joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005b5b
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rdx
mov qword [rsp + 0x28], rcx
call fcn.140007e72
mov rbx, rax
mov qword [rsp + 0x30], rsi
test rsi, rsi
mov eax, 0x275fe7bc
mov ebp, 0x20dbd73c
cmove ebp, eax
mov eax, 0xcf07a1b4
mov ecx, eax
cmp eax, 0xfbe8e626
jle 0x140005a8e
cmp ecx, 0x3440f7b9
jg 0x140005ad2
test dword [rax], eax
add byte [rax], al
cmp ecx, 0x147ef02a
jg 0x140005b59
cmp ecx, 0xfbe8e627
je 0x140005c35
cmp ecx, 0x1015665d
je 0x140005c4e
mov eax, ecx
cmp ecx, 0x1097649d
jne 0x140005a38
cmp byte [rbx + 1], 0x5a
mov eax, 0x1015665d
mov ecx, 0x147ef02b
cmove eax, ecx
jmp 0x140005a38
cmp ecx, 0xd2a7a206
jle 0x140005b0e
cmp ecx, 0xe14ca518
jg 0x140005b95
cmp ecx, 0xd2a7a207
je 0x140005c58
cmp ecx, 0xd4632404
je 0x140005c67
mov eax, ecx
cmp ecx, 0xd839d482
jne 0x140005a38
mov eax, 0x1015665d
jmp 0x140005a38
cmp ecx, 0x684fafcb
jg 0x140005bc5
cmp ecx, 0x3440f7ba
je 0x140005c88
cmp ecx, 0x64b5cec2
je 0x140005c9d
mov eax, ecx
cmp ecx, 0x651abe93
jne 0x140005a38
mov eax, 0x64b5cec2
jmp 0x140005a38
cmp ecx, 0x93460535
jle 0x140005bfb
cmp ecx, 0x93460536
je 0x140005ca9
cmp ecx, 0xb926c1f7
je 0x140005cbb
mov eax, ecx
cmp ecx, 0xcf07a1b4
jne 0x140005a38
test rbx, rbx
lea rbx, [rbx - 1]
mov eax, 0x3440f7ba
mov ecx, 0xfbe8e627
cmove eax, ecx
jmp 0x140005a38
cmp ecx, 0x147ef02b
je 0x140005cd3
test byte [rsi + 1], ch
add byte [rax], al
cmp ecx, 0x20dbd73c
je 0x140005cef
mov eax, ecx
cmp ecx, 0x275fe7bc
jne 0x140005a38
mov r14d, dword [r15 + 0xc]
add r14, rbx
mov eax, 0x80c011a3
mov esi, 1
jmp 0x140005a38
cmp ecx, 0xe14ca519
je 0x140005d04
cmp ecx, 0xed5b1a69
je 0x140005d1d
mov eax, ecx
cmp ecx, 0xf31223a2
jne 0x140005a38
mov eax, 0xfbe8e627
jmp 0x140005a38
mov eax, ebp
cmp ecx, 0x684fafcc
je 0x140005a38
cmp ecx, 0x75a8cf72
je 0x140005d36
mov eax, ecx
cmp ecx, 0x7b17a501
jne 0x140005a38
add r15, 0x28
mov eax, 0x651abe93
jmp 0x140005a38
cmp ecx, 0x80c011a3
je 0x140005d40
cmp ecx, 0x89a80948
jne 0x140005d4e
movsxd rax, dword [r12 + 0x3c]
cmp dword [rbx + rax], 0x4550
lea r13, [rbx + rax]
mov eax, 0x75a8cf72
mov ecx, 0xf31223a2
cmove eax, ecx
jmp 0x140005a38
movzx eax, word [r13 + 0x14]
lea r15, [rax + r13]
add r15, 0x18
mov eax, 0xe14ca519
xor edi, edi
jmp 0x140005a38
mov eax, 0xcf07a1b4
jmp 0x140005a38
mov eax, 0x80c011a3
mov esi, 4
jmp 0x140005a38
mov rcx, r15
mov rdx, qword [rsp + 0x28]
call fcn.140006673
test eax, eax
mov eax, 0x7b17a501
mov ecx, 0x684fafcc
cmove eax, ecx
jmp 0x140005a38
cmp byte [rbx], 0x4d
mov eax, 0x1015665d
mov ecx, 0x1097649d
cmove eax, ecx
invalid
wait
std
Function at 0x140005ba3
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rdx
mov qword [rsp + 0x28], rcx
call fcn.140007e72
mov rbx, rax
mov qword [rsp + 0x30], rsi
test rsi, rsi
mov eax, 0x275fe7bc
mov ebp, 0x20dbd73c
cmove ebp, eax
mov eax, 0xcf07a1b4
mov ecx, eax
cmp eax, 0xfbe8e626
jle 0x140005a8e
cmp ecx, 0x3440f7b9
jg 0x140005ad2
test dword [rax], eax
add byte [rax], al
cmp ecx, 0x147ef02a
jg 0x140005b59
cmp ecx, 0xfbe8e627
je 0x140005c35
cmp ecx, 0x1015665d
je 0x140005c4e
mov eax, ecx
cmp ecx, 0x1097649d
jne 0x140005a38
cmp byte [rbx + 1], 0x5a
mov eax, 0x1015665d
mov ecx, 0x147ef02b
cmove eax, ecx
jmp 0x140005a38
cmp ecx, 0xd2a7a206
jle 0x140005b0e
cmp ecx, 0xe14ca518
jg 0x140005b95
cmp ecx, 0xd2a7a207
je 0x140005c58
cmp ecx, 0xd4632404
je 0x140005c67
mov eax, ecx
cmp ecx, 0xd839d482
jne 0x140005a38
mov eax, 0x1015665d
jmp 0x140005a38
cmp ecx, 0x684fafcb
jg 0x140005bc5
cmp ecx, 0x3440f7ba
je 0x140005c88
cmp ecx, 0x64b5cec2
je 0x140005c9d
mov eax, ecx
cmp ecx, 0x651abe93
jne 0x140005a38
mov eax, 0x64b5cec2
jmp 0x140005a38
cmp ecx, 0x93460535
jle 0x140005bfb
cmp ecx, 0x93460536
je 0x140005ca9
cmp ecx, 0xb926c1f7
je 0x140005cbb
mov eax, ecx
cmp ecx, 0xcf07a1b4
jne 0x140005a38
test rbx, rbx
lea rbx, [rbx - 1]
mov eax, 0x3440f7ba
mov ecx, 0xfbe8e627
cmove eax, ecx
jmp 0x140005a38
cmp ecx, 0x147ef02b
je 0x140005cd3
test byte [rsi + 1], ch
add byte [rax], al
cmp ecx, 0x20dbd73c
je 0x140005cef
mov eax, ecx
cmp ecx, 0x275fe7bc
jne 0x140005a38
mov r14d, dword [r15 + 0xc]
add r14, rbx
mov eax, 0x80c011a3
mov esi, 1
jmp 0x140005a38
cmp ecx, 0xe14ca519
je 0x140005d04
cmp ecx, 0xed5b1a69
je 0x140005d1d
mov eax, ecx
cmp ecx, 0xf31223a2
jne 0x140005a38
mov eax, 0xfbe8e627
jmp 0x140005a38
mov eax, ebp
cmp ecx, 0x684fafcc
je 0x140005a38
cmp ecx, 0x75a8cf72
je 0x140005d36
mov eax, ecx
cmp ecx, 0x7b17a501
jne 0x140005a38
add r15, 0x28
mov eax, 0x651abe93
jmp 0x140005a38
cmp ecx, 0x80c011a3
je 0x140005d40
cmp ecx, 0x89a80948
jne 0x140005d4e
movsxd rax, dword [r12 + 0x3c]
cmp dword [rbx + rax], 0x4550
lea r13, [rbx + rax]
mov eax, 0x75a8cf72
mov ecx, 0xf31223a2
cmove eax, ecx
jmp 0x140005a38
movzx eax, word [r13 + 0x14]
lea r15, [rax + r13]
add r15, 0x18
mov eax, 0xe14ca519
xor edi, edi
jmp 0x140005a38
mov eax, 0xcf07a1b4
jmp 0x140005a38
mov eax, 0x80c011a3
mov esi, 4
jmp 0x140005a38
mov rcx, r15
mov rdx, qword [rsp + 0x28]
call fcn.140006673
test eax, eax
mov eax, 0x7b17a501
mov ecx, 0x684fafcc
cmove eax, ecx
jmp 0x140005a38
cmp byte [rbx], 0x4d
mov eax, 0x1015665d
mov ecx, 0x1097649d
cmove eax, ecx
invalid
wait
std
Function at 0x1400081ca
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov rdi, rcx
movsxd rax, dword [rcx + 0x3c]
mov eax, dword [rax + rcx + 0x88]
mov dword [rsp + 0x2c], eax
add rax, rcx
mov qword [rsp + 0x30], rax
mov eax, 0x8a288c0a
xor r15d, r15d
xor r11d, r11d
xor ebp, ebp
xor r10d, r10d
xor esi, esi
xor r13d, r13d
cmp eax, 0x64d47cb
jg 0x14000824e
cmp eax, 0xb3bbf233
jg 0x140008274
cmp eax, 0xa657e235
jle 0x1400082f5
cmp eax, 0xa657e236
je 0x140008317
cmp eax, 0xabc0fbce
jne 0x14000820e
dec r15d
mov eax, 0x21b3d823
mov ecx, 0x580d662e
cmove eax, ecx
xor r12d, r12d
jmp 0x14000820e
cmp eax, 0x580d662d
jg 0x1400082a9
cmp eax, 0x64d47cc
je 0x140008324
cmp eax, 0x21b3d823
je 0x14000832e
cmp eax, 0x252d48fb
je 0x1400082e9
jmp 0x14000820e
cmp eax, 0xb3bbf234
je 0x140008345
cmp eax, 0xc14565db
je 0x1400082e9
cmp eax, 0xceeaadb9
jne 0x14000820e
lea eax, [r15 - 1]
movzx eax, word [rsi + rax*2]
mov ebx, dword [rbp + rax*4]
add rbx, rdi
mov eax, 0x90088515
mov r13, rbx
jmp 0x14000820e
cmp eax, 0x580d662e
je 0x140008396
cmp eax, 0x5debb2fc
je 0x1400083ac
cmp eax, 0x7c585e2a
jne 0x14000820e
mov ebp, dword [r11 + 0x1c]
mov r10d, dword [r11 + 0x20]
add rbp, rdi
add r10, rdi
mov esi, dword [r11 + 0x24]
add rsi, rdi
mov eax, 0xb3bbf234
jmp 0x14000820e
mov eax, 0x90088515
xor ebx, ebx
jmp 0x14000820e
cmp eax, 0x8a288c0a
jne 0x1400083cd
cmp dword [rsp + 0x2c], 0
mov eax, 0x5debb2fc
mov ecx, 0xc14565db
cmove eax, ecx
jmp 0x14000820e
mov eax, 0x90088515
mov rbx, r13
jmp 0x14000820e
mov eax, 0xabc0fbce
jmp 0x14000820e
test r13, r13
sete byte [rsp + 0x2b]
mov eax, 0x580d662e
mov r12b, byte [rsp + 0x2b]
jmp 0x14000820e
lea eax, [r15 - 1]
mov ecx, dword [r10 + rax*4]
add rcx, rdi
mov rdx, qword [rsp + 0x38]
mov r14, r10
mov qword [rsp + 0x40], rbx
mov rbx, r15
mov r15, rdi
mov rdi, rsi
mov rsi, r11
call fcn.140006673
mov r11, rsi
mov rsi, rdi
mov rdi, r15
mov r15, rbx
mov rbx, qword [rsp + 0x40]
mov r10, r14
test eax, eax
mov eax, 0x64d47cc
mov ecx, 0xceeaadb9
cmove eax, ecx
jmp 0x14000820e
test r12b, 1
mov eax, 0xa657e236
mov ecx, 0xb3bbf234
cmovne eax, ecx
jmp 0x14000820e
mov r14, qword [rsp + 0x30]
mov r15d, dword [r14 + 0x18]
test r15d, r15d
mov eax, 0x7c585e2a
mov ecx, 0x252d48fb
cmove eax, ecx
mov r11, r14
jmp 0x14000820e
cmp eax, 0x90088515
jne 0x14000820e
mov rax, rbx
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400081d9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov rdi, rcx
movsxd rax, dword [rcx + 0x3c]
mov eax, dword [rax + rcx + 0x88]
mov dword [rsp + 0x2c], eax
add rax, rcx
mov qword [rsp + 0x30], rax
mov eax, 0x8a288c0a
xor r15d, r15d
xor r11d, r11d
xor ebp, ebp
xor r10d, r10d
xor esi, esi
xor r13d, r13d
cmp eax, 0x64d47cb
jg 0x14000824e
cmp eax, 0xb3bbf233
jg 0x140008274
cmp eax, 0xa657e235
jle 0x1400082f5
cmp eax, 0xa657e236
je 0x140008317
cmp eax, 0xabc0fbce
jne 0x14000820e
dec r15d
mov eax, 0x21b3d823
mov ecx, 0x580d662e
cmove eax, ecx
xor r12d, r12d
jmp 0x14000820e
cmp eax, 0x580d662d
jg 0x1400082a9
cmp eax, 0x64d47cc
je 0x140008324
cmp eax, 0x21b3d823
je 0x14000832e
cmp eax, 0x252d48fb
je 0x1400082e9
jmp 0x14000820e
cmp eax, 0xb3bbf234
je 0x140008345
cmp eax, 0xc14565db
je 0x1400082e9
cmp eax, 0xceeaadb9
jne 0x14000820e
lea eax, [r15 - 1]
movzx eax, word [rsi + rax*2]
mov ebx, dword [rbp + rax*4]
add rbx, rdi
mov eax, 0x90088515
mov r13, rbx
jmp 0x14000820e
cmp eax, 0x580d662e
je 0x140008396
cmp eax, 0x5debb2fc
je 0x1400083ac
cmp eax, 0x7c585e2a
jne 0x14000820e
mov ebp, dword [r11 + 0x1c]
mov r10d, dword [r11 + 0x20]
add rbp, rdi
add r10, rdi
mov esi, dword [r11 + 0x24]
add rsi, rdi
mov eax, 0xb3bbf234
jmp 0x14000820e
mov eax, 0x90088515
xor ebx, ebx
jmp 0x14000820e
cmp eax, 0x8a288c0a
jne 0x1400083cd
cmp dword [rsp + 0x2c], 0
mov eax, 0x5debb2fc
mov ecx, 0xc14565db
cmove eax, ecx
jmp 0x14000820e
mov eax, 0x90088515
mov rbx, r13
jmp 0x14000820e
mov eax, 0xabc0fbce
jmp 0x14000820e
test r13, r13
sete byte [rsp + 0x2b]
mov eax, 0x580d662e
mov r12b, byte [rsp + 0x2b]
jmp 0x14000820e
lea eax, [r15 - 1]
mov ecx, dword [r10 + rax*4]
add rcx, rdi
mov rdx, qword [rsp + 0x38]
mov r14, r10
mov qword [rsp + 0x40], rbx
mov rbx, r15
mov r15, rdi
mov rdi, rsi
mov rsi, r11
call fcn.140006673
mov r11, rsi
mov rsi, rdi
mov rdi, r15
mov r15, rbx
mov rbx, qword [rsp + 0x40]
mov r10, r14
test eax, eax
mov eax, 0x64d47cc
mov ecx, 0xceeaadb9
cmove eax, ecx
jmp 0x14000820e
test r12b, 1
mov eax, 0xa657e236
mov ecx, 0xb3bbf234
cmovne eax, ecx
jmp 0x14000820e
mov r14, qword [rsp + 0x30]
mov r15d, dword [r14 + 0x18]
test r15d, r15d
mov eax, 0x7c585e2a
mov ecx, 0x252d48fb
cmove eax, ecx
mov r11, r14
jmp 0x14000820e
cmp eax, 0x90088515
jne 0x14000820e
mov rax, rbx
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400086f1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rbx
movzx eax, byte [rcx + 0x100]
mov r9b, byte [rcx + 0x101]
mov r10d, 0x5ea7fbd2
mov r11d, 0xdda190f9
cmp r11d, 0x5ea7fbd2
je 0x140008765
cmp r11d, 0x589886c0
je 0x140008738
cmp r11d, 0xdda190f9
jne 0x14000870d
sub r8d, 1
mov r11d, 0x589886c0
cmovb r11d, r10d
jmp 0x14000870d
inc eax
movzx eax, al
mov r11b, byte [rcx + rax]
add r9b, r11b
movzx esi, r9b
mov bl, byte [rcx + rsi]
mov byte [rcx + rax], bl
mov byte [rcx + rsi], r11b
add bl, r11b
movzx r11d, bl
mov r11b, byte [rcx + r11]
xor byte [rdx], r11b
inc rdx
jmp 0x140008707
mov byte [rcx + 0x100], al
mov byte [rcx + 0x101], r9b
pop rbx
pop rsi
ret

Function at 0x140008775
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rbx, qword [rax + 0x10]
mov ecx, 0x826a9a0c
xor eax, eax
mov ebp, 0x8564e20b
mov r14d, 0xca03d4a2
mov r15d, 0xaf5a201d

Function at 0x140009902
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
test rcx, rcx
jne 0x140009938
lea rcx, str.GNUTARGET
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
jne 0x140009938
mov rax, qword [0x1400a24e0]
test rax, rax
jne 0x140009954
mov rax, qword [0x1400e0960]
jmp 0x140009954
lea rdx, str.default
mov qword [rsp + 0x30], rcx
call sub.msvcrt.dll_strcmp
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x140009963
jmp 0x140009923
test rbx, rbx
je 0x14000997f
or byte [rbx + 0x44], 0x40
mov qword [rbx + 8], rax
jmp 0x14000997f
test rbx, rbx
je 0x14000996c
and byte [rbx + 0x44], 0xbf
call fcn.140009770
test rax, rax
je 0x14000997f
test rbx, rbx
je 0x14000997f
mov qword [rbx + 8], rax
add rsp, 0x20
pop rbx
ret
Function at 0x140038739
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0x1505
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14003874f
imul eax, eax, 0x21
add eax, edx
jmp 0x14003873e
ret
Function at 0x140087b02
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, 8
lea r8, [0x1400dc500]
mov rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r8 + rax*4]
shr rcx, 8
xor rax, rcx
dec edx
jne 0x140087b11
ret
Function at 0x1400889d1
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
cmp dword [0x1400f0560], 0
mov rsi, rcx
mov r13, rdx
mov r12, r8
jne 0x140088a18
lea rcx, str.SFRAME_DEBUG
call sub.msvcrt.dll_getenv
mov dword [0x1400f0560], 1
test rax, rax
setne al
movzx eax, al
mov dword [0x1400f0564], eax
test rsi, rsi
je 0x140088a22
test r13, r13
jne 0x140088a31
test r12, r12
je 0x140088a44
mov dword [r12], 0x7d2
jmp 0x140088a44
cmp r13, 0x1b
ja 0x140088a4b
test r12, r12
je 0x140088a44
mov dword [r12], 0x7d3
xor ebx, ebx
jmp 0x140088bb2
movzx edx, word [rsi]
movzx r9d, byte [rsi + 3]
lea rcx, str.sframe_decode:_magic0x_x_version_u_flags_u_n
movzx r8d, byte [rsi + 2]
call fcn.140088424
mov ax, word [rsi]
cmp ax, 0xdee2
je 0x140088a7b
mov r14d, 1
cmp ax, 0xe2de
je 0x140088a7e
jmp 0x140088a37
xor r14d, r14d
mov ecx, 0x40
call sub.msvcrt.dll_malloc
mov qword [rsp + 0x28], rax
mov rbx, rax
test rax, rax
jne 0x140088aa4
test r12, r12
je 0x140088a44
mov dword [r12], 0x7d1
jmp 0x140088a44
mov ecx, 0x10
xor eax, eax
mov rdi, rbx
xor ebp, ebp
rep stosd dword [rdi], eax
test r14d, r14d
je 0x140088afd
mov rcx, r13
call sub.msvcrt.dll_malloc
mov rbp, rax
test rax, rax
je 0x140088a95
mov rdi, rax
mov rcx, r13
xor r8d, r8d
rep movsb byte [rdi], byte [rsi]
mov rcx, rax
call fcn.140088335
mov rdx, r13
mov rcx, rbp
call fcn.14008864f
test eax, eax
je 0x140088af6
mov rcx, rbp
call sub.msvcrt.dll_free
jmp 0x140088a37
mov qword [rbx + 0x38], rbp
mov rsi, rbp
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0xc]
mov rcx, rbx
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0xc], xmm1
call fcn.1400884b8
test eax, eax
jne 0x140088b26
test r12, r12
je 0x140088b91
mov dword [r12], 0x7d1
jmp 0x140088b91
imul r15d, dword [rbx + 8], 0x11
movzx eax, byte [rbx + 7]
lea rsi, [rsi + rax + 0x1c]
movsxd r13, r15d
mov rcx, r13
call sub.msvcrt.dll_malloc
mov qword [rbx + 0x20], rax
test rax, rax
je 0x140088b17
mov rdi, rax
mov rcx, r13
mov edx, r15d
rep movsb byte [rdi], byte [rsi]
lea rcx, str._u_total_fidx_size_n
call fcn.140088424
mov r13d, dword [rbx + 0x10]
mov rcx, r13
call sub.msvcrt.dll_malloc
mov qword [rbx + 0x28], rax
test rax, rax
je 0x140088b17
mov rdi, rax
mov rcx, r13
mov dword [rbx + 0x30], r13d
mov edx, r13d
rep movsb byte [rdi], byte [rsi]
lea rcx, str._u_total_fre_bytes_n
call fcn.140088424
jmp 0x140088bb2
test rbp, rbp
je 0x140088ba3
test r14d, r14d
je 0x140088ba3
mov rcx, rbp
call sub.msvcrt.dll_free
lea rcx, [rsp + 0x28]
call fcn.140088847
jmp 0x140088a44
mov rax, rbx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140093bb2
Capabilities:
Query environment variable

Disassembly:
mov r9d, 1
jmp fcn.1400937d6

Function at 0x140093bf9
Capabilities:
Get common file path

Disassembly:
push rsi
push rbx
sub rsp, 0x28
cmp qword [0x1400f05c0], 0
jne 0x140093c69
mov rsi, qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor edx, edx
xor ecx, ecx
call rsi
mov ebx, eax
test eax, eax
je 0x140093c4c
mov ecx, eax
call fcn.140096583
mov ecx, ebx
mov qword [0x1400f05c0], rax
mov rdx, rax
call rsi
test eax, eax
jne 0x140093c4c
mov rcx, qword [0x1400f05c0]
call sub.msvcrt.dll_free
xor eax, eax
mov qword [0x1400f05c0], rax
jmp 0x140093c56
cmp qword [0x1400f05c0], 0
jne 0x140093c69
lea rcx, [0x1400df498]
call fcn.140096640
mov qword [0x1400f05c0], rax
mov rax, qword [0x1400f05c0]
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x140096a84
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x1400f06a8]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x1400f06a4]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x140096ad2
mov rdx, qword [rax]
cmp r12, rdx
jb 0x140096aca
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140096bb9
inc ebx
add rax, 0x28
jmp 0x140096aaa
mov rcx, r12
call fcn.1400972b1
mov rbp, rax
test rax, rax
jne 0x140096af1
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140096a20
movsxd rbx, ebx
mov rax, qword [0x1400f06a8]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.14009735f
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400f06a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140096b53
mov rax, qword [0x1400f06a8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140096a20
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140096bb3
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140096bb3
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1400f06a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140096bb3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140096a20
inc dword [0x1400f06a4]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140096fe0
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x1400f0700]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400f06e0]
test rbx, rbx
je 0x14009702c
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140097026
test eax, eax
jne 0x140097026
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x140096ffe
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x1400971e0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140097203
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140097203
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140097204
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x14009723e
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x140097235
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140097240
inc r8d
add rax, 0x28
jmp 0x14009721c
xor eax, eax
ret

Function at 0x1400972b1
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x1400e0560]
mov r8, rcx
mov rcx, r9
call fcn.1400971e0
test eax, eax
je 0x1400972dd
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140097204
xor eax, eax
add rsp, 0x28
ret

Function at 0x140097470
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x130
mov rbx, rcx
call sub.msvcrt.dll__errno
xor ecx, ecx
mov dword [rax], ecx
test rbx, rbx
jne 0x140097498
call sub.msvcrt.dll__errno
mov dword [rax], 0xe
jmp 0x1400974a8
cmp byte [rbx], 0
jne 0x1400974af
call sub.msvcrt.dll__errno
mov dword [rax], 0x14
xor ebx, ebx
jmp 0x14009758c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1400974ca
call sub.msvcrt.dll__errno
mov dword [rax], 2
jmp 0x1400974a8
test al, 0x10
je 0x14009749d
lea rdi, [rsp + 0x2c]
mov rdx, rbx
mov r8d, 0x104
mov rcx, rdi
call sub.msvcrt.dll__fullpath
mov rcx, rdi
call sub.msvcrt.dll_strlen
lea rcx, [rax + 0x24b]
call sub.msvcrt.dll_malloc
mov rbx, rax
test rax, rax
jne 0x14009750d
call sub.msvcrt.dll__errno
mov dword [rax], 0xc
jmp 0x1400974a8
lea rsi, [rax + 0x244]
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_strcpy
cmp byte [rbx + 0x244], 0
je 0x14009754e
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov al, byte [rbx + rax + 0x243]
cmp al, 0x5c
je 0x14009754e
cmp al, 0x2f
je 0x14009754e
lea rdx, [0x1400dfeb0]
mov rcx, rsi
call sub.msvcrt.dll_strcat
lea rdx, [0x1400dfeb2]
mov rcx, rsi
call sub.msvcrt.dll_strcat
xor edx, edx
xor eax, eax
mov ecx, 0x41
mov qword [rbx + 0x128], rdx
lea rdx, [rbx + 0x130]
mov dword [rbx + 0x240], eax
mov rdi, rdx
xor eax, eax
mov qword [rbx + 0x238], 0xffffffffffffffff
rep stosd dword [rdi], eax
mov rax, rbx
add rsp, 0x130
pop rbx
pop rsi
pop rdi
ret
Function at 0x1400020e0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140002101
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000212e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140002130
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140002189
test ecx, ecx
jle 0x140002169
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140002189
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140002189
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al