joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001523c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1400152ba
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1400152b1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1400152b1
mov rax, qword [rbp - 8]
jmp 0x1400152cf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140015284
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
je 0x140001066
lea rcx, str.Windows_original_main_args:_n
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
xor ebx, ebx
cmp dword [rax], ebx
jle 0x140001066
xor edi, edi
mov rax, qword [sym.imp.MSVCR100.dll___argv]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
inc ebx
add rdi, 8
cmp ebx, dword [rax]
jl 0x140001038
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010b2
mov r9d, edi
mov rcx, qword [rax]
add rax, 0x10
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x14000109f
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010c9
mov rcx, qword [rbx]
mov rax, qword [str.java]
test rax, rax
jne 0x1400010d8
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x140002248]
mov r8d, 2
lea r9, str._J_ms8m
mov qword [rsp + 0x38], rax
lea rax, [0x140002238]
mov rdx, rbx
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov ecx, edi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r8d
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x18000fd30
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x18003cff8]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18000fd97
mov rcx, qword [rsp + 0x28]
mov edx, 0x10000
mov r8d, 0x40
lea r9, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
jne 0x18000fd7f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x34], eax
jmp 0x18000fd9f
jmp 0x18000fd84
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x28], rax
jmp 0x18000fd40
mov dword [rsp + 0x34], 0
mov eax, dword [rsp + 0x34]
add rsp, 0x38
ret

Function at 0x18000fdb0
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
mov eax, dword [0x18003cfd0]
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov eax, dword [rsp + 0x34]
cmp eax, ecx
je 0x18000fddf
mov dword [rsp + 0x64], 0x10dd
jmp 0x18000ff2a
mov rax, qword [0x18003cfd8]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x18000fe9c
mov rax, qword [rsp + 0x58]
mov r8d, dword [rax + 0x28]
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
mov edx, eax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x18]
lea r9, [rsp + 0x54]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x58]
cmp dword [rax + 8], 0
jne 0x18000fe62
mov rax, qword [rsp + 0x58]
cmp qword [rax + 0x20], 0
je 0x18000fe5d
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x20]
call fcn.18000ff40
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x20], 0
jmp 0x18000fe62
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
cmp rax, 0
je 0x18000fe8d
mov rcx, qword [rsp + 0x28]
call fcn.18001abf8
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x58], rax
jmp 0x18000fdeb
mov qword [0x18003cfd8], 0
call fcn.18000ff90
mov rax, qword [0x18003cfe0]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x18000ff0d
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
cmp rax, 0
je 0x18000fefe
mov rcx, qword [rsp + 0x20]
call fcn.18001abf8
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
jmp 0x18000feb8
mov qword [0x18003cfe0], 0
mov dword [0x18003cfd0], 0
mov dword [rsp + 0x64], 0
mov eax, dword [rsp + 0x64]
add rsp, 0x68
ret
Function at 0x180011a60
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x68]
add rcx, 0xffffffffffff0000
call fcn.180011ce0
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
cmp rax, qword [rsp + 0x60]
jbe 0x180011b8d
mov rax, qword [rsp + 0x58]
cmp rax, qword [0x18003c138]
jb 0x180011acd
mov rax, qword [rsp + 0x58]
cmp rax, qword [0x18003c140]
ja 0x180011acd
mov rax, qword [rsp + 0x58]
add rax, 0xfffffffff8000000
mov qword [rsp + 0x58], rax
jmp 0x180011a84
lea rcx, [rsp + 0x28]
xor edx, edx
mov r8d, 0x30
call fcn.18001f080
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x28]
mov r8d, 0x30
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp rax, 0
jne 0x180011b04
jmp 0x180011b8d
cmp dword [rsp + 0x48], 0x10000
jne 0x180011b72
cmp qword [rsp + 0x40], 0x10000
jb 0x180011b72
mov rcx, qword [rsp + 0x58]
mov edx, 0x10000
mov r8d, 0x3000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x180011b5d
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x70], rax
jmp 0x180011b96
mov rax, qword [rsp + 0x58]
add rax, 0xffffffffffff0000
mov qword [rsp + 0x58], rax
jmp 0x180011b88
mov rcx, qword [rsp + 0x30]
add rcx, 0xffffffffffff0000
call fcn.180011ce0
mov qword [rsp + 0x58], rax
jmp 0x180011a84
mov qword [rsp + 0x70], 0
mov rax, qword [rsp + 0x70]
add rsp, 0x78
ret

Function at 0x180011ba0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x60]
call fcn.180011d30
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
cmp rax, qword [rsp + 0x68]
jae 0x180011cc4
mov rax, qword [rsp + 0x58]
cmp rax, qword [0x18003c138]
jb 0x180011c06
mov rax, qword [rsp + 0x58]
cmp rax, qword [0x18003c140]
ja 0x180011c06
mov rax, qword [rsp + 0x58]
add rax, 0x8000000
mov qword [rsp + 0x58], rax
jmp 0x180011bbd
lea rcx, [rsp + 0x28]
xor edx, edx
mov r8d, 0x30
call fcn.18001f080
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x28]
mov r8d, 0x30
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp rax, 0
jne 0x180011c3d
jmp 0x180011cc4
cmp dword [rsp + 0x48], 0x10000
jne 0x180011cab
cmp qword [rsp + 0x40], 0x10000
jb 0x180011cab
mov rcx, qword [rsp + 0x58]
mov edx, 0x10000
mov r8d, 0x3000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x180011c96
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x70], rax
jmp 0x180011ccd
mov rax, qword [rsp + 0x58]
add rax, 0x10000
mov qword [rsp + 0x58], rax
jmp 0x180011cbf
mov rcx, qword [rsp + 0x28]
add rcx, qword [rsp + 0x40]
call fcn.180011d30
mov qword [rsp + 0x58], rax
jmp 0x180011bbd
mov qword [rsp + 0x70], 0
mov rax, qword [rsp + 0x70]
add rsp, 0x78
ret
Function at 0x180011d80
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x70], rcx
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x40]
mov r8d, 0x30
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x180011dd1
mov byte [rsp + 0x87], 0
jmp 0x180011e6a
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
movsxd rcx, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x180011e05
mov byte [rsp + 0x87], 0
jmp 0x180011e6a
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov edx, dword [rdx + 0xe8]
add rcx, rdx
cmp rax, rcx
jb 0x180011e62
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov edx, dword [rdx + 0xe8]
add rcx, rdx
mov rdx, qword [rsp + 0x28]
mov edx, dword [rdx + 0xec]
add rcx, rdx
cmp rax, rcx
jae 0x180011e62
mov byte [rsp + 0x87], 1
jmp 0x180011e6a
mov byte [rsp + 0x87], 0
mov al, byte [rsp + 0x87]
and al, 1
movzx eax, al
add rsp, 0x88
ret

Function at 0x180011e80
Capabilities:
Hook routines via microsoft detours

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x20]
cmp dword [rax], 0x52727464
je 0x180011ea7
mov dword [rsp + 0x2c], 0
jmp 0x180011f6b
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x18]
add rax, 0x10000
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x20]
add rax, 0x60
mov qword [rsp + 8], rax
mov dword [rsp + 4], 0
cmp dword [rsp + 4], 0x2a9
jae 0x180011f63
mov rax, qword [rsp + 8]
movsxd rcx, dword [rsp + 4]
imul rcx, rcx, 0x60
add rax, rcx
cmp qword [rax + 0x48], 0
je 0x180011f4e
mov rax, qword [rsp + 8]
movsxd rcx, dword [rsp + 4]
imul rcx, rcx, 0x60
add rax, rcx
mov rax, qword [rax + 0x48]
cmp rax, qword [rsp + 0x18]
jb 0x180011f41
mov rax, qword [rsp + 8]
movsxd rcx, dword [rsp + 4]
imul rcx, rcx, 0x60
add rax, rcx
mov rax, qword [rax + 0x48]
cmp rax, qword [rsp + 0x10]
jb 0x180011f4e
mov dword [rsp + 0x2c], 0
jmp 0x180011f6b
jmp 0x180011f53
mov eax, dword [rsp + 4]
add eax, 1
mov dword [rsp + 4], eax
jmp 0x180011ed7
mov dword [rsp + 0x2c], 1
mov eax, dword [rsp + 0x2c]
add rsp, 0x30
ret
Function at 0x180011f90
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
movzx eax, byte [rdx]
mov byte [rcx], al
movzx eax, byte [rdx + 1]
mov byte [rcx + 1], al
movzx eax, byte [rdx + 2]
mov byte [rcx + 2], al
movzx eax, byte [rdx + 3]
mov byte [rcx + 3], al
movzx eax, byte [rdx + 4]
mov byte [rcx + 4], al
movzx eax, byte [rdx + 5]
mov byte [rcx + 5], al
movzx eax, byte [rdx + 6]
mov byte [rcx + 6], al
movzx eax, byte [rdx + 7]
mov byte [rcx + 7], al
movzx eax, byte [rdx + 8]
mov byte [rcx + 8], al
movzx eax, byte [rdx + 9]
mov byte [rcx + 9], al
movzx eax, byte [rdx + 0xa]
mov byte [rcx + 0xa], al
movzx eax, byte [rdx + 0xb]
mov byte [rcx + 0xb], al
movzx eax, byte [rdx + 0xc]
mov byte [rcx + 0xc], al
movzx eax, byte [rdx + 0xd]
mov byte [rcx + 0xd], al
movzx eax, byte [rdx + 0xe]
mov byte [rcx + 0xe], al
movzx eax, byte [rdx + 0xf]
mov byte [rcx + 0xf], al
movzx eax, byte [rdx + 0x10]
mov byte [rcx + 0x10], al
movzx eax, byte [rdx + 0x11]
mov byte [rcx + 0x11], al
movzx eax, byte [rdx + 0x12]
mov byte [rcx + 0x12], al
movzx eax, byte [rdx + 0x13]
mov byte [rcx + 0x13], al
movzx eax, byte [rdx + 0x14]
mov byte [rcx + 0x14], al
movzx eax, byte [rdx + 0x15]
mov byte [rcx + 0x15], al
movzx eax, byte [rdx + 0x16]
mov byte [rcx + 0x16], al
movzx eax, byte [rdx + 0x17]
mov byte [rcx + 0x17], al
movzx eax, byte [rdx + 0x18]
mov byte [rcx + 0x18], al
movzx eax, byte [rdx + 0x19]
mov byte [rcx + 0x19], al
movzx eax, byte [rdx + 0x1a]
mov byte [rcx + 0x1a], al
movzx eax, byte [rdx + 0x1b]
mov byte [rcx + 0x1b], al
movzx eax, byte [rdx + 0x1c]
mov byte [rcx + 0x1c], al
movzx eax, byte [rdx + 0x1d]
mov byte [rcx + 0x1d], al
movzx eax, byte [rdx + 0x1e]
mov byte [rcx + 0x1e], al
movzx eax, byte [rdx + 0x1f]
mov byte [rcx + 0x1f], al
mov eax, 8
lea r9, str.cw
lea r8, [0x18002e1a0]
jmp 0x1800120c0
test ebp, ebp
je 0x180012107
xor bl, byte [rcx + rax*4 - 0x20]
mov byte [rcx + rax*4], bl
xor r10b, byte [rcx + rax*4 - 0x1f]
mov byte [rcx + rax*4 + 1], r10b
xor r11b, byte [rcx + rax*4 - 0x1e]
mov byte [rcx + rax*4 + 2], r11b
xor dl, byte [rcx + rax*4 - 0x1d]
mov byte [rcx + rax*4 + 3], dl
inc rax
cmp rax, 0x3c
je 0x180012129
movzx ebx, byte [rcx + rax*4 - 4]
movzx r10d, byte [rcx + rax*4 - 3]
movzx r15d, bl
movzx r14d, r10b
movzx r11d, byte [rcx + rax*4 - 2]
movzx esi, r11b
movzx edx, byte [rcx + rax*4 - 1]
movzx edi, dl
mov ebp, eax
and ebp, 7
cmp ebp, 4
jb 0x180012090
jne 0x180012094
movzx ebx, byte [r15 + r9]
movzx r10d, byte [r14 + r9]
movzx r11d, byte [rsi + r9]
movzx edx, byte [rdi + r9]
jmp 0x180012094
movzx r10d, byte [rsi + r9]
movzx r11d, byte [rdi + r9]
movzx edx, byte [r15 + r9]
mov esi, eax
shr esi, 3
movzx ebx, byte [rsi + r8]
xor bl, byte [r14 + r9]
jmp 0x180012094
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x180012a40
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x28
mov dword [rsp + 0x24], 0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x24]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [rsp + 0x24], 2
setge al
add rsp, 0x28
ret
Function at 0x18001c940
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x18001c9c4
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x18002ef50]
cmp byte [rcx + rax], 0
je 0x18001c9c4
dec r8
sub rdx, 1
jne 0x18001c9aa
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1800213c0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1800213e8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1800213e8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1800282f8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180028328
xor eax, eax
jmp 0x1800283eb
mov rbp, rbx
cmp word [rax], si
je 0x18002834d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180028334
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180028330
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180028248
movsxd r14, eax
test eax, eax
jne 0x18002838b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180028321
mov rcx, r14
call fcn.180028554
mov rdi, rax
test rax, rax
jne 0x1800283a4
xor ecx, ecx
call fcn.1800248ec
jmp 0x180028380
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180028248
test eax, eax
jne 0x1800283d5
mov rcx, rdi
call fcn.1800248ec
jmp 0x1800283df
xor ecx, ecx
call fcn.1800248ec
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x180028520
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x1800284fd
call fcn.180027188
mov dword [rax], 0x16
call fcn.1800207cc
or eax, 0xffffffff
jmp 0x18002851a
sub dword [rcx + 0x10], 1
jns 0x18002850c
add rsp, 0x28
jmp 0x18002b2d0
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x1800284dc
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x18002b302
call fcn.180027188
mov dword [rax], 0x16
call fcn.1800207cc
jmp 0x18002b421
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x18002b421
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x18002b421
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x18002b331
lock or dword [rcx + 0x14], 0x10
jmp 0x18002b421
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x18002b345
call fcn.18002b58c
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.1800284b4
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.18002b8f0
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x18002b40f
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x18002b3da
mov rcx, rsi
call fcn.1800284b4
cmp eax, edi
je 0x18002b3c5
mov rcx, rsi
call fcn.1800284b4
cmp eax, 0xfffffffe
je 0x18002b3c5
mov rcx, rsi
call fcn.1800284b4
movsxd rbx, eax
lea r14, [0x18003e210]
mov rcx, rsi
sar rbx, 6
call fcn.1800284b4
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x18002b3cc
lea rdx, [0x18003c310]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x18002b3da
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x18002b3fe
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x18002b3fe
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x18002b3fe
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x18002b424
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x18002c12c
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x18003e210]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x18002c18a
cmp word [rdx], r12w
jne 0x18002c18a
or byte [rax + r8*8 + 0x38], cl
jmp 0x18002c190
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x18002c2eb
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x18002c2c6
lea r9, [rcx + 2]
cmp ax, r13w
je 0x18002c1c9
mov rcx, r9
jmp 0x18002c1ec
cmp r9, rdx
jae 0x18002c203
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x18002c1ad
jmp 0x18002c2eb
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18002c2c0
cmp dword [rsp + 0x80], edi
je 0x18002c2c0
mov rdx, r14
lea r11, [0x18003e210]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x18002c299
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x18002c26c
mov word [rbx], r12w
jmp 0x18002c2e7
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x18002c275
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x18002c2e7
cmp word [rsp + 0x70], r12w
jne 0x18002c2a6
cmp rbx, rsi
je 0x18002c266
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.18002b43c
cmp word [rsp + 0x70], r12w
je 0x18002c2eb
mov word [rbx], r13w
jmp 0x18002c2e7
lea r11, [0x18003e210]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x18002c2e3
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x18002c2eb
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001b45c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001b472
mov al, 1
jmp 0x14001b4d2
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001b483
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001b4d0
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400195b0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001b4d0
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001b4d0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001b4d0
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001b4d2
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14001f6f0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001f718
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001f718
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140001d40
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call fcn.140002290
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call fcn.140002290
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
int3

Function at 0x1400023b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x140009008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x14000241c
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000241c
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x14000241c
movzx edx, word [rax + 6]
test edx, edx
je 0x14000241c
sub rcx, qword [0x140009008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x140002408
add rax, 0x28
dec edx
je 0x14000241c
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x140002400
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x140002400
jmp 0x14000241e
xor eax, eax
ret

Function at 0x140002420
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x140009008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x140002455
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x140002455
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x140002455
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x1400024d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140009008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1400024fc
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400024fc
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x1400024fe
xor eax, eax
ret