joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401a7787
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg r14b
bswap rsi
mov dword [rsp + 0x13], r8d
mov rsi, qword [rsp + 0x11]
jmp 0x1401a77b0
mov qword [rsp + 9], r9
mov si, 0x8881
sub rsp, 3
dec r14d
pushfq
jmp 0x1401a7771
xchg bp, r15w
lea r15, [rcx + riz - 0x5d]
add rsp, 8
mov r11b, r8b
jmp 0x1401a795a
bsf r15d, r8d
mov r13w, r11w
shl edi, 0x15
xchg r9, r15
xchg r10d, edx
push r10
jmp 0x1401a779a
setae r15b
lea rsi, [rsi + rsi]
xchg dil, r14b
xchg dword [rsp + 0x14], esi
jmp 0x1401a7830
mov dword [rsp], r12d
mov ebp, 0x1733c5d2
mov r9d, 0x5c9e43d3
mov r11d, 0x8a5028d0
std
push bx
jmp 0x1401a77e9
cpuid
xchg r14, r11
xchg rbp, rsi
mov esi, dword [rsp + 7]
jmp 0x1401a78b6
xchg r15b, r13b
stc
lea r13, [r14*8]
add rsp, 0xc
xchg word [rsp + 3], r10w
sub rsp, 0xd
jmp 0x1401a781a
mov r13, r15
xchg rdx, r10
cpuid
lea r9, [rdi + r15]
xchg dword [rsp + 0xb], r13d
lea r14, [rbx + riz - 0x96f9]
jmp 0x1401a77ff
rdtsc
xchg qword [rsp + 8], r11
xchg rdx, rbp
mov r11, rdi
xchg qword [rsp + 0xb], rcx
xchg qword [rsp + 0xc], rbx
jmp 0x1401a7859
pop r9
mov r10b, byte [rsp + 3]
mov r13d, 0xb1312867
jmp 0x1401a7921
mov bx, word [rsp + 6]
xchg bl, r9b
lea r10, [r10 + riz]
neg r10
pop rax
bsf r14w, r11w
jmp 0x1401a78a0
rdtsc
mov r15d, 0x26f8d134
bswap rbp
push rbx
call fcn.1401a78f8
rol byte [rax + 0x27], cl
rcl byte [rbp - 0x2d], cl
push rbp
mov di, 0x3b53
pop word [rsp + 2]
lea rcx, [rcx + r11]
cld
rdtsc
jmp 0x1401a78cd
mov cx, 0xf302
std
lea rbp, [r10*4]
pop rsi
mov rbx, 0xffffffffac9a5be6
mov r15d, 0x68cb271e
jmp 0x1401a78e5
xchg al, sil
neg r13w
sub r13d, r12d
sub rsp, 3
mov word [rsp + 0x1a], dx
lea rsp, [rsp + 0x1d]
jmp 0x1401a7887
Function at 0x1401a7c51
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop r14w
add rsp, 0x22
sub dil, 0xa6
jmp 0x1401a7c96
mov rbx, 0x51ace062
mov r8, r14
dec r9d
mov r8w, word [rsp]
jmp 0x1401a7c80
mov dl, r12b
std
xchg r9w, bx
mov ecx, eax
lea r14, [r12 + r14]
xchg ecx, ebx
jmp 0x1401a7cf8
bswap r8
bswap r14d
lea rbx, [r9 + rbp]
xchg r9b, dl
mov byte [rsp], r13b
mov word [rsp], r15w
jmp 0x1401a7c5f
sbb r13w, sp
xor cx, dx
mov rdx, r11
sub rsp, 0xd
xchg byte [rsp + 0xa], r9b
jmp 0x1401a7df2
lea r11, [rcx + riz - 0x2c8135ef]
sub rsp, 3
xchg byte [rsp + 3], r11b
sub rsp, 6
btc ax, di
mov cl, r11b
jmp 0x1401a7cdc
mov qword [rsp + 0x14], r12
pop rdi
mov r9d, dword [rsp + 0x1a]
sub rsp, 2
jmp 0x1401a7dc6
push word [rsp + 7]
rdtsc
lea rax, [rsp + rdx]
lea r13, [r14 + riz + 0xa6e7]
rdtsc
lea rsi, [rdx*8]
jmp 0x1401a7d16
bsf r13, r13
mov al, 0x40
rdtsc
push word [rsp + 2]
not rdi
pop qword [rsp + 9]
jmp 0x1401a7d2c
mov r10b, byte [rsp + 1]
mov r9w, 0x80d0
lea r10, [rdx + r8]
jmp 0x1401a7da5
pop r9
xchg byte [rsp + 0xe], r11b
mov r14w, cx
lea rax, [rdi + riz + 0x9b]
mov dx, word [rsp + 0x15]
lea r10, [rdx + r15]
jmp 0x1401a7d71
mov dword [rsp + 0x19], eax
lea rsp, [rsp + 0x21]
mov r9w, 0x5a75
rdtsc
xchg r8d, edi
setb dil
jmp 0x1401a7ebc
bswap rcx
sub rsp, 0x1b
xchg cl, bl
mov dil, r10b
lea rsp, [rsp + 0x13]
mov qword [rsp + 7], rdi
jmp 0x1401a7d87
sub rsi, 0x21dbfe48
pushfq
pushfq
bswap rbp
pushfq
lea r9, [rbx + rdi]
jmp 0x1401a7d5a
pop cx
mov r13w, word [rsp + 7]
mov r14b, 0x6f
call fcn.1401a7e08
xchg byte [rsp], sil
std
pushfq
rdtsc
xchg edx, r15d
bswap rdi
jmp 0x1401a7e1e

Function at 0x1401a8153
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rbp, [rsp + rbx]
mov r10, 0x4958f111
mov r13, qword [rsp]
stc
jmp 0x1401a816c
pop r15w
xchg dword [rsp], ebx
pop bp
shl eax, cl
cpuid
mov r8d, dword [rsp + 2]
jmp 0x1401a811e
clc
jmp 0x1401a8134
add rsp, 0xc
mov r14d, 0xfe13eb6b
xchg cx, dx
cld
cpuid
jmp 0x1401a81c5
xchg byte [rsp + 1], cl
mov si, word [rsp + 2]
mov r14d, dword [rsp + 4]
xchg byte [rsp + 2], r14b
sub rsp, 0x15
xchg cl, r11b
jmp 0x1401a8156
mov qword [rsp], r14
push word [rsp + 6]
xchg esi, ecx
cld
add rsp, 5
cmc
jmp 0x1401a81af
Function at 0x141d40b50
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x141d40b5d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x141d40b6d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x141d40b55
lea eax, [rcx + 1]
jmp 0x141d40b7b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x141d40b8e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x141d40b74
sub eax, 3
jb 0x141d40bae
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x141d40bfd
sar eax, 1
movsxd rbp, eax
jb 0x141d40be4
jmp 0x141d40bbc
add ebx, ebx
jne 0x141d40bba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x141d40be4
inc ecx
add ebx, ebx
jne 0x141d40bca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x141d40be4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x141d40bdd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x141d40bcc
add ecx, 2
jmp 0x141d40be9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.141d40b12
jmp 0x141d40b5d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0x1d20000]
mov eax, dword [rdi]
or eax, eax
je 0x141d40c5d
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1d40000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x141d40c0d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x141d40c57
mov qword [rbx], rax
add rbx, 8
jmp 0x141d40c2d
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x141d40ca1
cmp al, 0xef
ja 0x141d40c89
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x141d40c69
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x141d40c78
mov eax, dword [rdi]
add rdi, 4
jmp 0x141d40c78
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.141d40d20], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.141d40d20
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x141d40d10
sub rsp, 0xffffffffffffff80
jmp 0x140001125
Function at 0x10000bae0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x100011df8], rdi
je 0x10000bb40
cmp rax, rdi
jne 0x10000bb33
mov r12d, 1
jmp 0x10000bb40
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10000bb19
mov eax, dword [0x100011df0]
cmp eax, 1
jne 0x10000bb55
lea ecx, [rax + 0x1e]
call fcn.100142000
jmp 0x10000bbbc
mov eax, dword [0x100011df0]
cmp eax, ebx
jne 0x10000bbb2
mov dword [0x100011df0], 1
lea r13, [0x100001448]
lea rdi, [0x100001430]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x10000bba4
cmp eax, ebx
jne 0x10000bba4
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x10000bb99
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x10000bb82
cmp eax, ebx
je 0x10000bbbc
mov eax, 0xff
jmp 0x10000bd04
mov dword [0x1000115d4], 1
mov eax, dword [0x100011df0]
cmp eax, 1
jne 0x10000bbe4
lea rdx, [0x100001428]
lea rcx, [0x1000013f0]
call sub.msvcrt.dll__initterm
mov dword [0x100011df0], 2
cmp r12d, ebx
jne 0x10000bbf3
mov rax, rbx
xchg qword [0x100011df8], rax
cmp qword [0x100011e10], rbx
je 0x10000bc1b
lea rcx, [0x100011e10]
call fcn.10000c0cc
cmp eax, ebx
je 0x10000bc1b
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100011e10]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x10000bc31
mov eax, 0xff
jmp 0x10000bd04
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x10000bcb6
cmp word [rcx], bx
je 0x10000bc4c
cmp edx, ebx
jne 0x10000bcb6
cmp word [rcx], bx
je 0x10000bc62
cmp word [rcx], 0x20
ja 0x10000bc62
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x10000bc4c
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x100000000]
call fcn.100002d14
mov dword [0x1000115d0], eax
cmp dword [0x1000115b4], ebx
jne 0x10000bca0
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1000115d4], ebx
jne 0x10000bcb4
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1000115d0]
jmp 0x10000bd04
cmp word [rcx], 0x22
jne 0x10000bcc9
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x10000bc3d
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call fcn.10000c1e0
add rsp, 0x28
jmp 0x10000bae0
Function at 0x140001cf0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140001d11
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140001d3e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140001d40
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140001d99
test ecx, ecx
jle 0x140001d79
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140001d99
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140001d99
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
Function at 0x140001dc0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140001de2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140001df1
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140001e14
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140001e16
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140001e52
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140001eee
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140001e8d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140001ece
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140001eee
cmp rbx, rax
ja 0x140001ea0
test rbx, rbx
je 0x140001eee
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
Function at 0x140002350
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000237d
xor eax, eax
jmp 0x1400024e9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400023b7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400023b7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400024e9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400024dc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400023fa
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002425
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400024e1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002494
sub eax, 1
je 0x140002494
cmp eax, 2
jne 0x1400024dc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400024e1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400024c2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400024dc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400024e1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400034e0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140002950
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140002a23
cmp byte [rcx + 0x71], 0
je 0x140002a23
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140002a1f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400029e4
sub eax, 1
je 0x1400029e8
cmp eax, 2
jne 0x140002a1f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400034e0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140002a16
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140002a1f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400029cc
xor al, al
jmp 0x1400029cc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400034e0
add rsp, 0x60
pop rbx
ret

Function at 0x140003e60
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003eaa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003eaa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003eaa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003eaa
cmp dword [rcx + 0x84], 0xe
jbe 0x140003eaa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003eac
xor al, al
add rsp, 0x28
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00416510]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x00416520]
mov dword [rax], 1
mov rax, qword [0x00416530]
mov dword [rax], 1
mov rax, qword [0x00416500]
mov dword [rax], 1
mov rax, qword [0x004163f0]
cmp word [rax], 0x5a4d
jne 0x401067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x4010c0
mov rax, qword [0x004164f0]
mov dword [0x0041900c], ecx
mov eax, dword [rax]
test eax, eax
jne 0x4010b0
mov ecx, 1
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x004164b0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x004163a0]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 2
call sym.__set_app_type
jmp 0x401084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x401108
cmp dx, 0x20b
jne 0x401067
cmp dword [rax + 0x84], 0xe
jbe 0x401067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x401067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x401067

Function at 0x401550
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push rbp
mov eax, 0x12b40
call fcn.00402bb0
sub rsp, rax
lea rbp, [rsp + 0x80]
call dbg.__main
lea rax, [rbp - 0x50]
lea rdx, [0x00403020]
mov ecx, 0x12b00
mov r8, rcx
mov rcx, rax
call sym.memcpy
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x12b00
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0x12ab8], rax
cmp qword [rbp + 0x12ab8], 0
jne 0x4015d7
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.Failed_to_allocate_memory_in_the_current_process._Error:__lu_n
call sym.printf
mov eax, 1
jmp 0x4016a6
mov rax, qword [rbp + 0x12ab8]
mov rcx, rax
lea rax, [rbp - 0x50]
mov edx, 0x12b00
mov r8, rdx
mov rdx, rax
call sym.memcpy
mov rax, qword [rbp + 0x12ab8]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8, rax
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp + 0x12ab0], rax
cmp qword [rbp + 0x12ab0], 0
jne 0x401658
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.Failed_to_create_a_remote_thread._Error:__lu_n
call sym.printf
mov eax, 1
jmp 0x4016a6
mov rax, qword [rbp + 0x12ab0]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x12ab0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x12ab8]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov eax, 0
add rsp, 0x12b40
pop rbp
ret
Function at 0x401b60
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]

Function at 0x401bd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x00419614]
mov r12, rcx
mov rdi, rdx
mov rbx, r8
test esi, esi
jle 0x401d50
mov rax, qword [0x00419618]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x401c1c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x401ca1
inc ecx
add rax, 0x28
cmp ecx, esi
jne 0x401c00
mov rcx, r12
call dbg.__mingw_GetSectionForAddress
mov rbp, rax
test rax, rax
je 0x401d92
mov rax, qword [0x00419618]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call dbg._GetPEImageBase
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00419618]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x401da1
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x401c9b
sub eax, 4
and eax, 0xfffffffb
jne 0x401d08
inc dword [0x00419614]
cmp ebx, 8
jae 0x401cd0
test bl, 4
jne 0x401d60
test ebx, ebx
je 0x401cc3
movzx eax, byte [rdi]
mov byte [r12], al
test bl, 2
jne 0x401d80
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, ebx
dec ebx
mov rdx, qword [rdi + rax - 8]
mov qword [r12 + rax - 8], rdx
cmp ebx, 8
jb 0x401cc3
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rdi + rdx]
mov qword [r12 + rdx], rcx
cmp eax, ebx
jb 0x401ce8
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rsi, qword [0x00419618]
mov qword [rsi + 8], rcx
mov r9, rsi
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x401c9b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop dword [rax]
xor esi, esi
jmp 0x401c26
mov eax, dword [rdi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rdi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x401cc3
mov ebx, ebx
movzx eax, word [rdi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x401cc3
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
mov rax, qword [0x00419618]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rsi + 0x18]
call dbg.__report_error
nop
nop dword [rax]