joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800e3870
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x28]
cmp rdi, 0x40000000
jbe 0x1800e38ab
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x1801c5d30]
lea r15, [rdi + 0x40000000]
cmp qword [rsp + 0x30], r15
cmovbe r15, qword [rsp + 0x30]
sub r15, 0xfff
test rsi, rsi
je 0x1800e38ed
cmp rsi, r14
jb 0x1800e38e5
cmp rsi, r15
jae 0x1800e38e5
cmp qword [rsi + 8], 0
jne 0x1800e3ab5
mov rsi, qword [rsi]
test rsi, rsi
jne 0x1800e38d0
mov qword [rsp + 0xa0], rbx
mov rbx, rdi
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0xb0], r12
mov r12d, 0x40
cmp rdi, r14
jb 0x1800e3979
nop dword [rax]
nop word [rax + rax]
mov ebp, dword [rsp + 0x48]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x1800e3979
nop word [rax + rax]
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800e3979
cmp dword [rsp + 0x70], 0x10000
je 0x1800e39fb
mov rbx, qword [rsp + 0x58]
cmp rbx, rbp
jb 0x1800e3979
sub rbx, rbp
cmp rbx, r14
jae 0x1800e3940
test rsi, rsi
jne 0x1800e3a60
cmp rdi, r15
ja 0x1800e3a9d
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x1800e3a9d
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800e3a9d
cmp dword [rsp + 0x70], 0x10000
je 0x1800e3a31
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x68]
add rdi, qword [rsp + 0x50]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x1800e39b2
jmp 0x1800e3a9d
test rbx, rbx
je 0x1800e3979
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x1800e3a60
cmp rbx, r14
jae 0x1800e3920
jmp 0x1800e3982
test rdi, rdi
je 0x1800e3a9d
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x1800e3a60
cmp rdi, r15
jbe 0x1800e3990
jmp 0x1800e3a9d
xor eax, eax
lea rcx, [rsi + 0x40]
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], eax
nop dword [rax]
mov rax, qword [rsi + 8]
add r12, 0x40
mov qword [rcx], rax
mov qword [rsi + 8], rcx
add rcx, 0x40
cmp r12, 0xfc0
jbe 0x1800e3a70
mov rax, qword [0x1801c5d30]
mov qword [rsi], rax
mov qword [0x1801c5d30], rsi
mov r12, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
mov rax, rsi
mov rsi, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
ret
Function at 0x1800f33d0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1800f33e3
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.1800f39f0
lea rdx, [0x1801b9258]
lea rcx, [rsp + 0x20]
call fcn.18010e044
int3

Function at 0x1800fdc2c
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1801c1b58]
xor edx, edx
jmp fcn.1800f33d0

Function at 0x1800fe5bc
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1801c1b58]
jmp fcn.1800f33d0

Function at 0x180109d1c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x180109dd8]
mov r9, qword [r9 + 8]
jmp fcn.1800fb5e4

Function at 0x180109db0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x180109de8]
mov r9, qword [r9 + 8]
jmp fcn.1800fb5e4
Function at 0x180128e2c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x180128ccc
call fcn.1801151b4
mov dword [rax], 0x16
call fcn.180110f14
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x180128cb4
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x180128cb4
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x180128cfe
lock or dword [rax + 0x14], 0x10
jmp 0x180128cb4
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x180128d1b
mov rcx, qword [rbp + 0x10]
call fcn.18012b83c
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.180127368
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.180128004
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x180128d72
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x180128cb4
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x180128dde
mov rcx, qword [rbp + 0x10]
call fcn.180127368
cmp eax, 0xffffffff
je 0x180128dc5
mov rcx, qword [rbp + 0x10]
call fcn.180127368
cmp eax, 0xfffffffe
je 0x180128dc5
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.180127368
movsxd rdi, eax
lea rsi, [0x1801c21f0]
mov rcx, rbx
sar rdi, 6
call fcn.180127368
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x180128dcc
lea rax, [0x1801bc550]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x180128dde
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x180128e14
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x180128e10
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x180128e10
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x180128cb7
jmp 0x180128c84
Function at 0x180136850
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov byte [rsp + 0x20], 0
mov dword [rsp + 0x24], 0
mov rcx, qword [rsp + 0x40]
call fcn.1801366e0
mov rax, qword [rsp + 0x40]
cmp qword [rax + 8], 0
je 0x1801368b8
lea r9, [rsp + 0x24]
mov r8d, 0x40
mov edx, 8
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1801368b8
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 8]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov qword [rax], rcx
mov byte [rsp + 0x20], 1
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x1801368d0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov byte [rsp + 0x20], 0
mov dword [rsp + 0x24], 0
lea r9, [rsp + 0x24]
mov r8d, 0x40
mov edx, 8
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1801369a6
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
cmp qword [rax], rcx
je 0x180136985
movzx eax, byte [rsp + 0x58]
test eax, eax
je 0x180136968
mov rcx, qword [rsp + 0x48]
call fcn.1801385f0
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jbe 0x180136956
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
jmp 0x180136966
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx]
mov qword [rax], rcx
jmp 0x180136978
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx]
mov qword [rax], rcx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov qword [rax], rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 0x10], rcx
mov byte [rsp + 0x20], 1
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x180136b70
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov byte [rsp + 0x20], 0
mov rcx, qword [rsp + 0x40]
call fcn.1801385f0
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jbe 0x180136bf8
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
cmp qword [rax], rcx
je 0x180136bdd
mov dword [rsp + 0x24], 0
lea r9, [rsp + 0x24]
mov r8d, 0x40
mov edx, 8
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180136bdd
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
mov byte [rsp + 0x20], 1
mov edx, 0x14
mov rcx, qword [rsp + 0x28]
call fcn.180137450
movzx eax, al
test eax, eax
je 0x180136bf8
mov byte [rsp + 0x20], 1
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x180137200
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x48
mov byte [rsp + 0x20], 0
mov rax, qword [rsp + 0x60]
mov edx, 1
mov rcx, rax
call fcn.180033110
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1801373da
mov rax, qword [rsp + 0x60]
movzx eax, byte [rax + 0x30]
test eax, eax
jne 0x18013732a
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
call qword [rax]
mov rax, qword [rsp + 0x60]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rcx, qword [rcx]
mov qword [rax + 0x18], rcx
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x70]
mov qword [rax + 0x28], rcx
movzx eax, byte [rsp + 0x78]
test eax, eax
je 0x1801372aa
mov edx, 0x14
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x18]
call fcn.180137450
mov rax, qword [rsp + 0x60]
add rax, 8
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rcx
mov rdx, rax
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
call qword [rax + 8]
mov byte [rsp + 0x20], al
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov dl, 1
mov rcx, qword [rsp + 0x28]
call qword [rax + 0x18]
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x180137325
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x18]
mov rcx, qword [rsp + 0x60]
lea rdi, [rcx + 0x38]
mov rsi, rax
mov ecx, 5
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x60]
mov byte [rax + 0x30], 1
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x20]
mov qword [rax], rcx
jmp 0x1801373c1
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rcx, qword [rcx]
cmp qword [rax + 0x18], rcx
jne 0x1801373c1
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x70]
cmp qword [rax + 0x28], rcx
jne 0x1801373c1
mov dword [rsp + 0x24], 0
lea r9, [rsp + 0x24]
mov r8d, 0x40
mov edx, 5
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1801373c1
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x18]
movzx eax, byte [rax]
cmp eax, 0xe9
jne 0x1801373c1
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x20]
mov qword [rax], rcx
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x18]
mov rcx, qword [rsp + 0x60]
mov rdi, rax
lea rsi, [rcx + 0x38]
mov ecx, 5
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x20], 1
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 8
mov rcx, qword [rsp + 0x38]
call fcn.1800ef470
movzx eax, byte [rsp + 0x20]
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x180137450
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xc8
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov byte [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0x78]
call fcn.180136d90
nop
lea rcx, [rsp + 0x78]
call fcn.18000c990
test rax, rax
jbe 0x180137618
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x1801374d7
movzx eax, byte [rsp + 0x20]
mov byte [rsp + 0x21], al
lea rcx, [rsp + 0x78]
call fcn.180004990
movzx eax, byte [rsp + 0x21]
jmp 0x180137630
mov rax, qword [rsp + 0x40]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
call fcn.18000cab0
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.180136c10
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180137618
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call fcn.180136fc0
movzx eax, al
test eax, eax
je 0x180137604
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0xe0]
sub rcx, rax
mov rax, rcx
mov rdx, rax
mov rcx, qword [rsp + 0x68]
call fcn.180136ef0
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x180137604
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov r8, qword [rsp + 0xe8]
mov rdx, qword [rsp + 0xe0]
mov rcx, rax
call fcn.18010e7e0
test eax, eax
je 0x180137604
mov dword [rsp + 0x38], 0
lea r9, [rsp + 0x38]
mov r8d, 0x40
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180137604
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov rdi, qword [rsp + 0xe0]
mov rsi, rax
mov rcx, qword [rsp + 0xe8]
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x20], 1
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x70]
call fcn.1800ef470
movzx eax, byte [rsp + 0x20]
mov byte [rsp + 0x22], al
lea rcx, [rsp + 0x78]
call fcn.180004990
movzx eax, byte [rsp + 0x22]
add rsp, 0xc8
pop rdi
pop rsi
ret

Function at 0x180137710
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
cmp qword [rsp + 0x40], 0
je 0x18013772e
cmp qword [rsp + 0x48], 0
jne 0x180137730
jmp 0x18013779d
mov edx, 8
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x180137758
mov edx, 8
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x18013775a
jmp 0x18013779d
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
cmp qword [rax], rcx
je 0x18013779d
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, 8
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18013779d
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov qword [rax], rcx
add rsp, 0x38
ret
Function at 0x180138520
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
mov qword [rax], 0
mov rax, qword [rsp + 0x50]
mov qword [rax + 8], 0
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x10], 0
lea rcx, [0x1801c52e8]
call fcn.1800a93c0
cmp qword [0x1801c49c8], 0
jne 0x1801385ba
cmp qword [0x1801c49c0], 0
jne 0x1801385ba
mov byte [0x1801c49d0], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x180137850]
xor edx, edx
xor ecx, ecx
call fcn.180115330
mov qword [0x1801c49c0], rax
cmp qword [0x1801c49c0], 0
je 0x1801385ba
mov edx, 0xfffffffe
mov rcx, qword [0x1801c49c0]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rax, qword [0x1801c49c8]
inc rax
mov qword [0x1801c49c8], rax
lea rcx, [0x1801c52e8]
call fcn.1800a93d0
mov rax, qword [rsp + 0x50]
add rsp, 0x48
ret
Function at 0x1401bc0b0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401bc0fa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401bc0fa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401bc0fa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401bc0fa
cmp dword [rcx + 0x84], 0xe
jbe 0x1401bc0fa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401bc0fc
xor al, al
add rsp, 0x28
ret

Function at 0x1401bf54c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1401bf5bb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401bf5bb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401bf5bb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401bf5bb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401bf5bb
cmp dword [rcx + 0x84], 0xe
jbe 0x1401bf5bb
cmp dword [rcx + 0xf8], 0
je 0x1401bf5bb
mov ecx, ebx
call fcn.1401bf66c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1401bf448
nop
cmp dword [rbp + 0x20], 0
je 0x1401bf609
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1401bf614
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1401bf54c

Function at 0x1401bf750
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1401bf54c
Function at 0x1401c2804
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1401c2834
xor eax, eax
jmp 0x1401c28f7
mov rbp, rbx
cmp word [rax], si
je 0x1401c2859
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1401c2840
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1401c283c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1401c2724
movsxd r14, eax
test eax, eax
jne 0x1401c2897
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1401c282d
mov rcx, r14
call fcn.1401c3298
mov rdi, rax
test rax, rax
jne 0x1401c28b0
xor ecx, ecx
call fcn.1401c0d5c
jmp 0x1401c288c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1401c2724
test eax, eax
jne 0x1401c28e1
mov rcx, rdi
call fcn.1401c0d5c
jmp 0x1401c28eb
xor ecx, ecx
call fcn.1401c0d5c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1401c8060
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401c8088
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1401c8088
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140011217
Capabilities:
Terminate process

Disassembly:
jmp 0x140013640
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011299
Capabilities:
Execute command

Disassembly:
jmp 0x140011ab0
push rbp
push rsi
push rdi
sub rsp, 0x190
lea rbp, [rsp + 0x20]
lea rcx, [0x1400230a6]
call fcn.1400113a2
call fcn.1400113d9
xor ecx, ecx
call fcn.1400120a0
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_srand]
lea rcx, [rbp + 0xe8]
call fcn.140011316
lea rcx, [0x14001e900]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x6c
rep movsb byte [rdi], byte [rsi]
lea rcx, [0x14001af00]
call qword [sym.imp.ucrtbased.dll_system]
xor eax, eax
cmp eax, 1
je 0x140011c23
call fcn.1400110a0
call qword [sym.imp.ucrtbased.dll__getch]
sub eax, 0x30
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
mov dword [rbp + 0x164], eax
cmp dword [rbp + 0x164], 0
je 0x140011bc5
cmp dword [rbp + 0x164], 1
je 0x140011b5f
cmp dword [rbp + 0x164], 2
je 0x140011b83
cmp dword [rbp + 0x164], 3
je 0x140011ba4
jmp 0x140011bed
lea rcx, [0x14001af00]
call qword [sym.imp.ucrtbased.dll_system]
call fcn.1400112a3
lea rcx, [0x14001af00]
call qword [sym.imp.ucrtbased.dll_system]
jmp 0x140011c1e
lea rcx, [0x14001af00]
call qword [sym.imp.ucrtbased.dll_system]
call fcn.1400110f0
lea rcx, [0x14001af00]
call qword [sym.imp.ucrtbased.dll_system]
jmp 0x140011c1e
lea rcx, [0x14001af00]
call qword [sym.imp.ucrtbased.dll_system]
call fcn.14001106e
lea rcx, [0x14001af00]
call qword [sym.imp.ucrtbased.dll_system]
jmp 0x140011c1e
lea rcx, [0x14001af00]
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, [0x14001af08]
call fcn.1400111b3
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
jmp 0x140011c25
lea rcx, [0x14001af00]
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, [0x14001af28]
call fcn.1400111b3
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14001af00]
call qword [sym.imp.ucrtbased.dll_system]
jmp 0x140011b0d
xor eax, eax
lea rsp, [rbp + 0x170]
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400112a8
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014980
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400149a0
xor al, al
jmp 0x140014a21
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400149b3
xor al, al
jmp 0x140014a21
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400149dd
xor al, al
jmp 0x140014a21
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400149f1
xor al, al
jmp 0x140014a21
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014a03
xor al, al
jmp 0x140014a21
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014a1f
xor al, al
jmp 0x140014a21
mov al, 1
add rsp, 0x38
ret