joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f3e70
Capabilities:
Get file system object information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x2f0
movzx esi, r8b
mov rdi, rdx
mov rbp, rcx
test rdx, rdx
je 0x1400f3f4d
movzx eax, byte [rdx]
xor al, 0xe
test al, 0x1f
jne 0x1400f3f4d
lea rdx, str..exe
mov rcx, rdi
call fcn.14011341c
test eax, eax
jne 0x1400f3f4d
xor ebx, ebx
mov qword [rsp + 0x308], rbx
test rbp, rbp
je 0x1400f3f0c
test sil, sil
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x308]
mov rcx, rbp
cmovne r9, rbx
lea r8, [rsp + 0x308]
cmove r8, rbx
xor edx, edx
call qword [sym.imp.SHELL32.dll_ExtractIconExW]
mov rax, qword [rsp + 0x308]
test rax, rax
jne 0x1400f3fea
test sil, sil
lea rdx, [rsp + 0x308]
lea rcx, [rsp + 0x308]
cmove rdx, rbx
cmovne rcx, rbx
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetStockApplicationIcon
mov rax, qword [rsp + 0x308]
test rax, rax
je 0x1400f3fea
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_DuplicateIcon]
jmp 0x1400f3fea
xor ebx, ebx
mov qword [rsp + 0x308], rbx
test rbp, rbp
je 0x1400f3fa5
movzx eax, sil
lea r8, [rsp + 0x30]
neg al
mov r9d, 0x2b8
sbb ecx, ecx
xor edx, edx
add ecx, 0x101
mov dword [rsp + 0x20], ecx
mov rcx, rbp
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
je 0x1400f3f98
mov rbx, qword [rsp + 0x30]
mov qword [rsp + 0x308], rbx
jmp 0x1400f3fa0
mov rbx, qword [rsp + 0x308]
test rbx, rbx
jne 0x1400f3fe7
test rdi, rdi
je 0x1400f3fe7
neg sil
lea r8, [rsp + 0x30]
mov r9d, 0x2b8
mov edx, 0x80
sbb eax, eax
mov rcx, rdi
add eax, 0x111
mov dword [rsp + 0x20], eax
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
je 0x1400f3fdd
mov rax, qword [rsp + 0x30]
jmp 0x1400f3fea
mov rax, qword [rsp + 0x308]
jmp 0x1400f3fea
mov rax, rbx
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400f4010
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rdx, qword [rdx]
mov ecx, 2
add rdx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8, qword [rdi]
mov rcx, rax
mov rdx, qword [rdi + 8]
mov rbx, rax
call fcn.1401317c0
mov rcx, qword [rdi]
xor eax, eax
mov word [rbx + rcx], ax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rsi
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400f409e
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x1400f409e
mov rdx, rbp
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
test rax, rax
je 0x1400f409e
call qword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x1400f40a7
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400f40c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rsi, r8
mov r14, rcx
mov rcx, rsi
mov r8d, 5
mov rdx, r9
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x1400f41b4
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test eax, eax
je 0x1400f41b4
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400f41b4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rax, rax
je 0x1400f41b4
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
mov r8d, edi
mov edx, 4
mov ebx, edi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, ebx
mov rdx, rbp
mov rcx, rax
mov rdi, rax
call fcn.1401317c0
mov eax, 0xffff
cmp word [rdi + 2], ax
jne 0x1400f4176
mov dword [rdi + 0xc], 0x40000448
jmp 0x1400f417c
mov dword [rdi], 0x40000448
mov rax, qword [rsp + 0x68]
mov r8, r14
mov r9, qword [rsp + 0x60]
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
mov r8, rdi
xor edx, edx
mov rbx, rax
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, rbx
jmp 0x1400f41b6
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1400f9dd0
Capabilities:
Get user security identifier

Disassembly:
push rsi
push r14
push r15
sub rsp, 0x60
cmp qword [rcx], 0xfffe
mov r14, r9
movzx eax, word [rcx]
mov rsi, r8
mov word [rsp + 0x38], ax
mov r15, rdx
mov word [rsp + 0x3a], ax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x40], rax
jbe 0x1400f9e11
mov eax, 0xc0000106
add rsp, 0x60
pop r15
pop r14
pop rsi
ret
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x50], r12
call fcn.1400f99c0
lea rcx, [rsp + 0x80]
xor r12d, r12d
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0x38]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x20], rcx
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x80], r12
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_LsaLookupNames2]
mov rcx, qword [rsp + 0x80]
mov ebp, eax
test eax, eax
js 0x1400f9f65
mov edx, dword [rcx]
sub edx, 7
cmp edx, 1
jbe 0x1400f9f60
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x58], rdi
test r15, r15
je 0x1400f9ed8
mov rcx, qword [rcx + 8]
call qword [sym.imp.ntdll.dll_RtlLengthSid]
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
mov edx, 4
mov r8d, eax
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdx, qword [rsp + 0x80]
mov r8d, ebx
mov rcx, rax
mov rdi, rax
mov rdx, qword [rdx + 8]
call fcn.1401317c0
mov rcx, qword [rsp + 0x80]
mov qword [r15], rdi
test rsi, rsi
je 0x1400f9f47
movsxd rax, dword [rcx + 0x10]
test eax, eax
js 0x1400f9f37
lea rdx, [rax + rax*2]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
movzx edi, word [rcx + rdx*8]
mov r15, qword [rcx + rdx*8 + 8]
mov rdx, qword [0x140191180]
lea rcx, [rdi + 0x12]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateObject
mov rbx, rax
mov qword [rax], rdi
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rdi], r12w
test r15, r15
je 0x1400f9f32
mov rcx, qword [rax + 8]
mov r8d, edi
mov rdx, r15
call fcn.1401317c0
mov qword [rsi], rbx
jmp 0x1400f9f3f
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhReferenceEmptyString
mov qword [rsi], rax
mov rcx, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x88]
test r14, r14
je 0x1400f9f65
mov eax, dword [rcx]
mov dword [r14], eax
jmp 0x1400f9f65
mov ebp, 0xc0000073
mov rax, qword [rsp + 0x30]
mov r12, qword [rsp + 0x50]
test rax, rax
je 0x1400f9f85
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x1400f9f90
call qword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
mov eax, ebp
mov rbp, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop r14
pop rsi
ret
Function at 0x140100640
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push rbx
push rsi
sub rsp, 0x28
mov rbx, rdx
mov rsi, rcx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140100820
lea rcx, str.BinaryData
mov qword [rsp + 0x58], r14
call qword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetClipboardData]
mov r14, rax
test rax, rax
jne 0x140100694
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov r14, rax
test rax, rax
je 0x140100815
mov qword [rsp + 0x40], rbp
mov rcx, r14
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rcx, r14
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GlobalSize]
mov ecx, dword [rbx + 0x1c]
mov rbp, rax
mov r9d, dword [rbx + 0x20]
mov edi, ecx
mov r15d, dword [rbx + 0x14]
cmp ecx, r9d
jle 0x1401006df
mov edi, r9d
mov dword [rbx + 0x1c], r9d
mov r9d, ecx
mov dword [rbx + 0x20], ecx
cmp byte [rbx + 0x30], 0
je 0x1401007b1
cmp edi, 0xffffffff
jne 0x140100714
cmp dword [rbx + 0x18], 3
mov edi, r15d
jne 0x1401006fe
lea edi, [r15 + 1]
mov dword [rbx + 0x14], edi
mov r9d, ebp
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call fcn.140100990
jmp 0x1401007d0
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call fcn.140100830
mov r9d, ebp
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call fcn.140100990
call qword [sym.imp.USER32.dll_DestroyCaret]
mov r9d, 0x105
mov qword [rbx + 0x1c], 0xffffffffffffffff
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_RedrawWindow]
cmp dword [rbx + 0x68], 0
jne 0x140100781
cmp byte [rbx + 0x2c], 0
je 0x140100781
call qword [sym.imp.USER32.dll_DestroyCaret]
cmp byte [rbx + 0x2f], 0
mov eax, 8
mov r8d, 4
cmovne r8d, eax
imul r8d, dword [rbx + 0x44]
jmp 0x14010078b
call qword [sym.imp.USER32.dll_DestroyCaret]
mov r8d, dword [rbx + 0x44]
mov r9d, dword [rbx + 0x40]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_CreateCaret]
mov edx, dword [rbx + 0x6c]
mov ecx, dword [rbx + 0x68]
call qword [sym.imp.USER32.dll_SetCaretPos]
mov rcx, rsi
call qword [sym.imp.USER32.dll_ShowCaret]
jmp 0x1401007d0
cmp edi, 0xffffffff
jne 0x1401007c6
cmp dword [rbx + 0x18], 3
mov edi, r15d
jne 0x1401007c6
lea edi, [r15 + 1]
mov dword [rbx + 0x14], edi
mov eax, dword [rbx + 8]
sub eax, edi
cmp ebp, eax
cmova ebp, eax
mov ecx, edi
mov rdx, r12
add rcx, qword [rbx]
mov r8d, ebp
call fcn.1401317c0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov r9d, 0x105
mov dword [rbx + 0x14], r15d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_RedrawWindow]
mov r15, qword [rsp + 0x20]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov r14, qword [rsp + 0x58]
add rsp, 0x28
pop rsi
pop rbx
ret
Function at 0x140103b70
Capabilities:
Capture screenshot

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xb0
mov rbx, rdx
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetUpdateRect]
test eax, eax
je 0x140103d7e
mov eax, dword [rsp + 0x5c]
or eax, dword [rsp + 0x54]
or eax, dword [rsp + 0x58]
or eax, dword [rsp + 0x50]
je 0x140103d7e
cmp dword [rbx + 0x240], 0
mov qword [rsp + 0xc0], rsi
jg 0x140103c2e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
xor r8d, r8d
mov rcx, rdi
mov rdx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetUpdateRgn]
mov rcx, qword [rbx + 0x248]
test rcx, rcx
jne 0x140103bf7
mov qword [rbx + 0x248], rsi
jmp 0x140103c12
mov r9d, 2
mov r8, rsi
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.USER32.dll_BeginPaint]
test rax, rax
je 0x140103d76
jmp 0x140103d68
test dword [rbx + 0x40], 0x200000
je 0x140103ce3
cmp qword [rbx + 0x200], 0
jne 0x140103ce3
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_GetDC]
mov rsi, rax
test rax, rax
je 0x140103ce3
mov rcx, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov qword [rbx + 0x200], rax
test rax, rax
je 0x140103ce3
movups xmm0, xmmword [rbx + 0x68]
mov rcx, rsi
movups xmmword [rbx + 0x218], xmm0
mov edx, dword [rbx + 0x220]
mov r8d, dword [rbx + 0x224]
inc edx
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov qword [rbx + 0x210], rax
test rax, rax
jne 0x140103cbc
mov rcx, qword [rbx + 0x200]
call qword [sym.imp.GDI32.dll_DeleteDC]
mov qword [rbx + 0x200], 0
jmp 0x140103ce3
mov rcx, qword [rbx]
mov rdx, rsi
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rdx, qword [rbx + 0x210]
mov rcx, qword [rbx + 0x200]
call qword [sym.imp.GDI32.dll_SelectObject]
mov qword [rbx + 0x208], rax
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.USER32.dll_BeginPaint]
mov rsi, rax
test rax, rax
je 0x140103d76
movups xmm0, xmmword [rsp + 0x6c]
mov r8, qword [rbx + 0x200]
lea r9, [rsp + 0x50]
mov rdx, rbx
movups xmmword [rsp + 0x50], xmm0
test r8, r8
je 0x140103d60
call fcn.140109fb0
mov ecx, dword [rsp + 0x5c]
mov r8d, dword [rsp + 0x54]
sub ecx, r8d
mov edx, dword [rsp + 0x50]
mov rax, qword [rbx + 0x200]
mov r9d, dword [rsp + 0x58]
mov dword [rsp + 0x40], 0xcc0020
sub r9d, edx
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call qword [sym.imp.GDI32.dll_BitBlt]
jmp 0x140103d68
mov r8, rsi
call fcn.140109fb0
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.USER32.dll_EndPaint]
mov rsi, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0xc8]
add rsp, 0xb0
pop rdi
ret
Function at 0x14010dc80
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov qword [rcx], rdx
mov qword [rcx + 8], r8
mov r8d, 0x40
call fcn.14010dfa0
nop
mov eax, 0x5a4d
cmp word [rdi], ax
je 0x14010dcca
mov eax, 0xc000012f
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [rdi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0xffffffe
ja 0x14010dd6b
cmp rcx, rsi
jae 0x14010dd6b
lea rdx, [rcx + rdi]
mov qword [rbx + 0x10], rdx
mov r8d, 0x18
mov rcx, rbx
call fcn.14010dfa0
mov rdx, qword [rbx + 0x10]
movzx eax, word [rdx + 6]
lea rcx, [rax + rax*4]
movzx eax, word [rdx + 0x14]
lea rcx, [rcx + 3]
lea r8, [rax + rcx*8]
mov rcx, rbx
call fcn.14010dfa0
nop
mov rcx, qword [rbx + 0x10]
cmp dword [rcx], 0x4550
jne 0x14010dd6b
movzx eax, word [rcx + 0x18]
mov word [rbx + 0x28], ax
mov edx, 0x10b
sub ax, dx
mov edx, 0xfeff
test dx, ax
jne 0x14010dd6b
movzx eax, word [rcx + 6]
mov dword [rbx + 0x18], eax
movzx eax, word [rcx + 0x14]
add rcx, 0x18
add rcx, rax
mov qword [rbx + 0x20], rcx
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, 0xc000007b
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14010dd90
Capabilities:
Get file attributes
Map section object

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push r14
push r15
lea rbp, [rsp - 0x3f]
sub rsp, 0x100
xor r15d, r15d
mov r14, r9
mov qword [rbp + 0x5f], r15
test rcx, rcx
jne 0x14010ddc7
mov eax, 0xc0000030
add rsp, 0x100
pop r15
pop r14
pop rbp
ret
mov qword [rsp + 0x130], rbx
lea rdx, [rbp - 0x49]
xor r9d, r9d
mov qword [rsp + 0xf0], rdi
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
jne 0x14010ddf5
mov ebx, 0xc0000034
jmp 0x14010df7a
mov dword [rsp + 0x50], r15d
lea rax, [rbp - 0x49]
mov qword [rsp + 0x48], r15
lea r9, [rbp + 0xf]
mov dword [rsp + 0x40], 0x60
lea r8, [rbp - 0x39]
mov dword [rsp + 0x38], 1
lea rcx, [rbp - 0x59]
mov dword [rsp + 0x30], 1
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x80
mov edx, 0x1000a1
mov qword [rsp + 0x20], r15
mov dword [rbp - 0x39], 0x30
mov qword [rbp - 0x31], r15
mov dword [rbp - 0x21], 0x40
mov qword [rbp - 0x29], rax
movdqu xmmword [rbp - 0x19], xmm0
call qword [sym.imp.ntdll.dll_NtCreateFile]
mov ebx, eax
xor edx, edx
mov rax, qword gs:[0x30]
mov r8, qword [rbp - 0x41]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test ebx, ebx
mov rdi, r15
cmovns rdi, qword [rbp - 0x59]
js 0x14010df7a
mov r9d, 0x18
mov dword [rsp + 0x20], 5
lea r8, [rbp - 9]
mov rcx, rdi
lea rdx, [rbp + 0x1f]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov ebx, eax
test eax, eax
js 0x14010df62
mov rax, qword [rbp - 1]
lea r9, [rbp + 0x67]
mov qword [rsp + 0x30], rdi
lea rcx, [rbp + 0x5f]
mov dword [rsp + 0x28], 0x8000000
xor r8d, r8d
mov edx, 0xf001f
mov qword [rbp + 0x67], rax
mov dword [rsp + 0x20], 0x20
mov qword [rsp + 0xf8], rsi
call qword [sym.imp.ntdll.dll_NtCreateSection]
mov ebx, eax
test eax, eax
js 0x14010df5a
mov rax, qword [rbp + 0x67]
lea r8, [rbp - 0x61]
mov rcx, qword [rbp + 0x5f]
xor r9d, r9d
mov dword [rsp + 0x48], 0x20
mov rdx, 0xffffffffffffffff
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], 1
mov qword [rbp - 0x51], rax
lea rax, [rbp - 0x51]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
mov qword [rbp - 0x61], r15
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov ebx, eax
test eax, eax
js 0x14010df5a
mov rax, qword [rbp - 0x61]
mov rcx, qword [rbp + 0x67]
mov qword [r14], rax
mov rax, qword [rbp + 0x7f]
mov qword [rax], rcx
mov rsi, qword [rsp + 0xf8]
mov rcx, qword [rbp + 0x5f]
test rcx, rcx
je 0x14010df71
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
mov rdi, qword [rsp + 0xf0]
mov eax, ebx
mov rbx, qword [rsp + 0x130]
add rsp, 0x100
pop r15
pop r14
pop rbp
ret
Function at 0x14010dfe0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x170
mov rdi, r8
mov qword [r8], rdx
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], 0
mov r9d, 0x40
mov rbx, rdx
mov rsi, rcx
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
test eax, eax
js 0x14010e149
mov eax, 0x5a4d
cmp word [rsp + 0x30], ax
je 0x14010e036
mov eax, 0xc000012f
jmp 0x14010e149
mov ecx, dword [rsp + 0x6c]
mov qword [rsp + 0x180], rbp
lea eax, [rcx - 1]
cmp eax, 0xffffffe
ja 0x14010e13c
lea rbp, [rbx + rcx]
mov qword [rsp + 0x20], 0
mov rdx, rbp
lea r8, [rsp + 0x70]
mov r9d, 0xf8
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
test eax, eax
js 0x14010e141
cmp dword [rsp + 0x70], 0x4550
jne 0x14010e13c
movzx eax, word [rsp + 0x88]
mov ecx, 0x10b
mov word [rdi + 0x20], ax
sub ax, cx
mov ecx, 0xfeff
test cx, ax
jne 0x14010e13c
movzx eax, word [rsp + 0x76]
mov dword [rdi + 0x10], eax
lea r8d, [rax + rax*4]
movzx eax, word [rsp + 0x84]
lea r8d, [r8 + 3]
lea r8d, [rax + r8*8]
cmp r8d, 0x100000
ja 0x14010e13c
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
mov edx, 4
mov ebx, r8d
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r9d, ebx
mov qword [rsp + 0x20], 0
mov r8, rax
mov qword [rdi + 8], rax
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
mov rcx, qword [rdi + 8]
mov ebx, eax
test eax, eax
jns 0x14010e125
mov r8, rcx
xor edx, edx
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebx
jmp 0x14010e141
movzx eax, word [rsp + 0x84]
add rax, 0x18
add rcx, rax
mov qword [rdi + 0x18], rcx
xor eax, eax
jmp 0x14010e141
mov eax, 0xc000007b
mov rbp, qword [rsp + 0x180]
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140111790
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov edi, dword [rcx + 0x30]
mov eax, 0x38
mov r8d, edi
mov rsi, rdx
and r8d, 0x3f
mov rbp, rcx
sub eax, r8d
lea rcx, [rsp + 0x21]
mov ebx, 0x78
sub ebx, r8d
cmp r8d, 0x38
cmovb ebx, eax
xor edx, edx
lea eax, [rbx - 1]
movsxd r8, eax
call fcn.140131400
movsxd rax, ebx
lea rdx, [rsp + 0x20]
add rdx, rax
mov byte [rsp + 0x20], 0x80
mov eax, dword [rbp + 0x2c]
lea r8d, [rbx + 8]
shl eax, 3
mov ecx, edi
shr ecx, 0x1d
or ecx, eax
lea eax, [rdi*8]
bswap ecx
mov dword [rdx], ecx
mov rcx, rbp
bswap eax
mov dword [rdx + 4], eax
lea rdx, [rsp + 0x20]
call fcn.1401116c0
mov ecx, dword [rbp + 0x18]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov dword [rsi], edx
mov ecx, dword [rbp + 0x1c]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov dword [rsi + 4], edx
mov ecx, dword [rbp + 0x20]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov dword [rsi + 8], edx
mov ecx, dword [rbp + 0x24]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov dword [rsi + 0xc], edx
mov ecx, dword [rbp + 0x28]
mov eax, ecx
shr eax, 0x10
mov edx, ecx
and edx, 0xff0000
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov dword [rsi + 0x10], edx
xor eax, eax
mov rsi, qword [r11 + 0x20]
mov qword [rbp + 0x2c], rax
mov dword [rbp + 0x18], 0x67452301
mov dword [rbp + 0x1c], 0xefcdab89
mov dword [rbp + 0x20], 0x98badcfe
mov dword [rbp + 0x24], 0x10325476
mov dword [rbp + 0x28], 0xc3d2e1f0
mov rbp, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14011233c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140112386
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140112386
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140112386
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140112386
cmp dword [rcx + 0x84], 0xe
jbe 0x140112386
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140112388
xor al, al
add rsp, 0x28
ret

Function at 0x14011c130
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x14011c10d
call fcn.14011cc8c
mov dword [rax], 0x16
call fcn.140120ba0
or eax, 0xffffffff
jmp 0x14011c12a
sub dword [rcx + 0x10], 1
jns 0x14011c11c
add rsp, 0x28
jmp 0x140123c48
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x14011c0ec
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
jne 0x140123c7a
call fcn.14011cc8c
mov dword [rax], 0x16
call fcn.140120ba0
jmp 0x140123d97
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140123d97
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x140123d97
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x140123ca9
lock or dword [rcx + 0x14], 0x10
jmp 0x140123d97
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x140123cbd
call fcn.14012c0b8
mov rbx, qword [rdi + 8]
mov rcx, rdi
mov qword [rdi], rbx
call fcn.140121dc4
mov r8d, dword [rdi + 0x20]
mov ecx, eax
mov rdx, rbx
call fcn.14012d01c
mov dword [rdi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x140123d85
mov eax, dword [rdi + 0x14]
or esi, 0xffffffff
test al, 6
jne 0x140123d50
mov rcx, rdi
call fcn.140121dc4
cmp eax, esi
je 0x140123d3b
mov rcx, rdi
call fcn.140121dc4
cmp eax, 0xfffffffe
je 0x140123d3b
mov rcx, rdi
call fcn.140121dc4
movsxd rbx, eax
lea r14, [0x14018bc80]
mov rcx, rdi
sar rbx, 6
call fcn.140121dc4
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x140123d42
lea rdx, [0x140185350]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140123d50
lock or dword [rdi + 0x14], 0x20
cmp dword [rdi + 0x20], 0x200
jne 0x140123d74
mov eax, dword [rdi + 0x14]
shr eax, 6
test al, 1
je 0x140123d74
mov eax, dword [rdi + 0x14]
shr eax, 8
test al, 1
jne 0x140123d74
mov dword [rdi + 0x20], 0x1000
mov rax, qword [rdi]
add dword [rdi + 0x10], esi
movzx esi, byte [rax]
inc rax
mov qword [rdi], rax
jmp 0x140123d9a
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rdi + 0x14], eax
and dword [rdi + 0x10], 0
or esi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x140120134
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14011ff60