joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401704d0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov rbx, rdx
mov rdi, rcx
xor esi, esi
mov dword [rbp - 0x69], esi
lea r14, [0x14022fa30]
mov qword [rbp - 0x61], r14
cmp qword [rcx + 0x38], rsi
je 0x140170518
lea rdx, [rbp - 0x69]
call fcn.1401700e0
cmp dword [rbp - 0x69], esi
jne 0x14017066e
mov qword [rbp - 0x59], rdi
lea rax, [rbp - 0x69]
mov qword [rbp - 0x51], rax
lea rax, vtable.std::_Func_impl_no_alloc_class__lambda_da5965a3fb02337af7891b86470ab956___void___.0
mov qword [rbp - 0x49], rax
movaps xmm0, xmmword [rbp - 0x59]
movups xmmword [rbp - 0x41], xmm0
lea rax, [rbp - 0x49]
mov qword [rbp - 0x11], rax
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 9]
call fcn.140188610
nop
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x14017056a
mov rax, qword [rcx]
lea rdx, [rbp - 0x49]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rbp - 0x11], rsi
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140170577
mov rcx, qword [rbx]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 5]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rdi], rax
cmp rax, 0xffffffffffffffff
je 0x140170647
lea rdx, [rbp + 0x67]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140170647
mov rax, qword [rbp + 0x67]
mov qword [rdi + 0x30], rax
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 4]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rdi + 8], rax
test rax, rax
je 0x140170647
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 0x38], rax
test rax, rax
je 0x140170647
lea rcx, [rdi + 0x10]
cmp rcx, rbx
je 0x14017062d
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140170625
mov rbx, qword [rbx]
mov rdx, rbx
call fcn.140009b80
mov dword [rbp - 0x59], esi
mov qword [rbp - 0x51], r14
movaps xmm0, xmmword [rbp - 0x59]
movdqa xmmword [rbp - 0x69], xmm0
lea rcx, [rbp - 9]
call fcn.1401886e0
nop
lea rcx, [rbp - 9]
call fcn.140188690
cmp dword [rbp - 0x69], 0
jne 0x14017066e
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
movaps xmm0, xmmword [rbp - 0x69]
movdqa xmmword [rbp - 0x59], xmm0
lea r8, str.MemoryMappedFile::open
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x49]
call fcn.1400cc180
lea rdx, [0x140227e50]
lea rcx, [rbp - 0x49]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x1401706b0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
cmp qword [rdx + 0x18], 0x10
mov rbx, rdx
jb 0x1401706c7
mov rdx, qword [rdx]
cmp qword [rcx + 0x28], 0x10
lea rdi, [rcx + 0x10]
mov rcx, rdi
jb 0x1401706d8
mov rcx, qword [rdi]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x140170710
cmp rdi, rbx
je 0x140170706
cmp qword [rbx + 0x18], 0x10
mov r8, qword [rbx + 0x10]
jb 0x1401706fb
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rdi
call fcn.140009b80
mov dword [rsp + 0x20], 0
jmp 0x14017071a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rax, [0x14022fa30]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movd eax, xmm0
test eax, eax
jne 0x14017073e
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
lea r8, str.MemoryMappedFile::rename
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.1400cc180
lea rdx, [0x140227e50]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x140170770
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 0x10
mov rsi, r8
mov rbx, rdx
jb 0x14017078f
mov rdx, qword [rdx]
cmp qword [rcx + 0x28], 0x10
lea rdi, [rcx + 0x10]
mov rcx, rdi
jb 0x1401707a0
mov rcx, qword [rdi]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x1401707d8
cmp rdi, rbx
je 0x1401707ce
cmp qword [rbx + 0x18], 0x10
mov r8, qword [rbx + 0x10]
jb 0x1401707c3
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rdi
call fcn.140009b80
mov dword [rsp + 0x20], 0
jmp 0x1401707e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov rbx, qword [rsp + 0x40]
lea rax, [0x14022fa30]
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm0
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140170dd0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov rcx, qword [rcx]
call fcn.14016f150
test al, al
jne 0x140170f88
mov dword [rbp - 0x61], edi
mov qword [rbp - 0x59], rsi
xor esi, esi
mov dword [rbp + 0x67], esi
mov qword [rbp + 7], rsi
mov qword [rsp + 0x30], rsi
lea rax, [rbp - 0x11]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [rsi + 1]
lea rdx, [rbp - 0x61]
mov rcx, qword [rbx + 8]
call qword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x140170e4e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x140170faf
mov rcx, qword [rbx]
call fcn.14016eed0
mov qword [rbp + 0xf], rax
mov byte [rbp + 0x17], sil
lea rax, [rbp - 0x11]
mov qword [rbx + 0x10], rax
mov rcx, qword [rbx]
call fcn.14016eed0
lea rdx, [rax + 0x70]
lea rcx, vtable.std::_Func_impl_no_alloc_class__lambda_ba592e99b77cc87b7eb140194ef6b88a___void___.0
mov qword [rbp - 0x51], rcx
mov qword [rbp - 0x49], rbx
lea rcx, [rbp - 0x51]
mov qword [rbp - 0x19], rcx
lea rcx, [rbp - 0x51]
call fcn.140170ff0
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x140170eab
mov rax, qword [rcx]
lea rdx, [rbp - 0x51]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rcx, qword [rbx]
call fcn.14016ebe0
mov rcx, qword [rbx]
call fcn.14016eed0
lea rdi, [rax + 0x70]
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x140170ed8
mov rax, qword [rcx]
cmp rcx, rdi
setne dl
call qword [rax + 0x20]
mov qword [rdi + 0x38], rsi
mov qword [rbx + 0x10], rsi
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp + 0x7f]
lea rdx, [rbp - 0x11]
mov rcx, qword [rbx + 8]
call qword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
cmp eax, 1
je 0x140170f0e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e3
jne 0x140170f4b
jmp 0x140170f24
mov eax, dword [rbp + 0x7f]
mov rbx, qword [rsp + 0x128]
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x79], xmm0
mov qword [rbp - 0x69], rax
lea rcx, [rbp - 0x79]
call fcn.14016fa60
lea rdx, [0x140228248]
lea rcx, [rbp - 0x79]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
mov edx, eax
lea rcx, [rbp - 0x51]
call fcn.140172250
nop
mov r8, rax
lea rdx, str.TcpConnection::read__WSAGetOverlappedResult_failed_
lea rcx, [rbp + 0x1f]
call fcn.140010e60
nop
mov rdx, rax
lea rcx, [rbp - 0x79]
call fcn.1400ba200
lea rdx, [0x140227e18]
lea rcx, [rbp - 0x79]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x79], xmm0
mov qword [rbp - 0x69], rax
lea rcx, [rbp - 0x79]
call fcn.14016fa60
lea rdx, [0x140228248]
lea rcx, [rbp - 0x79]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
mov edx, eax
lea rcx, [rbp + 0x1f]
call fcn.140172250
nop
mov r8, rax
lea rdx, str.TcpConnection::read__WSARecv_failed_
lea rcx, [rbp - 0x51]
call fcn.140010e60
nop
mov rdx, rax
lea rcx, [rbp - 0x79]
call fcn.1400ba200
lea rdx, [0x140227e18]
lea rcx, [rbp - 0x79]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x1401716a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword [rcx + 8]
xor r14d, r14d
mov edi, r14d
mov ebp, r14d
mov rsi, rcx
nop word [rax + rax]
lea ecx, [rax + 0xff]
shl rdi, cl
add rdi, rdi
nop dword [rax]
mov r10, qword [rsi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x140171744
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x140171700
mov ecx, dword [r10]
jmp 0x140171827
cmp ecx, 0x4e0
jb 0x140171827
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140171760
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401717b0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r14d
mov dword [r10], r14d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov ecx, edx
mov dword [r10], eax
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rdx, rcx
shr rdx, 0x12
xor rdx, rcx
cmp rdx, qword [rsi + 0x10]
ja 0x1401716e0
mov rax, qword [rsi + 8]
or rdi, rdx
add rbp, rax
cmp rbp, 0x40
jb 0x1401716d0
mov rbx, qword [rsp + 0x10]
mov rax, rdi
mov rdi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop r14
ret
Function at 0x1401718b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x1340]
mov eax, 0x1440
call fcn.140189c90
sub rsp, rax
mov rdi, r8
mov rsi, rdx
mov rcx, qword [rcx]
call fcn.14016f150
test al, al
jne 0x140171a76
movdqa xmm0, xmmword [0x1401efa80]
movdqu xmmword [rsp + 0x38], xmm0
xor ebx, ebx
mov qword [rsp + 0x48], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
cmp qword [rdi + 0x18], 0x10
jb 0x140171918
mov rdi, qword [rdi]
lea r9, [rbp + 0x1350]
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x140171a36
mov rax, qword [rbp + 0x1350]
test rax, rax
je 0x14017194f
inc rbx
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x140171943
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov r8d, 0xffffffff
mov dword [rbp + 0x1334], r8d
mov dword [rbp - 0x4c], eax
mov edx, 1
nop dword [rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 - 0x4c], eax
inc rdx
cmp rdx, 0x270
jb 0x140171970
mov dword [rbp - 0x50], 0x270
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov ecx, 0x40
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
dec rcx
shr rax, 1
cmp rax, r8
ja 0x1401719b0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x20]
test rbx, rbx
jne 0x1401719d6
call fcn.1401716a0
jmp 0x1401719de
mov rdx, rbx
call fcn.1400cec10
mov rbx, qword [rbp + 0x1350]
test rax, rax
je 0x1401719fa
nop word [rax + rax]
mov rbx, qword [rbx + 0x28]
sub rax, 1
jne 0x1401719f0
mov rax, qword [rbx + 0x20]
mov ecx, dword [rax + 4]
call qword [sym.imp.WS2_32.dll_ntohl]
mov edx, eax
mov rcx, rsi
call fcn.140172650
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rax, rsi
lea r11, [rsp + 0x1440]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.140172250
nop
mov r8, rax
lea rdx, str.Ipv4Resolver::resolve__getaddrinfo_failed_
lea rcx, [rbp - 0x78]
call fcn.140010e60
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1400ba200
lea rdx, [0x140227e18]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
call fcn.14016fa60
lea rdx, [0x140228248]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x140187570
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x1401875a4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140187590
ret
Function at 0x140010188
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140019760], eax
call fcn.140010b30
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140019760], 0
jne case.default.0x1400101de
mov ecx, 1
call fcn.140010b30
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
invalid
fcmovbe st(0), st(3)
xchg dword [rsi], ebp
ja 0x14002afd0
invalid
Function at 0x14001118b
Capabilities:
Hide thread from debugger

Disassembly:
jmp 0x140013320
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x20]
lea rcx, [0x140029102]
call fcn.1400114e2
mov dword [rbp + 4], 0x11
mov qword [rbp + 0x28], 0
mov dword [rbp + 0x64], 0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbp + 0x88], rax
lea rdx, str.NtSetInformationThread
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x11
mov rcx, rax
call qword [rbp + 0x28]
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
je 0x1400133a4
mov dword [rbp + 0x64], 1
mov eax, dword [rbp + 0x64]
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret

Function at 0x1400112a3
Capabilities:
Get memory capacity

Disassembly:
jmp 0x1400136e0
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140023040]
xor rax, rbp
mov qword [rbp + 0x138], rax
lea rcx, [0x140029102]
call fcn.1400114e2
mov qword [rbp + 8], 0x40000000
lea rax, [rbp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x40
rep stosb byte [rdi], al
mov dword [rbp + 0x30], 0x40
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rbp + 8]
cmp qword [rbp + 0x38], rax
jae 0x14001375c
mov dword [rbp + 0x134], 1
jmp 0x140013766
mov dword [rbp + 0x134], 0
mov eax, dword [rbp + 0x134]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001e370]
call fcn.14001142e
mov eax, edi
mov rcx, qword [rbp + 0x138]
xor rcx, rbp
call fcn.14001125d
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret

Function at 0x1400112a8
Capabilities:
Terminate process

Disassembly:
jmp 0x140016540
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140011339
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
jmp 0x140012bc0
push rbp
push rdi
sub rsp, 0x2c8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x6e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140023040]
xor rax, rbp
mov qword [rbp + 0x268], rax
lea rcx, [0x140029102]
call fcn.1400114e2
mov qword [rbp + 8], 0
mov r8d, 0x18
xor edx, edx
lea rcx, [rbp + 0xf8]
call fcn.1400113ca
mov r8d, 0x68
xor edx, edx
lea rcx, [rbp + 0x130]
call fcn.1400113ca
mov r8d, 0xb0
xor edx, edx
lea rcx, [rbp + 0x30]
call fcn.1400113ca
lea rcx, [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rcx, [rbp + 0xf8]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0x130]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov r8d, 0x10002
mov edx, dword [rbp + 0x10c]
mov ecx, dword [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
mov edx, 0xffffffff
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
lea rcx, [rbp - 0x50]
lea rdx, [0x14001e080]
call fcn.14001142e
mov rcx, qword [rbp + 0x268]
xor rcx, rbp
call fcn.14001125d
lea rsp, [rbp + 0x278]
pop rdi
pop rbp
ret
Function at 0x140011366
Capabilities:
Parse pe header

Disassembly:
jmp 0x140017890
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400178b0
xor al, al
jmp 0x140017931
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400178c3
xor al, al
jmp 0x140017931
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400178ed
xor al, al
jmp 0x140017931
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140017901
xor al, al
jmp 0x140017931
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140017913
xor al, al
jmp 0x140017931
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001792f
xor al, al
jmp 0x140017931
mov al, 1
add rsp, 0x38
ret

Function at 0x1400113ac
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
jmp 0x140011e60
push rbp
push rdi
sub rsp, 0x1d8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x3e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140023040]
xor rax, rbp
mov qword [rbp + 0x1a8], rax
lea rcx, [0x140029102]
call fcn.1400114e2
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbp + 0x28]
mov dword [rbp + 0xb4], eax
cmp dword [rbp + 0xb4], 2
jae 0x140011ec0
mov eax, 1
jmp 0x140011f0b
mov dword [rbp + 0x60], 0x40
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor edx, edx
mov rax, qword [rbp + 0x68]
mov ecx, 0x400
div rcx
xor edx, edx
mov ecx, 0x400
div rcx
xor edx, edx
mov ecx, 0x400
div rcx
mov dword [rbp + 0xd4], eax
cmp dword [rbp + 0xd4], 2
jae 0x140011f09
mov eax, 1
jmp 0x140011f0b
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001e250]
call fcn.14001142e
mov rax, rdi
mov rcx, qword [rbp + 0x1a8]
xor rcx, rbp
call fcn.14001125d
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret
Function at 0x1400114c4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
jmp 0x140013650
push rbp
push rdi
sub rsp, 0x138
lea rbp, [rsp + 0x30]
lea rcx, [0x140029102]
call fcn.1400114e2
mov qword [rbp + 8], 0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.VirtualAllocExNuma
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x3e8
xor edx, edx
mov rcx, rax
call qword [rbp + 0x28]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x1400136cf
xor eax, eax
jmp 0x1400136d4
mov eax, 1
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x1400137d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x20]
lea rcx, [0x140029102]
call fcn.1400114e2
mov rax, qword [rbp + 0x1e0]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x1e0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rbp + 0x1e0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rbp + 0x1e0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x20]
mov rcx, qword [rbp + 0x1e0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x24]
mov rcx, qword [rbp + 0x1e0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xa8], rax
mov dword [rbp + 0xc4], 0
jmp 0x1400138a4
mov eax, dword [rbp + 0xc4]
inc eax
mov dword [rbp + 0xc4], eax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x1c]
cmp dword [rbp + 0xc4], eax
jae 0x140013931
mov eax, dword [rbp + 0xc4]
mov rcx, qword [rbp + 0x88]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 0x1e0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xe8], rax
mov rcx, qword [rbp + 0xe8]
call fcn.140011569
cmp eax, dword [rbp + 0x1e8]
jne 0x14001392c
mov r8d, dword [rbp + 0x1e8]
mov rdx, qword [rbp + 0xe8]
lea rcx, str.successfully_found___s____d_n
call fcn.14001155f
mov eax, dword [rbp + 0xc4]
mov rcx, qword [rbp + 0xa8]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rbp + 0x68]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 0x1e0]
add rcx, rax
mov rax, rcx
jmp 0x140013933
jmp 0x140013896
xor eax, eax
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret