joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140010640
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x1440
call fcn.140011e40
sub rsp, rax
mov rax, qword [0x14001d040]
xor rax, rsp
mov qword [rsp + 0x1438], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
movaps xmm0, xmmword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
movaps xmmword [rsp + 0x40], xmm0
movaps xmm1, xmmword [0x140015600]
movaps xmmword [rsp + 0x50], xmm1
movaps xmm0, xmmword [0x140015610]
movaps xmmword [rsp + 0x60], xmm0
movaps xmm1, xmmword [0x140015620]
movaps xmmword [rsp + 0x70], xmm1
movsd xmm0, qword [0x140015630]
movsd qword [rsp + 0x80], xmm0
movzx eax, word [0x140015638]
mov word [rsp + 0x88], ax
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rsp + 0x1414], 0xffffffff
mov dword [rsp + 0x94], eax
lea ecx, [rbp + 1]
nop dword [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x94], edx
inc rcx
cmp rcx, 0x270
jb 0x1400106f0
mov dword [rsp + 0x90], 0x270
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 7
mov word [rbx], bp
mov dword [rsp + 0x20], 1
mov edx, 0x17
mov rcx, rbx
call fcn.140010890
mov qword [rbx + 0x10], rbp
movdqa xmm0, xmmword [0x140015810]
movdqu xmmword [rsp + 0x1420], xmm0
mov dword [rsp + 0x1430], 3
lea rsi, [rsp + 0x1420]
mov r14d, 0x2d
mov edi, dword [rsi]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400107ae
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x1400107a3
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 7
jbe 0x14001079d
mov rax, qword [rbx]
mov dword [rax + rcx*2], r14d
jmp 0x1400107ae
mov r9d, r14d
mov rcx, rbx
call fcn.140010a10
test edi, edi
jle 0x14001080f
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov edx, 0x24
lea rcx, [rsp + 0x28]
call fcn.140010490
movzx r9d, word [rsp + rax*2 + 0x40]
mov rax, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rax, rdx
jae 0x140010801
lea rcx, [rax + 1]
mov qword [rbx + 0x10], rcx
mov rcx, rbx
cmp rdx, 7
jbe 0x1400107f5
mov rcx, qword [rbx]
mov word [rcx + rax*2], r9w
mov word [rcx + rax*2 + 2], bp
jmp 0x140010809
mov rcx, rbx
call fcn.140010a10
sub rdi, 1
jne 0x1400107b2
add rsi, 4
lea rax, [rsp + 0x1434]
cmp rsi, rax
jne 0x140010775
mov rax, rbx
mov rcx, qword [rsp + 0x1438]
xor rcx, rsp
call fcn.140010f20
lea r11, [rsp + 0x1440]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x140011b90
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140011bda
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140011bda
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140011bda
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140011bda
cmp dword [rcx + 0x84], 0xe
jbe 0x140011bda
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140011bdc
xor al, al
add rsp, 0x28
ret
Function at 0x140011bbc
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor edx, edx
mov rcx, qword gs:[0x60]
mov r8, qword [rbx + 0x28]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov r8, qword [rbx + 8]
and qword [rbx + 0x28], 0
cmp dword [r8], 2
jne 0x140011c13
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
and qword [rbx + 8], 0
mov r8, qword [rbx + 0x18]
cmp dword [r8], 2
jne case.default.0x140011c54
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
and qword [rbx + 0x18], 0
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov cl, 0x95
add al, 0xe4
fst dword [rdi + 0x4fe2039c]
pop rbp
out 0xa2, eax
movabs byte [0x401d802119a3f73c], al
xchg esp, eax
mov esi, 0x471d7421
mov edi, 0x4774730b
pop rcx
invalid
push rsp
mov esp, 0x7c3c67e4
pop rdi
invalid
scasb al, byte [rdi]
push rbx
jp 0x14003f99f
xchg edx, eax
cwde
mov edi, 0x3f168567
cld
fist word [rax + 0x3b3e1d26]
test byte [rsi + riz*2 + 0x5e], al
idiv dword [rbx + rdx - 0x47]
sbb bl, cl
retf 0x445f
and esp, edi
in al, dx
invalid
Function at 0x1400029b0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400029fa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400029fa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400029fa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400029fa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400029fa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400029fc
xor al, al
add rsp, 0x28
ret
Function at 0x401440
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r12, rcx
call qword [sym.imp.ucrtbase.dll_strlen]
mov rbx, rax
xor eax, eax
test rbx, rbx
je 0x401493
cmp byte [r12 + rbx - 1], 0xa
je 0x40146e
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x48]
xchg dword [0x00407104], eax
mov ecx, 2
call qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov edx, 1
mov r9, rax
mov r8, rbx
mov rcx, r12
call qword [sym.imp.ucrtbase.dll_fwrite]
add rsp, 0x28
pop rbx
pop r12
ret
Function at 0x401ac0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x100
mov ebx, ecx
mov rcx, rdx
mov rsi, rdx
mov rdi, r8
call dbg.__wine_dbg_get_channel_flags
movzx eax, al
bt eax, ebx
jae 0x401c98
mov ecx, dword [0x00407104]
xor eax, eax
mov rdx, qword gs:[0x30]
cmp dword [rdx + 0x48], ecx
je 0x401ba4
test byte [0x00403040], 8
jne 0x401c40
lea r12, [rsp + 0x30]
mov rbp, r12
test byte [0x00403050], 8
jne 0x401c00
mov rax, qword gs:[0x30]
mov r8d, dword [rax + 0x48]
lea rdx, str._04x:
mov rcx, rbp
call dbg.sprintf
test rdi, rdi
je 0x401b4b
cmp ebx, 3
jbe 0x401bb8
mov ecx, 2
call qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov r8, r12
mov r9, rax
mov ecx, dword [r8]
add r8, 4
lea edx, [rcx - 0x1010101]
not ecx
and edx, ecx
and edx, 0x80808080
je 0x401b5c
mov eax, edx
mov rcx, r12
shr eax, 0x10
test edx, 0x8080
cmove edx, eax
lea rax, [r8 + 2]
cmove r8, rax
mov eax, edx
add al, dl
mov edx, 1
sbb r8, 3
sub r8, r12
call qword [sym.imp.ucrtbase.dll_fwrite]
add rsp, 0x100
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cdqe
add rsi, 1
mov qword [rsp + 0x28], rdi
lea r8, str._s:_s:_s
lea rcx, [rbp + rax]
mov rax, r12
mov qword [rsp + 0x20], rsi
sub rax, rcx
lea rdx, [rax + 0xc8]
lea rax, str.fixme
mov r9, qword [rax + rbx*8]
call sym.snprintf.constprop.0
jmp 0x401b4b
lea rcx, [0x00403050]
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x401b25
mov rax, qword gs:[0x30]
mov r8d, dword [rax + 0x40]
mov rcx, rbp
lea rdx, str._04x:
call dbg.sprintf
cdqe
add rbp, rax
jmp 0x401b25
lea rcx, [0x00403040]
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x401b10
call qword [sym.imp.kernel32.dll_GetTickCount]
lea r12, [rsp + 0x30]
lea rdx, str._3u._03u:
mov r8d, eax
mov rcx, r12
mov r9, r8
imul r8, r8, 0x10624dd3
shr r8, 0x26
imul eax, r8d, 0x3e8
sub r9d, eax
call dbg.sprintf
movsxd rbp, eax
add rbp, r12
jmp 0x401b18
mov eax, 0xffffffff
jmp 0x401ba4

Function at 0x401dc0
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov ecx, 1
call sym._configure_wide_argv
call sym._initialize_wide_environment
call sym.__p___argc
mov r12d, dword [rax]
call sym.__p___wargv
mov r13, qword [rax]
call sym._get_initial_wide_environment
xor ecx, ecx
mov rbx, rax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x10]
mov edx, dword [rax + 0x3c]
cmp word [rax + rdx + 0x5c], 2
sete cl
add ecx, 1
call sym._set_app_type
mov ecx, r12d
mov r8, rbx
mov rdx, r13
call dbg.wmain
mov ecx, eax
call sym.exit
nop
nop
nop
nop
Function at 0x401e30
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push rsi
push rbx
sub rsp, 0x98
call qword [sym.imp.kernel32.dll_GetCommandLineW]
mov rbx, rax
movzx eax, word [rax]
test ax, ax
je 0x401eb4
cmp ax, 9
je 0x401ea0
cmp ax, 0x20
je 0x401ea0
xor r9d, r9d
xor edx, edx
nop dword [rax + rax]
cmp ax, 0x5c
je 0x401f08
cmp ax, 0x22
je 0x401ef0
xor edx, edx
movzx eax, word [rbx + 2]
add rbx, 2
test ax, ax
je 0x401eb4
cmp ax, 9
sete r8b
cmp ax, 0x20
sete cl
or r8b, cl
je 0x401e60
test r9b, 1
jne 0x401e60
nop dword [rax]
movzx eax, word [rbx + 2]
add rbx, 2
cmp ax, 9
je 0x401ea0
cmp ax, 0x20
je 0x401ea0
lea rcx, [rsp + 0x20]
call qword [sym.imp.kernel32.dll_GetStartupInfoW]
test byte [rsp + 0x5c], 1
je 0x401f10
movzx esi, word [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
mov r9d, esi
mov r8, rbx
xor edx, edx
mov rcx, rax
call dbg.wWinMain
add rsp, 0x98
pop rbx
pop rsi
ret
and edx, 1
jne 0x401e74
xor r9d, 1
jmp 0x401e76
add edx, 1
jmp 0x401e76
mov eax, 1
mov esi, 1
mov word [rsp + 0x60], ax
jmp 0x401ecb
Function at 0x4023f2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov eax, ecx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov byte [rbp + 0x10], al
mov byte [rbp - 1], 0
jmp 0x40248b
mov byte [rbp - 2], 0
jmp 0x402481
movzx eax, byte [rbp - 1]
movzx edx, byte [rbp - 2]
mov rcx, qword [rbp + 0x18]
movsxd rdx, edx
cdqe
shl rax, 2
add rax, rcx
add rax, rdx
movzx r8d, byte [rax]
movzx eax, byte [rbp + 0x10]
lea edx, [rax*4]
movzx eax, byte [rbp - 1]
add eax, edx
lea edx, [rax*4]
movzx eax, byte [rbp - 2]
add eax, edx
cdqe
mov rdx, qword [rbp + 0x20]
add rax, rdx
movzx ecx, byte [rax]
movzx eax, byte [rbp - 1]
movzx edx, byte [rbp - 2]
xor r8d, ecx
mov rcx, qword [rbp + 0x18]
movsxd rdx, edx
cdqe
shl rax, 2
add rax, rcx
add rax, rdx
mov byte [rax], r8b
add byte [rbp - 2], 1
cmp byte [rbp - 2], 3
jbe 0x402413
add byte [rbp - 1], 1
cmp byte [rbp - 1], 3
jbe 0x40240d
nop
add rsp, 0x10
pop rbp
ret

Function at 0x40249c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov byte [rbp - 1], 0
jmp 0x40250f
mov byte [rbp - 2], 0
jmp 0x402505
movzx eax, byte [rbp - 2]
movzx edx, byte [rbp - 1]
mov rcx, qword [rbp + 0x10]
movsxd rdx, edx
cdqe
shl rax, 2
add rax, rcx
add rax, rdx
movzx eax, byte [rax]
movzx eax, al
movzx r8d, byte [rbp - 2]
movzx ecx, byte [rbp - 1]
cdqe
lea rdx, str.cw
movzx edx, byte [rax + rdx]
mov r9, qword [rbp + 0x10]
movsxd rcx, ecx
movsxd rax, r8d
shl rax, 2
add rax, r9
add rax, rcx
mov byte [rax], dl
add byte [rbp - 2], 1
cmp byte [rbp - 2], 3
jbe 0x4024b4
add byte [rbp - 1], 1
cmp byte [rbp - 1], 3
jbe 0x4024ae
nop
add rsp, 0x10
pop rbp
ret

Function at 0x402fb1
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov byte [rbp - 1], 0
jmp 0x403024
mov byte [rbp - 2], 0
jmp 0x40301a
movzx eax, byte [rbp - 2]
movzx edx, byte [rbp - 1]
mov rcx, qword [rbp + 0x10]
movsxd rdx, edx
cdqe
shl rax, 2
add rax, rcx
add rax, rdx
movzx eax, byte [rax]
movzx eax, al
movzx r8d, byte [rbp - 2]
movzx ecx, byte [rbp - 1]
cdqe
lea rdx, [0x00406b60]
movzx edx, byte [rax + rdx]
mov r9, qword [rbp + 0x10]
movsxd rcx, ecx
movsxd rax, r8d
shl rax, 2
add rax, r9
add rax, rcx
mov byte [rax], dl
add byte [rbp - 2], 1
cmp byte [rbp - 2], 3
jbe 0x402fc9
add byte [rbp - 1], 1
cmp byte [rbp - 1], 3
jbe 0x402fc3
nop
add rsp, 0x10
pop rbp
ret

Function at 0x40325b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov byte [rbp - 1], 0
jmp 0x4032a4
movzx eax, byte [rbp - 1]
mov rdx, qword [rbp + 0x10]
add rax, rdx
movzx r8d, byte [rax]
movzx eax, byte [rbp - 1]
mov rdx, qword [rbp + 0x18]
add rax, rdx
movzx ecx, byte [rax]
movzx eax, byte [rbp - 1]
mov rdx, qword [rbp + 0x10]
add rax, rdx
mov edx, r8d
xor edx, ecx
mov byte [rax], dl
add byte [rbp - 1], 1
cmp byte [rbp - 1], 0xf
jbe 0x403271
nop
add rsp, 0x10
pop rbp
ret
Function at 0x403a10
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x0040a624]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x403b98
mov rax, qword [0x0040a628]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x403a5c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x403ae5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x403a40
mov rcx, rbx
call fcn.004046b0
test rax, rax
mov r12, rax
je 0x403bcd
mov rax, qword [0x0040a628]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.004047e0
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x0040a628]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x403bb0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x403ade
sub eax, 0x40
and eax, 0xffffffbf
jne 0x403b40
add dword [0x0040a624], 1
cmp edi, 8
jae 0x403b13
test dil, 4
jne 0x403b84
test edi, edi
je 0x403b08
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x403b9f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x403b08
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x403b2c
jmp 0x403b08
add rsi, qword [0x0040a628]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x403ade
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00404ba0
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x403b08
xor esi, esi
jmp 0x403a67
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x403b08
mov rax, qword [0x0040a628]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.00404ba0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.00404ba0
nop
nop dword [rax]

Function at 0x404320
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0040a900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0040a8e0]
test rbx, rbx
je 0x404374
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x40436b
test rsi, rsi
je 0x40436b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x404350
lea rcx, [0x0040a900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x4046b0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00406fc0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x40471d
mov rcx, r8
call fcn.00404590
test eax, eax
je 0x40471d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x40471d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x404714
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x40471f
add rax, 0x28
cmp rax, r9
jne 0x404700
xor eax, eax
add rsp, 0x28
ret

Function at 0x404ba0
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x00401540]
jmp 0x401510
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00404a70
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.00404a70
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x401530
Function at 0x1800010c0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x1800010e8
xor eax, eax
lea r8, [0x180001080]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret

Function at 0x180001100
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, ecx
mov ecx, dword [0x1800068ec]
mov ebx, edi
test ecx, ecx
je 0x18000123b
mov rax, qword [0x1800068e0]
add rax, 0x20
nop
movzx edx, byte [rax]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x180001158
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180001130
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
cmp ebx, 0xffffffff
je 0x18000123b
mov r8d, edi
lea rcx, [rsp + 0x20]
test esi, esi
mov edx, 0xffffffff
setne r8b
call fcn.180001480
mov r8d, dword [0x1800068ec]
cmp ebx, r8d
jae 0x1800011c8
nop word [rax + rax]
mov eax, ebx
imul rcx, rax, 0x38
mov rax, qword [0x1800068e0]
movzx edx, byte [rcx + rax + 0x20]
shr edx, 1
and edx, 1
cmp edx, esi
je 0x1800011c1
mov edx, esi
mov ecx, ebx
call fcn.180001370
mov edi, eax
test eax, eax
jne 0x1800011c8
mov r8d, dword [0x1800068ec]
inc ebx
cmp ebx, r8d
jb 0x180001190
cmp qword [rsp + 0x20], 0
je 0x18000123b
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180001227
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax]
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180001218
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x1800011f0
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1800062c8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x48]
mov eax, edi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180001370
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov eax, ecx
lea r9, [rsp + 0x30]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x1800068e0]
mov r8, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [r8 - 5]
cmove rdi, r8
mov r8d, 0x40
lea rbp, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1800013d4
mov eax, 0xa
jmp 0x180001467
test esi, esi
je 0x1800013f6
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x180001419
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x180001419
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x180001412
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x180001419
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx ecx, sil
shl sil, 2
add cl, cl
xor cl, byte [rbx + 0x20]
and cl, 2
xor cl, byte [rbx + 0x20]
xor sil, cl
and sil, 4
xor sil, cl
mov byte [rbx + 0x20], sil
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x180001480
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x180006240]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor esi, esi
mov r14d, edx
mov rbx, rcx
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
xor edx, edx
mov ebp, r8d
lea ecx, [rsi + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1800015aa
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1800015a1
nop word [rax + rax]
cmp dword [rsp + 0x20], 0x10
jb 0x180001584
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x180001584
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x180001584
mov rdx, qword [rbx]
test rdx, rdx
jne 0x180001542
mov dword [rbx + 8], 0x80
mov r8d, 0x200
mov rcx, qword [0x1800062c8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
mov rdx, rax
test rax, rax
je 0x1800015a1
jmp 0x180001577
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
jb 0x180001577
mov rcx, qword [0x1800062c8]
lea r9d, [rax + rax]
mov r8, rdx
shl r9, 2
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x1800015a1
mov eax, dword [rbx + 8]
add eax, eax
mov qword [rbx], rdx
mov dword [rbx + 8], eax
mov ecx, dword [rbx + 0xc]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
inc dword [rbx + 0xc]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rdi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1800014f0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx], rsi
je 0x180001603
cmp dword [rbx + 0xc], esi
jbe 0x180001603
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx]
xor edx, edx
mov eax, esi
lea ecx, [rdx + 0x5a]
mov r8d, dword [r8 + rax*4]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x1800015fc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rdi
call fcn.180001970
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [rbx + 0xc]
jb 0x1800015c0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180002aa0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180001b20
Capabilities:
Resume thread

Disassembly:
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rdi, rcx
je 0x180001b8f
mov qword [rsp + 0x30], rbx
xor ebx, ebx
cmp dword [rcx + 0xc], ebx
jbe 0x180001b78
mov qword [rsp + 0x38], rsi
mov r8, qword [rdi]
xor edx, edx
mov r8d, dword [r8 + rbx*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180001b6c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [rdi + 0xc]
jb 0x180001b40
mov rsi, qword [rsp + 0x38]
mov r8, qword [rdi]
xor edx, edx
mov rcx, qword [0x1800062c8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret