joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002fc68
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x160
mov rax, qword [0x14007bec0]
mov qword [rsp + 0x158], rax
mov esi, ecx
mov edi, 8
lea rdx, [0x14007b620]
lea rcx, [rsp + 0x30]
mov r8d, edi
call fcn.14002c848
mov rbx, qword [rsp + 0x30]
lea rdx, [0x14007b5f0]
lea rcx, [rsp + 0x30]
mov r8d, edi
call fcn.14002c848
mov rbp, qword [rsp + 0x30]
lea rdx, [0x14007b628]
lea rcx, [rsp + 0x30]
mov r8d, edi
call fcn.14002c848
mov r12, qword [rsp + 0x30]
lea r8d, [rdi + 0xc]
lea rcx, [rsp + 0x140]
xor edx, edx
call fcn.14002ef58
cmp esi, 1
lea r8d, [rdi + 8]
lea rcx, [rsp + 0x140]
jne 0x14002fd24
lea rdx, [0x14007b598]
call fcn.14002c848
lea r11, [rsp + 0x140]
lea eax, [rdi - 4]
xor dword [r11], 0x3dd17ea6
add r11, 4
dec rax
jne 0x14002fd12
jmp 0x14002fd55
lea rdx, [0x14007b5a8]
call fcn.14002c848
lea r11, [rsp + 0x140]
mov eax, 4
xor dword [r11], 0x3dd17ea6
add r11, 4
dec rax
jne 0x14002fd3d
mov byte [rsp + 0x151], 0x6c
lea rcx, [rsp + 0x140]
mov byte [rsp + 0x150], 0x6c
call rbx
test rax, rax
mov rdi, rax
je 0x14002fe29
lea rdx, [0x14007b2f0]
mov r8d, pe_nt_image_headers64
mov rcx, rax
call fcn.1400300d8
test eax, eax
je 0x14002fde3
call fcn.14002feb8
cmp eax, 3
je 0x14002fded
cmp eax, 4
je 0x14002fded
cmp eax, 5
je 0x14002fded
cmp qword [0x14007b3f0], 0xffffffffffffffff
jne 0x14002fded
lea rax, [rsp + 0x38]
lea r9, [0x14007b2f0]
lea r8, [0x1400304f8]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call fcn.1400301b8
cmp dword [0x14007b2e8], 0
mov qword [0x14007b3f0], rax
jne 0x14002fded
mov eax, 0xa816001f
jmp 0x14002fe89
mov ebx, 1
mov rdx, rbx
mov rcx, rdi
call r12
test rax, rax
mov qword [rsp + rbx*8 + 0x40], rax
je 0x14002fe24
inc rbx
cmp rbx, 0x1f
jb 0x14002fdf2
cmp esi, 1
mov rax, qword [rsp + 0x120]
jne 0x14002fe30
mov qword [0x14007b560], rax
jmp 0x14002fe37
mov rcx, rdi
call rbp
mov eax, 0xa8160005
jmp 0x14002fe89
mov qword [0x14007b568], rax
mov rcx, qword [rsp + 0x68]
call fcn.1400302a8
test eax, eax
je 0x14002fe4c
mov eax, 0xa8160006
jmp 0x14002fe89
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xf8]
call fcn.1400303d8
test eax, eax
je 0x14002fe6c
mov eax, 0xa8160007
jmp 0x14002fe89
cmp esi, 1
jne 0x14002fe7d
mov dword [0x14007b558], 2
jmp 0x14002fe87
mov dword [0x14007b55c], 2
xor eax, eax
mov rcx, qword [rsp + 0x158]
call fcn.140033cf0
add rsp, 0x160
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14002feb8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
mov r11, rsp
sub rsp, 0xe0
mov rax, qword [0x14007bec0]
mov qword [rsp + 0xd8], rax
xor edx, edx
lea rcx, [r11 - 0x20]
lea r8d, [rdx + 0x14]
call fcn.140030008
mov byte [rsp + 0xc0], 0x47
mov byte [rsp + 0xc5], 0x72
mov byte [rsp + 0xca], 0x45
mov byte [rsp + 0xc1], 0x65
mov byte [rsp + 0xc6], 0x73
mov byte [rsp + 0xcb], 0x78
mov byte [rsp + 0xc2], 0x74
mov byte [rsp + 0xc7], 0x69
mov byte [rsp + 0xcc], 0x41
mov byte [rsp + 0xc3], 0x56
mov byte [rsp + 0xc8], 0x6f
mov byte [rsp + 0xcd], 0
mov byte [rsp + 0xc4], 0x65
mov byte [rsp + 0xc9], 0x6e
mov dword [rsp + 0x20], SysAllocStringByteLen
call fcn.140030028
lea rdx, [rsp + 0xc0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rsp + 0xc0]
lea r8d, [rdx + 0x14]
mov rbx, rax
call fcn.140030008
lea rcx, [rsp + 0x20]
call rbx
test eax, eax
jne 0x14002ffa8
lea r8d, [rax + 0x14]
lea rcx, [rsp + 0xc0]
xor edx, edx
call fcn.140030008
xor eax, eax
jmp 0x14002ffdf
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x14002ffda
dec eax
je 0x14002ffc4
dec eax
jne 0x14002ffa4
cmp dword [rsp + 0x24], 5
sbb eax, eax
add eax, 7
jmp 0x14002ffdf
mov eax, dword [rsp + 0x28]
test eax, eax
jne 0x14002ffd3
mov eax, 4
jmp 0x14002ffdf
mov eax, 5
jmp 0x14002ffdf
mov eax, 3
mov rcx, qword [rsp + 0xd8]
call fcn.140033cf0
add rsp, 0xe0
pop rbx
ret

Function at 0x140030028
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x14007bec0]
mov qword [rsp + 0x38], rax
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x14]
call fcn.140030008
cmp qword [0x14007b2c8], 1
mov byte [rsp + 0x28], 0x2e
mov byte [rsp + 0x29], 0x64
mov byte [rsp + 0x2a], 0x6c
mov byte [rsp + 0x2b], 0x6c
mov byte [rsp + 0x20], 0x6b
mov byte [rsp + 0x21], 0x65
mov byte [rsp + 0x22], 0x72
mov byte [rsp + 0x23], 0x6e
mov byte [rsp + 0x24], 0x65
mov byte [rsp + 0x25], 0x6c
mov byte [rsp + 0x26], 0x33
mov byte [rsp + 0x27], 0x32
mov byte [rsp + 0x2c], 0
jne 0x1400300a5
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x14007b2c8], rax
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x14]
call fcn.140030008
mov rax, qword [0x14007b2c8]
mov rcx, qword [rsp + 0x38]
call fcn.140033cf0
add rsp, 0x48
ret
Function at 0x1400300d8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [0x14007bec0]
mov qword [rsp + 0x38], rax
mov rbp, rdx
xor edx, edx
mov edi, r8d
mov rsi, rcx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x14]
call fcn.140030008
mov byte [rsp + 0x20], 0x47
mov byte [rsp + 0x25], 0x64
mov byte [rsp + 0x2a], 0x69
mov byte [rsp + 0x2f], 0x6d
mov byte [rsp + 0x21], 0x65
mov byte [rsp + 0x27], 0x6c
mov byte [rsp + 0x2c], 0x65
mov byte [rsp + 0x30], 0x65
mov byte [rsp + 0x22], 0x74
mov byte [rsp + 0x26], 0x75
mov byte [rsp + 0x2b], 0x6c
mov byte [rsp + 0x31], 0x41
mov byte [rsp + 0x23], 0x4d
mov byte [rsp + 0x28], 0x65
mov byte [rsp + 0x2d], 0x4e
mov byte [rsp + 0x32], 0
mov byte [rsp + 0x24], 0x6f
mov byte [rsp + 0x29], 0x46
mov byte [rsp + 0x2e], 0x61
call fcn.140030028
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x14]
mov rbx, rax
call fcn.140030008
test rbx, rbx
jne 0x140030195
lea eax, [rbx + 1]
jmp 0x1400301a0
mov r8d, edi
mov rdx, rbp
mov rcx, rsi
call rbx
mov rcx, qword [rsp + 0x38]
call fcn.140033cf0
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400301b8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x58
mov rax, qword [0x14007bec0]
mov qword [rsp + 0x48], rax
mov r13, qword [rsp + 0xb8]
mov rdi, rdx
xor edx, edx
mov rbp, r8
mov rsi, rcx
lea r8d, [rdx + 0x14]
lea rcx, [rsp + 0x30]
mov r12, r9
call fcn.140030008
mov byte [rsp + 0x30], 0x43
mov byte [rsp + 0x35], 0x65
mov byte [rsp + 0x3a], 0x61
mov byte [rsp + 0x31], 0x72
mov byte [rsp + 0x36], 0x54
mov byte [rsp + 0x3b], 0x64
mov byte [rsp + 0x32], 0x65
mov byte [rsp + 0x37], 0x68
mov byte [rsp + 0x3c], 0
mov byte [rsp + 0x33], 0x61
mov byte [rsp + 0x38], 0x72
mov byte [rsp + 0x34], 0x74
mov byte [rsp + 0x39], 0x65
call fcn.140030028
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x14]
mov rbx, rax
call fcn.140030008
test rbx, rbx
jne 0x140030267
lea rax, [rbx - 1]
jmp 0x140030285
mov eax, dword [rsp + 0xb0]
mov r9, r12
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], eax
call rbx
mov rcx, qword [rsp + 0x48]
call fcn.140033cf0
add rsp, 0x58
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400308d8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x14007bec0]
mov qword [rsp + 0x38], rax
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x14]
call fcn.140030008
mov byte [rsp + 0x20], 0x47
mov byte [rsp + 0x25], 0x73
mov byte [rsp + 0x2a], 0x6f
mov byte [rsp + 0x21], 0x65
mov byte [rsp + 0x26], 0x74
mov byte [rsp + 0x2b], 0x72
mov byte [rsp + 0x22], 0x74
mov byte [rsp + 0x27], 0x45
mov byte [rsp + 0x2c], 0
mov byte [rsp + 0x23], 0x4c
mov byte [rsp + 0x28], 0x72
mov byte [rsp + 0x24], 0x61
mov byte [rsp + 0x29], 0x72
call fcn.140030028
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x14]
mov rbx, rax
call fcn.140030008
test rbx, rbx
jne 0x14003096a
xor eax, eax
jmp 0x14003096c
call rbx
mov rcx, qword [rsp + 0x38]
call fcn.140033cf0
add rsp, 0x40
pop rbx
ret

Function at 0x1400309d8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x68
mov rax, qword [0x14007bec0]
mov qword [rsp + 0x58], rax
mov r13, qword [rsp + 0xd0]
mov esi, edx
xor edx, edx
mov edi, r8d
mov rbp, rcx
lea r8d, [rdx + 0x14]
lea rcx, [rsp + 0x40]
mov r12, r9
call fcn.140030008
mov byte [rsp + 0x40], 0x43
mov byte [rsp + 0x45], 0x65
mov byte [rsp + 0x4a], 0x41
mov byte [rsp + 0x41], 0x72
mov byte [rsp + 0x46], 0x46
mov byte [rsp + 0x4b], 0
mov byte [rsp + 0x42], 0x65
mov byte [rsp + 0x47], 0x69
mov byte [rsp + 0x43], 0x61
mov byte [rsp + 0x48], 0x6c
mov byte [rsp + 0x44], 0x74
mov byte [rsp + 0x49], 0x65
call fcn.140030028
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x14]
mov rbx, rax
call fcn.140030008
test rbx, rbx
jne 0x140030a7f
xor eax, eax
jmp 0x140030aa7
mov eax, dword [rsp + 0xc8]
mov qword [rsp + 0x30], r13
mov r9, r12
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xc0]
mov r8d, edi
mov edx, esi
mov rcx, rbp
mov dword [rsp + 0x20], eax
call rbx
mov rcx, qword [rsp + 0x58]
call fcn.140033cf0
add rsp, 0x68
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140030ac8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov rax, qword [0x14007bec0]
mov qword [rsp + 0x38], rax
xor edx, edx
mov rdi, rcx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x14]
call fcn.140030008
mov byte [rsp + 0x20], 0x43
mov byte [rsp + 0x25], 0x48
mov byte [rsp + 0x2a], 0x65
mov byte [rsp + 0x21], 0x6c
mov byte [rsp + 0x26], 0x61
mov byte [rsp + 0x2b], 0
mov byte [rsp + 0x22], 0x6f
mov byte [rsp + 0x27], 0x6e
mov byte [rsp + 0x23], 0x73
mov byte [rsp + 0x28], 0x64
mov byte [rsp + 0x24], 0x65
mov byte [rsp + 0x29], 0x6c
call fcn.140030028
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x14]
mov rbx, rax
call fcn.140030008
test rbx, rbx
jne 0x140030b59
xor eax, eax
jmp 0x140030b5e
mov rcx, rdi
call rbx
mov rcx, qword [rsp + 0x38]
call fcn.140033cf0
add rsp, 0x48
pop rdi
pop rbx
ret
Function at 0x140034ed0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
test rcx, rcx
jne 0x140034efa
call fcn.140039e1c
and dword [rax], 0
call fcn.140039dfc
mov ebx, 0x16
mov dword [rax], ebx
call fcn.140039d94
mov eax, ebx
jmp 0x140034f4a
test edx, 0xfffffff9
jne 0x140034edd
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140034f23
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140039e3c
call fcn.140039dfc
mov eax, dword [rax]
jmp 0x140034f4a
test al, 0x10
jne 0x140034f48
test al, 1
je 0x140034f48
test bl, 2
je 0x140034f48
call fcn.140039e1c
mov dword [rax], 5
call fcn.140039dfc
mov dword [rax], 0xd
jmp 0x140034f1a
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140037b0c
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x140037b22
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140037b24
xor eax, eax
test eax, eax
je 0x140037b34
mov ecx, eax
call fcn.140039e3c
or eax, 0xffffffff
jmp 0x140037b36
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400398cb
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14007bec0]
jne 0x140033d0a
rol rcx, 0x10
test cx, 0xffff
jne 0x140033d06
repz ret
ror rcx, 0x10
jmp 0x140039824
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140082010]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140082108]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400398a9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140082010]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400398cb
mov rax, qword [rsp + 0x88]
mov qword [0x140082108], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400820a8], rax
mov rax, qword [0x140082108]
mov qword [0x140081f80], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140082090], rax
mov dword [0x140081f70], 0xc0000409
mov dword [0x140081f74], 1
mov rax, qword [0x14007bec0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14007bec8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140082008], eax
mov ecx, 1
call fcn.140048374
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140060600]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140082008], 0
jne 0x140039952
mov ecx, 1
call fcn.140048374
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x14003a434
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14003a2a4
Function at 0x140049ce8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x14007bec0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14003c9ac
xor ebx, ebx
cmp qword [0x140083190], rbx
mov rdi, rax
jne 0x140049dfb
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140049ed2
lea rdx, [0x14006a4d8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140049ed2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140083190], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140083198], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x1400831a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1400831b0], rax
test rax, rax
je 0x140049df2
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1400831a8], rax
jmp 0x140049e02
mov rax, qword [0x1400831a8]
jmp 0x140049e09
mov rax, qword [0x1400831a8]
mov r11, qword [0x1400831b0]
cmp rax, rdi
je 0x140049e70
cmp r11, rdi
je 0x140049e70
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1400831b0]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140049e70
test rax, rax
je 0x140049e70
call rsi
test rax, rax
je 0x140049e6a
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140049e6a
test byte [rsp + 0x40], 1
jne 0x140049e70
bts ebp, 0x15
jmp 0x140049eb0
mov rcx, qword [0x140083198]
cmp rcx, rdi
je 0x140049eb0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140049eb0
call rax
mov rbx, rax
test rax, rax
je 0x140049eb0
mov rcx, qword [0x1400831a0]
cmp rcx, rdi
je 0x140049eb0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140049eb0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140083190]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140049ed2
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140049ed4
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140033cf0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000631c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140010960], rbx
je 0x140006383
cmp rax, rbx
jne 0x140006376
mov ebx, 1
mov esi, ebx
jmp 0x140006388
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000635b
mov ebx, 1
mov eax, dword [0x140010968]
cmp eax, ebx
jne 0x1400063a0
mov edi, 0x1f
mov ecx, edi
call fcn.140143000
jmp 0x14000640c
mov eax, dword [0x140010968]
test eax, eax
jne 0x140006401
mov dword [0x140010968], ebx
lea r15, [0x1400089c8]
lea rdi, [0x1400089b0]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x1400063f3
test eax, eax
jne 0x1400063f7
cmp qword [rdi], r14
je 0x1400063e8
mov rax, qword [rdi]
mov rcx, qword [0x140008930]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x1400063ca
test eax, eax
je 0x140006407
mov eax, 0xff
jmp 0x140006562
mov dword [0x14000e3e4], ebx
mov edi, 0x1f
mov eax, dword [0x140010968]
cmp eax, ebx
jne 0x140006433
lea rdx, [0x1400089a8]
lea rcx, [0x140008938]
call sub.msvcrt.dll__initterm
mov dword [0x140010968], 2
test esi, esi
jne 0x140006441
mov rax, r14
xchg qword [0x140010960], rax
cmp qword [0x140010970], r14
je 0x140006474
lea rcx, [0x140010970]
call fcn.140006730
test eax, eax
je 0x140006474
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140010970]
mov r9, qword [0x140008930]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000648d
mov eax, 0xff
jmp 0x140006562
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x140006513
test ax, ax
je 0x1400064a8
test edx, edx
jne 0x140006513
sub ax, bx
cmp ax, di
ja 0x1400064be
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x1400064a8
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001394
mov dword [0x14000e3e0], eax
cmp dword [0x14000e400], r14d
jne 0x1400064fc
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000e3e4], r14d
jne 0x140006511
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000e3e0]
jmp 0x140006562
cmp ax, 0x22
jne 0x140006527
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x140006496
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.1400067b0
add rsp, 0x28
jmp 0x14000631c
Function at 0x416060
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4161eb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x006dd668]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x4160c5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4160d4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x4160f3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x416103
cmp rbx, 0x1000
jae 0x4160cb
jmp 0x41616d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x416115
xor edx, edx
jmp 0x416164
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x006dd668]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x4160f9
jmp 0x4160e8
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x006dd668]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x00569351]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x00569987]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x0056c314]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x416220
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416446
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x006dd668]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x416293
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4162a2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4162c5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4162d5
cmp rbx, 0x1000
jae 0x416299
nop
jmp 0x416358
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x4162ed
xor esi, esi
jmp 0x41634a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x006dd668]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x4162cb
jmp 0x4162b6
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x006dd668]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4163e0
nop dword [rax + rax]
call sym.runtime.printlock
lea rax, [0x005699a0]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x00569987]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
nop
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x00565b2d]
mov ebx, 0xd
call sym.runtime.throw
nop dword [rax + rax]
cmp eax, 0x5af
je 0x416380
call sym.runtime.printlock
lea rax, [0x005699a0]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x00569987]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
nop dword [rax]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x0056b934]
mov ebx, 0x1f
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp sym.runtime.sysUsedOS