joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006b880
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
dec dword [rcx + rcx*4 - 0x39]

Function at 0x14006e570
Capabilities:
Resolve dns

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x208
lea rbp, [rsp + 0x80]
mov rax, rdx
mov rsi, rcx
mov rdx, qword [rdx]
mov rdi, qword [rax + 8]
movzx eax, word [rax + 0x10]
mov word [rbp + 0x186], ax
mov rax, qword [0x140114fb8]
cmp rax, 3
jne 0x14006e6a2
lea rax, [rbp + 0x186]
mov qword [rbp + 0x170], rax
cmp rdi, 0x17f
ja 0x14006e6c8
lea rbx, [rbp - 0x60]
mov rcx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rdi - 0x60], 0
inc rdi
lea rcx, [rbp + 0x158]
mov rdx, rbx
mov r8, rdi
call fcn.14007abb0
cmp qword [rbp + 0x158], 0
je 0x14006e611
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x14006e693
mov rcx, qword [rbp + 0x160]
xorps xmm0, xmm0
movaps xmmword [rbp + 0x120], xmm0
movaps xmmword [rbp + 0x140], xmm0
movaps xmmword [rbp + 0x130], xmm0
mov dword [rbp + 0x128], 1
mov qword [rbp + 0x178], 0
lea r8, [rbp + 0x120]
lea r9, [rbp + 0x178]
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x14006e674
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x14006e68c
mov rax, qword [rbp + 0x178]
movzx ecx, word [rbp + 0x186]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov rax, rsi
add rsp, 0x208
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov rbx, rdx
call fcn.1400ddef0
mov rdx, rbx
lea rax, [rbp + 0x186]
mov qword [rbp + 0x170], rax
cmp rdi, 0x17f
jbe 0x14006e5c7
lea r9, [rbp + 0x170]
mov rcx, rsi
mov r8, rdi
call fcn.1400ddf60
jmp 0x14006e693

Function at 0x14006e6e0
Capabilities:
Connect socket

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov eax, 1
test rcx, rcx
jne 0x14006e793
mov rax, qword [0x140114fb8]
cmp rax, 3
jne 0x14006e7bc
mov rsi, rdx
mov rcx, rdx
mov edx, 1
call fcn.1400638b0
test rax, rax
je 0x14006e727
mov eax, 1
jmp 0x14006e793
cmp word [rsi], 0
je 0x14006e749
movups xmm0, xmmword [rsi + 4]
mov eax, dword [rsi + 0x14]
mov r9d, dword [rsi + 0x18]
movzx ecx, word [rsi + 0x1c]
mov r8d, 0x1c
mov r10w, 0x17
jmp 0x14006e75e
mov eax, dword [rsi + 2]
movzx ecx, word [rsi + 6]
xorps xmm0, xmm0
mov r8d, 0x10
mov r10w, 2
rol cx, 8
mov word [rbp - 0x1c], r10w
mov word [rbp - 0x1a], cx
mov dword [rbp - 0x18], eax
movups xmmword [rbp - 0x14], xmm0
mov dword [rbp - 4], r9d
lea rax, [rbp - 0x1c]
mov rsi, rdx
mov rcx, rdx
mov rdx, rax
call qword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
je 0x14006e79b
xor eax, eax
mov rdx, rsi
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov rcx, rsi
call qword [sym.imp.ws2_32.dll_closesocket]
mov rdx, rdi
jmp 0x14006e720
mov rsi, rdx
call fcn.1400ddef0
mov rdx, rsi
jmp 0x14006e70b
Function at 0x14007fc70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
test r8, r8
je 0x14007fcfa
mov rax, rdx
mov rdx, qword [rbp + 0x50]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x14007fcf0
cmp r11, r10
ja 0x14007fd76
cmp r10, rdx
ja 0x14007fd88
add r11, r9
xor ebx, ebx
nop word cs:[rax + rax]
cmp rdi, rbx
je 0x14007fcf2
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x14007fcd0
jmp 0x14007fd57
ja 0x14007fcfa
mov r11, r10
cmp rax, r8
jne 0x14007fc97
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x14007fd5b
mov r8, qword [rbp + 0x58]
add rdx, r8
movzx ecx, cx
mov al, 1
nop
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x14007fd30
mov r8, r10
sub ecx, r9d
jns 0x14007fd4e
jmp 0x14007fd5d
cmp r10, rdx
je 0x14007fd6a
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14007fd5d
xor al, 1
cmp r8, rdx
jne 0x14007fd10
jmp 0x14007fd5d
xor eax, eax
jmp 0x14007fd5d
mov al, 1
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.1400deee0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1400df480
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1400df410
int3

Function at 0x140081ed0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
cmp rbx, 0x20
jb 0x140081fad
mov rdx, qword [rcx + 8]
mov r9, qword [rcx + 0x18]
mov rax, rdx
mov r8, qword [rcx + 0x10]
mov r11, r9
mov r10, qword [rcx + 0x20]
rol r11, 0xc
rol rax, 1
add r11, rax
mov qword [rsp + 0x30], rsi
movabs rsi, 0x9e3779b185ebca87
mov qword [rsp + 0x38], rdi
movabs rdi, 0xc2b2ae3d27d4eb4f
mov rax, r8
rol rax, 7
add r11, rax
mov rax, r10
imul rdx, rdi
imul r8, rdi
imul r10, rdi
imul r9, rdi
mov rdi, qword [rsp + 0x38]
rol rax, 0x12
add r11, rax
rol rdx, 0x1f
imul rdx, rsi
movabs rax, 0x7a1435883d4d519d
rol r8, 0x1f
xor r11, rdx
rol r10, 0x1f
imul r11, rsi
imul r8, rsi
imul r10, rsi
sub r11, rax
rol r9, 0x1f
xor r11, r8
imul r11, rsi
imul r9, rsi
sub r11, rax
xor r11, r9
imul r11, rsi
sub r11, rax
xor r11, r10
movabs r10, 0x85ebca77c2b2ae63
imul r11, rsi
mov rsi, qword [rsp + 0x30]
add r10, r11
jmp 0x140081fbe
mov r10, qword [rcx + 0x18]
movabs rdx, 0x27d4eb2f165667c5
add r10, rdx
add r10, rbx
lea rdx, [rcx + 0x28]
mov rcx, r10
xor r9d, r9d
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.140081dd0
Function at 0x1400d4110
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x60]
movzx r8d, byte [rcx + 0x5c]
test eax, eax
jle 0x1400d414c
mov edx, dword [rcx + 0x288]
lea r11, [0x140114990]
mov r9d, eax
nop dword [rax]
mov eax, edx
shr rax, 0x18
xor rax, r8
shl edx, 8
xor edx, dword [r11 + rax*4]
mov dword [rcx + 0x288], edx
sub r9, 1
jne 0x1400d4130
mov eax, dword [rcx + 0x5c]
mov byte [rax + rcx + 0x80], 1
movsxd r9, dword [rcx + 0x60]
mov edx, r9d
sub edx, 1
je 0x1400d422e
sub edx, 1
je 0x1400d4220
cmp edx, 1
je 0x1400d41e0
mov byte [r9 + rcx + 0x7c], 1
mov rax, qword [rcx + 0x40]
movsxd rdx, dword [rcx + 0x6c]
mov byte [rdx + rax], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
movzx r8d, byte [rcx + 0x60]
mov rax, qword [rcx + 0x40]
sub r8b, 4
mov byte [rdx + rax + 1], r8b
inc dword [rcx + 0x6c]
ret
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
inc dword [rcx + 0x6c]
ret
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r8b
jmp 0x1400d41ff
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r8b
inc dword [rcx + 0x6c]
ret
Function at 0x1400dbd00
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400dbd4a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400dbd4a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400dbd4a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400dbd4a
cmp dword [rcx + 0x84], 0xe
jbe 0x1400dbd4a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400dbd4c
xor al, al
add rsp, 0x28
ret

Function at 0x1400ddf60
Capabilities:
Resolve dns

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov r14, r9
mov rsi, rcx
lea rcx, [rbp - 0x28]
call fcn.140076110
mov rdx, qword [rbp - 0x28]
movabs rax, 0x8000000000000000
cmp rdx, rax
jne 0x1400ddfe9
mov rdi, qword [rbp - 0x20]
mov rbx, qword [rbp - 0x18]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x60], xmm0
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x58], 1
mov qword [rbp - 8], 0
lea r8, [rbp - 0x60]
lea r9, [rbp - 8]
mov rcx, rdi
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x1400de01c
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x1400de030
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
test rdx, rdx
je 0x1400de050
mov rcx, qword [rbp - 0x20]
mov r8d, 1
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp fcn.140025550
mov rcx, qword [r14]
mov rax, qword [rbp - 8]
movzx ecx, word [rcx]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov byte [rdi], 0
test rbx, rbx
je 0x1400de050
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.140025550
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14000b7a0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x14000b7b0]
mov dword [rax], 1
mov rax, qword [0x14000b7c0]
mov dword [rax], 1
mov rax, qword [0x14000b740]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x14000b790]
mov dword [0x14000e020], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x14000b870]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x14000b850]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x14000b6f0]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x140001584
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
call sym.__main
lea rax, str.Hello__World__n
mov rcx, rax
call sym.printf
lea rax, str.pause
mov rcx, rax
call sym.system
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x1400018f0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]
Function at 0x140001960
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14000e0b4]
mov rbx, rcx
test esi, esi
jle 0x140001a90
mov rax, qword [0x14000e0b8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x1400019ab
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140001a35
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140001990
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
mov rdi, rax
test rax, rax
je 0x140001ab2
mov rax, qword [0x14000e0b8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call sym._GetPEImageBase
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000e0b8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140001a97
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140001a2e
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x140001a40
add dword [0x14000e0b4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000e0b8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001a2e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
nop dword [rax]
xor esi, esi
jmp 0x1400019b8
mov rax, qword [0x14000e0b8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call sym.__report_error
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call sym.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x140002160
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp edx, 2
je 0x140002290
ja 0x1400021a8
test edx, edx
je 0x140002228
mov eax, dword [0x14000e108]
test eax, eax
je 0x140002310
mov dword [0x14000e108], 1
mov eax, 1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp edx, 3
jne 0x140002195
mov eax, dword [0x14000e108]
test eax, eax
je 0x140002195
lea r12, [0x14000e120]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000e100]
test rbx, rbx
je 0x140002214
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x140002338
test eax, eax
jne 0x140002338
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400021e8
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x140002195
mov eax, dword [0x14000e108]
test eax, eax
jne 0x1400022a8
mov eax, dword [0x14000e108]
cmp eax, 1
jne 0x140002195
mov rbx, qword [0x14000e100]
test rbx, rbx
je 0x140002261
nop dword [rax]
mov rcx, rbx
mov rbx, qword [rbx + 0x10]
call sym.free
test rbx, rbx
jne 0x140002250
lea rcx, [0x14000e120]
mov qword [0x14000e100], 0
mov dword [0x14000e108], 0
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
jmp 0x140002195
call sym._fpreset
mov eax, 1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea r12, [0x14000e120]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000e100]
test rbx, rbx
je 0x1400022fc
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop word [rax + rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140002328
test rsi, rsi
je 0x140002328
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400022d8
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x140002232
lea rcx, [0x14000e120]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x14000218b
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400022d8
jmp 0x1400022fc
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400021e8
jmp 0x140002214

Function at 0x140002350
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140002368
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140002370
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140002380
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x1400023cd
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x1400023c4
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x1400023cf
add rax, 0x28
cmp rax, r9
jne 0x1400023b0
xor eax, eax
ret
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x70], r9
mov dword [rsp + 0x6c], r8d
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x140001039
jmp 0x140001122
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x6c]
add rax, rcx
mov qword [rsp + 0x40], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x1400203d0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
mov r8d, 0x40
lea r9, [rsp + 0x3c]
call rax
cmp eax, 0
jne 0x140001096
jmp 0x140001122
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.WriteProcessMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9, qword [rsp + 0x70]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x40]
mov ecx, 0xffffffff
lea r10, [rsp + 0x30]
mov qword [rsp + 0x20], r10
call rax
cmp eax, 0
jne 0x1400010e1
jmp 0x140001122
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x1400203d0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8d, dword [rsp + 0x3c]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x3c]
call rax
cmp eax, 0
jne 0x140001122
jmp 0x140001122
add rsp, 0x78
ret
Function at 0x140001130
Capabilities:
Get file size
Read file on windows

Disassembly:
sub rsp, 0xa8
xor eax, eax
mov r9d, eax
mov qword [rsp + 0x98], rcx
mov rcx, qword [rsp + 0x98]
mov edx, 0x80000000
mov r8d, 1
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x90], rax
mov rax, 0xffffffffffffffff
cmp qword [rsp + 0x90], rax
jne 0x1400011a3
mov dword [rsp + 0xa4], 0xffffffff
jmp 0x1400013ea
xor eax, eax
mov edx, eax
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x8c], eax
mov eax, dword [rsp + 0x8c]
mov ecx, eax
call fcn.14000b9d0
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
jne 0x1400011ff
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0xa4], 0xffffffff
jmp 0x1400013ea
xor eax, eax
mov r8d, dword [rsp + 0x8c]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x90]
lea r9, [rsp + 0x7c]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rsp + 0x90]
mov dword [rsp + 0x3c], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x80]
movzx ecx, byte [rcx]
cmp ecx, 0x50
jne 0x14000126d
mov rax, qword [rsp + 0x80]
movzx eax, byte [rax + 1]
cmp eax, 0x45
je 0x14000128a
mov rcx, qword [rsp + 0x80]
call fcn.14000b9d8
mov dword [rsp + 0xa4], 0xffffffff
jmp 0x1400013ea
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x70]
movsxd rcx, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
add rax, 4
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x68]
add rax, 0x108
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x4c], 0
mov eax, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x60]
movzx ecx, word [rcx + 2]
cmp eax, ecx
jge 0x14000137f
mov rax, qword [rsp + 0x58]
movsxd rcx, dword [rsp + 0x4c]
imul rcx, rcx, 0x28
add rax, rcx
mov rcx, rax
lea rdx, [0x1400203ff]
mov r8d, 5
call fcn.14000ba00
cmp eax, 0
jne 0x14000136a
mov rax, qword [rsp + 0x58]
movsxd rcx, dword [rsp + 0x4c]
imul rcx, rcx, 0x28
add rax, rcx
mov eax, dword [rax + 0x14]
mov dword [rsp + 0x54], eax
mov rax, qword [rsp + 0x58]
movsxd rcx, dword [rsp + 0x4c]
imul rcx, rcx, 0x28
add rax, rcx
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x50], eax
jmp 0x14000137f
jmp 0x14000136f
mov eax, dword [rsp + 0x4c]
add eax, 1
mov dword [rsp + 0x4c], eax
jmp 0x1400012e8
cmp dword [rsp + 0x54], 0
jne 0x1400013a7
mov rcx, qword [rsp + 0x80]
call fcn.14000b9d8
mov dword [rsp + 0xa4], 0xffffffff
jmp 0x1400013ea
mov eax, dword [rsp + 0x50]
mov r9d, eax
mov r8d, dword [rsp + 0x54]
mov rdx, qword [rsp + 0x98]
mov rax, qword [rsp + 0x80]
mov ecx, dword [rsp + 0x54]
add rax, rcx
mov rcx, rax
call section..text
mov rcx, qword [rsp + 0x80]
call fcn.14000b9d8
mov dword [rsp + 0xa4], 0
mov eax, dword [rsp + 0xa4]
add rsp, 0xa8
ret
Function at 0x1400073d0
Capabilities:
Allocate or change rwx memory
Patch event tracing for windows function

Disassembly:
sub rsp, 0x98
lea rax, str.EtwEventWrite
mov dword [rsp + 0x90], 0
lea rcx, [rsp + 0x50]
mov rdx, rax
mov r8d, 0x40
call fcn.14001f050
mov dword [rsp + 0x4c], 0
movsxd rax, dword [rsp + 0x4c]
cmp rax, 8
jae 0x14000752a
movsxd rax, dword [rsp + 0x4c]
mov rdx, qword [rsp + rax*8 + 0x50]
lea rcx, str.ntdll.dll
mov qword [rsp + 0x30], rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
mov rdx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x140007453
jmp 0x14000751a
mov rcx, qword [rsp + 0x40]
mov edx, 0x1000
mov r8d, 0x40
lea r9, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
jne 0x14000748a
mov dword [rsp + 0x94], 0
jmp 0x140007535
mov eax, dword [0x1400205f0]
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x3c]
mov dword [rax], ecx
mov r8d, dword [rsp + 0x90]
mov rcx, qword [rsp + 0x40]
mov edx, 0x1000
lea r9, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
jne 0x1400074d8
mov dword [rsp + 0x94], 0
jmp 0x140007535
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x28], rdx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov rdx, qword [rsp + 0x28]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp eax, 0
jne 0x140007515
mov dword [rsp + 0x94], 0
jmp 0x140007535
jmp 0x14000751a
mov eax, dword [rsp + 0x4c]
add eax, 1
mov dword [rsp + 0x4c], eax
jmp 0x140007404
mov dword [rsp + 0x94], 1
mov eax, dword [rsp + 0x94]
add rsp, 0x98
ret