joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14017d948
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
and qword [rsp + 0x40], 0
mov rbx, rcx
mov ecx, dword [rcx]
mov rsi, rdx
mov r14d, 0x40
lea rdi, [rbx + 0x60]
mov byte [rcx + rbx + 0x20], 0x80
inc ecx
cmp ecx, 0x38
jbe 0x14017d9a7
mov eax, ecx
mov edx, r14d
sub edx, ecx
lea rcx, [rbx + 0x20]
add rcx, rax
call fcn.140158b40
lea r9, [rsp + 0x40]
mov r8d, r14d
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.14017c1e4
xor ecx, ecx
mov eax, ecx
mov edx, r14d
sub edx, ecx
lea rcx, [rbx + 0x20]
add rcx, rax
call fcn.140158b40
mov rax, qword [rbx + 0x10]
lea r9, [rsp + 0x40]
shl rax, 3
lea rdx, [rbx + 0x20]
bswap rax
mov r8, r14
mov qword [rbx + 0x58], rax
mov rcx, rdi
call fcn.14017c1e4
mov rcx, rdi
mov r8d, 4
mov rax, qword [rcx]
lea rcx, [rcx + 8]
rol rax, 0x20
bswap rax
mov qword [rsi], rax
lea rsi, [rsi + 8]
sub r8, 1
jne 0x14017d9e6
mov edx, 0x80
mov rcx, rbx
call fcn.140158b40
movups xmm0, xmmword [0x1403e1850]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x1403e1860]
movups xmmword [rdi + 0x10], xmm1
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1401c9544
Capabilities:
Get hostname

Disassembly:
push rbx
sub rsp, 0x20
and dword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
nop dword [rax + rax]
test eax, eax
jne 0x1401c958d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0xea
je 0x1401c958d
test eax, eax
jle 0x1401c9599
movzx eax, ax
or eax, 0x80070000
jmp 0x1401c9599
cmp dword [rsp + 0x38], 1
seta al
mov byte [rbx], al
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140348e78
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx], 0
mov rbx, rdx
jne 0x140348e91
mov eax, dword [rcx + 8]
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rcx]
lea rdx, str.FWClosePolicyStore
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
test rax, rax
jne 0x140348f00
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
call fcn.1400abd44
cmp dword [rax], 2
jbe 0x140348ef7
lea rcx, str.Failed_to_get_address_of_FWClosePolicyStore
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x50], rcx
lea rdx, [0x140472e58]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140004d64
mov eax, ebx
add rsp, 0x30
pop rbx
ret
movabs r10, 0xb099976a12dca270
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp qword [case.0x140084480.0]

Function at 0x140348fd0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rbx, r8
movzx edi, dx
jne 0x140348fee
mov eax, dword [rcx + 8]
jmp 0x14034906e
mov rcx, qword [rcx]
lea rdx, str.FWFreeFirewallRulesOld
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
test rax, rax
jne 0x140349058
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
call fcn.1400abd44
cmp dword [rax], 2
jbe 0x140349054
lea rcx, str.Failed_to_get_address_of_FWFreeFirewallRulesOld
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x58], rcx
lea rdx, [0x140472e58]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140004d64
mov eax, ebx
jmp 0x14034906e
movabs r10, 0x88611fa11ad45270
mov rdx, rbx
movzx ecx, di
call qword [case.0x140084480.0]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140349080
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov word [rsp + 0x20], r9w
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rbx, r8
mov rdi, rdx
jne 0x1403490a4
mov eax, dword [rcx + 8]
jmp 0x14034913c
mov rcx, qword [rcx]
lea rdx, str.FWQueryFirewallRules
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov r11, rax
test rax, rax
jne 0x140349111
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
call fcn.1400abd44
cmp dword [rax], 2
jbe 0x14034910d
lea rcx, str.Failed_to_get_address_of_FWQueryFirewallRules
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x40], rcx
lea rdx, [0x140472e58]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140004d64
mov eax, ebx
jmp 0x14034913c
xor r8d, r8d
movabs r10, 0xe9711f7738575070
mov rax, qword [rsp + 0x68]
mov rdx, rbx
mov r9, qword [rsp + 0x60]
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov rax, r11
call qword [case.0x140084480.0]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140351b80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test rdx, rdx
jne 0x140351b89
xor eax, eax
ret
jmp fcn.140351860
Function at 0x140a44490
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140a4449d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140a444ad
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140a44495
lea eax, [rcx + 1]
jmp 0x140a444bb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140a444ce
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140a444b4
sub eax, 3
jb 0x140a444ee
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140a4453d
sar eax, 1
movsxd rbp, eax
jb 0x140a44524
jmp 0x140a444fc
add ebx, ebx
jne 0x140a444fa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140a44524
inc ecx
add ebx, ebx
jne 0x140a4450a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140a44524
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140a4451d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140a4450c
add ecx, 2
jmp 0x140a44529
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140a44452
jmp 0x140a4449d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0xa3b000]
mov eax, dword [rdi]
or eax, eax
je 0x140a445a9
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xa45330]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140a4454d
jns 0x140a44582
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140a4458c
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140a445a3
mov qword [rbx], rax
add rbx, 8
jmp 0x140a4456d
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140a445ed
cmp al, 0xef
ja 0x140a445d5
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140a445b5
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x140a445c4
mov eax, dword [rdi]
add rdi, 4
jmp 0x140a445c4
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x277]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140a44641
sub rsp, 0xffffffffffffff80
jmp 0x140666350
Function at 0x1400053b8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005402
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005402
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005402
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005402
cmp dword [rcx + 0x84], 0xe
jbe 0x140005402
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140005404
xor al, al
add rsp, 0x28
ret
Function at 0x140004440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x1400044d0
cmp r11, r10
ja 0x140004546
cmp r10, rdx
ja 0x14000455a
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x1400044d2
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x1400044b0
jmp 0x140004534
ja 0x1400044da
mov r11, r10
cmp rax, r8
jne 0x140004474
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x140004510
mov rdi, r8
sub ecx, edx
jns 0x14000452b
jmp 0x140004536
cmp r8, rsi
je 0x14000456b
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x140004536
xor al, 1
cmp rdi, rsi
jne 0x1400044f0
jmp 0x140004536
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140017c70
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140017a40
ud2
lea rcx, str.called__Option::unwrap____on_a__None__value
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140017ab0
ud2

Function at 0x140008cf0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae fcn.140001c70
cmp rax, rcx
je 0x140008d15
cmp rdx, 4
jae 0x140008d18
xor eax, eax
xor r8d, r8d
jmp 0x140008db0
xor eax, eax
ret
mov r8, rdx
and r8, 0xfffffffffffffffc
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x140019320]
movdqa xmm3, xmmword [0x140019330]
pxor xmm1, xmm1
nop dword [rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x140008d40
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x140008dc7
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x140008db0
ret
Function at 0x14000a090
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r9, qword [rcx]
test r9, r9
je 0x14000a0eb
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x14000a0eb
movzx eax, byte [r9 + rcx]
cmp eax, 0x49
je 0x14000a106
cmp eax, 0x42
jne 0x14000a0eb
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x14000a1b6
cmp byte [r9 + r11], 0x5f
jne 0x14000a1b6
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x14000a21e
mov rcx, rsi
xor edx, edx
call fcn.140005760
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.140005760
test al, al
jne 0x14000a2b1
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14000a142
lea rdx, [0x14001ab04]
mov r8d, 1
call fcn.140002200
test al, al
jne 0x14000a2b1
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x14000a0fa
xor r14d, r14d
lea rbx, [0x14001aeb8]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x14000a174
cmp byte [rax + rcx], 0x45
je 0x14000a2d3
sub r14, 1
jb 0x14000a199
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14000a199
mov r8d, 2
mov rdx, rbx
call fcn.140002200
test al, al
jne 0x14000a2b1
mov rcx, rsi
call fcn.140006f70
test al, al
jne 0x14000a2b1
mov rax, qword [rsi]
test rax, rax
jne 0x14000a160
jmp 0x14000a0fa
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r8b, 1
cmp r11, r10
jae 0x14000a278
movzx edx, byte [r9 + r11]
cmp dl, 0x5f
je 0x14000a212
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x14000a1fc
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x14000a1eb
add dl, 0xa9
jmp 0x14000a1fa
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x14000a278
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x14000a278
movzx edx, bl
add rax, rdx
jae 0x14000a1c0
jmp 0x14000a278
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x14000a278
cmp rax, rcx
jae 0x14000a275
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x14000a2cb
cmp qword [rsi + 0x20], 0
je 0x14000a2c4
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.14000a090
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x14000a0fc
mov r8b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14000a2b9
lea rax, str.invalid_syntaxrecursion_limit_reached
lea rdx, [0x14001ae78]
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
add r8, 0x10
call fcn.140002200
test al, al
je 0x14000a2b9
mov dil, 2
jmp 0x14000a0fa
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x14000a0fa
mov dil, 1
xor r8d, r8d
jmp 0x14000a27a
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x14000a0fa
Function at 0x140010ff0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rax, rdx
movzx r11d, byte [rdx + 0x38]
cmp r11b, 1
ja 0x140011057
movzx r9d, byte [rax + 0x10]
movzx r8d, byte [rax + 0x3a]
xor edx, edx
test r8b, r8b
jne 0x1400111a8
cmp r9b, 5
jb 0x1400111a8
mov r10, qword [rax]
mov rdx, qword [rax + 8]
xor esi, esi
test r11b, r11b
jne 0x140011047
cmp r9b, 6
je 0x140011047
mov esi, 2
cmp rdx, 2
jb 0x140011250
cmp rsi, rdx
jne case.0x1400100f9.31
xor edx, edx
jmp 0x1400111a8
xor edx, edx
xor r8d, r8d
xor r10d, r10d
add rdx, r10
lea rdi, [r10 + rsi]
inc rdi
inc edi
cmp rdi, rdx
sete dl
movzx r10d, byte [r10 + rsi]
adc al, 0x32
test dl, 1
jne 0x14001119d
cmp r10b, 0x2e
jne 0x14001119d
movzx edx, byte [rdi]
cmp dl, 0x5c
sete r10b
cmp dl, 0x2f
cli
invalid
sete dl
or dl, r10b
jmp 0x1400111a8
cmp r10b, 0x2e
sete r10b
and dl, r10b
xor r10d, r10d
test r11b, r11b
jne case.default.0x1400111d0
invalid
cmp r9b, 6
je case.default.0x1400111d0
invalid
invalid
invalid
movzx r9d, r9b
lea r10, [0x14001d858]
add byte [rdi + 0x63], cl
or al, 0x8a
mov r10, qword [rax + 0x20]
add r10, 4
mov r9, qword [rax + 0x20]
mov r10, qword [rax + 0x30]
mov r10d, 6
jmp case.default.0x1400111d0
mov r9, qword [rax + 0x20]
mov r10, qword [rax + 0x30]
mov r10d, 2
jmp case.default.0x1400111d0
lea r8, str.library_std_srcpath.rs
mov ecx, 2
call fcn.140017960
ud2
clc
add ecx, dword [rdi]
xchg edi, esi
add byte [rax], al
add byte [rax - 0x73], cl
or eax, 0x8a3c

Function at 0x14001615c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400161a6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400161a6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400161a6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400161a6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400161a6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400161a8
xor al, al
add rsp, 0x28
ret

Function at 0x1400169b0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov ebx, ecx
mov dword [rsp + 0x60], 0
xor ecx, ecx
mov dword [rsp + 0x68], 2
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140016a12
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140016a12
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
jne 0x140016a12
mov eax, 0x20b
cmp word [rdx + 0x18], ax
jne 0x140016a12
cmp dword [rdx + 0x84], 0xe
jbe 0x140016a12
cmp dword [rdx + 0xf8], 0
je 0x140016a12
mov ecx, ebx
call fcn.140016870
lea rax, [rsp + 0x68]
mov byte [rsp + 0x58], 0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rcx, [0x140021298]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.1400166f0
cmp dword [rsp + 0x60], 0
jne 0x140016a55
mov ecx, ebx
call fcn.140016820
int3
add rsp, 0x40
pop rbx
ret
Function at 0x140016aa0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
xor eax, eax
mov ebx, ecx
xor ecx, ecx
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x68], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140016afc
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140016afc
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140016afc
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140016afc
cmp dword [rcx + 0x84], 0xe
jbe 0x140016afc
cmp dword [rcx + 0xf8], 0
je 0x140016afc
mov ecx, ebx
call fcn.140016870
lea rax, [rsp + 0x68]
mov byte [rsp + 0x58], 0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rcx, [0x140021298]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.1400166f0
cmp dword [rsp + 0x60], 0
jne 0x140016b3f
mov ecx, ebx
call fcn.140016820
int3
add rsp, 0x40
pop rbx
ret

Function at 0x140017280
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rax, qword [0x140021088]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1400172bc
mov ecx, 5
int 0x29
mov ecx, 2
call fcn.140016000
xorps xmm0, xmm0
lea rcx, [rbp + 0x10]
xor eax, eax
xor edx, edx
mov r8d, 0x4d0
mov qword [rbp], rax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x10]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rbp + 0x108]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x140017378
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], 0
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0x4f8]
add rax, 8
mov dword [rsp + 0x70], 0xc0000417
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x74], 1
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x1400173de
test ebx, ebx
jne 0x1400173de
lea ecx, [rax + 2]
call fcn.140016000
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.140017880
mov rbx, qword [rsp + 0x600]
add rsp, 0x5f0
pop rbp
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00409850]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x00409860]
mov dword [rax], 1
mov rax, qword [0x00409870]
mov dword [rax], 1
mov rax, qword [0x00409840]
mov dword [rax], 1
mov rax, qword [0x00409700]
cmp word [rax], 0x5a4d
jne 0x401067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x4010d0
mov rax, qword [0x00409830]
mov dword [0x0040c020], ecx
mov eax, dword [rax]
test eax, eax
je 0x4010c0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x004097f0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x004097d0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x004096b0]
cmp dword [rax], 1
je 0x401108
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x401120
cmp dx, 0x20b
jne 0x401067
cmp dword [rax + 0x84], 0xe
jbe 0x401067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x401067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x401067

Function at 0x4018a0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]
Function at 0x401910
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x0040c0c4]
mov r12, rcx
test ebx, ebx
jle 0x401a40
mov rax, qword [0x0040c0c8]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x40195c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x4019e3
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x401940
mov rcx, r12
call dbg.__mingw_GetSectionForAddress
mov rsi, rax
test rax, rax
je 0x401a62
mov rax, qword [0x0040c0c8]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call dbg._GetPEImageBase
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x0040c0c8]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x401a47
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x4019dc
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x4019f0
add dword [0x0040c0c4], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x0040c0c8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x4019dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop dword [rax]
xor ebx, ebx
jmp 0x401967
mov rax, qword [0x0040c0c8]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x401f30
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0040c120]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0040c100]
test rbx, rbx
je 0x401f84
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x401f7b
test r12, r12
je 0x401f7b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x401f60
lea rcx, [0x0040c120]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x4021a0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x4021b8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x4021c0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret