joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005bc10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov r14d, 4
lea rbx, [rcx + 0x10290]
mov ebp, r14d
lea rsi, [rcx + 0x10698]
mov r10, rcx
lea r15, [0x140074160]
xor edi, edi
nop dword [rax + rax]
mov eax, dword [r10 + 0x10e90]
xor r11d, r11d
test eax, eax
je 0x14005bcb7
nop
xor r9d, r9d
lea eax, [r11 + 0x40]
nop word [rax + rax]
mov edx, eax
shr eax, 1
and edx, 1
mov ecx, eax
add rcx, rdi
movzx r8d, word [r10 + rcx*2 + 0x6efc]
mov ecx, edx
neg ecx
shr r8, 4
shr rcx, 4
and ecx, 0x7f
xor r8, rcx
movzx ecx, byte [r8 + r15]
add r9d, ecx
cmp eax, 1
jne 0x14005bc70
mov dword [rbx + r11*4], r9d
inc r11d
mov eax, dword [r10 + 0x10e90]
cmp r11d, eax
jb 0x14005bc60
mov edx, recvfrom
cmp eax, edx
jbe 0x14005bce0
mov eax, edx
lea rcx, [rbx + rax*4]
mov eax, edx
shr eax, 1
inc edx
shl eax, 4
sub eax, 0x50
add dword [rcx], eax
cmp edx, dword [r10 + 0x10e90]
jb 0x14005bcc0
nop dword [rax]
mov eax, dword [rbx]
add rdi, 0x40
mov dword [rsi - 8], eax
mov eax, dword [rbx + 4]
mov dword [rsi - 4], eax
mov eax, dword [rbx + 8]
mov dword [rsi], eax
mov eax, dword [rbx + 0xc]
add rbx, 0x100
mov dword [rsi + 4], eax
add rsi, 0x200
sub rbp, 1
jne 0x14005bc50
lea rdi, [r10 + 0x10aa0]
nop dword [rax]
cmp r14d, 4
ja 0x14005bd2b
mov edx, r14d
jmp 0x14005bd3d
bsr edx, r14d
mov eax, r14d
lea ecx, [rdx - 1]
shr eax, cl
and eax, 1
lea edx, [rax + rdx*2]
mov r9d, edx
mov r11d, edx
shr r9d, 1
mov eax, edx
and eax, 1
dec r9d
or eax, 2
mov ecx, r9d
shl eax, cl
mov ebx, r14d
sub ebx, eax
mov ebp, eax
xor r8d, r8d
lea esi, [r8 + 1]
mov eax, esi
mov edx, ebx
sub rax, r11
shr ebx, 1
add rax, rbp
and edx, 1
movzx ecx, word [r10 + rax*2 + 0x70fa]
lea esi, [rdx + rsi*2]
mov eax, edx
shr rcx, 4
neg eax
shr rax, 4
and eax, 0x7f
xor rcx, rax
movzx eax, byte [rcx + r15]
add r8d, eax
add r9d, 0xffffffff
jne 0x14005bd64
mov ecx, dword [r10 + r11*4 + 0x10290]
inc r14d
add ecx, r8d
mov dword [rdi - 0x400], ecx
mov ecx, dword [r10 + r11*4 + 0x10390]
add ecx, r8d
mov dword [rdi - 0x200], ecx
mov ecx, dword [r10 + r11*4 + 0x10490]
add ecx, r8d
mov dword [rdi], ecx
mov ecx, dword [r10 + r11*4 + 0x10590]
add ecx, r8d
mov dword [rdi + 0x200], ecx
add rdi, 4
cmp r14d, 0x80
jb 0x14005bd20
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov dword [r10 + 0x10e94], r9d
pop r15
pop r14
ret
Function at 0x14005d528
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x140406418]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x14005d572
call fcn.14001873c
mov dword [rax], recvfrom
call fcn.14001871c
mov dword [rax], recvfrom
call fcn.140014a88
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140019dc0
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x14005d57d
lea eax, [rbx + 1]
jmp 0x14005d55f
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x14005d55d
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x14005d55f

Function at 0x140060830
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp byte [0x1404099f8], 0
jne 0x1400608f5
mov byte [0x1404099f8], 1
lea r9, [0x140409a00]
xor r8d, r8d
nop
mov ecx, r8d
shr ecx, 1
mov edx, ecx
xor edx, 0xedb88320
test r8b, 1
cmove edx, ecx
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, 0xedb88320
test dl, 1
cmove eax, ecx
mov dword [r9 + r8*4], eax
inc r8
cmp r8, 0x100
jb 0x140060850
ret
Function at 0x140061970
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400619a0
xor eax, eax
jmp 0x140061a63
mov rbp, rbx
cmp word [rax], si
je 0x1400619c5
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400619ac
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400619a8
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140034c00
movsxd r14, eax
test eax, eax
jne 0x140061a03
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140061999
mov rcx, r14
call fcn.140014f28
mov rdi, rax
test rax, rax
jne 0x140061a1c
xor ecx, ecx
call fcn.140014eec
jmp 0x1400619f8
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140034c00
test eax, eax
jne 0x140061a4d
mov rcx, rdi
call fcn.140014eec
jmp 0x140061a57
xor ecx, ecx
call fcn.140014eec
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140061a80
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140061b07
mov rsi, rbx
cmp word [rax], bp
je 0x140061ac6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140061ab0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140061aac
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140014f28
mov rdi, rax
test rax, rax
je 0x140061af4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140006900
mov rbp, rdi
xor ecx, ecx
call fcn.140014eec
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140412bf6
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
push rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.140005ab0
mov rcx, qword [rsp + 0x90]
call fcn.1404176e4
sub rsp, 0x18
mov rdx, 1
lea rax, [rsp + 0x40]
push rax
xor r9, r9
mov r8, reloc.WS2_32.dll_inet_addr
mov rcx, 2
sub rsp, 0x20
call fcn.140005404
add rsp, 0x40
mov qword [rsp + 0x28], rax
push 0
push 0
pop rcx
pop rdx
call sub.KERNEL32.dll_GetSystemDirectoryW
mov rax, rax
push rax
pop rax
mov dword [rsp + 0x48], eax
movsxd r15, dword [rsp + 0x48]
and r15, r15
jne 0x140412ca7
movabs rcx, 0x140082028
push rcx
sub rsp, 0x28
call fcn.140005d50
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140005b00
add rsp, 0x28
pop rax
push rax
call fcn.140005d10
pop rdx
add rax, rdx
jmp 0x140412d79
movsxd rax, dword [rsp + 0x48]
inc rax
lea rdx, [rsp + 0x28]
mov rcx, rax
call fcn.140005668
movsxd r15, dword [rsp + 0x48]
add r15, r15
mov rax, r15
push rax
mov rbp, qword [rsp + 0x30]
lea rax, [rbp]
mov rax, rax
push rax
pop rcx
pop rdx
call fcn.140005810
movsxd rax, dword [rsp + 0x48]
mov rax, rax
push rax
lea rax, [rbp]
mov rax, rax
push rax
pop rcx
pop rdx
call sub.KERNEL32.dll_GetSystemDirectoryW
mov rax, rax
push rax
pop rax
mov dword [rsp + 0x48], eax
push rcx
sub rsp, 0x28
call fcn.140005d50
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140005d50
add rsp, 0x28
pop rcx
push rax
push 0x19
push 0xffffffffffffffff
mov rbp, qword [rsp + 0x50]
lea rax, [rbp]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140005880
add rsp, 0x28
movabs rcx, 0x14008207a
sub rsp, 0x28
call fcn.140005b00
add rsp, 0x28
pop rax
push rax
call fcn.140005d10
pop rdx
add rax, rdx
jmp 0x140412d79
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400055f0
add rsp, 0x28
pop rax
add rsp, 0x58
pop r15
pop rbp
ret

Function at 0x1404176e4
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x140406114]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret
Function at 0x648c13d0
Capabilities:
Check os version

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xc0
mov dword [rbp - 0xa0], 0x94
lea rax, [rbp - 0xa0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetVersionExA]
call rax
mov eax, dword [rbp - 0x9c]
cmp eax, 6
jne 0x648c1415
mov eax, dword [rbp - 0x98]
cmp eax, 1
jne 0x648c1415
mov eax, 1
jmp 0x648c141a
mov eax, 0
add rsp, 0xc0
pop rbp
ret

Function at 0x648c1423
Capabilities:
Get system firmware table

Disassembly:
push rbp
sub rsp, 0x430
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x3a8], 0x400
lea rax, [rbp - 0x60]
mov r9d, 0x400
mov r8, rax
mov edx, 0
mov ecx, 0x52534d42
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
call rax
mov dword [rbp + 0x3a4], eax
cmp dword [rbp + 0x3a4], 0
jne 0x648c1476
mov eax, 1
jmp 0x648c151f
mov dword [rbp + 0x3ac], 0
mov eax, dword [rbp + 0x3a4]
sub eax, 8
cmp dword [rbp + 0x3ac], eax
jae 0x648c151a
lea rdx, [rbp - 0x60]
mov eax, dword [rbp + 0x3ac]
add rax, rdx
mov r8d, 6
lea rdx, str.VMware
mov rcx, rax
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x648c1507
lea rdx, [rbp - 0x60]
mov eax, dword [rbp + 0x3ac]
add rax, rdx
mov r8d, 0xa
lea rdx, str.VirtualBox
mov rcx, rax
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x648c1507
lea rdx, [rbp - 0x60]
mov eax, dword [rbp + 0x3ac]
add rax, rdx
mov r8d, 7
lea rdx, str.Hyper_V
mov rcx, rax
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x648c150e
mov eax, 1
jmp 0x648c151f
add dword [rbp + 0x3ac], 1
jmp 0x648c1480
mov eax, 0
add rsp, 0x430
pop rbp
ret
Function at 0x648c1528
Capabilities:
Read file on windows

Disassembly:
push rbp
sub rsp, 0x2c0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x250], rcx
mov dword [rbp + 0x258], edx
lea rax, [rbp + 0xe0]
mov rdx, rax
lea rcx, str.2.ann_d52a00ff_d864_47e5_b1b1_433a8a78d21c.
mov rax, qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call rax
mov qword [rbp + 0x230], rax
cmp qword [rbp + 0x230], 0xffffffffffffffff
jne 0x648c157a
mov eax, 0
jmp 0x648c16e4
lea rax, [rbp - 0x30]
mov word [rax], 0x5c2e
mov byte [rax + 2], 0
lea rax, [rbp + 0xe0]
lea rdx, [rax + 0x2c]
lea rax, [rbp - 0x30]
mov rcx, rax
call sub.msvcrt.dll_strcat
lea rax, [rbp - 0x30]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0x80000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x228], rax
cmp qword [rbp + 0x228], 0xffffffffffffffff
jne 0x648c1606
mov rax, qword [rbp + 0x230]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindClose]
call rax
mov eax, 0
jmp 0x648c16e4
mov edx, dword [rbp + 0x258]
lea rcx, [rbp - 0x34]
mov rax, qword [rbp + 0x228]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8d, edx
mov rdx, qword [rbp + 0x250]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
mov dword [rbp + 0x224], eax
mov rax, qword [rbp + 0x228]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x230]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindClose]
call rax
cmp dword [rbp + 0x224], 0
jne 0x648c1675
mov eax, 0
jmp 0x648c16e4
mov dword [rbp + 0x23c], 0
mov eax, dword [rbp - 0x34]
cmp dword [rbp + 0x23c], eax
jge 0x648c16df
mov eax, dword [rbp + 0x23c]
movsxd rdx, eax
mov rax, qword [rbp + 0x250]
add rax, rdx
movzx eax, byte [rax]
cmp al, 0xd
je 0x648c16be
mov eax, dword [rbp + 0x23c]
movsxd rdx, eax
mov rax, qword [rbp + 0x250]
add rax, rdx
movzx eax, byte [rax]
cmp al, 0xa
jne 0x648c16d6
mov eax, dword [rbp + 0x23c]
movsxd rdx, eax
mov rax, qword [rbp + 0x250]
add rax, rdx
mov byte [rax], 0
jmp 0x648c16df
add dword [rbp + 0x23c], 1
jmp 0x648c167f
mov eax, 1
add rsp, 0x2c0
pop rbp
ret
Function at 0x648c1a0d
Capabilities:
Create process on windows
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xe0
mov qword [rbp + 0x10], rcx
lea rax, [rbp - 0x70]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [rbp - 0x70], 0x68
mov dword [rbp - 0x34], 1
mov word [rbp - 0x30], 0
lea rax, [rbp - 0x90]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
lea rax, [rbp - 0x90]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, qword [rbp + 0x10]
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
sete al
test al, al
je 0x648c1acd
mov ecx, 1
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
mov rax, qword [rbp - 0x90]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp - 0x90]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x88]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
nop
add rsp, 0xe0
pop rbp
ret
Function at 0x648c1b15
Capabilities:
Terminate process

Disassembly:
push rbp
sub rsp, 0x930
lea rbp, [rsp + 0x80]
call fcn.648c13d0
test al, al
je 0x648c1b3c
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
movzx eax, byte [0x648c4010]
test al, al
je 0x648c1b57
call fcn.648c1423
test al, al
je 0x648c1b57
mov eax, 1
jmp 0x648c1b5c
mov eax, 0
test al, al
je 0x648c1b6e
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
lea rax, [rbp + 0x7a0]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
lea rax, [rbp + 0x7a0]
mov edx, 0x5c
mov rcx, rax
call sub.msvcrt.dll_strrchr
add rax, 1
lea rdx, str.rundll32.exe
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x648c1bc5
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
lea rax, [rbp + 0x3a0]
mov edx, 0x400
mov rcx, rax
call fcn.648c1528
test eax, eax
sete al
test al, al
je 0x648c1bf0
mov ecx, 1
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8d, 0x400
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
call rax
mov qword [rbp + 0x8a8], rax
cmp qword [rbp + 0x8a8], 0
jne 0x648c1c2f
mov ecx, 1
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
mov rdx, qword [rbp + 0x8a8]
lea rax, [rbp + 0x3a0]
mov rcx, rax
call fcn.648c16ed
mov dword [rbp + 0x8a4], eax
cmp dword [rbp + 0x8a4], 0
je 0x648c1c64
mov eax, dword [rbp + 0x8a4]
cdqe
cmp rax, 0x3ff
jbe 0x648c1c96
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov rdx, qword [rbp + 0x8a8]
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapFree]
call rax
mov ecx, 1
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
mov eax, dword [rbp + 0x8a4]
movsxd rcx, eax
mov rdx, qword [rbp + 0x8a8]
lea rax, [rbp - 0x60]
mov r8, rcx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov eax, dword [rbp + 0x8a4]
cdqe
mov byte [rbp + rax - 0x60], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov rdx, qword [rbp + 0x8a8]
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapFree]
call rax
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.648c1a0d
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
nop

Function at 0x648c20c0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.648c3360
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.648c3360
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x648c2130
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x648c85e4]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x648c22d8
mov rax, qword [0x648c85e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x648c217c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x648c2207
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x648c2160
mov rcx, r12
call fcn.648c2e30
mov rbp, rax
test rax, rax
je 0x648c2312
mov rax, qword [0x648c85e8]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.648c2f60
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x648c85e8]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x648c2321
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x648c2200
sub eax, 4
and eax, 0xfffffffb
jne 0x648c2290
add dword [0x648c85e4], 1
cmp ebx, 8
jae 0x648c2238
test bl, 4
jne 0x648c22e0
test ebx, ebx
je 0x648c2229
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x648c2300
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x648c2229
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x648c226a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x648c85e8]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x648c2200
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.648c20c0
nop dword [rax]
xor edi, edi
jmp 0x648c2187
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x648c2229
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x648c2229
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.648c20c0
mov rax, qword [0x648c85e8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.648c20c0
nop
nop dword [rax]
Function at 0x648c2aa0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x648c88c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x648c88a0]
test rbx, rbx
je 0x648c2af4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x648c2aeb
test r12, r12
je 0x648c2aeb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x648c2ad0
lea rcx, [0x648c88c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x648c2e30
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x648c52a0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x648c2ea9
mov rcx, r10
call fcn.648c2d00
test eax, eax
je 0x648c2ea9
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x648c2ea6
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x648c2e9d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x648c2ea9
add r8, 0x28
cmp r8, r9
jne 0x648c2e88
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x140001380
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x18
cmp dword [0x14000c780], 0
jne 0x140001554
mov rax, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rax + 0x18]
mov r9, qword [rcx + 0x10]
mov rax, qword [r9 + 0x30]
test rax, rax
je 0x14000155e
mov r8, rax
movsxd rax, dword [rax + 0x3c]
mov ecx, dword [rax + r8 + 0x88]
test ecx, ecx
je 0x1400013ee
lea rdx, [r8 + rcx]
mov ecx, dword [r8 + rcx + 0xc]
mov eax, dword [rcx + r8]
or eax, 0x20202020
cmp eax, 0x6c64746e
jne 0x1400013ee
mov eax, dword [rcx + r8 + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x1400013fa
mov r9, qword [r9]
mov rax, qword [r9 + 0x30]
test rax, rax
jne 0x1400013b1
test rdx, rdx
je 0x14000155e
mov qword [rsp + 0x20], rbx
mov ebx, dword [rdx + 0x18]
mov qword [rsp + 0x28], rbp
mov ebp, dword [rdx + 0x24]
mov qword [rsp + 0x30], rsi
add rbp, r8
mov esi, dword [rdx + 0x1c]
mov qword [rsp + 0x10], rdi
add rsi, r8
mov edi, dword [rdx + 0x20]
mov qword [rsp + 8], r14
add rdi, r8
mov qword [rsp], r15
lea r14, [0x14000c780]
xor r10d, r10d
mov r15d, 0x775a
nop word [rax + rax]
lea eax, [rbx - 1]
mov edx, dword [rdi + rax*4]
add rdx, r8
cmp word [rdx], r15w
jne 0x1400014b5
xor r11d, r11d
mov r9d, 0x8eab0230
mov rax, rdx
nop dword [rax + rax]
movzx eax, word [rax]
mov ecx, r9d
ror ecx, 8
inc r11d
add ecx, eax
mov eax, r11d
add rax, rdx
xor r9d, ecx
cmp byte [rax], 0
jne 0x140001470
lea rdx, [r10*8]
inc r10d
mov dword [rdx + r14 + 4], r9d
lea eax, [rbx - 1]
movzx eax, word [rbp + rax*2]
mov eax, dword [rsi + rax*4]
mov dword [rdx + r14 + 8], eax
cmp r10d, 0x1f4
je 0x1400014ba
add ebx, 0xffffffff
jne 0x140001450
mov r15, qword [rsp]
lea eax, [r10 - 1]
mov rsi, qword [rsp + 0x30]
xor r9d, r9d
mov rbp, qword [rsp + 0x28]
mov dword [0x14000c780], r10d
test eax, eax
je 0x140001545
nop word [rax + rax]
mov ecx, r10d
xor eax, eax
sub ecx, r9d
cmp ecx, 1
je 0x140001539
nop dword [rax]
mov edx, eax
lea r11d, [rax + 1]
mov ebx, dword [r14 + r11*8 + 8]
mov edi, dword [r14 + rdx*8 + 8]
cmp edi, ebx
jbe 0x140001529
mov ecx, dword [r14 + rdx*8 + 4]
mov eax, dword [r14 + r11*8 + 4]
mov dword [r14 + rdx*8 + 4], eax
mov dword [r14 + r11*8 + 4], ecx
mov dword [r14 + rdx*8 + 8], ebx
mov dword [r14 + r11*8 + 8], edi
mov r10d, dword [0x14000c780]
mov ecx, r10d
mov eax, r11d
sub ecx, r9d
dec ecx
cmp r11d, ecx
jb 0x1400014f0
inc r9d
lea eax, [r10 - 1]
cmp r9d, eax
jb 0x1400014e0
mov rdi, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x20]
mov r14, qword [rsp + 8]
mov eax, 1
add rsp, 0x18
ret
xor eax, eax
add rsp, 0x18
ret

Function at 0x140001bb0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x15882105
call fcn.140001570
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret