joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000d060
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x18000d09c
mov ecx, 5
int 0x29
mov ecx, 2
call fcn.180011090
xorps xmm0, xmm0
lea rcx, [rbp + 0x10]
xor eax, eax
xor edx, edx
mov r8d, 0x4d0
mov qword [rbp], rax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x10]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rbp + 0x108]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x18000d158
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], 0
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0x4f8]
add rax, 8
mov dword [rsp + 0x70], 0xc0000417
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x74], 1
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x18000d1be
test ebx, ebx
jne 0x18000d1be
lea ecx, [rax + 2]
call fcn.180011090
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.180010e20
mov rbx, qword [rsp + 0x600]
add rsp, 0x5f0
pop rbp
ret
Function at 0x180010d10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp dword [rcx], 0xe06d7363
mov rdi, r9
mov rbp, r8
mov r14, rdx
mov rsi, rcx
jne 0x180010dcc
mov rax, qword [r9 + 0x38]
mov qword [rsp + 0x48], rbx
mov ebx, dword [rax]
add rbx, qword [r9 + 8]
mov eax, dword [rbx]
and eax, 0x1fffffff
sub eax, 0x19930521
cmp eax, 1
ja 0x180010dc7
mov eax, 1
xchg dword [0x18177a1c8], eax
cmp eax, 1
jne 0x180010d80
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
xchg dword [0x18177a1c8], eax
cmp eax, 1
je 0x180010d65
mov edx, 4
lea r9, [rsp + 0x40]
mov rcx, rbx
lea r8d, [rdx + 0x3c]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180010dbf
and dword [rbx], 0xf9930520
lea r9, [rsp + 0x40]
or dword [rbx], 0x19930520
mov edx, 4
mov r8d, dword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
xchg dword [0x18177a1c8], eax
mov rbx, qword [rsp + 0x48]
mov r9, rdi
mov r8, rbp
mov rdx, r14
mov rcx, rsi
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
jmp qword [sym.imp.msvcrt.dll___CxxFrameHandler]
Function at 0x140001a30
Capabilities:
Hash data via bcrypt

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
lea rcx, [rax + 8]
call fcn.140001314
mov rcx, qword [0x140026778]
xor r14d, r14d
mov rdi, qword [rsp + 0x40]
mov r15d, 7
test rcx, rcx
je 0x140001abd
lea edx, [r15 + 0x55]
call qword [sym.imp.msvcrt.dll_wcsrchr]
nop dword [rax + rax]
test rax, rax
jne 0x140001a89
mov rax, qword [0x140026778]
jmp 0x140001a8d
add rax, 2
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], r14w
jne 0x140001a91
lea r8d, [rcx + rcx]
xor r9d, r9d
mov rcx, qword [rdi]
mov rdx, rax
call qword [sym.imp.bcrypt.dll_BCryptHashData]
nop dword [rax + rax]
test eax, eax
jns 0x140001abd
mov rcx, r15
int 0x29
cmp word [0x140026748], r14w
je 0x140001b72
mov qword [0x140026838], r14
mov rsi, r14
mov ebp, 4
mov edx, 0x2e
lea rcx, [0x140026748]
call qword [sym.imp.msvcrt.dll_wcsrchr]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x140001b2d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], r14w
jne 0x140001afe
cmp rax, 1
jne 0x140001b23
mov rcx, qword [0x140026778]
lea r8, str.Invalid_file_version_custom_format__correct_format_is_e.g.__6.0.5000.1234__n
xor edx, edx
call fcn.1400038f0
mov word [rbx], r14w
add rbx, 2
jmp 0x140001b34
lea rbx, [0x140026748]
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0xa]
call qword [sym.imp.msvcrt.dll_wcstoul]
nop dword [rax + rax]
mov rcx, rsi
mov eax, eax
shl rax, cl
add rsi, 0x10
mov rcx, qword [0x140026838]
or rcx, rax
mov qword [0x140026838], rcx
sub rbp, 1
jne 0x140001ada
jmp 0x140001b79
mov rcx, qword [0x140026838]
test rcx, rcx
je 0x140001ba4
mov rcx, qword [rdi]
lea rdx, [0x140026838]
xor r9d, r9d
lea r8d, [r9 + 8]
call qword [sym.imp.bcrypt.dll_BCryptHashData]
nop dword [rax + rax]
test eax, eax
jns 0x140001ba4
mov rcx, r15
int 0x29
mov rcx, qword [rdi]
lea rdx, [0x140026728]
xor r9d, r9d
lea r8d, [r9 + 0x20]
call qword [sym.imp.bcrypt.dll_BCryptFinishHash]
nop dword [rax + rax]
test eax, eax
jns 0x140001bca
mov rcx, r15
int 0x29
mov rcx, qword [rdi]
call qword [sym.imp.bcrypt.dll_BCryptDestroyHash]
nop dword [rax + rax]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x48]
mov al, 1
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140001ff4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor r13d, r13d
mov r12b, r9b
mov r15, r8
mov rbx, rdx
mov rsi, rcx
test rcx, rcx
je 0x140002070
test rdx, rdx
je 0x140002070
test r9b, r9b
mov word [rdx], r13w
lea rax, str..mui
mov r8, rcx
lea r14, [0x14001add0]
mov rdx, r15
mov rcx, rbx
cmovne r14, rax
call fcn.1400014f4
test eax, eax
jns 0x140002090
lea r8, str.Failed_to_create_unique_temporary_file_name_for__s__0x_x_._n
mov r9, rsi
mov dword [rsp + 0x20], eax
xor edx, edx
lea rcx, [0x14001a968]
call fcn.1400038f0
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rbx + rdi*2], r13w
jne 0x140002094
mov r8, r14
mov rdx, r15
mov rcx, rbx
call fcn.1400014f4
test eax, eax
jns 0x1400020b9
lea r8, str.Failed_to_create_unique_temporary_file_name_for__s__0x_x__n
jmp 0x14000205b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14000215f
lea rbp, [rdi + 1]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rbx + rcx*2], r13w
jne 0x1400020d9
lea rdx, [rbx + rbp*2]
cmp rbp, rcx
jae 0x1400020f9
sub rcx, rbp
movzx eax, r13w
mov rdi, rdx
rep stosw word [rdi], ax
test r12b, r12b
je 0x140002111
mov rax, qword [0x140026848]
inc rax
mov qword [0x140026848], rax
jmp 0x140002122
mov rax, qword [0x140026830]
inc rax
mov qword [0x140026830], rax
mov r8, r15
mov r9d, 0xa
sub r8, rbp
mov ecx, eax
call fcn.140016f94
mov r8, r14
mov rdx, r15
mov rcx, rbx
call fcn.1400014f4
test eax, eax
js 0x140002166
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
jne 0x1400020d5
mov al, 1
jmp 0x140002072
lea r8, str.Failed_to_add_extension_to_unique_temporary_file_name_for__s__0x_x__n
jmp 0x14000205b
Function at 0x14000485c
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x140026110]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
nop dword [rax + rax]
lea rcx, [0x14001bf90]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
nop dword [rax + rax]
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
nop dword [rax + rax]
xor ebx, ebx
test eax, eax
jne 0x1400048ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
xor r8d, r8d
lea rdx, [0x14001a968]
mov r9d, eax
lea ecx, [rbx + 4]
call fcn.140003a4c
lea eax, [rbx + 6]
mov dword [rsp + 0x24], eax
jmp 0x1400048ee
mov eax, dword [rsp + 0x24]
cmp eax, 6
jb 0x140004983
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
nop dword [rax + rax]
lea rcx, [0x14001bf90]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
nop dword [rax + rax]
test rdi, rdi
je 0x14000497f
test rax, rax
je 0x14000497f
lea rdx, str.EnumResourceTypesExW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
lea rdx, str.EnumResourceNamesExW
mov rcx, rdi
mov qword [0x1400267b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
lea rdx, str.EnumResourceLanguagesExW
mov rcx, rdi
mov qword [0x1400267a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rbx, rax
jmp 0x140004991
xor al, al
jmp 0x14000499a
mov qword [0x1400267b0], rbx
mov qword [0x1400267a8], rbx
mov qword [0x1400267b8], rbx
mov al, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400168f0
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rdi
ret

Function at 0x1400049c4
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1400267b0]
xor r9d, r9d
test rax, rax
je 0x1400049ef
mov word [rsp + 0x20], r9w
mov r9d, 1
call qword [case.0x140006774.0]
add rsp, 0x38
ret
add rsp, 0x38
jmp qword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
Function at 0x140004ff8
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140026110]
xor rax, rsp
mov qword [rsp + 0x48], rax
and qword [rsp + 0x30], 0
mov rsi, rdx
mov rcx, rsi
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov dword [rsp + 0x20], 2
xor r8d, r8d
mov edx, 0xc0000000
xor r14b, r14b
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140005081
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea rdx, [0x14001a968]
xor r8d, r8d
mov r9d, eax
lea ecx, [r8 + 4]
call fcn.140003a4c
xor al, al
jmp 0x1400051b4
cmp byte [0x140026841], r14b
je 0x1400050a5
xor edx, edx
lea rcx, str.Muirctdl.dll
lea r8d, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
nop dword [rax + rax]
jmp 0x1400050b3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
nop dword [rax + rax]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400050cd
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rdx, rsi
jmp 0x14000506b
xor r9d, r9d
mov rcx, rbx
lea edx, [r9 + 0x14]
lea r8d, [r9 + 0x64]
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
jne 0x140005113
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
xor r8d, r8d
lea rdx, [0x14001a968]
mov r9d, eax
lea ecx, [r8 + 4]
call fcn.140003a4c
jmp 0x140005180
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
nop dword [rax + rax]
mov rbp, rax
test rax, rax
je 0x140005180
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
nop dword [rax + rax]
mov rcx, rbp
mov esi, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
nop dword [rax + rax]
test rax, rax
je 0x140005180
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, esi
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
test eax, eax
je 0x1400050ef
mov r14b, 1
test rdi, rdi
je 0x140005194
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
cmp byte [0x140026841], 0
je 0x1400051b1
test rbx, rbx
je 0x1400051b1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
mov al, r14b
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400168f0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400051e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor ebp, ebp
mov r15, rcx
mov r14b, bpl
test rdx, rdx
je 0x140005428
mov rbx, qword [rdx + 0x30]
movzx eax, word [rdx + 0x52]
mov word [rsp + 0x88], ax
test rbx, rbx
je 0x140005428
mov rdx, rbx
call fcn.140004ff8
test al, al
je 0x140005428
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
nop dword [rax + rax]
mov qword [rsp + 0x98], rax
test rax, rax
je 0x14000537b
mov rcx, qword [r15 + 0x70]
mov rdi, qword [rcx + 0x10]
test rdi, rdi
je 0x140005369
mov r13, qword [rdi + 0x18]
mov rsi, qword [rdi + 0x10]
jmp 0x14000534b
mov r12, qword [rsi + 0x18]
mov rbp, qword [rsi + 0x10]
jmp 0x14000533e
movzx ebx, word [rbp + 0x20]
mov r8, r12
mov rcx, qword [r15 + 8]
movzx r9d, bx
mov rdx, r13
mov word [rsp + 0x90], bx
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
nop dword [rax + rax]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400053dc
mov rcx, qword [r15 + 8]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
nop dword [rax + rax]
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14000539d
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
nop dword [rax + rax]
movzx ecx, word [rsp + 0x88]
mov r8, r12
movzx r9d, word [rsp + 0x90]
test cx, cx
mov dword [rsp + 0x28], ebx
mov rdx, r13
cmovne r9w, cx
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_UpdateResourceW]
nop dword [rax + rax]
xor ebx, ebx
test eax, eax
je 0x1400053a5
mov rbp, qword [rbp + 8]
test rbp, rbp
jne 0x14000527b
mov rsi, qword [rsi + 8]
test rsi, rsi
jne 0x14000526e
mov rdi, qword [rdi + 8]
test rdi, rdi
jne 0x140005261
mov rax, qword [rsp + 0x98]
mov rcx, rax
call fcn.140011944
test eax, eax
setne r14b
test eax, eax
jne 0x14000539d
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
xor r8d, r8d
lea rdx, [0x14001a968]
mov r9d, eax
lea ecx, [r8 + 4]
call fcn.140003a4c
mov al, r14b
jmp 0x14000542a
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
xor r8d, r8d
lea rdx, [0x14001a968]
mov r9d, eax
lea ecx, [r8 + 4]
call fcn.140003a4c
movzx eax, r12w
lea r8, str.Resource_Type___d__Name___d__LangID___d___n
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
jmp 0x140005411
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
xor r8d, r8d
lea rdx, [0x14001a968]
mov r9d, eax
lea ecx, [r8 + 4]
call fcn.140003a4c
movzx ecx, r12w
lea r8, str.Failed_to_find_resource_from_the_source_Type___d___Name___d__LangID__d___n
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ecx
movzx r9d, r13w
lea rcx, [0x14001a968]
xor edx, edx
call fcn.1400038f0
jmp 0x14000539d
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000773c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
xor r9d, r9d
test rdx, rdx
je 0x140007789
movzx eax, word [rdx]
cmp r9w, ax
je 0x14000776d
mov ecx, r9d
mov r8d, 0x2e
cmp r8w, ax
je 0x140007785
inc rcx
movzx eax, word [rdx + rcx*2]
cmp r9w, ax
jne 0x140007754
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x140007789
test al, 0x20
je 0x140007789
mov al, 1
jmp 0x14000778b
xor al, al
add rsp, 0x28
ret

Function at 0x140007e80
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x140026110]
xor rax, rsp
mov qword [rsp + 0x50], rax
and qword [rsp + 0x30], 0
mov rdi, rdx
mov r15, qword [rsp + 0xb0]
mov r14, r9
