joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402c6874
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1402a44d8
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1402c68fe
cmp byte [rbp - 0x21], r15b
je 0x1402c68f9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1402c6934
call fcn.1402bee54
test eax, eax
jne 0x1402c6920
cmp byte [rbp - 0x21], r15b
je 0x1402c6918
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1402c6934
cmp byte [rbp - 0x21], r15b
je 0x1402c6931
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1402b193c
test eax, eax
jne 0x1402c69d4
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1402a44d8
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1402c6973
cmp byte [rbp - 0x21], r15b
je 0x1402c69a8
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1402c69a8
call fcn.1402bee54
test eax, eax
jne 0x1402c6994
cmp byte [rbp - 0x21], r15b
je 0x1402c698d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1402c69a8
cmp byte [rbp - 0x21], r15b
je 0x1402c69a5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1402b193c
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1402c69d4
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1402c69d7
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1402c69e5
mov rcx, rdi
call fcn.1402bb190
cmp byte [rbp + 0x3f], r15b
je 0x1402c69f4
mov rcx, qword [rbp + 0x27]
call fcn.1402bb190
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1402cd4ec
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1402c04d4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1402c04d4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1402cd63c
cmp rax, 0xffffffffffffffff
je 0x1402cd63c
xor edi, edi
test rbp, rbp
jle 0x1402cd5e7
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1402beb14
mov rbx, rax
test rax, rax
jne 0x1402cd574
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1402cd5dd
mov edx, 0x8000
mov ecx, r14d
call fcn.1402afdb8
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1402be0d4
cmp eax, 0xffffffff
je 0x1402cd5bd
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1402cd584
mov edx, r15d
mov ecx, r14d
call fcn.1402afdb8
jmp 0x1402cd5dd
cmp byte [rsi + 0x38], dil
je 0x1402cd5d4
cmp dword [rsi + 0x34], 5
jne 0x1402cd5d4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], select
cmp byte [rsi + 0x30], dil
je 0x1402cd5dd
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1402bb190
jmp 0x1402cd650
jns 0x1402cd650
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1402c04d4
cmp rax, 0xffffffffffffffff
jne 0x1402cd608
cmp byte [rsi + 0x30], dil
je 0x1402cd650
mov edi, dword [rsi + 0x2c]
jmp 0x1402cd650
mov ecx, r14d
call fcn.1402c3ce4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1402cd650
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, ntohs
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], select
jmp 0x1402cd650
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1402cd649
mov eax, dword [rsi + 0x2c]
jmp 0x1402cd64e
mov eax, reloc.WS2_32.dll_shutdown
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1402c04d4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x180002ba0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a94], 0xa
jl 0x180002bd2
mov eax, dword [0x180020a98]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x180002bd2
nop word cs:[rax + rax]
jmp 0x180002bd0
mov rax, qword gs:[0x60]
mov r11, qword [rax + 0x18]
add r11, 0x10
mov eax, dword [0x180020a80]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a7c], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020aa0], 0xa
setl r9b
or r9b, al
lea r10, [rcx - 1]
xor eax, eax
mov r14, r11
mov r14, qword [r14]
cmp r14, r11
je 0x180002ca8
mov rsi, r10
test r8b, r8b
je 0x180002cc0
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x180002c40
test r9b, r9b
je 0x180002cd0
sub rsi, rcx
je 0x180002ca4
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop
movzx r13d, word [r15 + rbx*2]
lea edi, [r13 - 0x41]
lea ebp, [r13 + 0x20]
cmp di, 0x1a
cmovae ebp, r13d
movsx edi, byte [rcx + rbx]
lea r12d, [rdi - 0x41]
lea edx, [rdi + 0x20]
cmp r12b, 0x1a
cmovae edx, edi
sub ebp, edx
test r13d, r13d
je 0x180002ca0
test ebp, ebp
jne 0x180002ca0
add rbx, 1
cmp rsi, rbx
jne 0x180002c60
jmp 0x180002ca4
test ebp, ebp
jne 0x180002c2c
mov rax, qword [r14 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x180002cc0
jmp 0x180002cd0
Function at 0x1800023a0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a94], 0xa
jl 0x1800023d2
mov eax, dword [0x180020a98]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x1800023d2
nop word cs:[rax + rax]
jmp 0x1800023d0
mov rax, qword gs:[0x60]
mov r11, qword [rax + 0x18]
add r11, 0x10
mov eax, dword [0x180020a80]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a7c], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020aa0], 0xa
setl r9b
or r9b, al
lea r10, [rcx - 1]
xor eax, eax
mov r14, r11
mov r14, qword [r14]
cmp r14, r11
je 0x1800024a8
mov rsi, r10
test r8b, r8b
je 0x1800024c0
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x180002440
test r9b, r9b
je 0x1800024d0
sub rsi, rcx
je 0x1800024a4
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop
movzx r13d, word [r15 + rbx*2]
lea edi, [r13 - 0x41]
lea ebp, [r13 + 0x20]
cmp di, 0x1a
cmovae ebp, r13d
movsx edi, byte [rcx + rbx]
lea r12d, [rdi - 0x41]
lea edx, [rdi + 0x20]
cmp r12b, 0x1a
cmovae edx, edi
sub ebp, edx
test r13d, r13d
je 0x1800024a0
test ebp, ebp
jne 0x1800024a0
add rbx, 1
cmp rsi, rbx
jne 0x180002460
jmp 0x1800024a4
test ebp, ebp
jne 0x18000242c
mov rax, qword [r14 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x1800024c0
jmp 0x1800024d0
Function at 0x14001b31c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001b332
mov al, 1
jmp 0x14001b392
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001b343
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001b390
mov ecx, dword [rcx + 0x18]
nop
call fcn.140019470
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001b390
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001b390
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001b390
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001b392
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14001f5b0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001f5d8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001f5d8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140131168
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
pop rbp
sub r11b, byte [r8 - 0x39]
xor r14b, 0xf6
Function at 0x180007004
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x18003c048]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea r9, [r11 - 0x18]
xor r8d, r8d
xor edx, edx
lea rcx, [0x18002e548]
xor ebx, ebx
call sub.SHELL32.dll_SHGetKnownFolderPath
mov edi, eax
test eax, eax
jns 0x18000706c
xor ecx, ecx
call fcn.180009ff0
test al, al
je 0x180007065
mov r8d, edi
lea rdx, str.VM3DDevAPIRSLoadCCDAPI
lea rcx, str._s:_Unable_to_get_system_folder:_0x_08x_n
call fcn.1800099e0
xor al, al
jmp 0x1800071d1
mov rcx, qword [rsp + 0x20]
or r8, 0xffffffffffffffff
mov rax, r8
inc rax
cmp word [rcx + rax*2], bx
jne 0x180007078
lea edi, [rax + 0xc]
mov eax, 2
mul rdi
cmovo rax, r8
mov rcx, rax
call fcn.18000fd6c
mov rbp, rax
test rax, rax
jne 0x1800070c7
xor ecx, ecx
call fcn.180009ff0
test al, al
je 0x1800071bc
lea rdx, str.VM3DDevAPIRSLoadCCDAPI
lea rcx, str._s:_Unable_to_allocate_user32_path_buffer._n
call fcn.1800099e0
jmp 0x1800071bc
mov r8, qword [rsp + 0x20]
mov rdx, rdi
mov rcx, rbp
call fcn.18000fdf4
lea r8, str.user32.dll
mov rdx, rdi
mov rcx, rbp
call fcn.18000fd74
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x18003dd28], rax
test rax, rax
jne 0x18000712e
xor ecx, ecx
call fcn.180009ff0
test al, al
je 0x1800071bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.VM3DDevAPIRSLoadCCDAPI
lea rcx, str._s:_Unable_to_load_user32.dll:__u_n
call fcn.1800099e0
jmp 0x1800071bc
mov edi, ebx
lea rsi, [0x18003c008]
mov rdx, qword [rsi - 8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov rax, qword [rsi]
mov qword [rax], rcx
mov rax, qword [rsi]
cmp qword [rax], rbx
je 0x180007169
inc edi
add rsi, 0x10
cmp edi, 3
jae 0x18000719b
mov rax, qword [0x18003dd28]
jmp 0x180007137
xor ecx, ecx
call fcn.180009ff0
test al, al
je 0x180007198
lea rax, section..data
mov r8d, edi
add r8, r8
lea rdx, str.VM3DDevAPIRSLoadCCDAPI
lea rcx, str._s:_Unable_to_find__s_in_user32.dll._n
mov r8, qword [rax + r8*8]
call fcn.1800099e0
cmp edi, 3
jne 0x1800071b7
xor r8d, r8d
xor r9d, r9d
lea edx, [r8 + 1]
lea ecx, [rdx + 5]
call fcn.180007f3c
test al, al
je 0x1800071f3
mov bl, 1
jmp 0x1800071bc
call fcn.18000934c
mov rcx, rbp
call fcn.18000fd58
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov al, bl
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18000bdb0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov r8d, 0xc7
lea rdx, str.d:_buildob_bora_18379147_bora_vmsoft_build_release_x64_svgawddm_srcdevapi_resolutionset.c
lea rcx, str.VERIFY__s:_d_n
call fcn.18000b480
int3
Function at 0x180009cf0
Capabilities:
Enumerate files on windows

Disassembly:
push rsi
sub rsp, 0x180
mov rax, qword [0x18003c048]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov eax, dword [0x18003cb10]
lea r9, [0x18005e2c0]
mov dword [rsp + 0x28], eax
lea r8, str.C:_vm3dum_log_vm3dum_s__d__d.log
mov eax, dword [0x18005e290]
lea rcx, [0x18005e2e0]
mov edx, 0x80
mov dword [rsp + 0x20], eax
call fcn.18000a1d0
mov r8d, 0x20
lea rdx, [0x18002e664]
lea rcx, [0x18005e2e0]
call fcn.180010b24
mov rsi, rax
test rax, rax
je 0x180009dff
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x198], rdi
lea rcx, str.C:_vm3dum_log_vm3dum.log
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180009de3
mov qword [rsp + 0x190], rbx
lea rdx, [rsp + 0x30]
mov rcx, rax
mov ebx, 1
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x180009dc1
inc ebx
cmp ebx, 0x200
ja 0x180009dc1
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x180009da5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp ebx, 0x200
mov rbx, qword [rsp + 0x190]
ja 0x180009de3
mov qword [0x18003cb08], rsi
jmp 0x180009df7
mov rcx, rsi
call fcn.180010684
lea rcx, [0x18005e2e0]
call fcn.180010ca4
mov rdi, qword [rsp + 0x198]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.18000bdb0
add rsp, 0x180
pop rsi
ret

Function at 0x180009f20
Capabilities:
Enumerate files on windows

Disassembly:
movups xmm0, xmmword [rcx]
movups xmmword [0x18005e260], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [0x18005e270], xmm1
movups xmm0, xmmword [rcx + 0x20]
mov ecx, dword [0x18005e258]
movups xmmword [0x18005e280], xmm0
test ecx, ecx
je 0x180009fb8
sub ecx, 1
je 0x180009fa4
sub ecx, 1
je 0x180009f90
sub ecx, 1
je 0x180009f7c
cmp ecx, 1
je 0x180009f68
xor eax, eax
mov dword [0x18005e254], eax
jmp 0x180009fca
mov eax, dword [0x18005e270]
mov dword [0x18005e254], eax
mov eax, dword [0x18005e288]
jmp 0x180009fca
mov eax, dword [0x18005e26c]
mov dword [0x18005e254], eax
mov eax, dword [0x18005e284]
jmp 0x180009fca
mov eax, dword [0x18005e268]
mov dword [0x18005e254], eax
mov eax, dword [0x18005e280]
jmp 0x180009fca
mov eax, dword [0x18005e264]
mov dword [0x18005e254], eax
mov eax, dword [0x18005e27c]
jmp 0x180009fca
mov eax, dword [0x18005e260]
mov dword [0x18005e254], eax
mov eax, dword [0x18005e278]
cmp byte [0x18005e28c], 0
mov dword [0x18005e250], eax
je 0x180009fe7
cmp qword [0x18003cb08], 0
je fcn.180009cf0
ret

Function at 0x18000a230
Capabilities:
Set thread local storage value

Disassembly:
mov rax, qword [rcx]
mov r9, rcx
lock inc qword [rax]
cmp byte [0x18005e201], 0
je 0x18000a28e
rdtsc
shl rdx, 0x20
or rax, rdx
mov rdx, qword [rcx]
mov r8, rax
sub r8, qword [rcx + 0x10]
lock xadd qword [rdx + 8], r8
mov rdx, rax
sub rdx, qword [rcx + 8]
mov rcx, qword [rcx]
lock xadd qword [rcx + 0x10], rdx
mov rdx, qword [r9 + 0x18]
test rdx, rdx
je 0x18000a281
sub rax, qword [r9 + 8]
add qword [rdx + 0x10], rax
mov rdx, qword [r9 + 0x18]
mov ecx, dword [0x18005e204]
jmp qword [sym.imp.KERNEL32.dll_TlsSetValue]
ret
Function at 0x18000a530
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
cmp byte [0x18005e200], 0
mov rbx, rcx
jne 0x18000a5b9
mov word [0x18005e200], 0x101
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edx, 0x40
mov qword [rsp + 0x20], rbx
lea r9, [0x18002e6c0]
mov dword [0x18005e204], eax
lea rcx, [0x18005e208]
lea r8, [rdx - 0x41]
call fcn.18000a110
mov ecx, dword [0x18005e204]
cmp ecx, 0xffffffff
jne 0x18000a598
lea rcx, str.Unable_allocate_TLS_for_MKSGuestStats.__Timing_will_be_unavailable._n
call fcn.1800099e0
mov byte [0x18005e201], 0
jmp 0x18000a5a0
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov r8, rbx
lea rdx, str.MKSGuestStats_enabled_for__s._n
mov ecx, 8
add rsp, 0x30
pop rbx
jmp fcn.18000a000
add rsp, 0x30
pop rbx
ret
Function at 0x18000b7d0
Capabilities:
Create process memory minidump

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x5f0
mov rax, qword [0x18003c048]
xor rax, rsp
mov qword [rsp + 0x5e0], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x58], rax
lea rdx, str.CoreDump_CoreDump
lea rcx, str._s:_faking_exception_to_get_context_n
call fcn.1800099e0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xcafebabe
call qword [sym.imp.KERNEL32.dll_RaiseException]
Function at 0x18001f954
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18001f974
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.18001d144
or eax, 0xffffffff
jmp 0x18001f976
xor eax, eax
add rsp, 0x28
ret
Function at 0x140001820
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.14000da70
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.14000da70
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x140001890
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x1401180c4]
mov r12, rcx
test ebx, ebx
jle 0x1400019c0
mov rax, qword [0x1401180c8]
xor r9d, r9d
add rax, 0x18
nop dword [rax + rax]
mov r8, qword [rax]
cmp r8, r12
ja 0x1400018db
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp r12, r8
jb 0x140001965
add r9d, 1
add rax, 0x28
cmp r9d, ebx
jne 0x1400018c0
mov rcx, r12
call fcn.140002260
mov rsi, rax
test rax, rax
je 0x1400019e2
mov rax, qword [0x1401180c8]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call fcn.140002390
mov edx, dword [rsi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1401180c8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400019c7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14000195e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140001970
add dword [0x1401180c4], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x1401180c8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000195e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140001820
nop dword [rax]
xor ebx, ebx
jmp 0x1400018e8
mov rax, qword [0x1401180c8]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140001820
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140001820
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140001eb0
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r13, [0x140118120]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140118100]
test rbx, rbx
je 0x140001f0c
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x140001f03
test r12, r12
je 0x140001f03
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140001ee8
mov rcx, r13
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140002260
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400eedb0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002280
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002288
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002280
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x1400022d5
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400022cc
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002280
add rax, 0x28
cmp rax, r9
jne 0x1400022b8
xor eax, eax
ret

Function at 0x1400022e0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400eedb0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140002300
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002308
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x140002300
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x140002390
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400eedb0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1400023b0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x1400023b8
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x14000fd30
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x98
movabs rax, 0x6c6320726f727245
movabs rdx, 0x7520676e696e6165
mov qword [rsp + 0x20], rax
movabs rax, 0x6b5f6e6970732070
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20726f6620737965
mov qword [rsp + 0x30], rax
movabs rax, 0x20646165726874
mov qword [rsp + 0x38], rdx
xor edx, edx
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov word [rsp + 0x88], ax
mov byte [rsp + 0x8a], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x47]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x14000fe42
mov eax, 0x28
lea rcx, [rsp + 0x20]
jmp 0x14000fe1a
add rax, 1
cmp rax, 0x6b
je 0x14000fe37
cmp byte [rcx + rax], 0
movsxd rdx, eax
jne 0x14000fe10
cmp edx, 0x6a
je 0x14000fe37
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rdx + 0x20], 0xa
mov byte [rsp + rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov eax, 0x28
mov edx, 0x27
lea rcx, [rsp + 0x20]
jmp 0x14000fe2b