joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001b7ad0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1001b7add
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1001b7aed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1001b7ad5
lea eax, [rcx + 1]
jmp 0x1001b7afb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1001b7b0e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1001b7af4
sub eax, 3
jb 0x1001b7b2e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1001b7b7d
sar eax, 1
movsxd rbp, eax
jb 0x1001b7b64
jmp 0x1001b7b3c
add ebx, ebx
jne 0x1001b7b3a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1001b7b64
inc ecx
add ebx, ebx
jne 0x1001b7b4a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1001b7b64
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1001b7b5d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1001b7b4c
add ecx, 2
jmp 0x1001b7b69
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1001b7a92
jmp 0x1001b7add
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x40280
mov dl, 0x13
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1001b7bc9
cmp rsi, rcx
jae 0x1001b7bd1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1001b7bb0
cmp al, 0x8f
ja 0x1001b7bb0
cmp byte [rsi - 2], 0xf
je 0x1001b7bb6
sub al, 0xe8
cmp al, 1
ja 0x1001b7b9a
cmp rsi, rcx
jae 0x1001b7bd1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1001b7ba0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1001b7bd1
lodsb al, byte [rsi]
jmp 0x1001b7bb0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x1b5000]
mov eax, dword [rdi]
or eax, eax
je 0x1001b7c2e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1bb608]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1001b7bde
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1001b7c28
mov qword [rbx], rax
add rbx, 8
jmp 0x1001b7bfe
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.1001b7cb1], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.1001b7cb1
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1001b7ca1
sub rsp, 0xffffffffffffff80
jmp 0x1000017d0
Function at 0x525030
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
je 0x525040
jne 0x525040
sub rsp, 0x28
mov rax, qword [rdx]
cmp dword [rax + 0x8c], 0
je 0x5250eb
mov rsi, qword [rdx + 8]
mov edi, dword [rax + 0x88]
cmp dword [rdi + rsi + 0x18], 0
je 0x525088
jne 0x525088
je 0x494651b6
add r12, rsi
add rbx, rsi
je 0x5250eb
cmp dword [rsi + rdi + 0x14], 0
je 0x5250eb
mov r15, r8
mov r13, rcx
mov ebx, dword [rsi + rdi + 0x20]
mov r12d, dword [rsi + rdi + 0x24]
je 0x525069
jne 0x525069
je 0x7515afeb
and eax, 0x44e92375
mov esi, dword [rcx + rax]
Function at 0x532790
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x5327c0
mov eax, dword [rax + 0x20]
mov dword [rdi + 0x38], eax
mov rcx, rbx
mov rdx, rsi
call r15
mov rcx, rdi
jmp 0x532870
xor r14d, r14d
xor edx, edx
jmp 0x5328ff
mov rax, qword [rcx]
jmp 0x53280b
push r15
je 0x5328f6
jne 0x5328f6
add byte [rax], al
add byte [rax], al
nop word cs:[rax + rax]
nop dword [rax]
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx]
jmp 0x5328de
mov rcx, rbp
jmp 0x5328b1
mov r15, qword [sym.imp.itmkl_beo_UteNpt2HgazewrUmZvtjloS]
je 0x5327d2
jne 0x5327d2
jmp 0xffffffffff54b34d
mov rax, qword [rcx]
call qword [rax + 0x30]
jmp 0x532796
call qword [rax + 8]
je 0x532914
jne 0x532914
jmp 0x53d508
jmp 0x5328cc
call qword [rax + 0x20]
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx]
call qword [rax + 8]
test eax, eax
je 0x53287d
jne 0x53287d
por mm3, qword [rdx - 0x17]
je 0x5327ed
jne 0x5327ed
je 0xffffffff8462d62d
jmp 0x532821
sub rsp, 0x28
mov rdi, rcx
je 0x53290b
jmp 0x532932
push rdi
push rbp
push rbx
jmp 0x532845
je 0x532920
mov rax, qword [rcx]
jmp 0x5327ad
call fcn.00533060
jmp 0x53295e
jmp 0x10bac90
je 0x53293b
je 0x53294f
jne 0x53294f
je 0xffffffff8dd73819
je 0x532925
add byte [rax], al
add byte [rax - 0x75], cl
outsd dx, dword [rsi]
adc byte [rdi], cl
test ch, cl
add byte [rax], al
add byte [rdi], cl
test edi, eax
add byte [rax], al
add byte [rax - 0x7b], cl
leave
mov rbp, qword [rdi + 0x10]
je 0x53296f
jne 0x53296f
test rcx, rcx
jmp 0x53285e
call qword [rax + 0x18]
lea edx, [rax + 1]
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0x20]
mov rcx, qword [rdi + 0x10]
jmp 0x5327bb
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call qword [rax + 0x30]
test rax, rax
je 0x53293b
mov rcx, qword [rdi + 0x10]
je 0x532801
jne 0x532801
push r14
push rsi
jmp 0x532857
je 0x532842
jne 0x532842
mov rcx, qword [rcx + 0x10]
je 0x5328a8
jne 0x5328a8
jmp 0x13ee99d
test eax, eax
jmp 0x532918
jne 0x5327e0
jmp 0x53293b
xor r14d, r14d
jmp 0x53293b
je 0x532935
jne 0x532935
jmp 0x53287c
jne 0x53290b
jmp 0x54e77a
mov r14d, 1
mov eax, r14d
jmp 0x532942
je 0x53281b
jne 0x53281b
jmp 0x38b2b69b
lea rbx, [rdi + 0x38]
lea rsi, [rdi + 0x3c]
jmp 0x5327f5
cmp eax, 1
je 0x532892
jne 0x532892
je 0x98b4bb
mov rax, qword [rbp]
jmp 0x532838
invalid
add al, ah
dec dword [rbp + 0x29]
imul r9, rbx, 0xa2c13
Function at 0x548de0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, dword [rdx]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x1c], eax
lea rax, [rdx + 0x10]
cmp r8d, 0x100
cmovne rax, rdx
lea r8, str.expand_32_byte_kexpand_16_byte_k
lea r9, [0x0055fbe0]
cmove r9, r8
mov edx, dword [rax]
mov dword [rcx + 0x20], edx
mov edx, dword [rax + 4]
mov dword [rcx + 0x24], edx
mov edx, dword [rax + 8]
mov dword [rcx + 0x28], edx
mov eax, dword [rax + 0xc]
mov dword [rcx + 0x2c], eax
mov dword [rcx], 0x61707865
mov rax, qword [r9 + 4]
mov qword [rcx + 4], rax
mov eax, dword [r9 + 0xc]
mov dword [rcx + 0xc], eax
ret
Function at 0x54ee90
Capabilities:
Hash data using sha512

Disassembly:
test rcx, rcx
je 0x54ef1b
mov qword [rcx + 0x48], 0
mov qword [rcx], 0
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx + 8], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 0x10], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x18], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x20], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x28], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x30], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x38], rax
mov eax, 1
ret
Function at 0x54f940
Capabilities:
Encrypt data using curve25519

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov rsi, rdx
mov rdi, rcx
mov edx, 0x20
mov rcx, r8
mov r8, rsi
call fcn.0054f6b0
and byte [rsi], 0xf8
mov al, byte [rsi + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [rsi + 0x1f], al
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov rdx, rsi
call fcn.0054c300
mov rcx, rdi
mov rdx, rbx
call fcn.0054c280
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
ret
Function at 0x54f9a0
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
mov qword [rsp + 0x28], rcx
xor eax, eax
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
mov byte [rsp + rax + 0x30], cl
add rax, 1
cmp rax, 0x20
jne 0x54f9c0
and byte [rsp + 0x30], 0xf8
mov al, byte [rsp + 0x4f]
and al, 0x3f
or al, 0x40
mov byte [rsp + 0x4f], al
lea rbp, [rsp + 0x140]
mov rcx, rbp
call fcn.00549700
lea rbx, [rsp + 0x170]
mov rcx, rbx
call fcn.00549390
lea rsi, [rsp + 0xb0]
mov rcx, rsi
mov rdx, rbp
mov r8, rbx
call fcn.005493b0
mov rcx, rbx
mov rdx, rbx
mov r8, rbp
call fcn.0054b630
mov rcx, rbx
mov rdx, rbx
call fcn.00549990
mov rcx, rbp
mov rdx, rsi
mov r8, rbx
call fcn.0054a130
lea rcx, [rsp + 0x80]
call fcn.00549390
lea rdi, [rsp + 0x110]
mov rcx, rdi
call fcn.00549370
lea rcx, [rsp + 0x50]
mov rdx, rbp
call fcn.005496e0
lea r14, [rsp + 0xe0]
mov rcx, r14
call fcn.00549390
mov r13d, 0xfe
xor r15d, r15d
nop word cs:[rax + rax]
nop
mov ebp, r15d
mov eax, r13d
shr rax, 3
movzx r15d, byte [rsp + rax + 0x30]
mov ecx, r13d
and cl, 7
shr r15d, cl
and r15d, 1
xor ebp, r15d
lea rsi, [rsp + 0x80]
mov rcx, rsi
lea r12, [rsp + 0x50]
mov rdx, r12
mov r8d, ebp
call fcn.00549540
mov rcx, rdi
mov rdx, r14
mov r8d, ebp
call fcn.00549540
lea rbp, [rsp + 0xb0]
mov rcx, rbp
mov rdx, r12
mov r8, r14
call fcn.0054b630
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.0054b630
mov rcx, rsi
mov rdx, rsi
mov r8, rdi
call fcn.005493b0
mov rcx, rdi
mov rdx, r12
mov r8, r14
call fcn.005493b0
mov rcx, r14
mov rdx, rbp
mov r8, rsi
call fcn.0054a130
mov rcx, rdi
mov rdx, rdi
mov r8, rbx
call fcn.0054a130
mov rcx, rbp
mov rdx, rbx
call fcn.00549c20
mov rcx, rbx
mov rdx, rsi
call fcn.00549c20
mov rcx, r12
mov rdx, r14
mov r8, rdi
call fcn.005493b0
mov rcx, rdi
mov rdx, r14
mov r8, rdi
call fcn.0054b630
mov rcx, rsi
mov rdx, rbx
mov r8, rbp
call fcn.0054a130
mov rcx, rbx
mov rdx, rbx
mov r8, rbp
call fcn.0054b630
mov rcx, rdi
mov rdx, rdi
call fcn.00549c20
mov rcx, r14
mov rdx, rbx
call fcn.0054ac70
mov rcx, r12
mov rdx, r12
call fcn.00549c20
mov rcx, rbp
mov rdx, rbp
mov r8, r14
call fcn.005493b0
mov rcx, r14
lea rdx, [rsp + 0x140]
mov r8, rdi
call fcn.0054a130
mov rcx, rdi
mov rdx, rbx
mov r8, rbp
call fcn.0054a130
add r13d, 0xffffffff
cmp r13d, 0xffffffff
jne 0x54fa90
lea rsi, [rsp + 0x80]
lea rdx, [rsp + 0x50]
mov rcx, rsi
mov r8d, r15d
call fcn.00549540
lea rdi, [rsp + 0x110]
lea rdx, [rsp + 0xe0]
mov rcx, rdi
mov r8d, r15d
call fcn.00549540
mov rcx, rdi
mov rdx, rdi
call fcn.00549990
mov rcx, rsi
mov rdx, rsi
mov r8, rdi
call fcn.0054a130
mov rcx, qword [rsp + 0x28]
mov rdx, rsi
call fcn.0054a9a0
add rsp, 0x198
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x40bb60
Capabilities:
Get file system object information

Disassembly:
sub rsp, 0x2f8
lea rcx, [rsp + 0x38]
mov edx, 0x2b8
xor r8, r8
call fcn.00401070
mov dword [rsp + 0x44], 0x20000000
lea rcx, [0x0040bbb4]
mov edx, 0x10
lea r8, [rsp + 0x38]
mov r9d, 0x2b8
mov dword [rsp + 0x20], 0x4010
call sub.shell32.dll_SHGetFileInfoW
mov eax, dword [rsp + 0x40]
add rsp, 0x2f8
ret
Function at 0x6daa17e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6dac25e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6daa1968
mov rax, qword [0x6dac25e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6daa182c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6daa18b5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6daa1810
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6daa199d
mov rax, qword [0x6dac25e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6dac25e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6daa1980
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6daa18ae
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6daa1910
add dword [0x6dac25e4], 1
cmp edi, 8
jae 0x6daa18e3
test dil, 4
jne 0x6daa1954
test edi, edi
je 0x6daa18d8
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6daa196f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6daa18d8
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6daa18fc
jmp 0x6daa18d8
add rsi, qword [0x6dac25e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6daa18ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6daa18d8
xor esi, esi
jmp 0x6daa1837
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6daa18d8
mov rax, qword [0x6dac25e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6daa20f0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6dac28c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6dac28a0]
test rbx, rbx
je 0x6daa2144
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6daa213b
test rsi, rsi
je 0x6daa213b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6daa2120
lea rcx, [0x6dac28c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x6daa2380
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6daa2390
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6daa23a0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6daa23e1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6daa23d8
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6daa23e3
add rax, 0x28
cmp rax, r9
jne 0x6daa23c4
xor eax, eax
ret

Function at 0x6daa2480
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6dabf1f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6daa24ed
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6daa24ed
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6daa24ed
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6daa24e4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6daa24ef
add rax, 0x28
cmp rax, r9
jne 0x6daa24d0
xor eax, eax
add rsp, 0x28
ret

Function at 0x6daa25f0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6dabf1f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6daa2610
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6daa2608
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6daa266d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6daa2664
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6daa2674
add rax, 0x28
cmp rax, r9
jne 0x6daa2650
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6daa2690
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6dabf1f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6daa26fe
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6daa26fe
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6daa26fe
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6daa26fe
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6daa26f5
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6daa2705
add rcx, 0x28
cmp rcx, rax
jne 0x6daa26e0
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6daa2718
jmp 0x6daa26fe
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6daa2726
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6daa26fe
test r9d, r9d
jg 0x6daa2710
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6daa2a60
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1400306f4
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rax, r8
xor ecx, ecx
mov rdi, rdx
mov r8, r9
mov rdx, rax
mov qword [rbx], rcx
mov qword [rbx + 8], rcx
mov rcx, rbx
mov dword [rbx + 0x50], 0x6a09e667
mov dword [rbx + 0x54], 0xbb67ae85
mov dword [rbx + 0x58], 0x3c6ef372
mov dword [rbx + 0x5c], 0xa54ff53a
mov dword [rbx + 0x60], 0x510e527f
mov dword [rbx + 0x64], 0x9b05688c
mov dword [rbx + 0x68], 0x1f83d9ab
mov dword [rbx + 0x6c], 0x5be0cd19
call fcn.14002e94c
mov rdx, rdi
mov rcx, rbx
call fcn.14002e6e0
mov rbx, qword [rsp + 0x40]
mov rax, rdi
add rsp, 0x30
pop rdi
ret
Function at 0x1400320b8
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
jmp 0x1400320f4
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
call fcn.14000a864
test rax, rax
jne 0x14003210b
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x1400320e0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
jmp 0x1400320fb

Function at 0x140032a14
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
xor ebx, ebx
mov r13, rdx
mov rsi, rcx
mov edi, dword [rax + rcx + 0x88]
add rdi, rcx
mov r14d, dword [rdi + 0x1c]
mov r15d, dword [rdi + 0x20]
add r14, rcx
mov r12d, dword [rdi + 0x24]
add r15, rcx
add r12, rcx
cmp dword [rdi + 0x18], ebx
jbe 0x140032a87
movzx eax, word [r12 + rbx*2]
mov rdx, r13
mov ecx, dword [r15 + rbx*4]
add rcx, rsi
mov ebp, dword [r14 + rax*4]
add rbp, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x140032aa6
inc ebx
cmp ebx, dword [rdi + 0x18]
jb 0x140032a60
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, rbp
jmp 0x140032a89

Function at 0x140032ab4
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x240
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.14000b220
lea rcx, [0x140042750]
call fcn.1400106d8
lea rdx, [rsp + 0x30]
mov r8, rax
sub rdx, 2
lea rdx, [rdx + 2]
cmp word [rdx], 0
jne 0x140032aea
xor ecx, ecx
movzx eax, word [r8 + rcx*2]
mov word [rdx + rcx*2], ax
inc rcx
test ax, ax
jne 0x140032af6
lea rcx, [rsp + 0x30]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x140032b10
mov eax, dword [0x1400427b8]
lea rdx, [0x1400427c0]
movaps xmm0, xmmword [str.MicrosoftWindowsFontsAdSlavicF.ttf]
mov r9d, 1
movaps xmm1, xmmword [0x140042780]
xor r8d, r8d
movups xmmword [rcx], xmm0
mov dword [rsp + 0x28], 0x208
movaps xmm0, xmmword [0x140042790]
movups xmmword [rcx + 0x10], xmm1
movaps xmm1, xmmword [0x1400427a0]
movups xmmword [rcx + 0x20], xmm0
movsd xmm0, qword [0x1400427b0]
movups xmmword [rcx + 0x30], xmm1
movsd qword [rcx + 0x40], xmm0
mov dword [rcx + 0x48], eax
movzx eax, word [0x1400427bc]
mov word [rcx + 0x4c], ax
lea rax, [rsp + 0x30]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x240
pop rbx
ret
Function at 0x140032ba4
Capabilities:
Create directory
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x360
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x104
call fcn.14000b220
lea rcx, str.LOCALAPPDATA
call fcn.1400106e0
lea rcx, [rsp + 0x40]
mov r8, rax
dec rcx
xor edi, edi
inc rcx
cmp byte [rcx], dil
jne 0x140032bdc
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x140032be6
lea rcx, [rsp + 0x40]
dec rcx
inc rcx
cmp byte [rcx], dil
jne 0x140032bfc
movups xmm0, xmmword [str.MicrosoftWindowsFonts]
mov al, byte [0x140042800]
xor edx, edx
movups xmmword [rcx], xmm0
movsd xmm0, qword [0x1400427f8]
movsd qword [rcx + 0x10], xmm0
mov byte [rcx + 0x18], al
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor edx, edx
lea rcx, [rsp + 0x150]
mov r8d, 0x208
call fcn.14000b220
lea rcx, [0x140042750]
call fcn.1400106d8
lea rcx, [rsp + 0x150]
mov r8, rax
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x140032c61
xor edx, edx
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
inc rdx
test ax, ax
jne 0x140032c6c
lea rcx, [rsp + 0x150]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x140032c89
movaps xmm0, xmmword [str.MicrosoftWindowsFontsAdSlavicF.ttf]
xor r9d, r9d
movaps xmm1, xmmword [0x140042780]
xor r8d, r8d
mov eax, dword [0x1400427b8]
mov edx, 0x40000000
movups xmmword [rcx], xmm0
mov qword [rsp + 0x30], rdi
movaps xmm0, xmmword [0x140042790]
movups xmmword [rcx + 0x10], xmm1
mov dword [rsp + 0x28], pe_nt_image_headers64
movaps xmm1, xmmword [0x1400427a0]
movups xmmword [rcx + 0x20], xmm0
mov dword [rsp + 0x20], 2
movsd xmm0, qword [0x1400427b0]
movups xmmword [rcx + 0x30], xmm1
movsd qword [rcx + 0x40], xmm0
mov dword [rcx + 0x48], eax
movzx eax, word [0x1400427bc]
mov word [rcx + 0x4c], ax
lea rcx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea r9, [rsp + 0x370]
mov qword [rsp + 0x20], rdi
mov rcx, rax
lea rdx, [0x140070210]
mov r8d, 0x155b4
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x378]
add rsp, 0x360
pop rdi
ret