joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011efac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov r12, qword [rsp + 0xa0]
xor ebx, ebx
mov r14d, r9d
mov dword [r12], ebx
mov rsi, qword [rcx + 0x10]
mov ebp, r8d
mov r13, rcx
cmp rsi, rbx
je 0x14011f162
mov rdx, qword [rsi + 0x10]
mov rsi, qword [rsi]
lea rcx, str.CDockablePane
call fcn.14005a468
lea rdx, [rsp + 0x20]
mov rcx, qword [rax + 0x40]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r11, qword [rdi]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [r11 + 0x610]
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_PtInRect]
cmp eax, ebx
jne 0x14011f155
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_PtInRect]
cmp eax, ebx
jne 0x14011f155
mov rax, qword [rdi]
mov rdx, qword [rsp + 0x88]
mov r8d, 1
mov rcx, rdi
call qword [rax + 0x620]
cmp eax, 2
je 0x14011f145
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x2f8]
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x20]
add dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x34]
sub eax, dword [rsp + 0x3c]
add dword [rsp + 0x2c], eax
call qword [sym.imp.USER32.dll_PtInRect]
cmp eax, ebx
je 0x14011efe2
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.14001bcf8
lea rcx, vtable.CGlobalUtils.0
mov rdx, rax
call fcn.1400ccc48
cmp rax, rbx
je 0x14011f0f3
mov rax, qword [rax + 0x308]
cmp rax, rbx
je 0x14011f0f3
cmp dword [rax + 0xc], ebx
je 0x14011f0f3
cmp dword [rax + 8], ebx
jne 0x14011f125
mov edx, ebp
lea rcx, [rsp + 0x20]
neg edx
mov r8d, edx
call qword [sym.imp.USER32.dll_InflateRect]
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_PtInRect]
cmp eax, ebx
je 0x14011f15d
cmp ebp, ebx
je 0x14011f15d
jmp 0x14011efe2
mov ecx, dword [rax + 0x178]
lea eax, [rcx - 4]
cmp eax, 4
ja 0x14011f15d
mov rax, qword [rsp + 0xa8]
cmp ecx, 8
sete bl
mov dword [rax], ebx
jmp 0x14011f15d
mov rax, qword [rsp + 0xa8]
mov dword [rax], 1
jmp 0x14011f15d
mov dword [r12], 1
mov rax, rdi
jmp 0x14011f1c8
cmp r14d, ebx
jne 0x14011f1c6
mov rdi, qword [r13 + 0x10]
jmp 0x14011f1c1
mov rdx, rdi
cmp rdi, rbx
je 0x14011f1e6
mov rdx, qword [rdx + 0x10]
mov rdi, qword [rdi]
lea rcx, str.CDockablePane
call fcn.14005a468
lea rdx, [rsp + 0x30]
mov rcx, qword [rax + 0x40]
mov rsi, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rcx, [rsp + 0x30]
mov r8d, ebp
mov edx, ebp
call qword [sym.imp.USER32.dll_InflateRect]
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_PtInRect]
cmp eax, ebx
jne 0x14011f1e1
cmp rdi, rbx
jne 0x14011f16d
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov rax, rsi
jmp 0x14011f1c8
call fcn.14001501c
int3
Function at 0x14012a960
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test byte [rdx + 4], 1
mov esi, r8d
mov rbx, rdx
mov rbp, rcx
je 0x14012a989
mov rdi, qword [rdx + 0x10]
jmp 0x14012a9da
mov rdx, qword [rdx + 0x10]
mov rcx, qword [rbx + 8]
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x14012a9aa
call fcn.140029928
mov rcx, qword [rbx + 8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
jne 0x14012a9c4
call fcn.140029928
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
jne 0x14012a9da
call fcn.140029928
call fcn.14005b1a4
cmp qword [rax + 0x68], 0
je 0x14012a9f4
mov rdx, rdi
mov rcx, rbp
call fcn.1401290b0
mov rdi, rax
mov edx, esi
mov rcx, rdi
call fcn.14012a77c
mov rcx, qword [rbp + 0xb8]
mov rsi, rax
test rcx, rcx
je 0x14012aa1b
call qword [sym.imp.KERNEL32.dll_GlobalFree]
and qword [rbp + 0xb8], 0
test rsi, rsi
je 0x14012aa2a
mov rdi, rsi
mov qword [rbp + 0xb8], rsi
or dword [rbx + 4], 1
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov qword [rbx + 0x10], rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14012b428
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
lea r8, [rcx + 0x110]
mov rbx, rcx
mov rcx, rdi
mov edx, 0x40d9
call fcn.1401634e4
lea r8, [rbx + 0x1b8]
mov edx, 0x40da
mov rcx, rdi
call fcn.1401634e4
lea r8, [rbx + 0x268]
mov edx, 0x40db
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14016373c

Function at 0x14013653c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
lea r8, [rcx + 0x110]
mov rbx, rcx
mov rcx, rdi
mov edx, 0x4090
call fcn.1401634e4
lea r8, [rbx + 0x1b8]
mov edx, 0x4104
mov rcx, rdi
call fcn.1401634e4
lea r8, [rbx + 0x288]
mov edx, 0x4102
mov rcx, rdi
call fcn.1401634e4
lea r8, [rbx + 0x330]
mov edx, 0x408e
mov rcx, rdi
call fcn.1401634e4
lea r8, [rbx + 0x3d8]
mov edx, 0x4106
mov rcx, rdi
call fcn.1401634e4
lea r8, [rbx + 0x480]
mov edx, 0x4103
mov rcx, rdi
call fcn.1401634e4
lea r8, [rbx + 0x528]
mov edx, 0x4101
mov rcx, rdi
call fcn.1401634e4
lea r8, [rbx + 0x5d0]
mov edx, 0x40d9
mov rcx, rdi
call fcn.1401634e4
lea r8, [rbx + 0x678]
mov edx, 0x4105
mov rcx, rdi
call fcn.1401634e4
lea r8, [rbx + 0x720]
mov edx, 0x4082
mov rcx, rdi
call fcn.14016373c
lea r8, [rbx + 0x728]
mov edx, 0x408f
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14016373c
Function at 0x140138258
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
lea r8, [rcx + 0x110]
mov rbx, rcx
mov rcx, rdi
mov edx, 0x4265
call fcn.1401634e4
lea r8, [rbx + 0xb88]
mov edx, 0x425d
mov rcx, rdi
call fcn.1401634e4
lea r8, [rbx + 0x1600]
mov edx, 0x421c
mov rcx, rdi
call fcn.1401634e4
lea r8, [rbx + 0x16a8]
mov edx, 0x421d
mov rcx, rdi
call fcn.1401634e4
lea r8, [rbx + 0x1750]
mov edx, 0x421a
mov rcx, rdi
call fcn.1401634e4
lea r8, [rbx + 0x17f8]
mov edx, 0x421b
mov rcx, rdi
call fcn.1401634e4
lea r8, [rbx + 0x18a0]
mov edx, 0x4219
mov rcx, rdi
call fcn.1401634e4
lea r8, [rbx + 0x1b68]
mov edx, 0x421a
mov rcx, rdi
call fcn.14016373c
lea r8, [rbx + 0x1b70]
mov edx, 0x421c
mov rcx, rdi
call fcn.14016373c
lea r8, [rbx + 0x1b78]
mov edx, 0x421d
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14016373c

Function at 0x140138f5c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
lea r8, [rcx + 0x128]
mov rbx, rcx
mov rcx, rdi
mov edx, 0x40f7
call fcn.1401634e4
lea r8, [rbx + 0x1d0]
mov edx, 0x40fa
mov rcx, rdi
call fcn.1401634e4
lea r8, [rbx + 0x278]
mov edx, 0x4082
mov rcx, rdi
call fcn.1401634e4
lea r8, [rbx + 0x320]
mov edx, 0x4082
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14016373c

Function at 0x14013b2d0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, 0x11
mov ebx, edx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov si, ax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov r11w, ax
and r11d, 0x8000
and esi, 0x8000
je 0x14013b31f
cmp ebx, 0x43
je 0x14013b330
cmp ebx, 0x2d
je 0x14013b330
cmp ebx, 0x56
je 0x14013b329
test r11d, r11d
je 0x14013b34c
cmp ebx, 0x2d
jne 0x14013b34c
mov edx, 0x302
jmp 0x14013b335
mov edx, 0x301
mov rcx, qword [rdi + 0x40]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
jmp 0x14013b368
test esi, esi
je 0x14013b355
cmp ebx, 0x58
je 0x14013b35f
test r11d, r11d
je 0x14013b366
cmp ebx, 0x2e
jne 0x14013b366
mov edx, 0x300
jmp 0x14013b335
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140171d44
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
lea r8, [rcx + 0xe8]
mov rbx, rcx
mov rcx, rdi
mov edx, 1
call fcn.1401634e4
lea r8, [rbx + 0x190]
mov edx, 0x4084
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14016373c

Function at 0x14017602c
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov bl, r8b
movzx ebp, dx
mov rdi, rcx
call qword [rax + 0x2a0]
mov ecx, ebp
mov edx, 2
mov esi, eax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test bl, bl
jne 0x140176083
test esi, esi
js 0x140176083
cmp ax, 0x20
je 0x140176075
cmp bp, 0x71
jne 0x140176083
mov rax, qword [rdi]
mov edx, esi
mov rcx, rdi
call qword [rax + 0x2d0]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140185ccc
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.14018f094
nop
cmp dword [0x14025ebb8], 1
je 0x140185c78
mov dword [0x14025ebb4], 1
mov byte [0x14025ebb0], r12b
test ebx, ebx
jne 0x140185c64
mov rcx, qword [0x140261050]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140185c51
mov rcx, qword [0x140261048]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x140185bf0
call fcn.14018beb4
cmp qword [rdi], rax
jne 0x140185bf0
jmp 0x140185bd6
cmp rdi, rsi
jb 0x140185c51
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.14018beb4
mov qword [rdi], rax
call rbx
mov rcx, qword [0x140261050]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x140261048]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x140185c2f
cmp r13, rax
je 0x140185c4f
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x140185bd6
lea rdx, [0x1401bca80]
lea rcx, [0x1401bca68]
call fcn.140185a20
lea rdx, [0x1401bca90]
lea rcx, [0x1401bca88]
call fcn.140185a20
nop
test r12d, r12d
je 0x140185c87
mov ecx, 8
call fcn.14018ef94
test r12d, r12d
jne 0x140185cb2
mov dword [0x14025ebb8], 1
lea ecx, [r12 + 8]
call fcn.14018ef94
mov ecx, r15d
call fcn.1401859b4
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x140185b40

Function at 0x140185cd8
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x140185b40
Function at 0x14018c407
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140253530]
jne 0x140184daa
rol rcx, 0x10
test cx, 0xffff
jne 0x140184da6
repz ret
ror rcx, 0x10
jmp 0x14018c360
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14025f1c0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x14025f2b8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14018c3e5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14025f1c0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14018c407
mov rax, qword [rsp + 0x88]
mov qword [0x14025f2b8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14025f258], rax
mov rax, qword [0x14025f2b8]
mov qword [0x14025f130], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14025f240], rax
mov dword [0x14025f120], 0xc0000409
mov dword [0x14025f124], 1
mov rax, qword [0x140253530]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140253538]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14025f1b8], eax
mov ecx, 1
call fcn.14018f564
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14020cdb0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14025f1b8], 0
jne 0x14018c48e
mov ecx, 1
call fcn.14018f564
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140197264
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.14018beb4
xor ebx, ebx
mov rdi, rax
cmp qword [0x14025fa48], rbx
jne 0x14019736a
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14019743f
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14019743f
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x14020cfe0]
mov rcx, rsi
mov qword [0x14025fa48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x14020cfc8]
mov rcx, rsi
mov qword [0x14025fa50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x14025fa58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x14025fa68], rax
test rax, rax
je 0x140197361
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x14025fa60], rax
jmp 0x140197371
mov rax, qword [0x14025fa60]
jmp 0x140197378
mov rax, qword [0x14025fa60]
mov r11, qword [0x14025fa68]
cmp rax, rdi
je 0x1401973e0
cmp r11, rdi
je 0x1401973e0
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x14025fa68]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x1401973e0
test rax, rax
je 0x1401973e0
call rsi
test rax, rax
je 0x1401973da
lea rcx, [rsp + 0x88]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1401973da
test byte [rsp + 0x38], 1
jne 0x1401973e0
bts ebp, 0x15
jmp 0x14019741e
mov rcx, qword [0x14025fa50]
cmp rcx, rdi
je 0x14019741e
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14019741e
call rax
mov rbx, rax
test rax, rax
je 0x14019741e
mov rcx, qword [0x14025fa58]
cmp rcx, rdi
je 0x14019741e
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14019741e
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14025fa48]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14019743f
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140197441
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14000ade0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140011870
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.140011870
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x14000ae50
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x14002b0a4]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x14000b000
mov rax, qword [0x14002b0a8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14000ae9c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x14000af27
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x14000ae80
mov rcx, r12
call fcn.14000b900
mov rbp, rax
test rax, rax
je 0x14000b05d
mov rax, qword [0x14002b0a8]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.14000ba30
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x14002b0a8]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000b042
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14000af20
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x14000afb0
add dword [0x14002b0a4], 1
cmp ebx, 8
jae 0x14000af58
test bl, 4
jne 0x14000b010
test ebx, ebx
je 0x14000af49
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x14000b030
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x14000af49
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x14000af8a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rdi, qword [0x14002b0a8]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000af20
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.14000ade0
xor edi, edi
jmp 0x14000aea7
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x14000af49
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x14000af49
mov rax, qword [0x14002b0a8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.14000ade0
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.14000ade0
nop
nop dword [rax]
Function at 0x14000b570
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x14002b100]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14002b0e0]
test rbx, rbx
je 0x14000b5c4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x14000b5bb
test r12, r12
je 0x14000b5bb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14000b5a0
lea rcx, [0x14002b100]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x14000b900
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x140023f60]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x14000b979
mov rcx, r10
call fcn.14000b7d0
test eax, eax
je 0x14000b979
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x14000b976
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x14000b96d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x14000b979
add r8, 0x28
cmp r8, r9
jne 0x14000b958
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x14000bc70
Capabilities:
Allocate thread local storage

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [0x14002b0e8]
mov edi, ecx
mov rsi, rdx
test eax, eax
jne 0x14000b600
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov edx, 0x18
mov ecx, 1
call sub.msvcrt.dll_calloc
mov rbx, rax
test rax, rax
je 0x14000b653
mov dword [rax], edi
lea rcx, [0x14002b100]
mov qword [rax + 8], rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x14002b0e0]
lea rcx, [0x14002b100]
mov qword [0x14002b0e0], rbx
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
or eax, 0xffffffff
jmp 0x14000b5f6
push r12
push rbx
sub rsp, 0x28
mov rbx, rcx
mov r12, rdx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, eax
cmp eax, 0xffffffff
je 0x14000bca0
mov rdx, r12
mov dword [rbx], eax
add rsp, 0x28
pop rbx
pop r12
jmp 0x140011ab0
add rsp, 0x28
pop rbx
pop r12
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
test rdx, rdx
jne 0x140011ac0
xor eax, eax
ret
jmp 0x14000b5e0

Function at 0x14000bce0
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
sub rsp, 0x28
mov r12d, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, r12d
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, r13d
mov r12, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, r12
add rsp, 0x28
pop r12
pop r13
ret

Function at 0x14000bd20
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14000bd38
xor eax, eax
add rsp, 0x28
ret
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x140011ae0
Capabilities:
Download url
Receive data

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rdi, rdx
mov r8, rdx
mov rdx, rcx
lea rcx, str.Downloading__s_to__s_n
call fcn.1400132f0
mov ebx, 6
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rdi
mov rdx, rsi
mov ecx, 0
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
je 0x140011b39
sub ebx, 1
jne 0x140011b04
mov eax, 0
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov eax, 1
jmp 0x140011b31
Function at 0x1400126c0
Capabilities:
Read file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
mov eax, 0x100050
call fcn.14000bbb0
sub rsp, rax
mov rsi, rdx
mov rax, qword [rdx]
cmp rax, qword [rdx + 8]
je 0x1400126e7
mov qword [rdx + 8], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r12, rax
lea rdx, [rax - 1]
mov eax, 0
cmp rdx, 0xfffffffffffffffd
ja 0x1400127ed
mov dword [rsp + 0x10004c], 0xffffffff
lea r14, [rsp + 0x10004c]
lea rbp, [rsp + 0x40]
mov r13, qword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x140012772
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0
jmp 0x1400127ed
test edi, edi
je 0x140012772
cmp dword [rsp + 0x10004c], 0
je 0x1400127df
mov qword [rsp + 0x20], 0
mov r9, r14
mov r8d, 0x100000
mov rdx, rbp
mov rcx, r12
call r13
mov edi, eax
mov eax, dword [rsp + 0x10004c]
mov ecx, edi
or ecx, eax
je 0x140012751
test eax, eax
je 0x1400127db
mov ebx, 0
jmp 0x1400127c1
mov eax, ebx
movzx eax, byte [rsp + rax + 0x40]
mov byte [rdx], al
add qword [rsi + 8], 1
add ebx, 1
cmp dword [rsp + 0x10004c], ebx
jbe 0x140012764
mov rdx, qword [rsi + 8]
cmp rdx, qword [rsi + 0x10]
jne 0x1400127a7
mov r8d, ebx
add r8, rbp
mov rcx, rsi
call fcn.14001afb0
jmp 0x1400127b5
test edi, edi
je 0x140012772
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x100050
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret