joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140050e30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov edx, dword [rcx + 0x10]
lea r11, [rcx + 0x10]
mov edi, edx
mov rbx, rcx
and edi, 7
je 0x140050e95
cmp edx, edi
jge 0x140050e8b
mov r9, qword [rcx + 8]
mov r10d, dword [rcx + 0x14]
mov rax, qword [rbx]
cmp rax, r9
jb 0x140050e63
xor cl, cl
jmp 0x140050e6c
movzx ecx, byte [rax]
inc rax
mov qword [rbx], rax
movzx eax, cl
mov ecx, edx
shl eax, cl
add edx, 8
or eax, r10d
mov dword [r11], edx
mov dword [rbx + 0x14], eax
mov r10d, eax
cmp edx, 0x18
jle 0x140050e57
lea r11, [rbx + 0x10]
mov ecx, edi
shr dword [rbx + 0x14], cl
sub edx, edi
mov dword [r11], edx
xor r9d, r9d
mov ecx, edx
test edx, edx
jle 0x140050ece
mov eax, dword [rbx + 0x14]
lea rdx, [rsp + 0x30]
movzx r10d, al
nop word [rax + rax]
shr eax, 8
inc r9d
mov byte [rdx], r10b
lea rdx, [rdx + 1]
sub ecx, 8
mov dword [rbx + 0x14], eax
movzx r10d, al
test ecx, ecx
jg 0x140050eb0
mov dword [r11], ecx
movsxd rcx, r9d
cmp rcx, 4
jge 0x140050f02
mov r8, qword [rbx + 8]
nop dword [rax + rax]
mov rax, qword [rbx]
cmp rax, r8
jb 0x140050eec
xor dl, dl
jmp 0x140050ef5
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x140050ee0
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
je 0x140050f4a
lea rax, str.zlib_corrupt
mov qword [0x140093950], rax
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx]
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x140050f74
lea rax, str.read_past_buffer
mov qword [0x140093950], rax
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x140050f8e
mov rcx, rbx
call fcn.1400505b0
test eax, eax
je 0x140050f3d
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14005c9e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov r11, qword [rcx]
lea rbp, [0x140093960]
xor r10d, r10d
movsxd rdi, edx
cmp dword [0x140093964], r10d
mov rsi, rcx
mov eax, 0xffffffff
jne 0x14005caec
mov qword [rsp + 0x10], r14
mov ebx, r10d
mov r14, rbp
mov ecx, ebx
lea r14, [r14 + 4]
and cl, 1
neg cl
mov ecx, ebx
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
and cl, 1
neg cl
sbb r8d, r8d
shr edx, 1
and r8d, 0xedb88320
xor r8d, edx
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0xedb88320
xor edx, r8d
mov ecx, edx
and cl, 1
neg cl
sbb r8d, r8d
shr edx, 1
and r8d, 0xedb88320
xor r8d, edx
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0xedb88320
xor edx, r8d
mov ecx, edx
and cl, 1
neg cl
sbb r8d, r8d
shr edx, 1
and r8d, 0xedb88320
xor r8d, edx
mov ecx, r8d
and cl, 1
neg cl
sbb r9d, r9d
shr r8d, 1
and r9d, 0xedb88320
xor r9d, r8d
mov ecx, r9d
and cl, 1
neg cl
sbb edx, edx
shr r9d, 1
and edx, 0xedb88320
inc ebx
xor edx, r9d
mov dword [r14 - 4], edx
cmp ebx, 0x100
jl 0x14005ca20
mov r14, qword [rsp + 0x10]
lea ecx, [rdi + 4]
movsxd rbx, ecx
test ecx, ecx
jle 0x14005cb1c
mov r9, r11
sub r9, rdi
nop dword [rax]
movzx r8d, byte [r9 + r10 - 4]
inc r10
movzx edx, al
xor r8, rdx
shr eax, 8
xor eax, dword [rbp + r8*4]
cmp r10, rbx
jl 0x14005cb00
mov rbx, qword [rsp + 0x18]
not eax
mov rbp, qword [rsp + 0x20]
mov ecx, eax
shr ecx, 0x18
mov byte [r11], cl
mov ecx, eax
shr ecx, 0x10
mov byte [r11 + 1], cl
mov ecx, eax
shr ecx, 8
mov byte [r11 + 2], cl
mov byte [r11 + 3], al
lea rax, [r11 + 4]
mov qword [rsi], rax
mov rsi, qword [rsp + 0x28]
pop rdi
ret
Function at 0x140062a80
Capabilities:
Check mutex on windows

Disassembly:
sub rsp, 0x108
mov rax, qword [0x140092040]
xor rax, rsp
mov qword [rsp + 0xf0], rax
lea r8, str.garden_blade
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140062af5
mov r9d, 4
lea r8, str.Warning
lea rdx, str.Another_instance_of_the_program_is_already_running._Run_anyways_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x140062af5
xor eax, eax
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140077230
add rsp, 0x108
ret
lea rcx, [rsp + 0x28]
call fcn.140062b70
lea rcx, [rsp + 0x28]
call fcn.140062ba0
lea rcx, [rsp + 0x28]
call fcn.140061d10
lea rcx, [rsp + 0x28]
call fcn.140062b90
mov rcx, qword [rax]
call fcn.140062000
lea rcx, [rsp + 0x20]
call fcn.140001290
lea rcx, [rsp + 0x40]
call fcn.140062b80
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.14005e5c0
lea rcx, [rsp + 0x40]
call fcn.14005fbe0
lea rcx, [rsp + 0x40]
call fcn.1400601f0
xor ecx, ecx
call fcn.14005e5a0
int3
Function at 0x1400637c0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0xd0
call fcn.140063f79
mov edx, 0x4001
lea rcx, [rsp + 0xb0]
call fcn.1400632b0
nop
mov r8, rax
lea rcx, [rsp + 0x90]
call fcn.140063c60
nop
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140003330
mov rbx, rax
lea rdx, str.adbg_single_step_exception
lea rcx, [rsp + 0x50]
call fcn.140002d40
nop
lea rdx, str.C:UsersjaviwDocumentsGitHubgarden_bladeutil_adbg.cpp
lea rcx, [rsp + 0x30]
call fcn.140002d40
nop
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x50]
mov r8d, 0x1af
lea rdx, [rsp + 0x30]
mov ecx, 2
call fcn.14005dce0
nop
lea rcx, [rsp + 0x30]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x50]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x70]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x90]
call fcn.140002ce0
nop
lea rcx, [rsp + 0xb0]
call fcn.140002ce0
mov ecx, 0x4001
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
add rsp, 0xd0
pop rbx
ret

Function at 0x140063a60
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str._s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x140063a73
add rsp, 0x28
ret

Function at 0x140063f00
Capabilities:
Check for peb beingdebugged flag

Disassembly:
xor rax, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 2]
and rax, 0xff
ret

Function at 0x140063f17
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
xor rax, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0xbc]
and rax, 0x70
ret

Function at 0x140063f4d
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov qword [rcx], rdx
mov qword [rcx + 8], rax
xor rax, rax
mov rax, 5
shr rax, 2
sub rax, rbx
cmp rax, rcx
rdtsc
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], rax
ret
Function at 0x140075830
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0xc0
mov rax, qword [0x140092040]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov rbx, rdx
mov r9, r8
mov r8, rdx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, rbx
jb 0x14007587d
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.140077230
add rsp, 0xc0
pop rbx
ret
lea rax, str.cannot_write_to_file
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0x14
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0xa8]
mov qword [rsp + 0x38], rcx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movaps xmm1, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm1
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x40]
mov edx, dword [rax]
lea rcx, [rsp + 0x58]
call fcn.140076cf0
nop
mov byte [rsp + 0x20], 1
movzx eax, byte [rsp + 0x20]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x80]
call fcn.140071420
lea rdx, [0x14008e588]
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x140077ea0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140077eea
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140077eea
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140077eea
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140077eea
cmp dword [rcx + 0x84], 0xe
jbe 0x140077eea
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140077eec
xor al, al
add rsp, 0x28
ret
Function at 0x140001c30
Capabilities:
Execute command

Disassembly:
sub rsp, 0x28
mov ecx, 0xa
call fcn.140001000
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400032e4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xb
call fcn.140001410
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400032e4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xa
call fcn.140001820
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400032e4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 9
call fcn.140001410
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400032e4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x140001c34

Function at 0x1400029c8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002a12
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002a12
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002a12
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002a12
cmp dword [rcx + 0x84], 0xe
jbe 0x140002a12
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002a14
xor al, al
add rsp, 0x28
ret
Function at 0x3adbc1500
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
movzx edi, word [section..rdata]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rsi, r8
mov r8, r9
movq xmm1, rcx
mov rcx, rdx
mov rax, qword [rax + 0x20]
mov rbp, qword [rax]
mov rbx, qword [rbp - 0x10]
lea r9, [rbp - 0x10]
cmp rbp, rbx
je 0x3adbc158d
nop word [rax + rax]
mov rax, qword [r9 + 0x60]
lea r10, [rax + 2]
movzx eax, word [rax]
test ax, ax
je 0x3adbc1582
mov edx, 0xe0e
nop dword [rax]
mov r11d, edx
add r10, 2
shl r11d, 6
add edx, r11d
add edx, eax
movzx eax, word [r10 - 2]
test ax, ax
jne 0x3adbc1560
cmp edx, 0x18cf5f14
je 0x3adbc15fd
mov r9, rbx
mov rbx, qword [r9]
cmp rbp, rbx
jne 0x3adbc1548
xor eax, eax
movq xmm0, rax
mov rdx, rsi
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x60], 0
mov r9, qword [rsp + 0xc0]
punpcklqdq xmm0, xmm1
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.3adbc16a0
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, dword [r9 + 0x40]
mov rax, qword [r9 + 0x30]
cmp edx, 2
je 0x3adbc158d
sub edx, 3
lea rdx, [rax + rdx + 1]
nop word [rax + rax]
cmp word [rax], di
je 0x3adbc158f
add rax, 1
cmp rax, rdx
jne 0x3adbc1618
jmp 0x3adbc158d
Function at 0x3adbc19f0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rdi
push rsi
push rbx
mov rax, rcx
lea rcx, [rcx + 0xf]
sub rcx, rdx
cmp rcx, 0x1e
jbe 0x3adbc1ad4
movdqu xmm1, xmmword [rdx]
movups xmmword [rax], xmm1
movdqu xmm0, xmmword [rdx + 0x10]
movups xmmword [rax + 0x10], xmm0
movzx edi, byte [rax + 0x1f]
mov r10d, 8
movzx r9d, byte [rax + 0x1e]
lea r11, [0x3adc86140]
movzx r8d, byte [rax + 0x1d]
lea rbx, [0x3adc86020]
movzx edx, byte [rax + 0x1c]
jmp 0x3adbc1a99
movzx r8d, r8b
movzx edx, dl
movzx ecx, byte [r11 + r8]
movzx r8d, r9b
movzx r9d, dil
movzx edi, byte [r11 + rdx]
mov edx, r10d
shr edx, 3
movzx r8d, byte [r11 + r8]
xor cl, byte [rbx + rdx]
movzx r9d, byte [r11 + r9]
mov edx, ecx
xor dl, byte [rax]
add r10d, 1
add rax, 4
xor r8b, byte [rax - 3]
xor r9b, byte [rax - 2]
xor dil, byte [rax - 1]
mov byte [rax + 0x1c], dl
mov byte [rax + 0x1d], r8b
mov byte [rax + 0x1e], r9b
mov byte [rax + 0x1f], dil
cmp r10d, 0x3c
je 0x3adbc1ad0
mov ecx, r10d
and ecx, 7
je 0x3adbc1a40
cmp ecx, 4
jne 0x3adbc1a6e
movzx edx, dl
movzx r8d, r8b
movzx esi, r9b
movzx ecx, dil
movzx edx, byte [r11 + rdx]
movzx r8d, byte [r11 + r8]
movzx r9d, byte [r11 + rsi]
movzx edi, byte [r11 + rcx]
jmp 0x3adbc1a6e
pop rbx
pop rsi
pop rdi
ret
movzx ecx, byte [rdx]
mov byte [rax], cl
movzx ecx, byte [rdx + 1]
mov byte [rax + 1], cl
movzx ecx, byte [rdx + 2]
mov byte [rax + 2], cl
movzx ecx, byte [rdx + 3]
mov byte [rax + 3], cl
movzx ecx, byte [rdx + 4]
mov byte [rax + 4], cl
movzx ecx, byte [rdx + 5]
mov byte [rax + 5], cl
movzx ecx, byte [rdx + 6]
mov byte [rax + 6], cl
movzx ecx, byte [rdx + 7]
mov byte [rax + 7], cl
movzx ecx, byte [rdx + 8]
mov byte [rax + 8], cl
movzx ecx, byte [rdx + 9]
mov byte [rax + 9], cl
movzx ecx, byte [rdx + 0xa]
mov byte [rax + 0xa], cl
movzx ecx, byte [rdx + 0xb]
mov byte [rax + 0xb], cl
movzx ecx, byte [rdx + 0xc]
mov byte [rax + 0xc], cl
movzx ecx, byte [rdx + 0xd]
mov byte [rax + 0xd], cl
movzx ecx, byte [rdx + 0xe]
mov byte [rax + 0xe], cl
movzx ecx, byte [rdx + 0xf]
mov byte [rax + 0xf], cl
movzx ecx, byte [rdx + 0x10]
mov byte [rax + 0x10], cl
movzx ecx, byte [rdx + 0x11]
mov byte [rax + 0x11], cl
movzx ecx, byte [rdx + 0x12]
mov byte [rax + 0x12], cl
movzx ecx, byte [rdx + 0x13]
mov byte [rax + 0x13], cl
movzx ecx, byte [rdx + 0x14]
mov byte [rax + 0x14], cl
movzx ecx, byte [rdx + 0x15]
mov byte [rax + 0x15], cl
movzx ecx, byte [rdx + 0x16]
mov byte [rax + 0x16], cl
movzx ecx, byte [rdx + 0x17]
mov byte [rax + 0x17], cl
movzx ecx, byte [rdx + 0x18]
mov byte [rax + 0x18], cl
movzx ecx, byte [rdx + 0x19]
mov byte [rax + 0x19], cl
movzx ecx, byte [rdx + 0x1a]
mov byte [rax + 0x1a], cl
movzx ecx, byte [rdx + 0x1b]
mov byte [rax + 0x1b], cl
movzx ecx, byte [rdx + 0x1c]
mov byte [rax + 0x1c], cl
movzx ecx, byte [rdx + 0x1d]
mov byte [rax + 0x1d], cl
movzx ecx, byte [rdx + 0x1e]
mov byte [rax + 0x1e], cl
movzx edx, byte [rdx + 0x1f]
mov byte [rax + 0x1f], dl
jmp 0x3adbc1a17
Function at 0x3adbcc960
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, ecx
cmp r8, 3
mov r9, rdx
not eax
jbe 0x3adbcca30
lea rdx, [r8 - 4]
lea r10, [0x3adc86a60]
shr rdx, 2
lea rcx, [r9 + rdx*4 + 4]
nop dword [rax]
mov edx, eax
xor al, byte [r9]
add r9, 4
shr edx, 8
movzx eax, al
xor edx, dword [r10 + rax*4]
mov eax, edx
xor dl, byte [r9 - 3]
shr eax, 8
movzx edx, dl
xor eax, dword [r10 + rdx*4]
mov edx, eax
xor al, byte [r9 - 2]
shr edx, 8
movzx eax, al
xor edx, dword [r10 + rax*4]
mov eax, edx
xor dl, byte [r9 - 1]
shr eax, 8
movzx edx, dl
xor eax, dword [r10 + rdx*4]
cmp r9, rcx
jne 0x3adbcc988
and r8d, 3
test r8, r8
je 0x3adbcca24
lea rdx, [0x3adc86a60]
mov r9d, eax
xor al, byte [rcx]
shr r9d, 8
movzx eax, al
xor r9d, dword [rdx + rax*4]
cmp r8, 1
mov eax, r9d
je 0x3adbcca24
xor al, byte [rcx + 1]
shr r9d, 8
movzx eax, al
xor r9d, dword [rdx + rax*4]
cmp r8, 2
mov eax, r9d
je 0x3adbcca24
xor al, byte [rcx + 2]
mov r8d, r9d
shr r8d, 8
movzx eax, al
xor r8d, dword [rdx + rax*4]
mov eax, r8d
not eax
ret
mov rcx, rdx
jmp 0x3adbcc9d4
Function at 0x3adbe0b70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
movzx esi, byte [rcx + 0x40]
test sil, sil
mov rbx, rcx
je 0x3adbe0ba0
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r12, qword [rcx + 0x48]
mov r8d, 0xa
movzx edx, word [rcx + 0x50]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
mov rdi, rax
je 0x3adbe0c48
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rbp, rax
je 0x3adbe0c48
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov r13, rax
je 0x3adbe0c48
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
movsxd r12, eax
mov qword [rbx + 0x38], rdx
lea rcx, [r12 + 1]
call sub.msvcrt.dll_malloc
test rax, rax
mov rdi, rax
je 0x3adbe0c2b
mov r8, r12
mov rdx, r13
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov esi, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov qword [rbx + 0x30], rdi
mov byte [rbx + 0x40], sil
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor edi, edi
jmp 0x3adbe0c2b
Function at 0x3adbeb6e0
Capabilities:
Get memory capacity
Set console window title
Set environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rsi
mov r8d, 0xff
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x3adbeb730
mov dword [rax], 0x277
call rsi
mov r8, rbx
xor edx, edx
mov rcx, rax
add rsp, 0x28
pop rbx
pop rsi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [0], 0xb75
jle 0x3adbeb711
call qword [sym.imp.KERNEL32.dll_GetVersion]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
xor edx, edx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x3adbeb711
Function at 0x3adbeca20
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rax, dword [r8 + 0x3c]
add rax, r8
mov r13, rdx
mov r14, rcx
movzx edx, word [rax + 6]
mov r12, r8
test dx, dx
je 0x3adbecb3b
movzx ecx, word [rax + 0x14]
lea rsi, [rsp + 0x48]
mov r15d, dword [0x3adc87db0]
movzx edi, word [0x3adc87db4]
lea rbx, [rax + rcx + 0x18]
lea rax, [rdx + rdx*4]
lea rbp, [rbx + rax*8]
jmp 0x3adbeca85
add rbx, 0x28
cmp rbp, rbx
je 0x3adbecb3b
mov rdx, rsi
mov rcx, rbx
mov dword [rsp + 0x48], r15d
mov word [rsp + 0x4c], di
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x3adbeca78
mov edi, dword [rbx + 0xc]
mov rdx, rsi
mov r9d, 0x40
mov rcx, r14
mov eax, dword [rbx + 8]
mov dword [rsp + 0x34], 0
lea r8, [rsp + 0x40]
mov qword [rsp + 0x38], 0
mov rbp, qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
add r13, rdi
mov qword [rsp + 0x48], r13
lea r13, [rsp + 0x34]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], r13
call rbp
mov edx, eax
mov eax, 0xa
test edx, edx
jne 0x3adbecb40
mov r9d, dword [rbx + 8]
lea rbx, [rsp + 0x38]
mov rcx, r14
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rbx
lea r8, [r12 + rdi]
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
mov edx, eax
mov eax, 0xc
test edx, edx
jne 0x3adbecb40
mov qword [rsp + 0x20], r13
mov r8, rbx
mov rdx, rsi
mov rcx, r14
mov r9d, 0x20
call rbp
neg eax
sbb eax, eax
and eax, 0xb
jmp 0x3adbecb40
mov eax, 0xd
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x3adbf00a0
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
xor r9d, r9d
mov rsi, rdx
mov rdi, r8
xor r8d, r8d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov eax, 1
cmp rbx, 0xffffffffffffffff
je 0x3adbf010d
lea r9, [rsp + 0x4c]
mov r8d, edi
mov rdx, rsi
mov qword [rsp + 0x20], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret

Function at 0x3adbfadc0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.3adc05160
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.3adc05160
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x3adbfae30
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x3adcad614]
test esi, esi
mov rbx, rcx
jle 0x3adbfaf60
mov rax, qword [0x3adcad618]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x3adbfae7b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x3adbfaf05
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x3adbfae60
mov rcx, rbx
call fcn.3adbfb6b0
test rax, rax
mov rdi, rax
je 0x3adbfaf82
mov rax, qword [0x3adcad618]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.3adbfb7f0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x3adcad618]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x3adbfaf67
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x3adbfaefe
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x3adbfaf10
add dword [0x3adcad614], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov r8d, 0x40
mov eax, 4
mov rcx, qword [rsp + 0x20]
cmove r8d, eax
mov rdx, qword [rsp + 0x38]
add rbx, qword [0x3adcad618]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x3adbfaefe
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.3adbfadc0
nop dword [rax]
xor esi, esi
jmp 0x3adbfae88
mov rax, qword [0x3adcad618]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [rdi + 8]
mov r8, qword [rax + rbx + 0x18]
call fcn.3adbfadc0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.3adbfadc0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x3adbfb300
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x3adcad640]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x3adcad620]
test rbx, rbx
je 0x3adbfb35c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x3adbfb353
test rsi, rsi
je 0x3adbfb353
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x3adbfb338
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x3adbfb570
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.msvcrt.dll_exit]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [sym.imp.msvcrt.dll__exit]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x3adbfb5a8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x3adbfb5b0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret