joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021970
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x140021b29
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov esi, r9d
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x140021a06
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.1400212e0
mov r8d, dword [rbx + 0x80]
mov r9d, esi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.1400208f0
mov ecx, dword [rbx + 0x84]
test ecx, ecx
jns 0x1400219f7
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [rbx + 0x80]
test eax, eax
cmovg edx, eax
call fcn.1400165b0
mov dword [rbx + 0x80], 0
jmp 0x140021b15
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
mov r8d, 4
call fcn.14001f7d0
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rdi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rdi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], esi
movsd xmm0, qword [rdi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], esi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14003ea08
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003ea52
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003ea52
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003ea52
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003ea52
cmp dword [rcx + 0x84], 0xe
jbe 0x14003ea52
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003ea54
xor al, al
add rsp, 0x28
ret
Function at 0x140004350
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140085018]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r8d, dword [0x140088034]
cmp r8d, dword [0x140088084]
jge 0x1400044f2
mov eax, 0x92492493
mov qword [rsp + 0x70], rbx
imul r8d
mov ecx, r8d
add edx, r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 7
sub ecx, eax
movsxd rax, ecx
lea rcx, [0x140088040]
mov rbx, qword [rcx + rax*8]
test rbx, rbx
je 0x1400044ed
movzx edx, byte [rbx]
inc r8d
mov qword [rsp + 0x78], rdi
xor edi, edi
mov qword [rcx + rax*8], rdi
mov ecx, edx
mov dword [0x140088034], r8d
sub ecx, 1
je 0x140004495
sub ecx, 2
je 0x140004449
sub ecx, 2
je 0x1400043fe
cmp ecx, 0xfa
jne 0x1400044d3
lea rcx, str.Check_with_a_previous_sended_message
call fcn.140001750
jmp 0x1400044d3
mov rcx, qword [0x140088078]
lea r9, [rbp - 0x20]
mov byte [rbp - 0x19], dl
mov r8d, 7
xor dl, 0xfc
mov word [rbp - 0x1c], 0xff02
mov byte [rbp - 0x17], dl
lea rdx, [rbp - 0x1c]
mov byte [rbp - 0x1a], 2
mov byte [rbp - 0x16], 3
mov byte [rbp - 0x18], 1
mov dword [rbp - 0x20], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call fcn.1400048d0
jmp 0x1400044d3
mov rax, qword [rbx + 8]
movzx ecx, byte [rax + 5]
movzx r10d, byte [rax + 4]
movzx edx, byte [rax]
movzx r11d, byte [rax + 3]
add edx, 0x7d0
movzx r9d, byte [rax + 2]
movzx r8d, byte [rax + 1]
mov dword [rsp + 0x30], ecx
lea rcx, str._d__d__d__d:_d:_d
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r11d
call fcn.140001750
movzx eax, byte [rbx]
mov byte [rbp - 0x19], al
xor al, 0xfc
mov byte [rbp - 0x17], al
jmp 0x14000449e
mov byte [rbp - 0x19], dl
xor dl, 0xfc
mov byte [rbp - 0x17], dl
mov rcx, qword [0x140088078]
lea r9, [rbp - 0x20]
mov r8d, 7
mov qword [rsp + 0x20], rdi
lea rdx, [rbp - 0x1c]
mov word [rbp - 0x1c], 0xff02
mov byte [rbp - 0x1a], 2
mov byte [rbp - 0x16], 3
mov byte [rbp - 0x18], 1
mov dword [rbp - 0x20], edi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbx + 8]
call fcn.1400281b0
mov rcx, rbx
mov qword [rbx + 8], rdi
call fcn.1400281b0
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14000a530
add rsp, 0x60
pop rbp
ret
Function at 0x1400048d0
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push rbx
sub rsp, 0xd0
mov rax, qword [0x140085018]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, rcx
lea rcx, str.Process_downlink_r_n
call fcn.140001750
mov rax, qword [rbx + 8]
cmp byte [rax], 1
movzx ecx, byte [rax + 1]
jne 0x140004918
lea rcx, str.System_reset_rn
call fcn.140001750
jmp 0x140004b45
test cl, cl
je 0x140004b45
mov qword [rsp + 0xe0], rbp
lea rcx, str.Uplink_sensing_data_r_n
mov qword [rsp + 0xe8], rsi
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0xf8], r14
call fcn.140001750
mov ecx, 0x78
call fcn.1400281e0
mov rcx, rax
mov r14, rax
call fcn.140004b60
lea rcx, str.payload_:
mov esi, eax
mov ebp, eax
call fcn.140001750
test esi, esi
jle 0x1400049c3
mov rbx, r14
mov edi, ebp
nop word [rax + rax]
movzx edx, byte [rbx]
lea rcx, str._02x
call fcn.140001750
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x140004980
lea rcx, [0x140080734]
call fcn.140001750
mov r8, rbp
mov word [rsp + 0x40], 0x402
mov rdx, r14
mov byte [rsp + 0x42], bpl
lea rcx, [rsp + 0x43]
call fcn.14000ddf0
jmp 0x1400049db
lea rcx, [0x140080734]
call fcn.140001750
mov word [rsp + 0x40], 0x402
mov byte [rsp + 0x42], bpl
lea r10d, [rsi + 3]
mov ecx, 1
xor r8b, r8b
lea edx, [r10 - 1]
mov r9d, ecx
cmp r10d, ecx
jle 0x140004a7e
cmp edx, 0x20
jb 0x140004a7e
xorps xmm2, xmm2
xorps xmm1, xmm1
and edx, 0x8000001f
jge 0x140004a15
dec edx
or edx, 0xffffffe0
inc edx
mov eax, r10d
sub eax, edx
movsxd rdx, eax
nop dword [rax]
movdqu xmm0, xmmword [rsp + rcx + 0x40]
add r9d, 0x20
pxor xmm2, xmm0
movdqu xmm0, xmmword [rsp + rcx + 0x50]
add rcx, 0x20
pxor xmm1, xmm0
cmp rcx, rdx
jl 0x140004a20
pxor xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
pxor xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 4
pxor xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 2
pxor xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 1
pxor xmm1, xmm0
movd r8d, xmm1
movsxd rax, r9d
movsxd rcx, r10d
cmp rax, rcx
jge 0x140004a9d
nop dword [rax]
xor r8b, byte [rsp + rax + 0x40]
inc rax
cmp rax, rcx
jl 0x140004a90
mov byte [rsp + rcx + 0x40], r8b
lea eax, [rsi + 4]
movsxd rcx, eax
mov byte [rsp + rcx + 0x40], 3
lea rcx, str.river_monitoring_message__r_n
call fcn.140001750
lea eax, [rsi + 5]
xor ebp, ebp
movsxd rdi, eax
test eax, eax
jle 0x140004ae9
mov ebx, ebp
nop word [rax + rax]
movzx edx, byte [rsp + rbx + 0x40]
lea rcx, str._02x
call fcn.140001750
inc rbx
cmp rbx, rdi
jl 0x140004ad0
lea rcx, [0x140080734]
call fcn.140001750
mov rcx, qword [0x140088078]
lea r9, [rsp + 0x30]
add si, 5
mov dword [rsp + 0x30], ebp
movzx r8d, si
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r14
call fcn.1400281b0
mov r14, qword [rsp + 0xf8]
mov rdi, qword [rsp + 0xf0]
mov rsi, qword [rsp + 0xe8]
mov rbp, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14000a530
add rsp, 0xd0
pop rbx
ret
Function at 0x140014e20
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140014900
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140014e5f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1400632f8]
jmp 0x140014e69
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret

Function at 0x14003ca90
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400044a0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1400044b0]
mov dword [rax], 1
mov rax, qword [0x1400044c0]
mov dword [rax], 1
mov rax, qword [0x140004490]
mov dword [rax], 1
mov rax, qword [0x140004360]
cmp word [rax], 0x5a4d
jne 0x140001067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010d0
mov rax, qword [0x140004480]
mov dword [0x14000700c], ecx
mov eax, dword [rax]
test eax, eax
jne 0x1400010c0
mov ecx, 1
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x140004440]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x140004420]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x140004310]
cmp dword [rax], 1
je 0x140001108
xor eax, eax
add rsp, 0x28
ret
mov ecx, 2
call sym.__set_app_type
jmp 0x140001084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001120
cmp dx, 0x20b
jne 0x140001067
cmp dword [rax + 0x84], 0xe
jbe 0x140001067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x140001067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x140001067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x140001067

Function at 0x140001550
Capabilities:
Execute command

Disassembly:
push rbp
sub rsp, 0x1b0
lea rbp, [rsp + 0x80]
call dbg.__main
lea rax, section..rdata
mov qword [rbp + 0x120], rax
lea rax, str.dir
mov qword [rbp + 0x118], rax
lea rax, [0x140004008]
mov qword [rbp + 0x110], rax
lea rax, [0x14000400c]
mov qword [rbp + 0x108], rax
lea rax, [0x140004010]
mov qword [rbp + 0x100], rax
lea rax, [0x140004012]
mov qword [rbp + 0xf8], rax
lea rax, [0x140004015]
mov qword [rbp + 0xf0], rax
lea rax, str.ndos
mov qword [rbp + 0xe8], rax
mov byte [rbp - 0x20], 0
mov rax, qword [rbp + 0x120]
mov qword [rbp - 0x60], rax
mov rax, qword [rbp + 0x118]
mov qword [rbp - 0x58], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp - 0x48], rax
mov rax, qword [rbp + 0x100]
mov qword [rbp - 0x40], rax
mov rax, qword [rbp + 0xf8]
mov qword [rbp - 0x38], rax
mov rax, qword [rbp + 0xf0]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp - 0x28], rax
mov dword [rbp + 0x12c], 0
cmp dword [rbp + 0x12c], 5
jg 0x140001666
mov eax, dword [rbp + 0x12c]
cdqe
mov rdx, qword [rbp + rax*8 - 0x60]
lea rax, [rbp - 0x20]
mov rcx, rax
call sym.strcat
add dword [rbp + 0x12c], 1
jmp 0x14000163b
lea rax, [rbp - 0x20]
mov rcx, rax
call sym.system
mov eax, 0
add rsp, 0x1b0
pop rbp
ret
Function at 0x140001950
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]
Function at 0x1400019c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x1400070a4]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x140001b70
mov rax, qword [0x1400070a8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x140001a0c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140001a97
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x1400019f0
mov rcx, r12
call dbg.__mingw_GetSectionForAddress
mov rbp, rax
test rax, rax
je 0x140001bcd
mov rax, qword [0x1400070a8]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call dbg._GetPEImageBase
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1400070a8]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140001bb2
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140001a90
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140001b20
add dword [0x1400070a4], 1
cmp ebx, 8
jae 0x140001ac8
test bl, 4
jne 0x140001b80
test ebx, ebx
je 0x140001ab9
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x140001ba0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x140001ab9
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x140001afa
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rdi, qword [0x1400070a8]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001a90
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
xor edi, edi
jmp 0x140001a17
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x140001ab9
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x140001ab9
mov rax, qword [0x1400070a8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call dbg.__report_error
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop dword [rax]
Function at 0x1400020e0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x140007100]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400070e0]
test rbx, rbx
je 0x140002134
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x14000212b
test r12, r12
je 0x14000212b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140002110
lea rcx, [0x140007100]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140002360
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
jne 0x140002370
jmp sym._ValidateImageBase.part.0
xor eax, eax
ret

Function at 0x140002380
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x1400023c5
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp r8, rdx
ja 0x1400023bc
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x1400023c7
add rax, 0x28
cmp rax, r9
jne 0x1400023a8
xor eax, eax
ret

Function at 0x140002470
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x140004360]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x1400024e9
mov rcx, r10
call sym._ValidateImageBase.part.0
test eax, eax
je 0x1400024e9
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x1400024e6
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x1400024dd
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x1400024e9
add r8, 0x28
cmp r8, r9
jne 0x1400024c8
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x1400025d0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x140004360]
xor eax, eax
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x14000263f
mov rcx, r9
call sym._ValidateImageBase.part.0
test eax, eax
je 0x14000263f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
movzx edx, word [r9 + 6]
lea rax, [r9 + rax + 0x18]
test edx, edx
je 0x14000263d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002634
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002648
add rax, 0x28
cmp rax, r9
jne 0x140002620
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret
Function at 0x140002660
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x140004360]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
jne 0x1400026d8
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x1400026d8
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x1400026d8
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x1400026d8
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
nop dword [rax + rax]
mov r9d, dword [rdx + 0xc]
mov rcx, r9
cmp rax, r9
jb 0x1400026cc
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x1400026e0
add rdx, 0x28
cmp rdx, r10
jne 0x1400026b8
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jmp 0x1400026f0
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x1400026fe
mov edx, dword [rax + 0xc]
test edx, edx
je 0x1400026d5
test r8d, r8d
jg 0x1400026e8
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret
Function at 0x14000af60
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
mov rcx, qword [0x14002fd78]
test rcx, rcx
je 0x14000af9b
mov edx, 0x7d0
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000af8e
mov rcx, qword [0x14002fd78]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14002fd78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x140038db2], 0
je 0x14000b08e
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x140029868]
mov qword [rsp + 0x80], rsi
lea rsi, [0x1400325b0]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000b06f
test al, 0x10
je 0x14000b06f
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000b015
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x140001630
Capabilities:
Terminate process

Disassembly:
push rdi
sub rsp, 0x260
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rsp + 0x250], rax
cmp byte [rdx], 0
mov r9, rdx
mov rdi, rcx
jne 0x140001736
mov qword [rsp + 0x280], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], 0
mov r9d, 0x400
mov ebx, eax
mov dword [rsp + 0x28], 0xff
lea rax, [rsp + 0x150]
mov r8d, ebx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
lea rdx, [rsp + 0x40]
call fcn.1400017d0
movzx ecx, byte [rax + 6]
test cl, cl
je 0x1400016cd
xor byte [rax], 0x34
xor byte [rax + 1], 0x35
xor byte [rax + 2], 0x36
xor byte [rax + 3], 0x37
xor byte [rax + 4], 0x38
xor byte [rax + 5], 0x39
xor cl, 0x3a
mov byte [rax + 6], cl
lea r9, [rsp + 0x150]
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140001410
lea rcx, [0x14000d758]
call fcn.140008670
mov r8, rax
lea rdx, [rsp + 0x50]
mov r9d, 0x10
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 3
lea rcx, [rsp + 0x48]
call fcn.140008880
mov rcx, rax
call fcn.140008890
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov rbx, qword [rsp + 0x280]
lea rdx, [rsp + 0x40]
call fcn.1400017d0
movzx ecx, byte [rax + 6]
test cl, cl
je 0x140001765
xor byte [rax], 0x34
xor byte [rax + 1], 0x35
xor byte [rax + 2], 0x36
xor byte [rax + 3], 0x37
xor byte [rax + 4], 0x38
xor byte [rax + 5], 0x39
xor cl, 0x3a
mov byte [rax + 6], cl
mov r8, rdi
lea rcx, [rsp + 0x50]
mov rdx, rax
call fcn.140001410
lea rcx, [0x14000d758]
call fcn.140008670
mov r8, rax
lea rdx, [rsp + 0x50]
mov r9d, 0x10
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 3
lea rcx, [rsp + 0x48]
call fcn.140008880
mov rcx, rax
call fcn.140008890
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3