joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008ef80
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14008ef8d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14008ef9d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14008ef85
lea eax, [rcx + 1]
jmp 0x14008efab
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14008efbe
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14008efa4
sub eax, 3
jb 0x14008efde
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14008f02d
sar eax, 1
movsxd rbp, eax
jb 0x14008f014
jmp 0x14008efec
add ebx, ebx
jne 0x14008efea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14008f014
inc ecx
add ebx, ebx
jne 0x14008effa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14008f014
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14008f00d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14008effc
add ecx, 2
jmp 0x14008f019
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14008ef42
jmp 0x14008ef8d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x29400
mov dl, 0x11
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14008f079
cmp rsi, rcx
jae 0x14008f081
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14008f060
cmp al, 0x8f
ja 0x14008f060
cmp byte [rsi - 2], 0xf
je 0x14008f066
sub al, 0xe8
cmp al, 1
ja 0x14008f04a
cmp rsi, rcx
jae 0x14008f081
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14008f050
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14008f081
lodsb al, byte [rsi]
jmp 0x14008f060
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x8c000]
mov eax, dword [rdi]
or eax, eax
je 0x14008f0ea
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xd1640]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14008f08e
jns 0x14008f0c3
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14008f0cd
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14008f0e4
mov qword [rbx], rax
add rbx, 8
jmp 0x14008f0ae
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14008f124
cmp al, 0xef
ja 0x14008f116
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14008f0f6
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14008f105
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x227]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14008f178
sub rsp, 0xffffffffffffff80
jmp 0x14000c0d0
Function at 0x1800027a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
movsxd rax, dword [rcx + 0x3c]
mov ebp, dword [0x180020a84]
lea r11d, [rbp - 1]
imul r11d, ebp
cmp dword [rcx + rax + 0x8c], 0
mov r8d, dword [0x180020a88]
je 0x180002822
mov eax, dword [rcx + rax + 0x88]
cmp r8d, 0xa
jl 0x1800027e2
mov ebp, r11d
and ebp, 1
je 0x1800027e2
jmp 0x1800027e0
cmp dword [rcx + rax + 0x14], 0
je 0x180002822
mov r9d, dword [rcx + rax + 0x18]
test r9d, r9d
je 0x180002822
mov r10d, dword [rcx + rax + 0x1c]
cmp dword [0x180020a8c], 0xa
jl 0x180002842
mov esi, dword [0x180020a90]
lea edi, [rsi - 1]
imul edi, esi
and edi, 1
je 0x180002842
nop word cs:[rax + rax]
nop dword [rax]
jmp 0x180002820
xor ecx, ecx
cmp r8d, 0xa
jl 0x1800028af
mov eax, r11d
and eax, 1
je 0x1800028af
nop word cs:[rax + rax]
jmp 0x180002840
add r10, rcx
mov r15d, dword [rcx + rax + 0x20]
mov r14d, dword [rcx + rax + 0x24]
add r14, rcx
add r15, rcx
xor edi, edi
nop word [rax + rax]
mov esi, dword [r15]
add rsi, rcx
xor eax, eax
nop dword [rax + rax]
movzx ebx, byte [rdx + rax]
movzx ebp, byte [rsi + rax]
test bl, bl
je 0x180002885
add rax, 1
cmp bl, bpl
je 0x180002870
cmp bl, bpl
je 0x1800028a4
add edi, 1
add r15, 4
add r14, 2
cmp edi, r9d
jne 0x180002860
xor ecx, ecx
cmp r8d, 0xa
jge 0x1800028b5
jmp 0x1800028c2
movzx eax, word [r14]
mov eax, dword [r10 + rax*4]
add rcx, rax
cmp r8d, 0xa
jl 0x1800028c2
and r11d, 1
je 0x1800028c2
nop dword [rax + rax]
jmp 0x1800028c0
mov rax, rcx
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1800028d0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a94], 0xa
jl 0x180002902
mov eax, dword [0x180020a98]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x180002902
nop word cs:[rax + rax]
jmp 0x180002900
mov rax, qword gs:[0x60]
mov r11, qword [rax + 0x18]
add r11, 0x10
mov eax, dword [0x180020a80]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a7c], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020aa0], 0xa
setl r9b
or r9b, al
lea r10, [rcx - 1]
xor eax, eax
mov r14, r11
mov r14, qword [r14]
cmp r14, r11
je 0x1800029d8
mov rsi, r10
test r8b, r8b
je 0x1800029f0
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x180002970
test r9b, r9b
je 0x180002a00
sub rsi, rcx
je 0x1800029d4
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop
movzx r13d, word [r15 + rbx*2]
lea edi, [r13 - 0x41]
lea ebp, [r13 + 0x20]
cmp di, 0x1a
cmovae ebp, r13d
movsx edi, byte [rcx + rbx]
lea r12d, [rdi - 0x41]
lea edx, [rdi + 0x20]
cmp r12b, 0x1a
cmovae edx, edi
sub ebp, edx
test r13d, r13d
je 0x1800029d0
test ebp, ebp
jne 0x1800029d0
add rbx, 1
cmp rsi, rbx
jne 0x180002990
jmp 0x1800029d4
test ebp, ebp
jne 0x18000295c
mov rax, qword [r14 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x1800029f0
jmp 0x180002a00
Function at 0x1800025e0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a94], 0xa
jl 0x180002612
mov eax, dword [0x180020a98]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x180002612
nop word cs:[rax + rax]
jmp 0x180002610
mov rax, qword gs:[0x60]
mov r11, qword [rax + 0x18]
add r11, 0x10
mov eax, dword [0x180020a80]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a7c], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020aa0], 0xa
setl r9b
or r9b, al
lea r10, [rcx - 1]
xor eax, eax
mov r14, r11
mov r14, qword [r14]
cmp r14, r11
je 0x1800026e8
mov rsi, r10
test r8b, r8b
je 0x180002700
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x180002680
test r9b, r9b
je 0x180002710
sub rsi, rcx
je 0x1800026e4
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop
movzx r13d, word [r15 + rbx*2]
lea edi, [r13 - 0x41]
lea ebp, [r13 + 0x20]
cmp di, 0x1a
cmovae ebp, r13d
movsx edi, byte [rcx + rbx]
lea r12d, [rdi - 0x41]
lea edx, [rdi + 0x20]
cmp r12b, 0x1a
cmovae edx, edi
sub ebp, edx
test r13d, r13d
je 0x1800026e0
test ebp, ebp
jne 0x1800026e0
add rbx, 1
cmp rsi, rbx
jne 0x1800026a0
jmp 0x1800026e4
test ebp, ebp
jne 0x18000266c
mov rax, qword [r14 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x180002700
jmp 0x180002710
Function at 0x140011249
Capabilities:
Terminate process

Disassembly:
jmp 0x1400130d0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x1400112e9
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400158c0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400158e0
xor al, al
jmp 0x140015961
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400158f3
xor al, al
jmp 0x140015961
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001591d
xor al, al
jmp 0x140015961
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015931
xor al, al
jmp 0x140015961
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015943
xor al, al
jmp 0x140015961
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001595f
xor al, al
jmp 0x140015961
mov al, 1
add rsp, 0x38
ret
Function at 0x140013d10
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140011433
movzx eax, al
test eax, eax
jne 0x140013d30
mov ecx, 7
call fcn.14001138e
nop
mov byte [rsp + 0x20], 0
call fcn.1400113a7
mov byte [rsp + 0x21], al
cmp dword [0x1400202d0], 1
jne 0x140013d54
mov ecx, 7
call fcn.14001138e
nop
jmp 0x140013dac
cmp dword [0x1400202d0], 0
jne 0x140013da7
mov dword [0x1400202d0], 1
lea rdx, [0x14001b660]
lea rcx, [0x14001b330]
call fcn.1400111ea
test eax, eax
je 0x140013d88
mov eax, 0xff
jmp 0x140013eb1
lea rdx, [0x14001b220]
lea rcx, [section..rdata]
call fcn.140011398
mov dword [0x1400202d0], 2
jmp 0x140013dac
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001137a
call fcn.140011311
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140013e09
mov rcx, qword [rsp + 0x30]
call fcn.140011186
movzx eax, al
test eax, eax
je 0x140013e09
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140027020]
nop
call fcn.140011343
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140013e3d
mov rcx, qword [rsp + 0x38]
call fcn.140011186
movzx eax, al
test eax, eax
je 0x140013e3d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400113e8
nop
call fcn.140013f60
mov dword [rsp + 0x28], eax
call fcn.1400112e9
movzx eax, al
test eax, eax
jne 0x140013e5c
mov ecx, dword [rsp + 0x28]
call fcn.14001105a
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140013e6b
call fcn.1400113f2
nop
xor edx, edx
mov cl, 1
call fcn.140011177
mov eax, dword [rsp + 0x28]
jmp 0x140013eb1
add rsp, 0x68
ret
Function at 0x1800021d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
movsxd rax, dword [rcx + 0x3c]
mov ebp, dword [0x180020a84]
lea r11d, [rbp - 1]
imul r11d, ebp
cmp dword [rcx + rax + 0x8c], 0
mov r8d, dword [0x180020a88]
je 0x180002252
mov eax, dword [rcx + rax + 0x88]
cmp r8d, 0xa
jl 0x180002212
mov ebp, r11d
and ebp, 1
je 0x180002212
jmp 0x180002210
cmp dword [rcx + rax + 0x14], 0
je 0x180002252
mov r9d, dword [rcx + rax + 0x18]
test r9d, r9d
je 0x180002252
mov r10d, dword [rcx + rax + 0x1c]
cmp dword [0x180020a8c], 0xa
jl 0x180002272
mov esi, dword [0x180020a90]
lea edi, [rsi - 1]
imul edi, esi
and edi, 1
je 0x180002272
nop word cs:[rax + rax]
nop dword [rax]
jmp 0x180002250
xor ecx, ecx
cmp r8d, 0xa
jl 0x1800022df
mov eax, r11d
and eax, 1
je 0x1800022df
nop word cs:[rax + rax]
jmp 0x180002270
add r10, rcx
mov r15d, dword [rcx + rax + 0x20]
mov r14d, dword [rcx + rax + 0x24]
add r15, rcx
add r14, rcx
xor edi, edi
nop word [rax + rax]
mov esi, dword [r15]
add rsi, rcx
xor eax, eax
nop dword [rax + rax]
movzx ebx, byte [rdx + rax]
movzx ebp, byte [rsi + rax]
test bl, bl
je 0x1800022b5
add rax, 1
cmp bl, bpl
je 0x1800022a0
cmp bl, bpl
je 0x1800022d4
add edi, 1
add r15, 4
add r14, 2
cmp edi, r9d
jne 0x180002290
xor ecx, ecx
cmp r8d, 0xa
jge 0x1800022e5
jmp 0x1800022f2
movzx eax, word [r14]
mov eax, dword [r10 + rax*4]
add rcx, rax
cmp r8d, 0xa
jl 0x1800022f2
and r11d, 1
je 0x1800022f2
nop dword [rax + rax]
jmp 0x1800022f0
mov rax, rcx
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x180002300
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov rax, qword gs:[0x60]
mov r10, qword [rax + 0x18]
add r10, 0x10
mov eax, dword [0x180020a94]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a98], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a7c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a80], 0xa
setl r9b
or r9b, al
mov eax, dword [0x180020a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020aa0], 0xa
setl r11b
or r11b, al
xor eax, eax
mov r14, r10
test r8b, r8b
jne 0x1800023a1
jmp 0x180002490
test ebx, ebx
je 0x1800024c2
test r8b, r8b
je 0x180002490
mov r14, qword [r14]
cmp r14, r10
je 0x1800024c6
movsx r15d, byte [rcx]
mov rsi, rcx
test r15d, r15d
je 0x1800023e0
test r9b, r9b
je 0x1800024b0
nop word cs:[rax + rax]
nop dword [rax]
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x1800023d0
jmp 0x1800023e9
test r9b, r9b
je 0x1800024c0
test r11b, r11b
je 0x1800024a0
sub rsi, rcx
je 0x1800024c2
mov r13, qword [r14 + 0x60]
movzx edx, word [r13]
lea ebp, [rdx - 0x41]
lea ebx, [rdx + 0x20]
cmp bp, 0x1a
cmovae ebx, edx
lea r12d, [r15 - 0x41]
lea ebp, [r15 + 0x20]
cmp r12b, 0x1a
cmovae ebp, r15d
sub ebx, ebp
test edx, edx
je 0x180002390
test ebx, ebx
jne 0x180002390
mov edx, 1
nop dword [rax + rax]
cmp rsi, rdx
je 0x1800024c2
movzx r12d, word [r13 + rdx*2]
lea edi, [r12 - 0x41]
lea ebx, [r12 + 0x20]
cmp di, 0x1a
cmovae ebx, r12d
movsx edi, byte [rcx + rdx]
lea r15d, [rdi - 0x41]
lea ebp, [rdi + 0x20]
cmp r15b, 0x1a
cmovae ebp, edi
sub ebx, ebp
test r12d, r12d
je 0x180002390
add rdx, 1
test ebx, ebx
je 0x180002440
jmp 0x180002390
jmp 0x180002490
jmp 0x1800024a0
jmp 0x1800024b0
jmp 0x1800024c0
mov rax, qword [r14 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1800022f0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a94], 0xa
jl 0x180002322
mov eax, dword [0x180020a98]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x180002322
nop word cs:[rax + rax]
jmp 0x180002320
mov rax, qword gs:[0x60]
mov r11, qword [rax + 0x18]
add r11, 0x10
mov eax, dword [0x180020a80]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a7c], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020aa0], 0xa
setl r9b
or r9b, al
lea r10, [rcx - 1]
xor eax, eax
mov r14, r11
mov r14, qword [r14]
cmp r14, r11
je 0x1800023f8
mov rsi, r10
test r8b, r8b
je 0x180002410
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x180002390
test r9b, r9b
je 0x180002420
sub rsi, rcx
je 0x1800023f4
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop
movzx r13d, word [r15 + rbx*2]
lea edi, [r13 - 0x41]
lea ebp, [r13 + 0x20]
cmp di, 0x1a
cmovae ebp, r13d
movsx edi, byte [rcx + rbx]
lea r12d, [rdi - 0x41]
lea edx, [rdi + 0x20]
cmp r12b, 0x1a
cmovae edx, edi
sub ebp, edx
test r13d, r13d
je 0x1800023f0
test ebp, ebp
jne 0x1800023f0
add rbx, 1
cmp rsi, rbx
jne 0x1800023b0
jmp 0x1800023f4
test ebp, ebp
jne 0x18000237c
mov rax, qword [r14 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x180002410
jmp 0x180002420
Function at 0x2fc4c4bb0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4c5c70
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4c55b2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4ea108]
test eax, eax
je 0x2fc4c564a
lea rax, [0x2fc4ea0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4ea110]
mov qword [rbp - 8], rax
jmp 0x2fc4c562e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4c5622
cmp qword [rbp - 0x10], 0
je 0x2fc4c5622
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4c55e8
lea rax, [0x2fc4ea0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4c564b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4c5750
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4c5778
mov eax, 0
jmp 0x2fc4c57c6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4c57a1
mov eax, 0
jmp 0x2fc4c57c6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4c57c1
mov eax, 0
jmp 0x2fc4c57c6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4c57cc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4c584a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4c5841
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4c5841
mov rax, qword [rbp - 8]
jmp 0x2fc4c585f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4c5814
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x406cc7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x004160d0]
jne 0x40494a
rol rcx, 0x10
test cx, 0xffff
jne 0x404946
repz ret
ror rcx, 0x10
jmp 0x406c20
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x00417300]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x004173f8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x406ca5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x00417300]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x406cc7
mov rax, qword [rsp + 0x88]
mov qword [0x004173f8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x00417398], rax
mov rax, qword [0x004173f8]
mov qword [0x00417270], rax
mov rax, qword [rsp + 0x90]
mov qword [0x00417380], rax
mov dword [0x00417260], 0xc0000409
mov dword [0x00417264], 1
mov rax, qword [0x004160d0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x004160d8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x004172f8], eax
mov ecx, 1
call fcn.00406fd0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x004114f8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x004172f8], 0
jne 0x406d4e
mov ecx, 1
call fcn.00406fd0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x40db50
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.00407050
xor ebx, ebx
cmp qword [0x00417ff0], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x40dc81
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x40dbb3
xor eax, eax
jmp 0x40dd61
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x40dbac
mov rcx, rax
call fcn.00406fe0
lea rdx, str.GetActiveWindow
mov rcx, rbp
mov qword [0x00417ff0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00406fe0
lea rdx, str.GetLastActivePopup
mov rcx, rbp
mov qword [0x00417ff8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00406fe0
lea rcx, [rsp + 0x30]
mov qword [0x00418000], rax
call fcn.00408f00
test eax, eax
je 0x40dc37
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.00405010
cmp dword [rsp + 0x30], 2
jne 0x40dc81
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00406fe0
test rax, rax
mov qword [0x00418010], rax
je 0x40dc81
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00406fe0
mov qword [0x00418008], rax
mov rcx, qword [0x00418008]
cmp rcx, rsi
je 0x40dd13
cmp qword [0x00418010], rsi
je 0x40dd13
call fcn.004070b0
call rax
test rax, rax
mov rbp, rax
je 0x40dcde
mov rcx, qword [0x00418010]
call fcn.004070b0
lea rcx, [rsp + 0x38]
mov r9d, 0xc
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x40dcde
test byte [rsp + 0x48], 1
jne 0x40dd13
lea rcx, [rsp + 0x34]
call fcn.00408f50
test eax, eax
je 0x40dd00
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.00405010
cmp dword [rsp + 0x34], 4
jb 0x40dd0d
bts edi, 0x15
jmp 0x40dd47
bts edi, 0x12
jmp 0x40dd47
mov rcx, qword [0x00417ff8]
cmp rcx, rsi
je 0x40dd47
call fcn.004070b0
call rax
test rax, rax
mov rbx, rax
je 0x40dd47
mov rcx, qword [0x00418000]
cmp rcx, rsi
je 0x40dd47
call fcn.004070b0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x00417ff0]
call fcn.004070b0
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret