joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1423ec0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1423ecd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1423edd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1423ec5
lea eax, [rcx + 1]
jmp 0x1423eeb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1423efe
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1423ee4
sub eax, 3
jb 0x1423f1e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1423f6d
sar eax, 1
movsxd rbp, eax
jb 0x1423f54
jmp 0x1423f2c
add ebx, ebx
jne 0x1423f2a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1423f54
inc ecx
add ebx, ebx
jne 0x1423f3a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1423f54
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1423f4d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1423f3c
add ecx, 2
jmp 0x1423f59
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.01423e82
jmp 0x1423ecd
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x100f000]
mov eax, dword [rdi]
or eax, eax
je 0x1423fc9
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1024000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1423f79
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1423fc3
mov qword [rbx], rax
add rbx, 8
jmp 0x1423f99
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x142400d
cmp al, 0xef
ja 0x1423ff5
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1423fd5
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x1423fe4
mov eax, dword [rdi]
add rdi, 4
jmp 0x1423fe4
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1424061
sub rsp, 0xffffffffffffff80
jmp 0x45bb20
Function at 0x18001129e
Capabilities:
Create thread

Disassembly:
jmp 0x1800154e0
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x30]
lea rcx, [0x180029021]
call fcn.180011564
nop
mov eax, dword [rbp + 0xf8]
mov dword [rbp + 0xc0], eax
cmp dword [rbp + 0xc0], 1
je 0x180015520
jmp 0x180015546
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x18001127b]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov eax, 1
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret

Function at 0x1800112fd
Capabilities:
Terminate process

Disassembly:
jmp 0x180016f90
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
push rcx
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
push rsi
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
movzx rcx, word [rdx + 0x4a]
xor r9, r9
mov rsi, qword [rdx + 0x50]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov r8d, dword [rax + 0x20]
push rax
add r8, rdx
mov ecx, dword [rax + 0x18]
jrcxz 0x1400040ca
dec rcx
xor r9, r9
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
pop r8
add rax, rdx
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x180002940
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a94], 0xa
jl 0x180002972
mov eax, dword [0x180020a98]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x180002972
nop word cs:[rax + rax]
jmp 0x180002970
mov rax, qword gs:[0x60]
mov r11, qword [rax + 0x18]
add r11, 0x10
mov eax, dword [0x180020a80]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a7c], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020aa0], 0xa
setl r9b
or r9b, al
lea r10, [rcx - 1]
xor eax, eax
mov r14, r11
mov r14, qword [r14]
cmp r14, r11
je 0x180002a48
mov rsi, r10
test r8b, r8b
je 0x180002a60
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x1800029e0
test r9b, r9b
je 0x180002a70
sub rsi, rcx
je 0x180002a44
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop
movzx r13d, word [r15 + rbx*2]
lea edi, [r13 - 0x41]
lea ebp, [r13 + 0x20]
cmp di, 0x1a
cmovae ebp, r13d
movsx edi, byte [rcx + rbx]
lea r12d, [rdi - 0x41]
lea edx, [rdi + 0x20]
cmp r12b, 0x1a
cmovae edx, edi
sub ebp, edx
test r13d, r13d
je 0x180002a40
test ebp, ebp
jne 0x180002a40
add rbx, 1
cmp rsi, rbx
jne 0x180002a00
jmp 0x180002a44
test ebp, ebp
jne 0x1800029cc
mov rax, qword [r14 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x180002a60
jmp 0x180002a70
Function at 0x180002880
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a94], 0xa
jl 0x1800028b2
mov eax, dword [0x180020a98]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x1800028b2
nop word cs:[rax + rax]
jmp 0x1800028b0
mov rax, qword gs:[0x60]
mov r10, qword [rax + 0x18]
add r10, 0x10
mov eax, dword [0x180020a80]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a7c], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020aa0], 0xa
setl r9b
or r9b, al
lea r11, [rcx - 1]
xor eax, eax
mov r14, r10
mov r14, qword [r14]
cmp r14, r10
je 0x1800029ab
mov rsi, r11
test r8b, r8b
je 0x180002990
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x180002920
sub rsi, rcx
je 0x1800029a2
test r9b, r9b
je 0x1800029a0
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop word [rax + rax]
movzx r13d, word [r15 + rbx*2]
lea edi, [r13 - 0x41]
lea ebp, [r13 + 0x20]
cmp di, 0x1a
cmovae ebp, r13d
movsx edi, byte [rcx + rbx]
lea r12d, [rdi - 0x41]
lea edx, [rdi + 0x20]
cmp r12b, 0x1a
cmovae edx, edi
sub ebp, edx
test r13d, r13d
je 0x180002980
test ebp, ebp
jne 0x180002980
add rbx, 1
cmp rsi, rbx
jne 0x180002940
jmp 0x1800029a7
test ebp, ebp
jne 0x18000290c
jmp 0x1800029a7
jmp 0x180002990
jmp 0x1800029a0
test r9b, r9b
je 0x1800029c0
mov rax, qword [r14 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x1800029c0
Function at 0x180002450
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a94], 0xa
jl 0x180002482
mov eax, dword [0x180020a98]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x180002482
nop word cs:[rax + rax]
jmp 0x180002480
mov rax, qword gs:[0x60]
mov r10, qword [rax + 0x18]
add r10, 0x10
mov eax, dword [0x180020a80]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a7c], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020aa0], 0xa
setl r9b
or r9b, al
lea r11, [rcx - 1]
xor eax, eax
mov r14, r10
mov r14, qword [r14]
cmp r14, r10
je 0x18000257b
mov rsi, r11
test r8b, r8b
je 0x180002560
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x1800024f0
sub rsi, rcx
je 0x180002572
test r9b, r9b
je 0x180002570
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop word [rax + rax]
movzx r13d, word [r15 + rbx*2]
lea edi, [r13 - 0x41]
lea ebp, [r13 + 0x20]
cmp di, 0x1a
cmovae ebp, r13d
movsx edi, byte [rcx + rbx]
lea r12d, [rdi - 0x41]
lea edx, [rdi + 0x20]
cmp r12b, 0x1a
cmovae edx, edi
sub ebp, edx
test r13d, r13d
je 0x180002550
test ebp, ebp
jne 0x180002550
add rbx, 1
cmp rsi, rbx
jne 0x180002510
jmp 0x180002577
test ebp, ebp
jne 0x1800024dc
jmp 0x180002577
jmp 0x180002560
jmp 0x180002570
test r9b, r9b
je 0x180002590
mov rax, qword [r14 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x180002590
Function at 0x2fc4c5b7c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4c5bfa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4c5bf1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4c5bf1
mov rax, qword [rbp - 8]
jmp 0x2fc4c5c0f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4c5bc4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140004778
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r14d, dword [rsp + 0xa0]
lea ebp, [rdx - 0xab3]
mov r12d, edx
xor r14d, 0xd27
xor r12d, 0x19ed
mov dword [rsp + 0xa0], r14d
xor edx, 0xcc1
mov eax, r12d
mov esi, r8d
mov rbx, rcx
lea ecx, [r8 - 0xef5]
xor eax, 0x10
xor esi, 0xef5
mov dword [rsp + 0x88], ecx
mov edi, edx
cmp ecx, eax
je 0x1400048bf
mov rax, qword [section..data]
and dword [rax + 0x124], 0
mov ecx, dword [rbx + 0x44]
jmp 0x140004814
mov eax, 0xce66ee
sub eax, dword [rbx + 0x11c]
sub eax, dword [rbx + 0x78]
add dword [rbx + 0x50], eax
mov eax, ecx
imul eax, ecx
add dword [rbx + 0x124], eax
inc ecx
cmp ecx, dword [rbx + 0x48]
jbe 0x1400047f6
cmp dword [rbx + 0x128], 0x11684
ja 0x14000484f
mov r8, qword [section..data]
mov edx, dword [0x140013080]
add edx, 0xffe6e8cc
add edx, dword [r8 + 0x3c]
mov eax, dword [r8 + 0x124]
imul eax, edx
mov dword [r8 + 0x124], eax
jmp 0x140004877
mov rax, qword [section..data]
mov ecx, dword [rax + 0xcc]
xor ecx, dword [rbx + 0x98]
mov eax, dword [0x1400130a8]
xor ecx, 0x1715e
imul eax, ecx
mov dword [0x1400130a8], eax
mov ecx, dword [rbx + 0x124]
mov dword [rbx + 0xc0], ecx
mov eax, dword [rbx + 0x100]
cmp dword [rbx + 0xac], eax
jae 0x14000489e
sub ecx, dword [rbx]
mov dword [rbx + 0xc0], ecx
jmp 0x140004a00
mov rax, qword [section..data]
mov ecx, dword [rax + 0x148]
add ecx, 0x1027
add ecx, dword [rbx + 0x40]
xor dword [0x140013034], ecx
jmp 0x140004a00
mov eax, dword [rbx + 0x5c]
mov edx, 0xf65
and eax, edx
mov dword [rsp + 0x90], ebp
mov r15d, ebp
cmp ebp, eax
ja 0x1400049b5
mov ecx, dword [0x140013074]
imul ecx, esi
add ecx, 0xa2d
mov r13d, dword [0x14001304c]
cmp r13d, ecx
jb 0x140004995
lea r8d, [r14 - 0xef5]
imul r15d, esi, 0xc6f
mov r14d, dword [rsp + 0x88]
mov dword [rsp + 0x30], r8d
mov eax, dword [rbx + 0xac]
mov rdx, rdi
or eax, r15d
sub r14d, eax
mov eax, dword [rbx + 0x3c]
xor eax, dword [rbx + 0x108]
imul eax, r12d
xor ebp, eax
mov eax, dword [rbx + 0xc4]
and rdx, rax
mov rax, qword [section..data]
and edx, 0x672
mov ecx, dword [rax + 0xbc]
mov eax, r8d
or rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, dword [0x140013074]
add r13d, 2
mov r8d, dword [rsp + 0x30]
imul ecx, esi
add ecx, 0xa2d
cmp r13d, ecx
jae 0x140004915
mov r15d, dword [rsp + 0x90]
mov edx, 0xf65
mov dword [rsp + 0x88], r14d
mov r14d, dword [rsp + 0xa0]
mov eax, dword [rbx + 0x5c]
inc r15d
and eax, edx
mov dword [rsp + 0x90], r15d
cmp r15d, eax
jbe 0x1400048ea
mov ecx, dword [rsp + 0x88]
mov r9d, dword [rbx + 0xa8]
and edi, ebp
mov rax, qword [section..data]
or r9d, 0xe5a
mov r8d, dword [rbx + 0x158]
add r9d, edx
imul r8d, dword [0x14001309c]
or edi, dword [0x14001312c]
mov edx, dword [rax + 0xa8]
imul edx, ecx
mov rcx, rbx
mov dword [rsp + 0x20], edi
xor r8d, dword [rbx + 0x170]
call fcn.140003d70
lea eax, [r14 + 0x2f3]
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x004054d0]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x004054e0]
mov dword [rax], 1
mov rax, qword [0x004054f0]
mov dword [rax], 1
mov rax, qword [0x004054c0]
mov dword [rax], 1
mov rax, qword [0x00405380]
cmp word [rax], 0x5a4d
je 0x4010d0
mov rax, qword [0x004054b0]
mov dword [0x00408008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010c2
mov ecx, 2
call sym.__set_app_type
mov rcx, 0xffffffffffffffff
call sym._encode_pointer
mov rdx, qword [0x00405410]
mov qword [rdx], rax
mov rdx, qword [0x00405400]
mov qword [rdx], rax
mov rax, qword [0x00405470]
mov edx, dword [rax]
mov rax, qword [sym.imp.msvcrt.dll__fmode]
mov rax, qword [rax]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x00405330]
cmp dword [rax], 1
je 0x401120
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401133
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058
Function at 0x4015af
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
push rbx
sub rsp, 0x298
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x230], rcx
mov qword [rbp + 0x208], 0xffffffffffffffff
lea rax, [rbp - 0x50]
mov r9, qword [rbp + 0x230]
lea r8, str._s.
mov edx, 0x104
mov rcx, rax
call sym.snprintf
lea rdx, [rbp + 0xc0]
lea rax, [rbp - 0x50]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call rax
mov qword [rbp + 0x208], rax
cmp qword [rbp + 0x208], 0xffffffffffffffff
je 0x4017b4
lea rax, [rbp + 0xc0]
add rax, 0x2c
lea rdx, [0x00405007]
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x401737
lea rax, [rbp + 0xc0]
add rax, 0x2c
lea rdx, [0x00405009]
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x401737
lea rax, [rbp - 0x50]
lea rdx, [rbp + 0xc0]
add rdx, 0x2c
mov qword [rsp + 0x20], rdx
mov r9, qword [rbp + 0x230]
lea r8, str._s_s
mov edx, 0x104
mov rcx, rax
call sym.snprintf
mov eax, dword [rbp + 0xc0]
and eax, 0x10
test eax, eax
je 0x4016f0
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.helper
lea rax, [rbp - 0x50]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
call rax
test eax, eax
jne 0x401738
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov ebx, eax
mov rax, qword [sym.imp.msvcrt.dll___iob_func]
call rax
add rax, 0x60
lea rdx, [rbp - 0x50]
mov r9, rdx
mov r8d, ebx
lea rdx, str.RemoveDirectory_failed___lu__for__s_n
mov rcx, rax
call sym.fprintf
jmp 0x401738
lea rax, [rbp - 0x50]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
test eax, eax
jne 0x401738
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov ebx, eax
mov rax, qword [sym.imp.msvcrt.dll___iob_func]
call rax
add rax, 0x60
lea rdx, [rbp - 0x50]
mov r9, rdx
mov r8d, ebx
lea rdx, str.DeleteFile_failed___lu__for__s_n
mov rcx, rax
call sym.fprintf
jmp 0x401738
nop
lea rdx, [rbp + 0xc0]
mov rax, qword [rbp + 0x208]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindNextFileA]
call rax
test eax, eax
jne 0x40161d
mov rax, qword [rbp + 0x208]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindClose]
call rax
mov rcx, qword [rbp + 0x230]
mov rax, qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
call rax
test eax, eax
jne 0x4017b5
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov ebx, eax
mov rax, qword [sym.imp.msvcrt.dll___iob_func]
call rax
add rax, 0x60
lea rdx, [rbp - 0x50]
mov r9, rdx
mov r8d, ebx
lea rdx, str.RemoveDirectory_failed___lu__for__s_n
mov rcx, rax
call sym.fprintf
jmp 0x4017b5
nop
add rsp, 0x298
pop rbx
pop rbp
ret
Function at 0x401ea0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov ecx, dword [0x00408624]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x401fc0
mov rax, qword [0x00408628]
xor ebx, ebx
add rax, 0x18
mov rdx, qword [rax]
cmp rsi, rdx
jb 0x401eec
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rsi, rdx
jb 0x401fa6
add ebx, 1
add rax, 0x28
cmp ebx, ecx
jne 0x401ed0
mov rcx, rsi
call dbg.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x401ff8
movsxd rbx, ebx
lea rbx, [rbx + rbx*4]
shl rbx, 3
mov r13, rbx
add r13, qword [0x00408628]
mov qword [r13 + 0x20], rax
mov dword [r13], 0
call dbg._GetPEImageBase
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 0x18], rax
mov rax, qword [0x00408628]
mov rcx, qword [rax + rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x401fdb
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x401f9f
sub eax, 0x40
and eax, 0xffffffbf
je 0x401f9f
add rbx, qword [0x00408628]
mov rcx, qword [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x401fc7
add dword [0x00408624], 1
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.memcpy
xor ebx, ebx
jmp 0x401ef7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
mov rax, qword [0x00408628]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call dbg.__report_error
nop
nop dword [rax + rax]

Function at 0x402750
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00408900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004088e0]
test rbx, rbx
je 0x4027a4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x40279b
test rsi, rsi
je 0x40279b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x402780
lea rcx, [0x00408900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x4029e0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x4029f0
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0
Function at 0x402a00
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x402a41
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x402a38
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x402a43
add rax, 0x28
cmp rax, r9
jne 0x402a24
xor eax, eax
repz ret

Function at 0x402ae0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x00405380]
xor edx, edx
mov r8, rcx
cmp word [r9], 0x5a4d
je 0x402b00
mov rax, rdx
add rsp, 0x28
ret
mov rcx, r9
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402af8
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add rax, r9
movzx edx, word [rax + 0x14]
lea rdx, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x402b5d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x402b54
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x402af8
add rdx, 0x28
cmp rdx, r9
jne 0x402b40
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret

Function at 0x402c70
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00405380]
xor eax, eax
mov rdx, rcx
cmp word [r8], 0x5a4d
je 0x402c90
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402c88
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x402ced
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x402ce4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x402cf4
add rax, 0x28
cmp rax, r9
jne 0x402cd0
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x402d10
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x00405380]
xor r9d, r9d
mov r8d, ecx
cmp word [r11], 0x5a4d
je 0x402d31
mov rax, r9
add rsp, 0x28
ret
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402d29
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x402d29
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x402d29
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
nop dword [rax + rax]
mov r9d, dword [rdx + 0xc]
cmp rax, r9
mov rcx, r9
jb 0x402d84
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x402da0
add rdx, 0x28
cmp rdx, r10
jne 0x402d70
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jne 0x402db8
jmp 0x402d8d
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x402dc6
mov edx, dword [rax + 0xc]
test edx, edx
je 0x402d8d
test r8d, r8d
jg 0x402db0
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret