joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408fe0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
mov eax, 0x6068
call fcn.0040d260
sub rsp, rax
mov rax, qword [0x00413830]
mov qword [rsp + 0x6050], rax
mov rdi, rdx
mov rsi, r8
mov rbx, rcx
lea rdx, [rsp + 0x50]
mov r8d, 0x2000
mov ecx, 0xa0
mov rbp, r9
call fcn.00403e40
lea rcx, [rsp + 0x50]
call sub.msvcrt.dll_strlen
test rax, rax
je 0x40913c
lea rax, [rsp + 0x38]
lea rdx, str.SOFTWAREej_technologiesinstall4jinstallations
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40913c
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2050]
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x30], 0x2000
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x409131
cmp dword [rsp + 0x30], eax
jbe 0x409131
lea rdx, [rsp + 0x2050]
lea rcx, str.found_installations:__s
call fcn.0040a860
lea rcx, [rsp + 0x2050]
jmp 0x40911c
mov rcx, rbx
call sub.msvcrt.dll_strlen
test rax, rax
je 0x409131
lea rdx, str._sjre
lea rcx, [rsp + 0x4050]
mov r8, rbx
call qword [sym.imp.msvcrt.dll_sprintf]
lea rdx, [rsp + 0x4050]
mov rcx, rdi
call fcn.00407a88
test al, al
je 0x40911a
xor r9d, r9d
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
mov byte [rsp + 0x20], 1
call fcn.00408e98
test al, al
jne 0x409157
xor ecx, ecx
lea rdx, [0x0040ec58]
call qword [sym.imp.msvcrt.dll_strtok]
test rax, rax
mov rbx, rax
jne 0x4090c7
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x6050]
call fcn.0040d230
add rsp, 0x6068
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov al, 1
jmp 0x40913e

Function at 0x40915c
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
mov eax, 0x2048
call fcn.0040d260
sub rsp, rax
mov rax, qword [0x00413830]
mov qword [rsp + 0x2030], rax
mov rax, rdx
mov r12, r8
mov rbp, rcx
lea rdx, [rsp + 0x30]
mov r8d, 0x2000
mov rcx, rax
mov r13, r9
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x40920d
lea rcx, [rsp + 0x30]
xor esi, esi
call sub.msvcrt.dll_strlen
lea ebx, [rsi + 1]
test rax, rax
je 0x4091dd
lea rdi, [rsp + 0x30]
cmp byte [rdi], 0x2f
jne 0x4091c6
mov byte [rdi], 0x5c
lea rcx, [rsp + 0x30]
add esi, ebx
add rdi, rbx
call sub.msvcrt.dll_strlen
movsxd rcx, esi
cmp rcx, rax
jb 0x4091be
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.00407a88
test al, al
je 0x409207
xor r9d, r9d
mov r8, r13
mov rdx, r12
mov rcx, rbp
mov byte [rsp + 0x20], bl
call fcn.00408e98
test al, al
jne 0x409209
xor ebx, ebx
mov al, bl
jmp 0x40920f
xor al, al
mov rcx, qword [rsp + 0x2030]
call fcn.0040d230
add rsp, 0x2048
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x40a0d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x40a101
mov r10d, r8d
mov r8b, byte [rdx]
mov r9d, dword [rcx]
inc rdx
xor r8b, r9b
shr r9d, 8
movzx eax, r8b
lea r8, [0x00413020]
mov eax, dword [r8 + rax*4]
xor eax, r9d
dec r10
mov dword [rcx], eax
jne 0x40a0d8
ret

Function at 0x40a470
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x28
mov rbx, rcx
call sub.msvcrt.dll_strlen
cmp eax, 3
jl 0x40a55b
cmp byte [rbx + 1], 0x2d
jne 0x40a55b
mov rcx, qword [0x00413010]
lea rdi, [0x00413010]
jmp 0x40a4f9
mov rsi, qword [rdi]
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov rbp, rax
lea ecx, [rax + 1]
movsxd rcx, ecx
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test ebp, ebp
jle 0x40a4da
movsxd r8, ebp
mov rdx, rax
sub rsi, rax
mov cl, byte [rsi + rdx]
xor cl, 0xbb
mov byte [rdx], cl
inc rdx
dec r8
jne 0x40a4ca
movsxd r8, ebp
mov rdx, rax
mov rcx, rbx
mov byte [r8 + rax], 0
call qword [sym.imp.msvcrt.dll_strncmp]
test eax, eax
je 0x40a55b
add rdi, 8
mov rcx, qword [rdi]
call sub.msvcrt.dll_strlen
test rax, rax
jne 0x40a4a4
movsx ecx, byte [rbx]
sub ecx, 0x41
je 0x40a537
sub ecx, 4
je 0x40a52b
sub ecx, 7
je 0x40a537
sub ecx, 7
je 0x40a537
dec ecx
jne 0x40a55b
mov rcx, rbx
call fcn.00409f54
add eax, 0xfffffffc
jmp 0x40a542
mov dl, 1
mov rcx, rbx
call fcn.0040a3e4
jmp 0x40a560
mov rcx, rbx
call fcn.00409f54
add eax, 0xfffffffe
cmp eax, 1
ja 0x40a55b
mov rcx, rbx
call fcn.0040a360
neg al
sbb eax, eax
and eax, 2
add eax, 0xfffffffd
jmp 0x40a560
mov eax, 0xfffffffd
add rsp, 0x28
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x40a614
Capabilities:
Query environment variable

Disassembly:
push rbx
push rdi
mov eax, 0x4048
call fcn.0040d260
sub rsp, rax
mov rax, qword [0x00413830]
mov qword [rsp + 0x4030], rax
mov rcx, qword [0x00419918]
test rcx, rcx
je 0x40a65d
cmp qword [0x00419910], 0
jne 0x40a65d
lea rdx, [0x0040fed4]
call qword [sym.imp.msvcrt.dll_fopen]
mov qword [0x00419910], rax
cmp byte [0x00419908], 0
jne 0x40a7b2
mov bl, byte [0x0041fa0a]
lea rdx, [rsp + 0x30]
lea rcx, str.EXE4J_LOG
mov edi, 1
mov r8d, 0x2000
mov byte [0x00419908], dil
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x40a6b1
lea rdx, [0x0040fec0]
lea rcx, [rsp + 0x30]
call sub.msvcrt.dll_strcmp
movzx ebx, bl
test eax, eax
cmove ebx, edi
lea rdx, [rsp + 0x30]
lea rcx, str.INSTALL4J_LOG
mov r8d, 0x2000
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x40a6e6
lea rdx, [0x0040fec0]
lea rcx, [rsp + 0x30]
call sub.msvcrt.dll_strcmp
movzx ebx, bl
test eax, eax
cmove ebx, edi
test bl, bl
je 0x40a7b2
lea rdx, str.i4j_nlog_
lea rcx, [0x0040ee14]
call qword [sym.imp.msvcrt.dll__tempnam]
test rax, rax
mov qword [0x00419918], rax
je 0x40a727
lea rdx, [0x0040fe9c]
mov rcx, rax
call qword [sym.imp.msvcrt.dll_fopen]
mov qword [0x00419910], rax
jmp 0x40a72e
mov rax, qword [0x00419910]
test rax, rax
jne 0x40a75a
lea rcx, str.c:i4j_nlog
lea rdx, [0x0040fe9c]
mov qword [0x00419918], rcx
call qword [sym.imp.msvcrt.dll_fopen]
test rax, rax
mov qword [0x00419910], rax
je 0x40a7b2
lea rdx, [rsp + 0x2030]
mov r8d, 0x2000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x20]
call qword [sym.imp.msvcrt.dll_time]
lea rcx, [rsp + 0x20]
call qword [sym.imp.msvcrt.dll_ctime]
mov rcx, qword [0x00419910]
lea r8, [rsp + 0x2030]
lea rdx, [0x0040fe70]
mov r9, rax
call qword [sym.imp.msvcrt.dll_fprintf]
mov rcx, qword [0x00419910]
call qword [sym.imp.msvcrt.dll_fflush]
mov rcx, qword [rsp + 0x4030]
call fcn.0040d230
add rsp, 0x4048
pop rdi
pop rbx
ret

Function at 0x40a8d0
Capabilities:
Set registry value

Disassembly:
mov eax, 0x2078
call fcn.0040d260
sub rsp, rax
mov rax, qword [0x00413830]
mov qword [rsp + 0x2060], rax
call fcn.00404cf4
lea rcx, [rsp + 0x60]
xor r8d, r8d
mov rdx, rax
call fcn.00404ff4
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
lea rdx, str.SOFTWAREej_technologiesexe4jpids_
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40a988
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rsp + 0x58]
mov r9d, 4
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], r9d
lea rdx, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x2060]
call fcn.0040d230
add rsp, 0x2078
ret
Function at 0x40a9a0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
mov eax, 0x2060
call fcn.0040d260
sub rsp, rax
mov rax, qword [0x00413830]
mov qword [rsp + 0x2050], rax
call fcn.00404cf4
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov rdx, rax
call fcn.00404ff4
lea rax, [rsp + 0x38]
lea rdx, str.SOFTWAREej_technologiesexe4jpids_
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x40aa4d
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x40aa42
cmp dword [rsp + 0x30], 4
cmove ebx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x2050]
call fcn.0040d230
add rsp, 0x2060
pop rbx
ret
Function at 0x40b080
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x2040
call fcn.0040d260
sub rsp, rax
mov rax, qword [0x00413830]
mov qword [rsp + 0x2030], rax
mov ebx, ecx
mov ecx, 0x278b
call fcn.00403e8c
xor edi, edi
cmp eax, edi
je 0x40b1fa
cmp ebx, edi
jne 0x40b0d2
cmp byte [0x0041d9c0], dil
je 0x40b1fa
call qword [0x00419938]
jmp 0x40b1fa
cmp byte [0x0041d9c0], dil
jne 0x40b1fa
call fcn.00405e04
lea rdx, str._s_bin_splashscreen.dll
lea rcx, [rsp + 0x30]
mov r8, rax
call qword [sym.imp.msvcrt.dll_sprintf]
lea rdx, [rsp + 0x30]
lea rcx, str.loading_splashscreen_dll_from__s
call fcn.0040a860
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp rax, rdi
mov rbx, rax
jne 0x40b129
lea rcx, str.Could_not_load_splashscreen.dll
jmp 0x40b1f5
lea rdx, str.SplashClose
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SplashInit
mov rcx, rbx
mov qword [0x00419938], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SplashLoadMemory
mov rcx, rbx
mov qword [0x00419930], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x00419938], rdi
mov qword [0x0041d9b0], rax
je 0x40b1ee
mov rcx, qword [0x00419930]
cmp rcx, rdi
je 0x40b1ee
cmp rax, rdi
je 0x40b1ee
call rcx
xor ecx, ecx
mov edx, 0x2710
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rsi
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rdi
mov edx, eax
mov ebx, eax
call qword [0x0041d9b0]
lea rcx, str.splash_load_memory_returned__d___p___p___d_
mov r9, rdi
mov r8, rsi
mov edx, eax
mov dword [rsp + 0x20], ebx
call fcn.0040a860
mov byte [0x0041d9c0], 1
jmp 0x40b1fa
lea rcx, str.Could_not_find_functions_in_splashscreen.dll
call fcn.0040a7dc
mov rcx, qword [rsp + 0x2030]
call fcn.0040d230
add rsp, 0x2040
pop rdi
pop rsi
pop rbx
ret

Function at 0x40bc84
Capabilities:
Create directory

Disassembly:
push rbx
mov eax, 0x2030
call fcn.0040d260
sub rsp, rax
mov rax, qword [0x00413830]
mov qword [rsp + 0x2020], rax
xor ebx, ebx
lea rcx, [rsp + 0x20]
call fcn.004052c8
lea rdx, [rsp + 0x20]
lea rcx, [0x0041d9f0]
call sub.msvcrt.dll_strcpy
lea rdx, str._dir
lea rcx, [0x0041d9f0]
call sub.msvcrt.dll_strcat
lea rdx, [0x0041d9f0]
lea rcx, str.Temp_dir:__s
call fcn.0040a860
lea rcx, [0x0041d9f0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40bd24
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Could_not_create_dir___d_
mov edx, eax
call fcn.0040a860
inc ebx
cmp ebx, 5
jl 0x40bca4
lea rdx, [0x00410550]
mov ecx, 0x3f1
call fcn.0040457c
mov rcx, qword [rsp + 0x2020]
call fcn.0040d230
add rsp, 0x2030
pop rbx
ret
Function at 0x40bd3c
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push rbx
mov eax, 0x8030
call fcn.0040d260
sub rsp, rax
mov rax, qword [0x00413830]
mov qword [rsp + 0x8020], rax
lea rdx, [rsp + 0x2020]
mov r8d, 0x2000
mov ecx, 0x2714
call fcn.00403e40
lea rdx, [rsp + 0x2020]
lea rcx, str.native_lib_dir_is__s
call fcn.0040a860
lea rcx, [rsp + 0x2020]
call fcn.00406080
lea rdx, [rsp + 0x2020]
lea rcx, [rsp + 0x4020]
call fcn.004053e8
lea rcx, [rsp + 0x4020]
call sub.msvcrt.dll_strlen
test rax, rax
je 0x40bde5
lea rcx, [rsp + 0x4020]
call sub.msvcrt.dll_strlen
cmp byte [rsp + rax + 0x401f], 0x3b
je 0x40bde5
lea rdx, [0x0040ec58]
lea rcx, [rsp + 0x4020]
call sub.msvcrt.dll_strcat
lea rcx, [rsp + 0x4020]
call sub.msvcrt.dll_strlen
lea rcx, [rsp + 0x4020]
mov ebx, 0x4000
sub ebx, eax
call sub.msvcrt.dll_strlen
lea rcx, str.PATH
lea rdx, [rsp + rax + 0x4020]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea rdx, [rsp + 0x4020]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x40be4d
lea rdx, [rsp + 0x4020]
lea rcx, str.Setting_PATH__native_libs___s
call fcn.0040a860
jmp 0x40be6a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x4020]
lea rcx, str.Setting_PATH__native_libs___s_failed_with_error__d
mov r8d, eax
call fcn.0040a860
lea r8, [rsp + 0x4020]
lea rdx, str.PATH_s
lea rcx, [rsp + 0x20]
call qword [sym.imp.msvcrt.dll_sprintf]
lea rcx, [rsp + 0x20]
call qword [sym.imp.msvcrt.dll__putenv]
mov rcx, qword [rsp + 0x8020]
call fcn.0040d230
add rsp, 0x8030
pop rbx
ret

Function at 0x40bef8
Capabilities:
Shutdown system

Disassembly:
sub rsp, 0x48
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0040bea8
test al, al
je 0x40bf82
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40bf8d
lea r8, [rsp + 0x34]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x30]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 2
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40bf8d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
add rsp, 0x48
ret
Function at 0x40c9b0
Capabilities:
Create process on windows

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x60f0
call fcn.0040d260
sub rsp, rax
mov rax, qword [0x00413830]
mov qword [rsp + 0x60e0], rax
mov rsi, rcx
lea rcx, [rsp + 0xe0]
mov rdi, rdx
call sub.msvcrt.dll_strcpy
lea rcx, str..pack
call sub.msvcrt.dll_strlen
lea rbx, [rsp + 0xe0]
lea rcx, [rsp + 0xe0]
sub rbx, rax
call sub.msvcrt.dll_strlen
mov rcx, rdi
mov byte [rax + rbx], 0
call fcn.00404c8c
test al, al
jne 0x40ca23
lea rcx, str.pack_path_doesnt_exists
jmp 0x40cb43
lea rdx, str._s_binunpack200.exe
lea rcx, [rsp + 0x40e0]
mov r8, rsi
call qword [sym.imp.msvcrt.dll_sprintf]
lea r9, [rsp + 0xe0]
lea rdx, str._r___s____s_
lea rcx, [rsp + 0x20e0]
mov r8, rdi
call qword [sym.imp.msvcrt.dll_sprintf]
lea rcx, [rsp + 0x40e0]
call fcn.0040a860
lea rcx, [rsp + 0x20e0]
call fcn.0040a860
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x18]
call sub.msvcrt.dll_memset
mov ebx, 0x68
lea rcx, [rsp + 0x70]
mov r8, rbx
xor edx, edx
call sub.msvcrt.dll_memset
lea ecx, [rbx - 0x67]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov dword [rsp + 0xac], ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], ecx
lea rdx, [rsp + 0x20e0]
lea rcx, [rsp + 0x40e0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x70], ebx
mov word [rsp + 0xb0], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40cb20
lea rcx, str.could_not_create_unpack_process
call fcn.0040a860
lea rdx, [0x004108e0]
mov ecx, 0x3f1
call fcn.0040457c
lea rcx, str.waiting_for_unpack200_to_finish
call fcn.0040a860
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, str.unpack_done
call fcn.0040a860
mov rcx, qword [rsp + 0x60e0]
call fcn.0040d230
add rsp, 0x60f0
pop rdi
pop rsi
pop rbx
ret
Function at 0x40cda0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, rcx
lea rsi, [0x0041fab0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [0x0041fba8]
lea rdx, [rsp + 0x70]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x40ce21
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x48]
mov r9, rax
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov r8, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov r11, qword [0x0041fba8]
jmp 0x40ce3d
mov r11, qword [rsp + 0x68]
lea rax, [rsp + 0x68]
add rax, 8
mov qword [0x0041fba8], r11
mov qword [0x0041fb48], rax
mov rax, qword [0x00413830]
mov qword [0x0041fa20], r11
mov qword [0x0041fb30], rdi
mov dword [0x0041fa10], 0xc0000409
mov dword [0x0041fa14], 1
mov qword [rsp + 0x50], rax
mov rax, qword [0x00413828]
xor ecx, ecx
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x00410a40]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
add rsp, 0x68
ret
cmp rcx, qword [0x00413830]
jne 0x40d249
rol rcx, 0x10
test cx, 0xffff
jne 0x40d245
ret
ror rcx, 0x10
jmp 0x40cda0
Function at 0x40cf60
Capabilities:
Parse pe header
Terminate process

Disassembly:
mov rax, rsp
sub rsp, 0xc8
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
cmp word [0x00400000], 0x5a4d
je 0x40cf9d
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
lea rdi, [0x00400000]
jmp 0x40d02b
movsxd rax, dword [0x0040003c]
lea rdi, [0x00400000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x40cfc1
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x40d02b
movzx ecx, word [rax + 0x18]
cmp ecx, 0x10b
je 0x40d008
cmp ecx, 0x20b
je 0x40cfe0
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x40d02b
cmp dword [rax + 0x84], 0xe
ja 0x40cff4
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x40d02b
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
jmp 0x40d02b
cmp dword [rax + 0x74], 0xe
ja 0x40d019
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x40d02b
xor ebx, ebx
cmp dword [rax + 0xe8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
mov ecx, 2
call qword [sym.imp.msvcrt.dll___set_app_type]
mov qword [0x0041ff90], 0xffffffffffffffff
mov qword [0x0041ff98], 0xffffffffffffffff
mov rcx, qword [sym.imp.msvcrt.dll__fmode]
mov eax, dword [0x0041ff8c]
mov dword [rcx], eax
mov rcx, qword [sym.imp.msvcrt.dll__commode]
mov eax, dword [0x0041ff88]
mov dword [rcx], eax
call fcn.0040d210
cmp dword [0x00413844], 0
jne 0x40d085
lea rcx, [fcn.0040d210]
call qword [sym.imp.msvcrt.dll___setusermatherr]
lea rdx, [0x0040e538]
lea rcx, [0x0040e530]
call sub.msvcrt.dll__initterm
mov r11d, dword [0x0041ff84]
mov dword [rsp + 0xd8], r11d
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, dword [0x0041ff80]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x3c]
call qword [sym.imp.msvcrt.dll___getmainargs]
lea rdx, [0x0040e528]
lea rcx, [0x0040e508]
call sub.msvcrt.dll__initterm
mov r11, qword [sym.imp.msvcrt.dll__acmdln]
mov r8, qword [r11]
mov qword [rsp + 0x30], r8
cmp byte [r8], 0x22
jne 0x40d126
nop
nop
inc r8
mov qword [rsp + 0x30], r8
movzx eax, byte [r8]
test al, al
je 0x40d116
cmp al, 0x22
je 0x40d116
jmp 0x40d100
cmp byte [r8], 0x22
jne 0x40d136
inc r8
mov qword [rsp + 0x30], r8
jmp 0x40d136
cmp byte [r8], 0x20
jbe 0x40d136
inc r8
mov qword [rsp + 0x30], r8
jmp 0x40d126
movzx eax, byte [r8]
test al, al
je 0x40d14c
cmp al, 0x20
ja 0x40d14c
inc r8
mov qword [rsp + 0x30], r8
jmp 0x40d136
test byte [rsp + 0x8c], 1
je 0x40d161
movzx r9d, word [rsp + 0x90]
jmp 0x40d167
mov r9d, 0xa
xor edx, edx
mov rcx, rdi
call fcn.0040c63c
mov edi, eax
mov dword [rsp + 0x38], eax
test ebx, ebx
jne 0x40d183
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
call qword [sym.imp.msvcrt.dll__cexit]
jmp 0x40d1a7
mov eax, edi
jmp 0x40d1b0
mov rbx, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xe8]
add rsp, 0xc8
ret
Function at 0x6d863ef0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6d8855e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6d864078
mov rax, qword [0x6d8855e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6d863f3c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6d863fc5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6d863f20
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6d8640ad
mov rax, qword [0x6d8855e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6d8855e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6d864090
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6d863fbe
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6d864020
add dword [0x6d8855e4], 1
cmp edi, 8
jae 0x6d863ff3
test dil, 4
jne 0x6d864064
test edi, edi
je 0x6d863fe8
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6d86407f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6d863fe8
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6d86400c
jmp 0x6d863fe8
add rsi, qword [0x6d8855e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6d863fbe
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6d863fe8
xor esi, esi
jmp 0x6d863f47
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6d863fe8
mov rax, qword [0x6d8855e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6d864800
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6d8858c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6d8858a0]
test rbx, rbx
je 0x6d864854
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6d86484b
test rsi, rsi
je 0x6d86484b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6d864830
lea rcx, [0x6d8858c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]