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rdi
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140007f0c
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
xor r8d, r8d
mov rdx, rdi
mov r9d, eax
lea ecx, [r8 + 4]
call fcn.140003a4c
xor al, al
jmp 0x140007fa6
lea rdx, [rsp + 0x48]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop dword [rax + rax]
test eax, eax
je 0x140007ee7
mov rsi, qword [rsp + 0x48]
mov r8d, 1
mov rdx, rsi
call fcn.140003670
mov rbx, rax
test rax, rax
je 0x140007f05
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, esi
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop dword [rax + rax]
test eax, eax
jne 0x140007f9e
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
xor r8d, r8d
mov rdx, rdi
mov r9d, eax
lea ecx, [r8 + 4]
call fcn.140003a4c
mov rcx, qword [0x1400260b8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
jmp 0x140007f05
mov qword [r14], rbx
mov al, 1
mov qword [r15], rsi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400168f0
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140011bbc
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor edx, edx
mov rcx, qword gs:[0x60]
mov r8, qword [rbx + 0x28]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov r8, qword [rbx + 8]
and qword [rbx + 0x28], 0
cmp dword [r8], 2
jne 0x140011c13
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
and qword [rbx + 8], 0
mov r8, qword [rbx + 0x18]
cmp dword [r8], 2
jne case.default.0x140011c54
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
and qword [rbx + 0x18], 0
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.ntdll.dll_RtlFreeHeap]
adc esp, ebp
invalid
movabs al, byte [0xdb3cff5f8b89aacf]
cdq
enter 0x4623, 0xffffffffffffff94
invalid
movsd dword [rdi], dword [rsi]
or dword [rdx - 0x3f59bbd6], ebx
stosb byte [rdi], al
invalid
Function at 0x140011c68
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 0x18]
mov rdi, rcx
test rbx, rbx
je 0x140011d13
mov rax, rbx
mov rax, qword [rax]
mov qword [rdi + 0x18], rax
jmp 0x140011c9a
mov rax, qword [rax]
mov qword [rbx + 0x18], rax
call fcn.140011bbc
mov rax, qword [rbx + 0x18]
mov rcx, rax
test rax, rax
jne 0x140011c8e
jmp 0x140011cb4
mov rax, qword [rax]
mov qword [rbx + 0x20], rax
call fcn.140011bbc
mov rax, qword [rbx + 0x20]
mov rcx, rax
test rax, rax
jne 0x140011ca8
mov r8, qword [rbx + 8]
cmp dword [r8], 2
jne 0x140011ce5
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rbx, qword [rdi + 0x18]
mov rax, rbx
test rbx, rbx
jne 0x140011c85
mov rbx, qword [rdi + 0x20]
test rbx, rbx
je 0x140011d84
mov rax, rbx
mov rax, qword [rax]
mov qword [rdi + 0x20], rax
jmp 0x140011d34
mov rax, qword [rax]
mov qword [rbx + 0x18], rax
call fcn.140011bbc
mov rax, qword [rbx + 0x18]
mov rcx, rax
test rax, rax
jne 0x140011d28
jmp 0x140011d4e
mov rax, qword [rax]
mov qword [rbx + 0x20], rax
call fcn.140011bbc
mov rax, qword [rbx + 0x20]
mov rcx, rax
test rax, rax
jne 0x140011d42
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rbx, qword [rdi + 0x20]
mov rax, rbx
test rbx, rbx
jne 0x140011d1f
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140011de0
cmp dword [rbx], 1
mov rdi, qword [rbx + 8]
jne 0x140011dba
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbx + 0x18]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
and qword [rbx + 0x18], 0
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rbx, rdi
test rdi, rdi
jne 0x140011d8d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140011df4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r15d, ecx
mov ebp, r8d
mov rcx, qword gs:[0x60]
mov r14d, edx
xor edi, edi
mov r12d, 0x1000
mov r8d, r12d
mov rcx, qword [rcx + 0x30]
lea edx, [rdi + 8]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x140011ebe
mov r8, r12
xor edx, edx
mov rcx, rbx
call sub.msvcrt.dll_memset
jmp 0x140011e9a
cmp ebp, r12d
mov esi, r12d
mov rdx, rbx
mov ecx, r15d
cmovbe esi, ebp
mov r8d, esi
sub ebp, esi
call qword [sym.imp.KERNEL32.dll__lread]
nop dword [rax + rax]
xor ecx, ecx
cmp eax, esi
cmovne ecx, eax
test ecx, ecx
jne 0x140011e9e
add edi, esi
mov r8d, esi
mov rdx, rbx
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll__lwrite]
nop dword [rax + rax]
test ebp, ebp
jne 0x140011e58
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret