joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800f7ba0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, 0x30
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call sub.KERNEL32.dll_VirtualQuery
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1800f7be7
xor al, al
jmp 0x1800f7c89
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x1800f7c11
xor al, al
jmp 0x1800f7c89
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x88], rax
jb 0x1800f7c81
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0xc
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx + 0x8c]
add rax, rcx
cmp qword [rsp + 0x88], rax
jae 0x1800f7c81
mov al, 1
jmp 0x1800f7c89
jmp 0x1800f7c87
xor al, al
add rsp, 0x78
ret

Function at 0x1800f7f90
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x18013c5a0]
mov qword [rsp + 0x28], rax
jmp 0x1800f7fb0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800f7fdf
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1800f7fdd
call sub.KERNEL32.dll_GetLastError
jmp 0x1800f7fe1
jmp 0x1800f7fa2
xor eax, eax
add rsp, 0x38
ret
Function at 0x1800f8850
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x18013c5b8], eax
je 0x1800f886b
mov eax, 0x10dd
jmp 0x1800f8990
mov rax, qword [0x18013c5d0]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800f8915
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
call sub.KERNEL32.dll_VirtualProtect
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x1800f88e0
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 0
je 0x1800f88e0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x20]
call fcn.1800f72f0
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x30
mov rcx, qword [rsp + 0x38]
call fcn.180118cd0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x1800f8877
mov qword [0x18013c5d0], 0
call fcn.1800f7d50
mov rax, qword [0x18013c5c8]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1800f8979
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call sub.KERNEL32.dll_ResumeThread
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov edx, 0x10
mov rcx, qword [rsp + 0x48]
call fcn.180118cd0
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x1800f8931
mov qword [0x18013c5c8], 0
mov dword [0x18013c5b8], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x1800f8ec0
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x18013c5bc], 0
je 0x1800f8edd
mov eax, dword [0x18013c5bc]
jmp 0x1800f8fa3
call sub.KERNEL32.dll_GetCurrentThread
cmp qword [rsp + 0x50], rax
jne 0x1800f8ef0
xor eax, eax
jmp 0x1800f8fa3
mov ecx, 0x10
call fcn.180118914
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1800f8f5e
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x1800f8f43
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x10
mov rcx, qword [rsp + 0x38]
call fcn.180118cd0
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x18013c5bc], eax
mov qword [0x18013c5c0], 0
mov eax, dword [rsp + 0x20]
jmp 0x1800f8fa3
mov rcx, qword [rsp + 0x50]
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x1800f8f78
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
jmp 0x1800f8f19
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [0x18013c5c8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
mov qword [0x18013c5c8], rax
xor eax, eax
add rsp, 0x48
ret
Function at 0x1800f90a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x80], 0
jne 0x1800f90cd
xor ecx, ecx
call sub.KERNEL32.dll_GetModuleHandleW
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1800f90ed
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1800f9266
mov rax, qword [rsp + 0x40]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp dword [rax], 0x4550
je 0x1800f9124
mov ecx, 0xbf
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1800f9266
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 0x14]
test eax, eax
jne 0x1800f9142
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1800f9266
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], 0
jmp 0x1800f916e
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x20], eax
jae 0x1800f924a
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
lea rdx, str..detour
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x1800f9245
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x48]
cmp dword [rcx + rax + 0xc], 0
je 0x1800f91d3
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x48]
cmp dword [rcx + rax + 0x10], 0
jne 0x1800f91d5
jmp 0x1800f924a
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x48]
mov eax, dword [rcx + rax + 0xc]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax]
cmp rax, 0x40
jb 0x1800f921b
mov rax, qword [rsp + 0x28]
cmp dword [rax + 4], 0x727444
je 0x1800f921d
jmp 0x1800f924a
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x1800f9237
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx]
mov dword [rax + 8], ecx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
jmp 0x1800f9266
jmp 0x1800f9164
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1800f9266
add rsp, 0x78
ret
Function at 0x1800f9270
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [rsp + 0x90]
add rax, 0x10000
mov qword [rsp + 0x30], rax
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x48]
call sub.VCRUNTIME140.dll_memset
jmp 0x1800f92b8
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov r8d, 0x30
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
ja 0x1800f92d7
jmp 0x1800f937b
cmp dword [rsp + 0x68], 0x1000
jne 0x1800f92fc
mov eax, dword [rsp + 0x6c]
and eax, 0xff
cmp eax, 1
je 0x1800f92fc
mov eax, dword [rsp + 0x6c]
and eax, 0x100
test eax, eax
je 0x1800f92fe
jmp 0x1800f92a3
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x1800f9334
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x3c]
cmp rax, qword [rsp + 0x60]
ja 0x1800f9334
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x3c]
cmp rax, 0x40
jae 0x1800f9339
jmp 0x1800f92a3
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp dword [rax], 0x4550
jne 0x1800f92a3
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x20]
jmp 0x1800f937d
xor eax, eax
add rsp, 0x88
ret

Function at 0x1800fb860
Capabilities:
Log keystrokes via polling

Disassembly:
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0x38
movzx eax, byte [rsp + 0x48]
test eax, eax
jne 0x1800fb8c4
mov eax, 2
imul rax, rax, 0
xor ecx, ecx
mov rdx, qword [rsp + 0x40]
mov word [rdx + rax], cx
mov dword [rsp + 0x20], 1
jmp 0x1800fb89e
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x100
jge 0x1800fb8c2
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x40]
mov word [rdx + rcx*2], ax
jmp 0x1800fb894
jmp 0x1800fb8df
movzx eax, byte [rsp + 0x48]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ecx, byte [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov word [rdx + rcx*2], ax
add rsp, 0x38
ret

Function at 0x180100c20
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov ecx, 0x10
call fcn.180118914
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
mov qword [rax], rcx
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
mov qword [rax + 8], rcx
mov qword [0x18013ccd0], 0
mov rdx, qword [rsp + 0x20]
lea rcx, [0x180100ee0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov edx, 0x10
mov rcx, qword [rsp + 0x30]
call fcn.180118cd0
mov rax, qword [0x18013ccd0]
add rsp, 0x48
ret
Function at 0x1801147c0
Capabilities:
Read file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x68
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 0x58]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
cmp dword [rax + 0x2c], 0
jne 0x1801148c5
mov rax, qword [rsp + 0x80]
mov dword [rax + 0x2c], 1
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x80]
mov rdi, qword [rax + 0x38]
xor eax, eax
mov rcx, qword [rcx + 0x18]
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rsp + 0x80]
add rax, 0x40
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov rax, qword [rsp + 0x80]
mov r8d, dword [rax + 0x18]
mov rax, qword [rsp + 0x80]
mov rdx, qword [rax + 0x38]
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x1801148c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x1801148c5
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CancelIo]
mov rax, qword [rsp + 0x80]
mov dword [rax + 0x2c], 0
jmp 0x180114a0c
cmp dword [rsp + 0x98], 0
jl 0x1801148f3
mov edx, dword [rsp + 0x98]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x1801148f3
xor eax, eax
jmp 0x180114a32
mov rax, qword [rsp + 0x80]
add rax, 0x40
mov r9d, 1
lea r8, [rsp + 0x30]
mov rdx, rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x80]
mov dword [rax + 0x2c], 0
cmp dword [rsp + 0x34], 0
je 0x180114a0c
cmp dword [rsp + 0x30], 0
jbe 0x180114a0c
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx + 0x38]
movsx eax, byte [rcx + rax]
test eax, eax
jne 0x1801149c1
mov eax, dword [rsp + 0x30]
dec eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
cmp qword [rsp + 0x90], rax
jbe 0x180114987
mov eax, dword [rsp + 0x30]
mov qword [rsp + 0x48], rax
jmp 0x180114994
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 0x38]
inc rax
mov rdi, qword [rsp + 0x88]
mov rsi, rax
mov rcx, qword [rsp + 0x38]
rep movsb byte [rdi], byte [rsi]
jmp 0x180114a0c
mov eax, dword [rsp + 0x30]
cmp qword [rsp + 0x90], rax
jbe 0x1801149da
mov eax, dword [rsp + 0x30]
mov qword [rsp + 0x50], rax
jmp 0x1801149e7
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rax + 0x38]
mov rcx, qword [rsp + 0x38]
rep movsb byte [rdi], byte [rsi]
cmp dword [rsp + 0x34], 0
jne 0x180114a2e
lea rdx, [0x180120a38]
mov rcx, qword [rsp + 0x80]
call fcn.1801151d0
mov eax, 0xffffffff
jmp 0x180114a32
mov eax, dword [rsp + 0x38]
add rsp, 0x68
pop rdi
pop rsi
ret
Function at 0x180114a80
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x78
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x90]
movzx eax, word [rax + 0x14]
cmp qword [rsp + 0xa0], rax
jb 0x180114ad0
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x40], rax
jmp 0x180114b4f
mov rax, qword [rsp + 0x90]
movzx eax, word [rax + 0x14]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x40], rax
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x98]
mov rcx, qword [rsp + 0xa0]
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x90]
movzx eax, word [rax + 0x14]
sub rax, qword [rsp + 0xa0]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0x40]
add rdx, rcx
mov rcx, rdx
mov rdi, rcx
mov eax, CMapStringToOb::HashKey
mov rcx, qword [rsp + 0x48]
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x90]
movzx eax, word [rax + 0x14]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, dword [rsp + 0xa0]
mov rdx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x90]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x180114bb9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0x3e5
je 0x180114bb9
lea rdx, [0x180120a18]
mov rcx, qword [rsp + 0x90]
call fcn.1801151d0
mov dword [rsp + 0x34], 0xffffffff
jmp 0x180114c2c
cmp dword [rsp + 0xa8], 0
jl 0x180114be4
mov edx, dword [rsp + 0xa8]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x180114be4
xor eax, eax
jmp 0x180114c4a
mov r9d, 1
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x50]
mov rax, qword [rsp + 0x90]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x180114c2c
lea rdx, [0x180120a28]
mov rcx, qword [rsp + 0x90]
call fcn.1801151d0
mov dword [rsp + 0x34], 0xffffffff
mov rax, qword [rsp + 0x98]
cmp qword [rsp + 0x40], rax
je 0x180114c46
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [rsp + 0x34]
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x180114c60
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
lea rcx, [0x180120890]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x18013ccf0], rax
cmp qword [0x18013ccf0], 0
je 0x180114e84
lea rdx, str.HidD_GetAttributes
mov rcx, qword [0x18013ccf0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18013cd00], rax
cmp qword [0x18013cd00], 0
jne 0x180114cb5
mov eax, 0xffffffff
jmp 0x180114e8d
lea rdx, str.HidD_GetSerialNumberString
mov rcx, qword [0x18013ccf0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18013cd08], rax
cmp qword [0x18013cd08], 0
jne 0x180114ce4
mov eax, 0xffffffff
jmp 0x180114e8d
lea rdx, str.HidD_GetManufacturerString
mov rcx, qword [0x18013ccf0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18013cd10], rax
cmp qword [0x18013cd10], 0
jne 0x180114d13
mov eax, 0xffffffff
jmp 0x180114e8d
lea rdx, str.HidD_GetProductString
mov rcx, qword [0x18013ccf0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18013cd18], rax
cmp qword [0x18013cd18], 0
jne 0x180114d42
mov eax, 0xffffffff
jmp 0x180114e8d
lea rdx, str.HidD_SetFeature
mov rcx, qword [0x18013ccf0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18013cd20], rax
cmp qword [0x18013cd20], 0
jne 0x180114d71
mov eax, 0xffffffff
jmp 0x180114e8d
lea rdx, str.HidD_GetFeature
mov rcx, qword [0x18013ccf0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18013cd28], rax
cmp qword [0x18013cd28], 0
jne 0x180114da0
mov eax, 0xffffffff
jmp 0x180114e8d
lea rdx, str.HidD_GetIndexedString
mov rcx, qword [0x18013ccf0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18013cd30], rax
cmp qword [0x18013cd30], 0
jne 0x180114dcf
mov eax, 0xffffffff
jmp 0x180114e8d
lea rdx, [0x180120940]
mov rcx, qword [0x18013ccf0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18013cd38], rax
cmp qword [0x18013cd38], 0
jne 0x180114dfe
mov eax, 0xffffffff
jmp 0x180114e8d
lea rdx, str.HidD_FreePreparsedData
mov rcx, qword [0x18013ccf0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18013cd40], rax
cmp qword [0x18013cd40], 0
jne 0x180114e2a
mov eax, 0xffffffff
jmp 0x180114e8d
lea rdx, [0x180120970]
mov rcx, qword [0x18013ccf0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18013cd48], rax
cmp qword [0x18013cd48], 0
jne 0x180114e56
mov eax, 0xffffffff
jmp 0x180114e8d
lea rdx, [0x180120980]
mov rcx, qword [0x18013ccf0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18013cd50], rax
cmp qword [0x18013cd50], 0
jne 0x180114e82
mov eax, 0xffffffff
jmp 0x180114e8d
jmp 0x180114e8b
mov eax, 0xffffffff
jmp 0x180114e8d
xor eax, eax
add rsp, 0x28
ret
Function at 0x180119e78
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r9, rcx
mov eax, 0x5a4d
lea rdx, [0x180000000]
cmp word [0x180000000], ax
je 0x180119e9f
xor eax, eax
mov r8d, dword [0x18000003c]
jmp 0x180119ec1
movsxd r8, dword [0x18000003c]
xor eax, eax
cmp dword [r8 + rdx], 0x4550
jne 0x180119ec1
mov r10d, 0x20b
cmp word [r8 + rdx + 0x18], r10w
sete al
test eax, eax
je 0x180119f23
sub r9, rdx
movsxd r10, r8d
add r10, rdx
xor edx, edx
movzx eax, word [r10 + 0x14]
lea rcx, [r10 + 0x18]
add rcx, rax
mov qword [rsp + 8], rcx
mov dword [rsp], edx
movzx eax, word [r10 + 6]
cmp edx, eax
jae 0x180119f09
mov r8d, dword [rcx + 0xc]
cmp r9, r8
jb 0x180119f01
mov eax, dword [rcx + 8]
add eax, r8d
cmp r9, rax
jb 0x180119f0b
inc edx
add rcx, 0x28
jmp 0x180119edc
xor ecx, ecx
test rcx, rcx
jne 0x180119f14
xor eax, eax
jmp 0x180119f23
mov eax, dword [rcx + 0x24]
shr eax, 0x1f
not eax
and eax, 1
jmp 0x180119f23
add rsp, 0x18
ret
Function at 0x2fc4db360
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4dbd62
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc500108]
test eax, eax
je 0x2fc4dbdfa
lea rax, [0x2fc5000e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc500110]
mov qword [rbp - 8], rax
jmp 0x2fc4dbdde
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4dbdd2
cmp qword [rbp - 0x10], 0
je 0x2fc4dbdd2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4dbd98
lea rax, [0x2fc5000e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4dbdfb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4dbf00
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4dbf28
mov eax, 0
jmp 0x2fc4dbf76
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4dbf51
mov eax, 0
jmp 0x2fc4dbf76
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4dbf71
mov eax, 0
jmp 0x2fc4dbf76
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4dbf7c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4dbffa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4dbff1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4dbff1
mov rax, qword [rbp - 8]
jmp 0x2fc4dc00f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4dbfc4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x4121b0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, rcx
lea rsi, [0x00468a20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [0x00468b18]
lea rdx, [rsp + 0x70]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x412231
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x48]
mov r9, rax
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov r8, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov r11, qword [0x00468b18]
jmp 0x41224d
mov r11, qword [rsp + 0x68]
lea rax, [rsp + 0x68]
add rax, 8
mov qword [0x00468b18], r11
mov qword [0x00468ab8], rax
mov rax, qword [0x00467048]
mov qword [0x00468990], r11
mov qword [0x00468aa0], rdi
mov dword [0x00468980], 0xc0000409
mov dword [0x00468984], 1
mov qword [rsp + 0x50], rax
mov rax, qword [0x00467040]
xor ecx, ecx
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x00450730]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
add rsp, 0x68
ret
cmp rcx, qword [0x00467048]
jne 0x44e649
rol rcx, 0x10
test cx, 0xffff
jne 0x44e645
ret
ror rcx, 0x10
jmp 0x4121b0