joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800c14f0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x50
mov edi, r8d
mov r13, rdx
mov r14, rcx
call fcn.180094b10
xor ebx, ebx
cmp qword [0x1801110c8], rbx
mov rbp, rax
mov dword [rsp + 0x98], ebx
mov dword [rsp + 0x30], ebx
jne 0x1800c161c
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rsi, rax
je 0x1800c172f
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800c172f
mov rcx, rax
call fcn.180094a40
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1801110c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.180094a40
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1801110d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.180094a40
lea rcx, [rsp + 0x98]
mov qword [0x1801110d8], rax
call fcn.180092570
test eax, eax
je 0x1800c15cf
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.180089000
cmp dword [rsp + 0x98], 2
jne 0x1800c161c
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.180094a40
test rax, rax
mov qword [0x1801110e8], rax
je 0x1800c161c
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.180094a40
mov qword [0x1801110e0], rax
mov rcx, qword [0x1801110e0]
mov qword [rsp + 0x80], r12
cmp rcx, rbp
je 0x1800c16c8
cmp qword [0x1801110e8], rbp
je 0x1800c16c8
call fcn.180094c00
mov rcx, qword [0x1801110e8]
mov rsi, rax
call fcn.180094c00
test rsi, rsi
mov r12, rax
je 0x1800c16c8
test rax, rax
je 0x1800c16c8
call rsi
test rax, rax
je 0x1800c1693
lea rcx, [rsp + 0x34]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1800c1693
test byte [rsp + 0x40], 1
jne 0x1800c16c8
lea rcx, [rsp + 0x30]
call fcn.180092660
test eax, eax
je 0x1800c16b5
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.180089000
cmp dword [rsp + 0x30], 4
jb 0x1800c16c2
bts edi, 0x15
jmp 0x1800c1706
bts edi, 0x12
jmp 0x1800c1706
mov rcx, qword [0x1801110d0]
cmp rcx, rbp
je 0x1800c1706
call fcn.180094c00
test rax, rax
je 0x1800c1706
call rax
test rax, rax
mov rbx, rax
je 0x1800c1706
mov rcx, qword [0x1801110d8]
cmp rcx, rbp
je 0x1800c1706
call fcn.180094c00
test rax, rax
je 0x1800c1706
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1801110c8]
call fcn.180094c00
mov r12, qword [rsp + 0x80]
test rax, rax
je 0x1800c172f
mov r9d, edi
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x1800c1731
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800c17d0
Capabilities:
Get geographical location

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x40
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rdi
mov rax, qword [0x18010e350]
xor rax, rbp
mov qword [rbp], rax
mov eax, dword [0x1801110f0]
mov r15, r9
mov r13d, r8d
test eax, eax
mov r14d, edx
mov rbx, rcx
jne 0x1800c1851
lea edx, [rax + 1]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1800c1834
mov dword [0x1801110f0], 1
jmp 0x1800c1856
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1800c184b
mov dword [0x1801110f0], 2
jmp 0x1800c187b
mov eax, dword [0x1801110f0]
cmp eax, 1
jne 0x1800c186e
mov r9d, dword [rbp + 0x60]
mov r8, r15
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x1800c1982
cmp eax, 2
je 0x1800c187b
test eax, eax
jne 0x1800c1980
mov esi, dword [rbp + 0x68]
xor edi, edi
test esi, esi
jne 0x1800c188a
mov rax, qword [rbx]
mov esi, dword [rax + 4]
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
movsxd r12, eax
je 0x1800c1980
jle 0x1800c1980
xor edx, edx
mov rax, 0xffffffffffffffe0
mov rcx, r12
div r12
cmp rax, 1
jb 0x1800c1980
add rcx, 0x10
cmp rcx, 0x400
ja 0x1800c1908
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x1800c18e6
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1800d50b0
sub rsp, rax
lea rbx, [rsp + 0x30]
test rbx, rbx
je 0x1800c1980
mov dword [rbx], 0xcccc
jmp 0x1800c191b
call fcn.180087e60
test rax, rax
mov rbx, rax
je 0x1800c191f
mov dword [rax], 0xdddd
add rbx, 0x10
test rbx, rbx
je 0x1800c1980
mov r9d, r12d
mov r8, rbx
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x1800c196a
mov eax, dword [rbp + 0x60]
or r9d, 0xffffffff
mov r8, rbx
test eax, eax
lea edx, [r9 + 2]
mov ecx, esi
jne 0x1800c1959
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
jmp 0x1800c1962
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
cmp dword [rbx - 0x10], 0xdddd
lea rcx, [rbx - 0x10]
jne 0x1800c197c
call fcn.180087f30
mov eax, edi
jmp 0x1800c1982
xor eax, eax
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.180086e60
mov rbx, qword [rbp + 0x40]
mov rsi, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x50]
lea rsp, [rbp + 0x10]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1800c1ae0
Capabilities:
Get geographical location

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x50
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rdi
mov rax, qword [0x18010e350]
xor rax, rbp
mov qword [rbp], rax
mov eax, dword [0x1801110f4]
mov r15, r9
mov r13d, r8d
test eax, eax
mov r14d, edx
mov rbx, rcx
jne 0x1800c1b98
lea edx, [rax + 1]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1800c1b44
mov dword [0x1801110f4], 1
jmp 0x1800c1ba6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1800c1b92
mov dword [0x1801110f4], 2
mov r9d, dword [rbp + 0x60]
mov r8, r15
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.180086e60
mov rbx, qword [rbp + 0x40]
mov rsi, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x50]
lea rsp, [rbp + 0x10]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov eax, dword [0x1801110f4]
cmp eax, 2
je 0x1800c1b59
test eax, eax
je 0x1800c1b59
cmp eax, 1
jne 0x1800c1bce
mov esi, dword [rbp + 0x68]
xor edi, edi
test esi, esi
jne 0x1800c1bb5
mov rax, qword [rbx]
mov esi, dword [rax + 4]
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
movsxd r12, eax
jne 0x1800c1bd2
xor eax, eax
jmp 0x1800c1b6c
jle 0x1800c1bce
xor edx, edx
mov rax, 0xffffffffffffffe0
div r12
cmp rax, 2
jb 0x1800c1bce
lea rcx, [r12 + r12 + 0x10]
cmp rcx, 0x400
ja 0x1800c1c25
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x1800c1c07
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1800d50b0
sub rsp, rax
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x1800c1bce
mov dword [rbx], 0xcccc
jmp 0x1800c1c38
call fcn.180087e60
test rax, rax
mov rbx, rax
je 0x1800c1c3c
mov dword [rax], 0xdddd
add rbx, 0x10
test rbx, rbx
je 0x1800c1bce
mov r9d, r12d
mov r8, rbx
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1800c1c8f
mov eax, dword [rbp + 0x60]
or r9d, 0xffffffff
xor edx, edx
test eax, eax
mov qword [rsp + 0x38], rdi
mov r8, rbx
mov ecx, esi
mov qword [rsp + 0x30], rdi
jne 0x1800c1c7e
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
jmp 0x1800c1c87
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
cmp dword [rbx - 0x10], 0xdddd
lea rcx, [rbx - 0x10]
jne 0x1800c1ca1
call fcn.180087f30
mov eax, edi
jmp 0x1800c1b6c
Function at 0x1800d18f0
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
sub rsp, 0x20
mov rbp, rdx
xor edi, edi
xor edx, edx
lea r8d, [rdi + 1]
mov esi, ecx
call fcn.1800c1de0
cmp rax, 0xffffffffffffffff
mov r13, rax
je 0x1800d1a94
lea r8d, [rdi + 2]
xor edx, edx
mov ecx, esi
call fcn.1800c1de0
cmp rax, 0xffffffffffffffff
je 0x1800d1a94
mov qword [rsp + 0x40], rbx
mov rbx, rbp
mov qword [rsp + 0x50], r14
sub rbx, rax
test rbx, rbx
jle 0x1800d1a13
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r14d, 0x1000
lea edx, [rdi + 8]
mov rcx, rax
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbp, rax
jne 0x1800d1999
call fcn.180095550
mov dword [rax], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
call fcn.180095550
mov eax, dword [rax]
mov rbx, qword [rsp + 0x40]
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop rdi
pop rsi
ret
mov edx, 0x8000
mov ecx, esi
mov qword [rsp + 0x48], r12
call fcn.1800d1c40
mov r12d, eax
nop
mov r8d, ebx
cmp rbx, r14
mov rdx, rbp
cmovge r8d, r14d
mov ecx, esi
call fcn.18009d980
cmp eax, 0xffffffff
je 0x1800d19d5
cdqe
sub rbx, rax
test rbx, rbx
jg 0x1800d19b0
jmp 0x1800d19ee
call fcn.180095580
cmp dword [rax], 5
jne 0x1800d19ea
call fcn.180095550
mov dword [rax], SafeArrayGetDim
or rdi, 0xffffffffffffffff
mov edx, r12d
mov ecx, esi
call fcn.1800d1c40
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12, qword [rsp + 0x48]
jmp 0x1800d1a6c
test rbx, rbx
jns 0x1800d1a76
xor r8d, r8d
mov rdx, rbp
mov ecx, esi
call fcn.1800c1de0
cmp rax, 0xffffffffffffffff
je 0x1800d197a
mov ecx, esi
call fcn.1800c6c80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb rdi, rdi
neg rdi
sub rdi, 1
cmp rdi, 0xffffffffffffffff
jne 0x1800d1a76
call fcn.180095550
mov dword [rax], SafeArrayGetDim
call fcn.180095580
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
cmp rdi, 0xffffffffffffffff
je 0x1800d197a
xor r8d, r8d
mov rdx, r13
mov ecx, esi
call fcn.1800c1de0
cmp rax, 0xffffffffffffffff
je 0x1800d197a
xor eax, eax
jmp 0x1800d1981
call fcn.180095550
mov rbp, qword [rsp + 0x58]
mov eax, dword [rax]
add rsp, 0x20
pop r13
pop rdi
pop rsi
ret
Function at 0x14000ae60
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
mov rcx, qword [0x14002ed98]
test rcx, rcx
je 0x14000ae9b
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000ae8e
mov rcx, qword [0x14002ed98]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14002ed98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x14002eda8], 0
je 0x14000af8e
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x1400298f8]
mov qword [rsp + 0x80], rsi
lea rsi, [0x1400315d0]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000af6f
test al, 0x10
je 0x14000af6f
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000af15
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x14001b254
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001b26a
mov al, 1
jmp 0x14001b2ca
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001b27b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001b2c8
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400193a8
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001b2c8
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001b2c8
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001b2c8
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001b2ca
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14001f6e0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001f708
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001f708
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
je 0x140001066
lea rcx, str.Windows_original_main_args:_n
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
xor ebx, ebx
cmp dword [rax], ebx
jle 0x140001066
xor edi, edi
mov rax, qword [sym.imp.MSVCR100.dll___argv]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
inc ebx
add rdi, 8
cmp ebx, dword [rax]
jl 0x140001038
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010b2
mov r9d, edi
mov rcx, qword [rax]
add rax, 0x10
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x14000109f
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010c9
mov rcx, qword [rbx]
mov rax, qword [str.java]
test rax, rax
jne 0x1400010d8
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x140002250]
mov r8d, 2
lea r9, str._J_ms8m
mov qword [rsp + 0x38], rax
lea rax, [0x140002240]
mov rdx, rbx
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov ecx, edi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r8d
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x2fc4c5090
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4c5a92
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4e8108]
test eax, eax
je 0x2fc4c5b2a
lea rax, [0x2fc4e80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4e8110]
mov qword [rbp - 8], rax
jmp 0x2fc4c5b0e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4c5b02
cmp qword [rbp - 0x10], 0
je 0x2fc4c5b02
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4c5ac8
lea rax, [0x2fc4e80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4c5b2b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4c5c30
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4c5c58
mov eax, 0
jmp 0x2fc4c5ca6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4c5c81
mov eax, 0
jmp 0x2fc4c5ca6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4c5ca1
mov eax, 0
jmp 0x2fc4c5ca6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4c5cac
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4c5d2a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4c5d21
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4c5d21
mov rax, qword [rbp - 8]
jmp 0x2fc4c5d3f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4c5cf4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140a990b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140a99237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140a990e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a990c7
add dl, dl
jne 0x140a990ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a9914e
xor eax, eax
add dl, dl
jne 0x140a990fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a99205
add dl, dl
jne 0x140a9910e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a9911b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a99128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a99135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140a99142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140a990d6
mov eax, 1
add dl, dl
jne 0x140a9915e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a9916b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a99153
sub eax, ebx
mov ebx, 1
jne 0x140a991a4
mov ecx, 1
add dl, dl
jne 0x140a99186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140a99193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a9917b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a990d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140a991c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140a991cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a991b5
cmp eax, 0x7d00
jae 0x140a991f3
cmp eax, 0x500
jb 0x140a991ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a990d6
cmp eax, 0x7f
ja 0x140a991f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a990d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140a9922a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140a990d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
push rcx
xor rdx, rdx
push rsi
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
mov rsi, qword [rdx + 0x50]
movzx rcx, word [rdx + 0x4a]
xor r9, r9
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
push rax
mov ecx, dword [rax + 0x18]
mov r8d, dword [rax + 0x20]
add r8, rdx
jrcxz 0x1400040ca
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor r9, r9
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x180001070
Capabilities:
Allocate or change rwx memory
Create process on windows
Resume thread

Disassembly:
sub rsp, 0x5c8
mov edx, 0x68
lea rcx, [rsp + 0x80]
call section..text
mov dword [rsp + 0x80], 0x68
call fcn.180001260
test eax, eax
je 0x180001202
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x1000044
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x180043218]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x18000114c
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x44
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, str.rundll32.exe
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x180001202
mov dword [rsp + 0x120], 0x100003
lea rdx, [rsp + 0xf0]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x40000
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x40000
lea r8, section..data
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x1e8], rax
lea rdx, [rsp + 0xf0]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitThread]