joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cacf0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140135920], rbx
je 0x1400cad3c
cmp rax, rbx
jne 0x1400cad2f
mov ebx, 1
mov esi, ebx
jmp 0x1400cad41
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400cad14
mov ebx, 1
mov eax, dword [0x140135928]
cmp eax, ebx
jne 0x1400cad57
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x1400cadbc
mov eax, dword [0x140135928]
test eax, eax
jne 0x1400cadb6
mov dword [0x140135928], ebx
lea r15, [0x1400f26b8]
lea rdi, [0x1400f2698]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x1400cada8
test eax, eax
jne 0x1400cadac
cmp qword [rdi], 0
je 0x1400cad9d
mov rax, qword [rdi]
mov rcx, qword [case.0x1400cd70e.0]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x1400cad7e
test eax, eax
je 0x1400cadbc
mov eax, 0xff
jmp 0x1400cae98
mov dword [0x1401323b4], ebx
mov eax, dword [0x140135928]
cmp eax, ebx
jne 0x1400cade3
lea rdx, [0x1400f2690]
lea rcx, [0x1400f2638]
call sub.msvcrt.dll__initterm
mov dword [0x140135928], 2
test esi, esi
jne 0x1400cadf0
xor eax, eax
xchg qword [0x140135920], rax
cmp qword [0x140135930], 0
je 0x1400cae24
lea rcx, [0x140135930]
call fcn.1400cc0d0
test eax, eax
je 0x1400cae24
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140135930]
mov r9, qword [case.0x1400cd70e.0]
call r9
mov r8, qword [0x1401323c8]
mov rdx, qword [0x1401323c0]
mov ecx, dword [0x1401323b8]
call fcn.1400252f4
mov dword [0x1401323b0], eax
cmp dword [0x1401323d0], 0
jne 0x1400cae54
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1401323b4], 0
jne 0x1400cae69
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1401323b0]
jmp 0x1400cae98
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.1401d4000
add rsp, 0x28
jmp 0x1400cacf0

Function at 0x1400cb238
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400cb244
push rbx
sub rsp, 0x540
mov rax, qword [0x140131c10]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x1400cb2c1
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
jmp 0x1400cb2e1
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.1400caef0
add rsp, 0x540
pop rbx
ret
Function at 0x1400cb244
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400cb244
push rbx
sub rsp, 0x540
mov rax, qword [0x140131c10]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x1400cb2c1
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
jmp 0x1400cb2e1
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.1400caef0
add rsp, 0x540
pop rbx
ret

Function at 0x1400cbfbc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400cc008
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400cc000
cmp dword [rcx + 0x3c], edx
jl 0x1400cc000
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1400cc000
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1400cc008
mov rax, rdx
add rsp, 0x18
ret
Function at 0x1400111fe
Capabilities:
Terminate process

Disassembly:
jmp 0x140012f80
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011285
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400142d0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400142f0
xor al, al
jmp 0x140014371
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014303
xor al, al
jmp 0x140014371
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001432d
xor al, al
jmp 0x140014371
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014341
xor al, al
jmp 0x140014371
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014353
xor al, al
jmp 0x140014371
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001436f
xor al, al
jmp 0x140014371
mov al, 1
add rsp, 0x38
ret
Function at 0x14000c65c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140014cb8], rbx
je 0x14000c6c3
cmp rax, rbx
jne 0x14000c6b6
mov ebx, 1
mov esi, ebx
jmp 0x14000c6c8
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000c69b
mov ebx, 1
mov eax, dword [0x140014cc0]
cmp eax, ebx
jne 0x14000c6e0
mov edi, 0x1f
mov ecx, edi
call fcn.140194000
jmp 0x14000c74c
mov eax, dword [0x140014cc0]
test eax, eax
jne 0x14000c741
mov dword [0x140014cc0], ebx
lea r15, [0x14000eb70]
lea rdi, [0x14000eb58]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14000c733
test eax, eax
jne 0x14000c737
cmp qword [rdi], r14
je 0x14000c728
mov rax, qword [rdi]
mov rcx, qword [0x14000eb00]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000c70a
test eax, eax
je 0x14000c747
mov eax, 0xff
jmp 0x14000c8a0
mov dword [0x140014400], ebx
mov edi, 0x1f
mov eax, dword [0x140014cc0]
cmp eax, ebx
jne 0x14000c773
lea rdx, [0x14000eb50]
lea rcx, [0x14000eb18]
call sub.msvcrt.dll__initterm
mov dword [0x140014cc0], 2
test esi, esi
jne 0x14000c781
mov rax, r14
xchg qword [0x140014cb8], rax
cmp qword [0x140014cd8], r14
je 0x14000c7b4
lea rcx, [0x140014cd8]
call fcn.14000cc80
test eax, eax
je 0x14000c7b4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140014cd8]
mov r9, qword [0x14000eb00]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000c7cd
mov eax, 0xff
jmp 0x14000c8a0
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x14000c851
cmp word [rcx], r14w
je 0x14000c7e6
test edx, edx
jne 0x14000c851
movzx eax, word [rcx]
sub ax, bx
cmp ax, di
ja 0x14000c7fc
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000c7e6
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400018e8
mov dword [0x1400143fc], eax
cmp dword [0x140014420], r14d
jne 0x14000c83a
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140014400], r14d
jne 0x14000c84f
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400143fc]
jmp 0x14000c8a0
cmp word [rcx], 0x22
jne 0x14000c865
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000c7d6
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.14000cd00
add rsp, 0x28
jmp 0x14000c65c
Function at 0x14000b9ac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140016950], eax
call fcn.14000b730
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140016950], 0
jne case.default.0x14000ba02
mov ecx, 1
call fcn.14000b730
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
mov eax, 0xa1ef19e3
int1
fisttp qword [rbp - 0x414b922d]
and eax, 0xf04e9db3
jp 0x1400232f1
sbb eax, 0xa96fa36d
fcomp qword [rdi - 0x3d]
sbb eax, 0x7f45b219
movsd dword [rdi], dword [rsi]
in eax, 0x58
invalid
pop rdi
invalid
Function at 0x10000b640
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x10000b68a
cmp rcx, 0xffffffffffffffff
je 0x10000b68a
cmp word [rcx], 0x5a4d
jne 0x10000b682
cmp dword [rcx + 0x3c], edx
jl 0x10000b682
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10000b682
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x10000b68a
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140001154
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x10], 0
mov dword [rbp - 0x1c], 0x30
mov eax, dword [rbp - 0x1c]
mov rax, qword gs:[rax]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov rax, qword [rax + 8]
mov qword [rbp - 0x18], rax
mov dword [rbp - 4], 0
jmp 0x1400011ac
mov rax, qword [rbp - 0x10]
cmp rax, qword [rbp - 0x18]
jne 0x14000119e
mov dword [rbp - 4], 1
jmp 0x1400011e3
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [0x1400054b0]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x40], 0
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x30]
lock cmpxchg qword [rdx], rcx
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x14000118b
mov rax, qword [0x1400054c0]
mov eax, dword [rax]
cmp eax, 1
jne 0x1400011fd
mov ecx, 0x1f
call sym._amsg_exit
jmp 0x14000123c
mov rax, qword [0x1400054c0]
mov eax, dword [rax]
test eax, eax
jne 0x140001232
mov rax, qword [0x1400054c0]
mov dword [rax], 1
mov rax, qword [0x140005500]
mov rdx, rax
mov rax, qword [0x1400054f0]
mov rcx, rax
call sym._initterm
jmp 0x14000123c
mov dword [0x140009024], 1
mov rax, qword [0x1400054c0]
mov eax, dword [rax]
cmp eax, 1
jne 0x140001270
mov rax, qword [0x1400054e0]
mov rdx, rax
mov rax, qword [0x1400054d0]
mov rcx, rax
call sym._initterm
mov rax, qword [0x1400054c0]
mov dword [rax], 2
cmp dword [rbp - 4], 0
jne 0x140001294
mov rax, qword [0x1400054b0]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
mov rdx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
xchg qword [rax], rdx
mov rax, qword [0x140005400]
mov rax, qword [rax]
test rax, rax
je 0x1400012bf
mov rax, qword [0x140005400]
mov rax, qword [rax]
mov r8d, 0
mov edx, 2
mov ecx, 0
call rax
call sym._pei386_runtime_relocator
mov rax, qword [sym._gnu_exception_handler]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call rax
mov rdx, qword [0x1400054a0]
mov qword [rdx], rax
lea rax, [sym.__mingw_invalidParameterHandler]
mov rcx, rax
call sym._set_invalid_parameter_handler
call sym._fpreset
mov eax, dword [0x140009004]
lea rdx, [0x140009008]
mov ecx, eax
call sym.duplicate_ppstrings
call sym.__main
mov rax, qword [0x140005430]
mov rax, qword [rax]
mov rdx, qword [0x140009010]
mov qword [rax], rdx
mov rcx, qword [0x140009010]
mov rdx, qword [0x140009008]
mov eax, dword [0x140009004]
mov r8, rcx
mov ecx, eax
call dbg.main
mov dword [0x14000901c], eax
mov eax, dword [0x140009020]
test eax, eax
jne 0x14000135d
mov eax, dword [0x14000901c]
mov ecx, eax
call sym.exit
mov eax, dword [0x140009024]
test eax, eax
jne 0x14000136c
call sym._cexit
mov eax, dword [0x14000901c]
add rsp, 0x70
pop rbp
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140005460]
mov dword [rax], 1
mov rax, qword [0x140005470]
mov dword [rax], 1
mov rax, qword [0x140005480]
mov dword [rax], 1
mov rax, qword [0x140005420]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001af0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x1400027c2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140009168]
test eax, eax
je 0x14000285a
lea rax, [0x140009140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140009170]
mov qword [rbp - 8], rax
jmp 0x14000283e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140002832
cmp qword [rbp - 0x10], 0
je 0x140002832
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1400027f8
lea rax, [0x140009140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14000285b
nop
add rsp, 0x30
pop rbp
ret
Function at 0x140028720
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x1400aa180]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbx, rcx
mov qword [rsp + 0x90], rcx
lea r8, [0x1400951fc]
xor edx, edx
call fcn.14002c800
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
mov dword [rsp + 0x20], WSAStartup
mov dword [rsp + 0x24], 0x40
xor esi, esi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rsi
lea rax, str.cmd.exe
mov qword [rsp + 0x38], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400287bb
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x58], rsi
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x14002881e
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140028817
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140028812
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400288c8
mov rcx, r8
call fcn.14007eb6c
mov eax, 0xffffffff
jmp 0x140028894
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [rsp + 0x98]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140028892
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14002888d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400288c8
mov rcx, r8
call fcn.14007eb6c
mov eax, edi
mov byte [rbx], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbx + 0x10], rsi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14007e7b0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14002d2e0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1400aa180]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x14002d3fc
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14002d3fc
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov qword [rsp + 0x58], r8
mov ecx, dword [rax + rdx + 0xb0]
test ecx, ecx
jne 0x14002d359
mov qword [rdi], r8
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r8
jmp 0x14002d407
lea rbx, [rdx + rcx]
mov ebp, dword [rax + rdx + 0xb4]
add rbp, rbx
mov eax, dword [rbx]
mov rcx, qword [rsp + 0x50]
test eax, eax
je 0x14002d3ea
mov edx, eax
cmp rdx, rbp
jae 0x14002d3ea
mov r9d, dword [rbx + 4]
test r9d, r9d
je 0x14002d3ea
lea rax, [rdx + rsi]
mov qword [rsp + 0x28], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
lea rax, [r9 - 8]
shr rax, 1
mov dword [rsp + 0x38], eax
cmp rcx, r8
je 0x14002d3c2
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x38]
movsd qword [rcx + 0x10], xmm1
add rcx, 0x18
mov qword [rsp + 0x50], rcx
jmp 0x14002d3de
lea r8, [rsp + 0x28]
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.14002ddd0
mov r8, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov eax, dword [rbx + 4]
add rbx, rax
mov eax, dword [rbx]
test eax, eax
jne 0x14002d372
mov rax, qword [rsp + 0x48]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], r8
jmp 0x14002d407
mov qword [rcx], r8
mov qword [rcx + 8], r8
mov qword [rcx + 0x10], r8
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14007e7b0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14002ff30
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1400aa180]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edx, edx
lea r9, [rsp + 0x20]
mov rsi, rcx
xor r14d, r14d
xor r8d, r8d
mov dword [rsp + 0x20], r14d
mov edi, r14d
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14002ffb9
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, ntohs
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14002ff70
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rbp
test eax, eax
js 0x140030097
mov ebx, r14d
cmp dword [rdi], ebx
jbe 0x140030097
nop dword [rax]
mov eax, ebx
xorps xmm0, xmm0
imul rcx, rax, 0x128
movups xmmword [rsp + 0x28], xmm0
movzx edx, word [rcx + rdi + 0x2e]
lea rbp, [rcx + rdi]
add rdx, 0x30
mov qword [rsp + 0x38], r14
add rdx, rcx
mov qword [rsp + 0x40], r14
add rdx, rdi
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r14b
jne 0x140030015
lea rcx, [rsp + 0x28]
call fcn.140026d40
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x140030035
mov rdx, qword [rsi]
cmp qword [rsp + 0x40], 0xf
lea rcx, [rsp + 0x28]
cmova rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x1400300cd
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x14003008d
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030088
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140030116
call fcn.14007eb6c
inc ebx
cmp ebx, dword [rdi]
jb 0x14002ffe0
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rbp, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14007e7b0
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
mov rbx, qword [rbp + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x140030122
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003011d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003011d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007eb6c
mov rax, rbx
jmp 0x1400300aa