joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41def0
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.00415760
xor ebx, ebx
cmp qword [0x0043ad10], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x41e021
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x41df53
xor eax, eax
jmp 0x41e101
lea rdx, [0x00429458]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x41df4c
mov rcx, rax
call fcn.004156f0
lea rdx, str.GetActiveWindow
mov rcx, rbp
mov qword [0x0043ad10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.004156f0
lea rdx, [0x00429430]
mov rcx, rbp
mov qword [0x0043ad18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.004156f0
lea rcx, [rsp + 0x30]
mov qword [0x0043ad20], rax
call fcn.00414cf0
test eax, eax
je 0x41dfd7
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.00412ac0
cmp dword [rsp + 0x30], 2
jne 0x41e021
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.004156f0
test rax, rax
mov qword [0x0043ad30], rax
je 0x41e021
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.004156f0
mov qword [0x0043ad28], rax
mov rcx, qword [0x0043ad28]
cmp rcx, rsi
je 0x41e0b3
cmp qword [0x0043ad30], rsi
je 0x41e0b3
call fcn.004157c0
call rax
test rax, rax
mov rbp, rax
je 0x41e07e
mov rcx, qword [0x0043ad30]
call fcn.004157c0
lea rcx, [rsp + 0x38]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x41e07e
test byte [rsp + 0x48], 1
jne 0x41e0b3
lea rcx, [rsp + 0x34]
call fcn.00414d40
test eax, eax
je 0x41e0a0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.00412ac0
cmp dword [rsp + 0x34], 4
jb 0x41e0ad
bts edi, 0x15
jmp 0x41e0e7
bts edi, 0x12
jmp 0x41e0e7
mov rcx, qword [0x0043ad18]
cmp rcx, rsi
je 0x41e0e7
call fcn.004157c0
call rax
test rax, rax
mov rbx, rax
je 0x41e0e7
mov rcx, qword [0x0043ad20]
cmp rcx, rsi
je 0x41e0e7
call fcn.004157c0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x0043ad10]
call fcn.004157c0
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x180014330
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r12
mov eax, reloc.LIBEAY32.dll_Ordinal_32
call fcn.18004b950
sub rsp, rax
mov rax, qword [rcx + 8]
lea r12d, [r9 + 1]
mov rbx, rdx
mov r9, qword [rax + 0xc8]
mov rsi, rcx
test byte [r9 + 0x70], 1
je 0x180014396
mov ecx, dword [rdx + 4]
lea eax, [r12 + r8]
cmp eax, ecx
jbe 0x180014383
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
mov eax, r8d
add qword [rdx + 0x10], rax
add qword [rdx + 0x18], rax
sub ecx, r8d
mov dword [rdx + 4], ecx
jmp 0x18001439c
cmp r12d, dword [rdx + 4]
ja 0x180014370
mov ecx, dword [rdx + 4]
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x30], rbp
add ecx, 0xffffffff
or ebp, 0xffffffff
bt dword [rsi + 0x19c], 9
mov qword [rsp + 0x38], rdi
movzx edi, byte [rcx + rax]
jae 0x18001440e
cmp qword [rsi + 0xe0], 0
jne 0x18001440e
mov rcx, qword [rsi + 0x80]
lea rdx, [0x18006a9c0]
mov r8d, 8
add rcx, 8
call sub.LIBEAY32.dll_Ordinal_3906
test eax, eax
jne 0x1800143fc
test dil, 1
jne 0x1800143fc
mov rax, qword [rsi + 0x80]
or dword [rax], 8
mov rax, qword [rsi + 0x80]
test byte [rax], 8
je 0x18001440e
test edi, edi
je 0x18001440e
add edi, ebp
mov rcx, qword [rsi + 0xd0]
mov rcx, qword [rcx]
call sub.LIBEAY32.dll_Ordinal_3857
bt eax, 0x15
jae 0x180014432
sub ebp, edi
mov eax, 1
add dword [rbx + 4], ebp
jmp 0x1800144f0
mov r10d, dword [rbx + 4]
lea ecx, [rdi + r12]
mov ebp, Ordinal_256
mov r9d, r10d
mov eax, r10d
sub r9d, ecx
xor eax, ecx
xor r9d, ecx
or r9d, eax
lea eax, [r10 - 1]
xor r9d, r10d
shr r9d, 0x1f
sub r9d, 1
cmp eax, ebp
cmovb ebp, eax
xor r11d, r11d
test ebp, ebp
je 0x1800144c0
mov rsi, qword [rbx + 0x10]
mov r8d, edi
shr r8d, 0x1f
nop
nop
nop
movzx eax, r8b
mov ecx, r11d
mov edx, edi
sub edx, r11d
shr ecx, 0x1f
shr edx, 0x1f
xor al, cl
xor dl, cl
or dl, al
mov eax, r10d
xor dl, r8b
sub eax, r11d
add r11d, 1
sub dl, 1
sub eax, 1
movzx ecx, byte [rax + rsi]
movzx edx, dl
xor ecx, edi
and edx, ecx
not edx
and r9d, edx
cmp r11d, ebp
jb 0x180014480
not r9d
movzx eax, r9b
lea ecx, [rax - 1]
not eax
shr eax, 0x1f
shr ecx, 0x1f
and ecx, eax
lea eax, [rdi + 1]
neg ecx
and eax, ecx
sub r10d, eax
shl eax, 8
or dword [rbx], eax
mov eax, ecx
not ecx
and eax, 1
mov dword [rbx + 4], r10d
or eax, ecx
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x18001df90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
mov eax, reloc.LIBEAY32.dll_Ordinal_168
call fcn.18004b950
sub rsp, rax
mov esi, ecx
xor ebp, ebp
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x80]
xor ecx, ecx
mov edi, ebp
mov ebx, ebp
call fcn.180031870
test eax, eax
je 0x18001e21b
nop
nop
nop
mov eax, dword [rsp + 0x80]
shl eax, 0xa
test esi, eax
je 0x18001dff1
add edi, 1
add ebx, 1
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x80]
mov ecx, ebx
call fcn.180031870
test eax, eax
jne 0x18001dfe0
test edi, edi
je 0x18001e21b
mov ecx, dword [rsp + reloc.LIBEAY32.dll_Ordinal_304]
mov rbx, qword [rsp + 0x128]
mov qword [rsp + 0xd0], r12
mov eax, ecx
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0x98], r14
mov r14, qword [rsp + 0x138]
cdq
mov qword [rsp + 0x90], r15
idiv edi
cmp edi, 1
movsxd rdi, dword [rsp + 0x148]
cmove ecx, ebp
mov r8, rdi
xor edx, edx
mov dword [rsp + reloc.LIBEAY32.dll_Ordinal_304], ecx
mov rcx, r14
movsxd r13, eax
call fcn.18003d110
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x80]
xor ecx, ecx
call fcn.180031870
test eax, eax
je 0x18001e1c4
mov r12, qword [rsp + 0x140]
mov r15d, dword [rsp + 0x120]
nop
nop
nop
mov eax, dword [rsp + 0x80]
shl eax, 0xa
test esi, eax
je 0x18001e1a2
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x18001e1f5
mov eax, dword [rsp + 0x148]
mov r8d, dword [rsp + reloc.LIBEAY32.dll_Ordinal_304]
mov r9, qword [rsp + 0xd8]
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + reloc.LIBEAY32.dll_Ordinal_280]
mov qword [rsp + 0x68], r12
mov dword [rsp + 0x60], r15d
mov qword [rsp + 0x58], rax
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + reloc.LIBEAY32.dll_Ordinal_264]
and r8d, 1
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + reloc.LIBEAY32.dll_Ordinal_256]
add r8d, r13d
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0xf8]
mov rdx, rbx
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xf0]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0x20], eax
call fcn.18001db70
test eax, eax
je 0x18001e217
add rbx, r13
test rdi, rdi
jle 0x18001e1a2
mov r8, r12
mov rcx, r14
mov rdx, rdi
sub r8, r14
nop
nop
nop
nop
movzx eax, byte [r8 + rcx]
add rcx, 1
xor byte [rcx - 1], al
sub rdx, 1
jne 0x18001e190
add ebp, 1
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x80]
mov ecx, ebp
call fcn.180031870
test eax, eax
jne 0x18001e0b0
mov eax, 1
mov r14, qword [rsp + 0x98]
mov r13, qword [rsp + 0xa0]
mov r12, qword [rsp + 0xd0]
mov r15, qword [rsp + 0x90]
add rsp, 0xa8
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov edx, Ordinal_285
lea r9, [0x18005ef68]
mov ecx, 0x14
lea r8d, [rdx + 0x2a]
mov dword [rsp + 0x20], reloc.LIBEAY32.dll_Ordinal_276
call sub.LIBEAY32.dll_Ordinal_252
xor eax, eax
jmp 0x18001e1c9
mov ecx, 0x14
lea r9, [0x18005ef58]
mov edx, Ordinal_285
lea r8d, [rcx + 0x30]
mov dword [rsp + 0x20], Ordinal_267
call sub.LIBEAY32.dll_Ordinal_252
mov eax, ebp
add rsp, 0xa8
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180027ba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push r13
push r14
push r15
mov eax, Ordinal_58
call fcn.18004b950
sub rsp, rax
cmp r8d, 3
mov rbx, r9
mov r14d, r8d
mov r13, rdx
mov r15, rcx
jge 0x180027c02
mov edx, Ordinal_314
lea r9, [0x18005fab0]
lea ecx, [rax - 0x24]
lea r8d, [rdx + 0x2b]
mov dword [rsp + 0x20], reloc.LIBEAY32.dll_Ordinal_293
call sub.LIBEAY32.dll_Ordinal_252
mov dword [rbx], Ordinal_53
mov eax, 1
add rsp, 0x38
pop r15
pop r14
pop r13
pop rbx
ret
movzx eax, byte [rdx + 1]
mov qword [rsp + 0x60], rbp
movzx ebp, byte [rdx]
shl ebp, 8
add r13, 2
sub r14d, 2
or ebp, eax
mov eax, ebp
cdq
and eax, 1
xor eax, edx
cmp eax, edx
je 0x180027c49
mov edx, Ordinal_314
mov dword [rsp + 0x20], 0x131
lea r9, [0x18005fac0]
lea r8d, [rdx + 0x2b]
mov ecx, 0x14
jmp 0x180027d53
lea eax, [rbp + 1]
cmp r14d, eax
jge 0x180027c73
mov edx, Ordinal_314
mov dword [rsp + 0x20], reloc.LIBEAY32.dll_Ordinal_313
lea r9, [0x18005fad0]
lea r8d, [rdx + 0x2b]
mov ecx, 0x14
jmp 0x180027d53
test rcx, rcx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x30], r12
je 0x180027ca6
mov r12, qword [rcx + reloc.LIBEAY32.dll_Ordinal_624]
test r12, r12
jne 0x180027ca9
mov rax, qword [rcx + reloc.LIBEAY32.dll_Ordinal_368]
test rax, rax
je 0x180027ca6
mov r12, qword [rax + 0x2c0]
test r12, r12
jne 0x180027ca9
xor r12d, r12d
mov qword [rcx + 0x278], 0
mov rcx, r12
call sub.LIBEAY32.dll_Ordinal_1654
test ebp, ebp
mov edi, eax
je 0x180027d1f
mov qword [rsp + 0x68], rsi
nop
nop
nop
movzx esi, byte [r13]
movzx ecx, byte [r13 + 1]
add r13, 2
shl esi, 8
sub ebp, 2
sub r14d, 2
or esi, ecx
xor ebx, ebx
test edi, edi
jle 0x180027d11
mov edx, ebx
mov rcx, r12
call sub.LIBEAY32.dll_Ordinal_1653
cmp dword [rax + 8], esi
je 0x180027d08
add ebx, 1
cmp ebx, edi
jl 0x180027cf0
jmp 0x180027d11
mov qword [r15 + 0x278], rax
mov edi, ebx
test ebp, ebp
jne 0x180027cd0
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x68]
movzx eax, byte [r13]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x70]
lea ecx, [r14 - 1]
cmp eax, ecx
je 0x180027d74
mov edx, Ordinal_314
mov dword [rsp + 0x20], Ordinal_359
lea r9, [0x18005fae0]
lea r8d, [rdx + 0x2a]
mov ecx, 0x14
call sub.LIBEAY32.dll_Ordinal_252
mov rbp, qword [rsp + 0x60]
mov dword [rbx], Ordinal_53
mov eax, 1
add rsp, 0x38
pop r15
pop r14
pop r13
pop rbx
ret
xor eax, eax
mov rbp, qword [rsp + 0x60]
add rsp, 0x38
pop r15
pop r14
pop r13
pop rbx
ret
Function at 0x18003df70
Capabilities:
Accept command line arguments

Disassembly:
push rbx
sub rsp, 0x20
cmp edx, 1
mov rbx, r8
jne 0x18003e0d7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, Ordinal_150
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x18003dfc8
mov rcx, rax
mov dword [rax], Ordinal_150
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x18003dfd0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 0x30], rbp
mov ebp, dword [rbx + 8]
mov qword [rsp + 0x38], rsi
mov esi, dword [rbx + 4]
mov qword [rsp + 0x40], rdi
mov edi, dword [rbx + 0xc]
mov qword [rsp + 0x48], r12
mov r12d, dword [rbx + 0x10]
and edi, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r12d, 2
je 0x18003e015
bts edi, 0xf
mov eax, esi
mov ecx, 1
mov dword [0x18006b054], r12d
shl eax, 8
mov dword [0x18006b060], esi
mov dword [0x18006b064], ebp
add eax, ebp
mov dword [0x18006b058], edi
mov dword [0x18006b05c], eax
call fcn.180043db0
mov r12, qword [rsp + 0x48]
test eax, eax
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
je 0x18003dfc8
call fcn.180042530
test eax, eax
je 0x18003e0ca
call fcn.1800444b0
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [0x18006bb08], rax
call fcn.1800442e0
mov qword [0x18006aaa8], rax
call fcn.180040ba0
test eax, eax
js 0x18003e0c5
call fcn.1800441d0
test eax, eax
js 0x18003e0c0
call fcn.180043e40
test eax, eax
js 0x18003e0c0
xor ecx, ecx
call fcn.1800415b0
test eax, eax
jne 0x18003e0c0
add dword [0x18006aaa0], 1
mov eax, 1
add rsp, 0x20
pop rbx
ret
call fcn.180040ee0
call fcn.180042050
call fcn.180043e10
xor eax, eax
add rsp, 0x20
pop rbx
ret
test edx, edx
jne 0x18003e120
mov eax, dword [0x18006aaa0]
test eax, eax
jle 0x18003dfc8
sub eax, 1
cmp dword [0x18006b0b0], edx
mov dword [0x18006aaa0], eax
jne 0x18003e0ff
call fcn.1800417d0
test rbx, rbx
jne 0x18003e199
call fcn.180040ee0
call fcn.180042050
call fcn.180043e10
lea eax, [rbx + 1]
add rsp, 0x20
pop rbx
ret
cmp edx, 2
jne 0x18003e18d
call sym.SSLEAY32.dll_SSLv2_client_method
mov edx, 0x2d8
mov ecx, 1
call fcn.1800411e0
test rax, rax
mov rbx, rax
je 0x18003dfc8
mov ecx, dword [0x180069a60]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
test eax, eax
je 0x18003e17d
xor edx, edx
mov rcx, rbx
call fcn.1800420a0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov qword [rbx + 8], 0xffffffffffffffff
mov dword [rbx], eax
mov eax, 1
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
call fcn.180041300
xor eax, eax
add rsp, 0x20
pop rbx
ret
cmp edx, 3
jne 0x18003e199
xor ecx, ecx
call fcn.1800424d0
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x18003e3d7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x180069200]
jne 0x18003d0fa
rol rcx, 0x10
test cx, 0xffff
jne 0x18003d0f6
repz ret
ror rcx, 0x10
jmp 0x18003e330
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18006ab60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x18006ac58]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18003e3b5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18006ab60]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18003e3d7
mov rax, qword [rsp + 0x88]
mov qword [0x18006ac58], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18006abf8], rax
mov rax, qword [0x18006ac58]
mov qword [0x18006aad0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18006abe0], rax
mov dword [0x18006aac0], 0xc0000409
mov dword [0x18006aac4], 1
mov rax, qword [0x180069200]
mov qword [rsp + 0x68], rax
mov rax, qword [0x180069208]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18006ab58], eax
mov ecx, 1
call fcn.180044810
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x18004fd00]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18006ab58], 0
jne 0x18003e45e
mov ecx, 1
call fcn.180044810
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x180041060
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x5b0
mov rbp, rcx
mov rcx, qword [0x18006b040]
mov ebx, r9d
mov rdi, r8
mov rsi, rdx
call fcn.180041f70
test rax, rax
je 0x1800410b4
mov r10, qword [rsp + 0x5e0]
mov r9d, ebx
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], r10
call rax
jmp 0x180041149
mov ecx, 2
call fcn.180044810
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x98
call fcn.18003d110
mov rax, qword [rsp + 0x5b8]
mov dword [rsp + 0x40], 0xc000000d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x180041135
test ebx, ebx
jne 0x180041135
lea ecx, [rax + 2]
call fcn.180044810
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc000000d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180042930
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
sub rsp, 0x30
lea r12, [0x180069a70]
xor esi, esi
mov edi, ecx
mov rax, r12
mov ebx, esi
nop
cmp ecx, dword [rax]
je 0x18004296e
add ebx, 1
add rax, 0x10
cmp ebx, 0x17
jb 0x180042950
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
cmp ebx, 0x17
jae 0x180042b55
mov ecx, 3
call fcn.180046ea0
cmp eax, 1
je 0x180042b0c
mov ecx, 3
call fcn.180046ea0
test eax, eax
jne 0x1800429a5
cmp dword [0x18006aab8], 1
je 0x180042b0c
cmp edi, 0xfc
je 0x180042b55
mov qword [rsp + 0x50], rbp
lea rbp, [0x18006b320]
lea r8, str.Runtime_Error__n_nProgram:
mov rcx, rbp
mov edx, 0x314
call fcn.180044c80
test eax, eax
je 0x1800429e9
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.180040fc0
lea rdx, [0x18006b339]
mov r8d, Ordinal_264
xor ecx, ecx
mov byte [0x18006b43d], sil
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x180042a39
lea r8, str._program_name_unknown_
lea rcx, [0x18006b339]
mov edx, reloc.LIBEAY32.dll_Ordinal_763
call fcn.180044c80
test eax, eax
je 0x180042a39
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.180040fc0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x18006b339]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 0x3c
jbe 0x180042a88
lea rcx, [rcx + rbp - 0x23]
lea rdx, [0x18006b634]
lea r9d, [rax + 3]
lea r8, [0x1800503a4]
sub rdx, rcx
call fcn.180046d80
test eax, eax
je 0x180042a88
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.180040fc0
lea r8, [0x1800503a0]
mov edx, 0x314
mov rcx, rbp
call fcn.180046cc0
test eax, eax
je 0x180042ab4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.180040fc0
movsxd r8, ebx
mov edx, 0x314
mov rcx, rbp
add r8, r8
mov r8, qword [r12 + r8*8 + 8]
call fcn.180046cc0
test eax, eax
je 0x180042ae4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.180040fc0
lea rdx, str.Microsoft_Visual_C_Runtime_Library
mov r8d, 0x12010
mov rcx, rbp
call fcn.180046a60
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x180042b55
cmp rax, 0xffffffffffffffff
je 0x180042b55
xor eax, eax
movsxd rcx, ebx
lea r9, [rsp + 0x58]
add rcx, rcx
mov qword [rsp + 0x20], rsi
mov rdx, qword [r12 + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x180042b70
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov ecx, 3
call fcn.180046ea0
cmp eax, 1
je 0x180042ba2
mov ecx, 3
call fcn.180046ea0
test eax, eax
jne 0x180042c56
cmp dword [0x18006aab8], 1
jne 0x180042c56
mov qword [rsp + 0x48], rbx
lea rbx, [0x180069a70]
mov qword [rsp + 0x30], rdi
mov rax, rbx
xor edi, edi
cmp dword [rax], 0xfc
je 0x180042bce
add edi, 1
add rax, 0x10
cmp edi, 0x17
jb 0x180042bb8
jmp 0x180042c42
cmp edi, 0x17
jae 0x180042c42
mov ecx, 3
call fcn.180046ea0
cmp eax, 1
je 0x180042bf9
mov ecx, 3
call fcn.180046ea0
test eax, eax
jne 0x180042c42
cmp dword [0x18006aab8], 1
jne 0x180042c42
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x180042c42
cmp rax, 0xffffffffffffffff
je 0x180042c42
movsxd rcx, edi
xor eax, eax
lea r9, [rsp + 0x40]
add rcx, rcx
mov qword [rsp + 0x20], rax
mov rdx, qword [rbx + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, Ordinal_256
call fcn.180042930
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret
Function at 0x1800442e0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [0x18006b798]
test eax, eax
jne 0x180044333
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x180044313
mov dword [0x18006b798], 1
jmp 0x18004434e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x18004432d
mov dword [0x18006b798], 2
jmp 0x180044429
mov eax, dword [0x18006b798]
cmp eax, 1
jne 0x180044420
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x180044473
cmp word [rdi], 0
mov qword [rsp + 0x50], rbp
mov rbx, rdi
mov qword [rsp + 0x58], r12
je 0x180044375
add rbx, 2
cmp word [rbx], 0
jne 0x180044361
add rbx, 2
cmp word [rbx], 0
jne 0x180044361
xor r12d, r12d
sub rbx, rdi
mov r8, rdi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
sar rbx, 1
lea r9d, [rbx + 1]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
movsxd rbp, eax
je 0x180044413
mov rcx, rbp
call fcn.180041170
test rax, rax
mov rsi, rax
je 0x180044413
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea r9d, [rbx + 1]
mov r8, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x1800443ed
mov rcx, rsi
call fcn.180041300
mov rsi, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbp, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1800443f9
cmp eax, 2
je 0x180044429
test eax, eax
jne 0x180044473
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
test rax, rax
mov rbx, rax
je 0x180044473
cmp byte [rax], 0
je 0x180044452
nop
add rax, 1
cmp byte [rax], 0
jne 0x180044440
add rax, 1
cmp byte [rax], 0
jne 0x180044440
sub eax, ebx
add eax, 1
movsxd rsi, eax
mov rcx, rsi
call fcn.180041170
test rax, rax
mov rdi, rax
jne 0x180044485
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.18003cac0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rax, rdi
add rsp, 0x40
pop rdi
ret