joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003930
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140005980]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140003950
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140003958
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140003950
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400039ad
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400039a4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140003950
add rax, 0x28
cmp rax, r9
jne 0x140003990
xor eax, eax
ret

Function at 0x1400039b0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140005980]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400039cf
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400039d8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400039cf
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140003a70
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140005980]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140003a8f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140003a98
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x14001bee0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r8, qword [0x14004ad50]
mov eax, 0xffffffff
test edx, edx
je 0x14001bfa4
mov r9d, edx
nop word [rax + rax]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
xor eax, ecx
mov ecx, eax
and cl, 1
neg cl
sbb edx, edx
shr eax, 1
and edx, 0xedb88320
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb eax, eax
shr edx, 1
and eax, 0xedb88320
xor eax, edx
sub r9, 1
jne 0x14001bf00
not eax
ret
Function at 0x140021fb0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140021ffa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140021ffa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140021ffa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140021ffa
cmp dword [rcx + 0x84], 0xe
jbe 0x140021ffa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140021ffc
xor al, al
add rsp, 0x28
ret

Function at 0x14002778c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400275b8
Function at 0x140032c70
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140032c98
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140032c98
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400b4721
Capabilities:
Hash data using fnv

Disassembly:
mov rdx, rcx
mov r9d, 8
stc
test rcx, rcx
jmp 0x140656aad
sub eax, eax
jmp 0x14055d7d5
dec r9
stc
test rcx, rcx
jmp 0x140783d96
ret
je 0x14013a7fc
mov al, byte [rcx]
cmp r9b, 0xd3
test al, al
jmp 0x140694da0
je 0x14013a7fc
mov r8d, 0x811c9dc5
inc rdx
test sp, r13w
stc
movzx eax, al
cmp r10b, 0x28
cmp ax, r11w
xor eax, r8d
shl r8d, cl
sar r8b, 0x18
xadd r8, r8
imul r8d, eax, 0x1000193
shl al, cl
sbb al, 0xc6
or al, 0x89
mov al, byte [rdx]
test al, al
jmp 0x1406f9aee
je 0x140783d9c
mov rcx, r9
jmp 0x1401a08b5
jne 0x140694dac
mov eax, r8d
jmp 0x140799050
ret

Function at 0x1400bbad0
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov r8, rcx
stc
jmp 0x140802df2
je 0x140460fb0
mov rcx, rdx
jmp 0x140511aad
sub eax, eax
ret
je 0x14018022b
mov r10d, 0x811c9dc5
setb cl
lea eax, [r9 - 0x41]
xadd cl, cl
adc ecx, r14d
jmp 0x1404c87c3
jne 0x14023868c
mov eax, r10d
jmp 0x1407ce3f2
cmp ax, 0x19
lea ecx, [r9 + 0x20]
movzx rax, bp
movzx eax, ax
lea r8, [r8 + 2]
movsx ax, r9b
xchg al, ah
movsx eax, bp
cmova cx, r9w
rol ax, 0x12
movzx r9d, word [r8]
rcl al, 2
ror rax, cl
movzx eax, cx
clc
xor eax, r10d
inc r10d
imul r10d, eax, 0x1000193
test r9w, r9w
jmp 0x140147c41
dec rdx
jmp 0x140736240
test rcx, rcx
jmp 0x140460faa
ret
test rcx, rcx
je 0x14018022b
movzx r9d, word [rcx]
test r9w, r9w
jmp 0x14023867d

Function at 0x1403fff40
Capabilities:
Hash data using fnv

Disassembly:
je 0x14061b899
movzx eax, byte [r8 + r9]
jmp 0x1407a1383
ret
xor r8d, r8d
mov r9, rcx
clc
stc
test bpl, 0x39
test rcx, rcx
jne 0x14086a6d4
xor eax, eax
jmp 0x140803340
jb 0x1400cbbc0
mov eax, ecx
jmp 0x1402c70f5
inc r8
xor eax, ecx
inc cx
stc
imul ecx, eax, 0x1000193
cmp r8, rdx
jmp 0x14061b893
ret
mov ecx, 0x811c9dc5
cmp bl, r10b
test rdx, rdx
jmp 0x1400cbbba

Function at 0x14055381a
Capabilities:
Hash data using fnv

Disassembly:
jne 0x1406dbfb4
mov eax, edx
jmp 0x14073f0e6
test rcx, rcx
jmp 0x140839891
sub eax, eax
jmp 0x14079f839
je 0x1405ea768
inc rcx
cmp r11b, 0xa5
test r14b, 0x37
clc
movzx eax, al
cmp bl, 0x7c
cmp sil, r11b
xor eax, edx
not dx
sar dx, 0x98
rcr dl, cl
imul edx, eax, 0x1000193
mov al, byte [rcx]
test al, al
jmp 0x14051dffb
ret
ret
je 0x1405ea768
mov al, byte [rcx]
xadd dl, dh
sal dl, 0xfc
mov edx, 0x811c9dc5
cmc
test bpl, dl
test al, al
jmp 0x1406dbfae

Function at 0x1405de196
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
ret
ret
sub eax, eax
jmp 0x14017537d
test r8w, r8w
jmp 0x14060cdc1
xor eax, r9d
bts r9d, r10d
imul r9d, eax, 0x1000193
jmp 0x1403c3084
mov rdx, rcx
test rcx, rcx
jmp 0x1407b36c8
jne 0x1407b36eb
mov eax, r9d
jmp 0x140189f5b
je 0x1403bb077
movzx r8d, word [rcx]
test r15b, r13b
stc
test r8w, r8w
je 0x1403bb077
mov r9d, 0x811c9dc5
sar ah, 0xda
cdqe
lea eax, [r8 - 0x41]
cmp ax, 0x19
movsx rax, r11w
lea ecx, [r8 + 0x20]
cwde
not al
movzx eax, cx
lea rdx, [rdx + 2]
cmova cx, r8w
adc r8, 0x4a6762dc
rcl ax, 0xc1
neg r8w
movzx r8d, word [rdx]
movzx eax, cx
jmp 0x1404f4928
Function at 0x1406b7f97
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
ret
je 0x1407e78d2
mov r10d, 0x811c9dc5
bt ecx, r8d
cbw
movzx edx, r9b
setnp ah
cmp r9, rdi
sub r9b, 0x41
cmp r9b, 0x19
movsx cx, r14b
movzx rcx, bx
movsx ecx, si
lea eax, [rdx + 0x20]
sets ch
not ch
jmp 0x140796c61
ret
test r9b, r9b
jmp 0x14039ab6d
jne 0x14039ab7f
mov eax, r10d
jmp 0x1401d24a3
test rcx, rcx
jmp 0x1408455f4
mov r8, rcx
jmp 0x1404cc7a7
movzx ecx, al
not al
lahf
setb ah
cmova ecx, edx
movzx rax, r14w
lahf
inc r8
movzx eax, cl
test dl, r9b
xor eax, r10d
imul r10d, eax, 0x1000193
mov r9b, byte [r8]
stc
test spl, r15b
cmp spl, 0x69
test r9b, r9b
jmp 0x1404b2d04
sub eax, eax
jmp 0x14041af7e
je 0x1407e78d2
mov r9b, byte [rcx]
test r8w, r9w
jmp 0x14046365d

Function at 0x140753db3
Capabilities:
Hash data using fnv

Disassembly:
sub ax, 0x41
test r15b, r8b
cmp rdx, 0x16a01438
add cx, 0x20
cmp ax, 0x19
setbe al
cmova cx, word [r9]
sal ax, cl
inc ax
sub ax, 0x5c1b
lea r9, [r9 + 2]
movsx rax, bp
movzx eax, cx
cmp r10b, 2
stc
test r8, 0x2ce0204b
xor eax, r8d
sbb r8b, r8b
cmovp r8w, si
imul r8d, eax, 0x1000193
clc
stc
sub rdx, 1
jmp 0x14035d30b
je 0x1407c145d
mov r8d, 0x811c9dc5
cmc
not al
bswap rax
movzx eax, word [r9]
movsx ecx, cx
movzx ecx, word [r9]
jmp 0x14011487c
jne 0x14028e8c3
mov eax, r8d
jmp 0x1404ee5d2
ret
je 0x1407c145d
test rdx, rdx
jmp 0x14028e8b1
mov r9, rcx
test rcx, rcx
jmp 0x1404fb1f5
xor eax, eax
jmp 0x14086a707
ret
Function at 0x14089bc34
Capabilities:
Execute anti-debugging instructions
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
sar r10b, cl
mov qword [rsp + 0x18], rbp
bsr r9, rsp
rcr r9, 0x96
mov qword [rsp + 0x20], rsi
rcl r10w, 0xe3
push rdi
rcl rdi, cl
rcl r9b, 0xd5
cmc
push r14
mov r8, rdx
or r9b, 0x48
mov r9, rdx
shr r8, 3
movsx edi, r11w
movzx ebp, di
mov rdi, rcx
cmovno r10, r8
xchg si, bp
movabs rsi, 0xcbf29ce484222325
movabs rbp, 0x100000001b3
movzx r10, r14w
mov r14b, dil
movzx r10d, dx
movabs r14, 0x7080100200400801
cmovl r10d, r9d
mov r10d, 8
jmp 0x14089bcb5
jmp 0x14089bd6e
dec r8
rdtsc
shrd rbx, rsi, 0xac
rcl bh, 0x85
add cx, r13w
shl rdx, 0x20
bts cx, bx
clc
rol bx, 0xda
lea r11, [rsp + 0x18]
cmp bl, dil
or rax, rdx
btc ecx, 0xde
mov rbx, r10
mov rcx, rax
btc rdx, 0xb6
ror rcx, 3
add dx, r13w
xor rcx, rax
mov rax, r14
movzx edx, r13w
mul rcx
bsf ecx, r11d
mov rcx, rsi
test r8b, 0x4a
xor rdx, rax
movsx eax, r9w
mov ax, 0x6ef6
bswap eax
mov qword [rsp + 0x18], rdx
movsx eax, di
inc al
movzx eax, byte [r11]
jmp 0x14089bd32
inc r11
xor rcx, rax
test ch, bl
imul rcx, rbp
stc
cmp r8d, esi
cmc
sub rbx, 1
jmp 0x14089bd4c
jne 0x14089bd29
xor rcx, rdx
cmp dil, 0xd9
mov qword [rdi], rcx
cmc
cmp dil, r14b
lea rdi, [rdi + r10]
test r14w, 0x30c9
cmc
test r10b, r15b
test r8, r8
jne 0x14089bcba
and r9d, 7
jmp 0x14089bd80
je 0x14089be3e
rdtsc
shl rdx, 0x20
neg rcx
or rax, rdx
rcl dx, cl
mov rcx, rax
mov dh, 0x14
movsx dx, r13b
ror rcx, 3
add dh, 0xa5
xor rcx, rax
setle dl
mov rax, r14
mul rcx
sub ecx, 0x30285cc0
rcr cx, cl
jmp 0x14089bdc1
lea rcx, [rsp + 0x18]
xor rdx, rax
mov qword [rsp + 0x18], rdx
movsx rax, ax
movzx rax, r15w
setno al
movzx eax, byte [rcx]
jmp 0x14089bde1
inc rcx
clc
xor rsi, rax
imul rsi, rbp
clc
test r9d, 0x435654dd
sub r10, 1
jmp 0x14089bdfd
jne 0x14089bdd9
xor rdx, rsi
cmp spl, r12b
test r14b, 0x37
mov qword [rsp + 0x18], rdx
stc
test rdi, rdi
je 0x14089be3e
lea rsi, [rsp + 0x18]
movzx r14w, r13b
mov rcx, r9
mov bpl, spl
mov r14b, 0xef
movzx bx, r14b
rep movsb byte [rdi], byte [rsi]
movzx rbx, bp
cmovo r14d, r8d
mov rbx, qword [rsp + 0x20]
bswap r14w
mov rbp, qword [rsp + 0x28]
setle sil
not si
mov r14w, 0x2f48
mov rsi, qword [rsp + 0x30]
pop r14
pop rdi
ret
Function at 0x1408af7b5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
cmp dil, 0x1f
test spl, al
mov qword [rax + 8], rcx
rcl cl, 0x97
rol cx, 0xa
push rbp
movsx bp, spl
push rsi
sbb rsi, r9
mov bpl, bl
ror si, cl
push rdi
xor esi, r15d
sub sil, 0x6d
cmp rax, 0x60c91fa8
push r12
sar rsi, 0x77
rcr bpl, cl
push r13
btr rcx, r15
shl rcx, cl
adc bpl, 0x28
push r14
add r13b, 0x10
push r15
shrd esi, r10d, 0x5f
mov rbp, rsp
sub rsp, 0x60
rcl esi, cl
movzx r15, di
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov r13b, 0x7a
shr r15w, cl
mov qword [rax + 0x10], rbx
or sil, 0x2b
dec r15b
mov r14, r9
mov r13b, r8b
bswap ax
movsx r8, r12w
cmp r8w, 0x6c65
mov r15, rdx
bts r8d, ecx
movsx r8, r10w
mov dword [rbp - 0x28], 0x6c2f0b27
and r8b, 0x5e
shrd rcx, r12, 0xc8
mov dword [rbp - 0x24], 0xf07aa625
rol rcx, cl
rcr r8b, cl
mov dword [rbp - 0x20], 0x19b7a0af
shl r8, cl
movzx rcx, r11w
and dword [r9], 0
rcl rcx, 0xd6
lea rsi, [rbp - 0x28]
mov ax, sp
mov r9w, 0x3c26
sub edi, edi
clc
sal al, 0x44
lea rcx, [rbp - 0x1c]
bts r9, rsi
xadd al, r8b
lea rax, [rbp - 0x28]
rcr r9w, 0x47
cmp rcx, rax
movsx r8, cx
inc r9b
sbb rbx, rbx
not rbx
xadd cl, al
shl ch, 0x64
and ebx, 3
mov eax, dword [rsi]
stc
shld r8d, ebx, 0xbd
btr r8w, 0xdc
mov dword [rbp - 0x18], eax
sub cl, spl
sbb r8b, bl
and qword [rbp - 0x10], 0
mov r9b, 0x72
lea r9, [fcn.140036818]
lea r8, [rbp - 0x18]
bsf cx, sp
adc cl, r10b
movsx rcx, r13w
xor edx, edx
movzx cx, spl
movsx cx, r11b
mov rcx, qword [r15]
call fcn.140897e43
nop
mov rax, qword [rbp - 0x10]
test r11b, 0x2d
cmc
stc
test rax, rax
je 0x1408afa4a
and dword [rbp + 0x40], 0
rol cx, 0x2a
bsf rdx, rbp
adc r8d, 0x7f6c6023
and qword [rbp + 0x58], 0
lea r12, [rax + 0x34]
cwd
movsx rax, di
rdtsc
lea rax, [rbp + 0x58]
jmp 0x1408af953
mov qword [rsp + 0x20], rax
jmp 0x1408af960
mov r9d, 4
cmova dx, r14w
lea r8, [rbp + 0x40]
bswap rdx
setb dl
mov rdx, r12
mov rcx, qword [r15]
jmp 0x1408af980
call fcn.140843186
nop
mov edx, eax
cmc
test eax, eax
jmp 0x1408af990
js 0x1408afa42
test r13b, r13b
jmp 0x1408af99e
je 0x1408af9d2
mov ecx, dword [rbp + 0x40]
cbw
seto ah
mov eax, 0x40000
test eax, ecx
jmp 0x1408af9b8
jne 0x1408afa35
or ecx, eax
jmp 0x1408af9c5
mov dword [rbp + 0x40], ecx
jmp 0x1408af9cd
jmp 0x1408af9f7
mov eax, dword [rbp + 0x40]
cmc
bt eax, 0x12
jmp 0x1408af9df
jae 0x1408afa35
btr eax, 0x12
shr cl, cl
rcl ch, 0xe7
add dl, 0x82
mov dword [rbp + 0x40], eax
shr r8b, cl
and qword [rsp + 0x20], 0
movzx edx, dx
cdq
mov r9d, 4
lea r8, [rbp + 0x40]
movzx edx, r10w
cwd
mov rdx, r12
not cl
movsx cx, r8b
mov rcx, qword [r15]
jmp 0x1408afa23
call fcn.1401e9120
nop
rcr dl, 0xe8
mov edx, eax
test sil, r11b
test r11b, 0xa0
test edx, edx
jmp 0x1408afa3c
jns 0x1408afa57
mov dword [r14], edx
jmp 0x1408afa57
mov dword [r14], 0xc0000225
cmp bx, 0x59a2
stc
add rsi, 4
inc rdi
cmp rdi, rbx
jmp 0x1408afa66
jne 0x1408af8c4
mov rbx, qword [rsp + 0xa8]
sal r15w, 0x5c
add rsp, 0x60
mov r12w, 0x1dc2
seta r12b
pop r15
bswap r14
movsx ebp, di
movzx r14, si
pop r14
movsx ebp, r10w
pop r13
mov si, 0x18a1
pop r12
bswap rbp
pop rdi
mov esi, 0x7bd92c63
pop rsi
mov bpl, 0x51
jmp 0x1408afab6
pop rbp
jmp 0x1408afabc
ret
Function at 0x140011109
Capabilities:
Write file on windows

Disassembly:
jmp 0x14001e600
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400370f5]
call fcn.1400119e2
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x14001e657
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14001e763
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14001e6fc
cmp qword [rbp + 0x28], 0
jle 0x14001e6fc
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14001e69c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.140011947
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x14001e752
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x14001e752
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x140011582
Capabilities:
Terminate process

Disassembly:
jmp 0x140021460
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140011587
Capabilities:
Set current directory

Disassembly:
jmp 0x140019080
push rbp
push rdi
sub rsp, 0x4e8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xd2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140030018]
xor rax, rbp
mov qword [rbp + 0x4b0], rax
lea rcx, [0x1400370f7]
call fcn.1400119e2
mov r8d, 0x104
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [rbp + 0x234], eax
cmp dword [rbp + 0x234], 0
je 0x1400190ea
cmp dword [rbp + 0x234], 0x104
jb 0x1400190f1
xor al, al
jmp 0x1400191bf
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x258]
call fcn.140011343
nop
mov r8, 0xffffffffffffffff
lea rdx, [0x14002a454]
lea rcx, [rbp + 0x258]
call fcn.140011686
mov qword [rbp + 0x298], rax
cmp qword [rbp + 0x298], 0xffffffffffffffff
je 0x140019170
mov r9, qword [rbp + 0x298]
xor r8d, r8d
lea rdx, [rbp + 0x438]
lea rcx, [rbp + 0x258]
call fcn.140011244
mov qword [rbp + 0x4a8], rax
mov rdx, qword [rbp + 0x4a8]
lea rcx, [rbp + 0x258]
call fcn.140011807
lea rcx, [rbp + 0x438]
call fcn.1400118ac
lea rcx, [rbp + 0x258]
call fcn.14001134d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x1400191a5
mov byte [rbp + 0x474], 0
lea rcx, [rbp + 0x258]
call fcn.1400118ac
movzx eax, byte [rbp + 0x474]
jmp 0x1400191bf
mov byte [rbp + 0x494], 1
lea rcx, [rbp + 0x258]
call fcn.1400118ac
movzx eax, byte [rbp + 0x494]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140029280]
call fcn.140011857
mov rax, rdi
mov rcx, qword [rbp + 0x4b0]
xor rcx, rbp
call fcn.1400114b5
lea rsp, [rbp + 0x4c8]
pop rdi
pop rbp
ret
Function at 0x1400116fe
Capabilities:
Parse pe header

Disassembly:
jmp 0x140021f90
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140021fb0
xor al, al
jmp 0x140022031
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140021fc3
xor al, al
jmp 0x140022031
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140021fed
xor al, al
jmp 0x140022031
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140022001
xor al, al
jmp 0x140022031
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140022013
xor al, al
jmp 0x140022031
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14002202f
xor al, al
jmp 0x140022031
mov al, 1
add rsp, 0x38
ret
Function at 0x1400119c4
Capabilities:
Write file on windows

Disassembly:
jmp 0x140019ac0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
mov rax, qword [0x140030018]
xor rax, rbp
mov qword [rbp + 0x1a0], rax
lea rcx, [0x1400370f5]
call fcn.1400119e2
mov rax, qword [rbp + 0x1d0]
cmp qword [rax + 0x68], 0
je 0x140019b26
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140019b2d
mov al, 1
jmp 0x140019c87
call fcn.1400112bc
mov rcx, qword [rbp + 0x1d0]
mov rcx, qword [rcx]
mov qword [rbp + 0x198], rcx
mov edx, eax
mov rcx, qword [rbp + 0x1d0]
mov rax, qword [rbp + 0x198]
call qword [rax + 0x18]
mov dword [rbp + 0x164], eax
call fcn.1400112bc
mov dword [rbp + 0x184], eax
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x184]
call fcn.140011875
movzx eax, al
test eax, eax
je 0x140019b88
xor al, al
jmp 0x140019c87
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1d0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x1d0]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x194], eax
cmp dword [rbp + 0x194], 0
je 0x140019bed
cmp dword [rbp + 0x194], 1
je 0x140019bf8
cmp dword [rbp + 0x194], 3
je 0x140019c76
jmp 0x140019c85
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x140019c48
mov rax, qword [rbp + 0x1d0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x140019c48
xor al, al
jmp 0x140019c87
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140019c63
mov dword [rbp + 0x194], 1
jmp 0x140019c6d
mov dword [rbp + 0x194], 0
movzx eax, byte [rbp + 0x194]
jmp 0x140019c87
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140019c87
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140029bb0]
call fcn.140011857
mov rax, rdi
mov rcx, qword [rbp + 0x1a0]
xor rcx, rbp
call fcn.1400114b5
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret
Function at 0x1000170f0
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x10001a100]
jne 0x10001710b
rol rcx, 0x10
test cx, 0xffff
jne 0x100017107
ret 0
ror rcx, 0x10
jmp 0x100017530
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x10001d130]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x10001d228]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1000175b5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x10001d130]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x1000175d7
mov rax, qword [rsp + 0x88]
mov qword [0x10001d228], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x10001d1c8], rax
mov rax, qword [0x10001d228]
mov qword [0x10001d0a0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x10001d1b0], rax
mov dword [0x10001d090], 0xc0000409
mov dword [0x10001d094], 1
mov rax, qword [0x10001a100]
mov qword [rsp + 0x68], rax
mov rax, qword [0x10001a108]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1000015d0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret