joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003470
Capabilities:
Delete file
Query environment variable

Disassembly:
push rsi
sub rsp, 0x50
mov rax, qword [0x140034030]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rcx, str.MOZ_CRASHREPORTER_NO_DELETE_DUMP
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14000349f
cmp byte [rax], 0
jne 0x14000360c
cmp qword [0x140034290], 0
je 0x14000351a
lea rdx, [0x140034280]
lea rsi, [rsp + 0x28]
mov rcx, rsi
call fcn.140002a90
cmp qword [rsi + 0x18], 8
jb 0x1400034c9
mov rsi, qword [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rax, qword [rsp + 0x40]
cmp rax, 8
jb 0x14000351a
mov rcx, qword [rsp + 0x28]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140003515
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140003620
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001bac4
cmp qword [0x1400342b0], 0
je 0x140003595
lea rdx, [0x1400342a0]
lea rsi, [rsp + 0x28]
mov rcx, rsi
call fcn.140002a90
cmp qword [rsi + 0x18], 8
jb 0x140003544
mov rsi, qword [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rax, qword [rsp + 0x40]
cmp rax, 8
jb 0x140003595
mov rcx, qword [rsp + 0x28]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140003590
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140003620
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001bac4
cmp qword [0x1400342d0], 0
je 0x14000360c
lea rdx, [0x1400342c0]
lea rsi, [rsp + 0x28]
mov rcx, rsi
call fcn.140002a90
cmp qword [rsi + 0x18], 8
jb 0x1400035bf
mov rsi, qword [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rax, qword [rsp + 0x40]
cmp rax, 8
jb 0x14000360c
mov rcx, qword [rsp + 0x28]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140003607
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140003620
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001bac4
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14001ca10
nop
add rsp, 0x50
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400055e0
Capabilities:
Create directory

Disassembly:
push rsi
sub rsp, 0x50
mov rdx, rcx
mov rax, qword [0x140034030]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rsi, [rsp + 0x28]
mov rcx, rsi
call fcn.140002a90
cmp qword [rsi + 0x18], 8
jb 0x140005610
mov rsi, qword [rsp + 0x28]
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
mov rax, qword [rsp + 0x40]
cmp rax, 8
jb 0x140005661
mov rcx, qword [rsp + 0x28]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14000565c
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000568e
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001bac4
test esi, esi
jne 0x140005672
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000568a
mov sil, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14001ca10
mov eax, esi
add rsp, 0x50
pop rsi
ret
xor esi, esi
jmp 0x140005675
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140012320
Capabilities:
Move file

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140034030]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r8, qword [rdx + 0x10]
cmp qword [rcx + 0x10], r8
jne 0x14001236d
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x140012353
mov rcx, qword [rsi]
cmp qword [rdi + 0x18], 0x10
mov rdx, rdi
jb 0x140012360
mov rdx, qword [rdi]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140012441
lea rbx, [rsp + 0x48]
mov rcx, rbx
mov rdx, rdi
call fcn.140002a90
cmp qword [rbx + 0x18], 8
jb 0x140012389
mov rbx, qword [rsp + 0x48]
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov rdx, rsi
call fcn.140002a90
cmp qword [rdi + 0x18], 8
jb 0x1400123a5
mov rdi, qword [rsp + 0x28]
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, 1
sete bl
mov rax, qword [rsp + 0x40]
cmp rax, 8
jb 0x1400123fb
mov rcx, qword [rsp + 0x28]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x1400123f6
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14001245a
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001bac4
mov rax, qword [rsp + 0x60]
cmp rax, 8
jb 0x140012443
mov rcx, qword [rsp + 0x48]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14001243a
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14001245a
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001bac4
jmp 0x140012443
mov bl, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14001ca10
mov eax, ebx
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x140016d20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
movzx edx, cx
cmp byte [0x140034418], 1
jne 0x140016ddd
mov r8d, 5
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov ecx, 0x40
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r15, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r12, rax
mov rcx, rax
mov rdx, r14
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
or byte [r12 + 0xa], 0x40
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, r12
mov r8, rdi
mov r9, rsi
call qword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
mov rsi, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rax, rsi
jmp 0x140016df4
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov r8, rdi
mov r9, rsi
call qword [sym.imp.USER32.dll_DialogBoxParamW]
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140016e10
Capabilities:
Get graphical window text

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x850
mov ebp, r9d
mov rsi, r8
mov r14, rdx
mov rdi, rcx
mov rax, qword [0x140034030]
xor rax, rsp
mov qword [rsp + 0x848], rax
call qword [sym.imp.USER32.dll_GetDC]
mov r15, rax
mov rcx, rdi
mov edx, 0x31
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x140016e6d
mov rcx, r15
mov rdx, rax
call qword [sym.imp.GDI32.dll_SelectObject]
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov r8d, 0x400
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov r8d, dword [rsi + 0x10]
cmp qword [rsi + 0x18], 8
mov rdx, rsi
jb 0x140016e92
mov rdx, qword [rsi]
lea r9, [rsp + 0x38]
mov rcx, r15
call qword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
xor ebx, ebx
test eax, eax
je 0x140016f30
lea r12, [rsp + 0x40]
mov rcx, r12
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
lea r9, [rsp + 0x30]
mov rcx, r15
mov rdx, r12
mov r8d, eax
call qword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
test eax, eax
je 0x140016f30
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
sub eax, ecx
js 0x140016f30
mov r8d, dword [rsp + 0x8b0]
mov edx, dword [r14]
mov r9d, dword [r14 + 8]
add ecx, edx
mov ebx, r9d
sub ebx, ecx
test r8d, r8d
cmovne ebx, r8d
add ebx, eax
test bpl, bpl
je 0x140016f06
sub edx, ebx
mov dword [r14], edx
jmp 0x140016f0d
add r9d, ebx
mov dword [r14 + 8], r9d
mov r8d, dword [r14 + 4]
mov eax, dword [r14 + 0xc]
sub eax, r8d
sub r9d, edx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 1
mov rcx, rdi
call qword [sym.imp.USER32.dll_MoveWindow]
mov rax, qword [rsi + 0x18]
cmp rax, 8
jb 0x140016f71
mov rcx, qword [rsi]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140016f6c
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140016faa
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001bac4
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 7
mov word [rsi], 0
mov rcx, qword [rsp + 0x848]
xor rcx, rsp
call fcn.14001ca10
mov eax, ebx
add rsp, 0x850
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140016fc0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov rax, qword [0x140034030]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov byte [r8], 0
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000002
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x140017019
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000001
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x140017019
xor edi, edi
jmp 0x14001706c
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
mov dword [rax], 4
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
xor edi, edi
lea r9, [rsp + 0x44]
mov rdx, rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140017061
cmp dword [rsp + 0x44], 4
jne 0x140017061
cmp dword [rsp + 0x34], 1
sete byte [rsi]
mov dil, 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14001ca10
mov eax, edi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x140017530
Capabilities:
Get graphical window text

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x870
mov rsi, rcx
mov rax, qword [0x140034030]
xor rax, rsp
mov qword [rsp + 0x868], rax
mov edx, 0x3f6
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdi, rax
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDC]
mov rbx, rax
mov rcx, rdi
mov edx, 0x31
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x140017595
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.GDI32.dll_SelectObject]
lea r14, [rsp + 0x38]
mov rcx, rdi
mov rdx, r14
call qword [sym.imp.USER32.dll_GetWindowRect]
xor ecx, ecx
mov rdx, rsi
mov r8, r14
mov r9d, 2
call qword [sym.imp.USER32.dll_MapWindowPoints]
lea r14, [rsp + 0x60]
mov rcx, rdi
mov rdx, r14
mov r8d, 0x400
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, r14
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
lea r9, [rsp + 0x48]
mov rcx, rbx
mov rdx, r14
mov r8d, eax
call qword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
test eax, eax
je 0x140017632
mov eax, dword [rsp + 0x48]
mov ebp, dword [rsp + 0x38]
mov ebx, dword [rsp + 0x40]
sub ebx, ebp
cmp eax, ebx
jl 0x140017632
cvtsi2ss xmm0, eax
cvtsi2ss xmm1, ebx
divss xmm0, xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
cvttss2si eax, xmm0
imul eax, dword [rsp + 0x4c]
mov r8d, dword [rsp + 0x3c]
mov r14d, r8d
sub r14d, dword [rsp + 0x44]
add r14d, eax
test r14d, r14d
jg 0x140017655
mov rcx, qword [rsp + 0x868]
xor rcx, rsp
call fcn.14001ca10
nop
add rsp, 0x870
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r12d, 1
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], eax
mov r15, qword [sym.imp.USER32.dll_MoveWindow]
mov rcx, rdi
mov edx, ebp
mov r9d, ebx
call r15
mov rdi, qword [0x140034408]
mov rcx, qword [rdi + 8]
call fcn.14001e880
mov qword [rdi + 8], rdi
mov qword [rdi], rdi
mov qword [rdi + 0x10], rdi
mov qword [0x140034410], 0
lea rdi, [rsp + 0x34]
mov dword [rdi], 0x3ed
lea rcx, [rsp + 0x50]
mov rdx, rdi
call fcn.140017440
mov dword [rdi], 0x3f4
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x34]
call fcn.140017440
lea rdi, [rsp + 0x50]
mov rcx, rsi
mov rdx, rdi
call qword [sym.imp.USER32.dll_GetWindowRect]
add r14d, dword [rdi + 0xc]
mov dword [rdi + 0xc], r14d
mov edx, dword [rdi]
mov r8d, dword [rdi + 4]
sub r14d, r8d
mov r9d, dword [rdi + 8]
sub r9d, edx
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r14d
mov rcx, rsi
call r15
lea rdx, [0x14002d790]
lea rsi, [rsp + 0x50]
mov rcx, rsi
call fcn.1400209e0
lea rdx, [0x14002d794]
mov rcx, rsi
call fcn.1400209e0
lea rdx, [0x14002d798]
mov rcx, rsi
call fcn.1400209e0
lea rdx, [0x14002d79c]
mov rcx, rsi
call fcn.1400209e0
lea rdx, [0x14002d7a0]
mov rcx, rsi
call fcn.1400209e0
lea rdx, [0x14002d7a4]
mov rcx, rsi
call fcn.1400209e0
lea rdx, [0x14002d7a8]
mov rcx, rsi
call fcn.1400209e0
lea rdx, [0x14002d7ac]
mov rcx, rsi
call fcn.1400209e0
jmp 0x140017632
Function at 0x140018620
Capabilities:
Get graphical window text

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov eax, 0x9cc0
call fcn.14001ca40
sub rsp, rax
movaps xmmword [rsp + 0x9cb0], xmm6
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140034030]
xor rax, rsp
mov qword [rsp + 0x9ca8], rax
lea rdx, [rsp + 0x4e80]
mov r8d, 0x2711
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rbx, [rsp + 0x4c]
lea r14, [rsp + 0x48]
mov rcx, rdi
mov edx, 0xb0
mov r8, rbx
mov r9, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9d, dword [r14]
mov eax, dword [rbx]
mov edi, 0xfffffffe
cmp r9d, eax
je 0x1400186f8
sub r9d, eax
lea r8, [rsp + rax*2]
add r8, 0x4e80
lea rdi, [rsp + 0x50]
mov edx, 0x2711
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov eax, dword [rsp + 0x48]
sub eax, dword [rsp + 0x4c]
mov word [rsp + rax*2 + 0x50], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, rdi
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
not edi
xorps xmm6, xmm6
movups xmmword [rsp + 0x30], xmm6
xor r14d, r14d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r15, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea r8, [rsp + 0x4e80]
mov ecx, 0xfde9
xor edx, edx
mov r9d, 0xffffffff
call r15
mov ebx, eax
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov ecx, 0xfde9
xor edx, edx
mov r8, rsi
mov r9d, 0xffffffff
call r15
mov esi, eax
add ebx, edi
add esi, ebx
mov rcx, qword [rsp + 0x9ca8]
xor rcx, rsp
call fcn.14001ca10
mov eax, esi
movaps xmm6, xmmword [rsp + 0x9cb0]
add rsp, 0x9cc0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14001e410
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword [0x140034030]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dil, 1
cmp qword [rcx + 0x68], 0
je 0x14001e4cb
mov rsi, rcx
cmp byte [rcx + 0x71], 0
je 0x14001e4cb
mov rax, qword [rsi]
mov rax, qword [rax + 0x18]
mov rcx, rsi
mov edx, 0xffffffff
call qword [0x140036010]
cmp eax, 0xffffffff
je 0x14001e4c9
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
lea r8, [rsp + 0x28]
mov qword [rsp + 0x20], r8
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [0x140036010]
cmp eax, 3
je 0x14001e4e2
cmp eax, 1
je 0x14001e499
test eax, eax
jne 0x14001e4c9
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x14001e4bf
mov r9, qword [rsi + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
cmp rbx, rax
jne 0x14001e4c9
cmp byte [rsi + 0x71], 0
sete dil
jmp 0x14001e4cb
xor edi, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14001ca10
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov byte [rsi + 0x71], 0
mov dil, 1
jmp 0x14001e4cb
Function at 0x1406a0058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1406a01df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406a0089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406a006f
add dl, dl
jne 0x1406a0096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406a00f6
xor eax, eax
add dl, dl
jne 0x1406a00a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406a01ad
add dl, dl
jne 0x1406a00b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406a00c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406a00d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406a00dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406a00ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406a007e
mov eax, 1
add dl, dl
jne 0x1406a0106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406a0113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406a00fb
sub eax, ebx
mov ebx, 1
jne 0x1406a014c
mov ecx, 1
add dl, dl
jne 0x1406a012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406a013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406a0123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406a007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406a0168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406a0175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406a015d
cmp eax, 0x7d00
jae 0x1406a019b
cmp eax, 0x500
jb 0x1406a0196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406a007e
cmp eax, 0x7f
ja 0x1406a019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406a007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406a01d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406a007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400113a7
Capabilities:
Terminate process

Disassembly:
jmp 0x1400193e0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001148d
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001b6f0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001b710
xor al, al
jmp 0x14001b791
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001b723
xor al, al
jmp 0x14001b791
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001b74d
xor al, al
jmp 0x14001b791
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001b761
xor al, al
jmp 0x14001b791
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001b773
xor al, al
jmp 0x14001b791
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001b78f
xor al, al
jmp 0x14001b791
mov al, 1
add rsp, 0x38
ret
Function at 0x1400115ff
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x140017a00
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x208
lea rbp, [rsp + 0x20]
lea rcx, [0x14002d403]
call fcn.140011681
mov rax, qword [rbp + 0x200]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x200]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rbp + 0x200]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rbp + 0x200]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x20]
mov rcx, qword [rbp + 0x200]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x24]
mov rcx, qword [rbp + 0x200]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xa8], rax
mov dword [rbp + 0xc4], 0
jmp 0x140017ad4
mov eax, dword [rbp + 0xc4]
inc eax
mov dword [rbp + 0xc4], eax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x1c]
cmp dword [rbp + 0xc4], eax
jae 0x140017b53
mov eax, dword [rbp + 0xc4]
mov rcx, qword [rbp + 0x88]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 0x200]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xe8], rax
mov rcx, qword [rbp + 0xe8]
call fcn.140011609
mov dword [rbp + 0x104], eax
mov eax, dword [rbp + 0x208]
cmp dword [rbp + 0x104], eax
jne 0x140017b4e
mov eax, dword [rbp + 0xc4]
mov rcx, qword [rbp + 0xa8]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rbp + 0x68]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 0x200]
add rcx, rax
mov rax, rcx
jmp 0x140017b55
jmp 0x140017ac6
xor eax, eax
lea rsp, [rbp + 0x1e8]
pop rdi
pop rbp
ret
Function at 0x2fc4cb4f0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4cbef2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f0108]
test eax, eax
je 0x2fc4cbf8a
lea rax, [0x2fc4f00e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f0110]
mov qword [rbp - 8], rax
jmp 0x2fc4cbf6e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4cbf62
cmp qword [rbp - 0x10], 0
je 0x2fc4cbf62
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4cbf28
lea rax, [0x2fc4f00e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4cbf8b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4cc090
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4cc0b8
mov eax, 0
jmp 0x2fc4cc106
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4cc0e1
mov eax, 0
jmp 0x2fc4cc106
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4cc101
mov eax, 0
jmp 0x2fc4cc106
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4cc10c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4cc18a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4cc181
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4cc181
mov rax, qword [rbp - 8]
jmp 0x2fc4cc19f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4cc154
mov eax, 0
add rsp, 0x20
pop rbp
ret