joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001dda4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18001ddd4
xor eax, eax
jmp 0x18001de97
mov rbp, rbx
cmp word [rax], si
je 0x18001ddf9
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18001dde0
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18001dddc
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18001dcc4
movsxd r14, eax
test eax, eax
jne 0x18001de37
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18001ddcd
mov rcx, r14
call fcn.18001966c
mov rdi, rax
test rax, rax
jne 0x18001de50
xor ecx, ecx
call fcn.180019630
jmp 0x18001de2c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18001dcc4
test eax, eax
jne 0x18001de81
mov rcx, rdi
call fcn.180019630
jmp 0x18001de8b
xor ecx, ecx
call fcn.180019630
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x180024430
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180024458
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180024458
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x404730
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x40
mov dword [rsp + 0x2c], 0x10
lea r8, [rsp + 0x2c]
mov rbx, rdx
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x40476c
movzx eax, word [rsp + 0x32]
cmp dword [rsp + 0x2c], 0x10
mov word [rbx + 0x10], ax
mov eax, dword [rsp + 0x34]
setne byte [rbx + 0x12]
mov dword [rbx], eax
add rsp, 0x40
pop rbx
ret

Function at 0x4048f0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x68]
test rax, rax
je 0x40492a
sub rax, rdx
add rax, qword [rcx + 0x78]
test rdx, rdx
mov rcx, rax
je 0x40492a
xor eax, eax
nop word [rax + rax]
mov r8, rax
and r8d, 3
movzx r8d, byte [rcx + r8 - 4]
xor byte [rcx + rax], r8b
add rax, 1
cmp rdx, rax
jne 0x404910
ret

Function at 0x4049f0
Capabilities:
Set socket configuration

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbx, qword [sym.imp.WS2_32.dll_setsockopt]
mov r8d, 1
mov edx, 6
lea rdi, [rsp + 0x3c]
mov rsi, rcx
mov dword [rsp + 0x20], 4
mov rcx, qword [rcx]
mov r9, rdi
mov dword [rsp + 0x3c], 1
call rbx
mov rcx, qword [rsi]
mov dword [rsp + 0x20], 4
mov r9, rdi
mov r8d, 8
mov edx, 0xffff
call rbx
nop
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
Function at 0x4053a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x678
test rcx, rcx
mov rdi, rcx
je 0x405570
mov edx, 0x360
mov ecx, 1
call sub.msvcrt.dll_calloc
test rax, rax
mov rsi, rax
je 0x405590
lea rbx, [rsp + 0x250]
mov rdx, rdi
mov r8d, 0x208
mov rcx, rbx
call sub.msvcrt.dll_strncpy
mov byte [rsp + 0x457], 0
mov rdx, rbx
mov ecx, dword [rdx]
add rdx, 4
lea eax, [rcx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x4053f6
mov ecx, eax
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea rcx, [rdx + 2]
mov edi, eax
cmove rdx, rcx
add dil, al
sbb rdx, 3
lea rax, [rdx - 1]
cmp rax, rbx
jbe 0x405470
cmp byte [rax - 1], 0x3a
je 0x405470
movzx edx, byte [rax]
cmp dl, 0x2f
je 0x405450
cmp dl, 0x5c
jne 0x405470
nop word [rax + rax]
sub rax, 1
mov byte [rax + 1], 0
cmp rax, rbx
je 0x405470
cmp byte [rax - 1], 0x3a
je 0x405470
movzx edx, byte [rax]
cmp dl, 0x5c
je 0x405450
cmp dl, 0x2f
je 0x405450
lea rdi, [rsp + 0x40]
xor edx, edx
mov r8d, 0x208
lea rbp, [rsp + 0x460]
mov rcx, rdi
call sub.msvcrt.dll_memset
xor edx, edx
mov r9d, 0xffffffff
mov r8, rbx
mov ecx, 0xfde9
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
mov r9d, 0x104
mov r8, rdi
mov ecx, 0xfde9
mov dword [rsp + 0x28], 0x208
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rdx, rbp
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x405540
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x405550
test al, 0x10
je 0x405550
lea rdx, [0x0041428a]
mov rcx, rdi
call sub.msvcrt.dll_wcscat
lea rdx, [rsi + 8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov byte [rsi + 0x258], 0
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x678
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor eax, eax
mov word [rsp + 0x40], ax
jmp 0x4054f4
mov rcx, rsi
xor esi, esi
call sub.msvcrt.dll_free
mov rax, rsi
add rsp, 0x678
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor esi, esi
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x678
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x678
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x4074a0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
push rbx
sub rsp, 0x58
cmp r8d, 0xfffffffe
mov rbx, rcx
mov rsi, rdx
mov dword [rsp + 0x80], r8d
je 0x4074ea
test r8d, r8d
jle 0x4074f1
test byte [rcx + 0xd1], 8
jne 0x407530
test r9b, r9b
movsxd r8, r8d
je 0x407500
add qword [rbx + 0x58], r8
mov edx, 7
mov rcx, rbx
lea r8, [rsp + 0x80]
call fcn.00405170
nop
add rsp, 0x58
pop rbx
pop rsi
ret
or byte [rcx + 0xd1], 0x20
add rsp, 0x58
pop rbx
pop rsi
ret
lea rcx, [rbx + 0x68]
xor edx, edx
call fcn.00406220
lea r8, [rsp + 0x80]
mov edx, 8
mov rcx, rbx
call fcn.00405170
nop
add rsp, 0x58
pop rbx
pop rsi
ret
mov dword [rsp + 0x2c], r9d
lea r8, [rsp + 0x3c]
mov rcx, qword [rcx + 0x38]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x3c], 0x10
call qword [sym.imp.WS2_32.dll_getsockname]
movsxd rdx, dword [rsp + 0x80]
mov rcx, rsi
call fcn.004071b0
mov r8d, dword [rsp + 0x80]
mov r9d, dword [rsp + 0x2c]
jmp 0x4074c8

Function at 0x407d60
Capabilities:
Initialize winsock library

Disassembly:
push rdi
push rbx
sub rsp, 0x1c8
xor eax, eax
lea rdx, [rsp + 0x20]
mov rbx, rcx
mov ecx, 0x13
mov rdi, rbx
rep stosq qword [rdi], rax
mov dword [rbx + 0x60], 0xffffffff
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea rax, str.udp:__8.8.8.8:53
mov dword [rbx + 0x28], 0xbb8
mov qword [rbx + 8], rax
lea rax, str.udp:___2001:4860:4860::8888_:53
mov qword [rbx + 0x18], rax
add rsp, 0x1c8
pop rbx
pop rdi
ret
Function at 0x40a260
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
mov rcx, qword [rcx + 0x38]
test byte [rbx + 0xd1], 1
je 0x40a320
lea rax, [rsp + 0x40]
mov r9d, 2
mov qword [rsp + 0x48], 0
mov word [rsp + 0x40], r9w
movzx r9d, word [rbx + 0x34]
mov word [rsp + 0x42], r9w
mov r9d, dword [rbx + 0x24]
mov dword [rsp + 0x28], 0x10
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x44], r9d
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jg 0x40a2d0
test eax, eax
js 0x40a2e9
je 0x40a314
add rsp, 0x50
pop rbx
ret
mov rcx, qword [rbx + 0x38]
lea rdx, [rbx + 0x10]
mov dword [rsp + 0x3c], eax
call fcn.00404730
mov eax, dword [rsp + 0x3c]
test eax, eax
jns 0x40a2c5
mov rbx, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rbx
cmp eax, 0x2714
je 0x40a32b
call rbx
cmp eax, 0x2734
je 0x40a32b
call rbx
cmp eax, 0x2733
je 0x40a32b
call rbx
cmp eax, 0x2746
je 0x40a332
mov eax, 0xffffffff
add rsp, 0x50
pop rbx
ret
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
jmp 0x40a2c1
mov eax, 0xfffffffe
jmp 0x40a2c7
mov eax, 0xfffffffd
jmp 0x40a2c7

Function at 0x40aeb0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
mov rcx, qword [rcx + 0x38]
test byte [rbx + 0xd1], 1
je 0x40af40
mov r9d, 2
mov dword [rsp + 0x3c], 0x10
mov word [rsp + 0x40], r9w
movzx r9d, word [rbx + 0x34]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x48], 0
mov word [rsp + 0x42], r9w
mov r9d, dword [rbx + 0x24]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x44], r9d
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x28], r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recvfrom]
test eax, eax
jle 0x40af30
movzx edx, word [rsp + 0x42]
cmp dword [rsp + 0x3c], 0x10
mov word [rbx + 0x34], dx
mov edx, dword [rsp + 0x44]
setne byte [rbx + 0x36]
mov dword [rbx + 0x24], edx
test eax, eax
js 0x40af4d
je 0x40af78
add rsp, 0x50
pop rbx
ret
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jns 0x40af34
mov rbx, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rbx
cmp eax, 0x2714
je 0x40af83
call rbx
cmp eax, 0x2734
je 0x40af83
call rbx
cmp eax, 0x2733
je 0x40af83
call rbx
cmp eax, 0x2746
je 0x40af8a
mov eax, 0xffffffff
add rsp, 0x50
pop rbx
ret
mov eax, 0xfffffffe
jmp 0x40af36
mov eax, 0xfffffffd
jmp 0x40af36
Function at 0x40afa0
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push rsi
push rbx
sub rsp, 0x48
xor edx, edx
test byte [rcx + 0xd1], 1
setne dl
mov rbx, rcx
add edx, 1
cmp byte [rcx + 0x36], 1
sbb ecx, ecx
xor r8d, r8d
and ecx, 0xffffffeb
add ecx, 0x17
call qword [sym.imp.WS2_32.dll_socket]
and byte [rbx + 0xd0], 0xf7
cmp rax, 0xffffffffffffffff
mov qword [rbx + 0x38], rax
je 0x40b0b0
test byte [rbx + 0xd1], 1
jne 0x40b085
mov edx, 2
mov rcx, rax
mov qword [rsp + 0x38], 0
mov word [rsp + 0x30], dx
movzx edx, word [rbx + 0x34]
lea r8, [rsp + 0x2c]
mov dword [rsp + 0x2c], 1
lea rsi, [rsp + 0x30]
mov word [rsp + 0x32], dx
mov edx, dword [rbx + 0x24]
mov dword [rsp + 0x34], edx
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
lea rcx, [rbx + 0x38]
call fcn.004049f0
xor r8d, r8d
mov edx, 3
mov rcx, rbx
call fcn.00405170
mov rcx, qword [rbx + 0x38]
mov r8d, 0x10
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x40b0d0
mov r8d, 0
js 0x40b0f0
lea rdx, str.connect:__d
mov rcx, rbx
call fcn.00409070
nop
add rsp, 0x48
pop rbx
pop rsi
ret
xor r8d, r8d
mov rcx, rbx
mov edx, 3
call fcn.00405170
xor r8d, r8d
mov edx, 4
mov rcx, rbx
call fcn.00405170
nop
add rsp, 0x48
pop rbx
pop rsi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.socket__:__d
mov rcx, rbx
mov r8d, eax
call fcn.00409070
nop
add rsp, 0x48
pop rbx
pop rsi
ret
xor r8d, r8d
mov edx, 4
mov rcx, rbx
call fcn.00405170
nop
add rsp, 0x48
pop rbx
pop rsi
ret
mov rsi, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rsi
cmp eax, 0x2714
jne 0x40b110
or byte [rbx + 0xd0], 0x20
jmp 0x40b07e
call rsi
cmp eax, 0x2734
je 0x40b100
call rsi
cmp eax, 0x2733
je 0x40b100
call rsi
mov r8d, eax
jmp 0x40b06e
Function at 0x40f1f0
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rcx, qword [rcx + 0x58]
test rcx, rcx
je 0x40f213
mov rbx, qword [rcx + 0x30]
call sub.msvcrt.dll_free
test rbx, rbx
mov rcx, rbx
jne 0x40f202
mov rax, qword [rsi]
mov qword [rsi + 0x58], 0
test rax, rax
je 0x40f232
or byte [rax + 0xd1], 0x20
mov rax, qword [rax]
test rax, rax
jne 0x40f223
xor edx, edx
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.0040ede0

Function at 0x40f520
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
lea rbp, [rsp + 0x30]
mov rbx, rcx
mov rcx, rdx
lea r12, [rbx + 0x10]
mov rsi, rdx
call fcn.0040f400
mov rcx, rbp
mov rdx, rsi
rol ax, 8
mov word [rbx + 0x20], ax
call fcn.0040f360
mov rcx, rbp
mov rdx, r12
call fcn.0040c100
test al, al
mov ebp, eax
jne 0x40f580
mov eax, ebp
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
cmp byte [rbx + 0x22], 1
mov eax, 2
mov ecx, 4
mov qword [rsp + 0x58], 0
mov word [rsp + 0x50], ax
movzx eax, word [rbx + 0x20]
lea rdi, str.udp:
mov dword [rsp + 0x48], 1
sbb r9d, r9d
and r9d, 0xffffffeb
mov word [rsp + 0x52], ax
mov eax, dword [rbx + 0x10]
add r9d, 0x17
repe cmpsb byte [rsi], byte [rdi]
mov ecx, r9d
mov dword [rsp + 0x54], eax
seta al
sbb al, 0
movsx eax, al
cmp eax, 1
sbb esi, esi
not esi
add esi, 2
cmp eax, 1
sbb r8d, r8d
mov edx, esi
and r8d, 0xb
add r8d, 6
call qword [sym.imp.WS2_32.dll_socket]
cmp rax, 0xffffffffffffffff
mov rdi, rax
jne 0x40f603
xor ebp, ebp
jmp 0x40f569
lea r14, [rsp + 0x48]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov rcx, rax
mov r9, r14
mov r8d, 0xfffffffb
mov r13, qword [sym.imp.WS2_32.dll_setsockopt]
call r13
test eax, eax
jne 0x40f655
cmp byte [rbx + 0x22], 0
je 0x40f665
mov dword [rsp + 0x20], 4
mov r9, r14
mov edx, 0x29
mov rcx, rdi
mov r8d, 0x1b
call r13
test eax, eax
je 0x40f665
mov rcx, rdi
xor ebp, ebp
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x40f569
lea rdx, [rsp + 0x50]
mov r8d, 0x10
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x40f655
cmp esi, 1
je 0x40f6b1
mov rdx, r12
mov rcx, rdi
call fcn.00404730
mov dword [rsp + 0x4c], 1
lea r8, [rsp + 0x4c]
mov rcx, rdi
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov qword [rbx + 0x38], rdi
jmp 0x40f569
mov edx, 3
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_listen]
test eax, eax
je 0x40f682
jmp 0x40f655
Function at 0x411150
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x00418624]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x4112d8
mov rax, qword [0x00418628]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x41119c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x411225
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x411180
mov rcx, rbx
call fcn.00411df0
test rax, rax
mov r12, rax
je 0x41130d
mov rax, qword [0x00418628]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.00411f20
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00418628]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4112f0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x41121e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x411280
add dword [0x00418624], 1
cmp edi, 8
jae 0x411253
test dil, 4
jne 0x4112c4
test edi, edi
je 0x411248
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x4112df
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x411248
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x41126c
jmp 0x411248
add rsi, qword [0x00418628]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x41121e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.004124c0
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x411248
xor esi, esi
jmp 0x4111a7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x411248
mov rax, qword [0x00418628]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.004124c0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.004124c0
nop
nop dword [rax]

Function at 0x411a60
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00418900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004188e0]
test rbx, rbx
je 0x411ab4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x411aab
test rsi, rsi
je 0x411aab
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x411a90
lea rcx, [0x00418900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x411df0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x004157b0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x411e5d
mov rcx, r8
call fcn.00411cd0
test eax, eax
je 0x411e5d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x411e5d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x411e54
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x411e5f
add rax, 0x28
cmp rax, r9
jne 0x411e40
xor eax, eax
add rsp, 0x28
ret

Function at 0x412480
Capabilities:
Hide graphical window

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xe8
lea rax, [0x00401a70]
mov edx, 0x7f00
mov rbx, qword [sym.imp.USER32.dll_LoadIconA]
lea rsi, str.WINDOWSAPP
mov qword [rsp + 0x98], rax
mov rdi, rcx
movabs rax, 0x800000050
mov qword [rsp + 0xa8], rcx
xor ecx, ecx
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0x90], rax
call rbx
xor ecx, ecx
mov edx, 0x7f00
mov qword [rsp + 0xb0], rax
call rbx
mov edx, 0x7f00
xor ecx, ecx
mov qword [rsp + 0xd8], rax
call qword [sym.imp.USER32.dll_LoadCursorA]
lea rcx, [rsp + 0x90]
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xc0], 1
call qword [sym.imp.USER32.dll_RegisterClassExA]
xor edx, edx
test ax, ax
jne 0x401bc0
mov eax, edx
add rsp, 0xe8
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rdx, rsi
mov qword [rsp + 0x50], rdi
mov r9d, 0xcf0000
xor ecx, ecx
lea r8, str.WindowsApp
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x48], 0
lea rbx, [rsp + 0x60]
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0x177
mov dword [rsp + 0x30], 0x220
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rsi, qword [sym.imp.USER32.dll_GetMessageA]
mov rbp, qword [sym.imp.USER32.dll_TranslateMessage]
mov rdi, qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x401c4a
mov rcx, rbx
call rbp
mov rcx, rbx
call rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call rsi
test eax, eax
jne 0x401c40
mov edx, dword [rsp + 0x70]
mov eax, edx
add rsp, 0xe8
pop rbx
pop rsi
pop rdi
pop rbp
ret
sub rsp, 0x28
call fcn.00410ce0
mov rax, qword [0x00415820]
xor edx, edx
mov r9d, dword [rax]
mov rax, qword [0x00415810]
mov r8, qword [rax]
mov rax, qword [0x00415800]
mov rcx, qword [rax]
add rsp, 0x28
jmp 0x401af0

Function at 0x4124c0
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x00401540]
jmp 0x401510
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00412270
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.00412270
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x401530
Function at 0x140001070
Capabilities:
Copy file
Create process on windows
Get common file path
Move file

Disassembly:
push rbp
lea rbp, [rsp - 0x6c0]
sub rsp, 0x7c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x6b0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140001214
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x38]
lea edx, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x1400010eb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001214
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x38], 0
je 0x140001214
lea rdx, [rbp + 0x270]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea r8, [rbp + 0x270]
lea rdx, str._sdata
lea rcx, [rsp + 0x40]
call fcn.140001010
lea r8, [rsp + 0x40]
lea rdx, str._sdriver.dll
lea rcx, [rbp + 0x490]
call fcn.140001010
xor r9d, r9d
lea rdx, [rbp + 0x380]
xor ecx, ecx
lea r8d, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea r8, [rbp + 0x380]
lea rdx, str._sdriver.bat
lea rcx, [rbp + 0x50]
call fcn.140001010
xor r8d, r8d
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x490]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea r8, [rsp + 0x40]
lea rdx, str._s_rbxfps.data
lea rcx, [rbp + 0x5a0]
call fcn.140001010
lea r8, [rsp + 0x40]
lea rdx, str._s_rbxfps.exe
lea rcx, [rbp + 0x160]
call fcn.140001010
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
xor r9d, r9d
mov dword [rsp + 0x28], 1
lea r8, [rbp + 0x50]
mov qword [rsp + 0x20], 0
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor r9d, r9d
mov dword [rsp + 0x28], 1
lea r8, [rbp + 0x160]
mov qword [rsp + 0x20], 0
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
mov rcx, qword [rbp + 0x6b0]
xor rcx, rsp
call fcn.140001240
add rsp, 0x7c0
pop rbp
ret

Function at 0x140001b00
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001b4a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b4a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b4a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b4a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b4a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b4c
xor al, al
add rsp, 0x28
ret