joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4047ef
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov eax, r8d
mov word [rbp + 0x20], ax
mov rcx, qword [rbp + 0x10]
call fcn.00404518
test eax, eax
jne 0x40481c
mov eax, 0
jmp 0x4049c7
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
add rax, 0x88
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov eax, dword [rax + 4]
test eax, eax
je 0x40485c
mov rax, qword [rbp - 0x28]
mov eax, dword [rax]
test eax, eax
jne 0x404866
mov eax, 0
jmp 0x4049c7
mov rax, qword [rbp - 0x28]
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x28]
mov eax, dword [rax + 4]
mov dword [rbp - 0x34], eax
mov rax, qword [rbp - 0x30]
mov eax, dword [rax + 0x1c]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x30]
mov eax, dword [rax + 0x20]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 0x30]
mov eax, dword [rax + 0x24]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x50], rax
mov qword [rbp - 8], 0
cmp dword [rbp + 0x18], 0
je 0x404952
mov dword [rbp - 0xc], 0
jmp 0x404944
mov eax, dword [rbp - 0xc]
lea rdx, [rax*4]
mov rax, qword [rbp - 0x48]
add rax, rdx
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x58], rax
mov rax, qword [rbp - 0x58]
mov rcx, rax
call fcn.00402c0c
cmp dword [rbp + 0x18], eax
jne 0x404940
mov eax, dword [rbp - 0xc]
lea rdx, [rax + rax]
mov rax, qword [rbp - 0x50]
add rax, rdx
movzx eax, word [rax]
movzx eax, ax
lea rdx, [rax*4]
mov rax, qword [rbp - 0x40]
add rax, rdx
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 8], rax
jmp 0x404981
add dword [rbp - 0xc], 1
mov rax, qword [rbp - 0x30]
mov eax, dword [rax + 0x18]
cmp dword [rbp - 0xc], eax
jb 0x4048da
jmp 0x404981
movzx edx, word [rbp + 0x20]
mov rax, qword [rbp - 0x30]
mov eax, dword [rax + 0x10]
sub edx, eax
mov eax, edx
mov eax, eax
lea rdx, [rax*4]
mov rax, qword [rbp - 0x40]
add rax, rdx
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x40498f
mov eax, 0
jmp 0x4049c7
mov rdx, qword [rbp - 8]
mov rax, qword [rbp - 0x30]
cmp rdx, rax
jb 0x4049c3
mov edx, dword [rbp - 0x34]
mov rax, qword [rbp - 0x30]
add rdx, rax
mov rax, qword [rbp - 8]
cmp rdx, rax
jbe 0x4049c3
mov rax, qword [rbp - 8]
mov rdx, rax
mov rcx, qword [rbp + 0x10]
call fcn.0040464d
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
sub rsp, 0xffffffffffffff80
pop rbp
ret
Function at 0x4058ac
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov qword [rbp + 0x20], r8
mov dword [rbp - 4], 0
mov dword [rbp - 8], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0
mov edx, 1
lea rcx, [0x00414220]
call fcn.004049cd
mov r8d, 0
mov edx, 0x1aa40c23
mov rcx, rax
call fcn.004047ef
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
je 0x4059df
mov dword [rbp - 0xc], 0
jmp 0x405944
lea rax, [rbp - 0x20]
mov rdx, rax
lea rcx, str.NanoDumpSSPPipe
call fcn.00404dfe
mov dword [rbp - 8], eax
cmp dword [rbp - 8], 0
jne 0x40594c
mov rax, qword [rbp - 0x18]
mov ecx, 0x1f4
call rax
add dword [rbp - 0xc], 1
cmp dword [rbp - 0xc], 4
jle 0x405919
jmp 0x40594d
nop
cmp dword [rbp - 8], 0
jne 0x405998
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov r9, rax
mov r8d, 0x4e
mov edx, 1
lea rcx, str.Could_not_connect_to_the_named_pipe__the_DLL_does_not_seem_to_have_been_loaded
call sub.msvcrt.dll_fwrite
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov rdx, rax
mov ecx, 0xa
call sub.msvcrt.dll_fputc
jmp 0x4059e6
mov rax, qword [rbp - 0x20]
mov edx, dword [rbp + 0x18]
mov r9d, 0
mov r8d, edx
mov rdx, qword [rbp + 0x10]
mov rcx, rax
call fcn.00405317
mov dword [rbp - 8], eax
cmp dword [rbp - 8], 0
je 0x4059e2
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call fcn.0040555b
mov dword [rbp - 8], eax
cmp dword [rbp - 8], 0
je 0x4059e5
mov dword [rbp - 4], 1
jmp 0x4059e6
nop
jmp 0x4059e6
nop
jmp 0x4059e6
nop
mov rax, qword [rbp - 0x20]
test rax, rax
je 0x4059fb
mov rax, qword [rbp - 0x20]
mov rcx, rax
call fcn.00403287
mov eax, dword [rbp - 4]
add rsp, 0x40
pop rbp
ret

Function at 0x405b3d
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov dword [rbp - 4], 0
mov dword [rbp - 8], 0
cmp qword [rbp + 0x28], 0
jne 0x405bf6
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov r9, rax
mov r8d, 0x23
mov edx, 1
lea rcx, str.____Writing_an_unsigned_DLL_to_disk
call sub.msvcrt.dll_fwrite
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov rdx, rax
mov ecx, 0xa
call sub.msvcrt.dll_fputc
cmp qword [rbp + 0x20], 0
jne 0x405bd7
mov rax, qword [rbp + 0x30]
mov rcx, rax
call fcn.0040561f
mov dword [rbp - 8], eax
cmp dword [rbp - 8], 0
je 0x405bff
mov rax, qword [rbp + 0x30]
mov rax, qword [rax]
mov qword [rbp + 0x20], rax
mov edx, dword [rbp + 0x18]
mov rax, qword [rbp + 0x20]
mov r8d, edx
mov rdx, qword [rbp + 0x10]
mov rcx, rax
call fcn.004057a1
mov dword [rbp - 8], eax
cmp dword [rbp - 8], 0
je 0x405c02
mov dword [rbp - 4], 1
jmp 0x405c03
nop
jmp 0x405c03
nop
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret
Function at 0x405c0c
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x80]
mov qword [rbp], rcx
mov dword [rbp + 8], edx
mov qword [rbp + 0x10], r8
mov qword [rbp + 0x18], r9
mov dword [rbp - 0x34], 0
mov qword [rbp - 0x48], 0
mov qword [rbp - 0x28], 0
mov dword [rbp - 0x4c], 0
mov qword [rbp - 0x30], 0
mov dword [rbp - 0x50], 0
mov qword [rbp - 0x40], 0
mov r8, qword [rbp + 0x18]
mov rcx, qword [rbp + 0x10]
mov eax, dword [rbp + 8]
lea rdx, [rbp - 0x48]
mov qword [rsp + 0x20], rdx
mov r9, r8
mov r8, rcx
mov edx, eax
mov rcx, qword [rbp]
call fcn.00405b3d
mov dword [rbp - 0x34], eax
cmp dword [rbp - 0x34], 0
je 0x405da2
cmp qword [rbp + 0x10], 0
je 0x405ca1
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x28], rax
jmp 0x405cba
cmp qword [rbp + 0x18], 0
je 0x405cb2
mov rax, qword [rbp + 0x18]
mov qword [rbp - 0x28], rax
jmp 0x405cba
mov rax, qword [rbp - 0x48]
mov qword [rbp - 0x28], rax
mov edx, 1
lea rcx, str.Kernel32.dll
call fcn.004049cd
mov r8d, 0
mov edx, 0x2c912627
mov rcx, rax
call fcn.004047ef
mov qword [rbp - 0x40], rax
cmp qword [rbp - 0x40], 0
je 0x405da5
mov rdx, qword [rbp - 0x28]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov rax, qword [rbp - 0x40]
mov r9, rdx
lea r8, [0x00405a10]
mov edx, 0
mov ecx, 0
call rax
mov qword [rbp - 0x30], rax
lea rcx, [rbp - 0x4c]
mov edx, dword [rbp + 0x28]
mov rax, qword [rbp + 0x20]
mov r8, rcx
mov rcx, rax
call fcn.004058ac
mov dword [rbp - 0x34], eax
cmp dword [rbp - 0x34], 0
je 0x405da8
mov eax, dword [rbp - 0x4c]
test eax, eax
je 0x405d5d
mov edx, dword [rbp + 0x28]
mov rax, qword [rbp + 0x20]
mov r8d, 1
mov rcx, rax
call fcn.00402756
jmp 0x405da9
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov r9, rax
mov r8d, 0x18
mov edx, 1
lea rcx, str.The_dump_was_not_created
call sub.msvcrt.dll_fwrite
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov rdx, rax
mov ecx, 0xa
call sub.msvcrt.dll_fputc
jmp 0x405da9
nop
jmp 0x405da9
nop
jmp 0x405da9
nop
cmp qword [rbp - 0x30], 0
je 0x405dbc
mov rax, qword [rbp - 0x30]
mov rcx, rax
call fcn.00403287
cmp qword [rbp + 0x10], 0
je 0x405dcf
mov rax, qword [rbp + 0x10]
mov rcx, rax
call fcn.00401ee6
mov rax, qword [rbp - 0x48]
test rax, rax
je 0x405e05
mov rax, qword [rbp - 0x48]
mov rcx, rax
call fcn.00401ee6
mov rbx, qword [rbp - 0x48]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8, rbx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapFree]
call rax
nop
add rsp, 0x68
pop rbx
pop rbp
ret
Function at 0x406c80
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00407e90
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.00407e90
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x406cf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x00418614]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x406e98
mov rax, qword [0x00418618]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x406d3c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x406dc7
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x406d20
mov rcx, r12
call fcn.00407a50
mov rbp, rax
test rax, rax
je 0x406ed2
mov rax, qword [0x00418618]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.00407b80
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00418618]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x406ee1
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x406dc0
sub eax, 4
and eax, 0xfffffffb
jne 0x406e50
add dword [0x00418614], 1
cmp ebx, 8
jae 0x406df8
test bl, 4
jne 0x406ea0
test ebx, ebx
je 0x406de9
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x406ec0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x406de9
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x406e2a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x00418618]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x406dc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00406c80
nop dword [rax]
xor edi, edi
jmp 0x406d47
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x406de9
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x406de9
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.00406c80
mov rax, qword [0x00418618]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.00406c80
nop
nop dword [rax]
Function at 0x4076c0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00418900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004188e0]
test rbx, rbx
je 0x407714
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x40770b
test r12, r12
je 0x40770b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4076f0
lea rcx, [0x00418900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x407a50
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x00414a50]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x407ac9
mov rcx, r10
call fcn.00407920
test eax, eax
je 0x407ac9
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x407ac6
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x407abd
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x407ac9
add r8, 0x28
cmp r8, r9
jne 0x407aa8
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x140011393
Capabilities:
Terminate process

Disassembly:
jmp 0x140018e60
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140011483
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001a1b0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001a1d0
xor al, al
jmp 0x14001a251
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001a1e3
xor al, al
jmp 0x14001a251
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001a20d
xor al, al
jmp 0x14001a251
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001a221
xor al, al
jmp 0x14001a251
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001a233
xor al, al
jmp 0x14001a251
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001a24f
xor al, al
jmp 0x14001a251
mov al, 1
add rsp, 0x38
ret
Function at 0x14001120d
Capabilities:
Execute command

Disassembly:
jmp 0x140011a40
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1400230a4]
call fcn.14001139d
mov dword [rbp + 4], 3
jmp 0x140011a6c
mov eax, dword [rbp + 4]
dec eax
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jle 0x140011a9b
lea rcx, [0x14001ae2c]
call qword [sym.imp.ucrtbased.dll_system]
mov edx, dword [rbp + 4]
lea rcx, [0x14001ae30]
call fcn.1400111ae
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140011a64
lea rcx, [0x14001ae2c]
call qword [sym.imp.ucrtbased.dll_system]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x140011217
Capabilities:
Terminate process

Disassembly:
jmp 0x140013370
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112a3
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400146b0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400146d0
xor al, al
jmp 0x140014751
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400146e3
xor al, al
jmp 0x140014751
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001470d
xor al, al
jmp 0x140014751
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014721
xor al, al
jmp 0x140014751
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014733
xor al, al
jmp 0x140014751
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001474f
xor al, al
jmp 0x140014751
mov al, 1
add rsp, 0x38
ret
Function at 0x1400113c5
Capabilities:
Execute command

Disassembly:
jmp 0x140011b30
push rbp
push rdi
sub rsp, 0x228
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x52
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x1f8], rax
lea rcx, [0x1400230a4]
call fcn.14001139d
lea rax, [rbp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0xa0
rep stosb byte [rdi], al
mov dword [rbp + 0x124], 0
xor ecx, ecx
call fcn.140011f30
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_srand]
xor eax, eax
cmp eax, 1
je 0x140011cd8
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0x28
idiv ecx
mov eax, edx
mov dword [rbp + 0xe4], eax
movsxd rax, dword [rbp + 0xe4]
mov dword [rbp + rax*4 + 0x30], 8
mov dword [rbp + 4], 0
jmp 0x140011bd7
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0x28
jge 0x140011bee
mov edx, dword [rbp + 4]
lea rcx, str._2d
call fcn.1400111ae
jmp 0x140011bcf
lea rcx, [0x14001ae3c]
call fcn.1400111ae
mov dword [rbp + 4], 0
jmp 0x140011c0b
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0x28
jge 0x140011c27
movsxd rax, dword [rbp + 4]
mov edx, dword [rbp + rax*4 + 0x30]
lea rcx, str._2d
call fcn.1400111ae
jmp 0x140011c03
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14001ae2c]
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, [0x14001ae40]
call fcn.1400111ae
lea rdx, [rbp + 0x104]
lea rcx, [0x14001ae30]
call fcn.1400110a0
mov eax, dword [rbp + 0xe4]
cmp dword [rbp + 0x104], eax
jne 0x140011ca4
lea rcx, [0x14001ae58]
call fcn.1400111ae
mov eax, dword [rbp + 0x124]
inc eax
mov dword [rbp + 0x124], eax
lea rcx, [0x14001ae68]
call fcn.1400111ae
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14001120d
jmp 0x140011cc4
lea rcx, [0x14001ae88]
call fcn.1400111ae
mov edx, dword [rbp + 0xe4]
lea rcx, [0x14001aea0]
call fcn.1400111ae
jmp 0x140011cd8
movsxd rax, dword [rbp + 0xe4]
mov dword [rbp + rax*4 + 0x30], 0
jmp 0x140011b96
mov eax, dword [rbp + 0x124]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ad50]
call fcn.140011339
mov eax, edi
mov rcx, qword [rbp + 0x1f8]
xor rcx, rbp
call fcn.1400111c7
lea rsp, [rbp + 0x208]
pop rdi
pop rbp
ret
Function at 0x180002d50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov eax, dword [rsp + 0x90]
sub eax, 0x2540
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x80]
sub eax, 0x19a5
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x80]
xor eax, 0x3f76
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x98]
sub eax, 0x19a5
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x98]
add eax, 0x1436
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x70]
xor eax, 0x1af
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x90]
sub eax, 0x2540
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x88]
add eax, 0x44d
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x88]
xor eax, 0x3718
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x80]
sub eax, 0x19a5
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x2c]
xor eax, 0x701
cmp dword [rsp + 0x28], eax
je 0x180002e49
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x9c]
sub eax, 0x962ff
mov rcx, qword [rsp + 0x78]
mov ecx, dword [rcx + 0x28]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x78]
mov dword [rcx + 0x28], eax
mov eax, dword [rsp + 0x24]
add eax, 0x19a5
mov dword [rsp + 0x24], eax
jmp 0x180002ee8
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x90]
mov dword [rsp + 0x20], eax
jmp 0x180002e65
mov eax, dword [rsp + 0x20]
add eax, 2
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
sub ecx, eax
mov eax, ecx
cmp dword [rsp + 0x20], eax
jge 0x180002ee8
mov eax, dword [rsp + 0x38]
sub eax, 0x297d
sub eax, dword [rsp + 0x28]
mov dword [rsp + 0x44], eax
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x78]
mov eax, dword [rdx + rax + 0x3c]
mov ecx, dword [rcx + 0x38]
sub ecx, eax
mov eax, ecx
mov ecx, 4
imul rcx, rcx, 3
mov rdx, qword [rsp + 0x78]
and eax, dword [rdx + rcx + 0xa4]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x48]
sub eax, 0x2d13
mov dword [rsp + 0x3c], eax
mov r8d, dword [rsp + 0x3c]
mov edx, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x44]
call qword [sym.imp.KERNEL32.dll_OpenThread]
jmp 0x180002e5a
mov eax, dword [rsp + 0x2c]
sub eax, 0xb5d
add rsp, 0x68
ret
Function at 0x180004670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0xa0]
add eax, 0xe9
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x70]
add eax, 0xe67
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x70]
sub eax, 0x1b16
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x80]
xor eax, 0xb08
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0xa0]
xor eax, 0xdc5
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x98]
add eax, 0x1020
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x88]
sub eax, 0x2d13
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x98]
xor eax, 0x16b3
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x24]
add eax, 0x1b76
cmp dword [rsp + 0x2c], eax
jle 0x180004801
mov eax, dword [rsp + 0x24]
add eax, 0x28d2
cmp dword [rsp + 0x2c], eax
jge 0x180004750
mov rax, qword [rsp + 0x78]
lea rcx, [0x1800b01d0]
mov qword [rax + 0x70], rcx
mov eax, dword [rsp + 0x20]
add eax, 0x463
mov dword [rsp + 0x20], eax
jmp 0x180004801
mov eax, dword [rsp + 0x30]
or eax, 0x1f55
mov rcx, qword [rsp + 0x78]
sub eax, dword [rcx + 0x2c]
cmp dword [rsp + 0x20], eax
jb 0x180004801
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x28], eax
jmp 0x18000477f
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0x78]
mov eax, dword [rcx + rax + 0xa4]
add eax, dword [rsp + 0x34]
and eax, dword [rsp + 0x24]
cmp dword [rsp + 0x28], eax
jbe 0x180004801
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x78]
mov eax, dword [rdx + rax + 0xa4]
mov ecx, dword [rcx + 0x98]
xor ecx, eax
mov eax, ecx
mov eax, eax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x98]
mov ecx, dword [rsp + 0x38]
or ecx, eax
mov eax, ecx
sub eax, 0x15b2
mov eax, eax
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
jmp 0x180004775
mov eax, dword [rsp + 0x3c]
sub eax, 0x149
add rsp, 0x68
ret