joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402623c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rsi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp byte [rcx + 0x17], 0
jns 0x1402623e7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140262417
test eax, 0x410
sete sil
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.140159120
test al, al
jne 0x140262429
xor esi, esi
jmp 0x1402623fb
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x73
mov r9d, 2
call fcn.14023ca20
lea rcx, [rsp + 0x40]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.140206b20
mov rcx, rax
mov rdx, rsi
call fcn.14023dcd0
mov rcx, rdi
call fcn.14023caa0
jmp 0x140262425

Function at 0x140262480
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rsi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp byte [rcx + 0x17], 0
jns 0x1402624a7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1402624be
and eax, 0x410
cmp eax, 0x410
je 0x140262503
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x1402624ca
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x1402624e7
mov ecx, 2
call fcn.140159120
test al, al
jne 0x140262524
xor edi, edi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, edi
add rsp, 0x178
pop rdi
pop rsi
ret
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1401ce5b0
mov rcx, rsi
add rsp, 0x178
pop rdi
pop rsi
jmp fcn.140262580
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x93
mov r9d, 2
call fcn.14023ca20
lea rcx, [rsp + 0x40]
lea rdx, str.DeleteFile
mov r8d, 0xb
call fcn.140206b20
mov rcx, rax
mov rdx, rsi
call fcn.14023dcd0
mov rcx, rdi
call fcn.14023caa0
jmp 0x1402624e5

Function at 0x140262580
Capabilities:
Delete directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x1402625a8
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, eax
test eax, eax
jne 0x1402625c2
mov ecx, 2
call fcn.140159120
test al, al
jne 0x1402625e4
test edi, edi
setne bl
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, ebx
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.filesystem_win.cc
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov r8d, 0x2f
mov r9d, 2
call fcn.14023ca20
lea rcx, [rsp + 0x38]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.140206b20
mov rcx, rax
mov rdx, rsi
call fcn.14023dcd0
mov rcx, rbx
call fcn.14023caa0
jmp 0x1402625c2
Function at 0x140266f60
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov qword [rcx + 8], rdx
mov eax, dword [0x1402e6c20]
mov ecx, dword [0x1402db110]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1402671c9
mov rax, qword [0x1402e6c18]
test rax, rax
je 0x140267047
lea rdx, [rsp + 0x174]
mov dword [rdx], 0xaaaaaaaa
mov rcx, rdi
call qword [0x1402f5008]
test eax, eax
je 0x140266ff5
cmp dword [rsp + 0x174], 0
setne byte [rsi + 0x99]
je 0x14026704e
mov byte [rsi + 0x98], 0
mov dl, 1
jmp 0x140267083
cmp dword [0x1402e5a28], 2
jg 0x140267047
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str.process_info.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r8d, 0x4d
mov r9d, 2
call fcn.14023ca20
lea rcx, [rsp + 0x40]
lea rdx, [0x1402b2494]
mov r8d, 0xe
call fcn.140206b20
mov rcx, rbx
call fcn.14023caa0
mov byte [rsi + 0x99], 0
movaps xmm0, xmmword [0x14029ca60]
lea rbx, [rsp + 0x30]
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [rbx], 9
sete byte [rsi + 0x98]
cmp byte [rsi + 0x99], 0
setne dl
lea rax, [rsi + 0x48]
lea r9, [rsi + 0x40]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov r8, rsi
call fcn.140267210
test al, al
jne 0x140267106
cmp dword [0x1402e5a28], 2
jg 0x1402670e7
lea rdx, str.process_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x242
mov r9d, 2
call fcn.1400036d0
lea rcx, [rsp + 0x40]
lea rdx, str.GetProcessBasicInformation_failed
mov r8d, 0x21
call fcn.140206b20
mov rcx, rsi
call fcn.1400038d0
xor esi, esi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, esi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
cmp byte [rsi + 0x98], 0
mov rdx, qword [rsi + 0x40]
mov rcx, rdi
mov r8, rsi
jne 0x140267120
call fcn.140267aa0
jmp 0x140267125
call fcn.140267430
test al, al
jne 0x140267169
cmp dword [0x1402e5a28], 2
jg 0x1402670e7
lea rdx, str.process_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x24b
mov r9d, 2
call fcn.1400036d0
lea rcx, [rsp + 0x40]
lea rdx, str.ReadProcessData_failed
mov r8d, 0x16
jmp 0x1402670da
mov dl, byte [rsi + 0x98]
mov rcx, rdi
mov r8, rsi
call fcn.14013c980
mov sil, 1
test al, al
jne 0x1402670e9
cmp dword [0x1402e5a28], 2
jg 0x1402670e7
lea rdx, str.process_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x250
mov r9d, 2
call fcn.1400036d0
lea rcx, [rsp + 0x40]
lea rdx, str.ReadMemoryInfo_failed
mov r8d, 0x15
jmp 0x1402670da
lea rcx, [0x1402e6c20]
call fcn.1401cc16c
cmp dword [0x1402e6c20], 0xffffffff
jne 0x140266fab
lea rcx, [0x1402a4d98]
lea rdx, str.::IsWow64Process
xor r8d, r8d
call fcn.14013c860
mov qword [0x1402e6c18], rax
lea rcx, [0x1402e6c20]
call fcn.1401cc1d4
jmp 0x140266fab
Function at 0x140272e20
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, r8
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, 0xaaaaaaaa
lea rdi, [rsp + 0x44]
mov dword [rdi], eax
lea r8, [rsp + 0x40]
mov dword [r8], eax
lea rax, [rsp + 0x3c]
mov dword [rax], 4
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rdi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x140272e80
mov eax, dword [rsp + 0x40]
mov dword [rsi], eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret

Function at 0x140272f40
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x1a0
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x198], rax
movaps xmm0, xmmword [0x14029ca60]
lea rsi, [rsp + 0x160]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsi + 0x20], 0x100
jb 0x140272f94
mov ecx, 1
call fcn.140159120
test al, al
jne 0x140272fc3
mov eax, dword [rsp + 0x180]
cmp eax, 0x100
mov esi, 0xff
cmovb esi, eax
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, esi
add rsp, 0x1a0
pop rsi
ret
lea rdx, str.system_snapshot_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x10a
mov r9d, 1
call fcn.1400036d0
lea rcx, [rsp + 0x38]
lea rdx, str.dwNumberOfProcessors_exceeds_uint8_t_storage
mov r8d, 0x2c
call fcn.140206b20
mov rcx, rsi
call fcn.1400038d0
jmp 0x140272f94
Function at 0x140283d60
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x14029ca60]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.140209830
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.140288d60
test al, al
je 0x140283eb5
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x140283e2d
mov rcx, r14
call fcn.140209830
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0x108
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.140288d60
test al, al
je 0x140283e76
cmp dword [rbx], 0x4550
jne 0x140283ee6
mov sil, 1
test rdi, rdi
je 0x140283ec5
mov qword [rdi], r14
jmp 0x140283ec5
mov ecx, 1
call fcn.140159120
test al, al
je 0x140283ec3
lea rdx, str.pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.1400036d0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x140283f5a
mov ecx, 1
call fcn.140159120
test al, al
je 0x140283ec3
lea rdx, str.pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.1400036d0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x140283f54
mov ecx, 1
call fcn.140159120
test al, al
jne 0x140283f28
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.140159120
test al, al
je 0x140283ec3
lea rdx, str.pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.1400036d0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x140283f5a
lea rdx, str.pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.1400036d0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.140206b20
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x140283f6f
and r8d, 0x7f
jmp 0x140283f76
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.140206b20
mov rcx, rdi
call fcn.1400038d0
jmp 0x140283ec3
Function at 0x140283f90
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x14029ca60]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.140209830
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.140288d60
test al, al
je 0x1402840e5
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x14028405d
mov rcx, r14
call fcn.140209830
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0xf8
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.140288d60
test al, al
je 0x1402840a6
cmp dword [rbx], 0x4550
jne 0x140284116
mov sil, 1
test rdi, rdi
je 0x1402840f5
mov qword [rdi], r14
jmp 0x1402840f5
mov ecx, 1
call fcn.140159120
test al, al
je 0x1402840f3
lea rdx, str.pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.1400036d0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x14028418a
mov ecx, 1
call fcn.140159120
test al, al
je 0x1402840f3
lea rdx, str.pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.1400036d0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x140284184
mov ecx, 1
call fcn.140159120
test al, al
jne 0x140284158
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.140159120
test al, al
je 0x1402840f3
lea rdx, str.pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.1400036d0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x14028418a
lea rdx, str.pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.1400036d0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.140206b20
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x14028419f
and r8d, 0x7f
jmp 0x1402841a6
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.140206b20
mov rcx, rdi
call fcn.1400038d0
jmp 0x1402840f3
Function at 0x140001c34
Capabilities:
Encode data using xor

Disassembly:
add byte [rsi - 0x28], 0x51
stc
xor dword [r10 - 0x6747c396], ecx
mov ah, 0x16
add eax, 0x458ec23a
xor byte [r9 + 0x12], r11b
xor byte [r9 + 0x12], r11b
cli
and byte [rdi], ah
jl 0x140001c22
xor edx, eax
mov bh, 0x40
invalid

Function at 0x1400020c4
Capabilities:
Encode data using xor

Disassembly:
jg 0x1400020d8
push 0xffffffffdea55f33
invalid
add eax, 0x2fa9a9fb
outsb dx, byte [rsi]
retf

Function at 0x140005500
Capabilities:
Encode data using xor

Disassembly:
sub r15b, byte [r9 - 0x307ac61f]
mov fs, word [rdx]
stosb byte [rdi], al
add al, 0x92
mov esi, 0x2f3483a4
stosb byte [rdi], al
movsb byte [rdi], byte [rsi]
xor dword [rdi + rbp], 0xffffffaa
jne 0x1400054a0
invalid
jae 0x140005493
pop rcx
wait

Function at 0x140005ed8
Capabilities:
Encode data using xor

Disassembly:
ficomp word [rcx + 0x4a]
mov dword [rcx - 0x63121eaf], 0xf6696a24
add eax, 0x825acf90
xchg ecx, eax
add al, 0x9b
xor eax, 0x247f81d4
jne 0x140005ee6
and byte [rsi], ah
ret 0x26ac

Function at 0x14000a060
Capabilities:
Encode data using xor

Disassembly:
mov ch, 0x99
imul edi, dword [rdx + 0x28920452], 0x4d
rol byte [rsi - 0x27], cl
add eax, dword [rbx + 0x18]
mov al, 0xe
invalid

Function at 0x140011780
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc8
mov dword [rsp + 0xc0], 0x1aa04669
mov al, byte [rsp + 0xb5]
mov dl, al
xor dl, 0xff
mov byte [rsp + 0xb5], dl
mov qword [rsp + 0xa8], rcx
mov byte [rsp + 0xa7], al
call fcn.1400125b0
mov rcx, rax
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0x90], rax
call fcn.140013290
xor r8d, r8d
rol byte [rcx + rcx*4 - 0x3f], 0x44
mov eax, dword [rax + 0x88]
invalid
invalid
test byte [rax + rdi*4], ah

Function at 0x140011800
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r9d, r10d
mov r11, qword [rsp + 0x98]
add r11, r9
add ebx, ecx

Function at 0x14001185c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [rsi + r9 + 0x18], 0
mov word [rsp + 0x8e], bx
mov dword [rsp + 0x88], r8d
test byte [rax + rcx*4], ah
add byte [rax], al
add byte [rax], al
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], r11
mov dword [rsp + 0x70], ebx
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], rcx
je 0x14001192a
jmp 0x140011a75
mov eax, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x30]
xor edx, edx
mov r8, qword [rsp + 0x80]
or r8, r8
mov qword [rsp + 0xb8], r8
mov r9d, eax
mov r8d, r9d
mov r10, qword [rsp + 0x68]
mov r9d, dword [r10 + r8*4]
mov r8d, r9d
invalid
invalid
pushfq
and al, 0x98
Function at 0x140001154
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x10], 0
mov dword [rbp - 0x1c], 0x30
mov eax, dword [rbp - 0x1c]
mov rax, qword gs:[rax]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov rax, qword [rax + 8]
mov qword [rbp - 0x18], rax
mov dword [rbp - 4], 0
jmp 0x1400011ac
mov rax, qword [rbp - 0x10]
cmp rax, qword [rbp - 0x18]
jne 0x14000119e
mov dword [rbp - 4], 1
jmp 0x1400011e3
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [0x140120490]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x40], 0
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x30]
lock cmpxchg qword [rdx], rcx
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x14000118b
mov rax, qword [0x1401204a0]
mov eax, dword [rax]
cmp eax, 1
jne 0x1400011fd
mov ecx, 0x1f
call fcn.1401024e0
jmp 0x14000123c
mov rax, qword [0x1401204a0]
mov eax, dword [rax]
test eax, eax
jne 0x140001232
mov rax, qword [0x1401204a0]
mov dword [rax], 1
mov rax, qword [0x1401204e0]
mov rdx, rax
mov rax, qword [0x1401204d0]
mov rcx, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
jmp 0x14000123c
mov dword [0x140124024], 1
mov rax, qword [0x1401204a0]
mov eax, dword [rax]
cmp eax, 1
jne 0x140001270
mov rax, qword [0x1401204c0]
mov rdx, rax
mov rax, qword [0x1401204b0]
mov rcx, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov rax, qword [0x1401204a0]
mov dword [rax], 2
cmp dword [rbp - 4], 0
jne 0x140001294
mov rax, qword [0x140120490]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
mov rdx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
xchg qword [rax], rdx
mov rax, qword [0x1401203e0]
mov rax, qword [rax]
test rax, rax
je 0x1400012bf
mov rax, qword [0x1401203e0]
mov rax, qword [rax]
mov r8d, 0
mov edx, 2
mov ecx, 0
call rax
call fcn.140101768
mov rax, qword [0x140120520]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call rax
mov rdx, qword [0x140120480]
mov qword [rdx], rax
lea rax, section..text
mov rcx, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.140100f60
mov eax, dword [0x140124004]
lea rdx, [0x140124008]
mov ecx, eax
call fcn.14000147c
call fcn.140100cf7
mov rax, qword [0x140120410]
mov rax, qword [rax]
mov rdx, qword [0x140124010]
mov qword [rax], rdx
mov rcx, qword [0x140124010]
mov rdx, qword [0x140124008]
mov eax, dword [0x140124004]
mov r8, rcx
mov ecx, eax
call fcn.1400016d0
mov dword [0x14012401c], eax
mov eax, dword [0x140124020]
test eax, eax
jne 0x14000135d
mov eax, dword [0x14012401c]
mov ecx, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [0x140124024]
test eax, eax
jne 0x14000136c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x14012401c]
add rsp, 0x70
pop rbp
ret
Function at 0x140100f70
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.1401022d0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x140101c42
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140124168]
test eax, eax
je 0x140101cda
lea rax, [0x140124140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140124170]
mov qword [rbp - 8], rax
jmp 0x140101cbe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140101cb2
cmp qword [rbp - 0x10], 0
je 0x140101cb2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140101c78
lea rax, [0x140124140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x140101cdb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140101de0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140101e08
mov eax, 0
jmp 0x140101e56
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140101e31
mov eax, 0
jmp 0x140101e56
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140101e51
mov eax, 0
jmp 0x140101e56
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x140101e5c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x140101eda
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140101ed1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140101ed1
mov rax, qword [rbp - 8]
jmp 0x140101eef
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140101ea4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x14001bd90
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xa0
mov rax, qword [0x1400ea0c0]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov dil, 1
mov qword [rsp + 0xd0], rbx
movzx esi, dil
mov r14, rdx
mov rbp, rcx
nop word [rax + rax]
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14001bde6
test sil, sil
sete sil
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14001be4b
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [rsp + 0x58], 0x12
je 0x14001be48
test dil, dil
je 0x14001be4b
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x14001be05
jmp 0x14001be4b
xor dil, dil
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14001bf9e
mov rax, qword [0x1400ecee8]
test rax, rax
je 0x14001be74
mov rcx, qword [rax + 0x98]
jmp 0x14001be76
xor ecx, ecx
cmp qword [rcx + 0x48], 0
jne 0x14001be82
call fcn.14004b070
call fcn.14004c160
call fcn.140023740
movups xmm0, xmmword [r14]
lea rdx, [rsp + 0x30]
movsd xmm1, qword [r14 + 0x10]
movaps xmmword [rsp + 0x30], xmm0
movsd qword [rsp + 0x40], xmm1
call fcn.140007170
test sil, sil
je 0x14001bec1
movzx ecx, dil
call fcn.14001b7c0
mov r8d, 0x80088
jmp 0x14001bec7
mov r8d, 0x800a8
mov rcx, qword [rbp + 0x58]
mov edx, 0xffffffec
call qword [sym.imp.USER32.dll_SetWindowLongW]
call fcn.140025300
call fcn.140025720
mov rcx, qword [rbp + 0xb8]
lea r8, [rbp + 0xc8]
xorps xmm0, xmm0
xor r9d, r9d
movups xmmword [rsp + 0x80], xmm0
mov rax, qword [rcx]
lea edx, [r9 + 1]
call qword [rax + pe_nt_image_headers64]
mov rcx, qword [rbp + 0xb8]
lea r8, [rsp + 0x80]
mov rdx, qword [rbp + 0xc8]
mov rax, qword [rcx]
call qword [rax + 0x190]
mov rax, qword [0x1400ecee8]
mov rcx, qword [rax + 0x48d8]
mov rax, qword [rcx]
xor ecx, ecx
add rax, 0x48
cmp byte [rax], cl
cmovne rcx, rax
call fcn.14004a420
mov rcx, qword [rbp + 0xc0]
xor r8d, r8d
mov rax, qword [rcx]
lea edx, [r8 + 1]
call qword [rax + 0x40]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
test dil, dil
jne 0x14001bdd0
mov rbx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140072d20
mov rbp, qword [rsp + 0xd8]
add rsp, 0xa0
pop r14
pop rdi
pop rsi
ret
mov rcx, rbp
call fcn.14001bfb0
xor ecx, ecx
call fcn.14007a0dc
int3