joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009100
Capabilities:
Get file version info

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14004c018]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
lea rdx, [rsp + 0x3c]
mov rbp, rcx
mov dword [rsp + 0x3c], eax
mov rcx, r8
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov rsi, r8
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test eax, eax
je 0x1400091e3
mov ecx, edi
mov qword [rsp + 0x78], rbx
mov edx, 1
call fcn.14000f700
mov rbx, rax
test rax, rax
jne 0x14000916b
lea rcx, str.____Couldnt_allocate_memory_to_retrieve_version_data
call fcn.1400165d0
jmp 0x1400091de
mov r9, rbx
mov r8d, edi
xor edx, edx
mov rcx, rsi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x1400091d6
lea r9, [rsp + 0x38]
mov rcx, rbx
lea r8, [rsp + 0x30]
lea rdx, [0x140034cf8]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x1400091d6
cmp dword [rsp + 0x38], 0
je 0x1400091d6
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0xfeef04bd
jne 0x1400091d6
mov r9d, dword [rax + 0xc]
lea r8, str._ld__ld
movzx eax, r9w
mov edx, 0x100
shr r9d, 0x10
mov rcx, rbp
mov dword [rsp + 0x20], eax
call fcn.140004830
mov rcx, rbx
call fcn.1400164d4
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000b2e0
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140009880
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0xa0
mov rax, qword [0x14004c018]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [r11 + 0x18], rbp
lea rax, str.Domain
mov qword [r11 - 0x10], r12
mov r12, rcx
mov qword [r11 - 0x18], r13
xor ecx, ecx
xor r13d, r13d
mov dword [rsp + 0x40], 1
mov qword [r11 - 0x60], rax
lea rax, str.Private
mov dword [rsp + 0x50], 2
mov qword [r11 - 0x50], rax
lea rax, str.Public
mov qword [r11 - 0x20], r14
lea edx, [r13 + 2]
mov qword [r11 - 0x28], r15
lea r15d, [r13 - 1]
mov dword [rsp + 0x60], 4
mov qword [r11 - 0x78], r13
mov dword [r11 - 0x6c], r13d
mov word [r11 - 0x70], r13w
mov qword [r11 - 0x40], rax
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov r14d, eax
mov eax, 0x80000000
lea ecx, [r14 + rax]
test eax, ecx
jne 0x14000993f
cmp r14d, 0x80010106
je 0x14000993f
lea rcx, str.____Error_while_initializing_COM__CoInitializeEx_failed:_0x_08lx__n
mov edx, r14d
mov ebp, r14d
call fcn.140001010
mov esi, 0x80004005
jmp 0x140009a2d
xor edx, edx
lea rax, [rsp + 0x30]
lea r9, [0x14003f8d8]
mov qword [rsp + 0x20], rax
lea rcx, [0x14003f908]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov r14d, eax
mov ebp, eax
test eax, eax
jns 0x140009984
lea rcx, str.____Error_while_initializing_the_INetFwPolicy2_interface__CoCreateInstance_for_INetFwPolicy2_failed:_0x_08lx__n
mov edx, eax
call fcn.140001010
mov esi, 0x80004005
jmp 0x140009a2d
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x3c]
mov rax, qword [rcx]
call qword [rax + 0x38]
mov esi, eax
test eax, eax
jns 0x1400099ad
mov edx, eax
lea rcx, str.____Could_not_determine_Firewall_status__failed_to_get_the_active_Firewall_profiles___get_CurrentProfileTypes_failed:_0x_08lx__n
call fcn.140001010
jmp 0x140009a2d
mov qword [rsp + 0xb8], rbx
lea rbx, [rsp + 0x48]
mov qword [rsp + 0xc8], rdi
mov edi, r13d
mov edx, dword [rbx - 8]
test dword [rsp + 0x3c], edx
je 0x140009a03
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov esi, eax
test eax, eax
js 0x140009a8d
cmp word [rsp + 0x38], r13w
jne 0x140009a03
mov rdx, qword [rbx]
lea rcx, str.___The_Windows_Firewall_is_off_on_the__active___s_profile._n
call fcn.140001010
movzx r15d, r13w
inc edi
add rbx, 0x10
cmp edi, 3
jb 0x1400099c5
mov eax, r13d
cmp r15w, 0xffff
sete al
mov dword [r12], eax
mov rbx, qword [rsp + 0xb8]
mov rdi, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x30]
mov r15, qword [rsp + 0x80]
mov r12, qword [rsp + 0x98]
mov rbp, qword [rsp + 0xc0]
test rcx, rcx
je 0x140009a5a
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x30], r13
mov r13, qword [rsp + 0x90]
test r14d, r14d
mov r14, qword [rsp + 0x88]
js 0x140009a75
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14000b2e0
add rsp, 0xa0
pop rsi
ret
mov edx, edi
lea rcx, str.____Could_not_determine_Firewall_status__failed_to_retrieve_FirewallEnabled_settings_for__s_profile___get_FirewallEnabled_failed:_0x_08lx__n
add rdx, rdx
mov r8d, eax
mov rdx, qword [rsp + rdx*8 + 0x48]
call fcn.140001010
jmp 0x140009a1d
Function at 0x14000a6e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
cmp dword [0x14004e6e0], 0
jne 0x14000a88d
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
call fcn.140002e60
mov edx, 1
mov rcx, qword [rax + 0x30]
call fcn.1400082d0
xor edi, edi
lea r15, [0x14004e6e0]
mov rsi, rax
mov r14d, edi
mov ebp, edi
cmp dword [rax + 0x50], edi
jbe 0x14000a815
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x30], r12
mov r12d, 0x775a
nop word [rax + rax]
mov rax, qword [rsi + 0x48]
mov rbx, qword [rsi + 0x18]
mov ecx, ebp
mov r9d, dword [rax + rcx*4]
cmp dword [rsi], edi
je 0x14000a768
lea rdx, [rbx + r9]
jmp 0x14000a7a3
mov rax, qword [rsi + 0x20]
mov r8d, edi
mov r11, qword [rsi + 0x38]
movzx r10d, word [rax + 6]
test r10d, r10d
je 0x14000a7a0
lea rax, [r11 + 8]
mov edx, dword [rax + 4]
cmp edx, r9d
ja 0x14000a794
add edx, dword [rax]
cmp r9d, edx
jb 0x14000a897
inc r8d
add rax, 0x28
cmp r8d, r10d
jb 0x14000a781
mov rdx, rdi
cmp word [rdx], r12w
jne 0x14000a800
mov r9d, edi
mov r8d, 0xe14b0d06
mov rax, rdx
nop word [rax + rax]
movzx eax, word [rax]
mov ecx, r8d
ror ecx, 8
inc r9d
add ecx, eax
mov eax, r9d
add rax, rdx
xor r8d, ecx
cmp byte [rax], dil
jne 0x14000a7c0
mov eax, r14d
lea rcx, [rax + rax*2]
lea rbx, [rcx*4]
mov rcx, rsi
mov dword [rbx + r15 + 4], r8d
call fcn.140008410
mov dword [rbx + r15 + 8], eax
inc r14d
inc ebp
cmp ebp, dword [rsi + 0x50]
jb 0x14000a750
mov r12, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov edx, r14d
lea r9, [0x14000a6a0]
mov r8d, 0xc
mov dword [0x14004e6e0], r14d
lea rcx, [0x14004e6e4]
call fcn.140017ad0
mov eax, dword [0x14004e6e0]
mov r14, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
test eax, eax
je 0x14000a868
mov eax, edi
lea rdx, [rax + rax*2]
mov dword [r15 + rdx*4 + 0xc], edi
inc edi
mov eax, dword [0x14004e6e0]
cmp edi, eax
jb 0x14000a851
mov edx, eax
lea r9, [0x14000a6c0]
mov r8d, 0xc
lea rcx, [0x14004e6e4]
call fcn.140017ad0
mov r15, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x58]
mov eax, 1
add rsp, 0x38
ret
mov eax, r8d
lea rcx, [rax + rax*4]
lea rdx, [r11 + rcx*8]
test rdx, rdx
je 0x14000a7a0
sub r9d, dword [rdx + 0xc]
mov edx, dword [rdx + 0x14]
mov eax, r9d
add rax, rbx
add rdx, rax
jmp 0x14000a7a3
Function at 0x14000b200
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, dword [section..data]
call fcn.14000a8c0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x14000bbb4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000bbfe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000bbfe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000bbfe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000bbfe
cmp dword [rcx + 0x84], 0xe
jbe 0x14000bbfe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000bc00
xor al, al
add rsp, 0x28
ret

Function at 0x14000f6f4
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000f553
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000f553
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000f553
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000f553
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000f553
cmp dword [rcx + 0x84], 0xe
jbe 0x14000f553
cmp dword [rcx + 0xf8], 0
je 0x14000f553
mov ecx, ebx
call fcn.14000f610
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000f3e0
nop
cmp dword [rbp + 0x20], 0
je 0x14000f5a1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000f5ac
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000f4e4
Function at 0x14001d600
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x14001d5dd
call fcn.140017110
mov dword [rax], 0x16
call fcn.140016fd4
or eax, 0xffffffff
jmp 0x14001d5fa
sub dword [rcx + 0x10], 1
jns 0x14001d5ec
add rsp, 0x28
jmp 0x140024304
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x14001d5bc
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x140024336
call fcn.140017110
mov dword [rax], 0x16
call fcn.140016fd4
jmp 0x140024455
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140024455
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x140024455
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x140024365
lock or dword [rcx + 0x14], 0x10
jmp 0x140024455
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x140024379
call fcn.14002626c
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.14001bb98
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.140024c74
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x140024443
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x14002440e
mov rcx, rsi
call fcn.14001bb98
cmp eax, edi
je 0x1400243f9
mov rcx, rsi
call fcn.14001bb98
cmp eax, 0xfffffffe
je 0x1400243f9
mov rcx, rsi
call fcn.14001bb98
movsxd rbx, eax
lea r14, [0x14004d950]
mov rcx, rsi
sar rbx, 6
call fcn.14001bb98
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x140024400
lea rdx, [0x14004c180]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14002440e
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x140024432
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x140024432
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x140024432
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x140024458
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x14001f9f0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14001fa77
mov rsi, rbx
cmp word [rax], bp
je 0x14001fa36
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14001fa20
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14001fa1c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14001a960
mov rdi, rax
test rax, rax
je 0x14001fa64
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14000d4c0
mov rbp, rdi
xor ecx, ecx
call fcn.140019ac4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140024470
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x140024192
call fcn.140017110
mov dword [rax], 0x16
call fcn.140016fd4
jmp 0x1400242e2
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1400242e2
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x1400242e2
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x1400241c1
lock or dword [rcx + 0x14], 0x10
jmp 0x1400242e2
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1400241d5
call fcn.14002626c
mov ebp, dword [rbx + 0x10]
cmp ebp, 1
jne 0x1400241e5
mov rax, qword [rbx]
mov r14b, byte [rax]
jmp 0x1400241e8
xor r14b, r14b
mov rsi, qword [rbx + 8]
mov rcx, rbx
mov edi, dword [rbx + 0x20]
mov qword [rbx], rsi
call fcn.14001bb98
mov r8d, edi
mov rdx, rsi
mov ecx, eax
call fcn.140024c74
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x1400242d0
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x14002427b
mov rcx, rbx
call fcn.14001bb98
cmp eax, 0xffffffff
je 0x140024266
mov rcx, rbx
call fcn.14001bb98
cmp eax, 0xfffffffe
je 0x140024266
mov rcx, rbx
call fcn.14001bb98
movsxd rdi, eax
lea rsi, [0x14004d950]
mov rcx, rbx
sar rdi, 6
call fcn.14001bb98
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [rsi + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x14002426d
lea rdx, [0x14004c180]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14002427b
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x14002429f
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x14002429f
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x14002429f
mov dword [rbx + 0x20], 0x1000
mov rdx, qword [rbx]
cmp ebp, 1
jne 0x1400242bd
movzx ecx, byte [rdx]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, r14b
or cx, ax
inc rdx
jmp 0x1400242c8
movzx ecx, word [rdx]
add dword [rbx + 0x10], 0xfffffffe
add rdx, 2
mov qword [rbx], rdx
movzx eax, cx
jmp 0x1400242e7
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x14002415c
Function at 0x1400247c8
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x14004d950]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x140024826
cmp word [rdx], r12w
jne 0x140024826
or byte [rax + r8*8 + 0x38], cl
jmp 0x14002482c
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x140024987
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x140024962
lea r9, [rcx + 2]
cmp ax, r13w
je 0x140024865
mov rcx, r9
jmp 0x140024888
cmp r9, rdx
jae 0x14002489f
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x140024849
jmp 0x140024987
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14002495c
cmp dword [rsp + 0x80], edi
je 0x14002495c
mov rdx, r14
lea r11, [0x14004d950]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x140024935
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x140024908
mov word [rbx], r12w
jmp 0x140024983
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x140024911
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x140024983
cmp word [rsp + 0x70], r12w
jne 0x140024942
cmp rbx, rsi
je 0x140024902
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.1400246e8
cmp word [rsp + 0x70], r12w
je 0x140024987
mov word [rbx], r13w
jmp 0x140024983
lea r11, [0x14004d950]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x14002497f
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x140024987
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140026430
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400246e8
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400246e8
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140026580
cmp rax, 0xffffffffffffffff
je 0x140026580
xor edi, edi
test rbp, rbp
jle 0x14002652b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140019374
mov rbx, rax
test rax, rax
jne 0x1400264b8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140026521
mov edx, 0x8000
mov ecx, r14d
call fcn.14001891c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001e508
cmp eax, 0xffffffff
je 0x140026501
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400264c8
mov edx, r15d
mov ecx, r14d
call fcn.14001891c
jmp 0x140026521
cmp byte [rsi + 0x38], dil
je 0x140026518
cmp dword [rsi + 0x34], 5
jne 0x140026518
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140026521
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140019ac4
jmp 0x140026594
jns 0x140026594
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400246e8
cmp rax, 0xffffffffffffffff
jne 0x14002654c
cmp byte [rsi + 0x30], dil
je 0x140026594
mov edi, dword [rsi + 0x2c]
jmp 0x140026594
mov ecx, r14d
call fcn.14001dab4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140026594
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140026594
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14002658d
mov eax, dword [rsi + 0x2c]
jmp 0x140026592
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400246e8
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140027320
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140027348
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140027348
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140640720
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14064072d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14064073d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140640725
lea eax, [rcx + 1]
jmp 0x14064074b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14064075e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140640744
sub eax, 3
jb 0x14064077e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1406407cd
sar eax, 1
movsxd rbp, eax
jb 0x1406407b4
jmp 0x14064078c
add ebx, ebx
jne 0x14064078a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1406407b4
inc ecx
add ebx, ebx
jne 0x14064079a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1406407b4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1406407ad
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14064079c
add ecx, 2
jmp 0x1406407b9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1406406e2
jmp 0x14064072d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0x63a000]
mov eax, dword [rdi]
or eax, eax
je 0x14064082d
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x640000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1406407dd
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140640827
mov qword [rbx], rax
add rbx, 8
jmp 0x1406407fd
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140640871
cmp al, 0xef
ja 0x140640859
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140640839
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x140640848
mov eax, dword [rdi]
add rdi, 4
jmp 0x140640848
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.1406408f0], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.1406408f0
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1406408e0
sub rsp, 0xffffffffffffff80
jmp 0x1400014f0