joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003cf0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14000b010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140003d1d
xor eax, eax
jmp 0x140003e89
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140003d57
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140003d57
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140003e89
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140003e7c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140003d9a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140003dc5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140003e81
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003e34
sub eax, 1
je 0x140003e34
cmp eax, 2
jne 0x140003e7c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140003e81
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140003e62
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140003e7c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140003e81
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400052a0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140004220
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000b010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400042f3
cmp byte [rcx + 0x71], 0
je 0x1400042f3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400042ef
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400042b4
sub eax, 1
je 0x1400042b8
cmp eax, 2
jne 0x1400042ef
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400052a0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400042e6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400042ef
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000429c
xor al, al
jmp 0x14000429c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400052a0
add rsp, 0x60
pop rbx
ret

Function at 0x140005c3c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005c86
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005c86
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005c86
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005c86
cmp dword [rcx + 0x84], 0xe
jbe 0x140005c86
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140005c88
xor al, al
add rsp, 0x28
ret
Function at 0x180001330
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push rbx
sub rsp, 0x850
mov rax, qword [0x18001f008]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rbx, r8
sub edx, 1
je 0x180001385
cmp edx, 5
jne 0x180001367
test rbx, rbx
je 0x180001367
mov rax, qword [0x180020c00]
mov qword [r8], rax
mov eax, 1
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.1800019e0
add rsp, 0x850
pop rbx
ret
mov eax, dword [0x18001c6c8]
xor edx, edx
mov dword [rsp + 0x40], eax
mov r8d, 0x3fa
movzx eax, word [0x18001c6cc]
mov qword [0x180020c00], rcx
lea rcx, [rsp + 0x46]
mov word [rsp + 0x44], ax
call fcn.180002b10
xor edx, edx
lea rcx, [rsp + 0x440]
mov r8d, 0x400
call fcn.180002b10
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
test rbx, rbx
je 0x1800014dd
mov rcx, rbx
mov dword [rsp + 0x38], eax
call fcn.180001180
test rax, rax
jne 0x180001400
lea rcx, str._n____Failed_to_convert_arguments..._n
call fcn.180001070
jmp 0x1800014dd
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
lea rcx, str.____PetitPotam_exploit_by_Cneelis__Outflank_n
mov rbx, rax
call fcn.180001070
lea rcx, str.____Based_on_original_code_by__topotam77_n_n
call fcn.180001070
cmp dword [rsp + 0x38], 2
jge 0x18000143a
call fcn.180001150
jmp 0x1800014dd
mov r8, qword [rbx + 8]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x860], rdi
mov edx, 0x200
mov rdi, qword [rbx]
call fcn.180006100
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.180001220
test eax, eax
je 0x180001474
lea rcx, str.____RPC_Binding_failed..._n_n
jmp 0x1800014d0
mov r9, rdi
lea r8, str._sC_WindowsTemp_tmpBla.tmp
mov edx, 0x200
lea rcx, [rsp + 0x440]
call fcn.1800010d0
mov rbx, qword [rsp + 0x20]
lea r8, [rsp + 0x440]
mov rcx, rbx
lea rdx, [rsp + 0x28]
call fcn.180001000
cmp eax, 0x35
je 0x1800014c9
lea r8, [rsp + 0x30]
mov rcx, rbx
lea rdx, [rsp + 0x440]
call fcn.180001030
cmp eax, 0x35
jne 0x1800014d5
lea rcx, str.____Attack_success____n_n
call fcn.180001070
mov rdi, qword [rsp + 0x860]
mov ecx, 1
call fcn.180005d24
mov rcx, rax
call fcn.180006098
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140004560
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x88]
sub rax, rcx
sar rax, 1
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jae 0x1400045c4
mov dword [rsp + 0x24], 0
cmp dword [rsp + 0x90], 0
jl 0x1400045d8
mov dword [rsp + 0x68], 1
jmp 0x1400045e0
mov dword [rsp + 0x68], 0
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jne 0x1400045f9
mov ecx, 0x80070057
call fcn.1400052e0
xor eax, eax
test eax, eax
jne 0x1400045c4
cmp qword [rsp + 0x88], 0
jne 0x140004617
mov dword [rsp + 0x90], 0
jmp 0x140004633
movsxd rdx, dword [rsp + 0x90]
mov rcx, qword [rsp + 0x88]
call fcn.14002fac8
mov dword [rsp + 0x90], eax
mov eax, 0x7fffffff
sub eax, dword [rsp + 0x90]
cmp eax, dword [rsp + 0x24]
jl 0x14000464f
mov dword [rsp + 0x6c], 1
jmp 0x140004657
mov dword [rsp + 0x6c], 0
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
jne 0x140004670
mov ecx, 0x80070057
call fcn.1400052e0
xor eax, eax
test eax, eax
jne 0x140004633
mov ecx, dword [rsp + 0x90]
mov eax, dword [rsp + 0x24]
add eax, ecx
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
sub rax, 0x18
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
mov eax, 1
sub eax, dword [rcx + 0x10]
mov dword [rsp + 0x4c], eax
mov rax, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x20]
mov eax, dword [rax + 0xc]
sub eax, ecx
mov dword [rsp + 0x50], eax
mov ecx, dword [rsp + 0x50]
mov eax, dword [rsp + 0x4c]
or eax, ecx
test eax, eax
jge 0x1400046dd
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
call fcn.140004ec0
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x24]
cmp qword [rsp + 0x28], rax
ja 0x140004718
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
lea rax, [rcx + rax*2]
mov qword [rsp + 0x88], rax
movsxd r9, dword [rsp + 0x90]
shl r9, 1
movsxd rdx, dword [rsp + 0x90]
shl rdx, 1
mov ecx, dword [rsp + 0x24]
mov rax, qword [rsp + 0x30]
lea rcx, [rax + rcx*2]
mov r8, qword [rsp + 0x88]
call fcn.14002f9cc
cmp dword [rsp + 0x20], 0
jl 0x140004763
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov eax, dword [rax - 0xc]
cmp dword [rsp + 0x20], eax
jle 0x14000476d
mov ecx, 0x80070057
call fcn.1400052e0
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx]
mov eax, dword [rsp + 0x20]
mov dword [rcx - 0x10], eax
movsxd rdx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx]
xor eax, eax
mov word [rcx + rdx*2], ax
add rsp, 0x78
ret
Function at 0x140006990
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x20], 0
cmp dword [rsp + 0x24], 0
jne 0x1400069d6
mov rcx, qword [rsp + 0x80]
call fcn.140004bf0
jmp 0x140006a78
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
sub rax, 0x18
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
mov eax, 1
sub eax, dword [rcx + 0x10]
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x24]
mov eax, dword [rax + 0xc]
sub eax, ecx
mov dword [rsp + 0x4c], eax
mov ecx, dword [rsp + 0x4c]
mov eax, dword [rsp + 0x48]
or eax, ecx
test eax, eax
jge 0x140006a2c
mov edx, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x80]
call fcn.140004ec0
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x80]
call fcn.140006e00
mov dword [rsp + 0x20], 1
mov eax, dword [rsp + 0x20]
add rsp, 0x78
ret

Function at 0x14000a988
Capabilities:
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
movsxd rsi, r8d
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0xa0], 0
jne 0x14000a9c6
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x14000aa7a
call fcn.140008c24
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14000a9e5
mov ecx, 0x80004005
call fcn.1400052e0
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rcx, qword [rbx + 0xa0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0x118]
mov rdx, rsi
or rsi, 0xffffffffffffffff
mov r9, rsi
mov r8, qword [rsp + 0x40]
mov rcx, rdi
call fcn.140032804
test eax, eax
je 0x14000aa4d
cmp eax, 0xc
je 0x14000aa47
cmp eax, 0x16
je 0x14000aa41
cmp eax, 0x22
je 0x14000aa41
cmp eax, 0x50
je 0x14000aa4d
call fcn.1400093e4
int3
call fcn.1400093e4
int3
call fcn.14000939c
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x14000aa78
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14000f73c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.1400223e0
mov rsi, rax
test rax, rax
je 0x14000f7b8
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
test rbx, rbx
je 0x14000f7b3
cmp dword [rbx], 0x40
jb 0x14000f7b3
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x14000f7b3
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x14000f7bc
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140016f14
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x140016f7c
call fcn.14000b840
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140016f7c
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x140016f9e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.140016924
mov esi, eax
test rdi, rdi
je 0x140016f9c
test rbx, rbx
je 0x140016f9c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x140017db4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xb0], rdx
test rdx, 0xffffffffffff0000
jne 0x140017df3
cmp dword [rcx + 0xa8], 0
jne 0x140017df3
movzx eax, dx
mov dword [rcx + 0xa8], eax
call fcn.14000b840
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.140017d58
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14001dac4
Capabilities:
Get geographical location

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x2f0
mov rax, qword [0x14025e510]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov eax, r8d
mov rsi, rdx
mov rbx, rcx
cmp r8d, 0x800
jne 0x14001db36
lea r8, [0x1401deb48]
lea rcx, [rsp + 0xa0]
mov edx, 4
call fcn.140030e08
test eax, eax
je 0x14001db58
cmp eax, 0xc
je 0x14001db30
cmp eax, 0x16
je 0x14001db2a
cmp eax, 0x22
je 0x14001db2a
cmp eax, 0x50
je 0x14001db58
call fcn.1400093e4
int3
call fcn.1400093e4
int3
call fcn.14000939c
int3
mov r9d, 4
lea r8, [rsp + 0xa0]
mov ecx, eax
lea edx, [r9 - 1]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14001dc7b
call fcn.140032a14
mov edi, dword [rax]
call fcn.140032a14
lea rcx, [rsp + 0xb0]
and dword [rax], 0
lea rax, [rsp + 0xa0]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov esi, 0x112
lea r8d, [rsi - 1]
mov rdx, rsi
call fcn.1400329a8
mov ebx, eax
call fcn.140032a14
cmp dword [rax], 0
je 0x14001dbe0
call fcn.140032a14
cmp dword [rax], 0
je 0x14001dbe7
cmp dword [rax], 0xc
je 0x14001dbd5
cmp dword [rax], 0x16
je 0x14001dbca
cmp dword [rax], 0x22
je 0x14001dbca
cmp dword [rax], 0x50
je 0x14001dbe7
mov ecx, 0x80004005
call fcn.1400052e0
int3
mov ecx, 0x80070057
call fcn.1400052e0
int3
mov ecx, 0x8007000e
call fcn.1400052e0
int3
call fcn.140032a14
mov dword [rax], edi
cmp ebx, 0xffffffff
je 0x14001dc7b
cmp ebx, esi
jae 0x14001dc7b
lea rcx, [rsp + 0xb0]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
xor edx, edx
lea rcx, [rsp + 0x34]
lea r8d, [rdx + 0x6c]
mov rbx, rax
mov dword [rsp + 0x30], 0x70
call fcn.14002fb80
lea rcx, str.KERNEL32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001dc66
lea rdx, str.FindActCtxSectionStringW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001dc66
lea rcx, [rsp + 0x30]
xor edx, edx
mov r9, rbx
mov qword [rsp + 0x20], rcx
lea r8d, [rdx + 2]
xor ecx, ecx
call rax
mov rcx, rbx
test eax, eax
jne 0x14001dc6e
lea rcx, [rsp + 0xb0]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x14001dc7d
xor eax, eax
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.14002f990
add rsp, 0x2f0
pop rdi
pop rsi
pop rbx
ret

