joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e17f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rdx
mov rbx, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x4e1902
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x4e1822
mov rdi, rax
cmp qword [rax], 0
jne 0x4e18fc
mov ecx, dword [rbx + 0x18]
test ecx, ecx
je 0x4e1920
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x4e1939
mov rdi, rax
test rax, rax
jne 0x4e1895
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x38], rbx
mov ecx, 0x20
mov edx, 8
call fcn.00422020
test rax, rax
je 0x4e1955
mov rdi, rax
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov ecx, dword [rbx + 0x18]
test ecx, ecx
je 0x4e1946
dec ecx
mov rdx, rdi
call sub.kernel32.dll_TlsSetValue
test rsi, rsi
je 0x4e18b6
mov rax, qword [rsi]
mov qword [rsi], 0
mov rcx, rax
test rax, rax
je 0x4e18ba
mov rax, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
jmp 0x4e18ba
xor eax, eax
xor ecx, ecx
mov rdx, qword [rdi + 0x10]
mov qword [rsp + 0x30], rdx
movups xmm0, xmmword [rdi]
movaps xmmword [rsp + 0x20], xmm0
mov qword [rdi], 1
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rcx
cmp qword [rsp + 0x20], 0
je 0x4e18fc
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x4e18fc
lock dec qword [rax]
jne 0x4e18fc
lea rcx, [rsp + 0x30]
call fcn.004cb220
add rdi, 8
jmp 0x4e193b
mov rcx, rbx
call fcn.004be160
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x4e1815
jmp 0x4e1822
mov rcx, rbx
call fcn.004be160
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x4e183e
xor edi, edi
mov rax, rdi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov rcx, rbx
call fcn.004be160
mov ecx, eax
jmp 0x4e188d
mov ecx, 0x20
mov edx, 8
call fcn.0050fe70
ud2

Function at 0x4e2220
Capabilities:
Create udp socket

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov edi, r8d
mov rsi, rcx
cmp word [rdx], 0
mov eax, 2
mov ebx, 0x17
cmove ebx, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
mov ecx, ebx
mov edx, r8d
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x4e2274
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x4e230a
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2726
je 0x4e2287
cmp eax, 0x2739
jne 0x4e22d5
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, ebx
mov edx, edi
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x4e22d0
mov rdi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.kernel32.dll_SetHandleInformation
test eax, eax
je 0x4e22ea
mov qword [rsi + 8], rdi
mov qword [rsi], 0
jmp 0x4e230a
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x4e230a
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rcx, rdi
call sub.ws2_32.dll_closesocket
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x4e2960
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
push rdi
sub rsp, 0x108
mov r10, r8
mov rsi, rcx
mov eax, dword [rsp + 0x140]
xorps xmm0, xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
mov dword [rsp + 0x3c], pe_nt_image_headers64
cmp r9, 0x7fffffff
mov r8d, 0x7fffffff
cmovb r8, r9
lea rcx, [rsp + 0x3c]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x20], rcx
mov rcx, rdx
mov rdx, r10
mov r9d, eax
call sub.ws2_32.dll_recvfrom
cmp eax, 0xffffffff
je 0x4e2a40
mov edi, eax
mov eax, dword [rsp + 0x3c]
movzx ecx, word [rsp + 0x80]
cmp ecx, 0x17
je 0x4e2a9e
cmp ecx, 2
jne 0x4e2a92
cmp eax, 0x10
jb 0x4e2bc2
mov ecx, dword [rsp + 0x84]
movzx edx, word [rsp + 0x82]
rol dx, 8
call fcn.005319f0
xor edx, edx
jmp 0x4e2aff
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x274a
jne 0x4e2b1e
mov eax, dword [rsp + 0x3c]
movzx ecx, word [rsp + 0x80]
cmp ecx, 0x17
je 0x4e2b34
cmp ecx, 2
jne 0x4e2a92
cmp eax, 0x10
jb 0x4e2bc2
mov ecx, dword [rsp + 0x84]
movzx edx, word [rsp + 0x82]
rol dx, 8
call fcn.005319f0
xor edx, edx
jmp 0x4e2b95
lea rax, [0x00642fa8]
jmp 0x4e2b26
cmp eax, 0x1c
jb 0x4e2bdc
movups xmm0, xmmword [rsp + 0x88]
movaps xmmword [rsp + 0x70], xmm0
movzx r8d, word [rsp + 0x82]
rol r8w, 8
mov r9d, dword [rsp + 0x84]
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x70]
call fcn.00531a40
mov eax, dword [rsp + 0x40]
shl rax, 0x10
mov rcx, qword [rsp + 0x44]
movups xmm0, xmmword [rsp + 0x4c]
movaps xmmword [rsp + 0x60], xmm0
mov dx, 1
movsxd r8, edi
mov dword [rsi + 0xa], eax
shr rax, 0x20
mov word [rsi + 0xe], ax
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi + 0x18], xmm0
mov qword [rsi], r8
jmp 0x4e2bb0
shl rax, 0x20
or rax, 2
mov qword [rsi], rax
mov word [rsi + 8], 2
jmp 0x4e2bb8
cmp eax, 0x1c
jb 0x4e2bdc
movups xmm0, xmmword [rsp + 0x88]
movaps xmmword [rsp + 0x70], xmm0
movzx r8d, word [rsp + 0x82]
rol r8w, 8
mov r9d, dword [rsp + 0x84]
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x70]
call fcn.00531a40
mov eax, dword [rsp + 0x40]
shl rax, 0x10
mov rcx, qword [rsp + 0x44]
movups xmm0, xmmword [rsp + 0x4c]
movaps xmmword [rsp + 0x60], xmm0
mov dx, 1
mov dword [rsi + 0xa], eax
shr rax, 0x20
mov word [rsi + 0xe], ax
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi + 0x18], xmm0
mov qword [rsi], 0
mov word [rsi + 8], dx
mov qword [rsi + 0x10], rcx
add rsp, 0x108
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in___
lea r8, [0x00643088]
mov edx, 0x42
call fcn.00532500
ud2
lea rcx, str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in6___library_std_src_sys_common_net.rs
lea r8, [0x00643028]
mov edx, 0x43
call fcn.00532500
ud2
Function at 0x50c610
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r8, qword [rcx]
test r8, r8
je 0x50c66b
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x50c66b
movzx eax, byte [r8 + rcx]
cmp eax, 0x49
je 0x50c686
cmp eax, 0x42
jne 0x50c66b
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x50c73a
cmp byte [r8 + r11], 0x5f
jne 0x50c73a
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x50c7ae
mov rcx, rsi
xor edx, edx
call fcn.0050b400
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.0050b400
test al, al
jne 0x50c848
mov r8, qword [rsi + 0x20]
test r8, r8
je 0x50c6c1
lea rcx, [0x006541fc]
mov edx, 1
call fcn.00519f30
test al, al
jne 0x50c848
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x50c67a
xor r14d, r14d
lea rbx, [0x006541f6]
nop word cs:[rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x50c6f9
test rax, rax
je 0x50c6f9
cmp byte [rax + rcx], 0x45
je 0x50c871
sub r14, 1
jb 0x50c71d
mov r8, qword [rsi + 0x20]
test r8, r8
je 0x50c71d
mov edx, 2
mov rcx, rbx
call fcn.00519f30
test al, al
jne 0x50c848
mov rcx, rsi
call fcn.0050bb30
test al, al
jne 0x50c848
mov rax, qword [rsi]
test rax, rax
jne 0x50c6e0
jmp 0x50c67a
xor eax, eax
mov edi, 0x3e
nop word cs:[rax + rax]
mov r9b, 1
cmp r11, r10
jae 0x50c80f
movzx edx, byte [r8 + r11]
cmp dl, 0x5f
je 0x50c7a2
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x50c78c
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x50c77b
add dl, 0xa9
jmp 0x50c78a
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x50c80f
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x50c80f
movzx edx, bl
add rax, rdx
jae 0x50c750
jmp 0x50c80f
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x50c80f
cmp rax, rcx
jae 0x50c80c
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x50c850
cmp qword [rsi + 0x20], 0
je 0x50c86a
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.0050c610
mov edi, eax
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
cmp al, 2
jne 0x50c67a
jmp 0x50c848
mov r9b, 1
xor edi, edi
mov r8, qword [rsi + 0x20]
test r8, r8
je 0x50c85f
lea rax, [0x006541c1]
lea rcx, str.recursion_limit_reachedinvalid_syntax
test r9b, r9b
cmovne rcx, rax
xor r9b, 1
movzx eax, r9b
lea rdx, [rax + rax*8]
or rdx, 0x10
call fcn.00519f30
test al, al
je 0x50c85f
mov dil, 2
jmp 0x50c67a
mov dil, 1
xor r9d, r9d
mov r8, qword [rsi + 0x20]
test r8, r8
jne 0x50c81a
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x50c67a
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x50c67a
Function at 0x53a130
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x53a1aa
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x53a1a0
cmp r10, r11
jb 0x53a243
cmp r10, rdx
ja 0x53a257
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x53a1a2
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x53a180
jmp 0x53a217
ja 0x53a1aa
mov r11, r10
cmp rax, r8
jne 0x53a152
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x53a21b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x53a1f0
mov r8, r10
sub ecx, r9d
jns 0x53a20e
jmp 0x53a21d
cmp r10, rdx
je 0x53a229
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x53a21d
xor al, 1
cmp r8, rdx
jne 0x53a1d0
jmp 0x53a21d
xor eax, eax
jmp 0x53a21d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.called__Option::unwrap____on_a__None__valueunicode_code_point_out_of_range
lea r8, str.library_core_src_unicode_printable.rs
mov edx, 0x2b
call fcn.00532500
ud2
lea r8, str.library_core_src_unicode_printable.rs
mov rcx, r11
mov rdx, r10
call fcn.0053def0
ud2
lea r8, str.library_core_src_unicode_printable.rs
mov rcx, r10
call fcn.0053de60
ud2
Function at 0x543ff0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00544d10
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.00544d10
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x544060
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x00684304]
mov r12, rcx
test ebx, ebx
jle 0x544190
mov rax, qword [0x00684308]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x5440ac
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x544133
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x544090
mov rcx, r12
call fcn.00544a10
mov rsi, rax
test rax, rax
je 0x5441b2
mov rax, qword [0x00684308]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call fcn.00544b40
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00684308]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x544197
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x54412c
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x544140
add dword [0x00684304], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x00684308]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x54412c
call qword [sym.imp.kernel32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00543ff0
nop dword [rax]
xor ebx, ebx
jmp 0x5440b7
mov rax, qword [0x00684308]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.00543ff0
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.00543ff0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x544680
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00684360]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00684340]
test rbx, rbx
je 0x5446d4
mov rdi, qword [sym.imp.kernel32.dll_TlsGetValue]
mov rsi, qword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x5446cb
test r12, r12
je 0x5446cb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x5446b0
lea rcx, [0x00684360]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x544a10
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x006661b0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x544a30
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x544a38
ret
cmp word [r8 + 0x18], 0x20b
jne 0x544a30
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x544a85
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x544a7c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x544a30
add rax, 0x28
cmp rax, r9
jne 0x544a68
xor eax, eax
ret

Function at 0x544a90
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x006661b0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x544ab0
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x544ab8
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x544ab0
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x544b40
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x006661b0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x544b60
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x544b68
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x1400010c0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
cmp eax, 1
je 0x140001134
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, [0x1400044a8]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140006718], rax
cmp qword [0x140006718], 0xffffffffffffffff
je 0x140001127
jmp 0x140001134
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400010dc
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [0x140006718]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [0x140006718]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [0x140006718]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400027a0
add rsp, 0x58
ret
Function at 0x140001350
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push rdi
sub rsp, 0x540
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea r8, [0x1400044c8]
mov edx, 0x82
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
jne 0x140001393
xor eax, eax
jmp 0x140001554
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
jne 0x1400013b4
xor eax, eax
jmp 0x140001554
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
jne 0x1400013d3
xor eax, eax
jmp 0x140001554
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
jne 0x1400013f2
xor eax, eax
jmp 0x140001554
lea rdx, [rsp + 0x320]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x14000141a
cmp dword [rsp + 0x50], 0x104
jbe 0x140001421
xor eax, eax
jmp 0x140001554
lea r9, str.PipServer.exe
lea r8, [rsp + 0x320]
lea rdx, [0x1400044f0]
lea rcx, [rsp + 0x110]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0xffffffffffffffff
jne 0x14000148b
xor eax, eax
jmp 0x140001554
mov dword [rsp + 0x80], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x80]
mov r8d, dword [rsp + 0x54]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x58], eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0xa0]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
mov dword [rsp + 0xa0], 0x68
lea rax, [rsp + 0x88]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rax, [rsp + 0x88]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.1400027a0
add rsp, 0x540
pop rdi
ret
Function at 0x140001c50
Capabilities:
Get graphical window text
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x268
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov edx, 0x66
mov rcx, qword [rsp + 0x270]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r8d, pe_nt_image_headers64
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], 0xffffffffffffffff
inc qword [rsp + 0x20]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
cmp word [rax + rcx*2], 0
jne 0x140001ca8
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0x2e
jae 0x140001d27
xor r9d, r9d
lea r8, [0x140004500]
lea rdx, str.Khong_du_dai
mov rcx, qword [rsp + 0x270]
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 1
call fcn.1400027c8
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov byte [rax], 0x55
mov edx, 1
mov rcx, qword [rsp + 0x28]
call fcn.1400010c0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, [rsp + 0x50]
call fcn.140001570
call fcn.140001740
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400027a0
add rsp, 0x268
ret
Function at 0x140001f40
Capabilities:
Hide graphical window

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0xa0]
mov qword [0x140006710], rax
mov dword [rsp + 0x6c], 0x10e
mov dword [rsp + 0x68], 0xb4
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x78]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x80]
sub ecx, eax
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x84]
sub ecx, eax
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x70], eax
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x20], eax
mov r9d, 0xcf0000
lea r8, [0x1400067f0]
lea rdx, [0x140006720]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
jne 0x14000203d
xor eax, eax
jmp 0x14000218a
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 0x65
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x14
mov dword [rsp + 0x30], 0xaa
mov dword [rsp + 0x28], 0xa
mov dword [rsp + 0x20], 0x1e
mov r9d, 0x50000000
lea r8, str.Give_me_flag_or_you_die
lea rdx, [0x140004578]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 0x66
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x14
mov dword [rsp + 0x30], 0xc8
mov dword [rsp + 0x28], 0x23
mov dword [rsp + 0x20], 0x1e
mov r9d, 0x50800080
xor r8d, r8d
lea rdx, str.EDIT
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 0x67
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x1e
mov dword [rsp + 0x30], 0x64
mov dword [rsp + 0x28], 0x46
mov dword [rsp + 0x20], 0x50
mov r9d, 0x50000001
lea r8, str.Submit
lea rdx, str.BUTTON
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov edx, dword [rsp + 0xa8]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400027a0
add rsp, 0x98
ret
Function at 0x140003210
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000325a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000325a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000325a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000325a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000325a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000325c
xor al, al
add rsp, 0x28
ret