joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004fa78
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movsxd r8, dword [0x14000003c]
lea rdi, [0x140000000]
add r8, rdi
mov rsi, rdx
mov ebp, ecx
cmp dword [r8 + 0x84], 0xd
jbe 0x14004fb66
mov r9d, dword [r8 + 0xf0]
test r9d, r9d
je 0x14004fb66
movzx eax, word [r8 + 0x14]
lea rcx, [r8 + 0x18]
mov r10d, dword [r9 + rdi + 0xc]
add rcx, rax
movzx r11d, word [r8 + 6]
xor r9d, r9d
test r11d, r11d
je 0x14004faff
mov r8d, dword [rcx + 0xc]
cmp r10d, r8d
jb 0x14004faf3
mov edx, dword [rcx + 8]
lea eax, [rdx + r8]
cmp r10d, eax
jb 0x14004fb38
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x14004fade
mov eax, dword [rsp + 0x40]
xor ebx, ebx
mov edx, dword [rsp + 0x40]
test rbx, rbx
je 0x14004fb66
cmp dword [0x140147fc8], 0
jne 0x14004fb41
mov dword [0x140147fc8], 1
test eax, eax
js 0x14004fb2c
mov ecx, 0x19
int 0x29
mov rcx, rbx
mov edi, edx
call fcn.14004f9cc
jmp 0x14004fb43
mov eax, dword [rcx + 0x24]
lea rbx, [rdi + r8]
jmp 0x14004fb09
mov edi, edx
mov r9, rsi
mov r8d, ebp
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
nop dword [rax + rax]
test eax, eax
jne 0x14004fb6c
lea ecx, [rax + 0x19]
int 0x29
jmp 0x14004fb6c
mov dword [rsi], 4
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140052bec
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rax, qword [rcx]
lea r14, [rcx + 0x10]
xor r13d, r13d
mov qword [rcx + 8], rax
mov rsi, rcx
mov word [rax], r13w
mov rbx, qword [rcx + 8]
lea ebp, [r13 + 7]
sub rbx, qword [rcx]
mov ecx, 0xffffffff
sar rbx, 1
mov rax, qword [rsi]
cmp rax, r14
jne 0x140052c3d
mov rdi, rbp
jmp 0x140052c46
mov rdi, qword [r14]
sub rdi, rax
sar rdi, 1
sub rdi, rbx
lea rdx, [rax + rbx*2]
cmp rdi, rcx
mov r15d, edi
cmova r15d, ecx
lea rcx, str.TRACE_FORMAT_PREFIX
mov r8d, r15d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
mov r12d, eax
test eax, eax
jne 0x140052c9c
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
test eax, eax
je 0x140052c95
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
jmp 0x140052ca5
mov eax, 0x80004005
jmp 0x140052ca5
cmp r12d, r15d
mov eax, r13d
setae al
mov rcx, r12
test eax, eax
je 0x140052cdf
js 0x140052ce2
cmp rcx, rdi
jbe 0x140052cd8
lea rdx, [r12 + rbx]
cmp rdx, rcx
jb 0x140052cd1
mov rcx, rsi
call fcn.1400527b0
mov ecx, 0xffffffff
test al, al
jne 0x140052c30
mov eax, 0x8007000e
jmp 0x140052ce2
mov eax, 0x8000ffff
jmp 0x140052ce2
add rbx, rcx
mov rcx, qword [rsi]
cmp rcx, r14
je 0x140052cf3
mov rbp, qword [r14]
sub rbp, rcx
sar rbp, 1
cmp rbx, rbp
jbe 0x140052cfa
int 0x2c
mov rbp, qword [rsp + 0x58]
lea rcx, [rcx + rbx*2]
mov rbx, qword [rsp + 0x50]
mov qword [rsi + 8], rcx
mov rsi, qword [rsp + 0x60]
mov word [rcx], r13w
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x140053020
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.1400531c4
mov qword [rdi + 0x28], rax
test rax, rax
jne 0x14005304c
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
jmp 0x1400530de
xor r9d, r9d
lea r8, [0x140089948]
lea rdx, str.WEVT_TEMPLATE
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x14005308e
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, rdi
mov ebx, eax
call fcn.1400530f0
mov eax, ebx
jmp 0x1400530de
mov rcx, qword [rdi + 0x28]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
nop dword [rax + rax]
mov qword [rdi + 0x20], rax
test rax, rax
je 0x140053074
mov rcx, qword [rdi + 0x28]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
nop dword [rax + rax]
mov dword [rdi + 0x18], eax
test eax, eax
je 0x140053074
mov rcx, qword [rdi + 0x20]
call qword [sym.imp.KERNEL32.dll_LockResource]
nop dword [rax + rax]
mov qword [rdi], rax
test rax, rax
je 0x140053074
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14005cd2c
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor esi, esi
xor ebx, ebx
cmp qword [0x140147708], rbx
jne 0x14005ce8c
xor r8d, r8d
lea rcx, str.TRACE_FORMAT_SEARCH_PATH
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
mov edi, eax
jmp 0x14005cdd0
mov edx, edi
sub edx, esi
test edx, edx
jle 0x14005cdb3
test rbx, rbx
je 0x14005cd84
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
lea eax, [rdi + 1]
movsxd rsi, eax
add rsi, rsi
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x14005cdd4
mov r8, rsi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov esi, edi
mov r8d, esi
lea rcx, str.TRACE_FORMAT_SEARCH_PATH
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
mov edi, eax
sub eax, esi
test eax, eax
jg 0x14005cd68
xor eax, eax
lock cmpxchg qword [0x140147708], rbx
je 0x14005cdf0
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
cmp qword [0x140147708], 0
jne 0x14005ce8c
mov ecx, 0x208
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x14005ce70
mov rdx, rax
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x14005ce36
cmp eax, 0x103
jle 0x14005ce70
mov rax, qword [0x1401476f8]
test rax, rax
je 0x14005ce5f
cmp dword [0x1401476f0], 0
lea rcx, str.Could_Not_get_current_dir_n
jne 0x14005ce5a
call qword [0x14007ef80]
jmp 0x14005ce5f
call fcn.140061c74
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
xor ebx, ebx
xor eax, eax
lock cmpxchg qword [0x140147708], rbx
je 0x14005ce8c
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rax, qword [0x140147708]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14005d2d4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
cmp qword [rcx + 0x10], rcx
jne 0x14005d300
mov rdi, rcx
jmp 0x14005d35e
mov rbp, qword [rcx]
mov r15, rbx
lea rcx, [rbp + 0x18]
mov r8d, InitCommonControls
mov rdx, r14
call sub.msvcrt.dll_memcmp
test eax, eax
mov rdi, rbp
setns al
test al, al
movzx eax, al
cmove rdi, r15
xor rax, 1
mov r15, rdi
mov rbp, qword [rbp + rax*8 + 8]
lea rax, [0x14013bf78]
cmp rbp, rax
jne 0x14005d306
cmp rdi, rbx
je 0x14005d35e
lea rdx, [rdi + 0x18]
mov r8d, InitCommonControls
mov rcx, r14
call sub.msvcrt.dll_memcmp
test eax, eax
cmovs rdi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rbp, qword [rsp + 0x48]
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140066f90
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, qword [rcx]
lea r15, [rcx + 0x10]
xor r13d, r13d
mov qword [rcx + 8], rax
mov r12, rdx
mov r14, rcx
mov word [rax], r13w
mov rdi, qword [rcx + 8]
lea esi, [r13 + 7]
sub rdi, qword [rcx]
sar rdi, 1
mov rax, qword [r14]
cmp rax, r15
jne 0x140066fe3
mov rbx, rsi
jmp 0x140066fec
mov rbx, qword [r15]
sub rbx, rax
sar rbx, 1
sub rbx, rdi
lea rbp, [rax + rdi*2]
cmp rbx, 0x7fffffff
jbe 0x140067001
or eax, 0xffffffff
jmp 0x140067004
lea eax, [rbx + rbx]
mov dword [rsp + 0x70], eax
xor r9d, r9d
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x70]
shr ecx, 1
mov dword [rsp + 0x70], ecx
test eax, eax
jne 0x140067059
mov edx, r13d
test ecx, ecx
je 0x140067075
lea r8d, [rcx - 1]
cmp word [rbp + r8*2], r13w
jne 0x140067075
mov dword [rsp + 0x70], r8d
mov ecx, r8d
jmp 0x140067075
cmp eax, 0xea
jne 0x140067067
mov edx, 1
jmp 0x140067075
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
mov eax, ecx
test edx, edx
je 0x1400670a9
js 0x1400670ac
cmp rax, rbx
jbe 0x1400670a2
lea rdx, [rax + rdi]
cmp rdx, rax
jb 0x14006709b
mov rcx, r14
call fcn.1400527b0
test al, al
jne 0x140066fd6
mov edx, 0x8007000e
jmp 0x1400670ac
mov edx, 0x8000ffff
jmp 0x1400670ac
add rdi, rax
mov rax, qword [r14]
cmp rax, r15
je 0x1400670bd
mov rsi, qword [r15]
sub rsi, rax
sar rsi, 1
cmp rdi, rsi
jbe 0x1400670c4
int 0x2c
mov rbx, qword [rsp + 0x60]
lea rcx, [rax + rdi*2]
mov rbp, qword [rsp + 0x68]
mov eax, edx
mov rsi, qword [rsp + 0x78]
mov qword [r14 + 8], rcx
mov word [rcx], r13w
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140068080
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x14013bf40]
xor rax, rsp
mov qword [rsp + 0x470], rax
xor r12d, r12d
mov rsi, rcx
mov r14d, r12d
mov r15d, 0x1000000
mov ebx, r12d
mov ebp, r12d
cmp qword [rcx + 8], r12
jne 0x1400680e0
lea rcx, str.load__modname____you_must_specify_a_module_to_load_n
call qword [sym.imp.msvcrt.dll_printf]
nop dword [rax + rax]
xor eax, eax
jmp 0x140068299
mov ecx, 0x104
lea rax, [rsp + 0x260]
mov qword [rsp + 0x40], rcx
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x50]
mov rcx, qword [rsi]
xor edx, edx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.msvcrt.dll__wsplitpath_s]
nop dword [rax + rax]
cmp word [rsp + 0x260], r12w
jne 0x14006813c
mov rdi, qword [0x14013eba8]
mov r14d, 1
jmp 0x14006816e
lea rdx, str..pdb
lea rcx, [rsp + 0x260]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140068167
mov rdi, qword [0x14013eba8]
lea ebp, [rax + 1]
jmp 0x14006816e
mov rdi, qword [0x14013e690]
cmp qword [0x14013e448], r12
je 0x14006817c
call fcn.140067fc4
lea rax, [rsp + 0x50]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r12w
jne 0x140068185
lea rdx, [rsp + 0x50]
lea rcx, [0x140147690]
call fcn.140052a30
test al, al
jne 0x1400681bf
mov rdx, qword [rsi]
lea rcx, str.error_out_of_memory_loading__ls_n
call qword [sym.imp.msvcrt.dll_printf]
nop dword [rax + rax]
jmp 0x1400680d9
test ebp, ebp
jne 0x140068206
mov rcx, qword [rsi]
xor r9d, r9d
mov qword [rsp + 0x30], r12
xor r8d, r8d
mov dword [rsp + 0x28], r12d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov rcx, rax
xor edx, edx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
nop dword [rax + rax]
mov r15d, eax
mov r8, qword [rsi]
lea r9, [rsp + 0x50]
mov rcx, qword [0x14013e698]
mov rdx, rbx
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.dbghelp.dll_SymLoadModuleExW]
nop dword [rax + rax]
test rax, rax
jne 0x140068278
mov rax, qword [0x140147690]
mov qword [0x140147698], rax
mov word [rax], r12w
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r8, qword [rsi]
lea rcx, str.error_0x_x_loading__ls._n
mov edx, eax
call qword [sym.imp.msvcrt.dll_printf]
nop dword [rax + rax]
jmp 0x1400680d9
mov qword [0x14013e448], rax
cmp rbx, 0xffffffffffffffff
je 0x140068294
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov eax, 1
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.14006e720
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14006bf2c
Capabilities:
Check if file exists

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, reloc.MFC42u.dll_CDaoException::CDaoException
mov rax, qword [0x14013bf40]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov r15, r9
mov r14, r8
mov rbp, rdx
mov rbx, rcx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop dword [rax + rax]
xor r8d, r8d
mov rdx, rbp
mov rcx, rax
mov rsi, rax
call qword [sym.imp.imagehlp.dll_SymInitialize]
nop dword [rax + rax]
mov ecx, 0x680
call qword [sym.imp.imagehlp.dll_SymSetOptions]
nop dword [rax + rax]
mov eax, dword [r15]
lea rcx, [rsp + 0x40]
mov r12d, 0x104
lea r9d, [rdi + 2]
mov qword [rsp + 0x38], r12
mov r8, rbx
mov qword [rsp + 0x30], rcx
xor edx, edx
mov qword [rsp + 0x28], rax
mov rcx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.imagehlp.dll_SymGetSymbolFile]
nop dword [rax + rax]
test eax, eax
jne 0x14006c0bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
cmp eax, 2
jne 0x14006c0bd
xor eax, eax
cmp byte [rbx], al
je 0x14006bffb
inc rax
cmp byte [rax + rbx], 0
jne 0x14006bff2
mov rcx, rbx
cmp rax, 2
jb 0x14006c00e
cmp byte [rbx + 1], 0x3a
jne 0x14006c00e
lea rcx, [rbx + 2]
add rax, rbx
mov rdx, rax
jmp 0x14006c028
dec rax
cmp byte [rax], 0x2e
je 0x14006c02f
cmp byte [rax], 0x2f
je 0x14006c046
cmp byte [rax], 0x5c
je 0x14006c046
cmp rax, rcx
jne 0x14006c016
jmp 0x14006c046
mov rdx, rax
jmp 0x14006c041
dec rax
cmp byte [rax], 0x2f
je 0x14006c046
cmp byte [rax], 0x5c
je 0x14006c046
cmp rax, rcx
jne 0x14006c034
cmp byte [rdx], 0x2e
lea rax, [rdx + 1]
mov r9, rbp
lea r8, str._s_s
cmovne rax, rdx
lea rcx, [rsp + reloc.MFC42u.dll_CDocObjectServerItem::CDocObjectServerItem]
mov rdx, r12
mov qword [rsp + 0x20], rax
call fcn.140062d30
mov eax, dword [r15]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x38], r12
lea rdx, [rsp + reloc.MFC42u.dll_CDocObjectServerItem::CDocObjectServerItem]
mov qword [rsp + 0x30], rcx
xor edi, edi
mov qword [rsp + 0x28], rax
mov r8, rbx
xor ecx, ecx
mov qword [rsp + 0x20], r14
lea r9d, [rdi + 2]
call qword [sym.imp.imagehlp.dll_SymGetSymbolFile]
nop dword [rax + rax]
test eax, eax
jne 0x14006c0bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov rcx, rsi
call qword [sym.imp.imagehlp.dll_SymCleanup]
nop dword [rax + rax]
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14006e720
add rsp, reloc.MFC42u.dll_CDaoException::CDaoException
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14006c384
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
lea rax, [rbp - 0x10]
mov byte [rbp - 0x10], 0
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x20]
lea rax, [rbp - 0x10]
mov dword [0x14013ab20], 1
mov edx, 0x104
mov qword [rbp - 0x18], rax
call fcn.14006b844
test al, al
je 0x14006c452
mov rdx, qword [rbp - 0x20]
lea rcx, str._NT_SYMBOL_PATH
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 0x104
jbe 0x14006c416
mov edx, ebx
lea rcx, [rbp - 0x20]
call fcn.14006b844
test al, al
je 0x14006c452
mov rdx, qword [rbp - 0x20]
lea rcx, str._NT_SYMBOL_PATH
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
nop dword [rax + rax]
mov ebx, eax
test ebx, ebx
je 0x14006c452
mov r8, qword [rbp - 0x18]
lea rcx, [0x14013aae0]
mov rdx, qword [rbp - 0x20]
sub r8, rdx
call fcn.140069fcc
test al, al
je 0x14006c452
mov rax, qword [0x140147b30]
test rax, rax
je 0x14006c452
mov rdx, qword [rbp - 0x20]
lea rcx, str._NT_SYMBOL_PATH___s
call qword [0x14007ef80]
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x10]
cmp rcx, rax
je 0x14006c46b
lea rdx, [0x140080f44]
call fcn.14006eb30
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x40
pop rbp
ret
Function at 0x14006e480
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140147fa0], rbx
je 0x14006e4e7
cmp rax, rbx
jne 0x14006e4da
mov ebx, 1
mov esi, ebx
jmp 0x14006e4ec
mov ecx, COleDocument::AddItem
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14006e4bf
mov ebx, 1
mov eax, dword [0x140147fa8]
cmp eax, ebx
jne 0x14006e504
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14006e570
mov eax, dword [0x140147fa8]
test eax, eax
jne 0x14006e565
mov dword [0x140147fa8], ebx
lea r15, [0x14007f0a8]
lea rdi, [0x14007f090]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14006e557
test eax, eax
jne 0x14006e55b
cmp qword [rdi], r14
je 0x14006e54c
mov rax, qword [rdi]
mov rcx, qword [0x14007ef80]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14006e52e
test eax, eax
je 0x14006e56b
mov eax, 0xff
jmp 0x14006e6c6
mov dword [0x14013cb40], ebx
mov edi, 0x1f
mov eax, dword [0x140147fa8]
cmp eax, ebx
jne 0x14006e597
lea rdx, [0x14007f088]
lea rcx, [0x14007ef88]
call sub.msvcrt.dll__initterm
mov dword [0x140147fa8], 2
test esi, esi
jne 0x14006e5a5
mov rax, r14
xchg qword [0x140147fa0], rax
cmp qword [0x140147fc0], r14
je 0x14006e5d8
lea rcx, [0x140147fc0]
call fcn.14006efd0
test eax, eax
je 0x14006e5d8
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140147fc0]
mov r9, qword [0x14007ef80]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14006e5f1
mov eax, 0xff
jmp 0x14006e6c6
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14006e677
test ax, ax
je 0x14006e60c
test edx, edx
jne 0x14006e677
sub ax, bx
cmp ax, di
ja 0x14006e622
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14006e60c
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.14006f408
mov dword [0x14013cb3c], eax
cmp dword [0x14013cb60], r14d
jne 0x14006e660
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14013cb40], r14d
jne 0x14006e675
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14013cb3c]
jmp 0x14006e6c6
cmp ax, 0x22
jne 0x14006e68b
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14006e5fa
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.1401ee000
add rsp, 0x28
jmp 0x14006e480
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400b0c30]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1400b0c40]
mov dword [rax], 1
mov rax, qword [0x1400b0c50]
mov dword [rax], 1
mov rax, qword [0x1400b0bb0]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x1400b0c20]
mov dword [0x1400b900c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x1400b0d10]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x1400b0cf0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x1400b09a0]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x140014ec0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]

Function at 0x140014f30
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400b90b4]
mov rbx, rcx
test esi, esi
jle 0x140015060
mov rax, qword [0x1400b90b8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140014f7b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140015005
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140014f60
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
mov rdi, rax
test rax, rax
je 0x140015082
mov rax, qword [0x1400b90b8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call dbg._GetPEImageBase
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400b90b8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140015067
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140014ffe
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x140015010
add dword [0x1400b90b4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1400b90b8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140014ffe
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop dword [rax]
xor esi, esi
jmp 0x140014f88
mov rax, qword [0x1400b90b8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140015610
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x1400b9120]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400b9100]
test rbx, rbx
je 0x14001566c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x140015663
test eax, eax
jne 0x140015663
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140015648
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]