joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140152610
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp byte [0x1401994c9], 0
mov rbp, rcx
mov r12, rdx
mov rdi, r8
je 0x140152698
lea rdx, [0x14017d25a]
mov rcx, rdi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140152700
mov rbx, qword [0x140199380]
jmp 0x140152655
lea rbx, [rdx + rax + 4]
mov rdx, rbx
mov rcx, rdi
call sub.msvcrt.dll_strcmp
mov rcx, rbx
mov esi, eax
call sub.msvcrt.dll_strlen
lea rdx, [rbx + rax + 1]
mov eax, dword [rdx]
test esi, esi
jne 0x140152650
movzx r9d, word [rdx + 4]
lea r8, [rdx + 6]
mov rcx, rbp
mov rdx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.1401417e0
mov r8d, 0xa
xor ecx, ecx
mov edx, 3
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
lea rdx, [rax + 4]
mov qword [0x140199380], rax
mov ebx, dword [rax]
mov qword [0x140199380], rdx
mov r8d, dword [rax + 4]
lea rdx, [rax + 8]
mov qword [0x140199380], rdx
call fcn.140151740
cmp eax, ebx
jne 0x140152768
mov byte [0x1401994c9], 1
jmp 0x14015262c
cmp byte [0x1401994c8], 0
jne 0x140152643
mov rbx, qword [sym.imp.python311.dll_PyDict_New]
call rbx
mov qword [0x140199e28], rax
call rbx
mov qword [0x140199e20], rax
call rbx
mov qword [0x140199e18], rax
call rbx
mov qword [0x140199e10], rax
call rbx
mov qword [0x140199e08], rax
call rbx
mov qword [0x140199e00], rax
call rbx
mov qword [0x140199df8], rax
call rbx
mov byte [0x1401994c8], 1
mov qword [0x140199df0], rax
jmp 0x140152643
lea rcx, str.Error__corrupted_constants_object
call sub.msvcrt.dll_puts
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x14015b1b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.14016c940
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.14016c940
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
Function at 0x14015be82
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x14019a2e8]
test eax, eax
je 0x14015bf1a
lea rax, [0x14019a2c0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x14019a2f0]
mov qword [rbp - 8], rax
jmp 0x14015befe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x14015bef2
cmp qword [rbp - 0x10], 0
je 0x14015bef2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x14015beb8
lea rax, [0x14019a2c0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14015bf1b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x14015c020
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x14015c048
mov eax, 0
jmp 0x14015c096
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14015c071
mov eax, 0
jmp 0x14015c096
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x14015c091
mov eax, 0
jmp 0x14015c096
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x14015c09c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14015c11a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x14015c111
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x14015c111
mov rax, qword [rbp - 8]
jmp 0x14015c12f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x14015c0e4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x41f060
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41f1f0
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x00d035b8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0043ff20
xorps xmm15, xmm15
mov r14, qword [0x00de6798]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x41f0c5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x41f0e0
add rsp, 0x48
pop rbp
ret
call fcn.0045c980
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
nop dword [rax]
test rbx, rbx
jbe 0x41f0ff
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x41f10f
cmp rbx, 0x1000
jae 0x41f0cb
jmp 0x41f17a
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x41f122
xor edx, edx
nop
jmp 0x41f171
mov rcx, qword [0x00d035b8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0043ff20
xorps xmm15, xmm15
mov r14, qword [0x00de6798]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x41f105
jmp 0x41f0f4
call fcn.004763a0
xorps xmm15, xmm15
mov r14, qword [0x00de6798]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00444020
lea rax, [0x00994086]
mov ebx, 0x18
call fcn.00444860
mov rax, qword [rsp + 0x38]
call fcn.004445c0
lea rax, [0x00994bf5]
mov ebx, 0x19
call fcn.00444860
mov rax, qword [rsp + 0x30]
call fcn.004445c0
call fcn.00444240
call fcn.00444080
lea rax, [0x0099b734]
mov ebx, 0x21
call fcn.00442680
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00472dc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0041f060
Function at 0x41f220
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41f44a
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x00d035c0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0043ffc0
xorps xmm15, xmm15
mov r14, qword [0x00de6798]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x41f293
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x41f2ba
add rsp, 0x50
pop rbp
ret
mov rax, rcx
nop dword [rax]
call fcn.0045c980
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
mov rcx, rax
mov rax, qword [rsp + 0x68]
test rbx, rbx
jbe 0x41f2dc
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x41f2ec
cmp rbx, 0x1000
jae 0x41f299
jmp 0x41f36e
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x41f2fe
xor esi, esi
jmp 0x41f360
mov rax, qword [0x00d035c0]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0043ffc0
xorps xmm15, xmm15
mov r14, qword [0x00de6798]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x41f2e2
jmp 0x41f2ce
call fcn.004763a0
xorps xmm15, xmm15
mov r14, qword [0x00de6798]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x41f3e9
call fcn.00444020
lea rax, [0x00994c0e]
mov ebx, 0x19
call fcn.00444860
mov rax, qword [rsp + 0x68]
call fcn.004445c0
lea rax, [0x00994bf5]
mov ebx, 0x19
nop dword [rax]
call fcn.00444860
mov eax, dword [rsp + 0x34]
call fcn.004445c0
call fcn.00444240
call fcn.00444080
lea rax, [0x0098ac2e]
mov ebx, 0xd
call fcn.00442680
cmp eax, 0x5af
je 0x41f391
call fcn.00444020
lea rax, [0x00994c0e]
mov ebx, 0x19
call fcn.00444860
mov rax, qword [rsp + 0x38]
call fcn.004445c0
lea rax, [0x00994bf5]
mov ebx, 0x19
nop dword [rax]
call fcn.00444860
mov eax, dword [rsp + 0x34]
call fcn.004445c0
call fcn.00444240
call fcn.00444080
lea rax, [0x00999ea0]
mov ebx, 0x1f
call fcn.00442680
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00472dc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0041f220
Function at 0x42c3a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42c4a6
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x42c3e3
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x42c49b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.0042d0c0
test rax, rax
je 0x42c49b
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x0042c4e0]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call fcn.00472ca0
xorps xmm15, xmm15
mov r14, qword [0x00de6798]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x42c489
xor eax, eax
jmp 0x42c493
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x42c3d1
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.00472dc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.0042c3a0
Function at 0x465ba0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x465c62
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
lea rax, [rsp + 0x68]
call fcn.0045c060
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
lea rdx, [rcx + 0x10]
mov rbx, qword [rax]
mov rsi, qword [rax + 8]
mov rax, rdx
mov rcx, rsi
call fcn.00463200
test bl, bl
je 0x465c5c
mov qword [rsp + 0x18], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x00465ca0]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.00472ca0
xorps xmm15, xmm15
mov r14, qword [0x00de6798]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00472dc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00465ba0

Function at 0x468b60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x468c0f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00468c60]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00472ca0
xorps xmm15, xmm15
mov r14, qword [0x00de6798]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00472dc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00468b60
Function at 0x1423fb09a
Capabilities:
Authenticate hmac

Disassembly:
inc cx
mov cl, byte [r10 + 2]
call fcn.1423d1325
mov r8d, 0xe11c2982
shr r8, 0x72
xor r8, qword [r10 + r8]
push 0xffffffff9c096502
add r10, 8
movzx edi, byte [rbp + riz]
add rbp, 1
xor dil, sil
or qword [rsp], 0xffffffffd8b3a4ba
sbb dil, 0x84
rol dil, 1
dec dil
ror dil, 1
xor sil, dil
call fcn.1423e29c5
mov dword [rbp + riz], edx
jmp 0x1423d71f6
adc r10b, byte [rsp + r10*4 - 0x3d505]
movzx r10d, byte [r8 + r10*4 - 0x3d6c0]
jo 0x1423e61da
mov ecx, 0xd518561f
xor rcx, 0x68a94198
movzx r8d, cx
movzx r8w, byte [r10 + r8 - 0x1787]
jns 0x1423dbf30
xor r10b, r9b
dec qword [rsp]
neg r10b
jmp 0x1424057db
call fcn.1423f8416
push 0xabc1690
mov r10d, dword [rsp + 2]
mov word [rsp + r10 - 0xab6], 0x9393
mov dx, word [rdi + r10 - 0xabc]
lea rdi, [rdi + r10*2 - 0x1576]
or r10b, r10b
neg qword [rsp + r10 - 0xabc]
lea r8, [r10 + r8 - 0xabd]
not r10w
jb 0x1423e315f
mov rsi, qword [rsp + 0x10]
sub rbp, 4
jmp 0x1423e09fe
cmp ebx, 3
lea rsp, [rsp + 8]
jne 0x1423e68fa
mov r8d, 0x6e152c16
lea r8, [r8 + r8*4 - 0xec562d2]
mov r8, rax
jmp 0x1424125e4
jmp 0x1423f1148
Function at 0x140007cd0
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rcx, qword [0x14002d0a0]
test rcx, rcx
je 0x140007d0b
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140007d30
mov rcx, qword [0x14002d0a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x1400300e0], 0
jne 0x140007d48
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, qword [0x14002d0a0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x140007cfe
mov edx, 0x414
lea r12, [rsp + 0x20]
lea rsi, [0x14001d3aa]
mov qword [rsp + 0x20], 0
lea rdi, [0x140030100]
movq xmm0, rsi
mov rcx, r12
mov dword [rsp + 0x28], 3
movq xmm6, rdi
mov word [rsp + 0x40], dx
mov rbp, qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, 0x14
punpcklqdq xmm6, xmm0
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], rsi
movaps xmmword [rsp + 0x30], xmm6
call rbp
mov r13, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140007e14
test al, 0x10
je 0x140007d14
mov ecx, 0x64
call r14
mov eax, 0x414
mov qword [rsp + 0x50], rsi
mov rcx, r12
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 3
mov word [rsp + 0x40], ax
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
movaps xmmword [rsp + 0x30], xmm6
call rbp
sub ebx, 1
je 0x140007d14
mov rcx, rdi
call r13
cmp eax, 0xffffffff
jne 0x140007dc0
jmp 0x140007d14

Function at 0x14000e490
Capabilities:
Create directory

Disassembly:
push rdi
mov eax, 0x2020
push rsi
push rbx
call fcn.140015650
sub rsp, rax
mov eax, dword [0x140034100]
mov rsi, rcx
test eax, eax
je 0x14000e530
xor ebx, ebx
lea rdi, [0x140032100]
test eax, eax
jg 0x14000e4cc
jmp 0x14000e4e0
add rbx, 1
cmp dword [0x140034100], ebx
jle 0x14000e4e0
mov rdx, qword [rdi + rbx*8]
mov rcx, rsi
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x14000e4c0
jmp 0x14000e517
mov rcx, rsi
call sub.msvcrt.dll_wcslen
cmp rax, 2
jne 0x14000e4f5
cmp word [rsi + 2], 0x3a
je 0x14000e517
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14000e580
movsxd rbx, dword [0x140034100]
cmp ebx, 0x3ff
jle 0x14000e598
mov eax, 1
add rsp, 0x2020
pop rbx
pop rsi
pop rdi
ret
lea rdi, [rsp + 0x20]
lea rbx, str.HOME
mov r8d, 0x1000
mov rdx, rbx
mov rcx, rdi
call fcn.140007540
test al, al
je 0x14000e5ba
movsxd rbx, dword [0x140034100]
mov rcx, rdi
lea rdi, [0x140032100]
call sub.msvcrt.dll__wcsdup
mov qword [rdi + rbx*8], rax
mov eax, dword [0x140034100]
add eax, 1
mov dword [0x140034100], eax
jmp 0x14000e4b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000e504
xor eax, eax
jmp 0x14000e51c
mov rcx, rsi
call sub.msvcrt.dll__wcsdup
add dword [0x140034100], 1
mov rdx, rax
lea rax, [0x140032100]
mov qword [rax + rbx*8], rdx
jmp 0x14000e517
mov rcx, rbx
call fcn.140007c10
nop
nop word cs:[rax + rax]
nop
Function at 0x140011217
Capabilities:
Terminate process

Disassembly:
jmp 0x140013810
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400112a8
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014b60
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014b80
xor al, al
jmp 0x140014c01
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014b93
xor al, al
jmp 0x140014c01
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014bbd
xor al, al
jmp 0x140014c01
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014bd1
xor al, al
jmp 0x140014c01
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014be3
xor al, al
jmp 0x140014c01
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014bff
xor al, al
jmp 0x140014c01
mov al, 1
add rsp, 0x38
ret
Function at 0x1400112d5
Capabilities:
Terminate process

Disassembly:
jmp 0x1400156e0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001139d
Capabilities:
Parse pe header

Disassembly:
jmp 0x140016a30
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140016a50
xor al, al
jmp 0x140016ad1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140016a63
xor al, al
jmp 0x140016ad1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140016a8d
xor al, al
jmp 0x140016ad1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140016aa1
xor al, al
jmp 0x140016ad1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140016ab3
xor al, al
jmp 0x140016ad1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140016acf
xor al, al
jmp 0x140016ad1
mov al, 1
add rsp, 0x38
ret
Function at 0x140001001
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400043e0]
mov dword [rax], 1
mov rax, qword [0x1400043f0]
mov dword [rax], 1
mov rax, qword [0x140004400]
mov dword [rax], 1
mov rax, qword [0x140004390]
cmp word [rax], 0x5a4d
jne 0x14000108e
mov rdx, rax
movsxd rax, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x140001094
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001061
cmp dx, 0x20b
je 0x140001076
mov eax, 0
jmp 0x140001093
cmp dword [rax + 0x74], 0xe
jbe 0x14000109b
cmp dword [rax + 0xe8], 0
setne al
movzx eax, al
jmp 0x140001093
cmp dword [rax + 0x84], 0xe
jbe 0x1400010a2
cmp dword [rax + 0xf8], 0
setne al
movzx eax, al
jmp 0x140001093
mov eax, 0
ret
mov eax, 0
jmp 0x140001093
mov eax, 0
jmp 0x140001093
mov eax, 0
jmp 0x140001093

Function at 0x140001440
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xe0
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
call dbg.__main
lea rax, [rbp - 0x70]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp - 0x70], 0x68
lea rax, [rbp - 0x90]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
mov rax, qword [rbp + 0x18]
mov rax, qword [rax]
lea rdx, [rbp - 0x90]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
jmp 0x14000148f

Function at 0x140001720
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov ecx, 2
call dbg.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rcx, rax
mov r8, rsi
mov rdx, rbx
call sym.vfprintf
call sym.abort
nop

Function at 0x140001e30
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov eax, dword [0x1400070e8]
test eax, eax
jne 0x140001e47
add rsp, 0x28
pop rbx
pop rsi
ret
lea rcx, [0x140007100]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400070e0]
jmp 0x140001e61
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x140001e8b
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140001e5d
test rsi, rsi
je 0x140001e5d
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
jmp 0x140001e5d
lea rcx, [0x140007100]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x140001e40

Function at 0x140002030
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
jne 0x140002055
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000205b
cmp word [rcx + 0x18], 0x20b
jne 0x140002062
mov eax, 1
jmp 0x14000205a
mov eax, 0
ret
mov eax, 0
jmp 0x14000205a
mov eax, 0
jmp 0x14000205a
Function at 0x140002069
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
mov r9d, 0
jmp 0x140002089
add r9d, 1
add rax, 0x28
movzx r8d, word [rcx + 6]
cmp r9d, r8d
jae 0x1400020aa
mov r8d, dword [rax + 0xc]
mov r10d, r8d
cmp rdx, r10
jb 0x140002081
add r8d, dword [rax + 8]
cmp rdx, r8
jae 0x140002081
jmp 0x1400020af
mov eax, 0
ret