joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001dcf0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140035010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14001ddc5
cmp byte [rcx + 0x72], 0
je 0x14001ddc5
mov rax, qword [rcx]
mov qword [rsp + 0x78], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x14001ddc1
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14001dd86
sub eax, 1
je 0x14001dd8a
cmp eax, 2
jne 0x14001ddc1
mov byte [rbx + 0x72], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140028c80
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14001ddb8
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14001ddc1
cmp byte [rbx + 0x72], 0
sete al
jmp 0x14001dd6e
xor al, al
jmp 0x14001dd6e
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140028c80
add rsp, 0x60
pop rbx
ret

Function at 0x14001e450
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rcx + 4], edx
lea r9, [rcx + 8]
mov eax, 1
nop dword [rax]
mov r8d, edx
lea r9, [r9 + 4]
shr r8d, 0x1e
xor r8d, edx
imul edx, r8d, 0x6c078965
add edx, eax
inc rax
mov dword [r9 - 4], edx
cmp rax, 0x270
jb 0x14001e460
mov dword [rcx], 0x270
ret
Function at 0x140020de0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x140020e41
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140020e00
mov ecx, dword [r10]
jmp 0x140020f2a
cmp ecx, 0x4e0
jb 0x140020f2a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140020e60
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140020eb0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1400248c0
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x14002498c
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x14002498c
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x1400249a5
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x14002497c
cmp byte [rax], 0x5c
jne 0x140024976
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x140024976
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x140024962
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x140024973
test r8b, 0x10
jne 0x140024976
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x140024976
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.140020f80
test edi, edi
jne 0x1400248e0
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.140020f70
int3

Function at 0x14002868c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140028710
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14002c720]
cmp byte [rcx + rax], 0
je 0x140028710
dec r8
sub rdx, 1
jne 0x1400286f6
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14002976c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400297b6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400297b6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400297b6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400297b6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400297b6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400297b8
xor al, al
add rsp, 0x28
ret
Function at 0x1400627d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
cmp byte [rdx + 0x4a], 0
je 0x1400627f3
xor eax, eax
nop dword [rax]
lea ecx, [rax + 0x4b]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0x49
jb 0x1400627e0
mov byte [rdx + 0x4a], 0
call fcn.14006aa70
lea rax, [0x140329ab0]
add rsp, 0x28
ret

Function at 0x140062810
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
cmp byte [rdx + 0x15], 0
je 0x140062833
xor eax, eax
nop dword [rax]
lea ecx, [rax + 0x4b]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0x14
jb 0x140062820
mov byte [rdx + 0x15], 0
call fcn.14006aa70
lea rax, [0x140329ab0]
add rsp, 0x28
ret
Function at 0x1400652b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140321600]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x38], rdx
xor r14d, r14d
call fcn.1400961a0
mov rsi, rax
xorps xmm0, xmm0
test rax, rax
jne 0x14006538a
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
lea r8d, [r14 + 4]
lea rdx, [0x1402f60ac]
mov rcx, rdi
call fcn.14006ba60
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140065354
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14006534f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400654a6
mov rcx, r8
call fcn.1402141c0
mov rax, rdi
mov byte [rbx], 0
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], r14
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1402141a0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
movups xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x1402f81e0]
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0x30], 0
movdqa xmm0, xmmword [0x1402f82e0]
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x50], 0x7133352c
mov dword [rbp - 0x4c], 0x4d08103e
mov dword [rbp - 0x48], 0x49554a52
mov word [rbp - 0x44], 0x100
mov rcx, r14
nop word [rax + rax]
lea eax, [rcx + 0x4b]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 0x1c
jb 0x1400653d0
mov byte [rbp - 0x43], 0
lea r8, [rbp - 0x60]
mov edx, 0x2712
mov rcx, rsi
call fcn.14009a230
xor r8d, r8d
lea edx, [r8 + 0x40]
mov rcx, rsi
call fcn.14009a230
xor r8d, r8d
lea edx, [r8 + 0x51]
mov rcx, rsi
call fcn.14009a230
mov r8, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140065420
mov r8, qword [rbx]
mov edx, 0x271f
mov rcx, rsi
call fcn.14009a230
lea r8, [0x140065280]
mov edx, 0x4e2b
mov rcx, rsi
call fcn.14009a230
lea r8, [rbp - 0x30]
mov edx, 0x2711
mov rcx, rsi
call fcn.14009a230
mov rcx, rsi
call fcn.140096270
test eax, eax
je 0x140065479
mov ecx, eax
call fcn.1400972d0
mov rdx, rax
mov r9d, 0x10
xor r8d, r8d
xor ecx, ecx
call qword [0x140258658]
mov rcx, rsi
call fcn.140096180
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp - 0x20]
movups xmmword [rdi + 0x10], xmm1
movdqa xmm0, xmmword [0x1402f81e0]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], 0
jmp 0x14006531a
call fcn.140229330
int3
Function at 0x140214f04
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x140258510]
test rax, rax
je 0x140214f4e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140214f4e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140214f4e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140214f4e
cmp dword [rcx + 0x84], 0xe
jbe 0x140214f4e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140214f50
xor al, al
add rsp, 0x28
ret

Function at 0x140223d84
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140223bef
xor ecx, ecx
call qword [0x140258510]
test rax, rax
je 0x140223bef
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140223bef
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140223bef
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140223bef
cmp dword [rcx + 0x84], 0xe
jbe 0x140223bef
cmp dword [rcx + 0xf8], 0
je 0x140223bef
mov ecx, ebx
call fcn.140223ca0
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140223a7c
nop
cmp dword [rbp + 0x20], 0
je 0x140223c3d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140223c48
int3
xor r8d, r8d
xor edx, edx
jmp 0x140223b80
Function at 0x1400012b0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x2e0
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov rbx, rcx
xor esi, esi
xor edx, edx
lea ecx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140001316
mov dword [rsp + 0x90], 0x238
lea rdx, [rsp + 0x90]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x14000131d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400014ea
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140001230
nop
nop dword [rax + rax]
lea rdx, [rsp + 0xbc]
lea rcx, [rsp + 0x28]
call fcn.140002950
nop
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x68]
call fcn.140001230
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x140001395
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001390
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400014dc
call fcn.140004508
lea rax, [rsp + 0x68]
mov r10, qword [rsp + 0x80]
cmp r10, 7
seta r11b
mov r9, qword [rsp + 0x68]
cmova rax, r9
lea r8, [rsp + 0x48]
cmp qword [rsp + 0x60], 7
cmova r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x58]
cmp rdx, qword [rsp + 0x78]
jne 0x140001488
test rdx, rdx
je 0x1400013f8
sub r8, rax
nop dword [rax]
movzx ecx, word [r8 + rax]
cmp cx, word [rax]
jne 0x140001488
add rax, 2
sub rdx, 1
jne 0x1400013e0
mov esi, dword [rsp + 0x98]
cmp r10, 7
jbe 0x14000143a
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x140001432
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400014dc
mov rcx, r9
call fcn.140004508
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x1400014e8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400014e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400014e3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
test r11b, r11b
je 0x1400014be
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x1400014b6
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400014dc
mov rcx, r9
call fcn.140004508
lea rdx, [rsp + 0x90]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001330
jmp 0x14000143a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140004508
mov eax, esi
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.140004180
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400036b0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov rdi, rcx
mov qword [rcx], rax
mov ebx, edx
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x80], rax
add rcx, 0x50
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 0x48], rax
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x140004c88
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004cd2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004cd2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004cd2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004cd2
cmp dword [rcx + 0x84], 0xe
jbe 0x140004cd2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004cd4
xor al, al
add rsp, 0x28
ret
Function at 0x4020d4
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x00429200]
test rax, rax
je 0x4020e7
call rax
mov ecx, 2
call qword [fcn.00416520]
mov r8d, 0xe
mov edx, 1
lea rcx, str.out_of_memory_n
mov rbx, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, rbx
call sub.msvcrt.dll_fflush
mov ecx, 1
call sub.msvcrt.dll_exit
nop

Function at 0x406260
Capabilities:
Create process on windows
Create process suspended
Resume thread
Use process replacement

Disassembly:
push r12
mov eax, 0x1110
push rbp
push rdi
push rsi
push rbx
call fcn.00410fd0
sub rsp, rax
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov eax, ebx
mov rsi, rcx
mov ecx, 0x1a
mov rbp, rdx
mov dword [rsp + 0x54], 0
lea rdi, [rsp + 0xa8]
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x60]
mov ecx, 6
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x78]
mov ecx, 0xc
rep stosd dword [rdi], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x40], rax
lea rdx, str.c:windows_system32_notepad.exe
mov dword [rsp + 0x28], 4
lea rdi, [rsp + 0x110]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x54]
xor edx, edx
lea r8, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x30
call sub.ntdll.dll_NtQueryInformationProcess
lea r8, [rsp + 0x58]
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x58], 0
mov rcx, qword [rsp + 0x60]
mov r9d, 8
mov qword [rsp + 0x20], 0
mov r12, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rdx, [rax + 0x10]
call r12
mov eax, ebx
mov ecx, 0x400
mov rdx, qword [rsp + 0x58]
rep stosd dword [rdi], eax
lea r8, [rsp + 0x110]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
call r12
mov r9, rbp
mov r8, rsi
mov rcx, qword [rsp + 0x60]
movsxd rax, dword [rsp + 0x14c]
mov edx, dword [rsp + rax + 0x138]
mov qword [rsp + 0x20], 0
add rdx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
add rsp, 0x1110
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [0x00422aa0]
movsxd rdx, dword [rax]
mov rax, qword [0x00422a90]
mov rcx, qword [rax]
jmp 0x406260
sub rsp, 0x28
call fcn.004063e2
nop
add rsp, 0x28
jmp 0x4063f7
Function at 0x4063f7
Capabilities:
Use process replacement

Disassembly:
push r12
mov eax, 0x1110
push rbp
push rdi
push rsi
push rbx
call fcn.00410fd0
sub rsp, rax
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov eax, ebx
mov rsi, rcx
mov ecx, 0x1a
mov rbp, rdx
mov dword [rsp + 0x54], 0
lea rdi, [rsp + 0xa8]
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x60]
mov ecx, 6
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x78]
mov ecx, 0xc
rep stosd dword [rdi], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x40], rax
lea rdx, str.c:windows_system32_notepad.exe
mov dword [rsp + 0x28], 4
lea rdi, [rsp + 0x110]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x54]
xor edx, edx
lea r8, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x30
call sub.ntdll.dll_NtQueryInformationProcess
lea r8, [rsp + 0x58]
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x58], 0
mov rcx, qword [rsp + 0x60]
mov r9d, 8
mov qword [rsp + 0x20], 0
mov r12, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rdx, [rax + 0x10]
call r12
mov eax, ebx
mov ecx, 0x400
mov rdx, qword [rsp + 0x58]
rep stosd dword [rdi], eax
lea r8, [rsp + 0x110]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
call r12
mov r9, rbp
mov r8, rsi
mov rcx, qword [rsp + 0x60]
movsxd rax, dword [rsp + 0x14c]
mov edx, dword [rsp + rax + 0x138]
mov qword [rsp + 0x20], 0
add rdx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
add rsp, 0x1110
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [0x00422aa0]
movsxd rdx, dword [rax]
mov rax, qword [0x00422a90]
mov rcx, qword [rax]
jmp 0x406260
sub rsp, 0x28
call fcn.004063e2
nop
add rsp, 0x28
jmp 0x4063f7
Function at 0x406412
Capabilities:
Use process replacement

Disassembly:
push r12
mov eax, 0x1110
push rbp
push rdi
push rsi
push rbx
call fcn.00410fd0
sub rsp, rax
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov eax, ebx
mov rsi, rcx
mov ecx, 0x1a
mov rbp, rdx
mov dword [rsp + 0x54], 0
lea rdi, [rsp + 0xa8]
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x60]
mov ecx, 6
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x78]
mov ecx, 0xc
rep stosd dword [rdi], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x40], rax
lea rdx, str.c:windows_system32_notepad.exe
mov dword [rsp + 0x28], 4
lea rdi, [rsp + 0x110]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x54]
xor edx, edx
lea r8, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x30
call sub.ntdll.dll_NtQueryInformationProcess
lea r8, [rsp + 0x58]
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x58], 0
mov rcx, qword [rsp + 0x60]
mov r9d, 8
mov qword [rsp + 0x20], 0
mov r12, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rdx, [rax + 0x10]
call r12
mov eax, ebx
mov ecx, 0x400
mov rdx, qword [rsp + 0x58]
rep stosd dword [rdi], eax
lea r8, [rsp + 0x110]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
call r12
mov r9, rbp
mov r8, rsi
mov rcx, qword [rsp + 0x60]
movsxd rax, dword [rsp + 0x14c]
mov edx, dword [rsp + rax + 0x138]
mov qword [rsp + 0x20], 0
add rdx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
add rsp, 0x1110
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [0x00422aa0]
movsxd rdx, dword [rax]
mov rax, qword [0x00422a90]
mov rcx, qword [rax]
jmp 0x406260
sub rsp, 0x28
call fcn.004063e2
nop
add rsp, 0x28
jmp 0x4063f7
Function at 0x410070
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x00429844]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x4101f8
mov rax, qword [0x00429848]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x4100bc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x410145
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x4100a0
mov rcx, rbx
call fcn.00410d10
test rax, rax
mov r12, rax
je 0x41022d
mov rax, qword [0x00429848]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.00410e40
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00429848]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x410210
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x41013e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x4101a0
add dword [0x00429844], 1
cmp edi, 8
jae 0x410173
test dil, 4
jne 0x4101e4
test edi, edi
je 0x410168
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x4101ff
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x410168
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x41018c
jmp 0x410168
add rsi, qword [0x00429848]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x41013e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.0041d810
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x410168
xor esi, esi
jmp 0x4100c7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x410168
mov rax, qword [0x00429848]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.0041d810
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.0041d810
nop
nop dword [rax]

Function at 0x410980
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00429b20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00429b00]
test rbx, rbx
je 0x4109d4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x4109cb
test rsi, rsi
je 0x4109cb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4109b0
lea rcx, [0x00429b20]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]