joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002310
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x828
mov rax, qword [0x140064018]
xor rax, rsp
mov qword [rsp + 0x820], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov eax, 0xd3b478bc
mov ebp, 0x60eefa1b
mov ebx, 0xbf7c0f5e
lea r15, str._c_rundll32_printui.dll__PrintUIEntry__if__b__Printer___r_lpt1:__m___s_
lea r13, str._Adding_printer:__s_n
lea rsi, str.open
lea rdi, [0x1400549a8]
mov r12, qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov r14d, 0x21bdb8a4
jmp 0x1400023a0
mov eax, dword [0x140065db0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x56ab2325
cmove eax, ebx
cmp dword [0x140065db4], 0xa
cmovl eax, ebx
nop
cmp eax, 0x21bdb8a3
jg 0x1400023f0
cmp eax, 0xd5d06518
jg 0x140002410
cmp eax, 0xac1f5293
je 0x1400024a4
cmp eax, 0xd3b478bc
jne 0x1400024f3
mov rax, qword [0x140064b50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov eax, 0x6abdf84b
jmp 0x1400023a0
cmp eax, 0x60eefa1a
jg 0x140002430
cmp eax, 0x21bdb8a4
je 0x1400024b3
cmp eax, 0x56ab2325
jne 0x1400023a0
mov eax, 0x60eefa1b
jmp 0x1400023a0
cmp eax, 0xd5d06519
je 0x1400024cd
cmp eax, 0xee2c2b57
jne 0x1400023a0
mov eax, 0xac1f5293
jmp 0x1400023a0
cmp eax, 0x60eefa1b
je 0x14000237e
cmp eax, 0x6abdf84b
jne 0x1400023a0
mov r9, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
mov edx, 0x7d0
mov r8, r15
call fcn.140002530
mov rdx, qword [rsp + 0x38]
mov rcx, r13
call fcn.140001f30
mov r9, qword [rsp + 0x38]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, rsi
mov r8, rdi
call r12
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
cmp eax, 0x21
mov eax, 0xac1f5293
cmovb eax, r14d
jmp 0x1400023a0
mov rax, qword [rsp + 0x40]
mov eax, 0xd5d06519
jmp 0x1400023a0
mov edx, dword [rsp + 0x34]
lea rcx, str._Failed_launching_command._Return_value_is__d_n
call fcn.140001f30
mov eax, 0xee2c2b57
jmp 0x1400023a0
mov eax, dword [0x140065db0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x56ab2325
cmove eax, ebp
cmp dword [0x140065db4], 0xa
cmovl eax, ebp
jmp 0x1400023a0
cmp eax, 0xbf7c0f5e
jne 0x1400023a0
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.140003780
nop
add rsp, 0x828
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140035850
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140035a20
lea rcx, [rsp + 0x20]
call fcn.140035af0
movzx eax, al
test eax, eax
jne 0x140035895
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.140035a40
mov rax, qword [rsp + 0x40]
jmp 0x14003598f
lea rcx, [rsp + 0x20]
call fcn.140035a60
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.1400359d0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.140022780
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14001e690
lea rcx, [rsp + 0x28]
call fcn.14001e760
movzx eax, al
test eax, eax
jne 0x14003592f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.14001e6b0
lea rcx, [rsp + 0x20]
call fcn.140035a40
mov rax, qword [rsp + 0x50]
jmp 0x14003598f
lea rcx, [rsp + 0x20]
call fcn.140035a60
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.14001e780
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.1400218b0
lea rcx, [rsp + 0x28]
call fcn.14001e6d0
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.14001e6b0
lea rcx, [rsp + 0x20]
call fcn.140035a40
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret

Function at 0x140036610
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret

Function at 0x140036f60
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret

Function at 0x140037ad0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140038050
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140037b0f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x14006c008]
jmp 0x140037b19
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x14003f270
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.140003720
sub rsp, rax
mov rax, qword [0x140064018]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x140067270]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x14003f462
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x14003f3b6
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x14003f3b6
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x14003f39b
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x14003f338
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14003f422
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14003f481
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x14003f45d
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14003f481
jmp 0x14003f30e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140003780
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x14003f4a0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.140003720
sub rsp, rax
mov rax, qword [0x140064018]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x140067270]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14003f6ad
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x14003f5f9
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14003f5f9
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x14003f5d9
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x14003f568
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14003f66d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14003f6cc
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x14003f6a8
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14003f6cc
jmp 0x14003f53e
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140003780
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
push rcx
push rsi
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
movzx rcx, word [rdx + 0x4a]
mov rsi, qword [rdx + 0x50]
xor r9, r9
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
mov rdx, qword [rdx + 0x20]
push r9
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov ecx, dword [rax + 0x18]
push rax
mov r8d, dword [rax + 0x20]
add r8, rdx
jrcxz 0x1400040ca
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor r9, r9
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x1400013ba
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400013eb
xor eax, eax
jmp 0x1400015ed
mov rax, qword [rsp + 0x30]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax + 0x88]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp dword [rax], 0
jne 0x140001433
xor eax, eax
jmp 0x1400015ed
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
mov dword [rsp + 0x18], eax
mov eax, dword [rsp + 0x18]
add rax, qword [rsp + 0x80]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
mov eax, dword [rax + 0x18]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x10]
mov eax, dword [rax + 0x1c]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x10]
mov eax, dword [rax + 0x20]
mov dword [rsp + 0x1c], eax
mov rax, qword [rsp + 0x10]
mov eax, dword [rax + 0x24]
mov dword [rsp + 0x20], eax
mov qword [rsp + 8], 0
jmp 0x140001498
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x48]
cmp qword [rsp + 8], rax
jae 0x1400015eb
mov eax, dword [rsp + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 8]
lea rax, [rax + rcx*4]
mov qword [rsp + 0x58], rax
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 8]
lea rax, [rax + rcx*2]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50]
movzx ecx, word [rcx]
lea rax, [rax + rcx*4]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x58]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov qword [rsp], 0
mov qword [rsp], 0
jmp 0x140001542
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
movsx eax, byte [rax]
test eax, eax
je 0x1400015a0
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movsx eax, byte [rax]
test eax, eax
je 0x1400015a0
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
movsx eax, byte [rax]
mov rcx, qword [rsp]
mov rdx, qword [rsp + 0x28]
add rdx, rcx
mov rcx, rdx
movsx ecx, byte [rcx]
cmp eax, ecx
je 0x14000159e
jmp 0x1400015a0
jmp 0x140001537
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
movsx eax, byte [rax]
test eax, eax
jne 0x1400015e6
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movsx eax, byte [rax]
test eax, eax
jne 0x1400015e6
mov rax, qword [rsp + 0x60]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x1400015ed
jmp 0x14000148b
xor eax, eax
add rsp, 0x78
ret
Function at 0x1400015f2
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x68
mov qword [rsp + 0x30], 0
mov rax, qword gs:[0x60]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
mov rdi, rax
lea rsi, [rcx + 0x10]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140001820
mov rax, qword [rsp + 0x20]
cmp qword [rax + 0x30], 0
je 0x140001820
mov rax, qword [rsp + 0x20]
cmp qword [rax + 0x60], 0
jne 0x140001678
jmp 0x14000164e
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x18], rax
mov qword [rsp], 0
mov qword [rsp], 0
jmp 0x1400016a3
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp]
movzx eax, word [rax + rcx*2]
test eax, eax
je 0x1400017de
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp]
movzx eax, word [rax + rcx*2]
test eax, eax
je 0x1400017de
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp]
movzx eax, word [rax + rcx*2]
cmp eax, 0x5a
jg 0x140001735
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp]
movzx eax, word [rax + rcx*2]
cmp eax, 0x41
jl 0x140001735
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp]
movzx eax, word [rax + rcx*2]
sub eax, 0x41
add eax, 0x61
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp]
movzx edx, word [rsp + 0x28]
mov word [rax + rcx*2], dx
movzx eax, word [rsp + 0x28]
mov word [rsp + 8], ax
jmp 0x14000174a
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp]
movzx eax, word [rax + rcx*2]
mov word [rsp + 8], ax
movzx eax, word [rsp + 8]
mov word [rsp + 0xc], ax
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp]
movzx eax, word [rax + rcx*2]
cmp eax, 0x5a
jg 0x1400017ad
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp]
movzx eax, word [rax + rcx*2]
cmp eax, 0x41
jl 0x1400017ad
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp]
movzx eax, word [rax + rcx*2]
sub eax, 0x41
add eax, 0x61
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp]
movzx edx, word [rsp + 0x2c]
mov word [rax + rcx*2], dx
movzx eax, word [rsp + 0x2c]
mov word [rsp + 0xa], ax
jmp 0x1400017bf
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp]
movzx eax, word [rax + rcx*2]
mov word [rsp + 0xa], ax
movzx eax, word [rsp + 0xa]
mov word [rsp + 0x10], ax
movzx eax, word [rsp + 0xc]
movzx ecx, word [rsp + 0x10]
cmp eax, ecx
je 0x1400017d9
jmp 0x1400017de
jmp 0x140001698
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp]
movzx eax, word [rax + rcx*2]
test eax, eax
jne 0x14000180e
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp]
movzx eax, word [rax + rcx*2]
test eax, eax
jne 0x14000180e
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x30]
jmp 0x140001822
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
jmp 0x14000164e
xor eax, eax
add rsp, 0x68
pop rdi
pop rsi
ret
Function at 0x14000c550
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x140037fc8]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x14000c594
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14000c5fa
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x14000c631
test eax, eax
js 0x14000c60b
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14000c624
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.140007b90
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.140003f10
mov ecx, 7
int 0x29
ud2
Function at 0x14001a5c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x14001a63a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x14001a630
cmp r11, r10
ja 0x14001a6d1
cmp r10, rdx
ja 0x14001a6e3
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x14001a632
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x14001a610
jmp 0x14001a6a7
ja 0x14001a63a
mov r11, r10
cmp rax, r8
jne 0x14001a5e2
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14001a6ab
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x14001a680
mov r8, r10
sub ecx, r9d
jns 0x14001a69e
jmp 0x14001a6ad
cmp r10, rdx
je 0x14001a6b9
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14001a6ad
xor al, 1
cmp r8, rdx
jne 0x14001a660
jmp 0x14001a6ad
xor eax, eax
jmp 0x14001a6ad
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x140039e6b]
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14001cdf0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14001d2c0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14001d240
int3

Function at 0x14001bce0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001bd2a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001bd2a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001bd2a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001bd2a
cmp dword [rcx + 0x84], 0xe
jbe 0x14001bd2a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001bd2c
xor al, al
add rsp, 0x28
ret
Function at 0x14000df60
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [0x1400c1b00]
mov rax, qword [rsi]
test rax, rax
je 0x14000dff0
cmp qword [rax + 0x30], 0
jne 0x14000e010
lea rbx, [0x1400b9038]
mov qword [rax + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx], eax
mov rax, qword [rsi]
test rax, rax
je 0x14000dfc0
cmp qword [rax + 0x30], 0
jne 0x14000dfe0
lea rdx, [0x1400b9038]
mov qword [rax + 0x30], rdx
mov rax, rdx
cmp dword [rax], 0xffffffff
je 0x1400b8cc0
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.140013230
mov r8, rax
mov rax, qword [rsi]
cmp qword [r8 + 0x30], 0
je 0x14000dfa2
test rax, rax
jne 0x14000dfe0
call fcn.140013230
nop dword [rax]
mov rax, qword [rax + 0x30]
jmp 0x14000dfb0
call fcn.140013230
cmp qword [rax + 0x30], 0
mov rax, qword [rsi]
je 0x14000df80
test rax, rax
jne 0x14000e010
call fcn.140013230
nop dword [rax]
mov rbx, qword [rax + 0x30]
jmp 0x14000df8b
call sub.msvcrt.dll_abort
nop

Function at 0x14000e020
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x98
movabs rax, 0x6c6320726f727245
movabs rdx, 0x7520676e696e6165
mov qword [rsp + 0x20], rax
movabs rax, 0x6b5f6e6970732070
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20726f6620737965
mov qword [rsp + 0x30], rax
movabs rax, 0x20646165726874
mov qword [rsp + 0x38], rdx
xor edx, edx
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov word [rsp + 0x88], ax
mov byte [rsp + 0x8a], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x47]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x14000e132
mov eax, 0x28
lea rcx, [rsp + 0x20]
jmp 0x14000e10a
add rax, 1
cmp rax, 0x6b
je 0x14000e127
cmp byte [rcx + rax], 0
movsxd rdx, eax
jne 0x14000e100
cmp edx, 0x6a
je 0x14000e127
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rdx + 0x20], 0xa
mov byte [rsp + rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov eax, 0x28
mov edx, 0x27
lea rcx, [rsp + 0x20]
jmp 0x14000e11b