joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401b10
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
call dbg.__main
lea rax, [rbp - 0x10]
mov rcx, rax
call sym.inicializarLista
lea rcx, str._n_____________________________________
call sym.puts
lea rcx, str._n_tMENU_DE_OPCIONES_n
call sym.puts
lea rcx, str._t_1._Insertar_libro_n
call sym.puts
lea rcx, str._t_2._Buscar_libro_n
call sym.puts
lea rcx, str._t_3._Borrar_libro_n
call sym.puts
lea rcx, str._t_4._Salir_n
call sym.puts
lea rcx, str._t_Ingresa_una_opcion_por_favor:
call sym.puts
lea rcx, str._n_____________________________________
call sym.puts
lea rax, [rbp - 0x14]
mov rdx, rax
lea rcx, [0x00405013]
call sym.scanf
mov eax, dword [rbp - 0x14]
cmp eax, 2
je 0x401be3
cmp eax, 2
jg 0x401bb3
cmp eax, 1
je 0x401bc6
jmp 0x401d3f
cmp eax, 3
je 0x401c21
cmp eax, 4
je 0x401c5f
jmp 0x401d3f
lea rcx, str.______tINSERTAR_LIBRO_t_______n
call sym.puts
lea rax, [rbp - 0x10]
mov rcx, rax
call sym.insertarLibro
jmp 0x401d57
lea rcx, str.______tBUSCAR_LIBRO_t_______n
call sym.puts
lea rax, [rbp - 0x10]
mov rcx, rax
call sym.consultarVacia
test eax, eax
je 0x401c10
lea rcx, str.Lista_vacia._No_hay_libros_para_mostrar_y_o_buscar
call sym.puts
jmp 0x401d57
lea rax, [rbp - 0x10]
mov rcx, rax
call sym.buscarLibro
jmp 0x401d57
lea rcx, str.______tELIMINAR_LIBRO_t_______n
call sym.puts
lea rax, [rbp - 0x10]
mov rcx, rax
call sym.consultarVacia
test eax, eax
je 0x401c4e
lea rcx, str.Lista_vacia._No_hay_libros_para_mostrar_y_o_eliminar
call sym.puts
jmp 0x401d57
lea rax, [rbp - 0x10]
mov rcx, rax
call sym.borrarLibro
jmp 0x401d57
lea rcx, str.______tSALIR_t_______n
call sym.puts
lea rcx, str.Estas_seguro_de_salir_
call sym.puts
lea rcx, str.1._Si
call sym.puts
lea rcx, str.2._No
call sym.puts
lea rax, [rbp - 0x18]
mov rdx, rax
lea rcx, [0x00405013]
call sym.scanf
jmp 0x401cf3
lea rcx, str._n_____________________________________
call sym.puts
lea rcx, str.Opcion_invalida
call sym.puts
lea rcx, str.Por_favor__elige:
call sym.puts
lea rcx, str.1.__para_confirmar_la_salida
call sym.puts
lea rcx, str.2.__para_cancelar_y_regresar_al_menu
call sym.puts
lea rax, [rbp - 0x18]
mov rdx, rax
lea rcx, [0x00405013]
call sym.scanf
mov eax, dword [rbp - 0x18]
cmp eax, 1
je 0x401d03
mov eax, dword [rbp - 0x18]
cmp eax, 2
jne 0x401ca4
mov eax, dword [rbp - 0x18]
cmp eax, 1
jne 0x401d36
lea rcx, str._n_____________________________________
call sym.puts
lea rcx, str._tADIOS
call sym.puts
lea rcx, str._tSALIENDO...
call sym.puts
mov eax, 0
jmp 0x401d74
mov dword [rbp - 0x14], 0
jmp 0x401d57
lea rcx, str.Opcion_invalida
call sym.puts
lea rcx, str.Por_favor_selecciona_una_de_las_opciones_del_menu__1___4_
call sym.puts
mov eax, dword [rbp - 0x14]
cmp eax, 4
jne 0x401b29
lea rcx, str.PAUSE
call sym.system
mov eax, 0
add rsp, 0x40
pop rbp
ret
Function at 0x401f80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x00408054]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x40209a
mov rax, qword [0x00408058]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x401fce
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x402080
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x401fb2
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x4020d2
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x00408058]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call dbg._GetPEImageBase
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x00408058]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4020b5
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x402079
sub eax, 0x40
and eax, 0xffffffbf
je 0x402079
mov r9, rbp
add r9, qword [0x00408058]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4020a1
add dword [0x00408054], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.memcpy
xor ebp, ebp
jmp 0x401fdb
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
mov rax, qword [0x00408058]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbp + 8]
call dbg.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call dbg.__report_error
nop
nop word cs:[rax + rax]

Function at 0x402cb0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x402cc0
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x402cd0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x402d11
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x402d08
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x402d13
add rax, 0x28
cmp rax, r9
jne 0x402cf4
xor eax, eax
repz ret

Function at 0x402dc0
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x004056b0]
cmp word [rbx], 0x5a4d
je 0x402de0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, rcx
mov rcx, rbx
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402dd4
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp dbg._FindPESection
Function at 0x403030
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004089c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004089a0]
test rbx, rbx
je 0x403084
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x40307b
test rsi, rsi
je 0x40307b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x403060
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x004089c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
Function at 0x140004e40
Capabilities:
Read .ini file

Disassembly:
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x28], r9
mov rdi, r8
lea r9, [rsp + 0x80]
mov dword [rsp + 0x20], 0x40
lea r8, [0x1401149e6]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x140004f86
mov qword [rsp + 0xd8], rbp
lea r8, [rsp + 0x40]
mov qword [rsp + 0xe0], rsi
lea rdx, [rsp + 0x60]
movabs rsi, 0xabb7d23cb75daea9
mov qword [rsp + 0xe8], r14
mov qword [rsp + 0x48], rsi
lea rcx, [rsp + 0x80]
movabs r14, 0x2776c42fe49674f8
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r14
movabs rbp, 0x2776c42fe49674d4
vmovups xmm0, xmmword [rsp + 0x40]
mov qword [rsp + 0x30], rbp
vpxor xmm0, xmm0, xmmword [rsp + 0x30]
vmovdqu xmmword [rsp + 0x60], xmm0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok_s]
test rax, rax
je 0x140004f60
mov qword [rsp + 0xd0], rbx
xor ebx, ebx
nop dword [rax]
cmp rbx, 4
jge 0x140004f58
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
mov qword [rsp + 0x30], r14
lea r8, [rsp + 0x40]
vcvtsd2ss xmm1, xmm0, xmm0
vmovss dword [rdi + rbx*4], xmm1
mov qword [rsp + 0x38], rsi
lea rdx, [rsp + 0x70]
vmovdqu xmm0, xmmword [rsp + 0x30]
mov qword [rsp + 0x50], rbp
xor ecx, ecx
mov qword [rsp + 0x58], rsi
vpxor xmm1, xmm0, xmmword [rsp + 0x50]
vmovdqu xmmword [rsp + 0x70], xmm1
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok_s]
inc rbx
test rax, rax
jne 0x140004f00
mov rbx, qword [rsp + 0xd0]
mov r14, qword [rsp + 0xe8]
mov eax, 1
mov rsi, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xd8]
add rsp, 0xc0
pop rdi
ret
xor eax, eax
add rsp, 0xc0
pop rdi
ret
Function at 0x14000fc70
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov qword [r11 + 8], rcx
push r14
sub rsp, 0x80
movabs rcx, 0xabb7d23cb75daea9
movabs rdx, 0x2776c42fe49674d4
mov qword [rsp + 0x58], rcx
movabs rax, 0xabb7d23cce3cc2db
mov qword [rsp + 0x38], rax
movabs r8, 0x42008b4385f21199
mov qword [rsp + 0x30], r8
movabs rax, 0xf9bcad25b10d6eb6
vmovups xmm0, xmmword [rsp + 0x30]
mov qword [rsp + 0x40], rax
movabs rax, 0xd8d6be7fce3cc2db
mov qword [r11 - 0x20], rax
movabs rax, 0xf9bcad25b10d6ec5
mov qword [rsp + 0x38], rcx
movabs rcx, 0xb713e7a2cef64f3
mov qword [r11 - 0x18], rax
mov rax, qword [0x1401d53b0]
mov qword [r11 - 0x10], rcx
mov qword [rsp + 0x50], rdx
vpxor xmm0, xmm0, xmmword [rsp + 0x50]
mov qword [r11 - 0x28], r8
vmovups ymm1, ymmword [rsp + 0x60]
vmovups ymmword [rsp + 0x60], ymm1
vmovdqu xmm2, xmmword [rsp + 0x70]
mov qword [rsp + 0x30], rdx
lea rdx, [r11 - 0x38]
vpxor xmm1, xmm1, xmmword [rsp + 0x30]
mov qword [rsp + 0x48], rcx
lea rcx, [r11 - 0x28]
vmovdqu xmmword [rsp + 0x50], xmm0
vpxor xmm0, xmm2, xmmword [rsp + 0x40]
vmovdqu xmmword [rsp + 0x70], xmm0
vmovdqu xmmword [rsp + 0x60], xmm1
vzeroupper
call rax
xor ecx, ecx
mov qword [rsp + 0x90], 0
mov rsi, rax
call qword [sym.imp.ole32.dll_CoInitialize]
lea rax, [rsp + 0x90]
xor edx, edx
lea r9, [0x1400f8980]
mov qword [rsp + 0x20], rax
mov r8d, 1
lea rcx, [0x1400f8990]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rcx, qword gs:[0x60]
mov r14d, eax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14000fe37
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14000fe37
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rax, [rbx + r9*4]
mov eax, dword [rax + r10]
add rax, r10
movzx edx, byte [rax]
inc rax
test dl, dl
je 0x14000fe32
nop
movsx edx, dl
lea rax, [rax + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rax - 1]
test dl, dl
jne 0x14000fe10
cmp r8d, 0xf50944d9
je 0x14000fe3c
test r9d, r9d
jne 0x14000fdf0
mov rcx, qword [rcx]
jmp 0x14000fdc0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [0x1401d52a0]
add rax, r10
mov rcx, rsi
call rax
mov ecx, dword [0x1401d52a0]
mov r8b, 1
mov rdx, rsi
call fcn.14000f5c0
test r14d, r14d
jne 0x14000fe94
mov rcx, qword [rsp + 0x90]
mov rdx, rsi
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x90]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140051890
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x1401d52c0]
mov edi, ecx
cmp byte [rbx + 0x4d21], 0
jne 0x1400518e2
cmp byte [rbx + 0x4d22], 0
jne 0x1400518e2
movsx r9d, word [rbx + 0x5e68]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.14003fb60
test dil, 2
je 0x140051a0f
jmp 0x14005196c
vmovss xmm1, dword [rbx + 0x39c4]
vmovss xmm0, dword [0x14011cf50]
vfmadd213ss xmm0, xmm1, dword [rbx + 0xe4c]
vmovss xmm2, dword [0x14011cf70]
vfmadd213ss xmm2, xmm1, dword [rbx + 0xe48]
movsx r9d, word [rbx + 0x5e68]
lea r8, str.Tooltip__02d
xor eax, eax
mov dword [rbx + 0x49ec], 1
vmovss dword [rbx + 0x49f8], xmm2
vmovss dword [rbx + 0x49fc], xmm0
mov qword [rbx + 0x4a00], rax
lea rcx, [rsp + 0x20]
vmovss xmm0, dword [rbx + 0x3a2c]
vmulss xmm1, xmm0, dword [0x14011ce08]
or dword [rbx + 0x49e8], 0x41
mov edx, 0x10
vmovss dword [rbx + 0x4a48], xmm1
call fcn.14003fb60
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400519c0
lea r11, [0x140115240]
nop dword [rax]
cmp r9b, 0x23
jne 0x1400519a3
cmp byte [r8], r9b
jne 0x1400519a3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140051990
not ecx
call fcn.140047f20
test rax, rax
je 0x140051a0f
cmp byte [rax + 0xbe], 0
je 0x140051a0f
mov byte [rax + 0xc3], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xc5], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xe4], 1
mov edx, 0x10
inc word [rbx + 0x5e68]
movsx r9d, word [rbx + 0x5e68]
call fcn.14003fb60
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2030347
call fcn.14004aa60
mov rbx, qword [rsp + 0x40]
mov al, 1
add rsp, 0x30
pop rdi
ret
Function at 0x1800012dc
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga
Encrypt data using salsa20 or chacha

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4f]
sub rsp, 0xb0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r13, qword [rbp + 0x77]
lea rdx, [rcx + 2]
mov r10, r8
mov dword [rbp - 0x69], 0x61707865
lea r8, [rbp - 0x5b]
mov dword [rbp - 0x65], 0x3320646e
mov r15, r9
mov dword [rbp - 0x61], 0x79622d32
sub r8, rcx
mov dword [rbp - 0x5d], 0x6b206574
mov r9d, 8
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx - 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx - 2]
shl ecx, 8
or ecx, eax
mov dword [r8 + rdx], ecx
lea rdx, [rdx + 4]
sub r9, 1
jne 0x180001344
lea r8, [rbp - 0x37]
mov dword [rbp - 0x39], 0x13
sub r8, r10
lea rdx, [r10 + 2]
mov r9d, 3
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx - 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx - 2]
shl ecx, 8
or ecx, eax
mov dword [r8 + rdx], ecx
lea rdx, [rdx + 4]
sub r9, 1
jne 0x180001388
movsxd rax, dword [rbp + 0x7f]
xor ebx, ebx
mov r12, rax
test eax, eax
jle 0x18000142b
lea rdi, [rbp - 0x29]
lea r14d, [rax - 1]
sub rdi, r15
shr r14d, 6
lea esi, [rbx + 0x40]
inc r14d
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x69]
call fcn.180001000
inc dword [rbp - 0x39]
cmp rbx, rsi
jge 0x180001419
mov r8, r13
lea rcx, [rbx + r15]
sub r8, r15
mov rdx, r15
neg rdx
lea rax, [rdx + rcx]
cmp rax, r12
jge 0x180001419
mov al, byte [rdi + rcx]
xor al, byte [rcx]
mov byte [r8 + rcx], al
inc rcx
lea rax, [rdx + rcx]
cmp rax, rsi
jl 0x1800013fb
add rsi, 0x40
add rbx, 0x40
sub rdi, 0x40
sub r14, 1
jne 0x1800013d6
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.180002360
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x180002000
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x570]
sub rsp, 0x670
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x560], rax
mov ebx, 0x208
lea rcx, [rbp + 0x140]
mov r8d, ebx
xor edx, edx
call fcn.1800036b0
mov r8d, ebx
lea rcx, [rbp + 0x350]
xor edx, edx
call fcn.1800036b0
mov r8d, ebx
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.1800036b0
mov ebx, 0x104
lea rdx, [rbp + 0x140]
mov r8d, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x350]
call qword [sym.imp.SHLWAPI.dll_PathCanonicalizeW]
lea r8, str._c_DEL
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.1800043b0
lea r8, [rbp + 0x350]
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.180004434
lea r8, str.____NUL
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.180004434
mov r8d, ebx
lea rdx, [rbp + 0x140]
lea rcx, str.ComSpec
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
and dword [rsp + 0x28], 0
lea r9, [rsp + 0x30]
and qword [rsp + 0x20], 0
lea r8, [rbp + 0x140]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rbp + 0x560]
xor rcx, rsp
call fcn.180002360
mov rbx, qword [rsp + 0x680]
add rsp, 0x670
pop rbp
ret
Function at 0x140001d40
Capabilities:
Create process on windows
Impersonate user

Disassembly:
sub rsp, 0x428
mov rax, qword [0x140022008]
xor rax, rsp
mov qword [rsp + 0x410], rax
xorps xmm0, xmm0
lea r8, [rsp + 0x50]
xor eax, eax
mov edx, 0x2000000
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0xe0], rax
movups xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0x70], rax
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0x60], xmm0
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140001dd1
mov eax, 1
mov rcx, qword [rsp + 0x410]
xor rcx, rsp
call fcn.140001f10
add rsp, 0x428
ret
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0xf0]
lea rdx, [rsp + 0x280]
mov qword [rsp + 0x420], rbx
call fcn.140001140
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0xf0]
lea rdx, [rsp + 0x280]
mov ebx, eax
call fcn.1400012e0
test ebx, eax
mov rbx, qword [rsp + 0x420]
je 0x140001ead
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov r9d, 2
xor r8d, r8d
mov dword [rsp + 0x20], 1
mov edx, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x140001ead
lea rcx, str.___Token_Duplicated_n
call fcn.140001010
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea r8, str.C:WindowsSystem32cmd.exe
lea rax, [rsp + 0x80]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10
lea edx, [rax + 1]
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
test eax, eax
jne 0x140001ec5
lea rcx, str.____FAIL
call fcn.140001010
mov rcx, qword [rsp + 0x410]
xor rcx, rsp
call fcn.140001f10
add rsp, 0x428
ret
lea rcx, str.___SUCCESS
call fcn.140001010
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 1
call fcn.1400060f0
int3

Function at 0x140002904
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000294e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000294e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000294e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000294e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000294e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002950
xor al, al
add rsp, 0x28
ret
Function at 0x1400060f0
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140005f5b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005f5b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005f5b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005f5b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005f5b
cmp dword [rcx + 0x84], 0xe
jbe 0x140005f5b
cmp dword [rcx + 0xf8], 0
je 0x140005f5b
mov ecx, ebx
call fcn.14000600c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140005de8
nop
cmp dword [rbp + 0x20], 0
je 0x140005fa9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140005fb4
int3
xor r8d, r8d
xor edx, edx
jmp 0x140005eec
Function at 0x14000f4b4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000f4e4
xor eax, eax
jmp 0x14000f5a7
mov rbp, rbx
cmp word [rax], si
je 0x14000f509
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14000f4f0
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000f4ec
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000f3d4
movsxd r14, eax
test eax, eax
jne 0x14000f547
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000f4dd
mov rcx, r14
call fcn.14000c4d0
mov rdi, rax
test rax, rax
jne 0x14000f560
xor ecx, ecx
call fcn.14000ae28
jmp 0x14000f53c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000f3d4
test eax, eax
jne 0x14000f591
mov rcx, rdi
call fcn.14000ae28
jmp 0x14000f59b
xor ecx, ecx
call fcn.14000ae28
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140012d64
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140012d7a
mov al, 1
jmp 0x140012dda
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140012d8b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140012dd8
mov ecx, dword [rcx + 0x18]
nop
call fcn.14000fcb8
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140012dd8
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140012dd8
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140012dd8
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140012dda
xor al, al
add rsp, 0x20
pop rbx
ret