joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc52f570
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc530650
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc52ff72
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc552108]
test eax, eax
je 0x2fc53000a
lea rax, [0x2fc5520e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc552110]
mov qword [rbp - 8], rax
jmp 0x2fc52ffee
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc52ffe2
cmp qword [rbp - 0x10], 0
je 0x2fc52ffe2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc52ffa8
lea rax, [0x2fc5520e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc53000b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc530110
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc530138
mov eax, 0
jmp 0x2fc530186
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc530161
mov eax, 0
jmp 0x2fc530186
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc530181
mov eax, 0
jmp 0x2fc530186
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc53018c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc53020a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc530201
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc530201
mov rax, qword [rbp - 8]
jmp 0x2fc53021f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc5301d4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc53fbb0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc540c90
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc5405b2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc563108]
test eax, eax
je 0x2fc54064a
lea rax, [0x2fc5630e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc563110]
mov qword [rbp - 8], rax
jmp 0x2fc54062e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc540622
cmp qword [rbp - 0x10], 0
je 0x2fc540622
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc5405e8
lea rax, [0x2fc5630e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc54064b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc540750
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc540778
mov eax, 0
jmp 0x2fc5407c6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc5407a1
mov eax, 0
jmp 0x2fc5407c6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc5407c1
mov eax, 0
jmp 0x2fc5407c6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc5407cc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc54084a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc540841
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc540841
mov rax, qword [rbp - 8]
jmp 0x2fc54085f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc540814
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140008780
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 0
mov qword [rbp + 0x3d0], 2
mov qword [rbp + 0x3d8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor ebx, ebx
xor edi, edi
xor r12d, r12d
cmp r8, 0x201
jae 0x140008820
jmp 0x14000880f
jae 0x1400088e0
cmp r8, 0x201
jae 0x140008820
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x140008878
sub r8, r12
sub rdi, r12
cmp rdi, r8
jae 0x14000884f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.140022bc0
mov rbx, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp rbx, rax
mov r12d, 0xffffffff
cmovb r12, rbx
mov qword [rbp + 0x3d8], r12
mov rdi, rbx
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x1400088a1
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x140008948
mov r8d, r14d
cmp r15, r8
jne 0x140008800
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140008975
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x14000880f
jmp 0x140008820
cmp rsi, r8
jb 0x14000898f
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.14000b7e0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rbx, rbx
je 0x140008931
add rbx, rbx
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rbx
call fcn.140004920
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
test rbx, rbx
jne 0x140008919
jmp 0x140008931
lea rcx, str.internal_error:_entered_unreachable_code_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrary_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.140023690
jmp 0x1400089a4
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.140023ae0
ud2
Function at 0x140009170
Capabilities:
Create directory

Disassembly:
cmp byte [rcx], 0
je 0x140009180
mov rcx, rdx
mov rdx, r8
jmp fcn.140009190
mov rcx, rdx
mov rdx, r8
jmp fcn.1400118d0

Function at 0x1400118d0
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.140014330
mov rax, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
movabs rbx, 0x8000000000000000
cmp rax, rbx
je 0x140011991
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov r8b, 1
call fcn.140013070
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
cmp rdi, rbx
je 0x140011991
mov rcx, rsi
xor edx, edx
call qword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
je 0x140011965
test rdi, rdi
je 0x140011961
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.140004920
xor esi, esi
jmp 0x140011991
call qword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
shl rbx, 0x20
or rbx, 2
test rdi, rdi
je 0x14001198e
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.140004920
mov rsi, rbx
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x140012210
Capabilities:
Copy file

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r9
mov rsi, rcx
lea rcx, [rbp - 0x18]
call fcn.140014330
mov rax, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x10]
movabs r14, 0x8000000000000000
cmp rax, r14
je 0x14001227c
mov rcx, qword [rbp - 8]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x18]
mov r8b, 1
call fcn.140013070
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x38]
cmp rax, r14
jne 0x140012297
mov qword [rsi + 8], rdx
mov qword [rsi], 1
mov rax, rsi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x28], rdx
mov r8, qword [rbp + 0x60]
lea rcx, [rbp - 0x18]
mov rdx, rdi
call fcn.140014330
mov rax, qword [rbp - 0x18]
mov rdi, qword [rbp - 0x10]
cmp rax, r14
je 0x1400122e9
mov rcx, qword [rbp - 8]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rcx
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x18]
mov r8b, 1
call fcn.140013070
mov rbx, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x38]
cmp rbx, r14
jne 0x14001231a
mov r14, qword [rbp - 0x28]
mov r15, qword [rbp - 0x20]
mov qword [rsi + 8], rdi
mov qword [rsi], 1
test r15, r15
je 0x140012287
add r15, r15
mov r8d, 2
mov rcx, r14
mov rdx, r15
call fcn.140004920
jmp 0x140012287
mov qword [rbp - 0x18], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r8, [0x1400123f0]
lea r9, [rbp - 0x18]
mov r14, qword [rbp - 0x28]
mov rcx, r14
mov rdx, rdi
call qword [sym.imp.kernel32.dll_CopyFileExW]
test eax, eax
mov r15, qword [rbp - 0x20]
je 0x14001236c
mov rax, qword [rbp - 0x18]
mov qword [rsi + 8], rax
mov qword [rsi], 0
test rbx, rbx
jne 0x14001238e
jmp 0x1400122fc
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
test rbx, rbx
je 0x1400122fc
add rbx, rbx
mov r8d, 2
mov rcx, rdi
mov rdx, rbx
call fcn.140004920
jmp 0x1400122fc
Function at 0x140012410
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x1400270b0]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x140012454
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1400124ba
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x1400124f1
test eax, eax
js 0x1400124cb
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1400124e4
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x140027110]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.14000b410
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.1400069c0
mov ecx, 7
int 0x29
ud2
Function at 0x140020c30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x140020caa
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140020ca0
cmp r11, r10
ja 0x140020d41
cmp r10, rdx
ja 0x140020d53
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x140020ca2
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140020c80
jmp 0x140020d17
ja 0x140020caa
mov r11, r10
cmp rax, r8
jne 0x140020c52
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x140020d1b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x140020cf0
mov r8, r10
sub ecx, r9d
jns 0x140020d0e
jmp 0x140020d1d
cmp r10, rdx
je 0x140020d29
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x140020d1d
xor al, 1
cmp r8, rdx
jne 0x140020cd0
jmp 0x140020d1d
xor eax, eax
jmp 0x140020d1d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x1400299bb]
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140023690
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140023b60
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140023ae0
int3

Function at 0x140022394
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x1400223de
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400223de
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400223de
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400223de
cmp dword [rcx + 0x84], 0xe
jbe 0x1400223de
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400223e0
xor al, al
add rsp, 0x28
ret
Function at 0x120002080
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.12000a900
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.12000a900
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x1200020f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x1205fc0c4]
mov r12, rcx
test ebx, ebx
jle 0x120002220
mov rax, qword [0x1205fc0c8]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x12000213c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x1200021c3
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x120002120
mov rcx, r12
call fcn.120002aa0
mov rsi, rax
test rax, rax
je 0x120002242
mov rax, qword [0x1205fc0c8]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call fcn.120002bd0
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1205fc0c8]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x120002227
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1200021bc
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1200021d0
add dword [0x1205fc0c4], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x1205fc0c8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1200021bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.120002080
nop dword [rax]
xor ebx, ebx
jmp 0x120002147
mov rax, qword [0x1205fc0c8]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.120002080
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.120002080
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x120002710
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x1205fc120]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1205fc100]
test rbx, rbx
je 0x120002764
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x12000275b
test r12, r12
je 0x12000275b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x120002740
lea rcx, [0x1205fc120]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x120002aa0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1205c9c10]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x120002ac0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x120002ac8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x120002ac0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x120002b15
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x120002b0c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x120002ac0
add rax, 0x28
cmp rax, r9
jne 0x120002af8
xor eax, eax
ret

Function at 0x120002b20
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1205c9c10]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x120002b40
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x120002b48
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x120002b40
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x120002bd0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1205c9c10]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x120002bf0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x120002bf8
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x1200d3740
Capabilities:
Get session user name

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
xor edx, edx
xor r8d, r8d
lea r12, [rsp + 0x30]
mov word [rsp + 0x40], dx
mov r13, rcx
lea rbp, [rsp + 0x40]
mov edx, pe_nt_image_headers64
mov rcx, r12
mov qword [rsp + 0x30], rbp
lea rsi, [rsp + 0x2c]
mov qword [rsp + 0x38], 0
call fcn.120001ca0
mov rax, qword [rsp + 0x38]
mov rbx, qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2c], eax
jmp 0x1200d37c4
call rdi
cmp eax, 0x7a
jne 0x1200d3820
mov rax, qword [rsp + 0x38]
xor r8d, r8d
mov rcx, r12
lea rdx, [rax + rax]
call fcn.120001ca0
mov rax, qword [rsp + 0x38]
mov dword [rsp + 0x2c], eax
mov rcx, qword [rsp + 0x30]
mov rdx, rsi
call rbx
test eax, eax
je 0x1200d37a0
mov eax, dword [rsp + 0x2c]
xor r8d, r8d
mov rcx, r12
lea edx, [rax - 1]
call fcn.120001ca0
lea rax, [r13 + 0x10]
mov qword [r13], rax
mov rax, qword [rsp + 0x30]
cmp rax, rbp
je 0x1200d3860
mov qword [r13], rax
mov rax, qword [rsp + 0x40]
mov qword [r13 + 0x10], rax
mov rax, qword [rsp + 0x38]
mov qword [r13 + 8], rax
mov rax, r13
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rax, [r13 + 0x10]
mov rcx, qword [rsp + 0x30]
mov qword [r13 + 8], 0
mov qword [r13], rax
xor eax, eax
mov word [r13 + 0x10], ax
cmp rcx, rbp
je 0x1200d3850
mov rax, qword [rsp + 0x40]
lea rdx, [rax + rax + 2]
call sub.libstdc_6.dll_operator_delete_void__unsigned_long_long_
mov rax, r13
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
movdqu xmm0, xmmword [rsp + 0x40]
movups xmmword [r13 + 0x10], xmm0
jmp 0x1200d3803