joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005e030
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2a8
mov rax, qword [0x14008d310]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rsi, qword [rsp + 0x320]
lea rax, [0x140064ca8]
movsxd r13, dword [rsp + 0x318]
mov r14, r8
mov r15, qword [rsp + 0x310]
lea r8, [0x140069188]
mov qword [rsp + 0x38], r9
mov r12, rcx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edi, edi
mov qword [rsp + 0x20], rax
mov rdx, r13
mov rcx, rsi
mov ebx, edi
call fcn.14000c2e0
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x14005e170
test byte [rsp + 0x40], 0x10
je 0x14005e142
cmp word [rsp + 0x6c], 0x2e
movzx eax, word [rsp + 0x6e]
jne 0x14005e0ec
test ax, ax
je 0x14005e142
cmp word [rsp + 0x6c], 0x2e
jne 0x14005e0ec
cmp ax, 0x2e
jne 0x14005e0ec
cmp word [rsp + 0x70], di
je 0x14005e142
lea rcx, [rsp + 0x6c]
call sub.api_ms_win_crt_convert_l1_1_0.dll__wtol
mov edi, eax
test eax, eax
je 0x14005e140
mov rax, qword [rsp + 0x30]
lea r8, str._s_u_s
mov qword [rsp + 0x28], rax
mov r9, r12
mov rdx, r13
mov dword [rsp + 0x20], edi
mov rcx, rsi
call fcn.14000c2e0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14005e140
test r14, r14
je 0x14005e159
mov rcx, qword [rsp + 0x38]
mov edx, edi
call r14
test eax, eax
jne 0x14005e159
xor edi, edi
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14005e163
jmp 0x14005e0be
mov dword [r15], edi
mov ebx, 1
xor edi, edi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
jne 0x14005e173
mov word [rsi], di
mov eax, ebx
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140001020
add rsp, 0x2a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14005ede4
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r13, qword [rsp + 0x80]
xor ebx, ebx
mov word [r9], bx
mov r12, rdx
mov r14, r9
mov dword [rax + 0x10], ebx
mov r15, r8
mov qword [rax + 0x18], rbx
mov word [r13], bx
mov rbp, rcx
mov word [r8], bx
mov edi, 1
mov word [rdx], bx
lea rdx, [rax + 0x10]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test eax, eax
je 0x14005eeb9
mov ecx, esi
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rbx, rax
test rax, rax
jne 0x14005ee52
mov eax, 0x8007000e
jmp 0x14005eebb
mov r9, rbx
mov r8d, esi
xor edx, edx
mov rcx, rbp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x14005eeb0
lea r9, [rsp + 0x80]
mov rcx, rbx
lea r8, [rsp + 0x70]
lea rdx, [0x140068fb0]
call sub.VERSION.dll_VerQueryValueW
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14005eeb0
movzx eax, word [rcx + 0xa]
xor edi, edi
mov word [r12], ax
movzx eax, word [rcx + 8]
mov word [r15], ax
movzx eax, word [rcx + 0xe]
mov word [r14], ax
movzx eax, word [rcx + 0xc]
mov word [r13], ax
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, edi
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x14005eed0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x38
test rcx, rcx
jne 0x14005eee0
mov eax, 0x80004003
jmp 0x14005eef3
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor ecx, ecx
xor r8d, r8d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
add rsp, 0x38
ret
Function at 0x14005fd40
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rsi, r8
mov rbp, rdx
mov r14, rcx
xor r15d, r15d
mov edi, r15d
call fcn.1400027c4
mov rcx, rax
test rax, rax
je 0x14005fe6f
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x78], 0x208
lea ecx, [r15 + 1]
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov edx, 0x104
sub eax, edx
or eax, ecx
jge 0x14005fdb3
lea rcx, [rsp + 0x30]
call fcn.140002b54
mov rbx, qword [rsp + 0x30]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebp, eax
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcsnlen
test eax, eax
js 0x14005fe61
cmp eax, dword [rbx - 0xc]
jg 0x14005fe61
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r15w
test ebp, ebp
jne 0x14005fe21
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400086e0
mov rbx, qword [rsp + 0x30]
mov edx, dword [rbx - 0x10]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
test rax, rax
je 0x14005fe57
mov qword [rsi], rax
lea edi, [rbp + 1]
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14005fe3c
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, edi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
call fcn.140031228
nop
jmp 0x14005fe60
nop
mov ecx, 0x80070057
call fcn.1400312f0
nop
jmp 0x14005fe6e
nop
mov ecx, 0x80004005
call fcn.1400312f0
int3
Function at 0x140668058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1406681df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140668089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14066806f
add dl, dl
jne 0x140668096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406680f6
xor eax, eax
add dl, dl
jne 0x1406680a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406681ad
add dl, dl
jne 0x1406680b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406680c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406680d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406680dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406680ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14066807e
mov eax, 1
add dl, dl
jne 0x140668106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140668113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406680fb
sub eax, ebx
mov ebx, 1
jne 0x14066814c
mov ecx, 1
add dl, dl
jne 0x14066812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14066813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140668123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14066807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140668168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140668175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14066815d
cmp eax, 0x7d00
jae 0x14066819b
cmp eax, 0x500
jb 0x140668196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14066807e
cmp eax, 0x7f
ja 0x14066819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14066807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406681d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14066807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180004f28
Capabilities:
Parse pe header

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x18
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
movzx eax, word [rax]
mov dword [rsp + 4], eax
mov eax, dword [section..data]
cmp eax, 0x40
mov edx, 0xc0d71ea6
mov esi, 0xb8da8256
cmove esi, edx
cmp eax, 0x20
mov eax, 0xbf98aa7e
mov r8d, 0xb2252f14
cmove r8d, eax
mov edx, 0xf22730ef
mov r9d, 0x838aa1f5
mov r10d, 0x26f41355
mov r11d, 0xb2c91119
mov r14d, 0x147357dd
mov ebp, edx
cmp edx, 0xc0d71ea5
jg 0x180004fd2
cmp ebp, 0xb78732fc
jg 0x18000502a
cmp ebp, 0xb2252f13
jg 0x18000509d
mov edx, esi
cmp ebp, 0x838aa1f5
je 0x180004f88
mov edx, ebp
cmp ebp, 0x952013e3
jne 0x180004f88
mov edx, dword [rsp]
cmp edx, 0x20b
mov edx, 0xb78732fd
cmove edx, r9d
jmp 0x180004f88
cmp ebp, 0x1c44443c
jle 0x18000505f
cmp ebp, 0x4733d9f8
jg 0x1800050bf
cmp ebp, 0x1c44443d
je 0x18000511f
mov edx, ebp
cmp ebp, 0x26f41355
jne 0x180004f88
mov rdx, qword [rsp + 8]
movsxd rdx, dword [rdx + 0x3c]
add rdx, rcx
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x10]
cmp dword [rdx], 0x4550
mov edx, 0x1c44443d
cmove edx, r14d
jmp 0x180004f88
cmp ebp, 0xbddc9fce
jg 0x1800050e5
cmp ebp, 0xb78732fd
je 0x18000512e
mov edx, ebp
cmp ebp, 0xb8da8256
jne 0x180004f88
mov edx, 0x6f7dc5ee
mov ebx, 4
jmp 0x180004f88
cmp ebp, 0xf5bb4bca
jg 0x180005107
cmp ebp, 0xc0d71ea6
je 0x1800050fb
mov edx, ebp
cmp ebp, 0xf22730ef
jne 0x180004f88
mov edx, dword [rsp + 4]
cmp edx, 0x5a4d
mov edx, 0xbddc9fcf
cmove edx, r10d
jmp 0x180004f88
cmp ebp, 0xb2252f14
je 0x18000513d
mov edx, ebp
cmp ebp, 0xb2c91119
jne 0x180004f88
mov edx, r8d
jmp 0x180004f88
cmp ebp, 0x4733d9f9
je 0x18000514c
mov edx, ebp
cmp ebp, 0x6f7dc5ee
jne 0x180004f88
mov edx, 0x4733d9f9
mov edi, ebx
jmp 0x180004f88
cmp ebp, 0xbddc9fcf
je 0x180005158
mov edx, ebp
cmp ebp, 0xbf98aa7e
jne 0x180004f88
mov edx, 0x6f7dc5ee
xor ebx, ebx
jmp 0x180004f88
cmp ebp, 0x147357dd
je 0x180005167
mov edx, ebp
cmp ebp, 0xf5bb4bcb
jne 0x180004f88
jmp 0x18000518a
mov edx, 0x4733d9f9
mov edi, 2
jmp 0x180004f88
mov edx, 0x6f7dc5ee
mov ebx, 5
jmp 0x180004f88
mov edx, 0x6f7dc5ee
mov ebx, 3
jmp 0x180004f88
mov edx, 0xf5bb4bcb
mov eax, edi
jmp 0x180004f88
mov edx, 0xf5bb4bcb
mov eax, 1
jmp 0x180004f88
mov rdx, qword [rsp + 0x10]
movzx edx, word [rdx + 0x18]
mov dword [rsp], edx
mov edx, dword [rsp]
cmp edx, 0x10b
mov edx, 0x952013e3
cmove edx, r11d
jmp 0x180004f88
add rsp, 0x18
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x180007a4c
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x30
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
add rax, 0x18
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
mov dword [rsp + 0xc], eax
mov edx, 0x8f7c7822
cmp edx, 0xcfa3fbd9
jle 0x180007acd
cmp edx, 0x4f585cdf
jle 0x180007b39
cmp edx, 0x62caf06a
jg 0x180007bc8
cmp edx, 0x4f585ce0
je 0x180007c46
cmp edx, 0x535136b8
jne 0x180007a7b
mov r9, qword [rsp + 0x10]
movzx edx, word [r9 + 0x14]
lea r10, [r9 + rdx]
add r10, 0x18
movzx r9d, word [r9 + 6]
mov edx, 0xc64220c4
jmp 0x180007a7b
cmp edx, 0x9ad5fd16
jle 0x180007b83
cmp edx, 0xbbf7fb6c
jg 0x180007be8
cmp edx, 0x9ad5fd17
je 0x180007c53
cmp edx, 0xaadd065e
jne 0x180007a7b
movzx edx, word [rsp + 2]
lea rdx, [rdx + rdx*4]
shl rdx, 3
add rdx, qword [rsp + 0x28]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x18]
mov edx, dword [rdx + 0xc]
mov dword [rsp + 4], edx
mov r11d, dword [rsp + 4]
mov edx, 0x50b54fc
cmp r11d, ecx
ja 0x180007a7b
mov edx, 0x38d20072
jmp 0x180007a7b
cmp edx, 0x1b9fb5e6
jle 0x180007c29
cmp edx, 0x1b9fb5e7
je 0x180007c74
cmp edx, 0x38d20072
jne 0x180007a7b
mov rdx, qword [rsp + 0x18]
mov r11d, dword [rdx + 0x10]
add r11d, dword [rsp + 4]
mov edx, 0x86b41978
cmp r11d, ecx
ja 0x180007a7b
mov edx, 0x50b54fc
jmp 0x180007a7b
cmp edx, 0x868b8561
je 0x180007c95
cmp edx, 0x86b41978
je 0x180007cbc
cmp edx, 0x8f7c7822
jne 0x180007a7b
mov r11d, dword [rsp + 0xc]
mov edx, 0x535136b8
cmp r11d, 0x10b
je 0x180007a7b
mov edx, 0x9ad5fd17
jmp 0x180007a7b
cmp edx, 0x62caf06b
je 0x180007bdc
cmp edx, 0x6b9e45a9
jne 0x180007a7b
mov edx, 0xcfa3fbda
xor eax, eax
jmp 0x180007a7b
cmp edx, 0xbbf7fb6d
je 0x180007cd4
cmp edx, 0xc64220c4
jne 0x180007a7b
mov word [rsp + 0xa], r9w
mov qword [rsp + 0x28], r10
mov r11, qword [rsp + 0x28]
mov edx, 0xbbf7fb6d
cmp dword [r11 + 0x14], ecx
ja 0x180007a7b
mov edx, 0x4f585ce0
jmp 0x180007a7b
cmp edx, 0x50b54fc
je 0x180007ce0
cmp edx, 0xcfa3fbda
jne 0x180007a7b
jmp 0x180007cf3
mov edx, 0x868b8561
xor r8d, r8d
jmp 0x180007a7b
mov r11d, dword [rsp + 0xc]
mov edx, 0x1b9fb5e7
cmp r11d, 0x20b
je 0x180007a7b
mov edx, 0x62caf06b
jmp 0x180007a7b
mov r9, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x10]
movzx r10d, word [rdx + 0x14]
add r10, r9
movzx r9d, word [rdx + 6]
mov edx, 0xc64220c4
jmp 0x180007a7b
mov word [rsp + 2], r8w
movzx r11d, word [rsp + 2]
mov edx, 0xaadd065e
cmp r11w, word [rsp + 0xa]
jb 0x180007a7b
mov edx, 0x6b9e45a9
jmp 0x180007a7b
mov eax, ecx
sub eax, dword [rsp + 4]
mov rdx, qword [rsp + 0x18]
add eax, dword [rdx + 0x14]
mov edx, 0xcfa3fbda
jmp 0x180007a7b
mov edx, 0xcfa3fbda
mov eax, ecx
jmp 0x180007a7b
movzx r8d, word [rsp + 2]
inc r8d
mov edx, 0x868b8561
jmp 0x180007a7b
add rsp, 0x30
ret
Function at 0x18000ef60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r13d, ecx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
add rax, 0x10
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov r15, qword [rax]
mov r12d, 0xd4cd7fac
mov eax, 0x15ea1bd9
cmp eax, 0xf41e320e
jle 0x18000efd6
cmp eax, 0x15ea1bd8
jg 0x18000f027
cmp eax, 0xf41e320f
je 0x18000f05e
cmp eax, 0xfba60946
jne 0x18000ef9c
mov rax, qword [rsp + 0x38]
mov rbx, qword [rax + 0x30]
mov eax, 0x4c59ea0b
mov esi, 1
mov rbp, qword [rsp + 0x28]
jmp 0x18000ef9c
cmp eax, 0x93c83f67
je 0x18000f0a0
cmp eax, 0xd4cd7fac
je 0x18000f077
cmp eax, 0xdbf773b9
jne 0x18000ef9c
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx edx, word [rax + 0x58]
mov rcx, qword [rax + 0x60]
mov r8b, 1
call fcn.18000f0b4
cmp eax, r13d
mov eax, 0xf41e320f
mov ecx, 0xfba60946
cmove eax, ecx
jmp 0x18000ef9c
cmp eax, 0x4c59ea0b
je 0x18000f083
cmp eax, 0x15ea1bd9
jne 0x18000ef9c
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x28], r15
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
cmp rcx, rax
mov eax, 0xdbf773b9
cmove eax, r12d
jmp 0x18000ef9c
mov rax, qword [rsp + 0x28]
mov rbp, qword [rax]
mov eax, 0x4c59ea0b
xor esi, esi
mov rbx, qword [rsp + 0x40]
jmp 0x18000ef9c
mov eax, 0x93c83f67
xor edi, edi
jmp 0x18000ef9c
test esi, esi
mov eax, 0x93c83f67
mov ecx, 0x15ea1bd9
cmove eax, ecx
mov r15, rbp
mov r14, rbx
mov rdi, rbx
jmp 0x18000ef9c
mov rax, rdi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x18000f0b4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x18
test r8b, r8b
mov r8d, 0x4b69351a
mov eax, 0x54c0e4a4
cmove r8d, eax
dec edx
test rcx, rcx
mov eax, 0x9b12ff2d
mov r9d, 0x13d20df6
cmove r9d, eax
mov ebp, 0xaf79b83d
mov r10d, 0x7aff0327
mov r11d, 0x6e479ecb
mov r14d, 0x83345559
mov ebx, ebp
cmp ebp, 0x13d20df5
jle 0x18000f14a
cmp ebx, 0x54c0e4a3
jg 0x18000f17d
cmp ebx, 0x13d20df6
je 0x18000f1df
cmp ebx, 0x37d83c60
je 0x18000f1f2
mov ebp, ebx
cmp ebx, 0x4b69351a
jne 0x18000f0ff
mov edi, dword [rsp + 4]
cmp edi, 0x40
mov ebp, 0x54c0e4a4
cmovg ebp, r14d
movzx edi, word [rsp + 2]
jmp 0x18000f0ff
cmp ebx, 0xaf79b83c
jle 0x18000f1b4
mov ebp, r9d
cmp ebx, 0xaf79b83d
je 0x18000f0ff
cmp ebx, 0xefabd26a
je 0x18000f204
mov ebp, ebx
cmp ebx, 0xfede3fed
jne 0x18000f0ff
movzx edi, word [rsp + 2]
mov ebp, r8d
jmp 0x18000f0ff
cmp ebx, 0x54c0e4a4
je 0x18000f23c
cmp ebx, 0x6e479ecb
je 0x18000f26a
mov ebp, ebx
cmp ebx, 0x7aff0327
jne 0x18000f0ff
mov edi, dword [rsp + 4]
add edi, 0x20
mov ebp, 0x54c0e4a4
jmp 0x18000f0ff
cmp ebx, 0x83345559
je 0x18000f278
cmp ebx, 0x9b12ff2d
je 0x18000f292
mov ebp, ebx
cmp ebx, 0x8c2de0fa
jne 0x18000f0ff
jmp 0x18000f2a1
mov ebp, 0xefabd26a
xor r12d, r12d
xor r15d, r15d
mov rsi, rcx
jmp 0x18000f0ff
cmp edx, dword [rsp + 0xc]
mov ebp, 0xfede3fed
cmovb ebp, r11d
jmp 0x18000f0ff
mov dword [rsp + 0xc], r12d
mov dword [rsp + 8], r15d
mov qword [rsp + 0x10], rsi
mov rbx, qword [rsp + 0x10]
movzx ebx, word [rbx]
mov word [rsp + 2], bx
movzx ebx, word [rsp + 2]
mov dword [rsp + 4], ebx
cmp dword [rsp + 4], 0
mov ebp, 0x37d83c60
cmove ebp, r11d
jmp 0x18000f0ff
mov esi, dword [rsp + 8]
mov ebx, dword [rsp + 8]
shrd ebx, esi, 0x19
movzx r15d, di
xor r15d, ebx
mov rsi, qword [rsp + 0x10]
add rsi, 2
mov r12d, dword [rsp + 0xc]
inc r12d
mov ebp, 0xefabd26a
jmp 0x18000f0ff
mov ebp, 0x8c2de0fa
mov eax, dword [rsp + 8]
jmp 0x18000f0ff
mov edi, dword [rsp + 4]
cmp edi, 0x5b
mov ebp, 0x54c0e4a4
cmovl ebp, r10d
movzx edi, word [rsp + 2]
jmp 0x18000f0ff
mov ebp, 0x8c2de0fa
mov eax, 0xffffffff
jmp 0x18000f0ff
add rsp, 0x18
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x180026188
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, [0x18002d480]
xor ecx, ecx
lea r8, [0x18002d478]
lea rdx, str.FlsAlloc
call fcn.180025fb0
mov rbx, rax
test rax, rax
je 0x1800261c8
mov rcx, rax
call fcn.180023ac8
mov rcx, rdi
call rbx
jmp 0x1800261ce
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180026230
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x18002d490]
mov ecx, 2
lea r8, [0x18002d488]
lea rdx, str.FlsGetValue
call fcn.180025fb0
mov rdi, rax
test rax, rax
je 0x180026271
mov rcx, rax
call fcn.180023ac8
mov ecx, ebx
call rdi
jmp 0x180026279
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180026284
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x18002d498]
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 3
lea r8, [0x18002d490]
call fcn.180025fb0
mov rsi, rax
test rax, rax
je 0x1800262d0
mov rcx, rax
call fcn.180023ac8
mov rdx, rbx
mov ecx, edi
call rsi
jmp 0x1800262db
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140007c10
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x1400420c0]
test rcx, rcx
je 0x140007c60
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140007c48
mov rcx, qword [0x1400420c0]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1400420c0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x140007c2f
add rsp, 0x28
ret

Function at 0x14000e2d0
Capabilities:
Create directory

Disassembly:
push rdi
mov eax, 0x2020
push rsi
push rbx
call fcn.1400162b0
sub rsp, rax
mov eax, dword [0x140049100]
mov rsi, rcx
test eax, eax
je 0x14000e370
xor ebx, ebx
lea rdi, [0x140047100]
test eax, eax
jg 0x14000e30c
jmp 0x14000e320
add rbx, 1
cmp dword [0x140049100], ebx
jle 0x14000e320
mov rdx, qword [rdi + rbx*8]
mov rcx, rsi
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x14000e300
jmp 0x14000e357
mov rcx, rsi
call sub.msvcrt.dll_wcslen
cmp rax, 2
jne 0x14000e335
cmp word [rsi + 2], 0x3a
je 0x14000e357
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14000e3c0
movsxd rbx, dword [0x140049100]
cmp ebx, 0x3ff
jle 0x14000e3d8
mov eax, 1
add rsp, 0x2020
pop rbx
pop rsi
pop rdi
ret
lea rdi, [rsp + 0x20]
lea rbx, str.HOME
mov r8d, 0x1000
mov rdx, rbx
mov rcx, rdi
call fcn.140007540
test al, al
je 0x14000e3fa
movsxd rbx, dword [0x140049100]
mov rcx, rdi
lea rdi, [0x140047100]
call sub.msvcrt.dll__wcsdup
mov qword [rdi + rbx*8], rax
mov eax, dword [0x140049100]
add eax, 1
mov dword [0x140049100], eax
jmp 0x14000e2f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000e344
xor eax, eax
jmp 0x14000e35c
mov rcx, rsi
call sub.msvcrt.dll__wcsdup
add dword [0x140049100], 1
mov rdx, rax
lea rax, [0x140047100]
mov qword [rax + rbx*8], rdx
jmp 0x14000e357
mov rcx, rbx
call fcn.140007b50
nop
nop word cs:[rax + rax]
nop
Function at 0x140014f90
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.14001bee0
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.14001bee0
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x140015c62
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140049228]
test eax, eax
je 0x140015cfa
lea rax, [0x140049200]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140049230]
mov qword [rbp - 8], rax
jmp 0x140015cde
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140015cd2
cmp qword [rbp - 0x10], 0
je 0x140015cd2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140015c98
lea rax, [0x140049200]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x140015cfb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140015e00
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140015e28
mov eax, 0
jmp 0x140015e76
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140015e51
mov eax, 0
jmp 0x140015e76
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140015e71
mov eax, 0
jmp 0x140015e76
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x140015e7c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x140015efa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140015ef1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140015ef1
mov rax, qword [rbp - 8]
jmp 0x140015f0f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140015ec4
mov eax, 0
add rsp, 0x20
pop rbp
ret