joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000bdb0
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
call fcn.14000abd0
test eax, eax
je 0x14000bdc9
xor eax, eax
jmp 0x14000beba
mov qword [rsp + 0x50], 0
mov edx, 0x10000
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x48], rax
mov r8d, 0x8000
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rsp + 0x40], 0xffffffffffffffff
je 0x14000beb5
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x14000beaa
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x50]
add rsp, 0x68
ret
Function at 0x14000c620
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0xffffffffffffffff
je 0x14000c750
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14000c745
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x14000c73a
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x14000c72f
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 0x3c]
mov rax, qword [rsp + 0x60]
add rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
cmp dword [rax], 0x4550
jne 0x14000c72f
mov rax, qword [rsp + 0x68]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x14000c72f
mov dword [rsp + 0x48], 1
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x48]
add rsp, 0x78
ret

Function at 0x14000cd60
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x20], 0
mov edx, 2
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14000cdc8
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x14000cdc8
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x3c]
mov dword [rsp + 0x28], eax
mov ecx, dword [rsp + 0x28]
mov rax, qword [rsp + 0x50]
add rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
cmp dword [rax], 0x4550
je 0x14000cdc8
mov qword [rsp + 0x20], 0
jmp 0x14000cdd3
mov rax, qword [rsp + 0x20]
add rsp, 0x48
ret
Function at 0x14000d2b0
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x168
mov dword [rsp + 0x150], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rsp + 0x170]
mov r8, qword [r8]
lea rdx, [0x140040034]
lea rcx, [0x140040120]
call fcn.140015d10
mov edx, 1
lea rcx, [rsp + 0x40]
call fcn.140015a30
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14000d382
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x158], rax
cmp qword [rsp + 0x158], 0
je 0x14000d371
mov rcx, qword [rsp + 0x170]
mov rax, qword [rsp + 0x158]
mov rax, qword [rax]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [rsp + 0x150], 1
jmp 0x14000d377
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x150]
add rsp, 0x168
ret
Function at 0x14000e000
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov byte [rsp + 0x28], 0
call fcn.1400151a0
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14000e0bf
mov r8d, 0xf01ff
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14000e0a0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x14000e070
mov dword [rsp + 0x3c], 1
jmp 0x14000e078
mov dword [rsp + 0x3c], 0
movzx eax, byte [rsp + 0x3c]
mov byte [rsp + 0x28], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x38], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x38], eax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, byte [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x14000e0d0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x268
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x270]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000e167
mov dword [rsp + 0x250], 0
mov r9d, 0x104
lea r8, [rsp + 0x40]
mov edx, dword [rsp + 0x250]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x14000e15c
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call fcn.14000e0d0
mov eax, dword [rsp + 0x250]
add eax, 1
mov dword [rsp + 0x250], eax
jmp 0x14000e119
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x270]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add rsp, 0x268
ret

Function at 0x14000e790
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r8d, 0xd0
xor edx, edx
mov rcx, qword [rsp + 0x30]
call fcn.14003ce30
mov r11, qword [rsp + 0x30]
mov dword [r11], 0x67452301
mov rax, qword [rsp + 0x30]
mov dword [rax + 4], 0xefcdab89
mov rax, qword [rsp + 0x30]
mov dword [rax + 8], 0x98badcfe
mov rax, qword [rsp + 0x30]
mov dword [rax + 0xc], 0x10325476
mov rax, qword [rsp + 0x30]
mov dword [rax + 0x10], 0xc3d2e1f0
add rsp, 0x28
ret
Function at 0x140012820
Capabilities:
Query service status
Start service

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov byte [rsp + 0x28], 0
call fcn.1400151a0
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140012862
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14001291c
mov r8d, 0xf01ff
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400128fd
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1400128af
cmp dword [rsp + 0x44], 4
je 0x1400128cd
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x1400128cd
mov dword [rsp + 0x60], 0
jmp 0x1400128d5
mov dword [rsp + 0x60], 1
movzx eax, byte [rsp + 0x60]
mov byte [rsp + 0x28], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x38], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x38], eax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, byte [rsp + 0x28]
add rsp, 0x78
ret
Function at 0x14001c700
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x14001c858
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x3c]
mov dword [rsp + 0x20], eax
mov ecx, dword [rsp + 0x20]
mov rax, qword [rsp + 0x60]
add rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
jne 0x14001c858
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x90]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14001c858
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x50]
cmp dword [rsp + 0x30], eax
jae 0x14001c858
mov ecx, dword [rsp + 0x30]
mov rax, qword [rsp + 0x60]
add rax, rcx
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14001c858
mov rax, qword [rsp + 0x38]
cmp dword [rax + 0xc], 0
je 0x14001c858
mov rax, qword [rsp + 0x38]
cmp dword [rax + 0x10], 0
je 0x14001c858
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x50]
cmp dword [rcx + 0x10], eax
jae 0x14001c858
mov rax, qword [rsp + 0x38]
mov ecx, dword [rax + 0x10]
mov rax, qword [rsp + 0x60]
add rax, rcx
test rax, rax
je 0x14001c858
mov rax, qword [rsp + 0x38]
mov ecx, dword [rax + 0x10]
mov rax, qword [rsp + 0x60]
add rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x14001c845
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x68]
cmp qword [rcx], rax
jne 0x14001c835
mov edx, 8
mov rcx, qword [rsp + 0x40]
call fcn.140008140
test eax, eax
je 0x14001c835
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x40]
add rax, 8
mov qword [rsp + 0x40], rax
jmp 0x14001c7fb
mov rax, qword [rsp + 0x38]
add rax, 0x14
mov qword [rsp + 0x38], rax
jmp 0x14001c79d
add rsp, 0x58
ret
Function at 0x1400238b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
cmp qword [0x140051ee0], 0
je 0x1400238d6
cmp qword [0x140051ee8], 0
jne 0x140023966
mov edx, 1
lea rcx, [0x140043ca0]
call fcn.14000d610
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
add rcx, 0xa
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, 4
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140023948
mov rax, qword [rsp + 0x28]
mov rcx, qword [0x140051ed8]
sub rcx, rax
sub rcx, 0xe
mov rax, qword [rsp + 0x28]
mov dword [rax + 0xa], ecx
mov rcx, qword [rsp + 0x28]
add rcx, 0xa
lea r9, [rsp + 0x20]
mov r8d, dword [rsp + 0x20]
mov edx, 4
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140023973
lea rcx, [0x140023460]
call qword [0x140051ee8]
add rsp, 0x38
ret

Function at 0x140025990
Capabilities:
Accept command line arguments
Print debug messages

Disassembly:
sub rsp, 0x568
mov rax, qword [0x140051080]
xor rax, rsp
mov qword [rsp + 0x550], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [rsp + 0x20], 2
jne 0x140025b36
mov rcx, qword [rax + 8]
mov qword [rsp + 0x560], rbx
call fcn.14002ae58
mov r8d, 0x104
lea rdx, [rsp + 0x140]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 0x5c
lea rcx, [rsp + 0x140]
call fcn.140026b50
test rax, rax
je 0x140025a3c
movups xmm0, xmmword [str.LDUrlMon64.dll]
movups xmmword [rax + 2], xmm0
movsd xmm0, qword [0x14004c660]
movsd qword [rax + 0x12], xmm0
mov ecx, dword [0x14004c668]
mov dword [rax + 0x1a], ecx
movzx ecx, word [0x14004c66c]
mov word [rax + 0x1e], cx
mov r9d, ebx
lea r8, [rsp + 0x140]
lea rdx, str.LDUrlMonInject:_injecting__s_into_PID__d:
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140025ab5
mov r8d, 0x1b58
lea rcx, [rsp + 0x140]
mov rdx, rax
call fcn.1400054f0
test eax, eax
lea rcx, str.Failure
lea r8, str.Success
mov edx, 0x80
cmove r8, rcx
lea rcx, [rsp + 0x40]
call fcn.14002af08
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140025acb
lea r8, str.Cannot_open_process
mov edx, 0x80
lea rcx, [rsp + 0x40]
call fcn.14002af08
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0xa
lea rdx, [rsp + 0x28]
mov ecx, eax
call fcn.14002b060
lea r8, str._LE
mov edx, 0x80
lea rcx, [rsp + 0x40]
call fcn.14002af08
lea r8, [rsp + 0x28]
mov edx, 0x80
lea rcx, [rsp + 0x40]
call fcn.14002af08
lea r8, [0x14004c71c]
mov edx, 0x80
lea rcx, [rsp + 0x40]
call fcn.14002af08
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rbx, qword [rsp + 0x560]
xor eax, eax
mov rcx, qword [rsp + 0x550]
xor rcx, rsp
call fcn.140025b60
add rsp, 0x568
ret
Function at 0x140026640
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002668a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002668a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002668a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002668a
cmp dword [rcx + 0x84], 0xe
jbe 0x14002668a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002668c
xor al, al
add rsp, 0x28
ret

Function at 0x14002c924
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14002c714
Function at 0x140034a9c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140034acc
xor eax, eax
jmp 0x140034b8f
mov rbp, rbx
cmp word [rax], si
je 0x140034af1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140034ad8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140034ad4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400349ec
movsxd r14, eax
test eax, eax
jne 0x140034b2f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140034ac5
mov rcx, r14
call fcn.140032668
mov rdi, rax
test rax, rax
jne 0x140034b48
xor ecx, ecx
call fcn.14003262c
jmp 0x140034b24
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400349ec
test eax, eax
jne 0x140034b79
mov rcx, rdi
call fcn.14003262c
jmp 0x140034b83
xor ecx, ecx
call fcn.14003262c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14003cb50
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14003cb78
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14003cb78
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x401a70
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x0040a624]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x401bf8
mov rax, qword [0x0040a628]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x401abc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x401b45
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x401aa0
mov rcx, rbx
call fcn.00402710
test rax, rax
mov r12, rax
je 0x401c2d
mov rax, qword [0x0040a628]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.00402840
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x0040a628]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.DLL_VirtualQuery]
test rax, rax
je 0x401c10
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x401b3e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x401ba0
add dword [0x0040a624], 1
cmp edi, 8
jae 0x401b73
test dil, 4
jne 0x401be4
test edi, edi
je 0x401b68
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x401bff
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x401b68
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x401b8c
jmp 0x401b68
add rsi, qword [0x0040a628]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.DLL_VirtualProtect]
test eax, eax
jne 0x401b3e
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00405b50
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x401b68
xor esi, esi
jmp 0x401ac7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x401b68
mov rax, qword [0x0040a628]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.00405b50
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.00405b50
nop
nop dword [rax]

Function at 0x402380
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0040a900]
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov rbx, qword [0x0040a8e0]
test rbx, rbx
je 0x4023d4
mov rbp, qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.DLL_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x4023cb
test rsi, rsi
je 0x4023cb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4023b0
lea rcx, [0x0040a900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
Function at 0x402710
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00407600]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x40277d
mov rcx, r8
call fcn.004025f0
test eax, eax
je 0x40277d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x40277d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x402774
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x40277f
add rax, 0x28
cmp rax, r9
jne 0x402760
xor eax, eax
add rsp, 0x28
ret
Function at 0x405b50
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x00401540]
jmp 0x401510
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00402d50
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.00402d50
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x401530
Function at 0x140002f80
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140002fdd
lea rbx, [0x140064ba0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140002fc4
cmp r10, 2
jb 0x140002fc4
cmp byte [r9], r8b
jne 0x140002fc4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140002fa0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000301f
lea rbx, [0x140064ba0]
cmp r8b, 0x23
jne 0x140003003
cmp byte [r9], r8b
jne 0x140003003
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140002ff0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140003160
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14000317a
mov qword [r8], 0
lea rdx, [0x140064700]
call fcn.140003030
mov rbx, rax
test rax, rax
jne 0x14000319a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140003273
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003273
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140003273
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003273
cmp rdi, 0xffffffffffffffff
je 0x140003273
mov rax, qword [0x140147a20]
test rax, rax
je 0x140003210
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140003273
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140003260
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140147a20]
test rax, rax
je 0x140003255
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000327c
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x14000326e
mov qword [r14], rdi
mov rax, rsi
jmp 0x14000327e
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret