joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003010
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]

Function at 0x140003080
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x140010334]
mov rbx, rcx
test esi, esi
jle 0x1400031b0
mov rax, qword [0x140010338]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x1400030cb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140003155
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x1400030b0
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
mov rdi, rax
test rax, rax
je 0x1400031d2
mov rax, qword [0x140010338]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call sym._GetPEImageBase
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x140010338]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400031b7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x14000314e
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x140003160
add dword [0x140010334], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x140010338]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000314e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
nop dword [rax]
xor esi, esi
jmp 0x1400030d8
mov rax, qword [0x140010338]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call sym.__report_error
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call sym.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x140003880
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp edx, 2
je 0x1400039b0
ja 0x1400038c8
test edx, edx
je 0x140003948
mov eax, dword [0x140010388]
test eax, eax
je 0x140003a30
mov dword [0x140010388], 1
mov eax, 1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp edx, 3
jne 0x1400038b5
mov eax, dword [0x140010388]
test eax, eax
je 0x1400038b5
lea r12, [0x1400103a0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140010380]
test rbx, rbx
je 0x140003934
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x140003a58
test eax, eax
jne 0x140003a58
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140003908
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1400038b5
mov eax, dword [0x140010388]
test eax, eax
jne 0x1400039c8
mov eax, dword [0x140010388]
cmp eax, 1
jne 0x1400038b5
mov rbx, qword [0x140010380]
test rbx, rbx
je 0x140003981
nop dword [rax]
mov rcx, rbx
mov rbx, qword [rbx + 0x10]
call sym.free
test rbx, rbx
jne 0x140003970
lea rcx, [0x1400103a0]
mov qword [0x140010380], 0
mov dword [0x140010388], 0
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
jmp 0x1400038b5
call sym._fpreset
mov eax, 1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea r12, [0x1400103a0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140010380]
test rbx, rbx
je 0x140003a1c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop word [rax + rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140003a48
test rsi, rsi
je 0x140003a48
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400039f8
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x140003952
lea rcx, [0x1400103a0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x1400038ab
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400039f8
jmp 0x140003a1c
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140003908
jmp 0x140003934

Function at 0x140003a70
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140003a88
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140003a90
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140003aa0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x140003aed
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x140003ae4
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140003aef
add rax, 0x28
cmp rax, r9
jne 0x140003ad0
xor eax, eax
ret
Function at 0x140003af0
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x140003b80
mov rdx, qword [0x14000ca00]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x140003b6e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x140003b6e
cmp word [rax + 0x18], 0x20b
jne 0x140003b6e
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x140003b80
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x140003b59
add rbx, 0x28
cmp rbx, rdi
je 0x140003b80
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x140003b50
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x140003b90
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r8, qword [0x14000ca00]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x140003bb0
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x140003bb8
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140003bb0
movzx eax, word [rdx + 0x14]
sub rcx, r8
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x140003c05
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140003bfc
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140003bb0
add rax, 0x28
cmp rax, r9
jne 0x140003be8
xor eax, eax
ret

Function at 0x140003c10
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000ca00]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x140003c2f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140003c38
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x140003c2f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140003c50
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x14000ca00]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x140003c70
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x140003c78
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140003c70
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x140003cc0
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x140003cb7
test rcx, rcx
je 0x140003c70
sub rcx, 1
add rax, 0x28
cmp rdx, rax
jne 0x140003ca8
xor eax, eax
ret

Function at 0x140003cd0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000ca00]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140003cef
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140003cf8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140003d10
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14000ca00]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140003d30
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140003d38
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140003d30
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x140003d30
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x140003d84
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140003d90
add rdx, 0x28
cmp r9, rdx
jne 0x140003d70
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x140003da0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x14000ca00]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
jne 0x140003dc4
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
cmp dword [rcx], 0x4550
je 0x140003dd0
mov rax, r9
ret
cmp word [rcx + 0x18], 0x20b
jne 0x140003dc4
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x140003dc4
movzx edx, word [rcx + 0x14]
movzx r10d, word [rcx + 6]
lea rdx, [rcx + rdx + 0x18]
test r10w, r10w
je 0x140003dc4
lea ecx, [r10 - 1]
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
nop dword [rax + rax]
mov r9d, dword [rdx + 0xc]
mov rcx, r9
cmp rax, r9
jb 0x140003e1c
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x140003e30
add rdx, 0x28
cmp rdx, r10
jne 0x140003e08
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x140003e40
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x140003e4e
mov edx, dword [rax + 0xc]
test edx, edx
je 0x140003e25
test r8d, r8d
jg 0x140003e38
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x1400114ba
Capabilities:
Terminate process

Disassembly:
jmp 0x14001fff0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x1400115ff
Capabilities:
Parse pe header

Disassembly:
jmp 0x140022560
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140022580
xor al, al
jmp 0x140022601
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140022593
xor al, al
jmp 0x140022601
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400225bd
xor al, al
jmp 0x140022601
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400225d1
xor al, al
jmp 0x140022601
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400225e3
xor al, al
jmp 0x140022601
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400225ff
xor al, al
jmp 0x140022601
mov al, 1
add rsp, 0x38
ret
Function at 0x1400117e4
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x14001abe0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x458
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x478]
mov rax, qword [0x140031040]
xor rax, rbp
mov qword [rbp + 0x418], rax
mov dword [rbp + 0x404], 0
lea rcx, [0x1400380ff]
call fcn.140011866
nop
mov dword [rbp + 0x224], 0x200
lea rax, [rbp + 0x248]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystemBIOS
mov rcx, qword [rbp + 0x448]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rbp + 0x264], eax
cmp dword [rbp + 0x264], 0
je 0x14001acd2
lea rdx, str.Failed_to_open_registry_key.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14001146f
lea rdx, [0x140011429]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rdx, [0x14002b04c]
mov rcx, qword [rbp + 0x440]
call fcn.1400112a8
mov eax, dword [rbp + 0x404]
or eax, 1
mov dword [rbp + 0x404], eax
mov rax, qword [rbp + 0x440]
jmp 0x14001adaa
mov rcx, qword [rbp + 0x450]
call fcn.1400112b7
lea rcx, [rbp + 0x224]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp + 0x248]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp + 0x264], eax
mov rcx, qword [rbp + 0x248]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0x264], 0
je 0x14001ad84
lea rdx, str.Failed_to_query_registry_value:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14001146f
mov rdx, qword [rbp + 0x450]
mov rcx, rax
call fcn.1400114d8
lea rdx, [0x140011429]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rdx, [0x14002b04c]
mov rcx, qword [rbp + 0x440]
call fcn.1400112a8
mov eax, dword [rbp + 0x404]
or eax, 1
mov dword [rbp + 0x404], eax
mov rax, qword [rbp + 0x440]
jmp 0x14001adaa
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x440]
call fcn.1400112a8
mov eax, dword [rbp + 0x404]
or eax, 1
mov dword [rbp + 0x404], eax
mov rax, qword [rbp + 0x440]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14002a3e0]
call fcn.140011721
mov rax, rdi
mov rcx, qword [rbp + 0x418]
xor rcx, rbp
call fcn.14001141f
lea rsp, [rbp + 0x428]
pop rdi
pop rbp
ret
Function at 0x14001fcc0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400118b6
movzx eax, al
test eax, eax
jne 0x14001fce0
mov ecx, 7
call fcn.14001172b
nop
mov byte [rsp + 0x20], 0
call fcn.140011771
mov byte [rsp + 0x21], al
cmp dword [0x140031bb8], 1
jne 0x14001fd04
mov ecx, 7
call fcn.14001172b
nop
jmp 0x14001fd5c
cmp dword [0x140031bb8], 0
jne 0x14001fd57
mov dword [0x140031bb8], 1
lea rdx, [0x140029770]
lea rcx, [0x140029440]
call fcn.140011401
test eax, eax
je 0x14001fd38
mov eax, 0xff
jmp 0x14001fe61
lea rdx, [0x140029330]
lea rcx, [section..rdata]
call fcn.140011753
mov dword [0x140031bb8], 2
jmp 0x14001fd5c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011712
call fcn.140011631
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x14001fdb9
mov rcx, qword [rsp + 0x30]
call fcn.140011339
movzx eax, al
test eax, eax
je 0x14001fdb9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140039020]
nop
call fcn.140011686
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001fded
mov rcx, qword [rsp + 0x38]
call fcn.140011339
movzx eax, al
test eax, eax
je 0x14001fded
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011834
nop
call fcn.14001ff10
mov dword [rsp + 0x28], eax
call fcn.1400115ff
movzx eax, al
test eax, eax
jne 0x14001fe0c
mov ecx, dword [rsp + 0x28]
call fcn.1400110af
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001fe1b
call fcn.140011848
nop
xor edx, edx
mov cl, 1
call fcn.1400112fd
mov eax, dword [rsp + 0x28]
jmp 0x14001fe61
add rsp, 0x68
ret
Function at 0x180001000
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
sub rsp, 0x1f8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
cmp edx, 1
jne 0x18000110d
lea rdx, [0x1800031dc]
mov qword [rsp + 0x1f0], rbx
lea rcx, str.hello.txt
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov edx, 0xa
lea rcx, [rsp + 0x1d0]
mov r8, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
movsd xmm0, qword [rsp + 0x1d0]
movzx eax, word [rsp + 0x1d8]
movsd qword [rsp + 0x40], xmm0
mov word [rsp + 0x48], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, 0xa
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
movsd xmm0, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov rbx, rax
mov edx, 0xa
mov r8d, 0x40
mov rcx, rbx
movsd qword [rax], xmm0
movzx eax, word [rsp + 0x48]
mov word [rbx + 8], ax
xor eax, eax
mov qword [rsp + 0x40], rax
mov word [rsp + 0x48], ax
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor r9d, r9d
mov qword [rsp + 0x28], 0
mov r8, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x1f0]
mov eax, 1
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.180001140
add rsp, 0x1f8
ret
Function at 0x18000145b
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm6
mov rax, qword [0x180051110]
xor rax, rsp
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm3, xmmword [rcx + 0x30]
movaps xmmword [rsp + 0x20], xmm0
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmmword [rsp + 0x50], xmm3
movdqa xmmword [rsp + 0x40], xmm2
mov r9d, dword [rsp + 0x20]
mov r11d, dword [rsp + 0x24]
mov eax, dword [rsp + 0x28]
pshufd xmm4, xmmword [rsp + 0x30], 0x93
pshufd xmm5, xmmword [rsp + 0x50], 0x39
mov r10d, dword [rsp + 0x2c]
mov r8d, 0x16
pshufd xmm0, xmmword [rsp + 0x40], 0x39
pshufd xmm1, xmm4, 0xe5
movd xmm2, eax
movd xmm3, r11d
punpckldq xmm3, xmm2
movd xmm2, r10d
punpckldq xmm2, xmm1
punpcklqdq xmm2, xmm3
movd xmm1, r9d
shufps xmm1, xmm4, 0
shufps xmm1, xmm4, 0xe2
paddd xmm1, xmm2
pshufd xmm2, xmm1, 0x4e
pxor xmm2, xmm5
movdqa xmm3, xmm2
psrld xmm3, 0x10
pslld xmm2, 0x10
por xmm2, xmm3
paddd xmm0, xmm2
pshufd xmm3, xmm0, 0x4e
pxor xmm3, xmm4
movdqa xmm4, xmm3
psrld xmm4, 0x14
pslld xmm3, 0xc
por xmm3, xmm4
paddd xmm1, xmm3
pshufd xmm4, xmm1, 0x93
pshufd xmm2, xmm2, 0x39
pxor xmm2, xmm4
movdqa xmm4, xmm2
psrld xmm4, 0x18
pslld xmm2, 8
por xmm2, xmm4
pshufd xmm4, xmm2, 0x93
paddd xmm4, xmm0
pshufd xmm0, xmm3, 0x39
pshufd xmm3, xmm4, 0x93
pxor xmm3, xmm0
movdqa xmm0, xmm3
psrld xmm0, 0x19
pslld xmm3, 7
por xmm3, xmm0
paddd xmm1, xmm3
pxor xmm2, xmm1
movdqa xmm0, xmm2
psrld xmm0, 0x10
pslld xmm2, 0x10
por xmm2, xmm0
paddd xmm4, xmm2
pxor xmm3, xmm4
movdqa xmm0, xmm3
psrld xmm0, 0x14
pslld xmm3, 0xc
por xmm3, xmm0
paddd xmm1, xmm3
pxor xmm2, xmm1
movdqa xmm0, xmm2
psrld xmm0, 0x18
pslld xmm2, 8
por xmm2, xmm0
movdqa xmm0, xmm4
paddd xmm0, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm3
psrld xmm4, 0x19
pslld xmm3, 7
por xmm3, xmm4
pshufd xmm4, xmm3, 0x93
pshufd xmm5, xmm2, 0x93
movd r10d, xmm1
pshufd xmm6, xmm1, 0xe5
movd r9d, xmm6
pshufd xmm6, xmm1, 0x4e
movd r11d, xmm6
pshufd xmm1, xmm1, 0xe7
movd eax, xmm1
add r8d, 0xfffffffe
cmp r8d, 2
ja 0x1800014ce
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x24], r11d
mov dword [rsp + 0x28], eax
movdqa xmmword [rsp + 0x30], xmm3
mov dword [rsp + 0x2c], r10d
pshufd xmm1, xmm2, 0x4e
movdqa xmmword [rsp + 0x50], xmm1
pshufd xmm0, xmm0, 0x93
movdqa xmmword [rsp + 0x40], xmm0
add r9d, dword [rcx]
mov dword [rsp + 0x20], r9d
mov r8d, 1
mov eax, dword [rcx + r8*4]
add dword [rsp + r8*4 + 0x20], eax
inc r8
cmp r8, 0x10
jne 0x180001668
xor eax, eax
mov ecx, dword [rsp + rax*4 + 0x20]
mov dword [rdx + rax*4], ecx
inc rax
cmp rax, 0x10
jne 0x18000167c
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.180027370
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
ret
Function at 0x180001818
Capabilities:
Get file size
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rbx, rdx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor edi, edi
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800018cc
mov rcx, rsi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1800018ca
cmp qword [rbx], 0
jle 0x1800018ca
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor edi, edi
mov rcx, rsi
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test rax, rax
je 0x1800018cc
mov rbx, rax
mov qword [rsp + 0x20], 0
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800018cc
xor edi, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x1800020cc
Capabilities:
Hash data using sha1

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
mov ebx, dword [rcx + 0x40]
mov esi, dword [rcx + 0x44]
mov ebp, dword [rcx + 0x48]
mov edi, dword [rcx + 0x4c]
mov eax, dword [rcx + 0x50]
xor edx, edx
mov r8d, 0xf
mov r9d, ebx
mov r11d, esi
mov r14d, ebp
mov r10d, edi
mov rdi, rdx
cmp edx, 0x10
jb 0x18000212a
lea esi, [rdx + 0xd]
and esi, r8d
lea edi, [rdx + 8]
and edi, r8d
mov ebx, dword [rcx + rdi*4]
xor ebx, dword [rcx + rsi*4]
lea esi, [rdx + 2]
and esi, r8d
xor ebx, dword [rcx + rsi*4]
mov edi, edx
and edi, r8d
xor ebx, dword [rcx + rdi*4]
rol ebx, 1
mov dword [rcx + rdi*4], ebx
cmp edx, 0x13
ja 0x180002165
mov ebx, r10d
xor ebx, r14d
and ebx, r11d
xor ebx, r10d
add ebx, 0x5a827999
mov esi, r9d
rol esi, 5
add eax, esi
add eax, ebx
mov ebx, eax
add ebx, dword [rcx + rdi*4]
rol r11d, 0x1e
inc rdx
mov eax, r10d
mov edi, r14d
mov ebp, r11d
mov esi, r9d
cmp edx, 0x50
jne 0x1800020e9
jmp 0x1800021aa
cmp edx, 0x27
ja 0x18000217b
mov ebx, r10d
xor ebx, r14d
xor ebx, r11d
add ebx, 0x6ed9eba1
jmp 0x18000213c
cmp edx, 0x3b
ja 0x180002199
mov esi, r14d
and esi, r11d
mov ebx, r14d
or ebx, r11d
and ebx, r10d
or ebx, esi
add ebx, 0x8f1bbcdc
jmp 0x18000213c
mov ebx, r10d
xor ebx, r14d
xor ebx, r11d
add ebx, 0xca62c1d6
jmp 0x18000213c
movdqu xmm0, xmmword [rcx + 0x40]
movd xmm1, r14d
movd xmm2, r11d
punpckldq xmm2, xmm1
movd xmm1, r9d
movd xmm3, ebx
punpckldq xmm3, xmm1
punpcklqdq xmm3, xmm2
paddd xmm3, xmm0
movdqu xmmword [rcx + 0x40], xmm3
add dword [rcx + 0x50], r10d
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x180002525
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [rcx + 0x3c]
lea ecx, [rax - 1]
cmp ecx, 0x3ff
ja 0x1800025a4
cmp dword [rsi + rax + 0x8c], 0
je 0x1800025a4
mov edi, dword [rsi + rax + 0x88]
cmp dword [rsi + rdi + 0x18], 0
je 0x1800025a4
cmp dword [rsi + rdi + 0x14], 0
je 0x1800025a4
mov r12, rdx
mov r13d, dword [rsi + rdi + 0x20]
mov r15d, dword [rsi + rdi + 0x24]
add r13, rsi
xor r14d, r14d
xor ebx, ebx
mov ecx, dword [r13 + rbx*4]
add rcx, rsi
call fcn.180003a50
cmp rax, r12
je 0x180002596
inc rbx
cmp ebx, dword [rsi + rdi + 0x18]
jb 0x180002579
jmp 0x1800025a7
add r15, rsi
movzx eax, word [r15 + rbx*2]
cmp dword [rsi + rdi + 0x14], eax
jae 0x1800025ba
xor r14d, r14d
mov rax, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, dword [rsi + rdi + 0x1c]
add rcx, rsi
mov r14d, dword [rcx + rax*4]
add r14, rsi
jmp 0x1800025a7