joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408398
Capabilities:
Create process on windows

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0xc430
call fcn.00436460
sub rsp, rax
mov rbx, rcx
lea rcx, str._Spawner__Constructing_command..._n
mov byte [rsp + 0xe0], 0
call fcn.0040a054
call fcn.0041a8a0
lea rcx, [rax + 0x30]
call fcn.00416bd0
xor esi, esi
cmp qword [rbx], rsi
je 0x40841e
mov rdi, rbx
lea rdx, [0x0043addc]
lea rcx, [rsp + 0xe0]
call fcn.004154a0
mov rdx, qword [rdi]
lea rcx, [rsp + 0xe0]
call fcn.004154a0
lea rdx, [0x00440088]
lea rcx, [rsp + 0xe0]
call fcn.004154a0
add rsi, 1
lea rdi, [rbx + rsi*8]
cmp qword [rdi], 0
jne 0x4083d8
lea rdx, [rsp + 0xe0]
lea rcx, str._Spawner__Executing_command__s_n
call fcn.0040a054
call fcn.0041a8a0
lea rcx, [rax + 0x30]
call fcn.00416bd0
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.004171b0
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x18]
call fcn.004171b0
lea r11, [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0xe0]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4084d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateProcess_failed___d_._n
mov edx, eax
call fcn.0040a054
call fcn.0041a8a0
lea rcx, [rax + 0x30]
call fcn.00416bd0
mov eax, 0xffffffff
jmp 0x40850b
lea rcx, str._Spawner__Create_process_seems_to_have_worked_n
call fcn.0040a054
call fcn.0041a8a0
lea rcx, [rax + 0x30]
call fcn.00416bd0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0xc430
pop rdi
pop rsi
pop rbx
ret

Function at 0x408628
Capabilities:
Terminate thread

Disassembly:
sub rsp, 0x28
cmp qword [0x004481b0], 0
je 0x408691
mov ecx, dword [0x004481b8]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x12]
call qword [sym.imp.USER32.dll_PostThreadMessageA]
mov rcx, qword [0x004481b0]
mov edx, 0x2328
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x408677
mov rcx, qword [0x004481b0]
mov edx, 0x8ae
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x004481b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x004481c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x004481b0], 0
add rsp, 0x28
ret
Function at 0x409ba4
Capabilities:
Encode data using xor
Get session user name
Hash data using fnv
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x100
lea rcx, str.ALLUSERSPROFILE
call fcn.004198c0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r12, rax
mov dword [rsp + 0x130], 0x64
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rcx, [rsp + 0x20]
call fcn.004153e0
xor esi, esi
xor edi, edi
test eax, eax
mov ebx, 0x811c9dc5
movsxd rbp, eax
jle 0x409c27
movzx ecx, byte [rsp + rdi + 0x20]
mov edx, esi
xor ebx, ecx
movsx r8d, cl
lea rcx, str.__d___d__d_n
imul ebx, ebx, 0x1000193
mov r9d, ebx
call fcn.0040a054
add rdi, 1
add esi, 1
cmp rdi, rbp
jl 0x409bf9
test ebx, ebx
jns 0x409c2d
neg ebx
xor edx, edx
lea rcx, [rsp + 0x90]
lea r8d, [rdx + 0x64]
call fcn.004171b0
lea rdx, [0x0043ca64]
lea rcx, [rsp + 0x90]
mov r8d, ebx
call fcn.00416260
lea rcx, [rsp + 0x20]
xor ebx, ebx
call fcn.004153e0
test rax, rax
je 0x409c87
cmp byte [rsp + rbx + 0x20], 0x80
jb 0x409c74
mov byte [rsp + rbx + 0x20], 0x5f
lea rcx, [rsp + 0x20]
add rbx, 1
call fcn.004153e0
cmp rbx, rax
jb 0x409c68
mov ecx, 0x1388
call fcn.004151d0
mov rdx, r12
mov rcx, rax
mov rbx, rax
mov byte [rax], 0
call fcn.004154a0
lea rdx, str.JWUser_
mov rcx, rbx
call fcn.00409fec
lea rdx, [rsp + 0x90]
mov rcx, rbx
call fcn.004154a0
lea rdx, [0x0043b544]
mov rcx, rbx
call fcn.004154a0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.004154a0
mov rcx, rbx
call fcn.00409fa8
mov rax, rbx
add rsp, 0x100
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x409cf8
Capabilities:
Check os version
Query environment variable

Disassembly:
push rbx
push rdi
sub rsp, 0xc8
lea rcx, str.APPDATA
mov dword [rsp + 0x20], 0x94
call fcn.004198c0
test rax, rax
mov rdi, rax
je 0x409dd3
mov rcx, rax
call fcn.004153e0
cmp rax, 2
jbe 0x409dd3
cmp byte [rdi], 0x5c
jne 0x409dd3
cmp byte [rdi + 1], 0x5c
jne 0x409dd3
lea rcx, str._Extractor__Roaming_AppData_directory_detected_n
call fcn.0040a054
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x409ddf
cmp dword [rsp + 0x24], 5
jbe 0x409d89
lea rcx, str.LOCALAPPDATA
call fcn.004198c0
lea rcx, str._Extractor__Local_AppData_directory_resolved_to__s_n
mov rdx, rax
mov rdi, rax
call fcn.0040a054
jmp 0x409ddf
lea rcx, str.USERPROFILE
call fcn.004198c0
mov ecx, 0x1388
mov rbx, rax
call fcn.004151d0
mov rdx, rbx
mov rcx, rax
mov rdi, rax
mov byte [rax], 0
call fcn.004154a0
lea rdx, str.Local_Settings
mov rcx, rdi
call fcn.00409fec
lea rdx, str.Application_Data
mov rcx, rdi
call fcn.00409fec
jmp 0x409ddf
lea rcx, str._Extractor__Local_AppData_directory_detected_n
call fcn.0040a054
lea rcx, str.Validating_directory..._n
call fcn.0040a054
lea rcx, str.Shared_dir_detected_is__s_n
mov rdx, rdi
call fcn.0040a054
lea rcx, str.Checking_if__s_exists_n
mov rdx, rdi
call fcn.0040a054
mov edx, 6
mov rcx, rdi
call fcn.0041b380
test eax, eax
jne 0x409e95
lea rcx, str.Checking_if_string_is_cAscii__s_n
mov rdx, rdi
call fcn.0040a054
mov rcx, rdi
xor ebx, ebx
call fcn.004153e0
test rax, rax
je 0x409e4f
cmp byte [rbx + rdi], 0x80
jae 0x409e95
mov rcx, rdi
add rbx, 1
call fcn.004153e0
cmp rbx, rax
jb 0x409e38
lea rcx, str.Checking_if__s_contains_a___n
mov rdx, rdi
call fcn.0040a054
mov rcx, rdi
xor ebx, ebx
call fcn.004153e0
test rax, rax
je 0x409e84
cmp byte [rbx + rdi], 0x21
je 0x409e95
mov rcx, rdi
add rbx, 1
call fcn.004153e0
cmp rbx, rax
jb 0x409e6d
lea rcx, str.Shared_directory_appears_valid._n
call fcn.0040a054
jmp 0x409f1a
lea rcx, str.The_directory__s_appears_invalid._n
mov rdx, rdi
call fcn.0040a054
lea rcx, str.Trying_the_short_path_instead._n
mov rdx, rdi
call fcn.0040a054
mov ecx, 0x1388
call fcn.004151d0
mov r8d, 0x400
mov rcx, rdi
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x409f0a
lea rcx, str.Got_short_path_of__s_n
mov rdx, rbx
call fcn.0040a054
lea rcx, str.Checking_if__s_exists_n
mov rdx, rdi
call fcn.0040a054
mov edx, 6
mov rcx, rdi
call fcn.0041b380
test eax, eax
jne 0x409f0a
mov rax, rbx
jmp 0x409f1d
mov rcx, rbx
call fcn.00415190
call fcn.00409ba4
mov rdi, rax
mov rax, rdi
add rsp, 0xc8
pop rdi
pop rbx
ret
Function at 0x40a428
Capabilities:
Check os version
Query environment variable

Disassembly:
push rbx
push rdi
sub rsp, 0xc8
lea rdx, str.perm_all
mov rbx, rcx
call fcn.004176b0
test eax, eax
jne 0x40a4c0
lea rcx, str.Permanent_install_for_all_users_n
call fcn.0040a054
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40a47d
cmp dword [rsp + 0x24], 5
jbe 0x40a47d
lea rcx, str.PROGRAMDATA
call fcn.004198c0
jmp 0x40a4eb
lea rcx, str.ALLUSERSPROFILE
call fcn.004198c0
mov ecx, 0x1388
mov rbx, rax
call fcn.004151d0
mov rdx, rbx
mov rcx, rax
mov rdi, rax
mov byte [rax], 0
call fcn.004154a0
lea rdx, str.Application_Data
mov rcx, rdi
call fcn.00409fec
mov rcx, rdi
call fcn.00409fa8
jmp 0x40a4ee
lea rdx, str.perm_user
mov rcx, rbx
call fcn.004176b0
lea rcx, str.Permanent_install_for_current_user_n
test eax, eax
je 0x40a4e1
lea rcx, str.Temporary_install_n
call fcn.0040a054
call fcn.00409cf8
mov rdi, rax
test rdi, rdi
jne 0x40a508
lea rcx, str.ERROR:_Unable_to_get_shared_dir_
call fcn.0040a054
lea ecx, [rdi + 1]
call fcn.00416780
int3
mov rax, rdi
add rsp, 0xc8
pop rdi
pop rbx
ret
Function at 0x40c2d0
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
mov rbx, rcx
jne 0x40c2f7
lea rdx, str.._srchashes_sha2_sha256.c
lea rcx, str.md___NULL
mov r8d, 0xd0
call fcn.0040ead0
xor eax, eax
mov dword [rbx + 0x280], 0x6a09e667
mov dword [rbx + 0x284], 0xbb67ae85
mov dword [rbx + 0x288], 0x3c6ef372
mov dword [rbx + 0x28c], 0xa54ff53a
mov dword [rbx + 0x290], 0x510e527f
mov dword [rbx + 0x2a0], eax
mov qword [rbx + 0x278], rax
mov dword [rbx + 0x294], 0x9b05688c
mov dword [rbx + 0x298], 0x1f83d9ab
mov dword [rbx + 0x29c], 0x5be0cd19
add rsp, 0x20
pop rbx
ret

Function at 0x40c890
Capabilities:
Hash data using sha224

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
mov rbx, rcx
jne 0x40c8b5
lea r8d, [rcx + 0x2a]
lea rdx, str.c:users_simplehelpworkspace_runner_nativelibtomlibtomcrypt_srchashes_sha2_sha224.c
lea rcx, str.md___NULL
call fcn.0040ead0
xor eax, eax
mov dword [rbx + 0x280], 0xc1059ed8
mov dword [rbx + 0x284], 0x367cd507
mov dword [rbx + 0x288], 0x3070dd17
mov dword [rbx + 0x28c], 0xf70e5939
mov dword [rbx + 0x290], 0xffc00b31
mov dword [rbx + 0x2a0], eax
mov qword [rbx + 0x278], rax
mov dword [rbx + 0x294], 0x68581511
mov dword [rbx + 0x298], 0x64f98fa7
mov dword [rbx + 0x29c], 0xbefa4fa4
add rsp, 0x20
pop rbx
ret
Function at 0x40ff50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0xc8]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rsi
test eax, eax
mov qword [rsp + 0x48], rdi
mov rsi, rdx
mov rdi, r8
mov rbx, rcx
js 0x4100ce
cdq
and edx, 7
add eax, edx
and eax, 7
cmp eax, edx
jne 0x4100ce
cmp r8, 8
mov qword [rsp + 0x38], rbp
jb 0x40fff1
xor ebp, ebp
nop
nop
mov eax, dword [rbx + 0xc8]
test eax, eax
je 0x40fff1
cdq
add rsi, 1
and edx, 7
add eax, edx
sar eax, 3
movsxd rcx, eax
movzx eax, byte [rsi - 1]
xor byte [rcx + rbx], al
add dword [rbx + 0xc8], 8
cmp dword [rbx + 0xc8], 0x440
jne 0x40ffe7
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.0040fbb0
mov dword [rbx + 0xc8], ebp
sub rdi, 8
cmp rdi, 8
jae 0x40ffa0
cmp rdi, 0x440
jb 0x41003e
movabs rax, 0xf0f0f0f0f0f0f0f1
mul rdi
mov rbp, rdx
shr rbp, 0xa
mov rax, rbp
imul rax, rax, 0xfffffffffffffbc0
add rdi, rax
nop
nop
mov r8d, 0x11
mov rdx, rsi
mov rcx, rbx
call fcn.0040fbb0
add rsi, 0x88
sub rbp, 1
jne 0x410020
cmp rdi, 8
mov rbp, qword [rsp + 0x38]
jb 0x41008a
mov r8, rdi
shr r8, 3
mov rax, r8
imul rax, rax, 0xfffffffffffffff8
add rdi, rax
nop
nop
mov eax, dword [rbx + 0xc8]
add rsi, 1
cdq
and edx, 7
add eax, edx
sar eax, 3
movsxd rcx, eax
movzx eax, byte [rsi - 1]
xor byte [rcx + rbx], al
add dword [rbx + 0xc8], 8
sub r8, 1
jne 0x410060
test rdi, rdi
je 0x4100b8
mov eax, dword [rbx + 0xc8]
mov ecx, 8
cdq
sub cl, dil
and edx, 7
add eax, edx
movzx edx, byte [rsi]
sar eax, 3
shr dl, cl
movsxd r8, eax
xor byte [r8 + rbx], dl
add dword [rbx + 0xc8], edi
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x28
ret

Function at 0x416230
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x416259
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x416259
mov ecx, eax
call fcn.004156e0
mov eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x416e10
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x416e39
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x416e39
mov ecx, eax
call fcn.004156e0
mov eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x41b380
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
test rcx, rcx
mov ebx, edx
jne 0x41b3c6
call fcn.004156b0
mov dword [rax], 0
call fcn.00415680
mov ebx, 0x16
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], ebx
mov qword [rsp + 0x20], 0
call fcn.0041d730
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret
test edx, 0xfffffff9
jne 0x41b38d
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41b3f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.004156e0
call fcn.00415680
mov ebx, dword [rax]
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret
test al, 0x10
jne 0x41b42b
test al, 1
je 0x41b42b
test bl, 2
je 0x41b42b
call fcn.004156b0
mov dword [rax], 5
call fcn.00415680
mov dword [rax], 0xd
call fcn.00415680
mov ebx, dword [rax]
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x41b440
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x41b46b
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41b46b
mov ecx, eax
call fcn.004156e0
mov eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x41b480
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x41b4a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41b4a9
mov ecx, eax
call fcn.004156e0
mov eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x426987
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x004466e8]
jne 0x41ba5a
rol rcx, 0x10
test cx, 0xffff
jne 0x41ba56
repz ret
ror rcx, 0x10
jmp 0x4268e0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x0044a740]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x0044a838]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x426965
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x0044a740]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x426987
mov rax, qword [rsp + 0x88]
mov qword [0x0044a838], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x0044a7d8], rax
mov rax, qword [0x0044a838]
mov qword [0x0044a6b0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x0044a7c0], rax
mov dword [0x0044a6a0], 0xc0000409
mov dword [0x0044a6a4], 1
mov rax, qword [0x004466e8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x004466f0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x0044a738], eax
mov ecx, 1
call fcn.00427160
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x004396d0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x0044a738], 0
jne 0x426a0e
mov ecx, 1
call fcn.00427160
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x426a30
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.0041d8c0
xor ebx, ebx
cmp qword [0x0044ac10], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x426b61
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x426a93
xor eax, eax
jmp 0x426c41
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x426a8c
mov rcx, rax
call fcn.0041d850
lea rdx, str.GetActiveWindow
mov rcx, rbp
mov qword [0x0044ac10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0041d850
lea rdx, str.GetLastActivePopup
mov rcx, rbp
mov qword [0x0044ac18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0041d850
lea rcx, [rsp + 0x30]
mov qword [0x0044ac20], rax
call fcn.004164d0
test eax, eax
je 0x426b17
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.0041d690
cmp dword [rsp + 0x30], 2
jne 0x426b61
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0041d850
test rax, rax
mov qword [0x0044ac30], rax
je 0x426b61
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0041d850
mov qword [0x0044ac28], rax
mov rcx, qword [0x0044ac28]
cmp rcx, rsi
je 0x426bf3
cmp qword [0x0044ac30], rsi
je 0x426bf3
call fcn.0041d920
call rax
test rax, rax
mov rbp, rax
je 0x426bbe
mov rcx, qword [0x0044ac30]
call fcn.0041d920
lea rcx, [rsp + 0x38]
mov r9d, 0xc
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x426bbe
test byte [rsp + 0x48], 1
jne 0x426bf3
lea rcx, [rsp + 0x34]
call fcn.00416520
test eax, eax
je 0x426be0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.0041d690
cmp dword [rsp + 0x34], 4
jb 0x426bed
bts edi, 0x15
jmp 0x426c27
bts edi, 0x12
jmp 0x426c27
mov rcx, qword [0x0044ac18]
cmp rcx, rsi
je 0x426c27
call fcn.0041d920
call rax
test rax, rax
mov rbx, rax
je 0x426c27
mov rcx, qword [0x0044ac20]
cmp rcx, rsi
je 0x426c27
call fcn.0041d920
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x0044ac10]
call fcn.0041d920
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x140001480
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1400ce350]
mov dword [rax], 1
mov rax, qword [0x1400ce360]
mov dword [rax], 1
mov rax, qword [0x1400ce370]
mov dword [rax], 1
mov rax, qword [0x1400ce340]
mov dword [rax], 1
mov rax, qword [0x1400ce1e0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014de
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14000150a
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x140001530
cmp eax, 0x20b
je 0x140001557
jmp 0x140001586
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x140001543
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x140001572
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140007e6e
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
call sym.nimErrorFlag_6
mov qword [rbp - 8], rax
mov qword [rbp - 0x10], 0
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fread
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
cmp rax, qword [rbp + 0x20]
je 0x140007edc
mov rcx, qword [rbp + 0x10]
call sym.checkErr__stdZsyncio_u162
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
movzx eax, al
test eax, eax
jmp 0x140007edd
nop
mov rax, qword [rbp - 0x18]
add rsp, 0x40
pop rbp
ret

Function at 0x140009343
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp - 8], 0
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sym.strlen
mov qword [rbp - 8], rax
mov qword [rbp - 0x10], 0
mov rdx, qword [rbp - 8]
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x14], 0
mov rcx, qword [rbp + 0x10]
call sym.fflush
mov dword [rbp - 0x14], eax
nop
add rsp, 0x40
pop rbp
ret
Function at 0x14001346f
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp - 8], 0
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov qword [rbp - 8], rax
mov dword [rbp - 0xc], 0
mov rcx, qword [rbp + 0x10]
call sym.fflush
mov dword [rbp - 0xc], eax
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140016aee
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
lea rax, str.echoBinSafe
mov qword [rbp - 0x58], rax
lea rax, [0x1400b4b58]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
mov word [rbp - 0x40], 0
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.nimFrame_7
call sym.nimErrorFlag_7
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x50], 0xb34
lea rax, [0x1400dd180]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x50], 0x12
lea rax, [0x1400b52e8]
mov qword [rbp - 0x48], rax
mov qword [rbp - 8], 0
mov qword [rbp - 0x50], 0x13
mov rax, qword [rbp - 8]
cmp rax, qword [rbp + 0x18]
jge 0x140016c46
mov qword [rbp - 0x50], 0xb35
lea rax, [0x1400b4b58]
mov qword [rbp - 0x48], rax
cmp qword [rbp - 8], 0
js 0x140016bb2
mov rax, qword [rbp - 8]
cmp rax, qword [rbp + 0x18]
jl 0x140016bcb
mov rax, qword [rbp + 0x18]
lea rdx, [rax - 1]
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.raiseIndexError2
jmp 0x140016cd7
mov rax, qword [rbp - 8]
shl rax, 4
mov rdx, rax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov ecx, 1
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
mov rax, qword [rbp - 0x18]
mov rdx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rdx
lea rax, [rbp - 0x70]
mov r8d, 0
mov rdx, rax
call sym.writeWindows__system_u9037
mov rax, qword [rbp - 0x10]
movzx eax, byte [rax]
movzx eax, al
test eax, eax
jne 0x140016cd6
mov qword [rbp - 0x50], 0xd
lea rax, [0x1400b52e8]
mov qword [rbp - 0x48], rax
add qword [rbp - 8], 1
jmp 0x140016b80
nop
mov qword [rbp - 0x50], 0xb50
lea rax, [0x1400b4b58]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x20], 0
mov ecx, 1
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 1
mov edx, 1
lea rax, [0x1400b4b49]
mov rcx, rax
call sym.fwrite
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x50], 0xb51
mov dword [rbp - 0x24], 0
mov ecx, 1
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
call sym.fflush
mov dword [rbp - 0x24], eax
mov qword [rbp - 0x50], 0xb55
lea rax, [0x1400dd180]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x140016cd7
nop
call sym.popFrame_7
nop
add rsp, 0x90
pop rbp
ret