joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1445cc28c
Capabilities:
Encode data using base64

Disassembly:
mov dword [rsp + 0xb], 0xe02b939b
xor r8d, 0x49dde2f
mov qword [rsp], rdi
ror r8d, 1
lea r9, [rax*4 + 0x65a56c1a]
bswap r8d
xadd qword [rsp + 0xb], rax
not r8d
xadd dword [rsp + 0x13], esi
not r9b
rol r8d, 1
shr si, 0x6d
sbb rdi, 0xffffffff8194083b
mov qword [rsp + rsi + 0x10], r11
sub word [rsp + rsi*4], r9w
xor dword [rsp + rsi + 0x10], r8d
pop rdx
mov r11, qword [rsp + rsi*2 + 8]
movsxd r8, r8d
inc ecx
call fcn.14461dc03

Function at 0x1445ccfef
Capabilities:
Encode data using base64

Disassembly:
xor ecx, r11d
mov qword [rsp + rdx - 0x6a12c6bc], 0x1889e688
dec ecx
movzx edi, byte [rsp + rdx - 0x6a12c6b1]
mov eax, edi
call fcn.1445fb869

Function at 0x1445d3fd4
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
pop r9
and word [rsp + rsi + 0x12], si
sbb al, 0xa1
neg al
add al, 0x36
lea r9, [rsi*8 - 0x1edb4e0]
sub dword [rsp + rsi*4 - 4], 0x759c8c96
mov ecx, r8d
neg al
inc byte [rsp + rsi + 0x18]
jge 0x1445f0fb0
mov r9d, 0xd7161b20
mov ecx, dword [rbp + riz]
xor ecx, r11d
call fcn.1445bbbbd
lea rbx, [rbx + r8 - 0x82]
not dx
bswap rsi
sar r8w, 0xc1
not r9w
movsx eax, r8b
and dx, r9w
lea rdi, [r8*4 - 0x6bebe568]
movsx r9d, r8b
mov word [rbx + r8*2 - 0x84], dx
jmp 0x144638ea5

Function at 0x1445da888
Capabilities:
Encode data using base64

Disassembly:
push r9
mov qword [rsp + rax*4 + 0x744f18b8], r11
mov qword [rsp + rax + 0x1d13c636], r9
xor dword [rsp + rax + 0x1d13c646], esi
mov r11, qword [rsp + rax + 0x1d13c646]
movsxd rsi, esi
movsx ecx, byte [rsp + rax*2 + 0x3a278c50]
neg r9b
add r10, rsi
xchg word [rsp + rax*2 + 0x3a278c5d], dx
mov qword [rsp + rax + 0x1d13c63e], 0xffffffffa50e512e
add r8, qword [rax + rbx + 0x1d13c628]
sub edx, dword [rsp + r9 - 0x2b7]
jbe 0x14463cb4f
call fcn.1445b7ddf
pop r8
xor edi, r11d
lea edi, [r9 + rdi + 0x41757f7e]
rol edi, 3
dec cx
bswap edi
inc edi
push rax
neg edi
mov qword [rsp + r9 - 0x5f443187], r11
not byte [rsp + r9 - 0x5f44319d]
xor dword [rsp + r9 - 0x5f443187], edi
mov r11, qword [rsp + r9 - 0x5f443187]
movzx edx, ax
call fcn.144631ed5
dec r8d
add r9b, byte [rsp + r9 - 0x203e93]
mov edx, dword [rsp + r9*2 - 0x407d2f]
adc r9w, dx
xor r8d, 0xe3aeb50d
call fcn.144605f89

Function at 0x1445dafc4
Capabilities:
Authenticate hmac

Disassembly:
neg qword [rsp + r9*2 - 0xdd92]
xor r11b, sil
mov ecx, dword [rsp + r9 - 0x6ec5]
lea rsi, [rsp + rsi + 0x10]
mov qword [r9 + rsi - 0x6ecd], rdx
movzx eax, byte [rbp + r9 - 0x6ecc]
mov qword [rsp + r9*2 - 0xdd9a], r9
xor al, r11b
jmp 0x1446479f7

Function at 0x1445e4199
Capabilities:
Encode data using base64

Disassembly:
call fcn.144621b2f
inc r8w
mov qword [rbx + r9], rdx
sbb rdi, rcx
jne 0x1445cad91
inc esi
mov r8d, ecx
ror esi, 2
neg esi
mov qword [rsp + r9 + 8], r11
pop r11
xor dword [rsp + r9], esi
and rax, rdi
pop r11
and cx, 0xf305
movsxd rsi, esi
adc r10, rsi
mov rsi, qword [rbx + r9]
inc di
shr r9, 0x92
inc rcx
mov rax, qword [rbx + r9 + 8]
imul rsi
add rcx, r8
ja 0x1445dc055
Function at 0x1445e41dd
Capabilities:
Encode data using base64

Disassembly:
pop rsi
xor r11b, r8b
lea r8, [rsp + r8 + 0x18]
xadd r9, rcx
mov ax, word [r8 + rcx - 0x4bae9e50]
mov qword [rsp + rcx - 0x4bae9e50], rcx
xor dx, word [rsp + rcx - 0x4bae9e50]
mov r9w, ax
and byte [rsp + rcx - 0x4bae9e4d], 0x8d
mov qword [rsp + rcx - 0x4bae9e40], 0xffffffffde2dd11a
mov ax, word [rcx + rbx - 0x4bae9e52]
inc dword [rsp + rcx - 0x4bae9e43]
add edx, 0x9333f221
movzx edi, byte [rsp + rdx - 0x7bb3d9b6]
not r9w
not rcx
mov r8d, ecx
not ax
or r9w, ax
mov word [rbx + rdx - 0x7bb3d9c5], r9w
movzx eax, word [rbp + rcx + 0x4bae9e57]
lea rbp, [rbp + rdx - 0x7bb3d9bb]
xor r8, 0x6c93809e
xchg dword [rsp + rcx + 0x4bae9e62], r8d
xor ax, r11w
sal r8, cl
sub ax, 0xbe97
dec qword [rsp + rdx - 0x7bb3d9bd]
not ecx
xor ax, 0x283e
movzx r9d, dx
xadd r8w, di
adc ax, r8w
rol ax, 1
xor r11w, ax
sal r8b, 3
mov word [rbx + rdi*8 - 4], ax
call fcn.1445ef9ed
call fcn.14465a846
mov r8d, 0xc73b0d96
mov r9d, r8d
movsx ecx, r8w
mov cx, word [rbx + rcx - 0xd96]
movsx edx, r8b
movzx esi, dx
movzx eax, byte [rbp + rsi*2 - 0x1ff2c]
sub rdx, r9
lea r8, [r9*8 - 0x3ff10c5e]
xor al, r11b
and sil, sil
jle 0x1445d4d4a

Function at 0x1445e8b6f
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
lea eax, [rdx + rax - 0x331355b4]
rol eax, 2
mov qword [rsp + rdi + 0x44a9062], rdx
push rdx
inc eax
add dl, byte [rsp + rdx + 6]
mov qword [rsp + rdx + 0x10], r11
ror word [rsp + rdx + 4], 0xe9
xor dword [rsp + rdx + 0x10], eax
dec qword [rsp + rdx + 8]
neg rdx
sub word [rsp + rdx + 8], di
mov r11, qword [rsp + rdx + 0x10]
jg 0x14465e121
movsxd rax, eax
shr dx, 0xd
mov r9d, dword [rsp + rdx + 0xb]
adc r10, rax
mov rax, qword [rbx + rdx*2 + 0xa]
lea rcx, [r8*2 + 0x781278f]
lea r8, [rcx - 0x2be9134d]
xor rdx, qword [rbx + rdx*2 + 0x12]
inc dword [rsp + rdi*4 + 0x112a418e]
call fcn.1445d1f5e

Function at 0x1445e8c6e
Capabilities:
Authenticate hmac

Disassembly:
lea rbx, [r8 + rbx - 0x620011b5]
pop rdx
pop r8
pop r9
pop rdi
pop rdi
js fcn.14464d66a

Function at 0x1445ef499
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
and rdx, 0xfffffffffffffff0
pop rsi
sub rdx, rcx
mov edi, 0x5a133c2b
mov rsp, rdx
jmp 0x144638def

Function at 0x1445fdf41
Capabilities:
Execute anti-debugging instructions

Disassembly:
adc r10, rax
or dl, dl
mov rcx, qword [rbx]
mov qword [rsp + 0x10], 0xf307381
lea r9, [rsp + 0x70]
mov qword [r9], rcx
call fcn.1445f2ce4
xor r11b, al
inc dword [rsp + r8 - 0x638ffff6]
mov qword [rsp + r8 - 0x63900000], rdx
lea rax, [rsp + rax + 0x10]
mov word [rax + r8 - 0x63900000], si
movzx r9d, cx
sar word [rsp + r9*2 - 0x18928], 0x46
mov esi, r9d
mov r9d, dword [rbp + r8 - 0x638fffff]
sbb r8d, 0xfa94739a
jno 0x1445fa98f
jae 0x1446008ee
movzx r12d, r14w
movsx r15d, bp
pop rbp
lea r13, [r12*8 + 0x713a13ab]
movzx edx, r14w
call fcn.1445b6ad1
movsxd rax, eax
jae 0x1445e8b51
Function at 0x1445fe400
Capabilities:
Encode data using base64

Disassembly:
inc edi
sar rax, 4
push r11
and edx, eax
xor dword [rsp + r9*2 - 0xa2], edi
pop r11
movsxd rdi, edi
add r10, rdi
ror rax, cl
xchg r9d, eax
rol al, 0x87
mov si, word [r8 + rbx - 7]
movzx edx, byte [r8 + rbp]
shr cl, 0x64
xadd eax, r8d
add r9d, ecx
lea rbp, [rbp + r8*2 - 0x14a]
jle 0x144621292
mov eax, 0xa5b8e01f
movsx edx, al
mov edi, eax
mov r8d, dword [rbp + rdx - 0x1f]
ror dil, 0xe3
movzx ecx, ax
xor r8d, r11d
lea r8d, [r8 + rax - 0xd386ee6]
and ax, 0xe3bc
jnp 0x1445caf30
bswap edi
lea rax, [rcx + r9*8 - 0x2fce4ff8]
mov edx, eax
shr r8w, 3
inc edi
and r8b, al
dec r9w
neg esi
ror edi, 1
neg edi
ror rsi, 0x52
jb 0x1445c5a04
mov r8, qword [rbx]
mov rax, qword [rbx + 8]
not r8
mov r9d, 0x45b2b201
movsx edi, r9b
not rax
movsx esi, r9w
push rdi
pop rdi
or r8, rax
or r9w, 0xc085
mov qword [rbx + r9 - 0x45b2f27d], r8
jae 0x144604344
xor ecx, 0x129b1b26
xor edi, dword [rsp + rdi - 0x369fceb5]
sbb ecx, 0x3a1f5399
mov qword [rsp], r11
neg r8b
xor dword [rsp], ecx
lea r9, [r8 + 0x29037786]
mov edx, 0xb534fb1a
pop r11
movsxd rcx, ecx
add r10, rcx
mov rbx, qword [rbx]
jmp fcn.14464d66a
mov esi, 0x498583a1
xor r11b, dil
mov qword [rsp + rcx*2 - 0x44080c00], r8
mov qword [rsp + rcx - 0x22040600], rdx
lea rdi, [rsp + rdi + 8]
mov rcx, qword [rdi + r9 - 0x52]
pop rdx
movsx eax, sil
movzx edi, r8b
mov rdx, rcx
lea rcx, [rdi + r8*2 - 0x3fd119ff]
neg al
movzx ax, byte [r9 + rdx - 0x52]
mov word [rbx + r9 - 0x54], ax
mov edi, dword [rbp + r8*2 - 0x15b]
xor edi, r11d
lea rcx, [r8 + r8*2 - 0x5ae8def3]
jmp 0x1445dfe50
call fcn.1446217d8

Function at 0x1445ff1da
Capabilities:
Encode data using base64

Disassembly:
dec rdi
mov qword [rsp + rsi - 0x1325a], 0xffffffffcd98730b
rol al, 1
xadd word [rsp + rsi - 0x1324c], di
inc r8d
jb 0x1445db2f0

Function at 0x1446249cc
Capabilities:
Authenticate hmac

Disassembly:
adc r9, rsp
push r8
neg dil
je 0x1445d8273
and dword [rsp + rdi*8], edx
xor r9b, 0x89
xchg dword [rsp + rdi*4 + 4], edi
sar word [rsp + rsi*2 - 8], 9
dec r9b
ror edi, 0xa1
pop rax
xor r11b, r9b
ror ax, 0x87
dec r8b
ja 0x1445d8a67
movzx r9d, byte [rbp + rdi*8 + 4]
lea rbp, [rbp + rsi*2 - 7]
xor r9b, r11b
sub r9b, 0x3f
mov qword [rsp + rsi - 6], rdi
rol r9b, 1
sub si, di
adc dword [rsp + rdi*4], 0x2a02df8b
not r9b
xor dword [rsp + rdi*8 + 2], esi
jne 0x144615b78
Function at 0x144626e77
Capabilities:
Encode data using base64

Disassembly:
xor dl, 0xd
and r8w, r9w
jns 0x144640e07
inc dl
rol dl, 1
sal al, 1
add ax, word [rsp + rax + 0x612900c5]
jno 0x1446504cf
mov dword [rsp + rax + 0x6129af5c], 0xaf33c09a
and rdi, qword [rsp + rcx - 0x4ac7d4af]
mov dword [rcx + rdx - 0x4ac7d4cf], esi
bswap rax
setno cl
mov qword [rsp + rcx - 0x4ac7d401], r10
ret 0x20
or r9w, ax
shl esi, cl
mov rsi, qword [rsp + 8]
adc rsi, 0x17976
jmp rsi
mov qword [rsp + r8*2 - 0x1420fb6e], r8
movsxd r9, r9d
not edi
pop rax
mov qword [rsp + r8*4 - 0x2841f6d4], 0xffffffffcc8be6b1
add r10, r9
lea rax, [r8*2 + 0x4d08c104]
mov esi, dword [rbx + r8 - 0xa107db7]
movzx r9d, di
not rax
lea rdi, [rsp + r8*2 - 0x1420faae]
sub r8d, dword [rsp + r8 - 0xa107db1]
mov dword [rdi + rdx - 0x2d517a00], esi
mov esi, dword [rbx + rdx*2 - 0x5aa2f3f8]
shr r8b, 0x84
or r8d, r9d
rol byte [rsp + rdx*2 - 0x5aa2f3f5], 0xa5
lea rbx, [rdx + rbx - 0x2d5179f4]
xchg word [rsp + rdx*2 - 0x5aa2f3e4], ax
xchg byte [rsp + rdx - 0x2d5179ef], al
movzx edx, byte [rdx + rbp - 0x2d5179fb]
sub ax, r9w
lea rdi, [r8 + r8 - 0xaed1679]
sbb r8w, word [rsp + rax + 0x612900ee]
lea rbp, [rbp + r9*8 - 0x7fff2]
not r9
xor dl, r11b
xadd qword [rsp + r9 + 0x10015], r9
inc dl
xor r8, r9
push rdi
ja 0x1445c0c79
lea rcx, [rdi*8 - 0x3a65877e]
neg dl
neg r9b
add ecx, 0x2ca61025
jne 0x1445d7e99
xor r11b, dl
sal r8b, 0x67
lea rdx, [rsp + rdx + 0x28]
jbe 0x1445e26b1
mov ax, word [rbx + rcx - 0xd4f4f1a]
not r9w
movzx edi, word [rsp + rcx*8 - 0x6a7a78cc]
add edi, 0x2b2d30bb
mov edx, r8d
not ax
jns 0x14460c97f

Function at 0x144642236
Capabilities:
Encode data using base64

Disassembly:
xor sil, r11b
sub edi, 0xe0855004
jle 0x144654252
mov qword [rsp + rdi - 0x1f7ac69b], 0x4824ae0a
not sil
or r9b, dil
inc r9d
adc sil, 0x90
not sil
push rax
pop r8
add sil, 1
jmp 0x144624099
Function at 0x144647987
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rcx*2 + 8], rcx
and ax, si
and di, 0x3411
dec r8
mov word [rbx + rcx*2 + 2], ax
adc cl, byte [rbp + rcx*2 + 4]
lea rbp, [rbp + r8*2 - 0x139]
xor cl, r11b
jmp 0x144658090
mov qword [rsp + rcx - 0x56458922], r11
xor dword [rsp + rcx - 0x56458922], r8d
call fcn.144610d66
mov r8d, esi
mov ax, word [rbx + rsi - 0xa0]
mov qword [rsp + rsi*4 - 0x280], 0xffffffffd805703c
mov si, word [rbx + rsi*2 - 0x13e]
push rdi
movzx edx, byte [rsp + rcx*2 - 0xbf]
pop rdx
not ax
or cl, 1
setp cl
not si
jns 0x1445d40ef
mov dx, word [rbx]
mov ecx, 0x793d3604
xor cl, cl
xor cl, byte [rbx + rcx - 0x793d35fe]
mov r8d, 0x3c914338
movsx edi, r8b
xchg r8w, di
lea rbx, [rbx + r8 - 0x3c910036]
movsx eax, di
sal dx, cl
sub dil, r8b
call fcn.144654971
movzx esi, r9b
dec al
xor byte [rsp + r9*4 - 0x1bb29], 6
rol al, 1
dec rsi
call fcn.14462f08b
ror dx, cl
bswap r8d
inc word [rsp + r9 - 0x24]
dec r8d
xor dx, di
not r8d
adc dword [rsp + r9 - 0x26], 0x37040723
inc r8d
neg word [rsp + rcx - 0x56458921]
jne 0x144610e11
not r9
neg r8d
xadd qword [rsp + rsi*2 + 0x12], r9
ror dil, 0x61
call fcn.1446138cf
movsx esi, byte [rsp + rdx - 0x1a2195a2]
neg qword [rsp + rdx*2 - 0x34432b46]
mov word [rdx + rbx - 0x1a2195a1], r8w
mov eax, dword [rbp + rdx - 0x1a2195a3]
mov byte [rsp + rdx*4 - 0x6886568c], dl
lea rbp, [rdx + rbp - 0x1a21959f]
jno 0x144655806
xor eax, r11d
rol eax, 2
pop rdi
movsx r9d, cx
inc r9w
dec eax
shl dx, 0xec
jae 0x1445c5a7b
mov esi, 0xa79ff52e
movsx edx, sil
call fcn.144633587
movsxd r9, r9d
lea rsi, [rsi + rsi*2 + 0x5b01de8e]
add r10, r9
lea r9, [rsi + 0x42bbf615]
call fcn.14465b7e3
ror r9d, cl
xor dil, 0xa5
xchg rcx, r9
not dil
movsx r8d, si
inc cx
add dil, 0x2b
dec r9
not dil
sub dil, 0x1b
rol dil, 1
movsx edx, al
shr dl, 0x25
xchg r8b, cl
xor r11b, dil
add rdi, rsp
lea r9, [r9*8 + 0x5c0a7821]
dec si

Function at 0x14464bdc1
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov word [rbx + r8*4 - 0x203f6], r9w
pop rax
lea rdi, [rbx + r8 - 0x80ff]
mov qword [rbx + r8 - 0x8107], rdi
movzx edx, sil
lea rbx, [rbx + r8*4 - 0x203fe]
mov qword [rsp + r8 - 0x80fd], rcx
sub rdx, qword [rsp + r8 - 0x80fd]
jnp 0x14465162b
mov ecx, 0xcb1b59e
movzx eax, cl
mov r8d, dword [rbp + rcx - 0xcb1b59e]
xor r8d, r11d
dec r8d
xor r8d, 0x5b77dac
call fcn.1446364c2
mov r9d, ecx
lea rax, [rbx + r9 - 0x54004341]
push r8
call fcn.1445c6dbc
pop rsi
jnp fcn.14464d66a

Function at 0x14464f02a
Capabilities:
Authenticate hmac

Disassembly:
not sil
mov qword [rsp + r8 - 0x509dda36], r8
lea rdi, [rdi + 0x5a95979f]
add sil, 0x26
ror r8, 0xa4
xor r11b, sil
lea rsi, [rsp + rsi + 0x10]
sar di, 0xa4
mov edx, dword [rsp + r9 - 0xecbc]
jp 0x1445e3d22
Function at 0x144655a11
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
jnp 0x1445d3c3d
inc dl
rol eax, 1
mov qword [rsp + rdi*2 - 0x776d291e], r11
xor dword [rsp + rdi - 0x3bb6948b], eax
mov r11, qword [rsp + rdi*2 - 0x776d291e]
movsxd rax, eax
lea rdx, [rsi*8 - 0x15319f1]
add r10, rax
mov qword [rsp + rcx - 0x7801b4], 0x75827aa8
lea rdi, [rbx + rdi - 0x3bb69497]
inc r8
mov qword [rcx + rbx - 0x7801c8], rdi
cmovno dx, word [rsp + rcx - 0x7801b4]
lea rbx, [rbx + rcx - 0x7801c8]
sub rsi, rcx
lea rsi, [rsi*2 - 0x4d6cdbe9]
pop rdx
pop rax
js fcn.14464d66a

Function at 0x14465bba5
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
rol dil, 0xe3
shl dx, 0x6a
dec esi
rol edi, 0x7c
call fcn.1445cf054
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1400044b0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1400044c0]
mov dword [rax], 1
mov rax, qword [0x1400044d0]
mov dword [rax], 1
mov rax, qword [0x140004450]
cmp word [rax], 0x5a4d
jne 0x14000105e
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c8
mov rax, qword [0x1400044a0]
mov dword [0x14000700c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b8
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x140004570]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x140004550]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x140004400]
cmp dword [rax], 1
je 0x140001100
xor eax, eax
add rsp, 0x20
pop rbp
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x14000107b
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001118
cmp dx, 0x20b
jne 0x14000105e
cmp dword [rax + 0x84], 0xe
jbe 0x14000105e
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105e
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x20
pop rbp
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105e
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105e
Function at 0x140001558
Capabilities:
Hide graphical window

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xf0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov dword [rbp + 0x28], r9d
mov rax, qword [sym.imp.USER32.dll_SetProcessDPIAware]
call rax
pxor xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movq qword [rbp - 0x20], xmm0
lea rax, [sym.WindowProc_HWND____unsigned_int__unsigned_long_long__long_long_]
mov qword [rbp - 0x58], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x48], rax
lea rax, str.MyWindowClass
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x60]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_RegisterClassW]
call rax
mov qword [rsp + 0x58], 0
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0x1f4
mov dword [rsp + 0x30], 0x1f4
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
mov r9d, 0xcf0000
lea r8, str.My_Application
lea rax, str.MyWindowClass
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_CreateWindowExW]
call rax
mov qword [rbp - 8], rax
mov edx, dword [rbp + 0x28]
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_UpdateWindow]
call rax
mov qword [rsp + 0x58], 0
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 1
mov rax, qword [rbp - 8]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x1e
mov dword [rsp + 0x30], 0x96
mov dword [rsp + 0x28], 0x32
mov dword [rsp + 0x20], 0x32
mov r9d, 0x50010001
lea r8, [0x14000406c]
lea rax, str.BUTTON
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_CreateWindowExW]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov r8d, 0
lea rdx, str.explorer
mov rcx, rax
mov rax, qword [sym.imp.UxTheme.dll_SetWindowTheme]
call rax
jmp 0x140001705
lea rax, [rbp - 0x90]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_TranslateMessage]
call rax
lea rax, [rbp - 0x90]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_DispatchMessageA]
call rax
lea rax, [rbp - 0x90]
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetMessageA]
call rax
test eax, eax
setne al
test al, al
jne 0x1400016df
mov eax, 0
add rsp, 0xf0
pop rbp
ret

Function at 0x140001aa0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov rbx, rcx
lea rax, [rbp + 0x28]
mov ecx, 2
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
mov qword [rbp - 8], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rbp - 8]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]
Function at 0x140001b10
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
movsxd rsi, dword [0x1400070a4]
mov rbx, rcx
test esi, esi
jle 0x140001c40
mov rax, qword [0x1400070a8]
xor r9d, r9d
add rax, 0x18
nop dword [rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140001b5b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140001be3
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140001b40
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
mov rdi, rax
test rax, rax
je 0x140001c62
mov rax, qword [0x1400070a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call dbg._GetPEImageBase
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400070a8]
lea rdx, [rbp - 0x30]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140001c47
mov eax, dword [rbp - 0xc]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140001bdc
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x140001bf0
add dword [0x1400070a4], 1
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 2
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x18]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1400070a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001bdc
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop word [rax + rax]
xor esi, esi
jmp 0x140001b68
mov rax, qword [0x1400070a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400021f0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
lea r13, [0x140007100]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400070e0]
test rbx, rbx
je 0x140002255
mov r12, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ecx, dword [rbx]
call r12
mov rsi, rax
call rdi
test rsi, rsi
je 0x14000224c
test eax, eax
jne 0x14000224c
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140002230
mov rcx, r13
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140002490
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x1400024a8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x1400024b0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret
Function at 0x1400024c0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x14000250d
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x140002504
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x14000250f
add rax, 0x28
cmp rax, r9
jne 0x1400024f0
xor eax, eax
ret

Function at 0x140002510
Capabilities:
Parse pe header

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x1400025a8
mov rdx, qword [0x140004450]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x140002596
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x140002596
cmp word [rax + 0x18], 0x20b
jne 0x140002596
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x1400025a8
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x140002581
add rbx, 0x28
cmp rbx, rdi
je 0x1400025a8
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x140002578
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x1400025c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140004450]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400025e0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400025e8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400025e0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000263d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002634
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400025e0
add rax, 0x28
cmp rax, r9
jne 0x140002620
xor eax, eax
ret

Function at 0x140002640
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140004450]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000265f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002668
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000265f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140002680
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x140004450]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x1400026a0
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x1400026a8
ret
cmp word [rdx + 0x18], 0x20b
jne 0x1400026a0
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x1400026f0
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x1400026e7
test rcx, rcx
je 0x1400026a0
sub rcx, 1
add rax, 0x28
cmp rdx, rax
jne 0x1400026d8
xor eax, eax
ret