joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140207990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xa8
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r15, rcx
mov qword [rbp - 0x29], rdx
mov ecx, dword [rcx + 0x28]
mov edx, 1
mov r13, r9
mov qword [rbp - 0x31], r9
movzx r14d, r8b
mov byte [rbp - 0x39], r8b
imul ecx, dword [r15 + 0x48]
xor r12b, r12b
mov dword [rbp - 0x21], 0xe011cfd0
mov dword [rbp - 0x1d], 0xe11ab1a1
mov dword [rbp - 1], 0x6f0052
mov dword [rbp + 3], 0x74006f
mov dword [rbp + 7], 0x450020
mov dword [rbp + 0xb], 0x74006e
mov word [rbp + 0xf], 0x72
mov byte [rbp + 0x11], 0x79
mov dword [rbp - 0x19], 0x610050
mov dword [rbp - 0x15], 0x650067
mov dword [rbp - 0x11], 0x61004d
mov dword [rbp - 0xd], 0x65006b
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rsi, rax
test rax, rax
je 0x140207bb3
mov eax, dword [r15 + 0x48]
xor edx, edx
imul eax, dword [r15 + 0x28]
mov rcx, rsi
mov qword [rsp + 0xa0], rbx
mov r8d, eax
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [r15 + 0x48]
xor eax, eax
mov dword [rsp + 0x30], eax
mov r9, rsi
mov qword [rsp + 0x28], rax
mov r8, r13
movzx edx, r14b
mov dword [rsp + 0x20], ebx
call fcn.1401c1720
test eax, eax
je 0x140207ba2
mov rax, qword [rbp - 0x21]
cmp rax, qword [rsi]
jne 0x140207ba2
cmp byte [0x1411dd028], r12b
mov r14d, dword [rsi + 0x2c]
je 0x140207af3
mov byte [rbp - 0x1e], r14b
mov eax, r14d
shr eax, 0x18
mov byte [rbp - 0x21], al
mov eax, r14d
shr eax, 0x10
mov byte [rbp - 0x20], al
mov eax, r14d
shr eax, 8
mov byte [rbp - 0x1f], al
mov r14d, dword [rbp - 0x21]
mov eax, dword [rsi + 0x30]
mov ecx, eax
shr ecx, 0x18
mov byte [rbp - 0x21], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rbp - 0x20], cl
mov ecx, eax
shl r14d, 0x10
add r14d, 0x200
mov byte [rbp - 0x1e], al
shr ecx, 8
mov byte [rbp - 0x1f], cl
mov r13d, dword [rbp - 0x21]
jmp 0x140207b02
mov r13d, dword [rsi + 0x30]
shl r14d, 0x10
add r14d, 0x200
mov eax, dword [r15 + 0x48]
xor edx, edx
imul eax, dword [r15 + 0x28]
mov rcx, rsi
mov r8d, eax
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
mov r8, qword [rbp - 0x31]
mov r9, rsi
movzx edx, byte [rbp - 0x39]
inc r8
mov ecx, dword [r15 + 0x48]
mov eax, r13d
add r8, rax
xor eax, eax
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
call fcn.1401c1720
test eax, eax
je 0x140207ba2
mov r8d, 0x13
lea rcx, [rbp - 1]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140207ba2
mov eax, dword [r15 + 0x28]
imul eax, dword [r15 + 0x48]
cmp eax, 0x91
jbe 0x140207ba2
mov rax, qword [rbp - 0x19]
cmp rax, qword [rsi + 0x80]
jne 0x140207ba2
mov rax, qword [rbp - 0x11]
cmp rax, qword [rsi + 0x88]
jne 0x140207ba2
mov al, 0x72
cmp al, byte [rsi + 0x90]
jne 0x140207ba2
mov rax, qword [rbp - 0x29]
mov r12b, 1
mov ecx, r14d
mov qword [rax + 0x10], rcx
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0xa0]
movzx eax, r12b
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1402b25d0
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbp
ret
Function at 0x140208cc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r13, rdx
mov dword [rsp + 0x40], 0x6f502125
mov rbp, rcx
mov dword [rsp + 0x48], 0x65676150
xor ebx, ebx
mov dword [rsp + 0x4c], 0x31203a73
mov ecx, 0x500000
mov dword [rsp + 0x44], 0x46535045
mov r15, r9
movzx r14d, r8b
xor sil, sil
lea edx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rdi, rax
test rax, rax
je 0x140208dac
xor edx, edx
mov r8d, 0x500000
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [rbp + 0x48]
mov r9, rdi
mov dword [rsp + 0x30], ebx
mov r8, r15
mov qword [rsp + 0x28], rbx
movzx edx, r14b
mov dword [rsp + 0x20], 0x500000
call fcn.1401c1720
test eax, eax
je 0x140208da3
mov eax, dword [rsp + 0x40]
cmp eax, dword [rdi]
jne 0x140208da3
mov eax, dword [rsp + 0x44]
cmp eax, dword [rdi + 0xf]
je 0x140208da3
cmp byte [0x1411dd026], bl
jne 0x140208da3
mov rax, qword [rsp + 0x48]
nop
mov edx, ebx
lea rcx, [rdx + 8]
cmp rcx, 0x500000
jae 0x140208da3
cmp rax, qword [rdx + rdi]
je 0x140208d99
inc ebx
jmp 0x140208d80
lea edx, [rbx + 0xa]
mov sil, 1
mov qword [r13 + 0x10], rdx
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movzx eax, sil
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1402b25d0
add rsp, 0x60
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14020d170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rbp - 0x20], rax
xor r14b, r14b
mov dword [rbp - 0x30], 0x66757453
cmp byte [0x1411dd026], r14b
mov r13, r9
movzx r12d, r8b
mov dword [rbp - 0x2c], 0x20744966
mov r15, rdx
mov dword [rbp - 0x28], 0x31296328
mov rbx, rcx
mov word [rbp - 0x24], 0x3939
mov dword [rbp - 0x38], 0x21544953
je 0x14020d1d2
xor al, al
jmp 0x14020d2d6
mov ecx, dword [rcx + 0x28]
mov edx, 1
imul ecx, dword [rbx + 0x48]
mov qword [rsp + 0x70], rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rsi, rax
test rax, rax
je 0x14020d2cd
mov eax, dword [rbx + 0x28]
xor edx, edx
mov qword [rsp + 0x68], rdi
mov rcx, rsi
mov edi, dword [rbx + 0x48]
imul eax, edi
mov r8d, eax
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov r9, rsi
mov dword [rsp + 0x30], eax
mov r8, r13
mov qword [rsp + 0x28], rax
movzx edx, r12b
mov ecx, edi
mov dword [rsp + 0x20], ebx
call fcn.1401c1720
mov rdi, qword [rsp + 0x68]
test eax, eax
je 0x14020d2c4
mov rax, qword [rbp - 0x30]
cmp rax, qword [rsi]
jne 0x14020d28c
mov eax, dword [rbp - 0x28]
cmp eax, dword [rsi + 8]
jne 0x14020d28c
movzx eax, word [rbp - 0x24]
cmp ax, word [rsi + 0xc]
jne 0x14020d28c
cmp byte [0x1411dd028], r14b
mov ecx, dword [rsi + 0x54]
jne 0x14020d284
mov eax, ecx
mov byte [rbp - 0x35], cl
shr eax, 0x18
mov byte [rbp - 0x38], al
mov eax, ecx
shr eax, 0x10
mov byte [rbp - 0x37], al
mov eax, ecx
shr eax, 8
mov byte [rbp - 0x36], al
mov ecx, dword [rbp - 0x38]
mov eax, ecx
mov qword [r15 + 0x10], rax
jmp 0x14020d2c1
mov eax, dword [rbp - 0x38]
cmp eax, dword [rsi]
jne 0x14020d2c4
cmp byte [0x1411dd028], r14b
mov ecx, dword [rsi + 6]
jne 0x14020d2bd
mov eax, ecx
mov byte [rbp - 0x35], cl
shr eax, 0x18
mov byte [rbp - 0x38], al
mov eax, ecx
shr eax, 0x10
mov byte [rbp - 0x37], al
mov eax, ecx
shr eax, 8
mov byte [rbp - 0x36], al
mov ecx, dword [rbp - 0x38]
mov qword [r15 + 0x10], rcx
mov r14b, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rsi, qword [rsp + 0x70]
movzx eax, r14b
mov rcx, qword [rbp - 0x20]
xor rcx, rsp
call fcn.1402b25d0
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rbx
pop rbp
ret
Function at 0x14020d300
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rdx
mov dword [rbp - 0x20], 0x694c5153
mov rbx, rcx
mov dword [rbp - 0x1c], 0x66206574
mov edx, 1
mov dword [rbp - 0x18], 0x616d726f
mov ecx, 0x10000
mov dword [rbp - 0x14], 0x332074
mov r15, r9
movzx r14d, r8b
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rdi, rax
test rax, rax
je 0x14020d41a
xor edx, edx
mov r8d, 0x10000
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [rbx + 0x48]
xor eax, eax
mov dword [rsp + 0x30], eax
mov r9, rdi
mov qword [rsp + 0x28], rax
mov r8, r15
movzx edx, r14b
mov dword [rsp + 0x20], 0x10000
call fcn.1401c1720
test eax, eax
je 0x14020d411
mov rax, qword [rbp - 0x20]
cmp rax, qword [rdi]
jne 0x14020d411
mov rax, qword [rbp - 0x18]
cmp rax, qword [rdi + 8]
jne 0x14020d411
cmp byte [0x1411dd028], 0
movzx edx, word [rdi + 0x10]
jne 0x14020d3f0
movzx eax, dx
mov byte [rbp - 0x27], dl
shr ax, 8
mov byte [rbp - 0x28], al
mov eax, dword [rdi + 0x1c]
mov ecx, eax
movzx edx, word [rbp - 0x28]
shr ecx, 0x18
mov byte [rbp - 0x28], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rbp - 0x27], cl
mov ecx, eax
shr ecx, 8
mov byte [rbp - 0x26], cl
mov byte [rbp - 0x25], al
mov ecx, dword [rbp - 0x28]
jmp 0x14020d3f3
mov ecx, dword [rdi + 0x1c]
movzx ebx, dx
imul ebx, ecx
mov rcx, rdi
mov byte [0x1411dd036], 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov al, 1
mov qword [rsi + 0x10], rbx
jmp 0x14020d41c
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1402b25d0
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1402155c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, dword [rcx + 0x28]
mov r15, rcx
imul eax, dword [rcx + 0x48]
mov r13, r9
mov qword [rsp + 0x48], rdx
movzx r12d, r8b
mov edx, 1
mov dword [rsp + 0x58], 0x6d783f3c
xor r14b, r14b
mov dword [rsp + 0x5c], 0x6576206c
mov dword [rsp + 0x50], 0x6e755469
mov word [rsp + 0x54], 0x7365
mov dword [rsp + 0x40], 0x696c702f
lea ecx, [rax + rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbp, rax
test rax, rax
je 0x1402157ba
mov eax, dword [r15 + 0x48]
xor edx, edx
imul eax, dword [r15 + 0x28]
mov rcx, rbp
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x70], rsi
add eax, eax
mov r8d, eax
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [r15 + 0x48]
xor esi, esi
mov dword [rsp + 0x30], esi
mov r9, rbp
mov qword [rsp + 0x28], rsi
mov r8, r13
movzx edx, r12b
mov dword [rsp + 0x20], ebx
call fcn.1401c1720
mov rbx, qword [rsp + 0x78]
test eax, eax
je 0x14021578a
mov rax, qword [rsp + 0x58]
cmp rax, qword [rbp]
jne 0x14021578a
cmp byte [0x1411dd026], sil
mov ecx, 0x12c
jne 0x14021578a
mov eax, dword [r15 + 0x28]
imul eax, dword [r15 + 0x48]
movzx r9d, word [rsp + 0x54]
mov r10d, dword [rsp + 0x50]
lea r8d, [rax + rax]
nop word [rax + rax]
mov edx, ecx
lea rax, [rdx + 6]
cmp rax, r8
jae 0x14021578a
cmp r10d, dword [rdx + rbp]
jne 0x1402156ed
cmp r9w, word [rdx + rbp + 4]
je 0x1402156f1
inc ecx
jmp 0x1402156d0
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edx, 1
mov ecx, 0x200000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbp, rax
test rax, rax
je 0x140215793
xor edx, edx
mov r8d, 0x200000
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [r15 + 0x48]
lea r8, [r13 + 2]
mov dword [rsp + 0x30], esi
mov r9, rbp
mov qword [rsp + 0x28], rsi
movzx edx, r12b
mov dword [rsp + 0x20], 0x200000
call fcn.1401c1720
test eax, eax
je 0x14021578a
cmp byte [0x1411dd026], sil
jne 0x14021578a
mov eax, dword [rsp + 0x40]
nop dword [rax]
mov edx, esi
lea rcx, [rdx + 4]
cmp rcx, 0x200000
jae 0x14021578a
cmp eax, dword [rdx + rbp]
je 0x140215778
inc esi
jmp 0x140215760
mov rax, qword [rsp + 0x48]
lea ecx, [rsi + 0x407]
mov r14b, 1
mov qword [rax + 0x10], rcx
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rsi, qword [rsp + 0x70]
movzx eax, r14b
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1402b25d0
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movzx eax, r14b
jmp 0x14021579c
Function at 0x14021ebc0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rsp + 0x70], rax
cmp byte [0x1411ec733], 0
lea rcx, [0x1411e9a80]
mov ebx, dword [rsp + 0xd0]
mov ebp, edx
lea rdx, [rsp + 0x50]
mov r15, r9
mov r14, r8
je 0x14021ecfd
call qword [sym.imp.Qt5Core.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_QString::toStdWString_void____ptr64]
cmp qword [rax + 0x18], 8
jb 0x14021ec1a
mov rax, qword [rax]
xor edi, edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov rcx, rax
mov dword [rsp + 0x20], 3
lea r8d, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdx, qword [rsp + 0x68]
mov rsi, rax
cmp rdx, 8
jb 0x14021ec8e
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14021ec89
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14021ec89
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402b2268
imul ebx, ebp
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], di
shl ebx, 9
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8d, ebx
xor edx, edx
mov rcx, rax
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
cmp rsi, 0xffffffffffffffff
je 0x14021ecd7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1402b25d0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
imul ebx, ebp
shl ebx, 9
call qword [sym.imp.Qt5Core.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_QString::toStdWString_void____ptr64]
cmp qword [rax + 0x18], 8
jb 0x14021ed13
mov rax, qword [rax]
xor edi, edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov rcx, rax
mov dword [rsp + 0x20], 3
lea r8d, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdx, qword [rsp + 0x68]
mov rsi, rax
cmp rdx, 8
jb 0x14021ed87
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14021ed82
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14021ed82
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402b2268
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], di
cmp rsi, 0xffffffffffffffff
je 0x14021ecd7
shl ebp, 9
lea r8, [rsp + 0x4c]
mov eax, ebp
xor r9d, r9d
imul rax, r14
mov rcx, rsi
mov edx, eax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rdi
mov r8d, ebx
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x14021ecd9
Function at 0x14029de50
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x40
movzx r10d, word [rcx + 0x30]
mov rbx, r9
movzx r9d, word [rsp + 0x70]
mov r11, rcx
mov eax, edx
imul r10, rax
movzx eax, r8w
add r10, rax
mov rax, qword [rcx + 0x27c]
cmp byte [rcx + 0x23a], 0
jne 0x14029dec0
mov ecx, dword [rcx + 0x18]
lea r8, [rax + r10]
mov rax, qword [rsp + 0x78]
mov edx, ecx
imul edx, r9d
mov r9, rbx
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
shl edx, 9
mov dword [rsp + 0x20], edx
movzx edx, byte [r11 + 0x24f]
call fcn.1401c1720
add rsp, 0x40
pop rbx
ret
lea rdx, [rax + r10]
mov r8, rbx
add rsp, 0x40
pop rbx
jmp fcn.14029dee0
Function at 0x14029e1f0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x48
cmp byte [rcx + 0x23a], 0
mov r11, r8
mov r8, rdx
mov r10, rcx
jne 0x14029e234
add r8, qword [rcx + 0x27c]
xor eax, eax
movzx edx, byte [rcx + 0x24f]
mov ecx, dword [rcx + 0x18]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r9d
mov r9, r11
call fcn.1401c1720
add rsp, 0x48
ret
mov ecx, dword [rcx + 0x18]
xor edx, edx
shl ecx, 9
mov eax, r9d
div ecx
mov rdx, qword [r10 + 0x27c]
mov rcx, r10
add rdx, r8
mov r9d, eax
mov r8, r11
add rsp, 0x48
jmp fcn.14029dee0
Function at 0x1402b2384
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x1402b240f
movsxd rcx, dword [0x14000003c]
lea rdx, [0x140000000]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x1402b240f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1402b240f
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x1402b240b
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x1402b2405
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jae 0x1402b2405
test rdx, rdx
je 0x1402b240b
cmp dword [rdx + 0x24], 0
jge 0x1402b2401
xor al, al
jmp 0x1402b2415
mov al, 1
jmp 0x1402b2415
add rdx, 0x28
jmp 0x1402b23d7
xor al, al
jmp 0x1402b2415
xor al, al
jmp 0x1402b2415
add rsp, 0x18
ret

Function at 0x1402b3610
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x50], rax
mov rdi, rax
test rax, rax
jne 0x1402b364d
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x40]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x98], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x60], r14
cmovo rax, r15
mov rcx, rax
call fcn.1402b2a70
mov r14, rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x1402b374c
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0xa0], r12
mov r12, r14
mov qword [rsp + 0x68], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
nop word [rax + rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.1402b2a70
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x40]
inc r14d
cmp r14d, eax
jne 0x1402b36c0
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x90]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x40]
mov rdx, r14
call fcn.14008b090
mov esi, eax
cmp dword [rsp + 0x40], ebx
je 0x1402b378b
mov rdi, r14
mov rcx, qword [rdi]
test rcx, rcx
je 0x1402b378b
call fcn.1402b2268
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x40]
jne 0x1402b3772
mov rcx, r14
call fcn.1402b2268
mov r14, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x98]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
Function at 0x140001190
Capabilities:
Create directory

Disassembly:
sub rsp, 0x58
mov eax, 0x3bf255f0
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x3c], 0x2fe6135
inc byte [rdx]

Function at 0x1400011ac
Capabilities:
Create directory

Disassembly:
mov dword [rsp + 0x38], edx
mov qword [rsp + 0x30], rcx
jb sym.wer.dll_WerSysprepGeneralize
jmp 0x14000120b
mov eax, 0x4963226b
mov ecx, eax
mov eax, dword [rsp + 0x38]
add eax, 0x5008bf9e
mov dword [rsp + 0x54], eax
and al, 0x54

Function at 0x14000123c
Capabilities:
Create directory

Disassembly:
mov rax, qword [sym.imp.KERNEL32.dll_SetLastError]
and al, 0x54
mov qword [rsp + 0x40], 0x29ed8b53
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, rdx
shl rdx, cl
mov qword [rsp + 0x48], rdx
mov rdx, qword [rsp + 0x40]
sub rdx, 0x67b8bbca
mov eax, dword [rsp + 0x38]
and eax, 0x4169a3e1
mov dword [rsp + 0x54], eax
mov r8, qword [rsp + 0x20]
cmp r8, rdx
ja 0x1400011b9
jmp 0x1400011b9

Function at 0x140001270
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
cmp eax, 4
jae 0x140001292
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0xfffffffe
call rax
ud2
add rsp, 0x28
ret

Function at 0x1400012a0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x2a8
xor eax, eax
mov ecx, eax
lea rdx, [rsp + 0x80]
lea r8, [rsp + 0x7c]
mov dword [rsp + 0x2a4], 0x5610dee9
add cl, ch
ficom word [rax]
push rsi

Function at 0x1400012e8
Capabilities:
Terminate process

Disassembly:
cwde
add al, byte [rax]
add byte [0x18c2934d5], ch
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor eax, eax
mov esi, eax
mov qword [rsp + 0x70], rcx
mov rcx, rsi
mov qword [rsp + 0x68], r10
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], r9
invalid
invalid

Function at 0x14000132c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x48], rcx
mov rcx, rax
mov rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x48]
invalid
invalid

Function at 0x140001350
Capabilities:
Terminate process

Disassembly:
lea r9, [rsp + 0x7c]
mov r10, qword [rsp + 0x60]
mov qword [rsp + 0x38], rcx
mov rcx, r10
mov ecx, edx

Function at 0x1400013d0
Capabilities:
Terminate process

Disassembly:
test al, 2
add byte [rax], al
pop rdi
pop rsi
ret
Function at 0x180003ba0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x180003bc2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x180003c3c
mov rdi, r14
mov rcx, rbx
call fcn.180005e90
test rax, rax
jle 0x180003c14
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.18000a990
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x180003c2c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x180003c34
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x180003bd6
sub r14, rdi
jmp 0x180003d29
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x180003c53
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180003c55
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180003c8a
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.18000a990
mov rax, qword [rbx + 0x50]
sub rbp, rdi
add rsi, rdi
mov r8, rbp
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x180003d26
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r9], rax
jne 0x180003cc5
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x180003d01
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.18001069c
sub rbp, rax
add rsi, rax
mov rdi, rbp
cmp rax, 0xfff
jne 0x180003d3f
cmp rbp, rax
ja 0x180003cd1
mov r8, rdi
test rdi, rdi
je 0x180003d26
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.18001069c
mov r8, rdi
sub r8, rax
sub r14, r8
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
sub r14, rbp
jmp 0x180003d29