joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e560
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x680
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x670], rax
lea rbx, [0x14002ba30]
mov rbp, rcx
mov rdi, rbx
mov esi, 0x1a
xor r14d, r14d
cmp byte [rbx + 0x19], r14b
je 0x14000e672
movsx ecx, byte [rbx]
call fcn.140012fa8
mov r8d, 0x104
mov word [rsp + 0x40], ax
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x42], 0x3a
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
cmp eax, 4
jbe 0x14000e672
cmp word [rsp + 0x50], 0x5c
jne 0x14000e672
cmp word [rsp + 0x52], 0x3f
jne 0x14000e672
cmp word [rsp + 0x54], 0x3f
jne 0x14000e672
cmp word [rsp + 0x56], 0x5c
jne 0x14000e672
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x260]
mov qword [rsp + 0x30], r14
lea r8, [rsp + 0x58]
mov dword [rsp + 0x28], 0x410
or r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rdx, rdi
mov rcx, rbp
call fcn.14000e000
lea rdx, [0x14002138c]
mov rcx, rbp
call fcn.14000e000
lea rdx, [rsp + 0x260]
mov rcx, rbp
call fcn.14000e000
lea rdx, [0x14002138c]
mov rcx, rbp
call fcn.14000e000
add rdi, 0x20
add rbx, 0x20
sub rsi, 1
jne 0x14000e5a2
mov rcx, qword [rsp + 0x670]
xor rcx, rsp
call fcn.14000f550
lea r11, [rsp + 0x680]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140013cb8
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x140013a8c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140013a8c
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140013a8c
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140013a8c
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140013a8c
cmp dword [rcx + 0x84], 0xe
jbe 0x140013a8c
cmp dword [rcx + 0xf8], esi
je 0x140013a8c
mov ecx, r14d
call fcn.140013bd4
mov ecx, 2
call fcn.140016218
nop
cmp byte [0x14002c678], 0
jne 0x140013b56
mov r15d, 1
mov eax, r15d
xchg dword [0x14002c668], eax
test ebx, ebx
jne 0x140013aff
mov rdi, qword [section..data]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14002c670]
cmp rcx, rax
je 0x140013af6
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140010524]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14002c6b8]
jmp 0x140013b0b
cmp ebx, r15d
jne 0x140013b11
lea rcx, [0x14002c6d0]
call fcn.140014204
nop
test ebx, ebx
jne 0x140013b28
lea rdx, [0x140021330]
lea rcx, [0x140021310]
call fcn.14001394c
lea rdx, [0x140021340]
lea rcx, [0x140021338]
call fcn.14001394c
movzx eax, byte [0x14002c678]
test esi, esi
cmove eax, r15d
mov byte [0x14002c678], al
jmp 0x140013b56
mov ecx, 2
call fcn.14001626c
test esi, esi
jne 0x140013b6d
mov ecx, r14d
call fcn.140013b88
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x140013a1c
Function at 0x1400161c8
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x1400161a5
call fcn.1400149b4
mov dword [rax], 0x16
call fcn.1400156c8
or eax, 0xffffffff
jmp 0x1400161c2
sub dword [rcx + 0x10], 1
jns 0x1400161b4
add rsp, 0x28
jmp 0x14001adc0
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x140016184
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x14001ac60
call fcn.1400149b4
mov dword [rax], 0x16
call fcn.1400156c8
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14001ac48
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x14001ac48
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x14001ac92
lock or dword [rax + 0x14], 0x10
jmp 0x14001ac48
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x14001acaf
mov rcx, qword [rbp + 0x10]
call fcn.14001d5c0
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14001615c
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.14001db54
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x14001ad06
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x14001ac48
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x14001ad72
mov rcx, qword [rbp + 0x10]
call fcn.14001615c
cmp eax, 0xffffffff
je 0x14001ad59
mov rcx, qword [rbp + 0x10]
call fcn.14001615c
cmp eax, 0xfffffffe
je 0x14001ad59
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14001615c
movsxd rdi, eax
lea rsi, [0x14002c8b0]
mov rcx, rbx
sar rdi, 6
call fcn.14001615c
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x14001ad60
lea rax, [0x14002b2d0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14001ad72
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x14001ada8
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x14001ada4
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x14001ada4
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x14001ac4b
jmp 0x14001ac18
Function at 0x140002038
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp dword [0x14007a0c0], 0
je 0x14000205b
mov edx, 1
jmp 0x140002222
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
xor ebx, ebx
mov r8, qword [rax + 0x10]
xor eax, eax
mov rdx, qword [r8 + 0x30]
test rdx, rdx
je 0x1400020be
movsxd rcx, dword [rdx + 0x3c]
mov ecx, dword [rdx + rcx + 0x88]
test ecx, ecx
je 0x1400020b6
lea rax, [rcx + rdx]
mov ecx, dword [rax + 0xc]
add rcx, rdx
mov r9d, dword [rcx]
or r9d, 0x20202020
cmp r9d, 0x6c64746e
jne 0x1400020b6
mov ecx, dword [rcx + 4]
or ecx, 0x20202020
cmp ecx, 0x6c642e6c
je 0x1400020c8
mov r8, qword [r8]
mov rbx, rdx
jmp 0x140002070
test rax, rax
jne 0x1400020cb
jmp 0x140002222
mov rbx, rdx
mov ebp, dword [rax + 0x1c]
mov edi, dword [rax + 0x24]
xor esi, esi
lea r13, [0x14007a0c8]
mov edx, dword [rax + 0x18]
mov eax, dword [rax + 0x20]
add rdi, rbx
add rbp, rbx
lea r10d, [rdx - 1]
add rax, rbx
lea r12, [rax + r10*4]
add r10, r10
add r10, rdi
mov ecx, dword [r12]
add rcx, rbx
cmp word [rcx], 0x775a
jne 0x140002133
call fcn.140001f80
mov r11d, esi
inc esi
shl r11, 4
add r11, r13
mov dword [r11], eax
movzx eax, word [r10]
mov eax, dword [rbp + rax*4]
mov dword [r11 + 4], eax
xor eax, eax
mov qword [r11 + 8], rax
cmp esi, 0x1f4
je 0x140002145
sub r12, 4
lea rax, [r10 - 2]
cmp rdi, r10
je 0x140002145
mov r10, rax
jmp 0x1400020f7
mov dword [0x14007a0c0], esi
lea ebp, [rsi - 1]
lea r10, [0x14007a0c8]
test ebp, ebp
je 0x1400021ac
lea rdx, [0x14007a0c0]
xor ecx, ecx
lea eax, [rcx + 1]
mov r8d, dword [rdx + 0xc]
mov rcx, rax
shl rax, 4
add rax, r10
mov r9d, dword [rax + 4]
cmp r9d, r8d
jae 0x1400021a0
mov edi, dword [rdx + 8]
mov r11, qword [rdx + 0x10]
mov r12d, dword [rax]
mov dword [rdx + 0xc], r9d
mov r9, qword [rax + 8]
mov dword [rdx + 8], r12d
mov qword [rdx + 0x10], r9
mov dword [rax], edi
mov dword [rax + 4], r8d
mov qword [rax + 8], r11
add rdx, 0x10
cmp ecx, ebp
jb 0x140002162
dec ebp
jmp 0x140002155
mov eax, dword [0x14007a0cc]
mov r13d, dword [0x14007a0dc]
xor edi, edi
lea r15, [0x140076a40]
sub r13d, eax
lea r12, [rbx + rax]
mov r14d, edi
cmp edi, r13d
jae 0x140002051
lea rdx, [r12 + rdi]
mov r8d, 3
mov rcx, r15
inc rdi
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x1400021c9
lea rdi, [0x14007a0c0]
test r14d, r14d
je 0x140002051
add rdi, 0x10
cmp esi, ebp
je 0x140002051
mov ecx, dword [rdi - 4]
mov r8d, r13d
mov edx, r14d
inc ebp
add rcx, rbx
call fcn.140001fa8
mov qword [rdi], rax
jmp 0x1400021fe
mov eax, edx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140002e80
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140008b00
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140008b00
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140002ef0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14007c0f4]
mov rbx, rcx
test esi, esi
jle 0x140003020
mov rax, qword [0x14007c0f8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140002f3b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140002fc5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140002f20
mov rcx, rbx
call fcn.140003940
mov rdi, rax
test rax, rax
je 0x140003042
mov rax, qword [0x14007c0f8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140003a80
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14007c0f8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140003027
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140002fbe
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140002fd0
add dword [0x14007c0f4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14007c0f8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140002fbe
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140002e80
nop dword [rax]
xor esi, esi
jmp 0x140002f48
mov rax, qword [0x14007c0f8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140002e80
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140002e80
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400035b0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14007c160]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14007c140]
test rbx, rbx
je 0x14000360c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140003603
test rsi, rsi
je 0x140003603
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400035e8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140003940
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140077760]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140003960
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140003968
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140003960
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400039bd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400039b4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140003960
add rax, 0x28
cmp rax, r9
jne 0x1400039a0
xor eax, eax
ret

Function at 0x1400039c0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140077760]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400039df
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400039e8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400039df
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140003a80
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140077760]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140003a9f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140003aa8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x18001117c
Capabilities:
Execute command

Disassembly:
jmp 0x180011670
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x20]
lea rcx, [0x18002109f]
call fcn.1800112d5
mov eax, dword [rbp + 0xf8]
mov dword [rbp + 0xc0], eax
cmp dword [rbp + 0xc0], 1
je 0x1800116af
jmp 0x1800116bc
lea rcx, str.start_cmd.exe
call qword [sym.imp.ucrtbased.dll_system]
mov eax, 1
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret

Function at 0x1800111a9
Capabilities:
Terminate process

Disassembly:
jmp 0x180014ec0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140006070
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x50]
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov r13, r9
mov rbx, qword [rsp + 0x68]
mov r12, rdx
mov qword [r14], r8
mov qword [rbx], rax
mov rax, qword [r14]
cmp rax, r9
je 0x140006204
mov r15, qword [rsp + 0x60]
lea r9d, [rbp + 1]
mov rdi, qword [rbx]
mov r11d, 0x2800
mov r8d, 0x3ff
mov r10d, 0x2400
cmp rdi, r15
je 0x140006204
movzx edx, word [r12]
xor sil, sil
movzx ecx, word [rax]
cmp r9w, dx
jae 0x14000610b
lea eax, [r10 + rcx]
cmp ax, r8w
ja 0x14000622b
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x140006122
mov eax, ecx
add cx, r11w
cmp cx, r8w
ja 0x140006122
shl eax, 0xa
mov sil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x140006135
movzx r8d, al
mov r10d, ebp
mov r11d, ebp
jmp 0x140006182
mov r8d, eax
cmp eax, 0x800
jae 0x14000614f
shr r8d, 6
mov r10d, r9d
or r8b, 0xc0
mov r11d, r9d
jmp 0x140006182
cmp eax, 0x10000
jae 0x140006169
shr r8d, 0xc
mov r10d, 2
or r8b, 0xe0
mov r11d, r10d
jmp 0x140006182
shr r8d, 0x12
mov r10d, 3
movzx r11d, sil
or r8b, 0xf0
xor r11d, 1
add r11d, r11d
lea r9d, [r11 + 1]
mov rdx, r15
sub rdx, rdi
mov ecx, r9d
cmp rdx, rcx
jl 0x140006204
add qword [r14], 2
test sil, sil
jne 0x1400061a3
cmp r10d, 3
jae 0x1400061af
mov rcx, qword [rbx]
mov r9d, r11d
mov byte [rcx], r8b
inc qword [rbx]
test r9d, r9d
je 0x1400061e1
lea r8d, [r10 + r10*2]
add r8d, r8d
nop dword [rax + rax]
sub r8d, 6
mov edx, eax
mov ecx, r8d
dec r9d
shr edx, cl
mov rcx, qword [rbx]
and dl, 0x3f
or dl, 0x80
mov byte [rcx], dl
inc qword [rbx]
test r9d, r9d
jg 0x1400061c0
shr eax, 0xa
mov r9d, 1
test sil, sil
mov ecx, r9d
cmovne ecx, eax
mov word [r12], cx
mov rax, qword [r14]
cmp rax, r13
jne 0x1400060bf
mov rax, qword [rsp + 0x40]
cmp rax, qword [r14]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 2
jmp 0x140006212
Function at 0x140008591
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x98
call fcn.14000878d
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov ecx, dword [rax + 0x3c]
mov rax, qword [rsp + 0x88]
movsxd rcx, ecx
add rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
add rax, 0x18
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
add rax, 0x70
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x68]
mov ecx, dword [rcx]
add rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x14]
mov dword [rsp + 0x5c], eax
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x18]
mov dword [rsp + 0x58], eax
mov rax, qword [rsp + 0x60]
mov ecx, dword [rax + 0x1c]
mov rax, qword [rsp + 0x88]
mov ecx, ecx
add rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x60]
mov ecx, dword [rax + 0x20]
mov rax, qword [rsp + 0x88]
mov ecx, ecx
add rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x60]
mov ecx, dword [rax + 0x24]
mov rax, qword [rsp + 0x88]
mov ecx, ecx
add rax, rcx
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], 0
mov eax, dword [rsp + 0x3c]
cmp eax, dword [rsp + 0x5c]
jae 0x14000877d
mov rax, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x3c]
cmp dword [rax + rcx*4], 0
jne 0x14000869a
jmp 0x14000876d
mov rax, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x3c]
mov eax, dword [rax + rcx*4]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x34], 0
mov eax, dword [rsp + 0x34]
cmp eax, dword [rsp + 0x58]
jae 0x140008768
mov rax, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x34]
movzx eax, word [rax + rcx*2]
cmp eax, dword [rsp + 0x3c]
jne 0x140008753
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x34]
mov eax, dword [rax + rcx*4]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x88]
mov ecx, dword [rsp + 0x30]
add rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call fcn.140008864
cmp rax, 0xe
jne 0x14000874e
mov rax, qword [rsp + 0x28]
movsx eax, byte [rax]
cmp eax, 0x56
jne 0x14000874e
mov rax, qword [rsp + 0x28]
movsx eax, byte [rax + 7]
cmp eax, 0x50
jne 0x14000874e
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x88]
add rax, rcx
mov qword [rsp + 0x90], rax
jmp 0x14000877d
jmp 0x140008753
jmp 0x140008758
mov eax, dword [rsp + 0x34]
add eax, 1
mov dword [rsp + 0x34], eax
jmp 0x1400086b2
jmp 0x14000876d
mov eax, dword [rsp + 0x3c]
add eax, 1
mov dword [rsp + 0x3c], eax
jmp 0x140008674
mov rax, qword [rsp + 0x90]
add rsp, 0x98
ret
Function at 0x14000878d
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
sub rsp, 0x58
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov qword [rsp + 0x50], rax
mov rax, qword gs:[0x60]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
add rax, 0x38
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 8]
movzx eax, word [rax + 0x18]
cmp eax, 0
jne 0x140008813
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x30], rax
jmp 0x140008825
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
jmp 0x1400087dc
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140008846
mov rax, qword [rsp + 0x20]
add rsp, 0x58
ret
Function at 0x1400194a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
mov eax, 0x10118
call fcn.1400364c0
sub rsp, rax
mov rax, qword [0x140052010]
xor rax, rsp
mov qword [rsp + 0x100d0], rax
mov eax, dword [0x140053be8]
test eax, eax
je 0x1400196ef
cmp ecx, eax
jg 0x1400196ef
test ecx, eax
je 0x1400196ef
mov qword [rsp + 0x10110], rbx
mov qword [rsp + 0x10108], rbp
mov qword [rsp + 0x100e8], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x140053bec], eax
mov ebx, eax
je 0x140019545
nop dword [rax]
nop dword [rax + rax]
xor eax, eax
lock cmpxchg dword [0x140053bec], ebx
cmp dword [0x140053bec], ebx
je 0x140019545
mov ecx, 0x19
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x140053bec], ebx
jne 0x140019520
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
mov rbp, qword [0x140053be0]
mov rbx, 0xffffffffffffffff
cmp rbp, rbx
jne 0x140019574
lea rcx, [0x140053be0]
call fcn.1400193a0
mov rbp, rax
jmp 0x1400195ba
movzx eax, word [0x140053bf8]
cmp word [rsp + 0x50], ax
jne 0x14001959e
movzx eax, word [0x140053bfa]
cmp word [rsp + 0x52], ax
jne 0x14001959e
movzx eax, word [0x140053bfe]
cmp word [rsp + 0x56], ax
je 0x1400195ba
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x140053be0]
mov qword [0x140053be0], rbx
call fcn.1400193a0
xor r15d, r15d
test rbp, rbp
je 0x1400196c8
movzx ecx, word [rsp + 0x5e]
movzx edx, word [rsp + 0x5c]
mov eax, dword [0x140053bec]
movzx r9d, word [rsp + 0x5a]
movzx r8d, word [rsp + 0x58]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x20], edx
lea rdx, str._02d:_02d:_02d__03d__X:
mov qword [rsp + 0x10100], rsi
mov qword [rsp + 0x100f8], rdi
mov qword [rsp + 0x100f0], r14
call fcn.140009aa0
movsxd rsi, eax
lea r14, [rsp + 0x10130]
lea rdi, [rsp + 0x60]
mov qword [rsp + 0x48], r14
lea rdi, [rdi + rsi*2]
call fcn.140001030
mov r9, qword [rsp + 0x10128]
mov r8d, 0x8000
mov qword [rsp + 0x28], r14
mov rdx, rdi
mov qword [rsp + 0x20], r15
mov rcx, qword [rax]
or rcx, 1
call fcn.140024e4c
test eax, eax
lea rcx, [rsp + 0x60]
lea rdx, [0x14004b9a4]
cmovs eax, ebx
add eax, esi
cdqe
lea rcx, [rcx + rax*2]
call fcn.140009aa0
mov r14, qword [rsp + 0x100f0]
lea rax, [rsp + 0x60]
mov rdi, qword [rsp + 0x100f8]
mov rsi, qword [rsp + 0x10100]
nop word [rax + rax]
cmp word [rax + rbx*2 + 2], r15w
lea rbx, [rbx + 1]
jne 0x1400196a0
lea r8d, [rbx + rbx]
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
mov rcx, rbp
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbp, qword [rsp + 0x10108]
mov rbx, qword [rsp + 0x10110]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lock cmpxchg dword [0x140053bec], r15d
mov r15, qword [rsp + 0x100e8]
mov rcx, qword [rsp + 0x100d0]
xor rcx, rsp
call fcn.1400198d0
add rsp, 0x10118
ret

Function at 0x140027c88
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140027a78