joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402d2f24
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1403c2018]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor r10d, r10d
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x30], r10
mov ebx, r10d
mov qword [rbp - 0x28], rbx
mov r13, r8
mov dword [rbp - 0x18], r10d
mov r15, rdx
mov dword [rbp - 0x14], r10d
mov edi, r10d
test r9, r9
jne 0x1402d2f7b
mov esi, 0x80070057
jmp 0x1402d3156
mov byte [r9], r10b
test r15, r15
je 0x1402d3153
test r13, r13
je 0x1402d3153
mov r9d, 0x100
mov rax, r15
mov edx, r9d
cmp word [rax], r10w
je 0x1402d2fac
add rax, 2
sub rdx, 1
jne 0x1402d2f9c
mov rax, rdx
mov esi, 0x80070057
neg rax
mov rcx, r9
mov rax, rdx
sbb r8d, r8d
sub rcx, rdx
not r8d
and r8d, esi
neg rax
sbb r12, r12
and r12, rcx
test rdx, rdx
jne 0x1402d2fdf
mov esi, r8d
jmp 0x1402d3156
mov rdx, r9
mov rax, r13
cmp word [rax], r10w
je 0x1402d2ff5
add rax, 2
sub rdx, 1
jne 0x1402d2fe5
mov rax, rdx
neg rax
mov rax, rdx
sbb ecx, ecx
sub r9, rdx
not ecx
and esi, ecx
neg rax
sbb r14, r14
and r14, r9
test rdx, rdx
je 0x1402d3156
test r12, r12
je 0x1402d3153
test r14, r14
je 0x1402d3153
mov qword [rsp + 0x30], r10
lea rax, [rbp - 0x18]
xor r9d, r9d
mov qword [rsp + 0x28], r10
mov edx, r12d
mov qword [rsp + 0x20], rax
mov rcx, r15
lea r8d, [r9 + 1]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
jne 0x1402d306e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x1402d3156
mov edx, dword [rbp - 0x18]
lea rcx, [rbp - 0x30]
call fcn.1402d2eec
mov rdi, qword [rbp - 0x30]
test al, al
jne 0x1402d308c
mov esi, 0x8007000e
jmp 0x1402d3156
and qword [rsp + 0x30], rbx
lea rax, [rbp - 0x18]
and qword [rsp + 0x28], rbx
mov r9, rdi
mov r8d, 1
mov qword [rsp + 0x20], rax
mov edx, r12d
mov rcx, r15
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
xor r15d, r15d
test eax, eax
je 0x1402d3055
mov qword [rsp + 0x30], r15
lea rax, [rbp - 0x14]
mov qword [rsp + 0x28], r15
lea r8d, [r15 + 1]
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov edx, r14d
mov rcx, r13
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
je 0x1402d3055
mov edx, dword [rbp - 0x14]
lea rcx, [rbp - 0x28]
call fcn.1402d2eec
mov rbx, qword [rbp - 0x28]
test al, al
je 0x1402d3082
mov qword [rsp + 0x30], r15
lea rax, [rbp - 0x14]
mov qword [rsp + 0x28], r15
lea r8d, [r15 + 1]
mov r9, rbx
mov qword [rsp + 0x20], rax
mov edx, r14d
mov rcx, r13
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
je 0x1402d3055
mov eax, dword [rbp - 0x18]
cmp eax, dword [rbp - 0x14]
je 0x1402d3138
mov esi, r15d
jmp 0x1402d3156
mov r8, rax
mov rdx, rbx
mov rcx, rdi
call fcn.1402bbad0
test eax, eax
jne 0x1402d3133
mov rax, qword [rbp - 0x20]
mov byte [rax], 1
jmp 0x1402d3156
mov esi, r10d
mov rcx, rbx
call fcn.1400385dc
mov rcx, rdi
call fcn.1400385dc
mov eax, esi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140038910
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1402d341c
Capabilities:
Encode data using base64 via winapi

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1403c2018]
xor rax, rsp
mov qword [rbp - 8], rax
xor r15d, r15d
lea rax, [rbp - 0x38]
mov rsi, r8
mov qword [rbp - 0x38], r15
mov r8d, 0x800c
mov dword [rbp - 0x40], r15d
lea r9, [rbp - 0x40]
mov dword [rbp - 0x10], r15d
mov qword [rsp + 0x20], rax
call fcn.1402d318c
mov ebx, eax
test eax, eax
js 0x1402d3560
mov edx, dword [rbp - 0x40]
lea rax, [rbp - 0x10]
mov rcx, qword [rbp - 0x38]
xor r9d, r9d
mov r8d, 0x40000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
je 0x1402d354c
mov edx, dword [rbp - 0x10]
lea rax, [r15 - 1]
add edx, 1
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x20], r15
cmovb rdx, rax
mov qword [rbp - 0x18], 7
cmp rdx, 7
ja 0x1402d34d6
mov qword [rbp - 0x20], rdx
test rdx, rdx
je 0x1402d34ce
movzx eax, r15w
lea rdi, [rbp - 0x30]
mov rcx, rdx
rep stosw word [rdi], ax
mov word [rbp + rdx*2 - 0x30], r15w
jmp 0x1402d34e5
xor r9d, r9d
lea rcx, [rbp - 0x30]
mov r8b, r15b
call fcn.14002e078
lea rax, [rbp - 0x30]
cmp rsi, rax
je 0x1402d3516
mov rcx, rsi
call fcn.14001b814
movups xmm1, xmmword [rbp - 0x20]
mov qword [rbp - 0x20], r15
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r15w
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
lea rcx, [rbp - 0x30]
call fcn.14001b814
cmp qword [rsi + 0x18], 8
jb 0x1402d3529
mov rsi, qword [rsi]
mov edx, dword [rbp - 0x40]
lea rax, [rbp - 0x10]
mov rcx, qword [rbp - 0x38]
mov r9, rsi
mov r8d, 0x40000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
jne 0x1402d3560
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp qword [rbp - 0x38], r15
je 0x1402d356f
mov rcx, qword [rbp - 0x38]
call fcn.1400385dc
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140038910
add rsp, 0x70
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1402d3588
Capabilities:
Encode data using base64 via winapi

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1403c2018]
xor rax, rsp
mov qword [rbp - 8], rax
xor r15d, r15d
lea rax, [rbp - 0x38]
mov rsi, r8
mov qword [rbp - 0x38], r15
mov r8d, 0x8004
mov dword [rbp - 0x40], r15d
lea r9, [rbp - 0x40]
mov dword [rbp - 0x10], r15d
mov qword [rsp + 0x20], rax
call fcn.1402d318c
mov ebx, eax
test eax, eax
js 0x1402d36cc
mov edx, dword [rbp - 0x40]
lea rax, [rbp - 0x10]
mov rcx, qword [rbp - 0x38]
xor r9d, r9d
mov r8d, 0x40000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
je 0x1402d36b8
mov edx, dword [rbp - 0x10]
lea rax, [r15 - 1]
add edx, 1
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x20], r15
cmovb rdx, rax
mov qword [rbp - 0x18], 7
cmp rdx, 7
ja 0x1402d3642
mov qword [rbp - 0x20], rdx
test rdx, rdx
je 0x1402d363a
movzx eax, r15w
lea rdi, [rbp - 0x30]
mov rcx, rdx
rep stosw word [rdi], ax
mov word [rbp + rdx*2 - 0x30], r15w
jmp 0x1402d3651
xor r9d, r9d
lea rcx, [rbp - 0x30]
mov r8b, r15b
call fcn.14002e078
lea rax, [rbp - 0x30]
cmp rsi, rax
je 0x1402d3682
mov rcx, rsi
call fcn.14001b814
movups xmm1, xmmword [rbp - 0x20]
mov qword [rbp - 0x20], r15
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r15w
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
lea rcx, [rbp - 0x30]
call fcn.14001b814
cmp qword [rsi + 0x18], 8
jb 0x1402d3695
mov rsi, qword [rsi]
mov edx, dword [rbp - 0x40]
lea rax, [rbp - 0x10]
mov rcx, qword [rbp - 0x38]
mov r9, rsi
mov r8d, 0x40000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
jne 0x1402d36cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp qword [rbp - 0x38], r15
je 0x1402d36db
mov rcx, qword [rbp - 0x38]
call fcn.1400385dc
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140038910
add rsp, 0x70
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x1402d36f4
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp qword [rcx], rbx
je 0x1402d3708
mov ebx, 0x80040c15
jmp 0x1402d3739
mov r9d, 0x18
mov dword [rsp + 0x20], 0xf0000040
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1402d3739
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x14040b34d
Capabilities:
Resolve function by hash

Disassembly:
movabs eax, dword fs:[0xc78c08500000030]
mov eax, dword [rax + 0xc]
mov esi, dword [rax + 0x1c]
lodsd eax, dword [rsi]
mov ebx, dword [rax + 8]
jmp 0x14040b36c
pop rsi
add esi, 3
push rbx
mov edx, 0xec0e4e8e
call rsi
push rax
mov edx, 0x7c0dfcaa
call rsi
push rax
push rdi
mov edx, 0x4ee4a045
call rsi
xor edx, edx
push rdx
push 0x6d756369
push 0x6c656167
push rsp
push rdx
push rdx
call rax
push rax
mov edx, 0x75da1966
call rsi
call rax
xchg edi, eax
mov edx, 0xffd97fb
call rsi
call rax
cmp edi, 0xb7
jne 0x14040b3bb
mov esp, ebp
invalid
call fcn.14040b3dc
sti
xchg edi, eax
std
pcmpeqd mm5, qword [rbp - 0x50]
jb 0x14040b3c8
jb 0x14040b3c8
mov bl, socket
movabs eax, dword [0xd368a7c7d2d83d6a]
invalid
Function at 0x14002732d
Capabilities:
Set thread local storage value

Disassembly:
push rax
pushf
mov eax, 0x27afce7b
pushf
not eax
add eax, 0xc726eaa4
xor eax, 0x8a193b24
rol eax, 0x40
popf
pushf
not eax
add eax, 0xb45f65af
xor eax, 0x9ef13ea2
rol eax, 0x35
popf
cmp eax, 2
jne 0x14002736a
popf
pop rax
jmp 0x1400274c5
cmp eax, 0
jne 0x140027379
popf
pop rax
jmp 0x140027397
cmp eax, 3
jne 0x140027388
popf
pop rax
jmp 0x140027511
cmp eax, 1
jne 0x140027397
popf
pop rax
jmp 0x1400274bc
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x186425153]
pushf
sub r9, 0x46412ee3
popf
mov edi, ecx
lea rdx, [0x1ab5703d9]
pushf
sub rdx, 0x6b55e169
popf
mov ecx, 0x2c5cbc0b
pushf
not ecx
add ecx, 0x85b88c01
xor ecx, 0xa0027c37
rol ecx, 0xdf
popf
pushf
not ecx
add ecx, 0xc838f5ac
xor ecx, 0x83aefd4f
rol ecx, 0xc6
popf
pushf
not ecx
add ecx, 0xde5f2c34
xor ecx, 0xd5958ac1
rol ecx, 0xcc
popf
lea r8, [0x18d8f3c7a]
pushf
sub r8, 0x4d8e1a12
popf
call fcn.1400027b4
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x140027462
push rax
pushf
mov eax, 0x502781fc
pushf
not eax
add eax, 0xbd5b0241
xor eax, 0x86a11c80
rol eax, 0x42
popf
pushf
not eax
add eax, 0x9f2c5c94
xor eax, 0xf0e1e984
rol eax, 0xde
popf
jmp 0x14002735b
push rax
pushf
mov eax, 0xc27189c8
pushf
not eax
add eax, 0xb5c3f33f
xor eax, 0xa050d4ec
rol eax, 0xac
popf
pushf
not eax
add eax, 0x884377af
xor eax, 0xe2a46213
rol eax, 0xa1
popf
pushf
not eax
add eax, 0xdd57b369
xor eax, 0x8cecd33a
rol eax, 2
popf
pushf
not eax
add eax, 0xf98706d5
xor eax, 0xac46fff5
rol eax, 0x50
popf
jmp 0x14002735b
call qword [0x1400112a0]
jmp 0x140027511
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
push rax
pushf
mov eax, 0x6c8b8ab8
pushf
not eax
add eax, 0xf81a0e5f
xor eax, 0xee0e4396
rol eax, 0x75
popf
pushf
not eax
add eax, 0xa18c68fa
xor eax, 0x89c99dc5
rol eax, 0x3e
popf
pushf
not eax
add eax, 0x86188b68
xor eax, 0x8173021e
rol eax, 0x8d
popf
jmp 0x14002735b
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140036206
Capabilities:
Get thread local storage value

Disassembly:
push rax
pushf
mov eax, 0x75b6355f
pushf
not eax
add eax, 0x905cb2ae
xor eax, 0xc5f003cc
rol eax, 0xe3
popf
pushf
not eax
add eax, 0xc9b10de7
xor eax, 0xcefd19d0
rol eax, 0x28
popf
cmp eax, 2
jne 0x140036243
popf
pop rax
jmp 0x140036372
cmp eax, 0
jne 0x140036252
popf
pop rax
jmp 0x140036261
cmp eax, 1
jne 0x140036261
popf
pop rax
jmp 0x140036366
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x19bcbb48e]
pushf
sub r9, 0x5bca9236
popf
mov ecx, 0x129a1d39
pushf
not ecx
add ecx, 0x9c7a1086
xor ecx, 0x99f0c55a
rol ecx, 0xc6
popf
pushf
not ecx
add ecx, 0xa80e2103
xor ecx, 0xdc409b7e
rol ecx, 0x23
popf
lea r8, [0x1b1abcf23]
pushf
sub r8, 0x71aaacd3
popf
lea rdx, [0x1999fc197]
pushf
sub rdx, 0x599e9f3f
popf
call fcn.1400027b4
mov ecx, ebx
test rax, rax
je 0x140036320
push rax
pushf
mov eax, 0x49230907
pushf
not eax
add eax, 0x84cd8a87
xor eax, 0xe698d569
rol eax, 0x4e
popf
pushf
not eax
add eax, 0xf1914895
xor eax, 0xf58840ea
rol eax, 0xb0
popf
pushf
not eax
add eax, 0xbe7cfed0
xor eax, 0xfcda55cc
rol eax, 0xc4
popf
jmp 0x140036234
push rax
pushf
mov eax, 0x45863b34
pushf
not eax
add eax, 0xaa9e782c
xor eax, 0xc6143415
rol eax, 0x5e
popf
pushf
not eax
add eax, 0x8cb57efe
xor eax, 0xebd39c18
rol eax, 0x71
popf
pushf
not eax
add eax, 0x97425f54
xor eax, 0xd7884f10
rol eax, 0xc8
popf
jmp 0x140036234
add rsp, 0x20
pop rbx
jmp qword [0x1400112a0]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x140039c5a
Capabilities:
Allocate thread local storage

Disassembly:
push rax
pushf
mov eax, 0xedc83cd3
pushf
not eax
add eax, 0xe8c3a33c
xor eax, 0x80fcab1a
rol eax, 0x66
popf
pushf
not eax
add eax, 0xe317cf8e
xor eax, 0xda44913b
rol eax, 0x34
popf
pushf
not eax
add eax, 0xefa9526d
xor eax, 0xb25d9c5e
rol eax, 0x41
popf
cmp eax, 2
jne 0x140039caa
popf
pop rax
jmp 0x140039dc1
cmp eax, 0
jne 0x140039cb9
popf
pop rax
jmp 0x140039cc8
cmp eax, 1
jne 0x140039cc8
popf
pop rax
jmp 0x140039db2
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x18055a7e2]
pushf
sub r9, 0x405485b2
popf
xor ecx, ecx
lea r8, [0x1a7a6d284]
pushf
sub r8, 0x67a5b05c
popf
lea rdx, [0x1ae03ae88]
pushf
sub rdx, 0x6e028c58
popf
call fcn.1400027b4
test rax, rax
je 0x140039d6c
push rax
pushf
mov eax, 0xecb9164d
pushf
not eax
add eax, 0xdbed1c2f
xor eax, 0xa4f821e4
rol eax, 0xb9
popf
pushf
not eax
add eax, 0xd4a9000e
xor eax, 0x96d4ec06
rol eax, 0xf3
popf
pushf
not eax
add eax, 0x8dcb67d0
xor eax, 0xef516763
rol eax, 0xb5
popf
pushf
not eax
add eax, 0xb0075dd8
xor eax, 0xd7eb419b
rol eax, 0x2e
popf
jmp 0x140039c9b
push rax
pushf
mov eax, 0x9840c7f3
pushf
not eax
add eax, 0xe2bfc63c
xor eax, 0x9d7202af
rol eax, 0x67
popf
pushf
not eax
add eax, 0xfe1156af
xor eax, 0xb07110c1
rol eax, 0x55
popf
pushf
not eax
add eax, 0xeebc3400
xor eax, 0x8e633781
rol eax, 0xe4
popf
jmp 0x140039c9b
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [0x1400112a0]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]
Function at 0x1400405ac
Capabilities:
Authenticate hmac

Disassembly:
push rax
pushf
mov eax, 0x121b3ae6
pushf
not eax
add eax, 0xaa0ffe26
xor eax, 0xb2f91a0c
rol eax, 0x2a
popf
pushf
not eax
add eax, 0xd7b58dba
xor eax, 0xcb3aa557
rol eax, 0x55
popf
pushf
not eax
add eax, 0x87334805
xor eax, 0xf8e5dab8
rol eax, 0x5c
popf
cmp eax, 0
jne 0x1400405fc
popf
pop rax
jmp 0x1400405fc
jmp fcn.140047989
Function at 0x1400473c9
Capabilities:
Terminate process

Disassembly:
push rax
pushf
mov eax, 0x5b221561
pushf
not eax
add eax, 0xc9b1e6e3
xor eax, 0xea948bb8
rol eax, 0x4b
popf
pushf
not eax
add eax, 0xb76ad012
xor eax, 0xac8521c0
rol eax, 0x4e
popf
pushf
not eax
add eax, 0x939b25bd
xor eax, 0xd5aa5464
rol eax, 0x3e
popf
pushf
not eax
add eax, 0xff26a025
xor eax, 0xa77d78b0
rol eax, 0xde
popf
cmp eax, 2
jne 0x14004742c
popf
pop rax
jmp 0x14004750d
cmp eax, 0
jne 0x14004743b
popf
pop rax
jmp 0x14004744a
cmp eax, 1
jne 0x14004744a
popf
pop rax
jmp 0x1400474fb
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.14005d861
test al, al
je 0x1400474a1
push rax
pushf
mov eax, 0x50b5993c
pushf
not eax
add eax, 0x97c437fb
xor eax, 0xb490c520
rol eax, 0xfc
popf
pushf
not eax
add eax, 0xa15c84d3
xor eax, 0xd00f8e9f
rol eax, 0x94
popf
pushf
not eax
add eax, 0xd37491bc
xor eax, 0x9b0e6eea
rol eax, 0x83
popf
jmp 0x14004741d
push rax
pushf
mov eax, 0xcec61e40
pushf
not eax
add eax, 0x874262b9
xor eax, 0xac7ac427
rol eax, 0x69
popf
pushf
not eax
add eax, 0xe5bd1ade
xor eax, 0x9517a6cf
rol eax, 0xe1
popf
pushf
not eax
add eax, 0xf0ba0894
xor eax, 0x937c178c
rol eax, 7
popf
pushf
not eax
add eax, 0xf88a6f3a
xor eax, 0xe9886756
rol eax, 0xf8
popf
jmp 0x14004741d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
jmp 0x140047507
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
call fcn.140043172
mov ecx, ebx
jmp 0x140047517
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140091a10
Capabilities:
Access peb ldr_data
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword gs:[0x60]
xor r11d, r11d
mov rsi, r8
mov ebp, edx
mov rdi, qword [rax + 0x10]
movsxd rbx, dword [rdi + 0x3c]
add rbx, rdi
movzx eax, word [rbx + 0x14]
lea r9, [rbx + 0x18]
movzx r10d, word [rbx + 6]
add r9, rax
test r10, r10
je 0x140091acf
mov dword [rsp + 0x78], 0x46424f53
mov byte [rsp + 0x7c], 0x4f
movups xmm2, xmmword [r9]
lea rcx, [rsp + 0x78]
movups xmm0, xmmword [r9 + 0x10]
movsd xmm1, qword [r9 + 0x20]
movd edx, xmm2
movups xmmword [rsp + 0x20], xmm2
movsd qword [rsp + 0x40], xmm1
movups xmmword [rsp + 0x30], xmm0
test dl, dl
je 0x140091ab7
lea rax, [rsp + 0x78]
lea r8, [rsp + 0x20]
sub r8, rax
movzx eax, dl
nop
movzx edx, al
cmp al, byte [rcx]
jne 0x140091ab7
movzx eax, byte [r8 + rcx + 1]
inc rcx
movzx edx, al
test al, al
jne 0x140091aa0
cmp dl, byte [rcx]
lea rdx, [rsp + 0x20]
cmovne rdx, r11
add r9, 0x28
mov r11, rdx
sub r10, 1
jne 0x140091a62
mov eax, dword [r11 + 0xc]
mov rdx, rsi
mov ecx, dword [rbx + 8]
mov eax, dword [rax + rdi]
xor eax, dword [rbx + 0x68]
ror eax, cl
mov ecx, ebp
add rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
jmp rax
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140004440]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140004450]
mov dword [rax], 1
mov rax, qword [0x140004460]
mov dword [rax], 1
mov rax, qword [0x140004400]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140004430]
mov dword [0x14000700c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x140004510]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x1400044f0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x140004390]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x140001180
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x140004490]
xor edi, edi
mov rax, qword gs:[0x30]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
mov rsi, qword [rax + 8]
jmp 0x1400011c0
cmp rsi, rax
je 0x140001320
mov ecx, 0x3e8
call rbp
mov rax, rdi
lock cmpxchg qword [rbx], rsi
test rax, rax
jne 0x1400011b0
mov rsi, qword [0x1400044a0]
xor edi, edi
mov eax, dword [rsi]
cmp eax, 1
je 0x140001337
mov eax, dword [rsi]
test eax, eax
je 0x1400013a0
mov dword [0x140007008], 1
mov eax, dword [rsi]
cmp eax, 1
je 0x14000134c
test edi, edi
je 0x14000136d
mov rax, qword [0x1400043f0]
mov rax, qword [rax]
test rax, rax
je 0x140001223
xor r8d, r8d
mov edx, 2
xor ecx, ecx
call rax
call sym._pei386_runtime_relocator
mov rcx, qword [sym._gnu_exception_handler]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rdx, qword [0x140004480]
lea rcx, [sym.__mingw_invalidParameterHandler]
mov qword [rdx], rax
call sym._set_invalid_parameter_handler
call sym._fpreset
mov ebx, dword [0x140007028]
lea edi, [rbx + 1]
movsxd rdi, edi
shl rdi, 3
mov rcx, rdi
call sym.malloc
test ebx, ebx
mov rbp, qword [0x140007020]
mov r12, rax
jle 0x1400013c0
sub rdi, 8
xor ebx, ebx
mov rcx, qword [rbp + rbx]
call sym.strlen
lea rsi, [rax + 1]
mov rcx, rsi
call sym.malloc
mov r8, rsi
mov qword [r12 + rbx], rax
mov rdx, qword [rbp + rbx]
mov rcx, rax
add rbx, 8
call sym.memcpy
cmp rdi, rbx
jne 0x140001280
add rdi, r12
mov qword [rdi], 0
mov qword [0x140007020], r12
call sym.__main
mov rax, qword [0x140004410]
mov r8, qword [0x140007018]
mov ecx, dword [0x140007028]
mov rax, qword [rax]
mov qword [rax], r8
mov rdx, qword [0x140007020]
call dbg.main
mov ecx, dword [0x14000700c]
mov dword [0x140007010], eax
test ecx, ecx
je 0x1400013c8
mov edx, dword [0x140007008]
test edx, edx
je 0x140001380
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [0x1400044a0]
mov edi, 1
mov eax, dword [rsi]
cmp eax, 1
jne 0x1400011e1
mov ecx, 0x1f
call sym._amsg_exit
mov eax, dword [rsi]
cmp eax, 1
jne 0x140001200
mov rdx, qword [0x1400044c0]
mov rcx, qword [0x1400044b0]
call sym._initterm
test edi, edi
mov dword [rsi], 2
jne 0x140001208
xor eax, eax
xchg qword [rbx], rax
jmp 0x140001208
call sym._cexit
mov eax, dword [0x140007010]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, qword [0x1400044e0]
mov dword [rsi], 1
mov rcx, qword [0x1400044d0]
call sym._initterm
jmp 0x1400011f5
mov rdi, rax
jmp 0x1400012b6
mov ecx, eax
call sym.exit
nop

Function at 0x1400018c0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]
Function at 0x140001930
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x140b78c44]
test esi, esi
mov rbx, rcx
jle 0x140001a60
mov rax, qword [0x140b78c48]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14000197b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140001a05
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140001960
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov rdi, rax
je 0x140001a82
mov rax, qword [0x140b78c48]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call sym._GetPEImageBase
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x140b78c48]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140001a67
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400019fe
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140001a10
add dword [0x140b78c44], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov r8d, 0x40
mov eax, 4
mov rcx, qword [rsp + 0x20]
cmove r8d, eax
mov rdx, qword [rsp + 0x38]
add rbx, qword [0x140b78c48]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400019fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
nop dword [rax]
xor esi, esi
jmp 0x140001988
mov rax, qword [0x140b78c48]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [rdi + 8]
mov r8, qword [rax + rbx + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140001ff0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140b78ca0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140b78c80]
test rbx, rbx
je 0x14000204c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140002043
test rsi, rsi
je 0x140002043
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140002028
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140002260
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140002278
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140002280
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret