joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1408c2058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1408c21df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1408c2089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408c206f
add dl, dl
jne 0x1408c2096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408c20f6
xor eax, eax
add dl, dl
jne 0x1408c20a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408c21ad
add dl, dl
jne 0x1408c20b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408c20c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408c20d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408c20dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1408c20ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1408c207e
mov eax, 1
add dl, dl
jne 0x1408c2106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408c2113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408c20fb
sub eax, ebx
mov ebx, 1
jne 0x1408c214c
mov ecx, 1
add dl, dl
jne 0x1408c212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1408c213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408c2123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408c207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1408c2168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1408c2175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408c215d
cmp eax, 0x7d00
jae 0x1408c219b
cmp eax, 0x500
jb 0x1408c2196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408c207e
cmp eax, 0x7f
ja 0x1408c219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408c207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1408c21d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1408c207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140002060
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov eax, dword [rcx + 0x48]
lea rbx, [rcx + 0x28]
mov rdi, qword [rcx]
lea r11, [rcx + 0x28]
add rbx, rax
mov r9, rcx
movabs rbp, 0xc2b2ae3d27d4eb4f
movabs rsi, 0x9e3779b185ebca87
movabs r14, 0x27d4eb2f165667c5
movabs r15, 0x7a1435883d4d519d
cmp rdi, 0x20
jb 0x140002159
mov r8, qword [r9 + 0x18]
mov rdx, qword [rcx + 8]
mov rax, r8
mov r9, qword [r9 + 0x20]
mov rcx, qword [rcx + 0x10]
mov r10, r9
rol r10, 0x12
rol rax, 0xc
add r10, rax
mov rax, rcx
rol rax, 7
add r10, rax
mov rax, rdx
rol rax, 1
add r10, rax
movabs rax, 0x85ebca77c2b2ae63
imul rdx, rbp
imul rcx, rbp
imul r8, rbp
imul r9, rbp
rol rdx, 0x1f
imul rdx, rsi
rol rcx, 0x1f
xor r10, rdx
rol r8, 0x1f
imul r10, rsi
imul rcx, rsi
imul r8, rsi
sub r10, r15
rol r9, 0x1f
xor r10, rcx
imul r10, rsi
imul r9, rsi
sub r10, r15
xor r10, r8
imul r10, rsi
sub r10, r15
xor r10, r9
imul r10, rsi
add rax, r10
add rax, rdi
jmp 0x140002161
lea rax, [rdi + r14]
add rax, qword [rcx + 0x18]
lea rdx, [r11 + 8]
cmp rdx, rbx
ja 0x14000219a
nop word [rax + rax]
mov rcx, qword [r11]
add rdx, 8
imul rcx, rbp
add r11, 8
rol rcx, 0x1f
imul rcx, rsi
xor rax, rcx
rol rax, 0x1b
imul rax, rsi
sub rax, r15
cmp rdx, rbx
jbe 0x140002170
lea rdx, [r11 + 4]
movabs r8, 0x165667b19e3779f9
cmp rdx, rbx
ja 0x1400021c5
mov ecx, dword [r11]
mov r11, rdx
imul rcx, rsi
xor rax, rcx
rol rax, 0x17
imul rax, rbp
add rax, r8
cmp r11, rbx
jae 0x1400021eb
nop word [rax + rax]
movzx ecx, byte [r11]
inc r11
imul rcx, r14
xor rax, rcx
rol rax, 0xb
imul rax, rsi
cmp r11, rbx
jb 0x1400021d0
mov rbx, qword [rsp + 0x18]
mov rcx, rax
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
shr rcx, 0x21
xor rcx, rax
imul rcx, rbp
mov rbp, qword [rsp + 0x20]
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
ret

Function at 0x14000a500
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
mov edi, 0x28
test al, al
je 0x14000a5b1
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.14000fd70
cmp rax, 1
jne 0x14000a5e7
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x14000a58d
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x14000a580
cmp rcx, 1
jb 0x14000a5e7
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x14000a550
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14000c2e0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.14000fa2c
int3
Function at 0x14000a670
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, r8
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000a6b5
xor al, al
jmp 0x14000a702
cmp word [rbx], 0
je 0x14000a6cd
nop dword [rax + rax]
add rbx, 2
dec rdi
cmp word [rbx], 0
jne 0x14000a6c0
cmp word [rsp + 0x30], 0
je 0x14000a6fb
lea rcx, [rsp + 0x30]
sub rcx, rbx
nop dword [rax]
cmp rdi, 1
jb 0x14000a723
movzx eax, word [rcx + rbx]
dec rdi
mov word [rbx], ax
add rbx, 2
cmp word [rcx + rbx], 0
jne 0x14000a6e0
xor eax, eax
mov word [rbx], ax
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000c2e0
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
call fcn.14000fa2c
int3
Function at 0x14000cba0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000cbea
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000cbea
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000cbea
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000cbea
cmp dword [rcx + 0x84], 0xe
jbe 0x14000cbea
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000cbec
xor al, al
add rsp, 0x28
ret

Function at 0x14000f838
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000f8a7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000f8a7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000f8a7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000f8a7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000f8a7
cmp dword [rcx + 0x84], 0xe
jbe 0x14000f8a7
cmp dword [rcx + 0xf8], 0
je 0x14000f8a7
mov ecx, ebx
call fcn.14000f94c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000f740
nop
cmp dword [rbp + 0x20], 0
jne 0x14000f908
call fcn.14001451c
cmp eax, 1
jne 0x14000f8f8
xor dl, dl
jmp 0x14000f902
call fcn.1400144e8
test al, al
sete dl
cmp dword [rbp + 0x20], 0
je 0x14000f913
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000f91c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000f838

Function at 0x14000fa20
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000f8a7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000f8a7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000f8a7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000f8a7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000f8a7
cmp dword [rcx + 0x84], 0xe
jbe 0x14000f8a7
cmp dword [rcx + 0xf8], 0
je 0x14000f8a7
mov ecx, ebx
call fcn.14000f94c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000f740
nop
cmp dword [rbp + 0x20], 0
jne 0x14000f908
call fcn.14001451c
cmp eax, 1
jne 0x14000f8f8
xor dl, dl
jmp 0x14000f902
call fcn.1400144e8
test al, al
sete dl
cmp dword [rbp + 0x20], 0
je 0x14000f913
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000f91c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000f838
Function at 0x140019218
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14001929f
mov rsi, rbx
cmp word [rax], bp
je 0x14001925e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140019248
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140019244
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140016750
mov rdi, rax
test rax, rax
je 0x14001928c
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400204a0
mov rbp, rdi
xor ecx, ecx
call fcn.140015730
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001b7c0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001b7d6
mov al, 1
jmp 0x14001b842
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001b7e7
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001b840
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400199bc
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001b840
and qword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
mov r9d, 1
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001b840
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001b840
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001b842
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14001fc80
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001fca8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001fca8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x416da4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
test rdx, rdx
mov rsi, rdx
mov rbp, rcx
je 0x416dfe
call fcn.0041e578
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x416dfe
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rbx, rax
je 0x416e20
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.00416824
test rdi, rdi
mov esi, eax
je 0x416e1e
test rbx, rbx
je 0x416e1e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
add rsp, 0x20
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x42c967
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x00455400]
jne 0x42755a
rol rcx, 0x10
test cx, 0xffff
jne 0x427556
repz ret
ror rcx, 0x10
jmp 0x42c8c0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x0045ae90]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x0045af88]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x42c945
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x0045ae90]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x42c967
mov rax, qword [rsp + 0x88]
mov qword [0x0045af88], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x0045af28], rax
mov rax, qword [0x0045af88]
mov qword [0x0045ae00], rax
mov rax, qword [rsp + 0x90]
mov qword [0x0045af10], rax
mov dword [0x0045adf0], 0xc0000409
mov dword [0x0045adf4], 1
mov rax, qword [0x00455400]
mov qword [rsp + 0x68], rax
mov rax, qword [0x00455408]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x0045ae88], eax
mov ecx, 1
call fcn.0042cb60
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x00446b98]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x0045ae88], 0
jne 0x42c9ee
mov ecx, 1
call fcn.0042cb60
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x435c80
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.0042c230
xor ebx, ebx
cmp qword [0x0045b730], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x435db1
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x435ce3
xor eax, eax
jmp 0x435e91
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x435cdc
mov rcx, rax
call fcn.0042c1c0
lea rdx, [0x00446d30]
mov rcx, rbp
mov qword [0x0045b730], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0042c1c0
lea rdx, [0x00446d18]
mov rcx, rbp
mov qword [0x0045b738], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0042c1c0
lea rcx, [rsp + 0x30]
mov qword [0x0045b740], rax
call fcn.004293b0
test eax, eax
je 0x435d67
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.00427970
cmp dword [rsp + 0x30], 2
jne 0x435db1
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0042c1c0
test rax, rax
mov qword [0x0045b750], rax
je 0x435db1
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0042c1c0
mov qword [0x0045b748], rax
mov rcx, qword [0x0045b748]
cmp rcx, rsi
je 0x435e43
cmp qword [0x0045b750], rsi
je 0x435e43
call fcn.0042c290
call rax
test rax, rax
mov rbp, rax
je 0x435e0e
mov rcx, qword [0x0045b750]
call fcn.0042c290
lea rcx, [rsp + 0x38]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x435e0e
test byte [rsp + 0x48], 1
jne 0x435e43
lea rcx, [rsp + 0x34]
call fcn.00429400
test eax, eax
je 0x435e30
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.00427970
cmp dword [rsp + 0x34], 4
jb 0x435e3d
bts edi, 0x15
jmp 0x435e77
bts edi, 0x12
jmp 0x435e77
mov rcx, qword [0x0045b738]
cmp rcx, rsi
je 0x435e77
call fcn.0042c290
call rax
test rax, rax
mov rbx, rax
je 0x435e77
mov rcx, qword [0x0045b740]
cmp rcx, rsi
je 0x435e77
call fcn.0042c290
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x0045b730]
call fcn.0042c290
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x140001090
Capabilities:
Allocate or change rwx memory
Get file size
Read file on windows

Disassembly:
sub rsp, 0x78
mov dword [rsp + 0x74], 0
mov dword [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
call fcn.1400011a0
lea rcx, str.temp.bin
mov edx, 0x80000000
xor r8d, r8d
xor eax, eax
mov r9d, eax
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x68], rax
mov rax, 0xffffffffffffffff
cmp qword [rsp + 0x68], rax
jne 0x140001108
mov dword [rsp + 0x74], 0
jmp 0x14000118d
mov rcx, qword [rsp + 0x68]
xor eax, eax
mov edx, eax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x5c]
mov edx, eax
xor eax, eax
mov ecx, eax
mov r8d, 0x1000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
jne 0x140001160
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x74], 0
jmp 0x14000118d
mov r8d, dword [rsp + 0x5c]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x58]
xor eax, eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0x74], 0
mov eax, dword [rsp + 0x74]
add rsp, 0x78
ret

Function at 0x1400011a0
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x138
xor eax, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400011d2
mov dword [rsp + 0x134], 0
jmp 0x14000124b
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, 0
jne 0x140001201
mov dword [rsp + 0x134], 0
jmp 0x14000124b
lea rcx, [rsp + 0x30]
mov edx, 0x5c
call section..text
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140001231
mov dword [rsp + 0x134], 0
jmp 0x14000124b
mov rax, qword [rsp + 0x28]
mov byte [rax], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [rsp + 0x134], eax
mov eax, dword [rsp + 0x134]
add rsp, 0x138
ret
Function at 0x22cbd1370
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0x1a0
lea rbp, [rsp + 0x80]
lea rax, [rbp - 0x60]
lea rdx, section..rdata
mov ecx, 0x2f
mov rdi, rax
mov rsi, rdx
rep movsq qword [rdi], qword [rsi]
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x178
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x118]
mov rdx, rax
lea rax, [rbp - 0x60]
mov ecx, 0x178
mov r8, qword [rax]
mov qword [rdx], r8
mov r8d, ecx
add r8, rdx
lea r9, [r8 + 8]
mov r8d, ecx
add r8, rax
add r8, 8
mov r8, qword [r8 - 0x10]
mov qword [r9 - 0x10], r8
lea r8, [rdx + 8]
and r8, 0xfffffffffffffff8
sub rdx, r8
sub rax, rdx
add ecx, edx
and ecx, 0xfffffff8
shr ecx, 3
mov edx, ecx
mov edx, edx
mov rdi, r8
mov rsi, rax
mov rcx, rdx
rep movsq qword [rdi], qword [rsi]
mov rax, qword [rbp + 0x118]
call rax
mov eax, 1
add rsp, 0x1a0
pop rsi
pop rdi
pop rbp
ret

Function at 0x22cbd1435
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov qword [rbp + 0x20], r8
cmp dword [rbp + 0x18], 3
je 0x22cbd149f
cmp dword [rbp + 0x18], 3
ja 0x22cbd14a6
cmp dword [rbp + 0x18], 2
je 0x22cbd14a2
cmp dword [rbp + 0x18], 2
ja 0x22cbd14a6
cmp dword [rbp + 0x18], 0
je 0x22cbd14a5
cmp dword [rbp + 0x18], 1
jne 0x22cbd14a6
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.evil.dll_Entry__]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
jmp 0x22cbd14a6
nop
jmp 0x22cbd14a6
nop
jmp 0x22cbd14a6
nop
mov eax, 1
add rsp, 0x30
pop rbp
ret

Function at 0x22cbd1660
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]
Function at 0x22cbd16d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x22cbd7064]
mov rbx, rcx
test esi, esi
jle 0x22cbd1800
mov rax, qword [0x22cbd7068]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x22cbd171b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x22cbd17a5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x22cbd1700
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
mov rdi, rax
test rax, rax
je 0x22cbd1822
mov rax, qword [0x22cbd7068]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call dbg._GetPEImageBase
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x22cbd7068]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x22cbd1807
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x22cbd179e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x22cbd17b0
add dword [0x22cbd7064], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x22cbd7068]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x22cbd179e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop dword [rax]
xor esi, esi
jmp 0x22cbd1728
mov rax, qword [0x22cbd7068]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x22cbd1ba0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x22cbd70a0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x22cbd7080]
test rbx, rbx
je 0x22cbd1bfc
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x22cbd1bf3
test rsi, rsi
je 0x22cbd1bf3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x22cbd1bd8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x22cbd1e10
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x22cbd1e28
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x22cbd1e30
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret