joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002feb4
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x14007e438]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x14007e434]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x14002ff02
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14002fefa
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x14002ffe9
inc ebx
add rax, 0x28
jmp 0x14002feda
mov rcx, r12
call sym.__mingw_GetSectionForAddress
mov rbp, rax
test rax, rax
jne 0x14002ff21
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call sym.__report_error
movsxd rbx, ebx
mov rax, qword [0x14007e438]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call sym._GetPEImageBase
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14007e438]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x14002ff83
mov rax, qword [0x14007e438]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call sym.__report_error
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x14002ffe3
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14002ffe3
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14007e438]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14002ffe3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
inc dword [0x14007e434]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140030410
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x14007e4a0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14007e480]
test rbx, rbx
je 0x14003045c
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140030456
test eax, eax
jne 0x140030456
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x14003042e
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140030610
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140030633
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140030633
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret
Function at 0x140030634
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x14003066e
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x140030665
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140030670
inc r8d
add rax, 0x28
jmp 0x14003064c
xor eax, eax
ret

Function at 0x1400306e1
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x14006d880]
mov r8, rcx
mov rcx, r9
call sym._ValidateImageBase
test eax, eax
je 0x14003070d
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp sym._FindPESection
xor eax, eax
add rsp, 0x28
ret
Function at 0x100002878
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2a0
mov r15d, 0xa2
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetKeyState]
mov ebx, 0
mov ebp, 0x8000
test bp, ax
lea edi, [rbx + 1]
lea ecx, [r15 + 1]
cmovne ebx, edi
call qword [sym.imp.USER32.dll_GetKeyState]
lea esi, [rdi + 1]
test bp, ax
je 0x1000028cd
or ebx, esi
mov r12d, 0xa4
mov ecx, r12d
call qword [sym.imp.USER32.dll_GetKeyState]
test bp, ax
je 0x1000028e4
or ebx, 4
mov r13d, 0xa5
mov ecx, r13d
call qword [sym.imp.USER32.dll_GetKeyState]
test bp, ax
je 0x1000028fb
or ebx, 8
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
test bp, ax
je 0x10000290e
or ebx, 0x10
mov r14d, 0xa1
mov ecx, r14d
call qword [sym.imp.USER32.dll_GetKeyState]
test bp, ax
je 0x100002925
or ebx, 0x20
lea rcx, [rsp + 0x28]
xor ebp, ebp
xor edx, edx
mov r8d, 0x278
mov dword [rsp + 0x20], ebp
call fcn.10000a9a2
mov r11d, ebp
test dil, bl
je 0x100002956
mov dword [rsp + 0x20], edi
mov word [rsp + 0x28], r15w
mov dword [rsp + 0x2c], esi
mov r11d, edi
mov edx, 3
test sil, bl
je 0x10000297c
movsxd rax, r11d
add r11d, edi
lea rcx, [rax + rax*4]
mov eax, 0xa3
mov dword [rsp + rcx*8 + 0x20], edi
mov word [rsp + rcx*8 + 0x28], ax
mov dword [rsp + rcx*8 + 0x2c], edx
test bl, 4
je 0x100002999
movsxd rax, r11d
add r11d, edi
lea rcx, [rax + rax*4]
mov dword [rsp + rcx*8 + 0x20], edi
mov word [rsp + rcx*8 + 0x28], r12w
mov dword [rsp + rcx*8 + 0x2c], esi
test bl, 8
je 0x1000029b6
movsxd rax, r11d
add r11d, edi
lea rcx, [rax + rax*4]
mov dword [rsp + rcx*8 + 0x20], edi
mov word [rsp + rcx*8 + 0x28], r13w
mov dword [rsp + rcx*8 + 0x2c], edx
test bl, 0x10
je 0x1000029d7
movsxd rax, r11d
add r11d, edi
lea rcx, [rax + rax*4]
mov eax, 0xa0
mov dword [rsp + rcx*8 + 0x20], edi
mov word [rsp + rcx*8 + 0x28], ax
mov dword [rsp + rcx*8 + 0x2c], esi
test bl, 0x20
je 0x1000029f4
movsxd rax, r11d
add r11d, edi
lea rcx, [rax + rax*4]
mov dword [rsp + rcx*8 + 0x20], edi
mov word [rsp + rcx*8 + 0x28], r14w
mov dword [rsp + rcx*8 + 0x2c], esi
movsxd rax, r11d
mov r8d, 0x5b
add r11d, edi
lea rcx, [rax + rax*4]
movsxd rax, r11d
lea edx, [r8 - 6]
mov word [rsp + rcx*8 + 0x28], r8w
mov dword [rsp + rcx*8 + 0x20], edi
mov dword [rsp + rcx*8 + 0x2c], ebp
lea rcx, [rax + rax*4]
add r11d, edi
mov word [rsp + rcx*8 + 0x28], dx
mov dword [rsp + rcx*8 + 0x20], edi
mov dword [rsp + rcx*8 + 0x2c], ebp
movsxd rax, r11d
add r11d, edi
lea rcx, [rax + rax*4]
movsxd rax, r11d
mov word [rsp + rcx*8 + 0x28], dx
mov dword [rsp + rcx*8 + 0x20], edi
mov dword [rsp + rcx*8 + 0x2c], esi
lea rcx, [rax + rax*4]
mov word [rsp + rcx*8 + 0x28], r8w
mov dword [rsp + rcx*8 + 0x20], edi
mov dword [rsp + rcx*8 + 0x2c], esi
lea r8d, [rdx - 0x2d]
lea ecx, [r11 + 1]
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendInput]
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1000052e8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov r14d, 1
shr eax, 4
mov ebx, r8d
mov rsi, rcx
add ax, r14w
lea r8d, [r14 + 5]
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor r13d, r13d
mov r12, rax
cmp rax, r13
je 0x10000545e
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp rax, r13
je 0x10000545e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
cmp rax, r13
je 0x10000545e
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x100005394
cmp rdi, r11
jae 0x10000545e
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x10000537e
cmp rdi, r11
jae 0x10000545e
cmp word [rdi], r13w
je 0x10000545e
mov rax, qword [rsi]
movzx ebx, word [rdi]
mov ecx, r14d
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x1000053c6
mov edx, ebx
mov rcx, rsi
call fcn.100005554
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x1000053e7
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
add ecx, r14d
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call fcn.10000a98a
cmp eax, r13d
je 0x100005436
cmp eax, 0xc
je 0x10000542b
cmp eax, 0x16
je 0x100005420
cmp eax, 0x22
je 0x100005420
cmp eax, 0x50
je 0x100005436
mov ecx, 0x80004005
call fcn.100003a64
int3
mov ecx, 0x80070057
call fcn.100003a64
int3
mov ecx, 0x8007000e
call fcn.100003a64
int3
cmp ebx, r13d
jl 0x100005453
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x100005453
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, r14d
mov word [rdi + rcx], r13w
jmp 0x100005460
mov ecx, 0x80070057
call fcn.100003a64
int3
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x100008f7c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x860
mov rax, qword [0x10000f130]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov r12, rdx
mov rbp, rcx
lea rdx, [0x10000214e]
mov rcx, r8
mov rsi, r8
call fcn.10000867c
mov rcx, qword [rbp]
xor r13d, r13d
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x44]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, r12
mov dword [rsp + 0x48], r13d
mov qword [rsp + 0x20], r13
mov edi, r13d
mov dword [rsp + 0x40], r13d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r13d
jne 0x100009120
cmp dword [rsp + 0x44], 1
je 0x100009008
cmp dword [rsp + 0x44], 2
jne 0x100009120
mov edi, dword [rsp + 0x48]
mov eax, r13d
shr edi, 1
mov dword [rsp + 0x40], edi
cmp eax, r13d
jne 0x100009120
cmp edi, r13d
je 0x100009120
mov ecx, edi
mov eax, 2
mov rdi, 0xffffffffffffffff
mul rcx
cmovo rax, rdi
mov rcx, rax
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov rbx, rax
cmp rax, r13
jne 0x100009053
xor eax, eax
jmp 0x100009125
lea r9, [rsp + 0x40]
mov r8, rax
mov rdx, r12
mov rcx, rbp
mov word [rax], r13w
call fcn.100003958
cmp eax, r13d
jne 0x1000090a8
mov eax, dword [rsp + 0x40]
cmp eax, r13d
jbe 0x1000090a8
cmp eax, 0x400
jbe 0x100009087
mov word [rbx + 0x7fe], r13w
mov rcx, rdi
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
mov rdx, rbx
not rcx
lea r8d, [rcx - 1]
mov rcx, rsi
call fcn.100008788
or rdi, 0xffffffffffffffff
cmp word [rbx], 0x40
jne 0x100009118
mov rcx, qword [rbp]
mov qword [rsp + 0x30], r13
lea r8, [rsp + 0x50]
mov r9d, 0x400
mov rdx, r12
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegLoadMUIStringW]
cmp eax, r13d
jne 0x100009109
mov rcx, rdi
xor eax, eax
mov word [rsp + 0x84e], r13w
lea rdi, [rsp + 0x50]
lea rdx, [rsp + 0x50]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rcx, rsi
call fcn.100008788
jmp 0x100009118
lea rdx, [0x10000214e]
mov rcx, rsi
call fcn.10000867c
mov rcx, rbx
call fcn.10000aaf6
mov eax, 1
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.10000a940
mov rbx, qword [rsp + 0x8a8]
add rsp, 0x860
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x10000a264
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x10000f130]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call fcn.10000a9a2
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x100000000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call fcn.10000a9a2
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x10000a2f7
cmp dword [rsp + 0x24], 5
jb 0x10000a311
jmp 0x10000a30d
cmp dword [rsp + 0x30], esi
jne 0x10000a311
cmp dword [rsp + 0x24], 4
ja 0x10000a30d
jne 0x10000a311
cmp dword [rsp + 0x28], 0
jbe 0x10000a311
mov byte [rbx + 0x18], sil
lea rax, [0x1000017c0]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.10000a0c0
movzx ecx, byte [0x10000fbd0]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x10000fbd0], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.10000a940
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x10000ac78
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x10000acc5
cmp rcx, 0xffffffffffffffff
je 0x10000acc5
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x10000acbd
cmp dword [rcx + 0x3c], edx
jl 0x10000acbd
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10000acbd
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x10000acc5
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140020e20
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x1401970c0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, 4
mov eax, eax
mov ecx, dword [0x1401987d8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rax + rcx]
cmp dword [0x140197840], eax
jle 0x140020ec5
lea rcx, [0x140197840]
call fcn.140163814
cmp dword [0x140197840], 0xffffffff
jne 0x140020ec5
lea rdx, [0x14016ba30]
lea rcx, [rsp + 0x38]
call fcn.14001af20
nop
lea r8, [rsp + 0x38]
mov rdx, qword [0x1401977d8]
mov rcx, qword [rsp + 0x80]
call fcn.14001f450
mov qword [0x140197838], rax
lea rcx, [rsp + 0x38]
call fcn.140022630
nop
lea rcx, [0x140197840]
call fcn.1401637a8
cmp qword [0x140197838], 0
jne 0x140020efd
lea rdx, str.____Failed_to_find_MmUnmapLockedPages
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140015a80
mov qword [rsp + 0x30], rax
lea rdx, [0x14001a850]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor al, al
jmp 0x140020f2b
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x88]
mov r8, qword [0x140197838]
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x80]
call fcn.140017430
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140163a00
add rsp, 0x78
ret
Function at 0x140021cc0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov rax, qword [0x1401970c0]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xc0]
cmp qword [rax + 0x68], 0
je 0x140021cfd
mov rax, qword [rsp + 0xc0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140021d04
mov al, 1
jmp 0x140021e8d
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x38], 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xc0]
call qword [rsp + 0x60]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x3c], 0xffffffff
mov eax, dword [rsp + 0x48]
cmp dword [rsp + 0x3c], eax
jne 0x140021d60
mov dword [rsp + 0x40], 1
jmp 0x140021d68
mov dword [rsp + 0x40], 0
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x30]
test eax, eax
je 0x140021d81
xor al, al
jmp 0x140021e8d
mov qword [rsp + 0x70], reloc.WLDAP32.dll_Ordinal_32
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xc0]
add rcx, 0x74
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x80]
mov rdx, rcx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x140021df4
cmp dword [rsp + 0x34], 1
je 0x140021e00
cmp dword [rsp + 0x34], 3
je 0x140021e7b
jmp 0x140021e8b
mov rax, qword [rsp + 0xc0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jbe 0x140021e52
mov rax, qword [rsp + 0xc0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
lea rcx, [rsp + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x50], rax
je 0x140021e52
xor al, al
jmp 0x140021e8d
mov rax, qword [rsp + 0xc0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140021e6c
mov dword [rsp + 0x44], 1
jmp 0x140021e74
mov dword [rsp + 0x44], 0
movzx eax, byte [rsp + 0x44]
jmp 0x140021e8d
mov rax, qword [rsp + 0xc0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140021e8d
xor al, al
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.140163a00
add rsp, 0xb8
ret
Function at 0x1400247e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x68], 0
je 0x140024819
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14002490e
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x60], 0
jle 0x1400248b6
cmp qword [rsp + 0x20], 0
jle 0x1400248b6
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x60], rax
jge 0x140024859
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov qword [rsp + 0x28], rax
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rsp + 0x60], 0
jle 0x1400248fe
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x80], 0
je 0x1400248fe
mov rax, qword [rsp + 0x50]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x60]
mov edx, 1
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
add rsp, 0x48
ret
Function at 0x140029720
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
mov rax, qword [rsp]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140029744
xor eax, eax
jmp 0x140029772
mov rax, qword [rsp]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
cmp dword [rax], 0x4550
je 0x14002976d
xor eax, eax
jmp 0x140029772
mov rax, qword [rsp + 8]
add rsp, 0x18
ret
Function at 0x14002c770
Capabilities:
Block operations on executable memory pages using arbitrary code guard

Disassembly:
push rdi
sub rsp, 0x30
mov rax, qword [0x1401970c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov r8d, 4
lea rdx, [rsp + 0x20]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
test eax, eax
jne 0x14002c7bf
xor al, al
jmp 0x14002c7c1
mov al, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140163a00
add rsp, 0x30
pop rdi
ret

Function at 0x14002c7e0
Capabilities:
Block operations on executable memory pages using arbitrary code guard

Disassembly:
push rdi
sub rsp, 0x30
mov rax, qword [0x1401970c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov r8d, 4
lea rdx, [rsp + 0x20]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
test eax, eax
jne 0x14002c82f
xor al, al
jmp 0x14002c831
mov al, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140163a00
add rsp, 0x30
pop rdi
ret

Function at 0x14002d0b0
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x28
mov rax, qword gs:[0x60]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
mov rax, qword [rax + 0x18]
mov ecx, 8
imul rcx, rcx, 1
mov rax, qword [rax + rcx + 8]
mov qword [rsp + 0x10], rax
xor eax, eax
mov ecx, 8
imul rcx, rcx, 0
add rax, rcx
mov rcx, qword [rsp + 0x10]
sub rcx, rax
mov rax, rcx
mov qword [rsp], rax
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp]
lea rax, [rcx + rax + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp]
mov rax, qword [rax + 0x30]
movabs rcx, 0x6666666666666667
sub rax, rcx
mov rcx, qword [rsp + 0x18]
mov dword [rcx], eax
add rsp, 0x28
ret
Function at 0x1400584a0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rcx, qword [rsp + 0x60]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x68]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x68]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x20], 0
jmp 0x140058507
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x20], eax
jae 0x1400585a1
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x60]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14005859c
mov rax, qword [rsp + 0x28]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
cmp qword [rsp + 0x38], rax
jne 0x14005859c
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0xc], 0
jne 0x140058570
xor eax, eax
jmp 0x1400585a3
cmp qword [rsp + 0x70], 0
je 0x140058587
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 8]
mov dword [rax], ecx
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x68]
add rcx, rax
mov rax, rcx
jmp 0x1400585a3
jmp 0x1400584fd
xor eax, eax
add rsp, 0x58
ret