joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140056cb1
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
neg r10d
jns 0x140097a1c

Function at 0x14005a208
Capabilities:
Create pipe

Disassembly:
add r12b, byte [rsp + 0x74]
mov r14, qword [rsp + 0x48]
shl qword [rsp + 0x48], 0x2f
mov r14, qword [rsp + 0x10]
call fcn.14009714e

Function at 0x14005a222
Capabilities:
Create pipe

Disassembly:
xor cx, 0xd136
mov r12b, byte [rsp + r12 - 0xff61]
call fcn.14005be9e

Function at 0x14005a234
Capabilities:
Create pipe

Disassembly:
popfq
lea rsp, [rsp + 0x40]
ret
add qword [rsp + rcx - 0x48fee1a7], 0xffffffffbffabf8d
mov r11, rcx
call fcn.140067802
movabs r12, 0xbf908527b726230c
cmp rbx, 0x2ba511c
mov qword [rsp + 0x28], rbp
push r13
push rsi
jo 0x140069c67
movabs rsi, 0xa62ff78126a27d81
call fcn.1400aa135
movzx r12w, byte [rsp + 8]
lea rbx, [r12 + 0x90f6fa3]
test qword [rsp + 8], rbx
mov r12, qword [rsp + 0x18]
jl 0x1400bd50c
sub ebx, 0xaea6ce83
shl qword [rsp + 8], 0x2e
xor dword [rsp + 8], 0x6933ceba
setns bl
not rbx
mov rbx, qword [rsp]
neg qword [rsp + 8]
neg byte [rsp + 8]
cmp qword [rsp + 8], 0xffffffffb120ef34
call fcn.140051d20
seto byte [rsp + 0x28]
jbe 0x14009d750
pushfq
push rbx
movabs rbx, 0x23828e2749a620b6
pushfq
sub rbx, 0x32f4b8d
push r13
mov rbx, qword [rsp + 0x10]
mov qword [rsp + 0x10], 0xffffffffbc56ef94
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
call fcn.1400e4d37
movabs rax, 0x2502570b6d092e94
movsx r9d, r9w
shl ax, 0x4a
mov rax, qword [rsp + 8]
mov rax, qword [rax + r9 - 0x346b]
js 0x1400591e5
xor r11, r11
add qword [rsp + r11*4], 0xffffffffbff266c6
call fcn.1400d4998
xor r9w, word [rsp + 9]
neg qword [rsp + r9 - 0x136ece51]
je 0x1400080fe
push r11
movabs rbx, 0x67ba3cb2fb8ca70b
mov rbx, qword [rsp + 0x28]
mov rbx, qword [rbx]
jge 0x1400138af
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x30]
ret
push rcx
call fcn.1400c71a0
xchg r11d, eax
notrack jmp 0x1188fe488

Function at 0x14005a2b7
Capabilities:
Create pipe

Disassembly:
mov rdi, qword [rsp + rdi + 0x4c7f80a8]
mov dword [rsp + 0x18], 0x459ac2b4
mov dword [rsp + 0x50], 0x91076aa0
call fcn.1400897e6

Function at 0x14005a2d4
Capabilities:
Create pipe

Disassembly:
mov r10, qword [rsp + 0x18]
xor cl, ch
test word [rsp + 0x30], cx
setb byte [rsp + 0x30]
call fcn.14000afba

Function at 0x14005a2ea
Capabilities:
Create pipe

Disassembly:
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x140001d9c
mov r8, qword [rbp - 9]
xor r9d, r9d
mov rcx, rbx
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x140001d9c
lea rax, [rbp - 1]
mov dword [rbp - 1], 0x18
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov eax, 0x400
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], eax
mov r9d, 0xff
mov rcx, rdi
mov dword [rsp + 0x20], eax
lea edx, [r8 + 3]
mov qword [rbp + 7], rbx
mov dword [rbp + 0xf], esi
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
jmp 0x140001da0
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0xd0]
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret
mov rbx, qword [rsp + rcx + 0x18]
js 0x140001d3a
call fcn.1400ab6ea
pushfq
call fcn.140077094
invalid
Function at 0x14005b917
Capabilities:
Enumerate process modules

Disassembly:
jb 0x1400722cd
lea rax, [rax + r8 - 0xc940939]
call fcn.14006aa75
call fcn.1400b72e3

Function at 0x14005dc3c
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
push rbp
movabs rbp, 0x9ea5279ae226d2bb
xor bpl, 0xa1
lea rcx, [rcx + 1]
jle 0x1400011ad
jle 0x1400d15ce
sub bp, 0x22b9
or ebp, 0x483e6f13
add qword [rsp + 8], 0x5ba5e
push r13
mov qword [rsp + 0x28], rcx
xor rbp, 0x6d831d11
movabs r13, 0xaaa98a990f928116
xor ebp, 0xd130f7b7
test rbp, rbp
push rbx
movsx si, sil
mov qword [rsp + 0x30], rsi
mov rsi, qword [rsp + 0x28]
mov rsi, qword [rsi]
and dword [rsp + 0x30], 0xb02f4b21
not byte [rsp + 0x30]
mov qword [rsp + 0x28], 0xffffffffd80f1116
jg 0x14002098e
lea rsi, [rsi + 0x4aa2768e]
add qword [rsp], 0xffffffffbff5e653
xor qword [rsp + 0x30], 0xffffffffd423af8f
xor byte [rsp + 0x28], 0xb8
mov word [rsp + 0x30], 0x310b
not byte [rsp + 0x30]
call fcn.1400c1e7f

Function at 0x140060084
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub bpl, 0x10
mov rbp, qword [rsp + 0x60]
call fcn.14009625b
push rdx
call fcn.1400a3743

Function at 0x1400614cb
Capabilities:
Enumerate process modules

Disassembly:
push r14
push r9
call fcn.14004a744

Function at 0x1400615e6
Capabilities:
Encode data using xor

Disassembly:
and r8, r8
add qword [rsp + 0x20], 0xfffffffffff648dc
mov rbp, r8
movabs rsi, 0x680c0825fca87c0f
push rdx
movabs rdx, 0x2fb24ebbd9aee400
push rbx
cmp dl, r8b
setle bpl
mov rsi, qword [rsp + 0x30]
mov rsi, qword [rsi]
movabs rbx, 0x2b3654327f9a951e
and dl, r8b
sets bl
or edx, r8d
lea rsi, [rsi + 0xd042433]
mov qword [rsp + 0x30], rbp
push r13
push 0xffffffff89a6f687
xchg qword [rsp + 0x68], rsi
mov rbp, qword [rsp + 0x28]
call fcn.140084b8d
xor eax, 0x9ff3c750
punpckldq mm2, dword [rcx + 0x6840ebea]
xor al, ah
invalid

Function at 0x140065c2c
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + r12 - 0x562ad8d0], r13
mov byte [rsp + r13 - 0x2b1084d7], 0x93
call fcn.1400c1bbc
Function at 0x140065c42
Capabilities:
Enumerate process modules

Disassembly:
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor edi, edi
lea r8, [rbp + 0x380]
mov rcx, rax
mov dword [rbp + 0x380], edi
mov edx, esi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je fcn.140002c00
mov ecx, dword [rbp + 0x380]
shr ecx, 2
mov dword [rbp + 0x380], ecx
test ecx, ecx
je fcn.140002c00
mov eax, edi
mov r9d, 1
mov ecx, dword [rbx + rax*4]
call fcn.1400010c0
inc edi
cmp edi, dword [rbp + 0x380]
jb 0x14000289f
jmp fcn.140002c00
add qword [rsp + rbx - 0x2e650450], 0xffffffffbfff7eb8
mov r13, qword [rsp + rbx*2 - 0x5cca0870]
or bp, word [rsp + 0x62]
bswap ebp
sub byte [rsp + rbx*2 - 0x5cca0850], bl
sub rbp, 0xffffffff9580339f
jle 0x1400af280
jo 0x1400aa142
mov rbp, qword [rsp + rbx - 0x2e650430]
jo 0x14000285d
lea rbx, [rbx*8 + 0x2a2fc9ab]
or rbx, qword [rsp + 0x60]
shl ebx, 0xc4
ja 0x1400593bb
jbe 0x1400a47c0
invalid
sub qword [rsp + 0x60], 0xffffffffcf3b063a
mov byte [rsp + 0x60], 0x9b
mov rbx, qword [rsp + 0x30]
setb byte [rsp + 0x60]
jge 0x1400d8987
push 0xffffffffcd50906c
adc eax, 0x5fcfdf04
sti
jp 0x1400a47e5
add al, 0xdf
iretd
push rdx
rcr byte [r8 + r11*8 + 0x1d46d560], 1
cmp byte [rdi + 0x63], ch
out 0x53, eax
movabs byte [0x35a4309ce8572a51], al
invalid
mov bh, 0x4c
mov ebx, dword [rsp + 0x20]
sub byte [rsp + 0x10], 0xa4
neg word [rsp + 0x10]
neg dword [rsp + 0x10]
jne 0x1400bf0d9
jae 0x1400d8988
xchg byte [rax + rbp*8 - 0x716166ae], dl
iretd
xor dword [rsp + 0x60], 0x67368a32
neg byte [rsp + 0x60]
je 0x1400d89ae
invalid
neg byte ss:[esp + 0x60]
call fcn.14009a112
lock or ebp, dword [rax]
add dword [rdx + 0x22], esi
jb 0x1400d896a
jg 0x1400d8976
jle 0x1400d89e2
jns 0x1400d89ec
leave
jo 0x1400d898d
mov eax, 0x722a02a1
scasb al, byte [rdi]
jb 0x1400d895e
invalid
invalid
mov bh, 0x6d
xchg esi, eax
clc
invalid

Function at 0x140068231
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
bswap rcx
jg 0x1400dc332
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x30], rdi
movabs r15, 0xe528153de23b543b

Function at 0x14006826a
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
add dword [rsp + r8 + 0x6be4bf58], 0x4f042a13
call fcn.1400a272c
Function at 0x1400682a3
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
neg word [rsp + rsi + 0x38]
jae 0x1400a1149
mov r10, qword [rsp + rsi*8 + 0x28]
add esi, esi
lea rsi, [rsi + rsi*8 - 0x2f848fe]
cmp word [rsp + rsi + 0x2f8494e], 0x5e98
mov rsi, qword [rsp + rsi + 0x2f8493e]
jno 0x14009cbf2
mov rdi, qword [rsp + r11 - 0x26032a2d]
mov rdi, qword [rdi + r9 - 0x33]
sub r11d, r11d
mov qword [rsp + r11 + 0x20], r9
jo 0x1400011a1
mov r13, r11
push r8
shl byte [rsp + r13 + 0x28], 0x8c
lea rdi, [rdi + r11 - 0x2adfd446]
js 0x1400a9ff9
js 0x1400123d2
jne fcn.1400d15b9
add dword [rsp + r13*4 + 0x28], 0x94992595
jns 0x14009ebff
xor r13, qword [rsp + r13 + 0x28]
and r13, r11
setle byte [rsp + r11*2 + 0x28]
xchg qword [rsp + r9 + 0xd], rdi
mov r9, qword [rsp + r13 + 0x38]
sub byte [rsp + r13 + 0x28], 0x24
mov r8, qword [rsp + r11 + 0x28]
jns 0x1400a58f6
mov r11, qword [rsp + r11 + 0x20]
lea r8, [r13*2 - 0x4554dfc]
call fcn.140086d2f
call fcn.1400c7a33
movabs rbx, 0x43b17aa3451f51a9
not rbx
shl bl, 0x84
ja 0x1400d8fe4

Function at 0x14006d206
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
cmp r15, r12
movabs rcx, 0x5b85d41353b08816
not r12w
movsx r15w, r12b
lea rax, [rax + r12 - 0x772b4e33]
call fcn.1400ad806
Function at 0x14006e915
Capabilities:
Delete registry value

Disassembly:
push r10
jae 0x1400d4c15
shr r9b, 0xa9
mov rbp, qword [rsp + r9*2 + 0x10]
mov rbp, qword [rbp + r9]
xor r9, 0xffffffffd911b038
mov qword [rsp + r9 + 0x26ee4fd8], r9
call fcn.1400a34fc
push rdi
call fcn.1400d516a

Function at 0x140074226
Capabilities:
Delete registry value

Disassembly:
seto dl
add qword [rsp + 0x20], 0xffffffffbff48430
lea rsi, [rsi + 0x5905293b]
movabs r11, 0x8b51738bf8d9036
mov r8b, 0x89
sub r8b, r8b
test bx, 0x9c01
jle 0x1400b78c0
cmovne bx, r11w
mov rbx, qword [rsp + r11 - 0x461e2ed2]
or r8d, dword [rsp + r11 - 0x461e2ee8]
or r11w, word [rsp + 0x2e]
jns 0x1400138ee
mov rdx, qword [rsp + 0x18]
mov rdx, qword [rdx]
call fcn.140047439
not r8w
shr r11d, 0xfa
mov qword [rsp + 0x28], rbx
xchg qword [rsp + r11 + 0x19], rsi
mov rdx, qword [rsp + r11 + 1]
seta r11b
cmp dword [rsp + 0x28], ebx
movsx rbx, bx
setg bl
lea r11, [r11 + rbx*4 + 0x461fc712]
shr rbx, 0xc1
ja 0x1400a7b35
scasd eax, dword [rdi]
sub ecx, dword [rdx - 0x4f]
xchg edx, eax
fisttp dword [rax + 0x5940084]
out 0xed, al
lodsb al, byte [rsi]
invalid

Function at 0x140097cf8
Capabilities:
Enumerate process modules

Disassembly:
jno 0x1400c85f6
mov r10, rcx
lea rcx, [r10*2 + 0x659e35b7]
add qword [rsp + 0x18], 0x6298f
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + rdi - 0x1c4300ff]
xor r10d, 0x563e8d27
not edi
jae 0x1400981d3

Function at 0x14009f0e0
Capabilities:
Enumerate process modules

Disassembly:
mov rdi, qword [rsp + r13 + 0x20]
mov rdi, qword [rdi + rdx + 0x57ffda42]
bswap edx
lea r13, [r13 + r13*4 - 0x6664aae7]
lea r13, [r13 + rdx*8 - 0x30d309f6]
mov qword [rsp + 0x20], r13
shr byte [rsp + 0x20], 0x64
xor r13d, 0xd0affc84
setne r13b
jge 0x140001563
lea rdi, [rdi - 0x2adfd446]
neg r13b
sub qword [rsp + 8], 0x7fb7d0b8
push rsi
ja 0x14007eb4f
pushfq
add qword [rsp + 8], 0xffffffffbff17cde
push r15
mov qword [rsp + 0x10], 0xffffffffbc5ffcf8
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
call fcn.1400e4d37

Function at 0x1400a509d
Capabilities:
Enumerate process modules

Disassembly:
lea rax, [rax - 0x10c5d75d]
call fcn.14009b35b

Function at 0x1400a50a9
Capabilities:
Enumerate process modules

Disassembly:
xchg qword [rsp + r11 - 0x5c85e289], rax
mov r11, qword [rsp + r11 - 0x5c85e2a1]
call fcn.1400d84d5
jg 0x140012ac4
push rbp
push r10
pushfq
movabs r10, 0xd2b88e85dc1e3b2e
mov r10d, 0x873f78bc
test r10d, 0x62bffb05
push r14
mov r14, r10
jo 0x140065c12
add r10, r10
mov rbp, qword [rsp + 0x20]
cmp r14, r10
call fcn.14006c41b

Function at 0x1400a8618
Capabilities:
Enumerate process modules

Disassembly:
not r9b
call fcn.140013df1
invalid
pushfq
add qword [rsp + 0x10], 0x7f2ce
movabs rax, 0xd799792b7fbab0b3
or eax, 0x4e2e110f
sub eax, 0xe1be649e
jno 0x14000704b
jno 0x140060cb7
call fcn.1400ba67e

Function at 0x1400b2c65
Capabilities:
Delete registry value

Disassembly:
not bp
mov rbp, qword [rsp + 0x10]
mov rbp, qword [rbp + riz]
je fcn.1400a3167
sub edx, 0x921d7529
mov qword [rsp + 0x10], rdx
movsx edx, dl
mov qword [rsp + rdx + 0xc], rdx
shl edx, 0x81
lea rbp, [rbp + rdx + 0xf2061a1]
Function at 0x1400b2c9e
Capabilities:
Delete registry value

Disassembly:
jns 0x1400c40bd
movabs rbx, 0xa295399e852ab69a
movzx ebx, bl
test bl, 0x39
call fcn.1400511c2
nop
mov esi, 0xc2a9cbb3
mov bl, 0x4d

Function at 0x1400bdeaf
Capabilities:
Encode data using xor

Disassembly:
push r15
push r12
pushfq
movabs r15, 0x7526c3a283083110
movabs r12, 0x343c121e11352faf
push rcx
mov rax, qword [rsp + 0x30]
mov r12d, 0x19c10d
add r12, 0x7711f0be
call fcn.14006d206
mov cl, 0x49
cmp al, 0xb3
cld
mov bl, 0xfc
in eax, dx
xor cl, dh
outsb dx, byte [rsi]
rcr dword [rax], cl
stosd dword [rdi], eax
mov esi, 0x2d997979
fadd qword [rbx]
mov esp, 0x3666368d
cli
cmp dword [rbx + riz*4], 0xffffff86
sal ecx, 1
jno 0x1400bdee3
mov word [rdi], ds
movabs r15, 0x3af4c3972db19eb3
loop 0x1400bdec9
push rsi
fst dword [rbp - 0x34]
cli
or eax, 0xaaba2aea
mov bl, 0xf4
sti
invalid

Function at 0x1400c0458
Capabilities:
Create thread
Set registry value

Disassembly:
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.1400017f8
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREdialerconfig
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf013f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000260d
lea r9, [rbp + 0xb0]
mov qword [rbp + 0xc8], rdi
lea r8, [rbp + 0xc8]
mov dword [rbp + 0xb0], edi
lea edx, [rax + 1]
lea rcx, str.D:_A_OICI_GA___AU__A_OICI_GA___BA_
call qword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
mov ebx, 4
test eax, eax
je 0x140002587
mov r8, qword [rbp + 0xc8]
mov edx, ebx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rdi
lea rdx, [0x140003330]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140002602
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rsp + 0x58]
lea rdx, [0x140003530]
mov dword [rbp + 0xb8], eax
mov r9d, ebx
lea rax, [rbp + 0xb8]
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
js 0x1400024e3
or word [rsp + 0x28], 0x1005
shr dword [rsp + 0x28], 0xa4
sub qword [rsp + 0x70], 0xfffffffff2210ca7
shl byte [rsp + 0x70], 0x72
or word [rsp + 0x28], 0x7b3d
shl word [rsp + 0x70], 0x92
push qword [rsp + 0x60]
popfq
lea rsp, [rsp + 0x88]
ret
Function at 0x1400c1e9a
Capabilities:
Enumerate process modules

Disassembly:
cmp ecx, dword [rsp + 4]
and cx, cx
jo fcn.140089823
mov qword [rsp + 0x28], r8
cmovo rcx, qword [rsp + 0x18]
or qword [rsp + 0x18], rcx
sub cl, ch
lea rbx, [rbx + r8*2 + 0x1fc83206]
push rbx
mov byte [rsp + 0x20], 0x19
test byte [rsp + r8*2 - 0x39d82fd0], 0x1a
lea rcx, [r8 + rcx*8 + 0x1aa0c583]
push 0xffffffff9ab2f3b5
xchg qword [rsp + r8*2 - 0x39d82fc0], rbx
mov r8, qword [rsp + r8 - 0x1cec17e8]
jno 0x14004c23a
push 0xffffffffe313e839
pushfq
cmp dword [rsp + 8], 0xd6854610
setbe byte [rsp + 8]
mov rbx, qword [rsp + 0x28]
neg qword [rsp + 8]
test dword [rsp + 8], 0xf38345ae
lea rbx, [rbx + 1]
push r8
mov r8, qword [rsp + 0x10]
push rcx
mov qword [rsp + r8 - 0x1cec17c8], rbx
jle 0x1400c860f
movabs rcx, 0xfb358e1d3117d70d
mov word [rsp + 0x18], 0x8228
jbe 0x14007f289
or cx, word [rsp + r8 - 0x1cec17e2]
shr r8b, cl
shl word [rsp + 0x18], cl
add qword [rsp + 0x28], 0xfffffffffff8394e
mov cl, byte [rsp + r8*4 - 0x73b05fe5]
mov rbx, qword [rsp + r8 - 0x1cec17e8]
cmp bl, 0x1c
mov rbx, qword [rsp + 0x28]
mov rbx, qword [rbx + r8 - 0x1cec1800]
jb 0x1400751fd
call fcn.140016859

Function at 0x1400c32b7
Capabilities:
Enumerate process modules

Disassembly:
push 0x34978e30
xchg qword [rsp + 0x10], rbp
pushfq
test dword [rsp + 8], 0xa359e19
js 0x14006d275

Function at 0x1400c536c
Capabilities:
Delete registry key

Disassembly:
push r15
mov rbp, qword [rsp + 0x20]
pushfq
movabs r15, 0xfd3066b31238bc1e
not r15w
shr r15b, 0x58
push rdx
js 0x1400010b0
movabs rdx, 0xd0a4312418196ebb

Function at 0x1400c5b1b
Capabilities:
Enumerate process modules

Disassembly:
jae 0x140060cb7
mov r11, qword [rsp + r11*8 - 0x7fd60]
mov qword [rsp + 0x18], rbp
nop
movabs rbp, 0x763a07a92f2b4eaf
call fcn.1400b6b2e
sub qword [rsp + r10*8 - 0x7d387b0], 0x2808a53b
test r10, 0x1f23129b
call fcn.140075355

Function at 0x1400c888a
Capabilities:
Create thread

Disassembly:
shr word [rsp + 0x18], 0x17
call fcn.14009cbc3
mov r8, qword [rsp + 0x18]
js 0x1400581f6
jne fcn.14006b155
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x48]
ret
sets byte [rsp + 0x28]
mov r14, qword [rsp + 0x38]
or r8d, r8d
js 0x1400cf600
shl word [rsp + 0x28], 0xbb
mov byte [rsp + 0x28], r8b
jns 0x14008ad97
mov cl, 0xcf
adc edi, dword [rbp + 0x36]
adc dword [0x1848e3edf], esp
invalid
invalid
and al, 0x18
invalid

Function at 0x1400d30bc
Capabilities:
Create thread

Disassembly:
jo 0x14007a5dd
and dword [rsp + 0x58], r8d
jne 0x14006128f
pushfq
loope 0x1400d3127
int1
cld
adc ebp, dword [rbx]
sub dword [rbx + 0x6e], 0xffffff91
invalid
xor eax, 0xba2d207e
stosb byte [rdi], al
mov bl, 0xb4
sti
nop
or ecx, dword [0x1adc40771]
xchg esi, eax
add esi, dword [0x112b82270]
and ch, byte [rsi + 0x6878a9de]
ja 0x1400d31c2
clc
sub al, 0xfa
stosd dword [rdi], eax
mov bl, 0xb4
sti
sbb byte [rdi + 0x74], bh
clc
sub al, 0xfa
stosd dword [rdi], eax
mov bl, 0xb4
sti
or eax, 0xe895991
mov bh, 0x2d
xchg edi, eax
add esi, dword [0x171f808d7]
jne 0x1400d31c4
invalid
rcr ecx, 1
invalid
ja 0x1400d3191
xor eax, 0x17447d0a
outsb dx, byte [rsi]
invalid
Function at 0x140002dd0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140004950
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140004950
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140002e40
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400090a4]
mov rbx, rcx
test esi, esi
jle 0x140002f70
mov rax, qword [0x1400090a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140002e8b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140002f15
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140002e70
mov rcx, rbx
call fcn.140003890
mov rdi, rax
test rax, rax
je 0x140002f92
mov rax, qword [0x1400090a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.1400039d0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400090a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140002f77
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140002f0e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140002f20
add dword [0x1400090a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1400090a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140002f0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140002dd0
nop dword [rax]
xor esi, esi
jmp 0x140002e98
mov rax, qword [0x1400090a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140002dd0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140002dd0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140003500
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140009100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400090e0]
test rbx, rbx
je 0x14000355c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140003553
test rsi, rsi
je 0x140003553
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140003538
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140003890
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140006880]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400038b0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400038b8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400038b0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000390d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140003904
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400038b0
add rax, 0x28
cmp rax, r9
jne 0x1400038f0
xor eax, eax
ret

Function at 0x140003910
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006880]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000392f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140003938
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000392f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400039d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006880]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400039ef
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400039f8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140002050
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140002071
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000209e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400020a0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400020f9
test ecx, ecx
jle 0x1400020d9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400020f9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400020f9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al