joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180003838
Capabilities:
Create thread
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov dword [rax + 0x10], edx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov esi, dword [rsp + 0xb0]
lea r15d, [rdx + 0xf8a]
mov r14d, dword [rsp + 0xa0]
mov rdi, rcx
mov r13d, dword [rsp + 0xa8]
xor r14d, 0xe4b
mov r12d, edx
mov dword [rsp + 0xa0], r14d
lea ebp, [rsi + 0xdf]
mov ecx, edx
xor esi, 0x3818
lea eax, [rbp + 0x980]
xor ecx, 0x18b2
mov dword [rsp + 0xb0], esi
xor r12d, 0x2cf
mov dword [rsp + 0x40], ecx
add r13d, 0xfffff9eb
cmp r15d, eax
jge 0x180003a4e
mov eax, esi
xor eax, 0x3c1a
cmp ebp, eax
je 0x1800038fe
mov eax, dword [rdi + 0x38]
sub r13d, 0x7b0
sub eax, dword [rdi + 0xd0]
xor esi, 0x3ec5
add eax, 0x7bdc9
mov dword [rdi + 0xe8], eax
add r14d, 0x33e
jmp 0x180003a4e
mov eax, dword [rdi + 0xb8]
or eax, r12d
add eax, r14d
cmp dword [rdi + 0xdc], eax
jae 0x18000399c
movsxd rbx, r14d
mov rcx, rbx
xor rcx, 0x2677
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [rdi + 0x68]
mov r9d, esi
sub eax, dword [rdi + 0x80]
xor dword [rdi + 0xec], eax
mov rax, qword [section..data]
movsxd rcx, dword [rsp + 0x40]
movsxd r11, r13d
movsxd r10, esi
sub r9d, dword [rax + 0xcc]
or r10, r11
mov r8d, dword [rax + 0xbc]
xor r10, rcx
mov eax, dword [rdi + 0x34]
xor r11, rbx
xor r8, rax
mov qword [rsp + 0x28], r10
mov eax, ecx
mov dword [rsp + 0x20], r9d
sub eax, esi
mov r9, r11
sub eax, 0x1f45
movsxd rdx, eax
mov eax, ebp
sub eax, r13d
movsxd rcx, eax
movsxd rax, r12d
and rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x180003a4a
mov eax, dword [rdi + 0xf8]
xor eax, ebp
or eax, r15d
cmp r15d, eax
ja 0x180003a4e
movsxd rbx, ebp
mov r14d, r15d
xor rbx, 0x283c
imul eax, r15d, 0x18b2
movsxd rsi, eax
mov rax, qword [section..data]
mov ecx, dword [0x180052118]
mov r9d, dword [rdi + 0x140]
xor ecx, r12d
xor ecx, 0x24a8
mov qword [rsp + 0x28], rbx
mov edx, dword [rax + 0xa0]
xor r9d, 0x2189
mov r8d, dword [rax + 0x128]
add r8d, dword [rdi + 0x128]
imul r9d, dword [0x180052150]
add r8d, r13d
imul edx, r13d
mov dword [rsp + 0x20], ecx
mov rcx, rsi
or rdx, 0x2e29
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov eax, dword [rdi + 0xf8]
add r14d, 2
xor eax, ebp
or eax, r15d
cmp r14d, eax
jbe 0x1800039c7
mov esi, dword [rsp + 0xb0]
mov r14d, dword [rsp + 0xa0]
mov ecx, dword [rsp + 0x40]
mov eax, r14d
xor eax, 0x3d05
cmp esi, eax
jl 0x180003ae1
lea ebx, [rcx + 0x207c]
mov r9d, esi
lea eax, [r14 - 0x324]
xor ebp, 0x508
xor r9d, 0x60b
mov dword [rsp + 0x20], eax
lea rdx, [0x180052010]
mov ecx, ebx
add r13d, 0x5f3
lea r8d, [rbp - 0xd3b]
xor r8d, 0x396f
call fcn.1800026a8
mov ecx, dword [rsp + 0x88]
lea eax, [r12 + 0xdbf]
mov dword [rsp + 0x30], ecx
lea r8d, [r12 + 0x428]
mov dword [rsp + 0x28], eax
xor r15d, 0x308e
mov rax, qword [section..data]
mov r9d, esi
mov edx, ebx
mov qword [rsp + 0x20], rax
mov ecx, r15d
call fcn.1800018a8
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
lea eax, [r13 + 0x1d7]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140001e30
Capabilities:
Create thread
Print debug messages
Resume thread

Disassembly:
sub rsp, 0x38
lea rcx, str.Enter_Function_StartCustomThread____n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp qword [0x14004be68], 0
je case.default.0x140001e56
lea rcx, str.Enter_condition_pSvc__hWorkEvent___NULL__n
add rsp, 0x38
jmp qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [0x14004be68], rax
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x14004be78], rax
xor r9d, r9d
lea r8, [0x14000f320]
xor edx, edx
lea rax, [0x14004be70]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14004be60], rax
test rax, rax
je 0x140001ed7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov qword [0x14004be60], 0
mov ecx, dword [0x14004be70]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x5e5b
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov rcx, qword [0x14004be68]
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140001f42
lea rdx, str.Create_Thread_fails__n
mov ecx, 1
call fcn.140018d20
mov ecx, dword [0x14004be70]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x5e5b
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov rcx, qword [0x14004be68]
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140001f04
call fcn.1400097d0
cmp eax, 0x14
jl 0x140001f89
cmp qword [0x14004be80], 0
jne 0x140001f89
lea rax, [0x14004be88]
xor edx, edx
mov qword [rsp + 0x28], rax
lea r9, [0x14004be20]
lea r8, [0x140001ad0]
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14004be80], rax
add rsp, 0x38
ret
pop rbx
outsb dx, byte [rsi]
rol byte [rdi - 0xc320f71], 0x70
movabs eax, dword [0x26b5cfe21c7ee21c]
leave
jmp 0xfddc6fe0
invalid
invalid
Function at 0x14000db40
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x848
mov rax, qword [0x14004b008]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x800
call fcn.14001c790
lea rdi, [rsp + 0x868]
call fcn.140001030
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], 0
mov r8d, 0x7fffffff
mov rcx, qword [rax]
call fcn.140020cf8
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.140019260
add rsp, 0x848
pop rdi
pop rbx
ret

Function at 0x14000dbe0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
movsxd rbx, ecx
lea rcx, str.Enter_Function_DisableRadioHandler__disable___d_n
mov edx, ebx
call fcn.14000db40
mov r8d, ebx
lea rdx, str.Enter_Function_DisableRadioHandler__disable___d_n
mov ecx, 2
call fcn.140018d20
test ebx, ebx
je case.default.0x14000dc57
call fcn.1400097d0
cmp eax, 0x32
jl case.default.0x14000dc57
lea rcx, str.DisableRadioHandler__dont_send_check_msg__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, str.DisableRadioHandler__dont_send_check_msg_n
mov ecx, 2
call fcn.140018d20
mov dword [0x14004be94], 1
mov ecx, dword [0x14004be70]
mov r8, rbx
xor r9d, r9d
mov edx, 0x5e5d
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_PostThreadMessageW]
invalid
xchg edi, eax
push rdx
stosd dword [rdi], eax
mov esp, 0xdf41f083
cmp al, 0xf0
jnp 0x14007c828
sal byte [rdx - 0x18], cl
xlatb
mov ch, 0xc0
invalid
xchg esp, eax
invalid
Function at 0x140001080
Capabilities:
Accept command line arguments

Disassembly:
push rbx
sub rsp, 0x350
mov rax, qword [0x140017070]
xor rax, rsp
mov qword [rsp + 0x340], rax
lea rcx, [rsp + 0x50]
call fcn.140010600
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea rcx, [rsp + 0x50]
mov rdx, rax
call fcn.140010510
lea r8, str._target
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.1400103c0
lea rcx, [rsp + 0xb0]
mov rdx, rax
call fcn.140001b50
cmp qword [rsp + 0x40], 0x10
jb 0x1400010f0
mov rcx, qword [rsp + 0x28]
call fcn.140005ac0
lea r8, str._image
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.1400103c0
lea rcx, [rsp + 0xd8]
mov rdx, rax
call fcn.140001b50
cmp qword [rsp + 0x40], 0x10
jb 0x140001128
mov rcx, qword [rsp + 0x28]
call fcn.140005ac0
lea r8, str._args
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.1400103c0
lea rcx, [rsp + 0x100]
mov rdx, rax
call fcn.140001b50
cmp qword [rsp + 0x40], 0x10
jb 0x140001160
mov rcx, qword [rsp + 0x28]
call fcn.140005ac0
cmp qword [rsp + 0xc8], 0
jne 0x140001185
lea rdx, str.explorer.exe
lea rcx, [rsp + 0xb0]
mov r8d, 0xc
call fcn.1400013e0
cmp qword [rsp + 0xd0], 8
lea rax, vtable.InjectProcessExecutor.0
lea rdx, [rsp + 0xb8]
cmovae rdx, qword [rsp + 0xb8]
lea rcx, [rsp + 0x138]
mov qword [rsp + 0x130], rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp qword [rsp + 0x120], 8
lea r8, [rsp + 0x108]
cmovae r8, qword [rsp + 0x108]
cmp qword [rsp + 0xf8], 8
lea rdx, [rsp + 0xe0]
cmovae rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0x130]
call fcn.140002240
cmp qword [rsp + 0x120], 8
lea r11, vtable.ProcessExecutor.0
mov qword [rsp + 0x130], r11
jb 0x140001224
mov rcx, qword [rsp + 0x108]
call fcn.140005ac0
xor ebx, ebx
cmp qword [rsp + 0xf8], 8
mov qword [rsp + 0x120], 7
mov qword [rsp + 0x118], rbx
mov word [rsp + 0x108], bx
jb 0x14000125a
mov rcx, qword [rsp + 0xe0]
call fcn.140005ac0
cmp qword [rsp + 0xd0], 8
mov qword [rsp + 0xf8], 7
mov qword [rsp + 0xf0], rbx
mov word [rsp + 0xe0], bx
jb 0x14000128e
mov rcx, qword [rsp + 0xb8]
call fcn.140005ac0
lea rcx, [rsp + 0x50]
mov qword [rsp + 0xd0], 7
mov qword [rsp + 0xc8], rbx
mov word [rsp + 0xb8], bx
call fcn.1400101b0
xor eax, eax
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.140005910
add rsp, 0x350
pop rbx
ret
Function at 0x140001010
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140010200]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rdx, [0x14000a9dc]
lea rcx, str.PG_VERSION
call qword [sym.imp.MSVCR120.dll_fopen]
mov rbx, rax
test rax, rax
jne 0x14000109a
call qword [sym.imp.MSVCR120.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.MSVCR120.dll_strerror]
lea rcx, str._s:_could_not_open_file___s__for_reading:__s_n
mov rbx, rax
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rdi, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov r8, qword [0x140010358]
lea r9, str.PG_VERSION
lea rcx, [rax + 0x60]
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call fcn.140006620
mov ecx, 1
call qword [sym.imp.MSVCR120.dll_exit]
int3
lea rcx, [rsp + 0x30]
mov r8, rax
mov edx, 0x40
call qword [sym.imp.MSVCR120.dll_fgets]
test rax, rax
jne 0x140001147
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_ferror]
test eax, eax
jne 0x1400010f5
lea rcx, str._s:_unexpected_empty_file___s__n
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov r8, qword [0x140010358]
lea r9, str.PG_VERSION
lea rcx, [rax + 0x60]
mov rdx, rbx
call fcn.140006620
jmp 0x14000113b
call qword [sym.imp.MSVCR120.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.MSVCR120.dll_strerror]
lea rcx, str._s:_could_not_read_file___s_:__s_n
mov rbx, rax
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rdi, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov r8, qword [0x140010358]
lea r9, str.PG_VERSION
lea rcx, [rax + 0x60]
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call fcn.140006620
mov ecx, 1
call qword [sym.imp.MSVCR120.dll_exit]
int3
lea rax, [rsp + 0x30]
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x140001150
test ecx, ecx
jle 0x14000119b
movsxd rax, ecx
cmp byte [rsp + rax + 0x2f], 0xa
jne 0x14000119b
dec ecx
movsxd rax, ecx
cmp rax, 0x40
jae 0x14000123b
mov byte [rsp + rax + 0x30], 0
test ecx, ecx
jle 0x14000119b
cmp byte [rsp + rax + 0x2f], 0xd
jne 0x14000119b
lea eax, [rcx - 1]
movsxd rcx, eax
cmp rcx, 0x40
jae 0x140001235
mov byte [rsp + rcx + 0x30], 0
xor ecx, ecx
lea rdx, [rsp + 0x30]
lea rdi, [0x14000aa24]
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rdi + rcx - 1]
jne 0x1400011ea
cmp rcx, 4
jne 0x1400011b0
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_fclose]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400096d0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
lea rcx, str._s:_data_directory_is_of_wrong_version_nFile___s__contains___s___which_is_not_compatible_with_this_programs_version___s_._n
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov r8, qword [0x140010358]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rdi
lea r9, str.PG_VERSION
mov qword [rsp + 0x20], rcx
lea rcx, [rax + 0x60]
mov rdx, rbx
call fcn.140006620
mov ecx, 1
call qword [sym.imp.MSVCR120.dll_exit]
int3
call fcn.1400093c0
int3
call fcn.1400093c0
int3
Function at 0x140003bb0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xc40
mov rax, qword [0x140010200]
xor rax, rsp
mov qword [rsp + 0xc30], rax
mov rbx, rdx
mov rdi, rcx
lea rdx, str.postgres_9.6
mov rcx, rbx
call sub.MSVCR120.dll_strcmp
test eax, eax
je 0x140003bf6
lea rdx, [0x14000bae5]
xor ecx, ecx
call fcn.140008d40
lea rdx, [rsp + 0x830]
mov rcx, rdi
call fcn.140003d20
test eax, eax
js 0x140003cec
lea rdx, [rsp + 0x430]
lea rcx, [rsp + 0x830]
call fcn.140005ea0
lea rdx, [rsp + 0x430]
mov rcx, rbx
call qword [sym.imp.libintl.dll_libintl_bindtextdomain]
mov rcx, rbx
call qword [sym.imp.libintl.dll_libintl_textdomain]
lea rcx, str.PGLOCALEDIR
call qword [sym.imp.MSVCR120.dll_getenv]
test rax, rax
jne 0x140003c8a
lea r9, [rsp + 0x430]
lea r8, str.PGLOCALEDIR_s
lea rcx, [rsp + 0x20]
mov edx, 0x40e
call fcn.140006400
lea rcx, [rsp + 0x2c]
call fcn.140005580
lea rcx, [rsp + 0x20]
call qword [sym.imp.MSVCR120.dll__strdup]
mov rcx, rax
call fcn.1400088e0
lea rcx, str.PGSYSCONFDIR
call qword [sym.imp.MSVCR120.dll_getenv]
test rax, rax
jne 0x140003cec
lea rdx, [rsp + 0x430]
lea rcx, [rsp + 0x830]
call fcn.140005d80
lea r9, [rsp + 0x430]
lea r8, str.PGSYSCONFDIR_s
lea rcx, [rsp + 0x20]
mov edx, 0x40e
call fcn.140006400
lea rcx, [rsp + 0x2d]
call fcn.140005580
lea rcx, [rsp + 0x20]
call qword [sym.imp.MSVCR120.dll__strdup]
mov rcx, rax
call fcn.1400088e0
mov rcx, qword [rsp + 0xc30]
xor rcx, rsp
call fcn.1400096d0
mov rbx, qword [rsp + 0xc60]
add rsp, 0xc40
pop rdi
ret
Function at 0x140004bd0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
jne 0x140004c09
lea rcx, str.cannot_duplicate_null_pointer__internal_error__n
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.140006620
mov ecx, 1
call qword [sym.imp.MSVCR120.dll_exit]
int3
call qword [sym.imp.MSVCR120.dll__strdup]
test rax, rax
jne 0x140004c42
lea rcx, str.out_of_memory_n
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.140006620
mov ecx, 1
call qword [sym.imp.MSVCR120.dll_exit]
int3
add rsp, 0x20
pop rbx
ret

Function at 0x140004c50
Capabilities:
Terminate process

Disassembly:
xor edx, edx
jmp 0x140004de0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
mov ebp, 1
cmove rbx, rbp
mov esi, edx
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x140004e4b
test sil, 2
jne 0x140004e47
lea rcx, str.out_of_memory_n
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.140006620
mov ecx, ebp
call qword [sym.imp.MSVCR120.dll_exit]
int3
xor eax, eax
jmp 0x140004eb1
test sil, 4
je 0x140004eae
test al, 3
jne 0x140004ea1
test bl, 3
jne 0x140004ea1
cmp rbx, 0x400
ja 0x140004ea1
xor r9d, r9d
mov rcx, rax
add rax, rbx
mov r8, rax
mov edx, r9d
sub r8, rdi
add r8, 3
shr r8, 2
cmp rdi, rax
cmova r8, r9
test r8, r8
je 0x140004eae
nop dword [rax]
inc rdx
mov dword [rcx], r9d
lea rcx, [rcx + 4]
cmp rdx, r8
jb 0x140004e90
jmp 0x140004eae
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.MSVCR120.dll_memset
mov rax, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140004de0
Capabilities:
Terminate process

Disassembly:
xor edx, edx
jmp 0x140004de0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
mov ebp, 1
cmove rbx, rbp
mov esi, edx
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x140004e4b
test sil, 2
jne 0x140004e47
lea rcx, str.out_of_memory_n
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.140006620
mov ecx, ebp
call qword [sym.imp.MSVCR120.dll_exit]
int3
xor eax, eax
jmp 0x140004eb1
test sil, 4
je 0x140004eae
test al, 3
jne 0x140004ea1
test bl, 3
jne 0x140004ea1
cmp rbx, 0x400
ja 0x140004ea1
xor r9d, r9d
mov rcx, rax
add rax, rbx
mov r8, rax
mov edx, r9d
sub r8, rdi
add r8, 3
shr r8, 2
cmp rdi, rax
cmova r8, r9
test r8, r8
je 0x140004eae
nop dword [rax]
inc rdx
mov dword [rcx], r9d
lea rcx, [rcx + 4]
cmp rdx, r8
jb 0x140004e90
jmp 0x140004eae
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.MSVCR120.dll_memset
mov rax, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140004ed0
Capabilities:
Accept command line arguments
Query environment variable
Terminate process

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
lea rcx, str.PG_RESTRICT_EXEC
call qword [sym.imp.MSVCR120.dll_getenv]
mov qword [0x140010980], rax
test rax, rax
je 0x140004f0d
movzx edx, byte [rax]
cmp dl, byte [0x14000be74]
jne 0x140004f0d
movzx eax, byte [rax + 1]
cmp al, byte [0x14000be75]
je 0x140004f94
xor eax, eax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call fcn.140004bd0
lea rcx, str.PG_RESTRICT_EXEC1
mov rbx, rax
call fcn.1400088e0
lea rdx, [rsp + 0x20]
mov r8, rsi
mov rcx, rbx
call fcn.140005020
test rax, rax
jne 0x140004f9a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._s:_could_not_re_execute_with_restricted_token:_error_code__lu_n
mov edi, eax
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov r9d, edi
lea rcx, [rax + 0x60]
mov r8, rsi
mov rdx, rbx
call fcn.140006620
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x20]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x14000500c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._s:_could_not_get_exit_code_from_subprocess:_error_code__lu_n
mov edi, eax
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov r9d, edi
lea rcx, [rax + 0x60]
mov r8, rsi
mov rdx, rbx
call fcn.140006620
mov ecx, 1
call qword [sym.imp.MSVCR120.dll_exit]
int3
mov ecx, dword [rsp + 0x58]
call qword [sym.imp.MSVCR120.dll_exit]
int3
Function at 0x140006500
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x478
mov rax, qword [0x140010200]
xor rax, rsp
mov qword [rsp + 0x450], rax
test rcx, rcx
jne 0x140006545
call qword [sym.imp.MSVCR120.dll__errno]
mov dword [rax], 0x16
or eax, 0xffffffff
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400096d0
add rsp, 0x478
ret
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x470], rbx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x450]
mov qword [rsp + 0x460], rdi
mov dword [rsp + 0x40], 0
mov byte [rsp + 0x44], 0
mov qword [rsp + 0x30], rax
call fcn.140006710
mov rdi, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx ebx, byte [rsp + 0x44]
sub rdi, rcx
test bl, bl
jne 0x1400065e3
test rdi, rdi
je 0x1400065e3
mov r9, qword [rsp + 0x38]
mov qword [rsp + 0x468], rsi
mov esi, 1
mov edx, esi
mov r8, rdi
call qword [sym.imp.MSVCR120.dll_fwrite]
mov ecx, dword [rsp + 0x40]
movzx ebx, bl
add ecx, eax
cmp rax, rdi
cmovne ebx, esi
mov rsi, qword [rsp + 0x468]
jmp 0x1400065e7
mov ecx, dword [rsp + 0x40]
mov rdi, qword [rsp + 0x460]
or eax, 0xffffffff
test bl, bl
mov rbx, qword [rsp + 0x470]
cmovne ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400096d0
add rsp, 0x478
ret

Function at 0x1400066a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 8]
mov rdi, qword [rbx]
sub rdi, rcx
cmp byte [rbx + 0x24], 0
jne 0x1400066f2
test rdi, rdi
je 0x1400066f2
mov r9, qword [rbx + 0x18]
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
mov rax, qword [rbx + 8]
mov qword [rbx], rax
je 0x1400066f5
mov byte [rbx + 0x24], 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov qword [rbx], rcx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140007010
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
cmp dword [rsp + 0x50], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x40], r14
mov r14, rcx
mov edi, r8d
je 0x140007055
movsxd rax, r9d
mov rbp, rcx
test r9d, r9d
je 0x140007051
nop dword [rax]
dec rax
cmp byte [rbp], 0
je 0x140007051
inc rbp
test rax, rax
jne 0x140007040
sub ebp, ecx
jmp 0x140007069
or rbp, 0xffffffffffffffff
nop dword [rax]
inc rbp
cmp byte [rcx + rbp], 0
jne 0x140007060
sub edi, ebp
mov eax, 0
cmovs edi, eax
test edx, edx
je 0x140007079
neg edi
mov rbx, qword [rsp + 0x58]
mov qword [rsp + 0x38], rsi
test edi, edi
jle 0x1400070e8
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1400070d9
mov rsi, qword [rbx]
cmp rsi, rax
jb 0x1400070d9
mov r9, qword [rbx + 0x18]
test r9, r9
jne 0x1400070a6
inc dword [rbx + 0x20]
jmp 0x1400070e2
mov rcx, qword [rbx + 8]
sub rsi, rcx
cmp byte [rbx + 0x24], 0
jne 0x1400070d2
test rsi, rsi
je 0x1400070d2
mov r8, rsi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rsi
je 0x1400070d2
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], 0x20
inc qword [rbx]
dec edi
test edi, edi
jg 0x140007087
mov r8, rbx
mov edx, ebp
mov rcx, r14
call fcn.1400078c0
mov r14, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x30]
test edi, edi
jns 0x140007170
neg edi
movsxd rsi, edi
nop dword [rax + rax]
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140007162
mov rdi, qword [rbx]
cmp rdi, rax
jb 0x140007162
mov r9, qword [rbx + 0x18]
test r9, r9
jne 0x14000712f
inc dword [rbx + 0x20]
jmp 0x14000716b
mov rcx, qword [rbx + 8]
sub rdi, rcx
cmp byte [rbx + 0x24], 0
jne 0x14000715b
test rdi, rdi
je 0x14000715b
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x14000715b
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], 0x20
inc qword [rbx]
dec rsi
jne 0x140007110
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret