joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1802771a0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1803d9938]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov eax, dword [0x180375390]
xor edi, edi
movups xmm0, xmmword [str._pipediscord_ipc_0]
mov dword [rsp + 0x68], eax
mov rbx, rcx
movzx eax, word [0x180375394]
lea rcx, [rsp + 0x40]
movups xmm1, xmmword [0x180375378]
mov word [rsp + 0x6c], ax
mov eax, 0x30
movups xmmword [rsp + 0x40], xmm0
xor r9d, r9d
mov qword [rsp + 0x30], rdi
movsd xmm0, qword [0x180375388]
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov edx, 0xc0000000
movsd qword [rsp + 0x60], xmm0
mov word [rsp + 0x6a], ax
movups xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x1802772a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x180277258
movzx eax, word [rsp + 0x6a]
cmp ax, 0x39
jae 0x1802772c7
inc ax
mov word [rsp + 0x6a], ax
jmp 0x180277273
cmp eax, 0xe7
jne 0x1802772c7
mov edx, 0x2710
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x1802772c7
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], edi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
je 0x180277238
mov byte [rbx], 1
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180269d00
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
xor al, al
jmp 0x1802772a9

Function at 0x1802772d0
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
je 0x180277391
test rcx, rcx
je 0x180277391
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x180277391
xor ebp, ebp
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rbp
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov dword [rsp + 0x58], ebp
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x18027737c
mov eax, dword [rsp + 0x58]
cmp rax, rdi
jb 0x180277391
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x68]
mov r8d, edi
mov dword [rsp + 0x68], ebp
mov rdx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x180277365
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov rcx, rbx
call fcn.180277110
xor al, al
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
mov byte [rbx], bpl
mov rbx, qword [rsp + 0x50]
xor al, al
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x1802773a0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, r8
test r8, r8
jne 0x1802773b6
mov al, 1
add rsp, 0x30
pop rbx
ret
test rcx, rcx
je 0x1802773eb
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x1802773eb
test rdx, rdx
je 0x1802773eb
xor eax, eax
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x1802773eb
cmp dword [rsp + 0x50], ebx
je 0x1802773ae
xor al, al
add rsp, 0x30
pop rbx
ret
Function at 0x18027e6b0
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1803d9938]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor edx, edx
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x18027e83e
mov dword [rsp + 0x30], 0x1c
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x18027e833
mov eax, dword [rsp + 0x30]
cmp rax, 0x10
jb 0x18027e814
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x3c], eax
jne 0x18027e814
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x38], eax
je 0x18027e814
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
jne 0x18027e781
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0x80
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
shl rax, 2
mov r8, rax
xor edx, edx
mov rcx, qword [0x180455c20]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
jne 0x18027e77f
jmp 0x18027e833
jmp 0x18027e7eb
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x70]
mov ecx, dword [rcx + 8]
cmp dword [rax + 0xc], ecx
jb 0x18027e7eb
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
shl eax, 1
mov eax, eax
shl rax, 2
mov r9, rax
mov rax, qword [rsp + 0x70]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x180455c20]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x18027e7cc
jmp 0x18027e833
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
shl eax, 1
mov rcx, qword [rsp + 0x70]
mov dword [rcx + 8], eax
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx]
mov edx, dword [rsp + 0x38]
mov dword [rcx + rax*4], edx
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0xc]
inc eax
mov rcx, qword [rsp + 0x70]
mov dword [rcx + 0xc], eax
mov dword [rsp + 0x30], 0x1c
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x18027e704
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180269d00
add rsp, 0x68
ret
Function at 0x18027e860
Capabilities:
Suspend thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
mov qword [rax], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 8], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 0xc], 0
mov rcx, qword [rsp + 0x40]
call fcn.18027e6b0
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x18027e922
mov dword [rsp + 0x20], 0
jmp 0x18027e8bf
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x20], eax
jae 0x18027e922
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18027e920
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, dword [rsp + 0x50]
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
call fcn.18027e500
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18027e8b5
add rsp, 0x38
ret

Function at 0x18027e930
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x18027e9bf
mov dword [rsp + 0x20], 0
jmp 0x18027e958
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x20], eax
jae 0x18027e9a8
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18027e9a6
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18027e94e
mov rax, qword [rsp + 0x40]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x180455c20]
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x38
ret
Function at 0x18027e9d0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov eax, dword [rsp + 0x60]
imul rax, rax, 0x38
mov rcx, qword [0x180455c40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], 5
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x18027ea3a
mov rax, qword [rsp + 0x30]
sub rax, 5
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18027ea63
mov eax, 0xa
jmp 0x18027eb94
cmp dword [rsp + 0x68], 0
je 0x18027eace
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov byte [rax], 0xe9
mov rax, qword [rsp + 0x30]
add rax, 5
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 1], eax
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x18027eacc
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov byte [rax], 0xeb
mov rax, qword [rsp + 0x48]
mov byte [rax + 1], 0xf9
jmp 0x18027eb1a
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x18027eafe
mov rax, qword [rsp + 0x28]
add rax, 0x18
mov r8d, 7
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x18027eb1a
mov rax, qword [rsp + 0x28]
add rax, 0x18
mov r8d, 5
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
lea r9, [rsp + 0x20]
mov r8d, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx eax, byte [rsp + 0x68]
and al, 1
shl al, 1
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfd
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x28]
mov byte [rcx + 0x20], al
movzx eax, byte [rsp + 0x68]
and al, 1
shl al, 2
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfb
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x28]
mov byte [rcx + 0x20], al
xor eax, eax
add rsp, 0x58
ret
Function at 0x18027f390
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x90], 0x40000000
jbe 0x18027f3f1
mov rax, qword [rsp + 0x90]
sub rax, 0x40000000
cmp qword [rsp + 0x30], rax
jae 0x18027f3f1
mov rax, qword [rsp + 0x90]
sub rax, 0x40000000
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x90]
add rax, 0x40000000
cmp qword [rsp + 0x28], rax
jbe 0x18027f419
mov rax, qword [rsp + 0x90]
add rax, 0x40000000
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
sub rax, 0xfff
mov qword [rsp + 0x28], rax
mov rax, qword [0x180455c30]
mov qword [rsp + 0x20], rax
jmp 0x18027f444
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x18027f47e
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x20], rax
jb 0x18027f464
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x20], rax
jb 0x18027f466
jmp 0x18027f437
mov rax, qword [rsp + 0x20]
cmp qword [rax + 8], 0
je 0x18027f47c
mov rax, qword [rsp + 0x20]
jmp 0x18027f5f0
jmp 0x18027f437
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
jb 0x18027f4e7
mov r8d, dword [rsp + 0x78]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
call fcn.18027f190
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x18027f4ba
jmp 0x18027f4e7
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x1000
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x18027f4e5
jmp 0x18027f4e7
jmp 0x18027f48b
cmp qword [rsp + 0x20], 0
jne 0x18027f558
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x40], rax
ja 0x18027f558
mov r8d, dword [rsp + 0x78]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
call fcn.18027f270
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x18027f52b
jmp 0x18027f558
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x1000
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x18027f556
jmp 0x18027f558
jmp 0x18027f4fc
cmp qword [rsp + 0x20], 0
je 0x18027f5eb
mov rax, qword [rsp + 0x20]
add rax, 0x40
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov qword [rax + 8], 0
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x10], 0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x48]
add rax, 0x40
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
cmp rax, 0xfc0
jbe 0x18027f58b
mov rax, qword [rsp + 0x20]
mov rcx, qword [0x180455c30]
mov qword [rax], rcx
mov rax, qword [rsp + 0x20]
mov qword [0x180455c30], rax
mov rax, qword [rsp + 0x20]
add rsp, 0x88
ret
Function at 0x18027fd90
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
test eax, eax
je 0x18027fde9
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
cmp eax, 0x90
je 0x18027fde9
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
cmp eax, 0xcc
je 0x18027fde9
xor eax, eax
jmp 0x18027fe30
mov dword [rsp], 1
jmp 0x18027fdfa
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp], eax
jae 0x18027fe2b
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x20]
movzx ecx, byte [rdx + rcx]
cmp eax, ecx
je 0x18027fe29
xor eax, eax
jmp 0x18027fe30
jmp 0x18027fdf2
mov eax, 1
add rsp, 0x18
ret
Function at 0x14001112c
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
jmp 0x1400118a0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x138
lea rbp, [rsp + 0x30]
lea rcx, [0x1401b80a2]
call fcn.1400113de
nop
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, qword [rbp + 0x128]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x140011902
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____VirtualAlloc_Failed_With_Error:_0x_0.8X__n
call fcn.1400111cc
nop
jmp 0x140011979
mov r8, qword [rbp + 0x128]
mov rdx, qword [rbp + 0x120]
mov rcx, qword [rbp + 8]
call fcn.1400111ea
nop
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x14001195e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____CreateThread_Failed_With_Error:_0x_0.8X__n
call fcn.1400111cc
nop
jmp 0x140011979
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x14001122b
Capabilities:
Terminate process

Disassembly:
jmp 0x140014280
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x1400112c1
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400155d0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400155f0
xor al, al
jmp 0x140015671
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140015603
xor al, al
jmp 0x140015671
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001562d
xor al, al
jmp 0x140015671
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015641
xor al, al
jmp 0x140015671
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015653
xor al, al
jmp 0x140015671
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001566f
xor al, al
jmp 0x140015671
mov al, 1
add rsp, 0x38
ret
Function at 0x1400134c0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140011406
movzx eax, al
test eax, eax
jne 0x1400134e0
mov ecx, 7
call fcn.140011370
nop
mov byte [rsp + 0x20], 0
call fcn.140011389
mov byte [rsp + 0x21], al
cmp dword [0x1401b1fa8], 1
jne 0x140013504
mov ecx, 7
call fcn.140011370
nop
jmp 0x14001355c
cmp dword [0x1401b1fa8], 0
jne 0x140013557
mov dword [0x1401b1fa8], 1
lea rdx, [0x14001b660]
lea rcx, [0x14001b330]
call fcn.1400111d1
test eax, eax
je 0x140013538
mov eax, 0xff
jmp 0x140013661
lea rdx, [0x14001b220]
lea rcx, [section..rdata]
call fcn.14001137f
mov dword [0x1401b1fa8], 2
jmp 0x14001355c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001135c
call fcn.1400112e4
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x1400135b9
mov rcx, qword [rsp + 0x30]
call fcn.140011177
movzx eax, al
test eax, eax
je 0x1400135b9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x1401b9020]
nop
call fcn.140011320
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1400135ed
mov rcx, qword [rsp + 0x38]
call fcn.140011177
movzx eax, al
test eax, eax
je 0x1400135ed
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400113c0
nop
call fcn.140013710
mov dword [rsp + 0x28], eax
call fcn.1400112c1
movzx eax, al
test eax, eax
jne 0x14001360c
mov ecx, dword [rsp + 0x28]
call fcn.14001105a
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001361b
call fcn.1400113ca
nop
xor edx, edx
mov cl, 1
call fcn.140011168
mov eax, dword [rsp + 0x28]
jmp 0x140013661
add rsp, 0x68
ret
Function at 0x140011082
Capabilities:
Terminate process

Disassembly:
jmp 0x140012060
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x138
lea rbp, [rsp + 0x30]
lea rcx, [0x14002502e]
call fcn.1400113e8
mov rax, qword [rbp + 0x120]
mov qword [rbp + 0xf8], rax
cmp qword [rbp + 0xf8], 0x800002
je 0x1400120bb
cmp qword [rbp + 0xf8], 0x800004
je 0x1400120d3
cmp qword [rbp + 0xf8], 0x800008
je 0x1400120ea
jmp 0x1400120ff
mov rcx, qword [rbp + 0x128]
call fcn.14001119f
movzx eax, ax
mov qword [rbp + 0x120], rax
jmp 0x140012131
mov rcx, qword [rbp + 0x128]
call fcn.140011023
mov eax, eax
mov qword [rbp + 0x120], rax
jmp 0x140012131
mov rcx, qword [rbp + 0x128]
call fcn.140011361
mov qword [rbp + 0x120], rax
jmp 0x140012131
cmp qword [rbp + 0x120], 0x50
jb 0x140012131
mov r9d, 0x5b
lea r8, str.C:UsersUser_source_reposDX11_CD_READERINCLUDEFILEREADER.C
mov rdx, qword [rbp + 0x128]
lea rcx, str.Size___MAXSTRTOLERANCE
call fcn.14001100a
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
mov edx, 1
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.ucrtbased.dll_calloc]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x140012176
mov r9d, 0x61
lea r8, str.C:UsersUser_source_reposDX11_CD_READERINCLUDEFILEREADER.C
mov rdx, qword [rbp + 0x128]
lea rcx, [0x14001c404]
call fcn.14001100a
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
mov rax, qword [rbp + 0x128]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x120]
mov r8d, 1
mov rdx, qword [rbp + 0x120]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fread_s]
mov qword [rbp + 0x28], 0
jmp 0x1400121b5
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x120]
cmp qword [rbp + 0x28], rax
jae 0x140012204
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
movsx eax, byte [rax]
cmp eax, 0x80
jb 0x140012202
mov r9d, 0x67
lea r8, str.C:UsersUser_source_reposDX11_CD_READERINCLUDEFILEREADER.C
mov rdx, qword [rbp + 0x128]
lea rcx, str.isascii_ret_i__
call fcn.14001100a
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
jmp 0x1400121aa
mov rax, qword [rbp + 8]
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x140011154
Capabilities:
Terminate process

Disassembly:
jmp 0x1400128d0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x42
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
lea rcx, [0x140025045]
call fcn.1400113e8
mov rax, qword [rbp + 0x1e0]
mov rax, qword [rax]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
call fcn.140011023
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 1
je 0x14001294d
mov r9d, 0x1c
lea r8, str.C:UsersUser_source_reposDX11_CD_READERSOURCESTREAMINFO_OLST.C
mov rdx, qword [rbp + 8]
lea rcx, str.Test__0x00000001
call fcn.14001100a
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
mov dword [rbp + 0x44], 0
jmp 0x14001295e
mov eax, dword [rbp + 0x44]
inc eax
mov dword [rbp + 0x44], eax
mov rax, qword [rbp + 0x1e0]
mov eax, dword [rax + 0x100]
cmp dword [rbp + 0x44], eax
jae 0x140012a04
mov rcx, qword [rbp + 8]
call fcn.1400127f0
mov qword [rbp + 0x68], rax
movsxd rax, dword [rbp + 0x44]
mov rcx, qword [rbp + 0x1e0]
mov rax, qword [rcx + rax*8 + 0x108]
mov qword [rbp + 0x88], rax
mov dword [rbp + 0xa4], 0
jmp 0x1400129b5
mov eax, dword [rbp + 0xa4]
inc eax
mov dword [rbp + 0xa4], eax
mov eax, dword [rbp + 0x68]
cmp dword [rbp + 0xa4], eax
jae 0x1400129ff
mov rcx, qword [rbp + 8]
call fcn.1400126c0
mov dword [rbp + 0xc4], eax
mov dword [rbp + 0xe4], 0
jmp 0x1400129e9
mov eax, dword [rbp + 0xe4]
inc eax
mov dword [rbp + 0xe4], eax
mov rax, qword [rbp + 0x88]
mov eax, dword [rax + 0xc]
cmp dword [rbp + 0xe4], eax
jae 0x1400129fd
jmp 0x1400129db
jmp 0x1400129a7
jmp 0x140012956
lea rcx, [rbp - 0x20]
lea rdx, [0x14001c4c0]
call fcn.140011375
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret

Function at 0x14001123a
Capabilities:
Terminate process

Disassembly:
jmp 0x140014db0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112d5
Capabilities:
Parse pe header

Disassembly:
jmp 0x140016100
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140016120
xor al, al
jmp 0x1400161a1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140016133
xor al, al
jmp 0x1400161a1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001615d
xor al, al
jmp 0x1400161a1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140016171
xor al, al
jmp 0x1400161a1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140016183
xor al, al
jmp 0x1400161a1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001619f
xor al, al
jmp 0x1400161a1
mov al, 1
add rsp, 0x38
ret