joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007f640
Capabilities:
Get keyboard layout

Disassembly:
push rbx
push r14
sub rsp, 0x38
mov r14, rdx
mov rbx, rcx
nop
movzx eax, word [rbx]
cmp ax, 0x20
je 0x14007f65f
cmp ax, 9
jne 0x14007f665
add rbx, 2
jmp 0x14007f650
movzx eax, word [rbx]
test ax, ax
jne 0x14007f675
add rsp, 0x38
pop r14
pop rbx
ret
cmp word [rbx + 2], 0
lea rcx, [rbx + 2]
jne 0x14007f691
mov word [rdx + 2], ax
mov al, 1
mov byte [rdx], 0
add rsp, 0x38
pop r14
pop rbx
ret
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
xor sil, sil
mov byte [rdx], 1
mov edx, 0x2b
mov byte [rsp + 0x50], sil
mov qword [rsp + 0x30], rdi
call fcn.1400a9e38
mov rbp, rax
test rax, rax
je 0x14007f785
lea rdi, [rbp - 2]
cmp rdi, rbx
jbe 0x14007f6e8
nop word [rax + rax]
movzx eax, word [rdi]
cmp ax, 0x20
je 0x14007f6df
cmp ax, 9
jne 0x14007f6e8
sub rdi, 2
cmp rdi, rbx
ja 0x14007f6d0
sub rdi, rbx
lea rdx, [0x1400d0f38]
sar rdi, 1
mov rcx, rbx
inc rdi
mov r8, rdi
call fcn.1400aba40
test eax, eax
jne 0x14007f70d
or sil, 1
jmp 0x14007f743
mov r8, rdi
lea rdx, [0x1400d0f48]
mov rcx, rbx
call fcn.1400aba40
test eax, eax
jne 0x14007f729
or sil, 4
jmp 0x14007f743
mov r8, rdi
lea rdx, [0x1400d0f50]
mov rcx, rbx
call fcn.1400aba40
test eax, eax
jne 0x14007f7b9
or sil, 0x10
mov byte [rsp + 0x50], sil
lea rbx, [rbp + 2]
nop dword [rax]
movzx eax, word [rbx]
cmp ax, 0x20
je 0x14007f75f
cmp ax, 9
jne 0x14007f765
add rbx, 2
jmp 0x14007f750
cmp word [rbx], 0
je 0x14007f7b9
mov edx, 0x2b
lea rcx, [rbx + 2]
call fcn.1400a9e38
mov rbp, rax
test rax, rax
jne 0x14007f6c1
xor ecx, ecx
cmp word [rbx + 2], cx
jne 0x14007f7bd
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx ecx, word [rbx]
mov rdi, rax
call qword [sym.imp.USER32.dll_CharLowerW]
mov r9b, 1
lea rdx, [rsp + 0x50]
mov rcx, rax
mov r8, rdi
call fcn.1400167c0
movzx esi, byte [rsp + 0x50]
jmp 0x14007f7d5
xor al, al
jmp 0x14007f804
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140016650
movzx eax, al
mov word [r14 + 2], ax
test sil, 1
je 0x14007f7e7
or byte [r14], 8
test sil, 4
je 0x14007f7f1
or byte [r14], 0x10
test sil, 0x10
je 0x14007f7fb
or byte [r14], 4
cmp word [r14 + 2], 0
setne al
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x30]
add rsp, 0x38
pop r14
pop rbx
ret
Function at 0x140087cc0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x30030
call fcn.1400bfa50
sub rsp, rax
mov rbx, qword [rsp + 0x30060]
mov rsi, r9
mov rdi, r8
mov rax, rdx
test rbx, rbx
je 0x140087cf9
cmp word [rbx], 0
jne 0x140087d00
lea rbx, [0x1400e7b18]
xor ecx, ecx
lea r9, [rsp + 0x30060]
mov word [rsp + 0x10030], cx
lea r8, [rsp + 0x30]
mov word [rsp + 0x30040], cx
mov edx, 0x8000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp word [rsi], 0
je 0x140087d9e
cmp word [rdi], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30040]
cmovne rcx, rdi
mov dword [rsp + 0x20], 0xffff
lea r9, [rsp + 0x10030]
mov r8, rbx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov rcx, qword [0x1401070a0]
lea rdx, [rsp + 0x10030]
xor r9d, r9d
mov byte [rsp + 0x20], 1
or r8, 0xffffffffffffffff
call fcn.14008f120
lea r11, [rsp + 0x30030]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
cmp word [rdi], 0
je 0x140087dc2
lea r9, [rsp + 0x30]
mov r8d, 0xffff
lea rdx, [rsp + 0x10030]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
jmp 0x140087dda
lea r8, [rsp + 0x30]
mov edx, 0xffff
lea rcx, [rsp + 0x10030]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
test eax, eax
je 0x140087d69
lea rax, [rsp + 0x10030]
mov ecx, 0xa
nop dword [rax + rax]
cmp word [rax], 0
jne 0x140087e04
cmp word [rax + 2], 0
je 0x140087d69
mov word [rax], cx
add rax, 2
jmp 0x140087df0

Function at 0x140087e10
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
mov rsi, rcx
xor edx, edx
mov ebx, 1
call fcn.14008c900
test al, al
jne 0x140087f2a
mov qword [rsp + 0x78], r15
xor r9d, r9d
xor r15d, r15d
xor r8d, r8d
mov qword [rsp + 0x30], r15
mov edx, 0x40000000
mov dword [rsp + 0x28], r15d
mov rcx, rsi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140087f1b
mov qword [rsp + 0x60], rbp
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x68], r14
nop word [rax + rax]
inc rcx
cmp word [rdi + rcx*2], r15w
jne 0x140087e80
mov eax, ecx
lea ebp, [rcx*2 + 2]
lea r14, [rdi + rax*2]
mov qword [rsp + 0x20], r15
mov eax, 0x5d
lea r9, [rsp + 0x70]
lea rdx, [0x1400ed1d8]
mov word [r14], ax
mov rcx, rsi
lea r8d, [rax - 0x59]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140087eec
cmp dword [rsp + 0x70], 4
jne 0x140087eec
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], r15
mov r8d, ebp
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140087eec
cmp dword [rsp + 0x70], ebp
je 0x140087eef
mov ebx, r15d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x60]
test eax, eax
mov word [r14], r15w
mov r14, qword [rsp + 0x68]
cmove ebx, r15d
mov r15, qword [rsp + 0x78]
mov eax, ebx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
mov eax, ebx
mov r15, qword [rsp + 0x78]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
mov eax, ebx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x140088a20
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rsi, r9
mov rdi, r8
mov rbp, rdx
mov r14, rcx
test rdx, rdx
je 0x140088b5c
test r8, r8
je 0x140088a53
cmp word [r8], 0
jne 0x140088a5c
test rsi, rsi
je 0x140088b5c
mov rax, qword [0x140100a58]
xor r8d, r8d
mov rdx, rdi
mov rcx, rbp
mov r9d, dword [rax + 0x110]
lea rax, [rsp + 0x58]
or r9d, 0x2001f
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x140088b4d
mov rcx, qword [rsp + 0x58]
test rsi, rsi
jne 0x140088b37
call fcn.1400888f0
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140088b4d
mov eax, dword [0x140109c40]
test al, 1
jne 0x140088af8
or eax, 1
lea rcx, [0x1400eb5d0]
mov dword [0x140109c40], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x1400ed208]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
mov qword [0x140109c48], rax
jmp 0x140088aff
mov r10, qword [0x140109c48]
mov rax, qword [0x140100a58]
mov r8d, dword [rax + 0x110]
test r8d, r8d
je 0x140088b27
test r10, r10
je 0x140088b27
xor r9d, r9d
mov rdx, rdi
mov rcx, rbp
call r10
mov ebx, eax
jmp 0x140088b4d
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
jmp 0x140088b4d
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 0xffffffff
jne 0x140088b61
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x140088b63
mov ebx, 0x57
mov ecx, ebx
mov rax, qword [0x140100a58]
test ebx, ebx
setne dl
mov dword [rax + 0x40], ecx
mov rcx, r14
call fcn.140038ea0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x14008ef00
Capabilities:
Write clipboard data

Disassembly:
push rbx
push rsi
sub rsp, 0x28
mov rsi, rcx
mov rbx, rdx
lea rcx, [0x140107f00]
call fcn.1400057e0
test eax, eax
jne 0x14008ef3d
lea r8, [0x1400cef3c]
lea rdx, [0x1400cf380]
lea rcx, [0x1401072b0]
add rsp, 0x28
pop rsi
pop rbx
jmp fcn.1400395f0
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.USER32.dll_EmptyClipboard]
lea r14, [rsi + rbx]
xor r12d, r12d
lea rbx, [rsi + 4]
cmp rbx, r14
ja 0x14008f002
mov r15d, dword [rsi]
test r15d, r15d
je 0x14008f002
mov rax, rbx
add rbx, 8
cmp rbx, r14
ja 0x14008f002
mov edi, dword [rax]
mov rsi, rbx
add rbx, rdi
cmp rbx, r14
ja 0x14008f002
mov rdx, r12
test rdi, rdi
mov ecx, 0x42
sete dl
add rdx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbp, rax
test rax, rax
je 0x14008f0c0
test rdi, rdi
je 0x14008efe9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x14008f061
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call fcn.1400a9a00
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rsi, rbx
mov rdx, rbp
mov ecx, r15d
call qword [sym.imp.USER32.dll_SetClipboardData]
lea rbx, [rsi + 4]
cmp rbx, r14
jbe 0x14008ef70
cmp dword [0x140107f2c], r12d
je 0x14008f03c
cmp qword [0x140107f10], r12
je 0x14008f028
mov rcx, qword [0x140107f00]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x140107f10], r12
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x140107f2c], r12d
mov qword [0x140107f00], r12
mov eax, 1
mov r14, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbx
ret
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x140107f2c], r12d
je 0x14008f0a4
cmp qword [0x140107f10], r12
je 0x14008f090
mov rcx, qword [0x140107f00]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x140107f10], r12
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x140107f2c], r12d
mov qword [0x140107f00], r12
lea r8, [0x1400cef3c]
lea rdx, [0x1400cf348]
lea rcx, [0x1401072b0]
call fcn.1400395f0
jmp 0x14008f041
cmp dword [0x140107f2c], r12d
je 0x14008f0fa
cmp qword [0x140107f10], r12
je 0x14008f0e6
mov rcx, qword [0x140107f00]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x140107f10], r12
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x140107f2c], r12d
mov qword [0x140107f00], r12
lea r8, [0x1400cef3c]
lea rdx, [0x1400e29b0]
lea rcx, [0x1401072b0]
call fcn.1400395f0
jmp 0x14008f041
Function at 0x14008f570
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, rdx
movzx ecx, byte [rcx + 0x23]
test ecx, ecx
je 0x14008f7b0
mov qword [rsp + 0x50], rsi
sub ecx, 1
je 0x14008f60d
sub ecx, 1
je 0x14008f5d6
cmp ecx, 1
je 0x14008f5ba
mov rdx, qword [rdi + 0x28]
mov rcx, rbx
call qword [rdi + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
test rbx, rbx
je 0x14008f5c4
xor esi, esi
mov word [rdx], si
xor eax, eax
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
lea rcx, [0x140107f00]
call fcn.1400050a0
xor esi, esi
mov ecx, 0xffffffff
cmp rax, rcx
cmove rax, rsi
test rbx, rbx
je 0x14008f750
mov word [rbx + rax*2], si
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, rdi
call fcn.140001320
cmp dword [0x140105b28], 0
jne 0x14008f70e
cmp qword [rdi + 0x10], 0
jne 0x14008f70e
cmp qword [0x140109880], rdi
jne 0x14008f63b
test rbx, rbx
jne 0x14008f6ba
mov rcx, qword [rdi + 0x28]
lea rdx, [rsp + 0x40]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14008f6b5
xor esi, esi
mov qword [0x140109880], rsi
test rbx, rbx
je 0x14008f6a3
mov edx, dword [0x140105b3c]
test edx, edx
je 0x14008f685
mov r9, qword [rdi + 0x28]
lea r8, [0x1400ed760]
lea rcx, [0x1401072b0]
mov qword [rsp + 0x20], rsi
call fcn.14003a040
mov rcx, qword [rdi + 0x28]
mov rdx, rbx
call fcn.14008d1b0
mov rsi, qword [rsp + 0x50]
mov eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
dec eax
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
test rbx, rbx
je 0x14008f6f5
cmp byte [rdi + 0x23], 0
jne 0x14008f6c6
mov rax, qword [rdi + 0x10]
jmp 0x14008f6c9
mov rax, rdi
test byte [rax + 0x21], 4
je 0x14008f6d7
mov rdx, rdi
call fcn.14003a190
xor esi, esi
mov word [rbx], si
xor eax, eax
mov qword [0x140109880], rsi
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x50]
xor eax, eax
mov qword [0x140109880], rdi
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov r8, qword [rdi + 0x10]
mov qword [rsp + 0x48], rbp
mov rbp, r8
shr rbp, 1
test rbx, rbx
je 0x14008f7ab
test r8, r8
jne 0x14008f760
xor esi, esi
mov rax, rdi
cmp byte [rdi + 0x23], sil
cmove rax, rsi
test byte [rax + 0x21], 4
je 0x14008f746
mov rdx, rdi
call fcn.14003a190
mov word [rbx], si
xor eax, eax
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdi + 8]
cmp rbx, rdx
je 0x14008f7ab
cmp r8, 0x186a0
jae 0x14008f79d
movzx eax, word [rdx]
test ax, ax
je 0x14008f793
nop word [rax + rax]
mov word [rbx], ax
lea rdx, [rdx + 2]
movzx eax, word [rdx]
add rbx, 2
test ax, ax
jne 0x14008f780
xor esi, esi
mov rax, rbp
mov word [rbx], si
jmp 0x14008f74b
mov rcx, rbx
call fcn.1400a9a00
xor esi, esi
mov word [rbx + rbp*2], si
mov rax, rbp
jmp 0x14008f74b
mov rcx, qword [rdi + 0x10]
call fcn.14008f570
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00406810]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x00406820]
mov dword [rax], 1
mov rax, qword [0x00406830]
mov dword [rax], 1
mov rax, qword [0x00406800]
mov dword [rax], 1
mov rax, qword [0x004066c0]
cmp word [rax], 0x5a4d
je 0x4010d0
mov rax, qword [0x004067f0]
mov dword [0x00409008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010c2
mov ecx, 2
call sym.__set_app_type
mov rcx, 0xffffffffffffffff
call dbg._encode_pointer
mov rdx, qword [0x00406750]
mov qword [rdx], rax
mov rdx, qword [0x00406740]
mov qword [rdx], rax
mov rax, qword [0x004067b0]
mov edx, dword [rax]
mov rax, qword [sym.imp.msvcrt.dll__fmode]
mov rax, qword [rax]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x00406670]
cmp dword [rax], 1
je 0x401120
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401133
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058
Function at 0x403750
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x00409064]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x40386a
mov rax, qword [0x00409068]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x40379e
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x403850
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x403782
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x4038a2
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x00409068]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call dbg._GetPEImageBase
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x00409068]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x403885
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x403849
sub eax, 0x40
and eax, 0xffffffbf
je 0x403849
mov r9, rbp
add r9, qword [0x00409068]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x403871
add dword [0x00409064], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.memcpy
xor ebp, ebp
jmp 0x4037ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
mov rax, qword [0x00409068]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbp + 8]
call dbg.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call dbg.__report_error
nop
nop word cs:[rax + rax]

Function at 0x404480
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x404490
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x4044a0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x4044e1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x4044d8
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x4044e3
add rax, 0x28
cmp rax, r9
jne 0x4044c4
xor eax, eax
repz ret

Function at 0x404590
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x004066c0]
cmp word [rbx], 0x5a4d
je 0x4045b0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, rcx
mov rcx, rbx
call sym._ValidateImageBase.part.0
test eax, eax
je 0x4045a4
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp dbg._FindPESection
Function at 0x404800
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004099c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004099a0]
test rbx, rbx
je 0x404854
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x40484b
test rsi, rsi
je 0x40484b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x404830
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x004099c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
Function at 0x14019b000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
push rbp
mov rbp, rsp
sub rsp, 0x20
and rsp, 0xfffffffffffffff0
lea rbx, [0x14010e000]
movabs rdi, 0
push rbx
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
push rcx
push rsi
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
mov rsi, qword [rdx + 0x50]
movzx rcx, word [rdx + 0x4a]
xor r9, r9
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
mov rdx, qword [rdx + 0x20]
push r9
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov ecx, dword [rax + 0x18]
mov r8d, dword [rax + 0x20]
push rax
add r8, rdx
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
pop r8
add rax, rdx
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x140001860
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call fcn.140002670
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
nop word [rax + rax]
Function at 0x1400018d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x1400070a4]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x140001a80
mov rax, qword [0x1400070a8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14000191c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x1400019a7
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x140001900
mov rcx, r12
call fcn.140002380
mov rbp, rax
test rax, rax
je 0x140001add
mov rax, qword [0x1400070a8]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.1400024b0
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1400070a8]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140001ac2
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400019a0
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140001a30
add dword [0x1400070a4], 1
cmp ebx, 8
jae 0x1400019d8
test bl, 4
jne 0x140001a90
test ebx, ebx
je 0x1400019c9
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x140001ab0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x1400019c9
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x140001a0a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rdi, qword [0x1400070a8]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400019a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140001860
xor edi, edi
jmp 0x140001927
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x1400019c9
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x1400019c9
mov rax, qword [0x1400070a8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.140001860
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140001860
nop
nop dword [rax]