joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400038c0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
xor edx, edx
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
xor r8d, r8d
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
je 0x1400038ed
xor eax, eax
add rsp, 0x28
ret
mov qword [rsp + 0x38], rbx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
mov edi, dword [rsp + 0x30]
add edi, 0xb90
mov edx, edi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbx, rax
test rax, rax
je 0x140003938
lea r9, [rsp + 0x30]
mov r8d, edi
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
test eax, eax
jns 0x140003949
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rbx, qword [rsp + 0x38]
xor eax, eax
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rdi, qword [rsp + 0x20]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x28
ret

Function at 0x1400066d0
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rbx
push r12
push r13
push r15
sub rsp, 0x78
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [rcx + 0xc]
mov r13, r8
mov rbx, qword [rsp + 0xc0]
mov r15, rcx
lea r12d, [rax + 8]
cmp r12d, r9d
jbe 0x14000671a
and dword [rbx + 0x10], 0xffffffbf
mov eax, r12d
mov qword [rbx + 0x38], rax
mov eax, 0x80000005
jmp 0x140006817
mov rdx, rax
mov qword [rsp + 0x68], rdi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
test rax, rax
jne 0x14000673c
mov eax, 0xc00000a0
jmp 0x140006812
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0x70], rsi
mov esi, dword [r15]
mov qword [rsp + 0x60], r14
xor r14d, r14d
mov qword [rsp + 0x20], r14
test esi, 0xfffffffb
je 0x140006792
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp esi, eax
je 0x140006792
mov ecx, esi
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140006792
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov r14d, 1
mov r8d, dword [r15 + 0xc]
mov rdx, rdi
mov rcx, qword [r15 + 4]
call fcn.140001880
test r14d, r14d
mov ebp, eax
mov r14, qword [rsp + 0x60]
je 0x1400067c4
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test ebp, ebp
jne 0x1400067da
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, 0xc0000001
jmp 0x140006805
mov r8, rbp
mov dword [r13 + 4], ebp
lea rcx, [r13 + 8]
mov dword [r13], esi
mov rdx, rdi
call fcn.140001010
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, r12d
mov qword [rbx + 0x38], rax
xor eax, eax
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140001360
add rsp, 0x78
pop r15
pop r13
pop r12
pop rbx
ret
Function at 0x140006830
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x70
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, qword [rsp + 0xb0]
mov r15, r8
mov r14, rcx
cmp r9d, 7
jae 0x140006873
and dword [rbx + 0x10], 0xffffffbf
mov eax, 0x80000005
mov qword [rbx + 0x38], 7
jmp 0x14000691f
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0x68], rsi
xor esi, esi
mov qword [rsp + 0x60], rdi
mov edi, dword [rcx]
mov qword [rsp + 0x20], rsi
test edi, 0xfffffffb
je 0x1400068c6
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp edi, eax
je 0x1400068c6
mov ecx, edi
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x1400068c6
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov esi, 1
mov r8d, dword [r14 + 0xc]
lea rdx, [r14 + 0x10]
mov rcx, qword [r14 + 4]
call fcn.1400019c0
test esi, esi
movzx ebp, al
mov rsi, qword [rsp + 0x68]
je 0x1400068f9
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test bpl, bpl
mov rbp, qword [rsp + 0x98]
jne 0x14000690d
mov eax, 0xc0000001
jmp 0x14000691a
mov dword [r15], edi
xor eax, eax
mov qword [rbx + 0x38], 7
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140001360
add rsp, 0x70
pop r15
pop r14
pop rbx
ret
Function at 0x140008f90
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r14
push r15
sub rsp, 0x20
mov rbp, qword [0x1400151c8]
xor r14b, r14b
mov ebx, ecx
mov edi, r8d
mov qword [rsp + 0x58], 0
mov r15, rdx
cmp rbp, 0xffffffffffffffff
je 0x14000913f
test rbp, rbp
je 0x14000913f
xor edx, edx
mov rcx, rbp
lea r8d, [rdx + 1]
call fcn.140001880
cmp eax, 1
jne 0x14000913f
mov ecx, ebx
mov qword [rsp + 0x40], rsi
lea rdx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140009124
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140009134
mov rbx, qword [0x1400151c0]
cmp rbx, 0xffffffffffffffff
je 0x140009129
test rbx, rbx
je 0x140009129
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 1]
call fcn.140001880
cmp eax, 1
jne 0x140009124
mov rsi, qword [0x1400151d8]
cmp rsi, 0xffffffffffffffff
je 0x140009124
test rsi, rsi
je 0x140009124
xor edx, edx
mov r8d, eax
mov rcx, rsi
call fcn.140001880
cmp eax, 1
jne 0x140009124
mov rcx, qword [rsp + 0x58]
call rbx
mov rbx, rax
test rax, rax
je 0x140009124
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 1]
call fcn.140001880
cmp eax, 1
jne 0x14000911d
mov rdx, r15
mov rcx, rbx
call rsi
mov rsi, rax
test rax, rax
je 0x14000911d
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 1]
call fcn.140001880
cmp eax, 1
jne 0x14000911d
mov eax, dword [0x1400151ec]
cmp eax, 0xffffffff
je 0x1400090e7
mov ebx, eax
add rbx, rsi
je 0x1400090e7
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 1]
call fcn.140001880
cmp eax, 1
jne 0x1400090e7
xchg dword [rbx], edi
jmp 0x14000911a
mov eax, dword [0x1400151e8]
cmp eax, 0xffffffff
je 0x14000911d
mov ebx, eax
add rbx, rsi
je 0x14000911d
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 1]
call fcn.140001880
cmp eax, 1
jne 0x14000911d
and dword [rbx], 0xfe000000
and edi, 0x1ffffff
or dword [rbx], edi
mov r14b, 1
mov rcx, qword [rsp + 0x58]
call rbp
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140009134
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rsi, qword [rsp + 0x40]
movzx eax, r14b
jmp 0x140009141
xor al, al
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x1400095f0
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx esi, dl
mov ecx, ecx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], 0
xor bl, bl
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140009653
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140009663
mov eax, dword [0x1400152f8]
cmp eax, 0xffffffff
je 0x140009658
mov edi, eax
add rdi, rcx
je 0x140009658
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 1]
call fcn.140001880
cmp eax, 1
jne 0x140009653
mov byte [rdi], sil
movzx ebx, al
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140009663
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rsi, qword [rsp + 0x38]
movzx eax, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140009680
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov ebp, r9d
mov rsi, r8
mov r14d, edx
mov rdi, rcx
test r9d, r9d
jne 0x1400096c1
mov rax, qword [rsp + 0x60]
and dword [rax + 0x10], 0xffffffbf
mov qword [rax + 0x38], 0x2200
mov eax, 0x80000005
jmp 0x140009807
mov edx, 0x1200
mov qword [rsp + 0x40], rbx
xor ecx, ecx
mov r8d, 0x4f41524b
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x1400097fd
xor edx, edx
mov r8d, 0x1200
mov rcx, rax
call fcn.140001720
xor edx, edx
mov r8d, 0x1200
mov rcx, rbx
call fcn.140001720
cmp r14d, 5
je 0x140009715
mov eax, 0xc000000d
jmp 0x140009802
test rdi, rdi
je 0x1400097f6
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 1]
call fcn.140001880
cmp eax, 1
jne 0x1400097f6
mov ecx, dword [rdi]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x1400097eb
mov rax, qword [rsp + 0x20]
mov ecx, dword [0x1400152f8]
test rax, rax
je 0x140009783
cmp ecx, 0xffffffff
je 0x140009783
mov edi, ecx
add rdi, rax
je 0x140009783
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 1]
call fcn.140001880
cmp eax, 1
mov rax, qword [rsp + 0x20]
jne 0x140009783
mov rcx, qword [rdi]
jmp 0x140009785
xor ecx, ecx
mov qword [rbx], rax
mov byte [rbx + 8], cl
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor edx, edx
mov rcx, rbx
cmp ebp, 0xd
jae 0x1400097be
mov rax, qword [rsp + 0x60]
and dword [rax + 0x10], 0xffffffbf
mov qword [rax + 0x38], 0x100d
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, 0x80000005
jmp 0x140009802
mov dword [rsi], 1
movsd xmm0, qword [rbx]
movsd qword [rsi + 4], xmm0
movzx eax, byte [rbx + 8]
mov byte [rsi + 0xc], al
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, qword [rsp + 0x60]
mov qword [rax + 0x38], 0xd
xor eax, eax
jmp 0x140009802
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, 0xc0000001
jmp 0x140009802
mov eax, 0xc0000017
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14000c850
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rdx
xor sil, sil
mov byte [rsp + 0x20], sil
mov r14d, 1
mov ebx, r14d
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000c93e
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000c93e
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rcx, qword [sym.imp.ntoskrnl.exe_PsInitialSystemProcess]
cmp rax, qword [rcx]
jne 0x14000c8d9
or rdi, 0xffffffff80000000
xor ebx, ebx
mov dword [rsp + 0x38], ebx
mov word [rsp + 0x24], 0
movzx r8d, bl
lea rdx, [rsp + 0x24]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ObSetHandleAttributes]
mov ebx, eax
mov dword [rsp + 0x28], eax
test eax, eax
js 0x14000c90b
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov ebx, eax
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x14000c927
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
movzx eax, sil
test ebx, ebx
cmovns eax, r14d
jmp 0x14000c940
xor al, al
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140001360
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop r14
pop rdi
pop rsi
ret
Function at 0x14000ded0
Capabilities:
Check os version
Enumerate pe sections

Disassembly:
push rbp
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x188], rax
xor edx, edx
mov qword [0x140015b90], 0
mov r8d, 0x11c
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
call fcn.140001720
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x11c
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
cmp dword [rsp + 0x34], 0xa
lea rdx, [rsp + 0x20]
lea rcx, [0x1400106f0]
je 0x14000df3d
lea rcx, [0x1400107e0]
call fcn.14000e9b0
mov rbp, rax
test rax, rax
je 0x14000dfd8
mov qword [rsp + 0x1b0], rbx
movsxd rbx, dword [rbp + 0x3c]
add rbx, rbp
mov qword [rsp + 0x1b8], rsi
mov rcx, rbx
mov qword [rsp + 0x1c0], rdi
movzx esi, word [rbx + 6]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000dfbe
movzx eax, word [rbx + 0x14]
xor edi, edi
add rbx, 0x18
add rbx, rax
test esi, esi
je 0x14000dfbe
nop
mov rax, qword [rbx]
lea rdx, [0x1400116b4]
lea rcx, [rsp + 0x178]
mov qword [rsp + 0x178], rax
call qword [sym.imp.ntoskrnl.exe__stricmp]
test eax, eax
je 0x14000dff1
add rbx, 0x28
inc edi
cmp edi, esi
jb 0x14000df90
xor al, al
mov rsi, qword [rsp + 0x1b8]
mov rbx, qword [rsp + 0x1b0]
mov rdi, qword [rsp + 0x1c0]
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.140001360
add rsp, 0x1a0
pop rbp
ret
mov qword [rsp + 0x1c8], r12
xor r8d, r8d
movsxd r12, dword [rbx + 8]
mov qword [rsp + 0x190], r15
mov r15d, dword [rbx + 0xc]
add r15, rbp
shr r12, 3
xor ebp, ebp
test r12, r12
je 0x14000e0ca
mov qword [rsp + 0x198], r14
xor edx, edx
mov r14, r15
nop dword [rax + rax]
cmp rdx, 0x80
jne 0x14000e0e1
movdqa xmm0, xmmword [0x1400116c0]
lea rbx, [rsp + 0x150]
movdqa xmm1, xmmword [0x1400116d0]
sub ebp, r8d
sub r14, 0x400
mov dword [rsp + 0x170], 0x2d
movdqu xmmword [rsp + 0x150], xmm0
movdqu xmmword [rsp + 0x160], xmm1
nop dword [rax]
mov edi, dword [rbx]
lea eax, [rdi + rbp]
movsxd rcx, eax
mov rsi, qword [r15 + rcx*8]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000e0f8
mov eax, dword [rsi + 0x1c]
and eax, 0x7f
cmp eax, edi
jne 0x14000e0f8
add rbx, 4
lea rax, [rsp + 0x174]
cmp rbx, rax
jne 0x14000e080
movsxd rax, ebp
lea rcx, [r15 + rax*8]
mov qword [0x140015b90], rcx
mov r14, qword [rsp + 0x198]
mov r15, qword [rsp + 0x190]
mov al, 1
mov r12, qword [rsp + 0x1c8]
jmp 0x14000dfc0
mov rax, qword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
mov rcx, qword [rax]
cmp qword [r14], rcx
jbe 0x14000e0f8
inc r8d
inc rdx
jmp 0x14000e0fd
xor r8d, r8d
xor edx, edx
inc ebp
add r14, 8
movsxd rax, ebp
cmp rax, r12
jb 0x14000e030
jmp 0x14000e0c2
Function at 0x14000e9b0
Capabilities:
Get system information on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x20
xor esi, esi
lea r9, [rsp + 0x50]
mov r14, rdx
mov dword [rsp + 0x50], esi
mov rbx, rcx
xor r8d, r8d
xor edx, edx
lea ecx, [rsi + 0xb]
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov eax, dword [rsp + 0x50]
test eax, eax
jne 0x14000e9eb
xor eax, eax
add rsp, 0x20
pop r14
pop rsi
pop rbx
ret
mov qword [rsp + 0x40], rbp
mov rdx, rax
xor ecx, ecx
mov qword [rsp + 0x48], rdi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r8d, dword [rsp + 0x50]
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.140001720
mov r8d, dword [rsp + 0x50]
lea r9, [rsp + 0x50]
mov rdx, rdi
mov ecx, 0xb
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
test eax, eax
js 0x14000eaa0
test rbx, rbx
je 0x14000ea96
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe__strlwr]
mov ebx, esi
mov rbp, rax
cmp dword [rdi], ebx
jbe 0x14000eaa0
nop word [rax + rax]
mov eax, ebx
imul rcx, rax, 0x128
add rcx, 0x30
add rcx, rdi
call qword [sym.imp.ntoskrnl.exe__strlwr]
mov rcx, rax
mov rdx, rbp
call qword [sym.imp.ntoskrnl.exe_strstr]
test rax, rax
jne 0x14000ea7f
inc ebx
cmp ebx, dword [rdi]
jb 0x14000ea50
jmp 0x14000eaa0
mov eax, ebx
imul rcx, rax, 0x128
mov eax, dword [rcx + rdi + 0x20]
mov rsi, qword [rcx + rdi + 0x18]
mov dword [r14], eax
jmp 0x14000eaa0
mov ecx, dword [rdi + 0x20]
mov rsi, qword [rdi + 0x18]
mov dword [r14], ecx
mov rbp, qword [rsp + 0x40]
test rdi, rdi
je 0x14000eab5
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, rsi
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rsi
pop rbx
ret
Function at 0x14000147f
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140005470]
mov dword [rax], 1
mov rax, qword [0x140005480]
mov dword [rax], 1
mov rax, qword [0x140005490]
mov dword [rax], 1
mov rax, qword [0x140005430]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014d0
mov eax, 0
jmp 0x14000157d
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400014fc
mov eax, 0
jmp 0x14000157d
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x140001522
cmp eax, 0x20b
je 0x140001549
jmp 0x140001578
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x140001535
mov eax, 0
jmp 0x14000157d
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000157d
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x140001564
mov eax, 0
jmp 0x14000157d
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000157d
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001c10
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x1400028e2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140009168]
test eax, eax
je 0x14000297a
lea rax, [0x140009140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140009170]
mov qword [rbp - 8], rax
jmp 0x14000295e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140002952
cmp qword [rbp - 0x10], 0
je 0x140002952
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140002918
lea rax, [0x140009140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14000297b
nop
add rsp, 0x30
pop rbp
ret
Function at 0x140002a80
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140002aa8
mov eax, 0
jmp 0x140002af6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140002ad1
mov eax, 0
jmp 0x140002af6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140002af1
mov eax, 0
jmp 0x140002af6
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x140002afc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x140002b7a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140002b71
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140002b71
mov rax, qword [rbp - 8]
jmp 0x140002b8f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140002b44
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140003180
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400031ca
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400031ca
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400031ca
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400031ca
cmp dword [rcx + 0x84], 0xe
jbe 0x1400031ca
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400031cc
xor al, al
add rsp, 0x28
ret
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
push rcx
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
push rsi
mov rdx, qword [rdx + 0x20]
xor r9, r9
mov rsi, qword [rdx + 0x50]
movzx rcx, word [rdx + 0x4a]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
mov rdx, qword [rdx + 0x20]
push r9
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov ecx, dword [rax + 0x18]
mov r8d, dword [rax + 0x20]
push rax
add r8, rdx
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x2fc4dd0e0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4ddae2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc502108]
test eax, eax
je 0x2fc4ddb7a
lea rax, [0x2fc5020e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc502110]
mov qword [rbp - 8], rax
jmp 0x2fc4ddb5e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4ddb52
cmp qword [rbp - 0x10], 0
je 0x2fc4ddb52
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4ddb18
lea rax, [0x2fc5020e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4ddb7b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4ddc80
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4ddca8
mov eax, 0
jmp 0x2fc4ddcf6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4ddcd1
mov eax, 0
jmp 0x2fc4ddcf6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4ddcf1
mov eax, 0
jmp 0x2fc4ddcf6
mov eax, 1
add rsp, 0x20
pop rbp
ret