joyce8/EMBER2024-capa huggingface dataset:
Function at 0x577f40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x57814b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rcx
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x578064
cmp rdx, 0x40
ja 0x57813d
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
cmp rbx, rdx
je 0x577fd4
mov rax, rdx
mov rcx, rsi
call sym.runtime.memmove
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop
cmp rdx, 0x40
jne 0x578040
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call sym.crypto_md5.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x00cca828]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
nop dword [rax]
cmp rcx, rsi
jb 0x578135
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rcx
sub r8, rsi
add rbx, rdx
jmp 0x578067
mov r8, rcx
cmp r8, 0x40
jl 0x5780e5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdi
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call sym.crypto_md5.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x00cca828]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test r8, r8
je 0x578128
lea rdx, [rax + 0x10]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
nop dword [rax + rax]
cmp rbx, rdx
je 0x578124
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call sym.runtime.memmove
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
call sym.runtime.panicSliceB
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicSliceB
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp sym.crypto_md5._digest_.Write
Function at 0x58eca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58ed9e
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rsi
nop dword [rax]
test r8, r8
je 0x58ed22
cmp rdi, r8
jb 0x58ed92
cmp rbx, rsi
je 0x58ed05
mov rdx, rbx
lea rdi, [rsi + r8]
lea rdi, [rdi - 1]
nop
nop
cmp rdi, rbx
jb 0x58ed02
mov rdi, rsi
lea r9, [rdx + r8]
lea r9, [r9 - 1]
cmp r9, rsi
jae 0x58ed7f
mov rbx, rdx
mov rsi, rdi
nop
jmp 0x58ed05
mov rbx, rdx
lea rdx, [r8 - 1]
cmp rcx, rdx
jbe 0x58ed77
movzx ecx, byte [rax + 0x400]
movzx edx, byte [rax + 0x401]
xor edi, edi
nop
jmp 0x58ed60
add rsp, 0x10
pop rbp
ret
movzx r9d, byte [rsi + rdi]
inc ecx
movzx r10d, cl
mov r11d, dword [rax + r10*4]
add edx, r11d
movzx r12d, dl
mov r13d, dword [rax + r12*4]
mov dword [rax + r10*4], r13d
mov dword [rax + r12*4], r11d
lea r10d, [r11 + r13]
movzx r10d, r10b
xor r9d, dword [rax + r10*4]
mov byte [rbx + rdi], r9b
inc rdi
nop dword [rax]
cmp r8, rdi
jg 0x58ed28
mov byte [rax + 0x400], cl
mov byte [rax + 0x401], dl
add rsp, 0x10
pop rbp
ret
mov rax, rdx
call sym.runtime.panicIndex
lea rax, [0x0064a8c0]
lea rbx, [0x00aa9830]
call sym.runtime.gopanic
mov rcx, r8
mov rdx, rdi
call sym.runtime.panicSliceAcap
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp sym.crypto_rc4._Cipher_.XORKeyStream
Function at 0x591a60
Capabilities:
Encode data using xor

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov r15, qword [rsp + 0x18]
mov r8, qword [rdi]
mov r9, qword [rdi + 8]
mov r10, qword [rdi + 0x10]
mov r11, qword [rdi + 0x18]
mov r12, qword [rdi + 0x20]
cmp r15, 0x10
jb 0x591b27
add r8, qword [rsi]
adc r9, qword [rsi + 8]
adc r10, 1
lea rsi, [rsi + 0x10]
mov rax, r11
mul r8
mov rbx, rax
mov rcx, rdx
mov rax, r11
mul r9
add rcx, rax
adc rdx, 0
mov r13, r11
imul r13, r10
add r13, rdx
mov rax, r12
mul r8
add rcx, rax
adc rdx, 0
mov r8, rdx
mov r14, r12
imul r14, r10
mov rax, r12
mul r9
add r13, rax
adc r14, rdx
add r13, r8
adc r14, 0
mov r8, rbx
mov r9, rcx
mov r10, r13
and r10, 3
mov rbx, r13
and rbx, 0xfffffffffffffffc
add r8, rbx
adc r9, r14
adc r10, 0
shrd r13, r14, 2
shr r14, 2
add r8, r13
adc r9, r14
adc r10, 0
sub r15, 0x10
cmp r15, 0x10
jae 0x591a8c
test r15, r15
je 0x591b6a
mov rbx, 1
xor rcx, rcx
xor r13, r13
add rsi, r15
shld rcx, rbx, 8
shl rbx, 8
mov r13b, byte [rsi - 1]
xor rbx, r13
dec rsi
dec r15
jne 0x591b3c
add r8, rbx
adc r9, rcx
adc r10, 0
mov r15, 0x10
jmp 0x591a9b
mov qword [rdi], r8
mov qword [rdi + 8], r9
mov qword [rdi + 0x10], r10
ret
Function at 0x593060
Capabilities:
Encode data using xor

Disassembly:
xor r10, r10
xor r11, r11
xor r12, r12
cmp r9, 0xd
jne 0x593107
mov r10, qword [rcx]
mov r11, qword [rcx + 5]
shr r11, 0x18
mov r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
cmp r9, 0x10
jb 0x5931aa
add r10, qword [rcx]
adc r11, qword [rcx + 8]
adc r12, 1
lea rcx, [rcx + 0x10]
sub r9, 0x10
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
jmp 0x593107
cmp r9, 0
je 0x593263
xor r13, r13
xor r14, r14
xor r15, r15
add rcx, r9
shld r14, r13, 8
shl r13, 8
mov r15b, byte [rcx - 1]
xor r13, r15
dec rcx
dec r9
jne 0x5931c0
add r10, r13
adc r11, r14
adc r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
Function at 0x1400192f0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140022ab0], rbx
je 0x140019357
cmp rax, rbx
jne 0x14001934a
mov ebx, 1
mov esi, ebx
jmp 0x14001935c
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14001932f
mov ebx, 1
mov eax, dword [0x140022ab8]
cmp eax, ebx
jne 0x140019374
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x1400193e0
mov eax, dword [0x140022ab8]
test eax, eax
jne 0x1400193d5
mov dword [0x140022ab8], ebx
lea r15, [0x14001b730]
lea rdi, [0x14001b718]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x1400193c7
test eax, eax
jne 0x1400193cb
cmp qword [rdi], r14
je 0x1400193bc
mov rax, qword [rdi]
mov rcx, qword [0x14001b6d8]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14001939e
test eax, eax
je 0x1400193db
mov eax, 0xff
jmp 0x140019536
mov dword [0x140022490], ebx
mov edi, 0x1f
mov eax, dword [0x140022ab8]
cmp eax, ebx
jne 0x140019407
lea rdx, [0x14001b710]
lea rcx, [0x14001b6e0]
call sub.msvcrt.dll__initterm
mov dword [0x140022ab8], 2
test esi, esi
jne 0x140019415
mov rax, r14
xchg qword [0x140022ab0], rax
cmp qword [0x140022ad0], r14
je 0x140019448
lea rcx, [0x140022ad0]
call fcn.140019950
test eax, eax
je 0x140019448
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140022ad0]
mov r9, qword [0x14001b6d8]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x140019461
mov eax, 0xff
jmp 0x140019536
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x1400194e7
test ax, ax
je 0x14001947c
test edx, edx
jne 0x1400194e7
sub ax, bx
cmp ax, di
ja 0x140019492
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14001947c
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.14001023c
mov dword [0x14002248c], eax
cmp dword [0x1400224b0], r14d
jne 0x1400194d0
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140022490], r14d
jne 0x1400194e5
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14002248c]
jmp 0x140019536
cmp ax, 0x22
jne 0x1400194fb
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14001946a
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.140157000
add rsp, 0x28
jmp 0x1400192f0
Function at 0x140004e03
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140010008]
jne 0x1400046ca
rol rcx, 0x10
test cx, 0xffff
jne 0x1400046c6
repz ret
ror rcx, 0x10
jmp 0x140004d5c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400111e0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1400112d8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140004de1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400111e0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140004e03
mov rax, qword [rsp + 0x88]
mov qword [0x1400112d8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140011278], rax
mov rax, qword [0x1400112d8]
mov qword [0x140011150], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140011260], rax
mov dword [0x140011140], 0xc0000409
mov dword [0x140011144], 1
mov rax, qword [0x140010008]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140010010]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14000c3c8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x1400051bc
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x530
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x140005227
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
jmp 0x140005247
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x530
pop rbx
ret
Function at 0x140005670
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov dword [rax + 0x18], r8d
push r12
sub rsp, 0x30
mov edi, r8d
mov ebx, edx
mov r12d, ecx
mov ecx, 8
call fcn.140007a9c
nop
cmp dword [0x14001171c], 1
je 0x140005723
mov dword [0x140011718], 1
mov byte [0x1400116d4], dil
test ebx, ebx
jne 0x14000570f
mov rcx, qword [0x1400122d0]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov rcx, qword [0x1400122c8]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov qword [rsp + 0x20], rax
test rsi, rsi
je 0x1400056fc
sub rbx, 8
mov qword [rsp + 0x20], rbx
cmp rbx, rsi
jb 0x1400056fc
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400056fa
call rcx
jmp 0x1400056e2
lea rdx, [0x14000c388]
lea rcx, [0x14000c380]
call fcn.1400054f4
lea rdx, [0x14000c398]
lea rcx, [0x14000c390]
call fcn.1400054f4
nop
test edi, edi
je 0x140005731
mov ecx, 8
call fcn.140007978
test edi, edi
jne 0x140005759
mov dword [0x14001171c], 1
lea ecx, [rdi + 8]
call fcn.140007978
mov ecx, r12d
call fcn.1400054a0
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
xor r8d, r8d
xor edx, edx
jmp 0x140005670

Function at 0x140005790
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov dword [rax + 0x18], r8d
push r12
sub rsp, 0x30
mov edi, r8d
mov ebx, edx
mov r12d, ecx
mov ecx, 8
call fcn.140007a9c
nop
cmp dword [0x14001171c], 1
je 0x140005723
mov dword [0x140011718], 1
mov byte [0x1400116d4], dil
test ebx, ebx
jne 0x14000570f
mov rcx, qword [0x1400122d0]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov rcx, qword [0x1400122c8]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov qword [rsp + 0x20], rax
test rsi, rsi
je 0x1400056fc
sub rbx, 8
mov qword [rsp + 0x20], rbx
cmp rbx, rsi
jb 0x1400056fc
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400056fa
call rcx
jmp 0x1400056e2
lea rdx, [0x14000c388]
lea rcx, [0x14000c380]
call fcn.1400054f4
lea rdx, [0x14000c398]
lea rcx, [0x14000c390]
call fcn.1400054f4
nop
test edi, edi
je 0x140005731
mov ecx, 8
call fcn.140007978
test edi, edi
jne 0x140005759
mov dword [0x14001171c], 1
lea ecx, [rdi + 8]
call fcn.140007978
mov ecx, r12d
call fcn.1400054a0
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
xor r8d, r8d
xor edx, edx
jmp 0x140005670

Function at 0x14000579c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x140005670
Function at 0x140005820
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r13
sub rsp, 0x30
lea r13, [0x1400101a0]
mov ebx, ecx
xor edi, edi
mov rax, r13
cmp ecx, dword [rax]
je 0x140005853
add edi, 1
add rax, 0x10
cmp edi, 0x17
jb 0x140005843
cmp edi, 0x17
jae 0x140005a01
mov ebp, 3
mov ecx, ebp
call fcn.140008434
cmp eax, 1
je 0x1400059b9
mov ecx, ebp
call fcn.140008434
test eax, eax
jne 0x140005889
cmp dword [section..data], 1
je 0x1400059b9
cmp ebx, 0xfc
je 0x140005a01
lea rbx, [0x140011720]
mov ebp, 0x314
lea r8, str.Runtime_Error__n_nProgram:
mov rcx, rbx
mov rdx, rbp
call fcn.140007c98
test eax, eax
je 0x1400058cc
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400051bc
lea rdx, [0x140011739]
mov r8d, 0x104
xor ecx, ecx
mov byte [0x14001183d], 0
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x14000591d
lea r8, str._program_name_unknown_
lea rcx, [0x140011739]
mov edx, 0x2fb
call fcn.140007c98
test eax, eax
je 0x14000591d
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400051bc
lea r8, [0x140011739]
mov rdx, rbp
mov rcx, rbx
call fcn.1400083a8
test eax, eax
je 0x140005948
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400051bc
lea r8, [0x14000c9e0]
mov rdx, rbp
mov rcx, rbx
call fcn.1400083a8
test eax, eax
je 0x140005973
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400051bc
movsxd r8, edi
mov rdx, rbp
mov rcx, rbx
add r8, r8
mov r8, qword [r13 + r8*8 + 8]
call fcn.1400083a8
test eax, eax
je 0x1400059a2
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400051bc
lea rdx, str.Microsoft_Visual_C_Runtime_Library
mov r8d, 0x12010
mov rcx, rbx
call fcn.140008178
jmp 0x140005a01
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x140005a01
or rcx, 0xffffffffffffffff
cmp rax, rcx
je 0x140005a01
movsxd rdx, edi
xor eax, eax
lea r9, [rsp + 0x48]
and qword [rsp + 0x20], rax
add rdx, rdx
mov rdx, qword [r13 + rdx*8 + 8]
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r13
ret
Function at 0x140006108
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebx, ebx
cmp rax, rbx
mov rdi, rax
jne 0x140006130
xor eax, eax
jmp 0x14000617c
cmp word [rdi], bx
je 0x140006147
add rax, 2
cmp word [rax], bx
jne 0x140006135
add rax, 2
cmp word [rax], bx
jne 0x140006135
sub eax, edi
add eax, 2
movsxd rbp, eax
mov rcx, rbp
call fcn.1400052e0
cmp rax, rbx
mov rsi, rax
je 0x140006170
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call fcn.140008610
mov rbx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400068ac
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x1400068f6
cmp rcx, 0xffffffffffffffff
je 0x1400068f6
cmp word [rcx], 0x5a4d
jne 0x1400068ee
cmp dword [rcx + 0x3c], edx
jl 0x1400068ee
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1400068ee
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1400068f6
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140008178
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov ebx, r8d
mov r12, rdx
mov r13, rcx
call fcn.140006468
xor ebp, ebp
and dword [rsp + 0x88], ebp
and dword [rsp + 0x30], ebp
cmp qword [0x140011f88], rbp
mov rdi, rax
jne 0x1400082ab
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov rsi, rax
jne 0x1400081d7
xor eax, eax
jmp 0x14000838b
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400081d0
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140011f88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140011f90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rcx, [rsp + 0x88]
mov qword [0x140011f98], rax
call fcn.140005528
test eax, eax
je 0x14000825e
and qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400051bc
cmp dword [rsp + 0x88], 2
jne 0x1400082ab
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
test rax, rax
mov qword [0x140011fa8], rax
je 0x1400082ab
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x140011fa0], rax
mov rcx, qword [0x140011fa0]
cmp rcx, rdi
je 0x14000833d
cmp qword [0x140011fa8], rdi
je 0x14000833d
call sub.KERNEL32.dll_DecodePointer
call rax
test rax, rax
mov rsi, rax
je 0x140008308
mov rcx, qword [0x140011fa8]
call sub.KERNEL32.dll_DecodePointer
lea rcx, [rsp + 0x34]
mov r9d, 0xc
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x38]
mov rcx, rsi
call rax
test eax, eax
je 0x140008308
test byte [rsp + 0x40], 1
jne 0x14000833d
lea rcx, [rsp + 0x30]
call fcn.14000556c
test eax, eax
je 0x14000832a
and qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400051bc
cmp dword [rsp + 0x30], 4
jb 0x140008337
bts ebx, 0x15
jmp 0x140008371
bts ebx, 0x12
jmp 0x140008371
mov rcx, qword [0x140011f90]
cmp rcx, rdi
je 0x140008371
call sub.KERNEL32.dll_DecodePointer
call rax
test rax, rax
mov rbp, rax
je 0x140008371
mov rcx, qword [0x140011f98]
cmp rcx, rdi
je 0x140008371
call sub.KERNEL32.dll_DecodePointer
mov rcx, rbp
call rax
mov rbp, rax
mov rcx, qword [0x140011f88]
call sub.KERNEL32.dll_DecodePointer
mov r9d, ebx
mov r8, r12
mov rdx, r13
mov rcx, rbp
call rax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x140009754
Capabilities:
Get system information on windows

Disassembly:
push rbp
push r12
push r13
sub rsp, 0x90
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], rsi
mov qword [rbp + 0xa0], rdi
mov rax, qword [0x140010008]
xor rax, rbp
mov qword [rbp + 0x68], rax
mov eax, dword [rsp]
sub rsp, 0x10
lea r12, [rsp + 0x20]
mov eax, dword [r12]
lea rdx, [rbp + 8]
mov r8d, 0x30
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000985a
mov r13, qword [rbp + 0x10]
lea rcx, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rbp + 0x3c]
lea rcx, [rbp]
xor ebx, ebx
and dword [rbp], ebx
call qword [sym.imp.KERNEL32.dll_SetThreadStackGuarantee]
cmp eax, 1
jne 0x1400097e2
mov eax, dword [rbp]
test eax, eax
cmovne ebx, eax
lea edx, [rdi - 1]
lea ecx, [rdx + rbx]
cmp ecx, ebx
jb 0x14000985a
mov eax, edx
not eax
and ecx, eax
je 0x1400097fd
lea eax, [rcx + rdi]
cmp eax, ecx
jb 0x14000985a
mov ecx, eax
lea eax, [rdi + rdi*2]
mov ebx, edx
cmp ecx, eax
not rbx
cmovb ecx, eax
and rbx, r12
lea rax, [r13 + rdi]
mov esi, ecx
sub rbx, rsi
cmp rbx, rax
jb 0x14000985a
mov r9d, 4
mov r8d, 0x1000
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x14000985a
lea r9, [rbp + 4]
mov r8d, 0x104
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14000985a
mov eax, 1
jmp 0x14000985c
xor eax, eax
mov rcx, qword [rbp + 0x68]
xor rcx, rbp
call fcn.1400046b0
mov rbx, qword [rbp + 0x90]
mov rsi, qword [rbp + 0x98]
mov rdi, qword [rbp + 0xa0]
lea rsp, [rbp + 0x70]
pop r13
pop r12
pop rbp
ret