joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ab260
Capabilities:
Parse pe header

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
movzx eax, word [rdx]
cmp eax, 0x5a4d
jne 0x1400ab2c2
mov rdi, rdx
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x1400ab2c2
cmp dword [0x1406e7ac4], 0xa
jl 0x1400ab322
mov ecx, dword [0x1406e7ac0]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x1400ab322
nop word cs:[rax + rax]
nop
jmp 0x1400ab2c0
cmp dword [0x1406e7ac4], 0xa
jl 0x1400ab2e2
mov eax, dword [0x1406e7ac0]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400ab2e2
nop dword [rax]
jmp 0x1400ab2e0
cmp dword [0x1406e8224], 0xa
jl 0x1400ab302
mov eax, dword [0x1406e8220]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400ab302
nop dword [rax]
jmp 0x1400ab300
cmp dword [0x1406e7bd0], 0xa
jl 0x1400ab342
mov eax, dword [0x1406e7bd4]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400ab342
nop dword [rax]
jmp 0x1400ab320
cmp dword [0x1406e8224], 0xa
jl 0x1400ab364
mov ecx, dword [0x1406e8220]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x1400ab364
nop dword [rax]
jmp 0x1400ab340
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
cmp dword [0x1406e7bd0], 0xa
jl 0x1400ab382
mov ecx, dword [0x1406e7bd4]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x1400ab382
nop
jmp 0x1400ab380
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], 0
mov ebx, dword [rdi + rax + 0xb0]
test rbx, rbx
je 0x1400ab345
add rbx, rdi
mov r12d, dword [rdi + rax + 0xb4]
add r12, rbx
cmp rbx, r12
jae 0x1400ab41d
movabs r13, 0x1fffffff8
lea r14, [rbp - 0x20]
lea r15, [rbp - 0x38]
jmp 0x1400ab3e3
mov rax, qword [rbp - 0x28]
mov qword [rdx + 0x10], rax
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [rdx], xmm0
add qword [rbp - 0x18], 0x18
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, r12
jae 0x1400ab41d
cmp dword [rbx + 4], 0
je 0x1400ab41d
mov eax, dword [rbx]
add rax, rdi
mov qword [rbp - 0x38], rax
lea rax, [rbx + 8]
mov qword [rbp - 0x30], rax
mov eax, dword [rbx + 4]
add rax, r13
shr rax, 1
mov dword [rbp - 0x28], eax
mov rdx, qword [rbp - 0x18]
cmp rdx, qword [rbp - 0x10]
jne 0x1400ab3c4
mov rcx, r14
mov r8, r15
call fcn.1400ac1e0
jmp 0x1400ab3d8
cmp dword [0x1406e7ad4], 0xa
jl 0x1400ab442
mov eax, dword [0x1406e7ad0]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400ab442
nop word [rax + rax]
jmp 0x1400ab440
mov rax, qword [rbp - 0x10]
movaps xmm0, xmmword [rbp - 0x20]
cmp dword [0x1406e82cc], 0xa
jl 0x1400ab472
mov ecx, dword [0x1406e82c8]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x1400ab472
nop word cs:[rax + rax]
nop
jmp 0x1400ab470
cmp dword [0x1406e82e4], 0xa
jl 0x1400ab492
mov ecx, dword [0x1406e82e0]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x1400ab492
nop dword [rax]
jmp 0x1400ab490
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rax
jmp 0x1400ab350
Function at 0x1400b0ad0
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, r8
mov r12, rdx
mov r13, rcx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rsi, rax
movsxd rax, dword [r12 + 0x3c]
movzx ebx, word [rax + r12 + 6]
test rbx, rbx
je 0x1400b0b66
movzx ecx, word [rax + r12 + 0x14]
add rax, r12
lea rdi, [rcx + rax]
add rdi, 0x18
xor r15d, r15d
jmp 0x1400b0b2a
add rdi, 0x28
add rbx, 0xffffffffffffffff
