]
mov dword [rax], 1
mov rax, qword [0x00409930]
mov dword [rax], 1
mov rax, qword [0x00409810]
cmp word [rax], 0x5a4d
je 0x4010b0
mov rax, qword [0x00409920]
mov dword [0x0040c008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010a0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x004098e0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x004097a0]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401103
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058

Function at 0x401593
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
call sym.__main
mov ecx, 0xa
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov byte [rbp - 1], 8
movsx eax, byte [rbp - 1]
mov ecx, eax
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
cmp ax, 0x8001
sete al
test al, al
je 0x4015de
movsx eax, byte [rbp - 1]
lea rdx, str.log.txt
mov ecx, eax
call sym.Save_int__char_
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x4015b2
Function at 0x401d60
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x0040c624]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x401ee8
mov rax, qword [0x0040c628]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x401dac
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x401e35
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x401d90
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x401f1d
mov rax, qword [0x0040c628]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x0040c628]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x401f00
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x401e2e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x401e90
add dword [0x0040c624], 1
cmp edi, 8
jae 0x401e63
test dil, 4
jne 0x401ed4
test edi, edi
je 0x401e58
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x401eef
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x401e58
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x401e7c
jmp 0x401e58
add rsi, qword [0x0040c628]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x401e2e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x401e58
xor esi, esi
jmp 0x401db7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x401e58
mov rax, qword [0x0040c628]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x402670
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0040c900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0040c8e0]
test rbx, rbx
je 0x4026c4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x4026bb
test rsi, rsi
je 0x4026bb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4026a0
lea rcx, [0x0040c900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x402900
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x402910
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x402920
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x402961
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x402958
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x402963
add rax, 0x28
cmp rax, r9
jne 0x402944
xor eax, eax
ret

Function at 0x402a00
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00409810]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x402a6d
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402a6d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x402a6d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x402a64
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x402a6f
add rax, 0x28
cmp rax, r9
jne 0x402a50
xor eax, eax
add rsp, 0x28
ret

Function at 0x402b70
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00409810]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x402b90
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402b88
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x402bed
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x402be4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x402bf4
add rax, 0x28
cmp rax, r9
jne 0x402bd0
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x402c10
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x00409810]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x402c7e
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402c7e
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x402c7e
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x402c7e
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x402c75
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x402c85
add rcx, 0x28
cmp rcx, rax
jne 0x402c60
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x402c98
jmp 0x402c7e
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x402ca6
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x402c7e
test r9d, r9d
jg 0x402c90
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x407b70
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x10007510
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xa0
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x10015150], rbx
je 0x10007566
cmp rax, rbx
jne 0x10007559
mov edi, 1
jmp 0x10007566
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10007540
mov eax, dword [0x10015148]
cmp eax, 1
jne 0x1000757b
lea ecx, [rax + 0x1e]
call sub.MSVCR80.dll__amsg_exit
jmp 0x100075ba
mov eax, dword [0x10015148]
test eax, eax
jne 0x100075b0
mov dword [0x10015148], 1
lea rdx, [0x100014d0]
lea rcx, [0x100014b8]
call sub.MSVCR80.dll__initterm_e
test eax, eax
je 0x100075ba
mov eax, 0xff
jmp 0x10007714
mov dword [0x10014314], 1
mov eax, dword [0x10015148]
cmp eax, 1
jne 0x100075e2
lea rdx, [0x100014b0]
lea rcx, [0x10001470]
call sub.MSVCR80.dll__initterm
mov dword [0x10015148], 2
test edi, edi
jne 0x100075ef
xor eax, eax
xchg qword [0x10015150], rax
cmp qword [0x10015168], 0
je 0x10007618
lea rcx, [0x10015168]
call fcn.10007b90
test eax, eax
je 0x10007618
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x10015168]
mov rax, qword [sym.imp.MSVCR80.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
nop
nop
movzx ecx, byte [rbx]
cmp cl, 0x20
ja 0x100076aa
test cl, cl
je 0x10007640
test edi, edi
jne 0x100076aa
movzx eax, byte [rbx]
test al, al
je 0x10007656
cmp al, 0x20
ja 0x10007656
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x10007640
test byte [rsp + 0x6c], 1
je 0x10007665
movzx r9d, word [rsp + 0x70]
jmp 0x1000766b
mov r9d, 0xa
mov r8, rbx
xor edx, edx
lea rcx, [0x10000000]
call fcn.10005300
mov dword [0x10014310], eax
cmp dword [0x100142f4], 0
jne 0x10007693
mov ecx, eax
call qword [sym.imp.MSVCR80.dll_exit]
cmp dword [0x10014314], 0
jne 0x100076a8
call qword [sym.imp.MSVCR80.dll__cexit]
mov eax, dword [0x10014310]
jmp 0x1000770d
cmp cl, 0x22
jne 0x100076bc
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
movzx ecx, cl
call qword [sym.imp.MSVCR80.dll__ismbblead]
test eax, eax
je 0x100076d2
add rbx, 1
mov qword [rsp + 0x28], rbx
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x10007630
jmp 0x10007714
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
sub rsp, 0x28
call fcn.10139000
add rsp, 0x28
jmp 0x10007510
Function at 0x401530
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x80]
call fcn.004021b0
lea rax, str.Si_presionas_aceptar__te_arrepentiras...
mov qword [rbp - 0x48], rax
lea rax, str.__________________________________________
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x54], 0x40
mov ecx, dword [rbp - 0x54]
mov rdx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
mov r9d, ecx
mov r8, rdx
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
mov dword [rbp - 0x58], eax
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov ecx, eax
call sub.msvcrt.dll_srand
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_GetSystemMetrics]
call rax
sub eax, 1
mov dword [rbp - 0x5c], eax
mov ecx, 1
mov rax, qword [sym.imp.USER32.dll_GetSystemMetrics]
call rax
sub eax, 1
mov dword [rbp - 0x60], eax
jmp 0x4015ff
call sub.msvcrt.dll_rand
cdq
idiv dword [rbp - 0x60]
mov eax, edx
lea ebx, [rax + 1]
call sub.msvcrt.dll_rand
cdq
idiv dword [rbp - 0x5c]
mov eax, edx
add eax, 1
mov edx, ebx
mov ecx, eax
mov rax, qword [sym.imp.USER32.dll_SetCursorPos]
call rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov ecx, 0x77
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
test ax, ax
sete al
test al, al
jne 0x4015c8
mov eax, 0
add rsp, 0x48
pop rbx
pop rbp
ret
Function at 0x401830
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x00407054]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x40194a
mov rax, qword [0x00407058]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x40187e
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x401930
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x401862
mov rcx, rbx
call fcn.00402670
test rax, rax
mov r12, rax
je 0x401982
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x00407058]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call fcn.00402790
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x00407058]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x401965
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x401929
sub eax, 0x40
and eax, 0xffffffbf
je 0x401929
mov r9, rbp
add r9, qword [0x00407058]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x401951
add dword [0x00407054], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.msvcrt.dll_memcpy
xor ebp, ebp
jmp 0x40188b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.004017c0
mov rax, qword [0x00407058]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbp + 8]
call fcn.004017c0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.004017c0
nop
nop word cs:[rax + rax]

Function at 0x402580
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x4025c1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x4025b8
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x4025c3
add rax, 0x28
cmp rax, r9
jne 0x4025a4
xor eax, eax
repz ret

Function at 0x402670
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x00404360]
cmp word [rbx], 0x5a4d
je 0x402690
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, rcx
mov rcx, rbx
call fcn.00402540
test eax, eax
je 0x402684
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.00402580
Function at 0x4028e0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004079c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004079a0]
test rbx, rbx
je 0x402934
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x40292b
test rsi, rsi
je 0x40292b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x402910
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x004079c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
Function at 0x18001ad90
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
test rax, rax
je 0x18001adc6
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x18001add6
lea rax, str.The_number_of_hardware_threads_is_not_known_for_the_target_platform
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x50
pop rsi
ret
Function at 0x18001c280
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 0
mov qword [rbp + 0x3d0], 2
mov qword [rbp + 0x3d8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor ebx, ebx
xor edi, edi
xor r12d, r12d
cmp r8, 0x201
jae 0x18001c320
jmp 0x18001c30f
jae 0x18001c3e0
cmp r8, 0x201
jae 0x18001c320
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x18001c378
sub r8, r12
sub rdi, r12
cmp rdi, r8
jae 0x18001c34f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.180080670
mov rbx, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp rbx, rax
mov r12d, 0xffffffff
cmovb r12, rbx
mov qword [rbp + 0x3d8], r12
mov rdi, rbx
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x18001c3a1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18001c448
mov r8d, r14d
cmp r15, r8
jne 0x18001c300
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x18001c475
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x18001c30f
jmp 0x18001c320
cmp rsi, r8
jb 0x18001c48f
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call sym.rt_dll.dll___std::ffi::os_str::OsString_as_std::os::windows::ffi::OsStringExt_::from_wide::h79c8d52da8dd9416
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rbx, rbx
je 0x18001c431
add rbx, rbx
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rbx
call sym.rt_dll.dll___rust_dealloc
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
test rbx, rbx
jne 0x18001c419
jmp 0x18001c431
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syspalwindowsmod.rs
mov edx, 0x28
call sym.rt_dll.dll_core::panicking::panic::hc78b6d0617c02f64
jmp 0x18001c4a4
lea rax, str.library_std_src_syspalwindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call sym.rt_dll.dll_core::slice::index::slice_end_index_len_fail::hb4e1554cec1567f2
ud2
Function at 0x18001c500
Capabilities:
Query environment variable

Disassembly:
push rbp
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 8], 0xfffffffffffffffe
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x18001c526
mov rdx, rax
add rsp, 0x70
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x20], rax
lea rax, [sym.rt_dll.dll___std::io::error::Error_as_core::fmt::Display_::fmt::h1016179516289660]
mov qword [rbp - 0x18], rax
lea rax, str.failure_getting_env_string_from_OS:
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
mov qword [rbp - 0x30], 0
lea rax, [rbp - 0x20]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
lea rdx, str.library_std_src_syspalwindowsos.rs
lea rcx, [rbp - 0x50]
call sym.rt_dll.dll_core::panicking::panic_fmt::h66fb88c8a7d9ff95
ud2