joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4dd13c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4dd1ba
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4dd1b1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4dd1b1
mov rax, qword [rbp - 8]
jmp 0x2fc4dd1cf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4dd184
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4cfe40
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d0f20
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d0842
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f3108]
test eax, eax
je 0x2fc4d08da
lea rax, [0x2fc4f30e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f3110]
mov qword [rbp - 8], rax
jmp 0x2fc4d08be
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d08b2
cmp qword [rbp - 0x10], 0
je 0x2fc4d08b2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d0878
lea rax, [0x2fc4f30e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d08db
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d09e0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d0a08
mov eax, 0
jmp 0x2fc4d0a56
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d0a31
mov eax, 0
jmp 0x2fc4d0a56
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d0a51
mov eax, 0
jmp 0x2fc4d0a56
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d0a5c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d0ada
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d0ad1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d0ad1
mov rax, qword [rbp - 8]
jmp 0x2fc4d0aef
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d0aa4
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001108
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov edx, dword [rsp + 0x6c]
add edx, dword [rsp + 0x6c]
insb byte [rdi], dx
mov r8d, dword [rcx + 0xc]
mov dword [rsp + 0x6c], edx
mov edx, dword [rcx + 0x14]
mov r9d, edx
mov r10, qword [rsp + 0x48]
add r10, r9
mov edx, r8d
mov r9d, edx
mov r11, qword [rsp + 0x50]
add r11, r9
mov edx, dword [rcx + 0x10]
mov r8d, edx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x30], ecx
mov rcx, r11
mov rdx, r10
mov qword [rsp + 0x28], rax
call fcn.140002a20
mov si, word [rsp + 0x5c]
xor si, word [rsp + 0x5c]
mov word [rsp + 0x5c], si
je 0x14000117a
pop rsp
je 0x14000117a
pop rsp
mov rax, qword [rsp + 0x28]
add rax, 1
mov rcx, qword [rsp + 0x30]
add rcx, 0x28
cmp rax, 5
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
jne 0x1400010f7
invalid
mov rcx, qword [rsp + 0x48]
call fcn.140001c00
mov edx, dword [rax + 0x54]
mov r8d, edx
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
call fcn.140002a20
nop
add rsp, 0x70
pop rsi
ret

Function at 0x140001514
Capabilities:
Encode data using xor

Disassembly:
mov rdx, rsi
mov dword [rsp + 0x44], eax
call r8
mov dword [rsp + 0x40], eax
call fcn.1400013a0
cmp eax, 0
je 0x14000156e
jmp 0x140001609
call fcn.140001050
cmp eax, 0
jne 0x140001609

Function at 0x140002564
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [rsp + 0x38]
xor ecx, 0x494e30e1
mov dword [rsp + 0xb0], ecx
and al, 0xb0
add byte [rax], al
add byte [rbx + rcx*4 - 0x74], cl
and al, 0xa0
add byte [rax], al
add byte [rdx + rcx*4 + 0x54], al
add al, 0x40
movsx ecx, r10b
mov r8w, cx
xor r9, 0x7f92b364
mov word [rsp + rax*2 + 0x60], r8w
add rax, 1
mov dword [rsp + 0xb0], 0xd7f5e461
cmp rax, r9
mov qword [rsp + 0x28], rax
jne 0x140002544
lea rcx, [rsp + 0x60]
call sym.UxTheme.dll_Ordinal_1
mov edx, dword [rsp + 0x38]
add edx, edx
mov dword [rsp + 0xb0], edx
add rsp, 0xb8
ret

Function at 0x14000380c
Capabilities:
Encode data using xor

Disassembly:
and al, 0xc0
add byte [rax], al
add byte [rax - 0x39], cl
test byte [rax + rdi*4], ah
and al, 0xb8
Function at 0x2fc4ceaf0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4cfbd0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4cf4f2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f2108]
test eax, eax
je 0x2fc4cf58a
lea rax, [0x2fc4f20e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f2110]
mov qword [rbp - 8], rax
jmp 0x2fc4cf56e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4cf562
cmp qword [rbp - 0x10], 0
je 0x2fc4cf562
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4cf528
lea rax, [0x2fc4f20e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4cf58b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4cf690
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4cf6b8
mov eax, 0
jmp 0x2fc4cf706
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4cf6e1
mov eax, 0
jmp 0x2fc4cf706
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4cf701
mov eax, 0
jmp 0x2fc4cf706
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4cf70c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4cf78a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4cf781
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4cf781
mov rax, qword [rbp - 8]
jmp 0x2fc4cf79f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4cf754
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140001b30
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x250
lea rsi, fcn.1400e52a0
movq xmm0, rsi
mov r9, qword [r8 + 8]
mov r8, qword [r8]
lea rbx, [rsp + 0x50]
mov qword [rsp + 0x28], r9
mov rax, rcx
lea rcx, [rsp + 0x30]
movq xmm1, rbx
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x20]
punpcklqdq xmm0, xmm1
movaps xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [0x14021b930]
movaps xmmword [rsp + 0x40], xmm0
call rax
mov rdi, qword [fcn.1400d4dc0]
mov ecx, 2
call rdi
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov r8d, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call rdi
mov ecx, 0xa
mov rdx, rax
call sub.msvcrt.dll_fputc
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x30], rsi
cmp rcx, rbx
je 0x140001bd5
call fcn.14020b0f0
nop
add rsp, 0x250
pop rbx
pop rsi
pop rdi
ret
Function at 0x140003fe0
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x698
lea rdi, fcn.1400e52a0
xor r9d, r9d
movq xmm0, rdi
mov r10, qword [rdx]
mov r11, qword [rdx + 8]
mov rdx, qword [r8 + 8]
mov rax, qword [r8]
lea rbp, [rsp + 0x80]
lea r13, [rsp + 0x40]
mov qword [rsp + 0x38], rdx
mov rbx, rcx
movq xmm1, rbp
lea rcx, [rsp + 0x60]
lea r8, [rsp + 0x30]
mov rdx, r13
punpcklqdq xmm0, xmm1
mov qword [rsp + 0x40], r10
movaps xmmword [rsp + 0x60], xmm0
movdqa xmm0, xmmword [0x14021b930]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x30], rax
movaps xmmword [rsp + 0x70], xmm0
call fcn.1400e48b0
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__fileno]
mov esi, eax
mov ecx, eax
call qword [sym.imp.msvcrt.dll__isatty]
mov rcx, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
test eax, eax
jne 0x1400040c0
mov r9, rbx
mov r8, r12
mov edx, 1
call sub.msvcrt.dll_fwrite
cmp rax, r12
jb 0x14020c008
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x60], rdi
cmp rcx, rbp
je 0x1400040ac
call fcn.14020b0f0
nop
add rsp, 0x698
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov qword [rsp + 0x40], rcx
mov rdx, r13
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x48], r12
call fcn.140001c90
mov rax, qword [rsp + 0x290]
mov dword [rsp + 0x5c], 0
mov ecx, esi
mov r12, qword [rsp + 0x288]
lea rbx, [rax - 1]
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
lea r9, [rsp + 0x5c]
mov r8d, ebx
mov rdx, r12
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
test eax, eax
je 0x14020bfc7
lea rax, fcn.1400e5400
mov rcx, qword [rsp + 0x288]
mov qword [rsp + 0x280], rax
lea rax, [rsp + 0x2a0]
cmp rcx, rax
je 0x140004097
call fcn.14020b0f0
jmp 0x140004097
mov ecx, 0x10
call fcn.14020b1f0
lea rdx, str.failed_to_write_to_console
mov rcx, rax
mov rsi, rax
call fcn.1401d23f0
lea rax, [0x140239740]
lea r8, [0x140001850]
mov rcx, rsi
mov qword [rsi], rax
lea rdx, [0x140234ea0]
call fcn.14020b770
mov rbx, rax
jmp 0x14020c05e
mov ecx, 0x18
call fcn.14020b1f0
mov rsi, rax
call qword [sym.imp.msvcrt.dll__errno]
mov edx, dword [rax]
lea rbx, str.cannot_write_to_file
mov r8, r13
mov rcx, rsi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0x14
call fcn.1400e5210
lea r8, [0x140001890]
lea rdx, [0x140234ec0]
mov rcx, rsi
call fcn.14020b770
mov rcx, rsi
mov rbx, rax
call fcn.14020b450
lea rax, fcn.1400e5400
mov rcx, qword [rsp + 0x288]
mov qword [rsp + 0x280], rax
lea rax, [rsp + 0x2a0]
cmp rcx, rax
je 0x14020c087
call fcn.14020b0f0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x60], rdi
cmp rcx, rbp
je 0x14020c09b
call fcn.14020b0f0
mov rcx, rbx
call fcn.1400c9b10
mov rbx, rax
jmp 0x14020c087
Function at 0x14000c950
Capabilities:
Set console window title

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
lea rax, [0x140239950]
mov qword [rcx], rax
mov rbx, rcx
mov rdi, rdx
mov qword [rcx + 8], 0
mov qword [rcx + 0x10], 0
mov ecx, 1
call fcn.140069840
cmp eax, 0xe
je 0x14000c9a0
cmp eax, 7
je 0x14000c9a0
mov rax, qword [0x140232f20]
mov byte [rax], 0
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov ecx, 0x158
call fcn.14020b140
mov qword [rbx + 8], rax
mov rsi, rax
call fcn.140084930
xor r9d, r9d
mov r8d, 1
mov rdx, rsi
mov rcx, rax
call fcn.140079dd0
test eax, eax
js 0x14000c98b
mov rcx, qword [rbx + 8]
xor edx, edx
call fcn.14007aff0
mov rax, qword [rbx + 8]
mov ecx, 0xfffffff6
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000ca0f
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
jne 0x14000ca48
cmp byte [rdi], 0
je 0x14000c995
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.140016960
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14000c995
call fcn.14020b0e0
jmp 0x14000c995
mov edx, dword [rsp + 0x20]
mov rcx, rbx
and edx, 0xffffffbf
mov dword [rsp + 0x20], edx
or dl, 0x80
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
jmp 0x14000ca0f
Function at 0x140043ce0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x28
lea r10, [0x1402737e0]
mov r8, rcx
lea r9, [rcx + rdx]
test rdx, rdx
jne 0x140043d48
jmp 0x140043d70
lea rdx, [rax + 1]
mov eax, dword [r10 + rax*4]
add r8, 1
mov qword [0x1402741a0], rdx
mov edx, eax
shr edx, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov edx, eax
shr edx, 0x12
xor eax, edx
shr rax, 0x18
mov byte [r8 - 1], al
cmp r9, r8
je 0x140043d70
mov rax, qword [0x1402741a0]
cmp rax, 0x26f
jbe 0x140043d00
mov rcx, r10
call fcn.1401deac0
mov rax, qword [0x1402741a0]
jmp 0x140043d00
add rsp, 0x28
ret

Function at 0x14005ed20
Capabilities:
Check for time delay via gettickcount
Get system information on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x58
xor ebx, ebx
nop dword [rax + rax]
mov ecx, 0x5f5e100
call sub.msvcrt.dll_malloc
mov rcx, rax
test rax, rax
je 0x14005ed50
call fcn.1400d47d8
nop word [rax + rax]
mov ecx, 0x5f5e100
mov esi, ebx
add ebx, 1
call sub.msvcrt.dll_malloc
mov rcx, rax
test rax, rax
je 0x14005ed6c
call fcn.1400d47d8
imul eax, ebx, 0xaaaaaaab
add eax, 0x2aaaaaaa
cmp eax, 0x55555554
jbe 0x14005ed50
lea ebx, [rsi + 2]
cmp ebx, 7
jle 0x14005ed30
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0x40], 1
jle 0x14005edb9
mov rsi, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rsi
mov ecx, 0x3e8
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
call rsi
sub eax, ebx
cmp eax, 0x3e7
jg 0x14005edc5
mov eax, 1
add rsp, 0x58
pop rbx
pop rsi
ret
xor ebx, ebx
nop word [rax + rax]
mov ecx, 0x5f5e100
call sub.msvcrt.dll_malloc
mov rcx, rax
test rax, rax
je 0x14005edf0
call fcn.1400d47d8
nop word [rax + rax]
mov ecx, 0x5f5e100
mov esi, ebx
add ebx, 1
call sub.msvcrt.dll_malloc
mov rcx, rax
test rax, rax
je 0x14005ee0c
call fcn.1400d47d8
imul eax, ebx, 0xaaaaaaab
add eax, 0x2aaaaaaa
cmp eax, 0x55555554
jbe 0x14005edf0
lea ebx, [rsi + 2]
cmp ebx, 7
jle 0x14005edd0
xor eax, eax
add rsp, 0x58
pop rbx
pop rsi
ret
Function at 0x140067e50
Capabilities:
Get common file path

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rdi, rcx
mov rbp, rdx
mov r12, r8
test rcx, rcx
je 0x140067f68
call sub.msvcrt.dll_wcslen
mov r13, rax
mov rbx, rax
jmp 0x140067e97
lea rsi, [rbx - 1]
movzx edx, word [rdi + rsi*2]
cmp dx, 0x2f
je 0x140067ef0
cmp dx, 0x5c
je 0x140067ef0
mov rbx, rsi
test rbx, rbx
jne 0x140067e80
test rbp, rbp
je 0x140067ece
mov ecx, 0x20a
call fcn.140082d00
mov qword [rbp], rax
mov rdx, rax
test rax, rax
je 0x140067f9c
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x140067f81
mov rcx, rdi
call sub.msvcrt.dll__wcsdup
mov qword [r12], rax
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
test rsi, rsi
je 0x140067e9c
test rbp, rbp
je 0x140067f29
lea rcx, [rbx + rbx + 2]
call fcn.140082d00
mov qword [rbp], rax
mov rcx, rax
test rax, rax
je 0x140067f9c
mov r8, rbx
mov rdx, rdi
call sub.msvcrt.dll_wcsncpy
mov rax, qword [rbp]
xor ecx, ecx
mov word [rax + rbx*2], cx
sub r13, rsi
lea rsi, [r13 + r13]
mov rcx, rsi
call fcn.140082d00
mov qword [r12], rax
mov rcx, rax
test rax, rax
je 0x140067f9c
lea rdx, [rdi + rbx*2]
lea r8, [r13 - 1]
call sub.msvcrt.dll_wcsncpy
mov rax, qword [r12]
xor edx, edx
mov word [rax + rsi - 2], dx
jmp 0x140067eda
test rdx, rdx
je 0x140067f74
mov qword [rdx], 0
mov qword [r12], 0
jmp 0x140067eda
mov rcx, qword [rbp]
call fcn.140082d20
mov qword [rbp], 0
mov eax, 0xffffffff
jmp 0x140067edc
lea rdx, [0x140226d30]
mov ecx, 0xe
call fcn.140060580
nop
nop
Function at 0x140068eb0
Capabilities:
Resolve dns

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [rcx + 0x48]
mov rdx, qword [rcx + 0x40]
mov rbx, rcx
mov qword [rcx + 0x48], 0
mov rcx, qword [rcx + 0x38]
lea r9, [rbx + 0x48]
call qword [sym.imp.WS2_32.dll_GetAddrInfoW]
cmp eax, 0x273f
je 0x140068f90
jle 0x140068f10
cmp eax, 0x2afa
je 0x140068f80
jg 0x140068f50
cmp eax, 0x277d
je 0x140068f30
cmp eax, 0x2af9
jne 0x140068f70
mov eax, 0xfffff440
mov dword [rbx + 0x58], eax
add rsp, 0x20
pop rbx
ret
cmp eax, 0x2726
je 0x140068f60
jg 0x140068f40
test eax, eax
je 0x140068f03
cmp eax, 8
jne 0x140068f70
mov eax, 0xfffff442
jmp 0x140068f03
mov eax, 0xfffff43e
jmp 0x140068f03
cmp eax, 0x273c
jne 0x140068f70
mov eax, 0xfffff43d
jmp 0x140068f03
cmp eax, 0x2afb
jne 0x140068f70
mov eax, 0xfffff444
jmp 0x140068f03
mov eax, 0xfffff446
jmp 0x140068f03
mov ecx, eax
call fcn.1400605e0
mov dword [rbx + 0x58], eax
add rsp, 0x20
pop rbx
ret
mov eax, 0xfffff447
mov dword [rbx + 0x58], eax
add rsp, 0x20
pop rbx
ret
mov eax, 0xfffff443
mov dword [rbx + 0x58], eax
add rsp, 0x20
pop rbx
ret

Function at 0x14006a070
Capabilities:
Connect pipe
Create pipe

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
test r9d, r9d
jne 0x14006a0f0
mov rcx, qword [rdx + 0x120]
xor r8d, r8d
mov qword [rsp + 0x38], 0
mov r9d, 0xff
mov dword [rsp + 0x30], 0
mov edx, 0x40040003
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0x20], 0x10000
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov qword [rbx + 0x70], rax
mov r8, rax
cmp rax, 0xffffffffffffffff
je 0x14006a172
mov dword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov rdx, rsi
mov rcx, rdi
call fcn.140069ef0
test eax, eax
jne 0x14006a160
pxor xmm0, xmm0
lea rdx, [rbx + 0x40]
movups xmmword [rbx + 0x40], xmm0
movups xmmword [rdx + 0x10], xmm0
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x14006a120
mov eax, dword [rsi + 0x78]
add eax, 1
mov dword [rsi + 0x78], eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rbp, qword [sym.imp.KERNEL32.dll_GetLastError]
call rbp
cmp eax, 0x3e5
je 0x14006a10e
call rbp
mov edx, eax
xor eax, eax
cmp edx, 0x217
je 0x14006a18b
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x70], 0xffffffffffffffff
call rbp
test eax, eax
jg 0x14006a17f
call rbp
cdqe
jmp 0x14006a18b
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x70], 0xffffffffffffffff
mov rbp, qword [sym.imp.KERNEL32.dll_GetLastError]
call rbp
test eax, eax
jle 0x14006a156
call rbp
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [rbx + 0x40], rax
mov rax, qword [rdi + 0x48]
mov qword [rbx + 0x68], 0
test rax, rax
je 0x14006a1c8
mov rdx, qword [rax + 0x68]
mov qword [rbx + 0x68], rdx
mov qword [rax + 0x68], rbx
mov eax, dword [rsi + 0x78]
mov qword [rdi + 0x48], rbx
add eax, 1
mov dword [rsi + 0x78], eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov qword [rbx + 0x68], rbx
jmp 0x14006a1ac
Function at 0x14006a370
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov eax, dword [rdx + 0x58]
mov rsi, rcx
mov rbx, rdx
lea rdi, [rdx + 0x80]
test eax, 0x1000000
je 0x14006a3f8
mov r8d, 0x10
lea rcx, [0x14006a1d0]
mov qword [rdx + 0x238], 0
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
test eax, eax
je 0x14006a4b0
mov rcx, qword [rbx + 0x128]
test rcx, rcx
je 0x14006a3d9
xor r9d, r9d
mov r8d, 0x32
lea rdx, [0x14006af40]
call fcn.1400828c0
or dword [rbx + 0x58], 0x10000
mov eax, dword [rbx + 0x78]
add eax, 1
mov dword [rbx + 0x78], eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
pxor xmm0, xmm0
lea rdx, [rdx + 0xc0]
movups xmmword [rbx + 0xc0], xmm0
movups xmmword [rdx + 0x10], xmm0
test eax, 0x80000
je 0x14006a427
mov rax, qword [rbx + 0xf0]
or rax, 1
mov qword [rbx + 0xd8], rax
mov rcx, qword [rbx + 0x118]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdx
lea rdx, [0x140274da0]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14006a4c0
test byte [rbx + 0x5a], 8
je 0x14006a3b8
cmp qword [rbx + 0xf0], 0
je 0x14006a530
cmp qword [rbx + 0xf8], 0xffffffffffffffff
jne 0x14006a3b8
mov rdx, qword [rbx + 0xd8]
lea rcx, [rbx + 0xf8]
mov dword [rsp + 0x28], 4
mov r9, rdi
mov dword [rsp + 0x20], 0xffffffff
lea r8, [0x14006a5f0]
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x14006a3b8
nop word cs:[rax + rax]
mov rbp, qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14006a4d4
mov rbp, qword [sym.imp.KERNEL32.dll_GetLastError]
call rbp
cmp eax, 0x3e5
je 0x14006a44a
call rbp
test eax, eax
jle 0x14006a520
call rbp
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [rbx + 0xc0], rax
mov rax, qword [rsi + 0x48]
mov qword [rbx + 0xe8], 0
test rax, rax
je 0x14006a568
mov rdx, qword [rax + 0x68]
mov qword [rbx + 0xe8], rdx
mov qword [rax + 0x68], rdi
mov qword [rsi + 0x48], rdi
jmp 0x14006a3d9
call rbp
cdqe
jmp 0x14006a4e6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0xf0], rax
test rax, rax
jne 0x14006a462
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x140226dcb]
mov ecx, eax
call fcn.140060580
nop dword [rax]
mov qword [rbx + 0xe8], rdi
jmp 0x14006a510