je 0x1400b0b69
mov rcx, rdi
mov rdx, r13
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400b0b20
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
cmp rsi, rax
jne 0x1400b0b20
mov eax, dword [rdi + 0xc]
test eax, eax
je 0x1400b0b66
test r14, r14
je 0x1400b0b5e
mov eax, dword [rdi + 8]
mov dword [r14], eax
mov eax, dword [rdi + 0xc]
mov r15d, eax
add r15, r12
jmp 0x1400b0b69
xor r15d, r15d
mov rax, r15
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400da920
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x1406de900]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov word [rsp + 0x28], 0x6277
mov byte [rsp + 0x2a], 0
movups xmm0, xmmword [0x140265884]
movups xmmword [rsp + 0x3a], xmm0
movups xmm0, xmmword [0x14026587a]
mov eax, dword [0x1406f0f08]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x1406f0f0c], 0xa
movaps xmmword [rsp + 0x30], xmm0
setl al
or al, cl
mov cl, 0x49
je 0x1400da9d0
jmp 0x1400daa19
test cl, cl
je 0x1400da9c3
movaps xmm1, xmmword [rsp + 0x30]
xorps xmm1, xmm0
movaps xmmword [rsp + 0x30], xmm1
xor byte [rsp + 0x40], 0x40
xor byte [rsp + 0x41], 0x41
xor byte [rsp + 0x42], 0x42
xor byte [rsp + 0x43], 0x43
xor byte [rsp + 0x44], 0x44
xor byte [rsp + 0x45], 0x45
xor byte [rsp + 0x46], 0x46
xor byte [rsp + 0x47], 0x47
xor byte [rsp + 0x48], 0x48
xor byte [rsp + 0x49], 0x49
test al, al
jne 0x1400daa25
xor ecx, ecx
cmp byte [rsp + 0x49], 0
je 0x1400da980
movaps xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [str.0123456789:____]
movaps xmmword [rsp + 0x30], xmm0
xor byte [rsp + 0x40], 0x40
xor byte [rsp + 0x41], 0x41
xor byte [rsp + 0x42], 0x42
xor byte [rsp + 0x43], 0x43
xor byte [rsp + 0x44], 0x44
xor byte [rsp + 0x45], 0x45
xor byte [rsp + 0x46], 0x46
xor byte [rsp + 0x47], 0x47
xor byte [rsp + 0x48], 0x48
mov cl, byte [rsp + 0x49]
xor cl, 0x49
mov byte [rsp + 0x49], cl
movaps xmm0, xmmword [str.0123456789:____]
jmp 0x1400da980
lea rcx, [0x1406eef20]
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov rsi, qword [0x1406eef20]
test rsi, rsi
je 0x1400dab14
cmp dword [0x1406dfff4], 0xa
jl 0x1400daa66
mov eax, dword [0x1406dfff0]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x1400daa9b
lea rcx, [0x1406eeda8]
mov edx, 0x178
mov r8d, 1
mov r9, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp dword [0x1406dfff4], 0xa
jl 0x1400daab8
mov eax, dword [0x1406dfff0]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400daab8
lea rcx, [0x1406eeda8]
mov edx, 0x178
mov r8d, 1
mov r9, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x1400daa66
mov rsi, qword [0x1406eef20]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
cmp dword [0x1406dfff4], 0xa
jl 0x1400dab14
mov eax, dword [0x1406dfff0]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400dab14
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
nop dword [rax]
mov rcx, rsi
call rdi
mov rcx, rsi
call rdi
cmp dword [0x1406dfff4], 0xa
jl 0x1400dab14
mov eax, dword [0x1406dfff0]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x1400daaf0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401fc630
nop
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x14011ffa0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xc0
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x30], xmm11
movaps xmmword [rbp + 0x20], xmm10
movaps xmmword [rbp + 0x10], xmm9
movaps xmmword [rbp], xmm8
movdqa xmmword [rbp - 0x10], xmm7
movdqa xmmword [rbp - 0x20], xmm6
mov qword [rbp - 0x28], 0xfffffffffffffffe
cmp dword [0x1406f1548], 0xa
jl 0x14012001e
mov eax, dword [0x1406f154c]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x14012001e
movups xmm0, xmmword [0x14026458d]
movups xmm1, xmmword [0x140264580]
movups xmm2, xmmword [0x140264570]
nop word [rax + rax]
movups xmmword [rbp - 0x43], xmm0
movaps xmmword [rbp - 0x50], xmm1
movaps xmmword [rbp - 0x60], xmm2
jmp 0x140120010
movups xmm0, xmmword [0x14026458d]
movups xmmword [rbp - 0x43], xmm0
movups xmm0, xmmword [0x140264580]
movaps xmmword [rbp - 0x50], xmm0
movdqu xmm0, xmmword [0x140264570]
movdqa xmmword [rbp - 0x60], xmm0
mov eax, dword [0x1406f12f0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x1406f12f4], 0xa
setl al
or al, cl
movdqa xmm8, xmmword [0x140258800]
xor ecx, ecx
movdqa xmm11, xmmword [0x140265510]
movdqa xmm5, xmmword [0x140265520]
movdqa xmm3, xmmword [str.0000000000000000]
movdqa xmm4, xmmword [0x140258820]
movdqa xmm9, xmmword [str.0123456789:____]
movdqa xmm10, xmmword [str._ABCDEFGHIJKLMNO]
nop dword [rax]
movdqa xmm6, xmm8
movdqu xmm0, xmmword [rbp + rcx - 0x60]
movdqa xmm1, xmm11
psubb xmm1, xmm6
pand xmm1, xmm5
movdqa xmm7, xmm6
paddb xmm7, xmm3
movdqa xmm2, xmm5
pandn xmm2, xmm7
por xmm2, xmm1
pxor xmm0, xmm5
pxor xmm0, xmm2
movdqu xmmword [rbp + rcx - 0x60], xmm0
add rcx, 0x10
paddb xmm6, xmm4
cmp rcx, 0x20
jne 0x1401200a5
xor byte [rbp - 0x40], 0x50
xor byte [rbp - 0x3f], 0x51
xor byte [rbp - 0x3e], 0x52
xor byte [rbp - 0x3d], 0x53
xor byte [rbp - 0x3c], 0x54
xor byte [rbp - 0x3b], 0x55
xor byte [rbp - 0x3a], 0x56
xor byte [rbp - 0x39], 0x57
xor byte [rbp - 0x38], 0x58
xor byte [rbp - 0x37], 0x59
xor byte [rbp - 0x36], 0x5a
xor byte [rbp - 0x35], 0x5b
xor byte [rbp - 0x34], 0x5c
test al, al
jne 0x140120179
movdqa xmm0, xmmword [rbp - 0x50]
pxor xmm0, xmm10
movdqa xmm1, xmmword [rbp - 0x60]
pxor xmm1, xmm9
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmmword [rbp - 0x50], xmm0
xor byte [rbp - 0x40], 0x50
xor byte [rbp - 0x3f], 0x51
xor byte [rbp - 0x3e], 0x52
xor byte [rbp - 0x3d], 0x53
xor byte [rbp - 0x3c], 0x54
xor byte [rbp - 0x3b], 0x55
xor byte [rbp - 0x3a], 0x56
xor byte [rbp - 0x39], 0x57
xor byte [rbp - 0x38], 0x58
xor byte [rbp - 0x37], 0x59
xor byte [rbp - 0x36], 0x5a
xor byte [rbp - 0x35], 0x5b
xor byte [rbp - 0x34], 0x5c
xor ecx, ecx
jmp 0x1401200a0
lea rsi, [0x1406eea50]
mov rcx, rsi
call fcn.1400abec0
lea rdi, [rbp - 0x60]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, rsi
mov rdx, rdi
mov r8, rax
call fcn.14008d7b0
lea rcx, [0x140120270]
call fcn.1401fc650
movaps xmm6, xmmword [rbp - 0x20]
movaps xmm7, xmmword [rbp - 0x10]
movaps xmm8, xmmword [rbp]
movaps xmm9, xmmword [rbp + 0x10]
movaps xmm10, xmmword [rbp + 0x20]
movaps xmm11, xmmword [rbp + 0x30]
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140150cd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], 0xfffffffffffffffe
lea rdi, [0x1406ee548]
mov qword [rbp - 0x10], rcx
cmp rcx, rdi
je 0x140150d24
mov rax, qword [rbp - 0x10]
mov rsi, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
mov r9, rax
jb 0x140150d09
mov r9, qword [rax]
mov rax, qword [0x1406ee560]
cmp rax, rsi
jae 0x140150d2f
lea rcx, [0x1406ee548]
mov rdx, rsi
call fcn.1400ac710
cmp dword [0x1406e0b24], 0xa
jge 0x140150d83
jmp 0x140150da2
mov ecx, dword [0x1406f0ab0]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
sete dl
cmp dword [0x1406f0ab4], 0xa
setl cl
or cl, dl
nop dword [rax]
test cl, cl
je 0x140150d50
cmp rax, 0x10
jb 0x140150d61
mov rdi, qword [0x1406ee548]
mov qword [0x1406ee558], rsi
mov rcx, rdi
mov rdx, r9
mov r8, rsi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rsi], 0
cmp dword [0x1406e0b24], 0xa
jl 0x140150da2
mov eax, dword [0x1406e0b20]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x140150da2
nop word cs:[rax + rax]
nop
jmp 0x140150da0
mov rdi, qword [0x1406eef30]
test rdi, rdi
je 0x140150e07
xor eax, eax
lea rcx, [0x140179af0]
lea rdx, [0x1406eef30]
nop
cmp rdi, rcx
je 0x140150dd3
add eax, 1
mov rdi, qword [rdx + rax*8]
test rdi, rdi
jne 0x140150dc0
jmp 0x140150e07
mov eax, eax
lea rcx, [0x1406ef250]
mov rsi, qword [rcx + rax*8]
test rsi, rsi
je 0x140150e07
mov edx, dword [0x1406e0b28]
mov eax, dword [0x1406e0b2c]
lea ecx, [rdx - 1]
imul ecx, edx
and ecx, 1
test ecx, ecx
jne 0x140150e9c
jmp 0x140150ea1
mov edx, 0x1f4
xor ecx, ecx
mov r8d, 0x1000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
je 0x140150e3d
lea rdx, [0x140179af0]
mov r8d, 0x1f4
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [0x1406eef28]
lea rax, [0x1406eef30]
lea rcx, [0x140179af0]
mov qword [rax + rdx*8], rcx
mov edi, dword [0x1406e0b28]
mov eax, dword [0x1406e0b2c]
lea ecx, [rdi - 1]
imul ecx, edi
and ecx, 1
cmp eax, 0xa
jl 0x140150e82
test ecx, ecx
je 0x140150e82
nop word cs:[rax + rax]
nop
jmp 0x140150e80
lea rdi, [0x1406ef250]
mov qword [rdi + rdx*8], rsi
add rdx, 1
mov qword [0x1406eef28], rdx
test ecx, ecx
je 0x140150ea1
cmp eax, 9
jg 0x140150ec4
lea rcx, [0x14014fcf0]
call rsi
cmp dword [0x1406e0b2c], 0xa
jl 0x140150ecf
mov eax, dword [0x1406e0b28]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x140150ecf
lea rcx, [0x14014fcf0]
call rsi
jmp 0x140150ea1
mov rsi, qword [rbp - 0x10]
mov r8, qword [rsi + 0x18]
cmp r8, 0x10
jb 0x140150eec
mov rdx, qword [rsi]
add r8, 1
mov rcx, rsi
call fcn.14017a700
movaps xmm0, xmmword [0x1402599c0]
movups xmmword [rsi + 0x10], xmm0
mov byte [rsi], 0
cmp dword [0x1406f0a30], 0xa
jl 0x140150f22
mov eax, dword [0x1406f0a34]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x140150f22
nop word cs:[rax + rax]
nop
jmp 0x140150f20
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401e1310
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push rdi
sub rsp, 0x1a0
mov rax, qword [0x1406de900]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x58]
mov rdi, rax
xor eax, eax
mov ecx, Ordinal_27
rep stosb byte [rdi], al
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
lea rax, [rsp + 0xe0]
mov rdi, rax
xor eax, eax
mov ecx, 0xb0
rep stosb byte [rdi], al
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov r8d, 0x10002
mov edx, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
mov edx, 0xffffffff
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1401fc630
add rsp, 0x1a0
pop rdi
ret
Function at 0x1401e1410
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
sub rsp, 0x60
mov rax, qword [0x1406de900]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1401e143f
jmp 0x1401e15a5
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov ecx, 8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
jmp 0x1401e14ac
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x20]
add rax, 0x28
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x28], eax
jae 0x1401e154b
lea r9, [rsp + 0x50]
mov r8d, 0x40
mov edx, Ordinal_41
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0xff
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x20]
mov byte [rdx + rcx], al
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 0x20]
mov byte [rcx + rax], 0
mov rax, qword [rsp + 0x20]
mov dword [rax + 0xc], 0
mov rax, qword [rsp + 0x20]
mov dword [rax + 8], 0
mov rax, qword [rsp + 0x20]
mov dword [rax + 8], 0
lea r9, [rsp + 0x50]
mov r8d, dword [rsp + 0x50]
mov edx, Ordinal_41
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1401e1494
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
lea r9, [rsp + 0x54]
mov r8d, 0x40
mov edx, 8
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x40], rax
lea r9, [rsp + 0x54]
mov r8d, dword [rsp + 0x54]
mov edx, 8
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401fc630
add rsp, 0x60
pop rdi
ret
Function at 0x1401e15c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
sub rsp, 0x70
mov rax, qword [0x1406de900]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rcx, [0x140269130]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1401e15f6
xor eax, eax
jmp 0x1401e16fb
lea rdx, str.DbgUiRemoteBreakin
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1401e161c
xor eax, eax
jmp 0x1401e16fb
lea rcx, [0x140269158]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1401e163d
xor eax, eax
jmp 0x1401e16fb
lea rdx, [0x140269168]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x1401e1663
xor eax, eax
jmp 0x1401e16fb
lea rax, [rsp + 0x48]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WS2_32.dll_sendto
rep stosb byte [rdi], al
mov eax, 0x6a
mov word [rsp + 0x48], ax
mov byte [rsp + 0x4a], 0x68
mov dword [rsp + 0x4c], 0xffffffff
mov byte [rsp + 0x50], 0xb8
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x54], eax
mov eax, 0xd0ff
mov word [rsp + 0x58], ax
lea r9, [rsp + 0x40]
mov r8d, 4
mov edx, reloc.WS2_32.dll_sendto
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1401e16c5
xor eax, eax
jmp 0x1401e16fb
mov r9d, reloc.WS2_32.dll_sendto
lea r8, [rsp + 0x48]
mov edx, reloc.WS2_32.dll_sendto
mov rcx, qword [rsp + 0x20]
call fcn.1401c27f0
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x40]
mov edx, reloc.WS2_32.dll_sendto
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401fc630
add rsp, 0x70
pop rdi
ret
Function at 0x1401e1710
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x58
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1401e189d
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0
jmp 0x1401e178a
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x30]
add rax, 0x28
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x20], eax
jge 0x1401e189d
xor eax, eax
add rax, 0x7b
mov ecx, 1
imul rcx, rcx, 0
lea rdx, str..SCY
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x24], al
mov eax, 1
add rax, 0x7b
mov ecx, 1
imul rcx, rcx, 1
lea rdx, str..SCY
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x25], al
mov eax, 2
add rax, 0x7b
mov ecx, 1
imul rcx, rcx, 2
lea rdx, str..SCY
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x26], al
mov eax, 3
add rax, 0x7b
mov ecx, 1
imul rcx, rcx, 3
lea rdx, str..SCY
movsx rcx, byte [rdx + rcx]
xor rcx, rax
mov rax, rcx
mov byte [rsp + 0x27], al
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x29], 1
lea rcx, [rsp + 0x24]
call fcn.1401ddb00
lea rax, [rsp + 0x24]
mov rax, qword [rsp + 0x30]
mov rax, qword [rsp + 0x30]
lea rcx, [rsp + 0x24]
sub rcx, rax
movzx edx, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x1401e1878
inc rax
test dl, dl
jne 0x1401e1865
xor eax, eax
jmp 0x1401e187d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1401e1898
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [0], 0x1565
xor ecx, ecx
int 0x29
jmp 0x1401e1772
add rsp, 0x58
ret

Function at 0x1401e1930
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x28
mov rax, qword gs:[0x60]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
mov rax, qword [rax + 0x18]
mov ecx, 8
imul rcx, rcx, 1
mov rax, qword [rax + rcx + 8]
mov qword [rsp + 0x10], rax
xor eax, eax
mov ecx, 8
imul rcx, rcx, 0
add rax, rcx
mov rcx, qword [rsp + 0x10]
sub rcx, rax
mov rax, rcx
mov qword [rsp], rax
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp]
lea rax, [rcx + rax + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp]
mov rax, qword [rax + 0x30]
movabs rcx, 0x100000000
add rax, rcx
mov rcx, qword [rsp + 0x18]
mov dword [rcx], eax
xor eax, eax
add rsp, 0x28
ret
Function at 0x1401e2850
Capabilities:
Terminate process

Disassembly:
push rdi
sub rsp, 0x510
mov rax, qword [0x1406de900]
xor rax, rsp
mov qword [rsp + 0x500], rax
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x4d0
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x60], 0x100010
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1401e28f2
cmp qword [rsp + 0x78], 0
jne 0x1401e28ea
cmp qword [rsp + 0x80], 0
jne 0x1401e28ea
cmp qword [rsp + 0x88], 0
jne 0x1401e28ea
cmp qword [rsp + 0x90], 0
jne 0x1401e28ea
cmp qword [rsp + 0x98], 0
jne 0x1401e28ea
cmp qword [rsp + 0xa0], 0
je 0x1401e28f2
mov dword [rsp + 0x20], 1
cmp dword [rsp + 0x20], 0
je 0x1401e2910
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [0], 0x1565
xor ecx, ecx
int 0x29
mov rcx, qword [rsp + 0x500]
xor rcx, rsp
call fcn.1401fc630
add rsp, 0x510
pop rdi
ret

Function at 0x1401e2930
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push rdi
sub rsp, 0x80
mov rax, qword [0x1406de900]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, Ordinal_50
rep stosb byte [rdi], al
mov dword [rsp + 0x70], 0
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x44]
mov r9d, 0x40
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1401e29a9
xor eax, eax
jmp 0x1401e2a13
mov rdi, qword [rsp + 0x20]
mov eax, 0xc3
mov ecx, 1
rep stosb byte [rdi], al
mov eax, dword [rsp + 0x44]
lea r9, [rsp + 0x70]
mov r8d, 0x140
mov edx, eax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1401e29de
xor eax, eax
jmp 0x1401e2a13
call qword [rsp + reloc.WLDAP32.dll_Ordinal_32]
jmp 0x1401e29fb
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 1
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1401fc630
add rsp, 0x80
pop rdi
ret