joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140088410
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x1400ce700]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rdx, [0x1400bced0]
mov rbp, rcx
call fcn.140090e90
xor edi, edi
test rax, rax
je 0x1400884f6
mov ebx, edi
call fcn.14007ef84
mov r14d, dword [rax]
call fcn.14007ef84
mov r8d, 0x104
lea rcx, [rsp + 0x30]
mov rdx, rbp
mov dword [rax], edi
call fcn.140090ddc
mov rsi, rax
test rax, rax
je 0x140088487
call fcn.14007ef84
mov dword [rax], r14d
jmp 0x1400884b1
call fcn.14007ef84
cmp dword [rax], 0x22
jne 0x1400884ee
call fcn.14007ef84
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], r14d
call fcn.140090ddc
mov rbx, rax
mov rsi, rax
test rax, rax
je 0x1400884ee
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], di
jne 0x1400884b5
cmp rax, 3
je 0x1400884d0
mov rcx, rsi
call fcn.14008836c
test al, al
je 0x1400884e1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x1400884e1
mov dil, 1
mov rcx, rbx
call fcn.14007d5dc
mov al, dil
jmp 0x1400884f8
mov rcx, rbx
call fcn.14007d5dc
xor al, al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140073180
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x140089088
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x1400890bf
call fcn.14007ef84
mov dword [rax], reloc.WLDAP32.dll_Ordinal_22
call fcn.14007a6b0
xor eax, eax
jmp 0x14008914d
mov rdx, r9
mov rcx, r8
call fcn.140089024
mov rbx, rax
test rax, rax
je 0x14008914a
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x140088f50]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x140089137
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14007eef8
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14008911e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14008912d
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.14008d4c0
jmp 0x14008914a
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140089147
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x14008ad4c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x1400dbee0]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x14008ada3
cmp word [rdx], r13w
jne 0x14008ada3
or byte [rax + rdi*8 + 0x38], cl
jmp 0x14008ada8
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x14008aecd
mov r11d, reloc.WS2_32.dll_listen
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x14008aeee
lea r9, [rdx + 2]
cmp cx, r11w
je 0x14008ade1
mov rdx, r9
mov word [rbx], cx
jmp 0x14008ae08
cmp r9, r8
jae 0x14008ae18
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x14008adc2
jmp 0x14008aecd
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14008aec2
cmp dword [rsp + 0x80], esi
je 0x14008aec2
lea r8, [0x1400dbee0]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x14008ae9a
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x14008ae6a
mov word [rbx], r13w
jmp 0x14008aeca
mov ecx, reloc.WS2_32.dll_listen
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x14008ae77
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x14008aeca
cmp word [rsp + 0x70], r13w
jne 0x14008aea7
cmp rbx, r14
je 0x14008ae64
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.1400893e0
cmp word [rsp + 0x70], r13w
je 0x14008aecd
mov ecx, reloc.WS2_32.dll_listen
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1400dbee0]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x14008aec7
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x14008aecd
Function at 0x14008fbb0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14008fbc6
mov al, 1
jmp 0x14008fc26
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14008fbd7
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14008fc24
mov ecx, dword [rcx + 0x18]
nop
call fcn.140090810
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14008fc24
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14008fc24
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14008fc24
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14008fc26
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x140090920
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400893e0
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400893e0
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140090a70
cmp rax, 0xffffffffffffffff
je 0x140090a70
xor edi, edi
test rbp, rbp
jle 0x140090a1b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14008d448
mov rbx, rax
test rax, rax
jne 0x1400909a8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140090a11
mov edx, 0x8000
mov ecx, r14d
call fcn.14008a984
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14008c104
cmp eax, 0xffffffff
je 0x1400909f1
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400909b8
mov edx, r15d
mov ecx, r14d
call fcn.14008a984
jmp 0x140090a11
cmp byte [rsi + 0x38], dil
je 0x140090a08
cmp dword [rsi + 0x34], 5
jne 0x140090a08
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
cmp byte [rsi + 0x30], dil
je 0x140090a11
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14008d4c0
jmp 0x140090a84
jns 0x140090a84
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400893e0
cmp rax, 0xffffffffffffffff
jne 0x140090a3c
cmp byte [rsi + 0x30], dil
je 0x140090a84
mov edi, dword [rsi + 0x2c]
jmp 0x140090a84
mov ecx, r14d
call fcn.140090810
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140090a84
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, reloc.WS2_32.dll_listen
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
jmp 0x140090a84
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140090a7d
mov eax, dword [rsi + 0x2c]
jmp 0x140090a82
mov eax, reloc.WLDAP32.dll_Ordinal_22
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400893e0
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140094300
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140094330
xor eax, eax
jmp 0x1400943f3
mov rbp, rbx
cmp word [rax], si
je 0x140094355
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14009433c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140094338
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400912bc
movsxd r14, eax
test eax, eax
jne 0x140094393
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140094329
mov rcx, r14
call fcn.14008e0a4
mov rdi, rax
test rax, rax
jne 0x1400943ac
xor ecx, ecx
call fcn.14008d4c0
jmp 0x140094388
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400912bc
test eax, eax
jne 0x1400943dd
mov rcx, rdi
call fcn.14008d4c0
jmp 0x1400943e7
xor ecx, ecx
call fcn.14008d4c0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140094410
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140094497
mov rsi, rbx
cmp word [rax], bp
je 0x140094456
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140094440
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14009443c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14008e0a4
mov rdi, rax
test rax, rax
je 0x140094484
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14009a9b0
mov rbp, rdi
xor ecx, ecx
call fcn.14008d4c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140095750
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140095770
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14007eef8
or eax, 0xffffffff
jmp 0x140095772
xor eax, eax
add rsp, 0x28
ret

Function at 0x140097620
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1400ce700]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x14009766a
call fcn.14007ef64
mov dword [rax], reloc.WS2_32.dll_ntohs
call fcn.14007ef84
mov dword [rax], reloc.WS2_32.dll_listen
call fcn.14007a6b0
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140073180
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x140097675
lea eax, [rbx + 1]
jmp 0x140097657
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x140097655
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x140097657

Function at 0x14009a5e0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14009a608
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14009a608
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x18001da00
Capabilities:
Encode data using xor

Disassembly:
xchg ecx, eax
test ebp, esp
test al, 1
jrcxz 0x18001da51
int 0x1b
mov edx, 0x30b69549
jnp 0x18001d9dc
pushfq
repne insb byte [rdi], dx
or al, 5
xchg esi, eax
sal dword ds:[rsi - 0x79], 0x8e
insd dword [rdi], dx
loop 0x18001dab1
loop 0x18001dab1
invalid
retf 0x8f8a

Function at 0x180043490
Capabilities:
Encode data using xor

Disassembly:
pop rax
or ebx, ebp
fist word [rbx - 0x79f31b26]
mov al, 0x2d
mov ch, 0x5a
pop rdx
add eax, dword [rcx + 0x45452e7e]
mov esp, 0x1094792a
cld
call 0x10e3313e3
outsd dx, dword [rsi]
cmpsb byte [rsi], byte [rdi]
xlatb
push rcx
ror dword [rsi], cl
or al, 0x87
mov ebx, 0x5bb545
int1
xor dword [rax], 0x14
pop rdi
jle 0x18004349c
iret

Function at 0x1800694e0
Capabilities:
Encode data using xor

Disassembly:
imul ebx, esi, 0x378fd9cb
imul ebx, esi, 0x378fd9cb
rcr byte [rax], 1
sub al, 0xbd
mov ebx, 0xd77886e2
xor dword [rax - 0x8b91ec0], ebp
imul edi, ebp, 3
xchg esi, eax
mov edx, 0xbcdbffca
pop rsi
jae 0x1800694df
sbb eax, 0x3ec0d486
or al, 0x29
pop rdx
mov ah, 0x67
scasd eax, dword [rdi]
sti
pop rdi
sub cl, bh
invalid

Function at 0x1800caba0
Capabilities:
Encode data using xor

Disassembly:
mov es, word [rdx + 0x4a]
invalid
imul ebx, esp, 0x21d0a853
int 0xda
xchg esi, eax
fsubr qword [rax - 0x4b67f6df]
xor eax, 0x8270341f
sahf
pop rbx
mov byte [rbx - 0x29], bh
jno sym.LiMapBase.dll_public_virtual:_void___cdecl_gv::CVectorLineObject::setLineStyle_enum_gv::CVectorMapObject::LineStyle_const____ptr64____ptr64
mov ebx, 0xfe01b3f
leave
push rsp
jnp 0x1800cab7a
cdq
cmc
jge 0x1800cac20
jae 0x1688ecd72
cmp al, 0xcf
push rdi
invalid
mov eax, ebx
invalid
and dword [rbp + 0xf], edx
jae 0x1800cabf2
invalid

Function at 0x1800d9c80
Capabilities:
Encode data using xor

Disassembly:
xor byte [rdi - 0x735ad0e5], 0xde
cmp eax, 0x4976db7b
push rsi
push 0xffffffffffffffb8
enter 0x48a, 0xffffffffffffffc1
cmp eax, 0x917bd487
add al, 0xd7
push rdi
xor bh, cl
pop rdx
sal dword ds:[rsi - 0x79], 0x8e
insd dword [rdi], dx
imul ebx, esp, 0x21d0a853
imul ebx, esp, 0x21d0a853
imul ebx, esp, 0x21d0a853
int 0xda
xchg esi, eax
fsubr qword [rax - 0x4b67f6df]
xor eax, 0x8270341f
sahf
pop rbx
mov byte [rbx - 0x29], bh
jno sym.LiMapBase.dll_public_virtual:_void___cdecl_gv::CVectorMultiPolygonObject::setLineStyle_enum_gv::CVectorMapObject::LineStyle_const____ptr64____ptr64
mov ebx, 0xfe01b3f
leave
push rsp
jnp 0x1800d9c5a
cdq
cmc
jge 0x1800d9d00
jae 0x1008fbe52
cmp al, 0xcf
push rdi
invalid
jmp 0x1800d9ca8
and dword [rbp + 0xf], edx
jae 0x1800d9cd2
sbb dword [r13 + 0x7a], 0x46
jrcxz 0x1800d9cb1
or edx, eax
invalid
Function at 0x2fc5fdeb0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc5fe8b2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc621108]
test eax, eax
je 0x2fc5fe94a
lea rax, [0x2fc6210e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc621110]
mov qword [rbp - 8], rax
jmp 0x2fc5fe92e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc5fe922
cmp qword [rbp - 0x10], 0
je 0x2fc5fe922
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc5fe8e8
lea rax, [0x2fc6210e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc5fe94b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc5fea50
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc5fea78
mov eax, 0
jmp 0x2fc5feac6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc5feaa1
mov eax, 0
jmp 0x2fc5feac6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc5feac1
mov eax, 0
jmp 0x2fc5feac6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc5feacc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc5feb4a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc5feb41
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc5feb41
mov rax, qword [rbp - 8]
jmp 0x2fc5feb5f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc5feb14
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140041df0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140041e00]
mov dword [rax], 1
mov rax, qword [0x140041e10]
mov dword [rax], 1
mov rax, qword [0x140041d90]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140041de0]
mov dword [0x14004b00c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x140041ed0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x140041eb0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x140041b40]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x140001c17
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0
lea rax, [0x14003e03f]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, str.VirtualAllocExNuma
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp - 0x10], rax
mov rbx, qword [rbp - 0x10]
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x3e8
mov edx, 0
mov rcx, rax
call rbx
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
je 0x140001c9c
mov eax, 0
jmp 0x140001ca1
mov eax, 1
add rsp, 0x48
pop rbx
pop rbp
ret

Function at 0x140001ca8
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
lea rax, [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov eax, dword [rbp - 0x20]
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 1
ja 0x140001cd6
mov eax, 0
jmp 0x140001d0a
mov dword [rbp - 0x80], 0x40
lea rax, [rbp - 0x80]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call rax
mov rax, qword [rbp - 0x78]
shr rax, 0x1e
mov dword [rbp - 8], eax
cmp dword [rbp - 8], 1
ja 0x140001d05
mov eax, 0
jmp 0x140001d0a
mov eax, 1
add rsp, 0xa0
pop rbp
ret
Function at 0x140002280
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x3c]
cdqe
mov rdx, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x88]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x1c]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x20]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x24]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x38], rax
mov dword [rbp - 4], 0
jmp 0x14000237e
mov eax, dword [rbp - 4]
lea rdx, [rax*4]
mov rax, qword [rbp - 0x30]
add rax, rdx
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x40], rax
mov rdx, qword [rbp + 0x18]
mov rax, qword [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
call rax
test eax, eax
sete al
test al, al
je 0x14000237a
mov eax, dword [rbp - 4]
lea rdx, [rax + rax]
mov rax, qword [rbp - 0x38]
add rax, rdx
movzx eax, word [rax]
movzx eax, ax
lea rdx, [rax*4]
mov rax, qword [rbp - 0x28]
add rax, rdx
mov eax, dword [rax]
mov dword [rbp - 0x44], eax
mov eax, dword [rbp - 0x44]
mov rdx, qword [rbp + 0x10]
add rax, rdx
jmp 0x140002393
add dword [rbp - 4], 1
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x18]
cmp dword [rbp - 4], eax
jb 0x140002308
mov eax, 0
add rsp, 0x70
pop rbp
ret

Function at 0x14000cda0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]