joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011b120
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
cmp r9d, 8
jge 0x14011b171
movzx r10d, dx
sub r8d, r10d
movzx eax, r8w
xor edx, edx
test r9d, r9d
jle 0x14011b39b
movsxd r8, edx
movzx r8d, word [rcx + r8*2]
sub r8d, r10d
movzx r8d, r8w
cmp r8d, eax
jle 0x14011b165
inc edx
cmp edx, r9d
jl 0x14011b145
jmp 0x14011b39b
mov eax, edx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
movzx r10d, dx
movd xmm0, r10d
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
mov eax, r8d
sub eax, r10d
movzx eax, ax
movd xmm1, eax
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
mov rax, rcx
add r9d, 0xfffffff8
mov edx, r9d
add rdx, rdx
lea r8, [rax + rdx]
movups xmm2, xmmword [0x1401bf790]
movaps xmm3, xmm1
psubw xmm3, xmm2
movups xmm4, xmmword [rax]
psubw xmm4, xmm0
movaps xmm5, xmm4
psubw xmm5, xmm2
movaps xmm6, xmm3
pcmpgtw xmm6, xmm5
pcmpeqw xmm4, xmm1
por xmm4, xmm6
movaps xmmword [rsp + 0x20], xmm4
xorps xmm5, xmm5
pcmpeqw xmm4, xmm5
pmovmskb r10d, xmm4
cmp r10d, 0xffff
jne 0x14011b2db
add rax, 0x10
cmp rax, r8
jb 0x14011b1b8
movups xmm4, xmmword [r8]
psubw xmm4, xmm0
movaps xmm0, xmm4
psubw xmm0, xmm2
pcmpgtw xmm3, xmm0
pcmpeqw xmm1, xmm4
por xmm1, xmm3
movaps xmmword [rsp + 0x20], xmm1
xorps xmm0, xmm0
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x14011b39b
mov rax, qword [rsp + 0x20]
mov qword [rsp + 8], rax
movzx eax, word [rsp + 8]
shr eax, 0xf
movzx ecx, word [rsp + 0xa]
shr ecx, 0xf
add ecx, ecx
or eax, ecx
movzx ecx, word [rsp + 0xc]
shr ecx, 0xf
shl ecx, 2
or ecx, eax
mov eax, ecx
movzx ecx, word [rsp + 0xe]
shr ecx, 0xf
shl ecx, 3
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x28]
mov qword [rsp], rcx
movzx ecx, word [rsp]
shr ecx, 0xf
movzx r8d, word [rsp + 2]
shr r8d, 0xf
add r8d, r8d
or ecx, r8d
movzx r8d, word [rsp + 4]
shr r8d, 0xf
shl r8d, 2
or r8d, ecx
mov ecx, r8d
movzx r8d, word [rsp + 6]
shr r8d, 0xf
shl r8d, 3
or r8d, ecx
mov ecx, r8d
shl ecx, 4
or eax, ecx
bsf ecx, eax
mov r8d, 0x20
test eax, eax
cmove ecx, r8d
mov eax, ecx
shr rdx, 1
add eax, edx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x18], rdx
movzx edx, word [rsp + 0x18]
shr edx, 0xf
movzx r8d, word [rsp + 0x1a]
shr r8d, 0xf
add r8d, r8d
or edx, r8d
movzx r8d, word [rsp + 0x1c]
shr r8d, 0xf
shl r8d, 2
or r8d, edx
mov edx, r8d
movzx r8d, word [rsp + 0x1e]
shr r8d, 0xf
shl r8d, 3
or r8d, edx
mov edx, r8d
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x10], r8
movzx r8d, word [rsp + 0x10]
shr r8d, 0xf
movzx r10d, word [rsp + 0x12]
shr r10d, 0xf
add r10d, r10d
or r8d, r10d
movzx r10d, word [rsp + 0x14]
shr r10d, 0xf
shl r10d, 2
or r10d, r8d
mov r8d, r10d
movzx r10d, word [rsp + 0x16]
shr r10d, 0xf
shl r10d, 3
or r10d, r8d
mov r8d, r10d
shl r8d, 4
or edx, r8d
bsf r8d, edx
mov r10d, 0x20
test edx, edx
cmove r8d, r10d
sub rax, rcx
shr rax, 1
add eax, r8d
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
mov eax, 0xffffffff
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x1400035a0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x18], 8
mov rbx, rcx
jb 0x1400035b7
mov rcx, qword [rcx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
sete dil
test dil, dil
jne 0x1400035f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1400035f3
cmp qword [rbx + 0x18], 8
jb 0x1400035de
mov rbx, qword [rbx]
mov rcx, rbx
call fcn.1400028f0
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, dil
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140003610
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x290
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x2a8], rbx
mov rax, qword [0x14004e748]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call fcn.14001b4d0
lea rdx, [rsp + 0x70]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x140003710
mov qword [rsp + 0x40], 7
xor edi, edi
mov qword [rsp + 0x38], rdi
mov word [rsp + 0x28], di
cmp word [rsp + 0x70], di
jne 0x14000368a
mov r8d, edi
jmp 0x14000369d
lea rax, [rsp + 0x70]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], di
jne 0x140003693
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x28]
call fcn.140001750
nop
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x48]
call fcn.140002c20
nop
cmp rbx, rax
je 0x1400036d5
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call fcn.140001bb0
nop
cmp qword [rsp + 0x60], 8
jb 0x1400036e7
mov rcx, qword [rsp + 0x48]
call fcn.140018320
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rdi
mov word [rsp + 0x48], di
cmp qword [rsp + 0x40], 8
jb 0x14000370c
mov rcx, qword [rsp + 0x28]
call fcn.140018320
mov al, 1
jmp 0x140003712
xor al, al
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140017c70
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x290
pop rdi
ret
Function at 0x140003740
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [r11 - 0x40], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x14004e748]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rcx
mov qword [r11 - 0x48], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbp
mov word [rsp + 0x50], bp
test eax, eax
je 0x140003811
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rbp
lea ebx, [rax + 1]
mov edx, ebx
lea r8, [0x140041480]
lea rcx, [rsp + 0x28]
call fcn.1400043a0
nop
mov rsi, qword [rsp + 0x28]
mov rdx, rsi
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
cmp word [rsi], bp
jne 0x1400037e5
mov r8d, ebp
jmp 0x1400037fb
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rsi + r8*2], 0
jne 0x1400037f0
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140001750
nop
mov rcx, rsi
call fcn.140018320
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbp
mov word [rdi], bp
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.140001bb0
nop
mov rax, qword [rdi + 0x10]
cmp rax, 1
jbe 0x14000389f
mov rcx, qword [rdi + 0x18]
cmp rcx, 8
jb 0x14000384e
mov rdx, qword [rdi]
jmp 0x140003851
mov rdx, rdi
cmp word [rdx + rax*2 - 2], 0x2f
je 0x14000386f
cmp rcx, 8
jb 0x140003864
mov rdx, qword [rdi]
jmp 0x140003867
mov rdx, rdi
cmp word [rdx + rax*2 - 2], 0x5c
jne 0x14000389f
lea rdx, [rax - 1]
cmp rdx, rax
ja 0x140003890
mov qword [rdi + 0x10], rdx
cmp rcx, 8
jb 0x140003887
mov rax, qword [rdi]
jmp 0x14000388a
mov rax, rdi
mov word [rax + rdx*2], bp
jmp 0x14000389f
xor r8d, r8d
sub rdx, rax
mov rcx, rdi
call fcn.1400044e0
nop
cmp qword [rsp + 0x68], 8
jb 0x1400038b1
mov rcx, qword [rsp + 0x50]
call fcn.140018320
mov rax, rdi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140017c70
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140005c60
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x14004e748]
xor rax, rsp
mov qword [rsp + 0x250], rax
lea rax, [rsp + 0x30]
mov rbx, r8
mov esi, ecx
mov edx, ecx
xor ebp, ebp
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
xor dil, dil
mov qword [rsp + 0x30], rbp
call qword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
js 0x140005d07
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x140005cfa
cmp word [rsp + 0x40], bp
jne 0x140005cce
mov r8d, ebp
jmp 0x140005cea
lea rax, [rsp + 0x40]
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], bp
jne 0x140005ce0
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140001750
mov dil, 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x140005d5a
lea rax, [rsp + 0x40]
mov r9d, 1
xor r8d, r8d
mov edx, esi
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x140005d5a
cmp word [rsp + 0x40], bp
jne 0x140005d34
mov r8, rbp
jmp 0x140005d4a
lea rax, [rsp + 0x40]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], bp
jne 0x140005d40
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140001750
mov dil, 1
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140005da7
mov rcx, qword [rbx + 0x18]
cmp rcx, 8
jb 0x140005d72
mov rdx, qword [rbx]
jmp 0x140005d75
mov rdx, rbx
cmp word [rdx + rax*2 - 2], 0x5c
jne 0x140005da7
lea rdx, [rax - 1]
cmp rdx, rax
ja 0x140005d99
mov qword [rbx + 0x10], rdx
cmp rcx, 8
jb 0x140005d93
mov rbx, qword [rbx]
mov word [rbx + rdx*2], bp
jmp 0x140005da7
xor r8d, r8d
sub rdx, rax
mov rcx, rbx
call fcn.1400044e0
movzx eax, dil
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140017c70
mov rbx, qword [rsp + 0x288]
add rsp, 0x260
pop rdi
pop rsi
pop rbp
ret
Function at 0x140009000
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push r14
sub rsp, 0x270
mov rax, qword [0x14004e748]
xor rax, rsp
mov qword [rsp + 0x260], rax
cmp byte [rcx + 0x28], 0
mov qword [rsp + 0x290], rsi
mov r14, rdx
mov rsi, rcx
je 0x140009126
cmp byte [rcx + 0x29], 0
jne 0x140009126
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsi + 0x18], 0x104
mov qword [rsi], 0xffffffffffffffff
jae 0x140009122
cmp qword [rsi + 0x20], 8
mov qword [rsp + 0x298], rdi
lea rdi, [rsi + 8]
jb 0x140009073
mov rcx, qword [rdi]
jmp 0x140009076
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathIsFileSpecW]
test eax, eax
jne 0x1400090c5
cmp qword [rdi + 0x18], 8
jb 0x14000908c
mov r8, qword [rdi]
jmp 0x14000908f
mov r8, rdi
lea rcx, [rsp + 0x50]
mov edx, 0x104
call fcn.140019940
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400090c5
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectory]
cmp qword [rdi + 0x18], 8
jb 0x1400090cf
mov rdi, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov edx, 0x40000000
lea r8d, [r9 + 3]
mov rcx, rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, qword [rsp + 0x298]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
je 0x140009122
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov byte [rsi + 0x29], 1
mov rcx, qword [rsi]
mov rsi, qword [rsp + 0x290]
cmp rcx, 0xffffffffffffffff
je 0x14000916f
cmp qword [r14 + 0x18], 0x10
mov rax, qword [r14 + 0x10]
mov dword [rsp + 0x40], 0
jb 0x14000914d
mov r14, qword [r14]
lea r9, [rsp + 0x40]
mov r8d, eax
mov rdx, r14
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete al
jmp 0x140009171
xor al, al
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140017c70
add rsp, 0x270
pop r14
ret

Function at 0x140010850
Capabilities:
Print debug messages

Disassembly:
test rcx, rcx
je 0x1400108b8
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x140010889
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Log_compression_disabled_for_debug_builds
mov qword [rbx], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp qword [rbx + 0x20], 8
jb 0x140010899
mov rcx, qword [rbx + 8]
call fcn.140018320
xor eax, eax
mov qword [rbx + 0x20], 7
mov rcx, rbx
mov qword [rbx + 0x18], rax
mov word [rbx + 8], ax
call fcn.140018320
add rsp, 0x20
pop rbx
repz ret
Function at 0x140010b60
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [rsp + 0x20]
mov rdx, rax
mov rdi, rax
call fcn.1400116d0
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14002d470
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
jne 0x14002d49c
call fcn.14001a1cc
mov dword [rax], 0x16
call fcn.14001f6a8
jmp 0x14002d5a2
mov eax, dword [rcx + 0x18]
test al, 0x83
je 0x14002d5a2
test al, 0x40
jne 0x14002d5a2
test al, 2
je 0x14002d4be
or eax, 0x20
mov dword [rcx + 0x18], eax
jmp 0x14002d5a2
or eax, 1
mov dword [rcx + 0x18], eax
test eax, 0x10c
jne 0x14002d4d2
call fcn.140029700
jmp 0x14002d4d9
mov rax, qword [rcx + 0x10]
mov qword [rcx], rax
mov rcx, rdi
call fcn.140025384
mov r8d, dword [rdi + 0x24]
mov rdx, qword [rdi + 0x10]
mov ecx, eax
call fcn.14002601c
mov dword [rdi + 8], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x14002d591
test byte [rdi + 0x18], 0x82
jne 0x14002d55f
mov rcx, rdi
call fcn.140025384
cmp eax, 0xffffffff
je 0x14002d54a
mov rcx, rdi
call fcn.140025384
cmp eax, 0xfffffffe
je 0x14002d54a
mov rcx, rdi
call fcn.140025384
mov rcx, rdi
lea rsi, [0x140051ea0]
movsxd rbx, eax
sar rbx, 5
call fcn.140025384
and eax, 0x1f
imul rax, rax, 0x58
add rax, qword [rsi + rbx*8]
jmp 0x14002d551
lea rax, [0x14004e780]
mov al, byte [rax + 8]
and al, 0x82
cmp al, 0x82
jne 0x14002d55f
bts dword [rdi + 0x18], 0xd
cmp dword [rdi + 0x24], 0x200
jne 0x14002d57e
test byte [rdi + 0x18], 8
je 0x14002d57e
test dword [rdi + 0x18], 0x400
jne 0x14002d57e
mov dword [rdi + 0x24], 0x1000
mov rcx, qword [rdi]
add dword [rdi + 8], 0xfffffffe
movzx eax, word [rcx]
add rcx, 2
mov qword [rdi], rcx
jmp 0x14002d5a7
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [rdi + 0x18], eax
and dword [rdi + 8], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140002c50
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140004720
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140004720
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140002cc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14000a0a4]
mov rbx, rcx
test esi, esi
jle 0x140002df0
mov rax, qword [0x14000a0a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140002d0b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140002d95
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140002cf0
mov rcx, rbx
call fcn.140003710
mov rdi, rax
test rax, rax
je 0x140002e12
mov rax, qword [0x14000a0a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140003850
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000a0a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140002df7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140002d8e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140002da0
add dword [0x14000a0a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000a0a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140002d8e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140002c50
nop dword [rax]
xor esi, esi
jmp 0x140002d18
mov rax, qword [0x14000a0a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140002c50
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140002c50
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140003380
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14000a100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000a0e0]
test rbx, rbx
je 0x1400033dc
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x1400033d3
test rsi, rsi
je 0x1400033d3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400033b8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140001550
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r14d, r9d
mov r15, r8
mov rbp, rdx
mov rdi, rcx
mov ecx, dword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x20], 0x40
xor ebx, ebx
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8, rbp
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
je 0x140001623
mov rsi, rax
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffffffffffff
mov rdx, rsi
mov r8, rdi
mov r9, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140001621
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea r9, [0x140001540]
xor ebx, ebx
mov rcx, 0xffffffffffffffff
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [r15], rax
test rax, rax
je 0x140001623
test r14d, r14d
je 0x14000161c
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rbx, rsi
jmp 0x140001623
xor ebx, ebx
mov rax, rbx
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1404d9c00
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
ret
Function at 0x1404da7d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r15, rdx
mov r12, rcx
movsxd r13, dword [rcx + 0x3c]
mov ebx, dword [rcx + r13 + 0x54]
mov r8, rbx
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x1404da83a
lea r9, [rsp + 0x20]
mov rcx, r15
mov rdx, rbx
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1404da83a
mov rcx, r15
mov rdx, r12
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rcx, r15
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx eax, word [r12 + r13 + 6]
test ax, ax
je 0x1404da8dc
movsxd rcx, dword [r12 + 0x3c]
lea rbp, [rcx + r12]
add rbp, 0x110
xor r14d, r14d
jmp 0x1404da876
movzx eax, word [r12 + r13 + 6]
add r14, 1
movzx ecx, ax
add rbp, 0x28
cmp r14, rcx
jae 0x1404da8dc
cmp dword [rbp + 0x1c], 0
js 0x1404da866
mov ebx, dword [rbp]
mov esi, dword [rbp + 4]
lea rdi, [r12 + rsi]
add rsi, r15
mov rcx, rdi
mov rdx, rsi
mov r8, rbx
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x1404da860
mov rcx, rsi
mov rdx, rbx
mov r8d, 0x40
lea r9, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1404da860
mov rcx, rsi
mov rdx, rdi
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov r8d, dword [rsp + 0x24]
mov rcx, rsi
mov rdx, rbx
lea r9, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1404da860
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1404da960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
test rcx, rcx
je 0x1404dab3a
mov rsi, rdx
mov rbx, rcx
movsxd rax, dword [rcx + 0x3c]
mov edi, dword [rax + rcx + 0x88]
mov r13d, dword [rdi + rcx + 0x1c]
add r13, rcx
test esi, 0xffff0000
je 0x1404da9f6
mov ebp, dword [rbx + rdi + 0x18]
test ebp, ebp
je 0x1404dab3a
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r8
mov r14d, dword [rbx + rdi + 0x20]
mov r15d, dword [rbx + rdi + 0x24]
add r14, rbx
add r15, rbx
xor r12d, r12d
nop word cs:[rax + rax]
nop dword [rax]
mov ecx, dword [r14]
add rcx, rbx
mov rdx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1404daa0a
add ebp, 0xffffffff
add r14, 4
add r15, 2
test ebp, ebp
jne 0x1404da9d0
jmp 0x1404dab42
movzx eax, si
mov ecx, dword [rbx + rdi + 0x10]
sub rax, rcx
mov r12d, dword [r13 + rax*4]
jmp 0x1404dab3f
movzx eax, word [r15]
mov r12d, dword [r13 + rax*4]
cmp edi, r12d
ja 0x1404dab3f
mov rax, qword [rsp + 0x38]
add edi, dword [rbx + rax + 0x8c]
cmp r12d, edi
jae 0x1404dab3f
add r12, rbx
mov rcx, r12
mov edx, 0x2e
call sub.msvcrt.dll_strchr
mov r14, rax
add r14, 1
mov rsi, r14
sub rsi, r12
lea rcx, [rsi + 4]
mov edx, 2
call sub.msvcrt.dll_calloc
test rax, rax
je 0x1404dab3a
mov rbx, rax
lea r8, [rsi + 1]
mov qword [rsp + 0x20], rsi
xor ecx, ecx
mov rdx, rax
mov r9, r12
call qword [sym.imp.msvcrt.dll_mbstowcs_s]
mov eax, dword [0x1404dd014]
mov dword [rbx + rsi*2], eax
movzx eax, word [0x1404dd018]
mov word [rbx + rsi*2 + 4], ax
lea rdx, str.api_
mov r8d, 4
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
je 0x1404daac8
lea rdx, str.ext_
mov r8d, 4
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
jne 0x1404dab16
lea r8, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
mov rdx, rbx
call fcn.1404d9c20
test rax, rax
je 0x1404dab16
mov rsi, rax
mov rcx, rbx
call sub.msvcrt.dll_free
mov rdi, qword [rsp + 0x40]
lea rcx, [rdi + 1]
mov edx, 2
call sub.msvcrt.dll_calloc
test rax, rax
je 0x1404dab3a
mov rbx, rax
add rdi, rdi
mov rcx, rax
mov rdx, rsi
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov rdx, r14
mov r8, rbx
call fcn.1404da960
mov r12, rax
mov rcx, rbx
call sub.msvcrt.dll_free
jmp 0x1404dab42
xor r12d, r12d
jmp 0x1404dab42
add r12, rbx
mov rax, r12
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1404daea0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1404dbdb0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.1404dbdb0
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]