joyce8/EMBER2024-capa huggingface dataset:
Function at 0x25128ae0
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
push rdi
push rsi
lea rsp, [rsp - 0x20]
mov ax, word [0x251371d0]
cmp ax, 0xcb
je 0x25128c15
cmp ax, 0xcc
je 0x25128c15
mov rax, qword [0x25140810]
test rax, rax
je 0x25128b1c
mov ecx, dword [0x251405f0]
call rax
mov rbx, rax
jmp 0x25128b23
lea rbx, [0x251405f8]
cmp word [0x251405e0], 0
jle 0x25128b4a
lea rcx, [0x251405b0]
call fcn.25128e30
mov rcx, rbx
call fcn.25128580
mov rcx, rbx
call fcn.25128610
mov rsi, qword [rbx]
jmp 0x25128b7a
mov rdi, qword [rsi + 8]
mov rax, qword [rsi]
and rax, 1
test rax, rax
jne 0x25128b6d
mov rdx, rsi
mov rcx, rbx
call fcn.251277b0
jmp 0x25128b77
mov rax, qword [rsi]
and rax, 0xfffffffffffffffe
mov qword [rsi], rax
mov rsi, rdi
test rsi, rsi
jne 0x25128b50
mov qword [rbx], 0
mov dword [rbx + 0x90], 0
cmp word [0x251405e0], 0
jle 0x25128c15
lea rdx, [0x251404c0]
mov rcx, rbx
call fcn.25127940
mov rsi, rax
test rsi, rsi
je 0x25128be4
mov rax, qword [0x25140560]
mov qword [rsi + 0x18], rax
cmp qword [0x25140560], 0
je 0x25128bd6
mov rax, qword [0x25140560]
mov qword [rax + 0x10], rsi
mov rax, qword [rbx + 0xa0]
mov qword [0x25140560], rax
sub word [0x251405e0], 1
cmp word [0x251405e0], 0
sete bl
lea rcx, [0x251405b0]
call fcn.25128e50
test bl, bl
je 0x25128c15
lea rcx, [0x251405b0]
call fcn.25128e10
nop
lea rsp, [rsp + 0x20]
pop rsi
pop rdi
pop rbx
ret
Function at 0x2512ab00
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push rsi
push r12
push r13
push r14
lea rsp, [rsp - 0x138]
mov esi, 0
mov qword [0x251403a0], 0
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x28]
mov r8d, 0x104
movabs rcx, 0
call sub.kernel32.dll_GetModuleFileNameA
mov ebx, eax
mov eax, ebx
and eax, 0xffffffff
mov byte [rsp + rax + 0x28], 0
mov r8d, ebx
mov rcx, rsp
mov edx, 0
call fcn.2512ace0
movsxd rax, ebx
lea r8, [rax + 1]
mov rax, qword [0x251403a0]
mov rdx, qword [rax]
lea rcx, [rsp + 0x28]
call fcn.25121980
call sub.kernel32.dll_GetCommandLineA
mov qword [0x25137250], rax
mov r14, qword [0x25137250]
jmp 0x2512ac90
add r14, 1
movzx eax, byte [r14]
sub eax, 1
cmp eax, 0x20
jb 0x2512aba0
cmp byte [r14], 0
je 0x2512ac9a
mov dil, 0
mov r12, r14
mov ebx, 0
jmp 0x2512ac02
mov al, byte [r14]
cmp al, 1
jb 0x2512abfb
sub al, 1
sub al, 0x1f
jbe 0x2512abdb
sub al, 2
je 0x2512abe5
jmp 0x2512abfb
test dil, dil
je 0x2512ac08
add ebx, 1
jmp 0x2512abfe
cmp byte [r14 + 1], 0x22
je 0x2512abf5
test dil, dil
sete dil
jmp 0x2512abfe
add r14, 1
jmp 0x2512abfe
add ebx, 1
add r14, 1
cmp byte [r14], 0
jne 0x2512abc8
test esi, esi
je 0x2512ac8d
mov r8d, ebx
mov edx, esi
mov rcx, rsp
call fcn.2512ace0
mov dil, 0
mov r14, r12
mov rdx, qword [0x251403a0]
movsxd rax, esi
mov r13, qword [rdx + rax*8]
jmp 0x2512ac82
mov al, byte [r14]
cmp al, 1
jb 0x2512ac73
sub al, 1
sub al, 0x1f
jbe 0x2512ac4b
sub al, 2
je 0x2512ac5d
jmp 0x2512ac73
test dil, dil
je 0x2512ac88
mov al, byte [r14]
mov byte [r13], al
add r13, 1
jmp 0x2512ac7e
cmp byte [r14 + 1], 0x22
je 0x2512ac6d
test dil, dil
sete dil
jmp 0x2512ac7e
add r14, 1
jmp 0x2512ac7e
mov al, byte [r14]
mov byte [r13], al
add r13, 1
add r14, 1
cmp byte [r14], 0
jne 0x2512ac38
mov byte [r13], 0
add esi, 1
cmp byte [r14], 0
jne 0x2512aba4
mov dword [0x25140390], esi
movsxd rax, esi
lea rdx, [rax + 1]
shl rdx, 3
lea rcx, [0x251403a0]
call fcn.251288a0
mov rax, qword [0x251403a0]
movsxd rsi, esi
mov qword [rax + rsi*8], 0
nop
lea rsp, [rsp + 0x138]
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
ret

Function at 0x2512c620
Capabilities:
Read file via mapping

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x60]
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], rdx
mov dword [rbp - 0x18], r8d
mov byte [rbp - 0x20], 0
mov rax, qword [rbp - 8]
mov r8d, 0xffffffff
mov edx, 0
mov ecx, 4
mov r9, rax
call fcn.25130c00
mov qword [rbp - 0x28], rax
cmp qword [rbp - 0x28], 0
je 0x2512c6c8
nop
mov eax, dword [rbp - 0x18]
mov qword [rsp + 0x20], rax
mov rcx, qword [rbp - 0x28]
mov r9d, 0
mov r8d, 0
mov edx, 4
call sub.kernel32.dll_MapViewOfFile
mov qword [rbp - 0x30], rax
cmp qword [rbp - 0x30], 0
jne 0x2512c69d
mov rcx, rsp
lea rdx, [0x2512c6c8]
call fcn.2512bbf0
mov r8d, dword [rbp - 0x18]
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x30]
call fcn.25121980
mov rcx, qword [rbp - 0x30]
call sub.kernel32.dll_UnmapViewOfFile
or eax, eax
setne al
mov byte [rbp - 0x20], al
nop
mov rcx, rbp
call fcn.2512c600
movzx eax, byte [rbp - 0x20]
nop
lea rsp, [rbp]
pop rbp
ret
Function at 0x2512d100
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x2c0]
mov qword [rbp - 0x278], rbx
mov qword [rbp - 0x270], rdi
mov qword [rbp - 0x268], rsi
mov qword [rbp - 0x260], r12
mov qword [rbp - 0x258], r13
mov rsi, rcx
mov qword [rbp - 0x240], 0
mov qword [rbp - 0x238], 0
mov qword [rbp - 0x230], 0
nop
mov rcx, rsi
call sub.kernel32.dll_GlobalLock
mov rbx, rax
test rbx, rbx
jne 0x2512d184
call sub.kernel32.dll_GetLastError
mov edi, eax
mov r8d, edi
lea rdx, str.Twain.ProcessNative.GlobalLock
mov ecx, 1
call fcn.2512e3b0
jmp 0x2512d389
mov rcx, rsi
call sub.kernel32.dll_GlobalSize
mov r12, rax
test r12, r12
je 0x2512d389
lea rcx, [rbp - 0x228]
mov r8d, 0
movabs rdx, 0x20a
call fcn.25121c80
lea rdx, [rbp - 0x228]
mov ecx, 0x104
call sub.kernel32.dll_GetTempPathW
lea rcx, [rbp - 0x238]
call fcn.25123d90
call sub.kernel32.dll_GetTickCount
and eax, 0xffffffff
cvtsi2ss xmm1, rax
lea rcx, [rbp - 0x240]
call fcn.2512e570
mov rdx, qword [rbp - 0x240]
lea r8, [0x2513a5c0]
lea rcx, [rbp - 0x238]
mov r9d, 0
call fcn.25123f20
mov rdx, qword [rbp - 0x238]
lea rcx, [rbp - 0x230]
call fcn.25124990
mov rdx, qword [rbp - 0x230]
test rdx, rdx
jne 0x2512d232
lea rdx, [0x25140470]
lea rcx, [rbp - 0x228]
call sub.kernel32.dll_lstrcatW
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
lea rcx, [rbp - 0x228]
movabs r9, 0
mov r8d, 0
mov edx, 0xc0000000
call sub.kernel32.dll_CreateFileW
mov r13, rax
cmp r13, 0xffffffffffffffff
jne 0x2512d2a9
call sub.kernel32.dll_GetLastError
mov edi, eax
mov r8d, edi
lea rdx, str.Twain.ProcessNative.CreateFile
mov ecx, 1
call fcn.2512e3b0
mov rcx, rsi
call sub.kernel32.dll_GlobalUnlock
jmp 0x2512d389
lea rcx, [rbp - 0x18]
mov r8d, 0
movabs rdx, 0xe
call fcn.25121c80
mov word [rbp - 0x18], 0x4d42
mov dword [rbp - 0x16], 0xe
mov word [rbp - 0x12], 0
mov word [rbp - 0x10], 0
mov dword [rbp - 0xe], 0xe
mov qword [rsp + 0x20], 0
lea r9, [rbp - 8]
lea rdx, [rbp - 0x18]
mov rcx, r13
mov r8d, 0xe
call sub.kernel32.dll_WriteFile
test eax, eax
je 0x2512d341
mov qword [rsp + 0x20], 0
mov r8d, r12d
mov rdx, rbx
lea r9, [rbp - 8]
mov rcx, r13
call sub.kernel32.dll_WriteFile
test eax, eax
jne 0x2512d35c
call sub.kernel32.dll_GetLastError
mov edi, eax
mov r8d, edi
lea rdx, str.Twain.ProcessNative.WriteFile.lpDib
mov ecx, 1
call fcn.2512e3b0
jmp 0x2512d35c
call sub.kernel32.dll_GetLastError
mov edi, eax
mov r8d, edi
lea rdx, str.Twain.ProcessNative.WriteFile.BitmapFileHeader
mov ecx, 1
call fcn.2512e3b0
mov rcx, rsi
call sub.kernel32.dll_GlobalUnlock
mov rcx, r13
call sub.kernel32.dll_CloseHandle
lea rcx, [rbp - 0x228]
call fcn.2512cf50
test al, al
jne 0x2512d388
lea rcx, [rbp - 0x228]
call sub.kernel32.dll_DeleteFileW
nop
mov rcx, rbp
call fcn.2512d0c0
mov rbx, qword [rbp - 0x278]
mov rdi, qword [rbp - 0x270]
mov rsi, qword [rbp - 0x268]
mov r12, qword [rbp - 0x260]
mov r13, qword [rbp - 0x258]
lea rsp, [rbp]
pop rbp
ret
Function at 0x2512e990
Capabilities:
Get graphical window text

Disassembly:
push rbx
push rdi
push rsi
push r12
lea rsp, [rsp - 0x38]
mov ebx, ecx
mov rsi, rdx
mov edi, r8d
lea r12d, [edi + 0x214]
movsxd rdx, r12d
lea rcx, [rsp + 0x20]
call fcn.25127560
movsxd rdx, r12d
mov rcx, qword [rsp + 0x20]
mov r8d, 0
call fcn.25121c80
mov rax, qword [rsp + 0x20]
mov byte [rax], 4
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x210], ebx
call sub.kernel32.dll_GetCurrentProcessId
mov rdx, qword [rsp + 0x20]
mov dword [rdx + 0x20c], eax
call sub.user32.dll_GetForegroundWindow
mov rbx, rax
test rbx, rbx
je 0x2512ea29
lea rdx, [rsp + 0x28]
mov rcx, rbx
call sub.user32.dll_GetWindowThreadProcessId
call sub.kernel32.dll_GetCurrentProcessId
cmp eax, dword [rsp + 0x28]
jne 0x2512ea29
mov rax, qword [rsp + 0x20]
lea rdx, [rax + 2]
mov rcx, rbx
mov r8d, 0x104
call sub.user32.dll_GetWindowTextW
mov rax, qword [rsp + 0x20]
lea rdx, [rax + 0x214]
movsxd r8, edi
mov rcx, rsi
call fcn.25121980
mov edx, r12d
mov rcx, qword [rsp + 0x20]
call fcn.2512e180
mov rcx, qword [rsp + 0x20]
call fcn.251275c0
nop
lea rsp, [rsp + 0x38]
pop r12
pop rsi
pop rdi
pop rbx
ret

Function at 0x2512f560
Capabilities:
Get disk information

Disassembly:
push rbx
push rdi
push rsi
lea rsp, [rsp - 0x680]
mov rbx, rcx
mov rsi, rdx
cmp rbx, 0x8000
je 0x2512f587
cmp rbx, 0x8004
jne 0x2512f699
test rsi, rsi
je 0x2512f699
cmp dword [rsi + 4], 2
jne 0x2512f699
lea rcx, [rsp + 0x40]
mov r8d, 0
movabs rdx, 0x62c
call fcn.25121c80
mov byte [rsp + 0x40], 6
mov edi, 0
sub edi, 1
nop
nop
add edi, 1
movsxd rax, edi
mov edx, dword [rsi + 0xc]
mov ecx, eax
shr edx, cl
cmp edx, 1
jne 0x2512f5f0
lea ecx, [edi + 0x41]
and ecx, 0xff
call fcn.251253d0
mov word [rsp + 0x4c], ax
jmp 0x2512f5f5
cmp edi, 0x19
jl 0x2512f5c8
cmp word [rsp + 0x4c], 0
je 0x2512f699
mov word [rsp + 0x4e], 0x3a
mov word [rsp + 0x50], 0x5c
mov word [rsp + 0x42], bx
lea rcx, [rsp + 0x4c]
call sub.kernel32.dll_GetDriveTypeW
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], 0
mov ecx, 1
call sub.kernel32.dll_SetErrorMode
mov ebx, eax
mov dword [rsp + 0x38], 0x104
lea rax, [rsp + 0x670]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x678]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x256]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x48]
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x4c]
mov r8d, 0x104
call sub.kernel32.dll_GetVolumeInformationW
mov ecx, ebx
call sub.kernel32.dll_SetErrorMode
lea rcx, [rsp + 0x40]
mov edx, 0x62c
call fcn.2512e180
nop
lea rsp, [rsp + 0x680]
pop rsi
pop rdi
pop rbx
ret

Function at 0x2512fa60
Capabilities:
Terminate thread

Disassembly:
lea rsp, [rsp - 0x28]
cmp qword [0x25137870], 0
je 0x2512faaf
call fcn.2512f760
mov rax, qword [0x25137870]
mov rcx, rax
call fcn.251338d0
test al, al
je 0x2512fa98
mov rcx, qword [0x25137870]
mov edx, 0
call sub.kernel32.dll_TerminateThread
mov rcx, qword [0x25137870]
call sub.kernel32.dll_CloseHandle
mov qword [0x25137870], 0
nop
lea rsp, [rsp + 0x28]
ret
Function at 0x25134110
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push rbx
push rdi
push rsi
push r12
push r13
push r14
push r15
push rbp
lea rsp, [rsp - 0x88]
mov rbx, rcx
mov eax, edx
mov qword [rsp + 0x80], rax
movabs rbp, 0
lea rcx, [rsp + 0x50]
mov r8d, 0
movabs rdx, 0x30
call fcn.25121c80
lea rcx, [rsp + 0x50]
call sub.kernel32.dll_GetSystemInfo
mov rdx, qword [rsp + 0x58]
mov rax, rbx
sub rax, rdx
cmp rax, 0x7fffffff
jbe 0x2513417e
lea rax, [rbx - 0x7fffffff]
mov r15, rax
jmp 0x25134183
mov r15, qword [rsp + 0x58]
mov rax, qword [rsp + 0x60]
sub rax, rbx
cmp rax, 0x7fffffff
jbe 0x2513419c
lea rdx, [rbx + 0x7fffffff]
jmp 0x251341a1
mov rdx, qword [rsp + 0x60]
mov eax, dword [rsp + 0x80]
mov ecx, eax
sub rdx, rcx
mov r14, rdx
mov r13b, 0
mov r12b, 0
lea rcx, [rsp + 0x20]
mov r8d, 0
movabs rdx, 0x30
call fcn.25121c80
lea rdx, [rsp + 0x20]
mov rcx, rbx
movabs r8, 0x30
call sub.kernel32.dll_VirtualQuery
cmp rax, 0
jbe 0x25134210
mov rax, qword [rsp + 0x28]
lea rax, [rax - 0x10000]
mov rdi, rax
mov rax, qword [rsp + 0x28]
lea rax, [rax + 0x10000]
mov rsi, rax
jmp 0x251342f0
mov eax, dword [rsp + 0x54]
lea rax, [rax + rbx]
mov rdi, rax
mov edx, dword [rsp + 0x54]
mov rax, rbx
sub rax, rdx
mov rsi, rax
jmp 0x251342f0
cmp rdi, r14
jae 0x25134292
test r13b, r13b
jne 0x25134292
mov edx, dword [rsp + 0x54]
mov rcx, rdi
mov r9d, 1
mov r8d, 0x2000
call sub.kernel32.dll_VirtualAlloc
mov rbp, rax
test rbp, rbp
je 0x25134283
mov eax, dword [rsp + 0x80]
mov edx, eax
mov rcx, rbp
mov r9d, 0x40
mov r8d, 0x1000
call sub.kernel32.dll_VirtualAlloc
mov rbp, rax
test rbp, rbp
jne 0x251342fe
add rdi, 0x10000
cmp rdi, r14
jb 0x25134292
mov r12b, 0
cmp rsi, r15
jbe 0x251342f0
test r12b, r12b
jne 0x251342f0
mov edx, dword [rsp + 0x54]
mov rcx, rsi
mov r9d, 1
mov r8d, 0x2000
call sub.kernel32.dll_VirtualAlloc
mov rbp, rax
test rbp, rbp
je 0x251342e1
mov eax, dword [rsp + 0x80]
mov edx, eax
mov rcx, rbp
mov r9d, 0x40
mov r8d, 0x1000
call sub.kernel32.dll_VirtualAlloc
mov rbp, rax
test rbp, rbp
jne 0x251342fe
sub rsi, 0x10000
cmp rsi, r15
ja 0x251342f0
mov r13b, 0
cmp rdi, r14
jae 0x251342fe
cmp rsi, r15
ja 0x25134230
mov rax, rbp
nop
lea rsp, [rsp + 0x88]
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
ret
Function at 0x25134470
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0xb0]
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], rdx
mov qword [rbp - 0x18], r8
mov byte [rbp - 0x20], 0
mov rax, qword [rbp - 8]
mov edx, 0x64
mov rcx, rax
call fcn.25134110
mov rdx, qword [rbp - 0x18]
mov qword [rdx], rax
mov rax, qword [rbp - 0x18]
cmp qword [rax], 0
je 0x25134677
mov ecx, 0
call sub.kernel32.dll_SetLastError
nop
mov dword [rbp - 0x28], 0
lea rcx, [rbp - 0x68]
mov r8d, 0
movabs rdx, 0x38
call fcn.25121c80
mov rax, qword [rbp - 8]
mov qword [rbp - 0x68], rax
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x60], rax
mov rax, qword [rbp - 0x18]
mov rax, qword [rax]
mov qword [rbp - 0x58], rax
lea rcx, [rbp - 0x68]
call fcn.25134af0
test eax, eax
jne 0x25134514
mov rcx, rsp
lea rdx, [0x25134677]
call fcn.2512bbf0
cmp dword [rbp - 0x48], 0
je 0x25134529
mov rcx, rsp
lea rdx, [0x25134677]
call fcn.2512bbf0
mov rcx, qword [rbp - 8]
lea rdx, [rbp - 0x78]
movabs r8, 5
call fcn.25121980
mov rax, qword [rbp - 0x50]
lea rax, [rax + 0xe]
mov qword [rbp - 0x88], rax
mov rdx, rax
lea rcx, [0x25138d80]
movabs r8, 4
call fcn.25121980
mov rax, qword [rbp - 0x50]
lea rax, [rax + 4]
lea rax, [rax + 0xe]
mov qword [rbp - 0x88], rax
mov rdx, rax
lea rcx, [rbp - 0x78]
movabs r8, 5
call fcn.25121980
cmp qword [0x25138d90], 0
je 0x251345b6
call sub.kernel32.dll_GetCurrentProcess
mov rcx, rax
mov rax, qword [rbp - 0x18]
mov rdx, qword [rax]
mov r8d, 0x64
call qword [0x25138d90]
lea r9, [rbp - 0x28]
mov rcx, qword [rbp - 8]
mov r8d, 0x40
movabs rdx, 5
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x251345e6
mov rcx, rsp
lea rdx, [0x25134677]
call fcn.2512bbf0
call sub.kernel32.dll_GetCurrentThread
mov rcx, rax
call sub.kernel32.dll_GetThreadPriority
mov dword [rbp - 0x70], eax
cmp dword [rbp - 0x70], 0x7fffffff
je 0x25134611
call sub.kernel32.dll_GetCurrentThread
mov rcx, rax
mov edx, 0xf
call sub.kernel32.dll_SetThreadPriority
nop
mov byte [rbp - 0x80], 0xe9
mov rax, qword [rbp - 8]
lea rdx, [rax + 5]
mov rax, qword [rbp - 0x50]
sub rax, rdx
mov dword [rbp - 0x7f], eax
mov rdx, qword [rbp - 8]
lea rcx, [rbp - 0x80]
movabs r8, 5
call fcn.25121980
cmp qword [0x25138d90], 0
je 0x25134661
call sub.kernel32.dll_GetCurrentProcess
mov rcx, rax
mov rdx, qword [rbp - 8]
mov r8d, 5
call qword [0x25138d90]
mov byte [rbp - 0x20], 1
nop
mov rcx, rbp
call fcn.251343a0
nop
mov rcx, rbp
call fcn.25134410
movzx eax, byte [rbp - 0x20]
nop
lea rsp, [rbp]
pop rbp
ret
Function at 0x25134700
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x60]
mov qword [rbp - 8], rcx
mov byte [rbp - 0x10], 0
mov eax, 0
mov ecx, eax
call sub.kernel32.dll_SetLastError
cmp qword [rbp - 8], 0
je 0x251347ee
mov rcx, qword [rbp - 8]
call fcn.251340a0
mov qword [rbp - 0x30], rax
cmp qword [rbp - 0x30], 0
je 0x251347ee
mov rax, qword [rbp - 8]
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x30]
lea rax, [rax - 8]
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x18], 0
lea r9, [rbp - 0x18]
mov rcx, qword [rbp - 8]
mov r8d, 0x40
movabs rdx, 0x64
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x251347ee
call sub.kernel32.dll_GetCurrentThread
mov rcx, rax
call sub.kernel32.dll_GetThreadPriority
mov dword [rbp - 0x28], eax
cmp dword [rbp - 0x28], 0x7fffffff
je 0x251347a7
call sub.kernel32.dll_GetCurrentThread
mov rcx, rax
mov edx, 0xf
call sub.kernel32.dll_SetThreadPriority
nop
mov rdx, qword [rbp - 0x30]
lea rcx, [rbp - 0x38]
movabs r8, 8
call fcn.25121980
cmp qword [0x25138d90], 0
je 0x251347e1
call sub.kernel32.dll_GetCurrentProcess
mov rcx, rax
mov rdx, qword [rbp - 0x30]
mov r8d, 8
call qword [0x25138d90]
mov byte [rbp - 0x10], 1
nop
mov rcx, rbp
call fcn.25134690
movzx eax, byte [rbp - 0x10]
nop
lea rsp, [rbp]
pop rbp
ret

Function at 0x25134870
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x60]
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], rdx
mov qword [rbp - 0x18], r8
mov byte [rbp - 0x20], 0
mov eax, 0
mov ecx, eax
call sub.kernel32.dll_SetLastError
cmp qword [rbp - 0x18], 0
je 0x251349c8
cmp qword [rbp - 8], 0
jne 0x251348c9
mov rcx, qword [rbp - 0x18]
mov r8d, 0x8000
movabs rdx, 0
call sub.kernel32.dll_VirtualFree
mov byte [rbp - 0x20], 1
jmp 0x251349c8
mov r8, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 8]
call fcn.25134320
test al, al
je 0x251349bf
mov rcx, qword [rbp - 0x18]
call fcn.251340a0
mov qword [rbp - 0x40], rax
cmp qword [rbp - 0x40], 0
je 0x251349c8
mov dword [rbp - 0x28], 0
lea r9, [rbp - 0x28]
mov rcx, qword [rbp - 8]
mov r8d, 0x40
movabs rdx, 5
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x251349c8
call sub.kernel32.dll_GetCurrentThread
mov rcx, rax
call sub.kernel32.dll_GetThreadPriority
mov dword [rbp - 0x38], eax
cmp dword [rbp - 0x38], 0x7fffffff
je 0x25134951
call sub.kernel32.dll_GetCurrentThread
mov rcx, rax
mov edx, 0xf
call sub.kernel32.dll_SetThreadPriority
nop
mov rax, qword [rbp - 0x40]
lea rax, [rax + 4]
mov qword [rbp - 0x40], rax
mov rdx, qword [rbp - 8]
mov rcx, qword [rbp - 0x40]
movabs r8, 5
call fcn.25121980
cmp qword [0x25138d90], 0
je 0x25134997
call sub.kernel32.dll_GetCurrentProcess
mov rcx, rax
mov rdx, qword [rbp - 8]
mov r8d, 5
call qword [0x25138d90]
mov rcx, qword [rbp - 0x18]
mov r8d, 0x8000
movabs rdx, 0
call sub.kernel32.dll_VirtualFree
mov byte [rbp - 0x20], 1
nop
mov rcx, rbp
call fcn.25134800
jmp 0x251349c8
mov rcx, qword [rbp - 0x18]
call fcn.25134700
movzx eax, byte [rbp - 0x20]
nop
lea rsp, [rbp]
pop rbp
ret
Function at 0x25134b10
Capabilities:
Check for software breakpoints

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov rax, qword [rbp + 0x10]
movzx eax, byte [rax]
test al, al
je 0x25134b47
mov rax, qword [rbp + 0x10]
movzx eax, byte [rax]
cmp al, 0x90
je 0x25134b47
mov rax, qword [rbp + 0x10]
movzx eax, byte [rax]
cmp al, 0xcc
je 0x25134b47
mov eax, 0
jmp 0x25134b80
mov dword [rbp - 4], 1
mov eax, dword [rbp - 4]
cmp eax, dword [rbp + 0x18]
jae 0x25134b7b
mov edx, dword [rbp - 4]
mov rax, qword [rbp + 0x10]
add rax, rdx
movzx edx, byte [rax]
mov rax, qword [rbp + 0x10]
movzx eax, byte [rax]
cmp dl, al
je 0x25134b75
mov eax, 0
jmp 0x25134b80
add dword [rbp - 4], 1
jmp 0x25134b4e
mov eax, 1
add rsp, 0x10
pop rbp
ret
Function at 0x14000127c
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edx, dword [0x14000a688]
mov rdi, rcx
mov r8, rcx
mov rcx, qword [0x14000a680]
call fcn.1400010b4
mov edx, eax
mov eax, 0xffffffff
cmp rdx, rax
jne 0x1400012b4
or eax, 0xffffffff
jmp 0x140001310
mov r10, qword [0x14000a680]
or ebx, 0xffffffff
mov esi, dword [0x14000a688]
add r10, rdx
xor ecx, ecx
mov r8, r10
movsxd r9, ecx
lea rax, [r9 + rdx]
cmp rax, rsi
jae 0x1400012ff
mov r11b, byte [r8]
lea eax, [r11 + 0x3e]
cmp al, 1
jbe 0x1400012ff
cmp r11b, 0xb8
je 0x1400012f5
inc ecx
inc r8
cmp ecx, 0x20
jl 0x1400012cc
jmp 0x1400012ff
mov ebx, dword [r9 + r10 + 1]
cmp ebx, 0xffffffff
jne 0x14000130e
mov rdx, rdi
lea rcx, [0x140001f90]
call sub.ntoskrnl.exe_DbgPrint
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140001320
Capabilities:
Access pe header
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14000a610]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, qword [0x14000a698]
xor r12d, r12d
mov r15, rcx
test rbx, rbx
jne 0x140001490
lea rcx, [rbp - 0x30]
call fcn.1400014cc
mov rdi, rax
test rax, rax
je 0x1400013ca
cmp dword [rbp - 0x30], r12d
je 0x1400013ca
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov rsi, rax
mov r14d, r12d
movzx ecx, word [rax + 0x14]
lea rbx, [rax + 0x18]
add rbx, rcx
cmp r12w, word [rax + 6]
jae 0x1400013ca
mov rcx, qword [rbx]
lea rdx, [0x140001e70]
mov qword [rbp - 0x18], rcx
mov r8d, 5
lea rcx, [rbp - 0x18]
mov byte [rbp - 0x10], r12b
call sub.ntoskrnl.exe_strncmp
test eax, eax
je 0x1400013f1
movzx eax, word [rsi + 6]
add rbx, 0x28
inc r14d
cmp r14d, eax
jb 0x140001395
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140001be0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov dword [rbp - 0x28], 0xefc1f88b
mov esi, r12d
mov dword [rbp - 0x24], 0x20e78307
mov dword [rbp - 0x20], 0xfff25
mov byte [rbp - 0x1c], r12b
cmp dword [rbx + 8], 0xd
je 0x1400013ca
mov ecx, dword [rbx + 0xc]
lea rdx, [rbp - 0x28]
mov r14d, esi
mov r8d, 0xd
add rcx, r14
add rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCompareMemory]
cmp rax, 0xd
je 0x140001443
mov eax, dword [rbx + 8]
inc esi
sub eax, 0xd
cmp esi, eax
jb 0x140001413
jmp 0x1400013ca
mov edx, dword [rbx + 0xc]
add rdx, 0xd
add rdx, r14
add rdx, rdi
cmp byte [rdx], 0x4c
jne 0x1400013ca
cmp byte [rdx + 1], 0x8d
jne 0x1400013ca
cmp byte [rdx + 2], 0x15
jne 0x1400013ca
movsxd rax, dword [rdx + 3]
test eax, eax
je 0x1400013ca
lea rbx, [rax + 7]
add rbx, rdx
mov qword [0x14000a698], rbx
test rbx, rbx
je 0x1400013ca
mov rdi, qword [rbx]
test rdi, rdi
je 0x1400013ca
mov rcx, r15
call fcn.14000127c
cmp eax, 0xffffffff
je 0x1400013ca
mov ecx, eax
cmp rcx, qword [rbx + 0x10]
jae 0x1400013ca
mov rax, qword [rbx]
mov eax, dword [rax + rcx*4]
sar eax, 4
cdqe
add rax, rdi
jmp 0x1400013cc