Function at 0x14002d414
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x14025e510]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
mov edx, 0x105
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x14002d44a
xor eax, eax
jmp 0x14002d496
lea rcx, [rsp + 0x20]
call fcn.14002f9b0
cmp word [rsp + rax*2 + 0x1e], 0x5c
je 0x14002d476
lea r8, [0x1401def20]
lea rcx, [rsp + 0x20]
mov edx, 0x105
call fcn.140033364
test eax, eax
jne 0x14002d446
lea rcx, [rsp + 0x20]
mov r8, rbx
mov edx, 0x105
call fcn.140033364
test eax, eax
jne 0x14002d446
lea rcx, [rsp + 0x20]
call fcn.14001bf88
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14002f990
add rsp, 0x240
pop rbx
ret
Function at 0x14002f78c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x14002f815
movsxd rax, dword [0x14000003c]
lea rdi, [0x140000000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x14002f7d7
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x14002f825
mov ecx, 0x20b
cmp word [rax + 0x18], cx
je 0x14002f7ed
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x14002f825
cmp dword [rax + 0x84], 0xe
ja 0x14002f801
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x14002f825
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xb0], ebx
jmp 0x14002f825
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
lea rdi, [0x140000000]
mov ecx, 1
call fcn.140428000
test eax, eax
jne 0x14002f855
cmp dword [0x1402716e0], 1
jne 0x14002f841
call fcn.14003393c
mov ecx, 0x1c
call fcn.140033714
mov ecx, 0xff
call fcn.140032fe8
call fcn.140034690
test eax, eax
jne 0x14002f880
cmp dword [0x1402716e0], 1
jne 0x14002f86c
call fcn.14003393c
mov ecx, 0x10
call fcn.140033714
mov ecx, 0xff
call fcn.140032fe8
call fcn.1400342f0
nop
call fcn.140034000
test eax, eax
jns 0x14002f899
mov ecx, 0x1b
call fcn.140032f7c
call sub.KERNEL32.dll_GetCommandLineW
mov qword [0x140276a88], rax
call fcn.140033f6c
mov qword [0x1402716d8], rax
call fcn.140033e7c
test eax, eax
jns 0x14002f8c4
mov ecx, 8
call fcn.140032f7c
call fcn.140033bac
test eax, eax
jns 0x14002f8d7
mov ecx, 9
call fcn.140032f7c
mov ecx, 1
call fcn.140033088
test eax, eax
je 0x14002f8ec
mov ecx, eax
call fcn.140032f7c
call fcn.140033b50
test byte [rsp + 0x6c], 1
movzx edx, word [rsp + 0x70]
mov r9d, 0xa
cmovne r9d, edx
mov r8, rax
xor edx, edx
mov rcx, rdi
call fcn.140198dc8
mov edi, eax
mov dword [rsp + 0x20], eax
test ebx, ebx
jne 0x14002f923
mov ecx, eax
call fcn.1400332c4
call fcn.1400332dc
jmp 0x14002f944
mov eax, edi
jmp 0x14002f94d
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
sub rsp, 0x28
call fcn.140034760
add rsp, 0x28
jmp 0x14002f78c
Function at 0x1400332d0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x140033138

Function at 0x1400348bb
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14025e510]
jne 0x14002f9aa
rol rcx, 0x10
test cx, 0xffff
jne 0x14002f9a6
repz ret
ror rcx, 0x10
jmp 0x140034814
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140271d20]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140271e18]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140034899
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140271d20]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400348bb
mov rax, qword [rsp + 0x88]
mov qword [0x140271e18], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140271db8], rax
mov rax, qword [0x140271e18]
mov qword [0x140271c90], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140271da0], rax
mov dword [0x140271c80], 0xc0000409
mov dword [0x140271c84], 1
mov rax, qword [0x14025e510]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14025e518]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140271d18], eax
mov ecx, 1
call fcn.14003e6b4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1401e3e20]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140271d18], 0
jne 0x140034942
mov ecx, 1
call fcn.14003e6b4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret