joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a7a8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x18], 8
jb 0x14001a7b6
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001a7c8
shr eax, 4
and al, 1
jmp 0x14001a7ca
xor al, al
add rsp, 0x28
ret

Function at 0x14001a7d0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [0x140074020]
xor rax, rsp
mov qword [rbp - 8], rax
xor edi, edi
cmp qword [rcx + 0x10], rdi
jne 0x14001a80b
xor al, al
jmp 0x14001a997
mov dword [rbp - 0x5c], 0x5c
mov eax, dword [0x14004e148]
mov dword [rbp - 0x10], eax
movzx eax, word [0x14004e14c]
mov word [rbp - 0xc], ax
cmp qword [rcx + 0x18], 8
jb 0x14001a832
mov rdx, qword [rcx]
jmp 0x14001a835
mov rdx, rcx
mov rax, qword [rcx + 0x10]
lea r8, [rdx + rax*2]
cmp qword [rcx + 0x18], 8
jb 0x14001a847
mov rcx, qword [rcx]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rdi
xor eax, eax
mov r9b, al
mov rdx, rcx
lea rcx, [rbp - 0x50]
call fcn.14001a698
nop
mov word [rbp - 0x60], di
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x50]
call fcn.14001aae8
mov qword [rbp - 0x58], rdi
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x10]
mov rcx, qword [rbp - 0x50]
call fcn.1400341dc
mov rbx, rax
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], rdi
mov word [rbp - 0x30], di
xor r8d, r8d
lea rdx, [0x140060548]
lea rcx, [rbp - 0x30]
call fcn.14000b650
nop
test rbx, rbx
je 0x14001a966
test rbx, rbx
je 0x14001a8e1
cmp word [rbx], di
jne 0x14001a8ca
mov rax, rdi
jmp 0x14001a8d2
mov rcx, rbx
call fcn.14003279c
mov r8, rax
mov rdx, rbx
lea rcx, [rbp - 0x30]
call fcn.14000f380
cmp qword [rbp - 0x20], rdi
jbe 0x14001a923
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rcx, [rbp - 0x30]
cmp eax, 0xffffffff
je 0x14001a90d
call fcn.14001a7a8
test al, al
jmp 0x14001a921
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14001a961
cmp word [rbp - 0x5c], di
jne 0x14001a92e
mov rax, rdi
jmp 0x14001a937
lea rcx, [rbp - 0x5c]
call fcn.14003279c
mov r8, rax
lea rdx, [rbp - 0x5c]
lea rcx, [rbp - 0x30]
call fcn.14000f380
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x10]
xor ecx, ecx
call fcn.1400341dc
mov rbx, rax
test rax, rax
jmp 0x14001a8b5
mov bl, dil
jmp 0x14001a968
mov bl, 1
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x30]
call fcn.14000b5d0
nop
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x14001a995
mov rdx, qword [rbp - 0x40]
sub rdx, rcx
sar rdx, 1
mov r8d, 2
call fcn.140004950
mov al, bl
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140027920
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x14001a9b8
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x14001aee0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov byte [r9], 1
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14001bb38
test al, al
jne 0x14001af11
xor eax, eax
jmp 0x14001af56
mov rcx, rbx
call fcn.14001bb40
test al, al
je 0x14001af0d
mov eax, 0xffffffff
cmp rsi, rax
ja 0x14001af0d
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x58]
and dword [rsp + 0x58], 0
mov r8d, esi
and qword [rsp + 0x20], 0
mov rdx, rbp
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001af52
mov byte [rdi], 0
mov eax, dword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14001b080
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov byte [r9], 1
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14001bb38
test al, al
jne 0x14001b0b1
xor eax, eax
jmp 0x14001b0f6
mov rcx, rbx
call fcn.14001bb48
test al, al
je 0x14001b0ad
mov eax, 0xffffffff
cmp rsi, rax
ja 0x14001b0ad
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x58]
and dword [rsp + 0x58], 0
mov r8d, esi
and qword [rsp + 0x20], 0
mov rdx, rbp
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14001b0f2
mov byte [rdi], 0
mov eax, dword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14001fc0c
Capabilities:
Read http header

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov rax, qword [0x140074020]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov r15, r8
mov r14, rdx
mov rdi, rcx
xor r12d, r12d
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], r12d
mov qword [rsp + 0x28], r12
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r12 + 0x16]
mov rcx, r14
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [rsp + 0x44], eax
test ebx, ebx
jne 0x14001fd2a
cmp eax, 0x7a
je 0x14001fd2a
lea rcx, [rbp - 0x80]
call fcn.14000a708
nop
lea rdx, str.WinHttpQueryHeaders_failed_with
mov rcx, rax
call fcn.14000da30
mov rcx, rax
lea rdx, [rsp + 0x44]
call fcn.14000dad8
mov rcx, rax
lea rdx, [rbp + 0x68]
call fcn.14000a6ec
nop
mov rdx, r15
lea rcx, [rsp + 0x58]
call fcn.14000a7c0
movzx r8d, si
or r8d, 0x80070000
test esi, esi
cmovle r8d, esi
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x9a
lea r9, str.srcgfehttpaccess.cpp
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0xb0]
call fcn.14001ddc0
lea rdx, [0x140072490]
lea rcx, [rbp + 0xb0]
call fcn.14002c720
nop
mov edx, dword [rsp + 0x40]
shr rdx, 1
lea rcx, [rsp + 0x58]
call fcn.140019830
nop
mov qword [rsp + 0x28], r12
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov rbx, qword [rsp + 0x58]
mov r9, rbx
xor r8d, r8d
lea edx, [r8 + 0x16]
mov rcx, r14
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x14001fe0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [rsp + 0x44], eax
lea rcx, [rbp - 0x80]
call fcn.14000a708
nop
lea rdx, str.WinHttpQueryHeaders_failed_with
mov rcx, rax
call fcn.14000da30
mov rcx, rax
lea rdx, [rsp + 0x44]
call fcn.14000dad8
mov rcx, rax
lea rdx, [rbp + 0x88]
call fcn.14000a6ec
nop
mov rdx, r15
lea rcx, [rbp + 0x68]
call fcn.14000a7c0
movzx r8d, bx
or r8d, 0x80070000
test ebx, ebx
cmovle r8d, ebx
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0xac
lea r9, str.srcgfehttpaccess.cpp
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0xb0]
call fcn.14001ddc0
lea rdx, [0x140072490]
lea rcx, [rbp + 0xb0]
call fcn.14002c720
nop
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], r12
cmp qword [rdi + 0x18], 8
jb 0x14001fe26
mov rax, qword [rdi]
jmp 0x14001fe29
mov rax, rdi
mov word [rax], r12w
mov r8, qword [rsp + 0x60]
cmp rbx, r8
je 0x14001fe49
sub r8, rbx
sar r8, 1
mov rdx, rbx
mov rcx, rdi
call fcn.14000b650
nop
test rbx, rbx
je 0x14001fe67
mov rdx, qword [rsp + 0x68]
sub rdx, rbx
sar rdx, 1
mov r8d, 2
mov rcx, rbx
call fcn.140004950
mov rax, rdi
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.140027920
add rsp, 0x2a0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140024428
Capabilities:
Hash data via wincrypt

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
xor ebx, ebx
mov r8, qword [rdx + 8]
sub r8, qword [rdx]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x14002445e
mov eax, 0xffffffff
cmp r8, rax
ja 0x14002445e
mov rdx, qword [rdx]
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
setne bl
mov al, bl
add rsp, 0x20
pop rbx
ret

Function at 0x140025920
Capabilities:
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
lea rdi, [rcx + 8]
mov rbx, rcx
mov rcx, qword [rdi]
test rcx, rcx
je 0x140025943
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
and qword [rdi], 0
mov rcx, qword [rbx]
test rcx, rcx
je 0x140025957
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
and qword [rbx], 0
mov rcx, rbx
call fcn.1400257cc
mov r9d, eax
mov dword [rsp + 0x20], 0xf0000060
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1400259a6
mov rcx, qword [rdi]
test rcx, rcx
je 0x14002598e
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
and qword [rdi], 0
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400259a2
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
and qword [rbx], 0
xor al, al
jmp 0x1400259ca
mov rcx, rbx
call fcn.140024468
mov rcx, qword [rbx]
mov edx, eax
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14002597c
mov al, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400263a0
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x290]
sub rsp, 0x390
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x140074020]
xor rax, rsp
mov qword [rbp + 0x280], rax
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rbp - 0x80]
call fcn.14000a7c0
nop
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1400269c8
nop
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x80]
call fcn.140026b00
nop
lea rcx, [rsp + 0x40]
call fcn.14000a758
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x80]
call fcn.140026bbc
cmp qword [rax + 0x18], 8
jb 0x14002642e
mov rax, qword [rax]
lea rdx, [rbp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x40]
call fcn.14000b5d0
cmp rbx, 0xffffffffffffffff
jne 0x140026477
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
lea r8d, [rbx + 0x21]
lea rdx, str.src_filesystem.cpp
call fcn.1400124e0
int3
mov qword [rsp + 0x38], rbx
mov qword [rdi], r14
mov qword [rdi + 8], r14
mov qword [rdi + 0x10], r14
mov dword [rsp + 0x20], 1
lea rdx, [0x1400509d0]
lea rcx, [rbp + 0x5c]
call fcn.1400348ac
test eax, eax
je 0x140026572
lea rdx, [0x1400509d4]
lea rcx, [rbp + 0x5c]
call fcn.1400348ac
test eax, eax
je 0x140026572
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.14000a7c0
nop
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], r14
mov word [rsp + 0x60], r14w
cmp word [rbp + 0x5c], r14w
jne 0x1400264ed
mov rax, r14
jmp 0x1400264f6
lea rcx, [rbp + 0x5c]
call fcn.14003279c
mov r8, rax
lea rdx, [rbp + 0x5c]
lea rcx, [rsp + 0x60]
call fcn.14000b650
nop
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x60]
call fcn.1400269c8
nop
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x40]
call fcn.140026b00
nop
lea rcx, [rbp - 0x60]
call fcn.14000a758
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x60]
call fcn.14000b5d0
lea r8, [rbp + 0x30]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.140026f18
nop
mov rdx, rax
mov rcx, rdi
call fcn.140026890
nop
lea rcx, [rbp - 0x18]
call fcn.14000a758
nop
lea rcx, [rsp + 0x40]
call fcn.14000a758
lea rdx, [rbp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14002648f
test rbx, rbx
je 0x140026596
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rcx, [rbp - 0x80]
call fcn.14000a758
mov rax, rdi
mov rcx, qword [rbp + 0x280]
xor rcx, rsp
call fcn.140027920
add rsp, 0x390
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140026fb8
Capabilities:
Delete directory
Delete file

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140074020]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rdi, rcx
xor esi, esi
cmp dword [rcx], esi
setne cl
lea r9d, [rsi + 0x3e]
lea r8, str.src_filesystem_object.cpp
lea rdx, str.Incorrect_state
call fcn.14002235c
mov ecx, dword [rdi]
sub ecx, 1
je 0x1400270ef
cmp ecx, 1
jne 0x14002714d
mov qword [rbp + 0x1f], 7
mov qword [rbp + 0x17], rsi
mov word [rbp + 7], si
lea rcx, [0x140050b3c]
call fcn.14003279c
mov r8, rax
lea rdx, [0x140050b3c]
lea rcx, [rbp + 7]
call fcn.14000b650
nop
lea r8, [rbp + 7]
lea rdx, [rdi + 8]
lea rcx, [rbp - 0x19]
call fcn.1400263a0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp + 7]
call fcn.14000b5d0
mov rbx, qword [rbp - 0x19]
jmp 0x140027080
mov rcx, rbx
call fcn.140026fb8
add rbx, 0x50
cmp rbx, qword [rbp - 0x11]
jne 0x140027074
lea rdx, [rbp + 0x27]
lea rcx, [rdi + 8]
call fcn.140026bbc
cmp qword [rax + 0x18], 8
jb 0x14002709d
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor esi, esi
test eax, eax
sete bl
xor r8d, r8d
mov dl, 1
lea rcx, [rbp + 0x27]
call fcn.14000b5d0
test bl, bl
je 0x1400270e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
lea r8d, [rsi + 0x54]
lea rdx, str.src_filesystem_object.cpp
call fcn.1400124e0
nop
lea rcx, [rbp - 0x19]
call fcn.1400267fc
jmp 0x14002714d
lea rcx, [rdi + 8]
lea rdx, [rbp + 0x27]
call fcn.140026bbc
cmp qword [rax + 0x18], 8
jb 0x140027106
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
sete bl
xor r8d, r8d
mov dl, 1
lea rcx, [rbp + 0x27]
call fcn.14000b5d0
test bl, bl
je 0x14002714d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov r8d, 0x46
lea rdx, str.src_filesystem_object.cpp
call fcn.1400124e0
int3
mov dword [rdi], esi
lea rcx, [rdi + 0x28]
xor edx, edx
lea r8d, [rdx + 0x24]
call fcn.14002c580
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140027920
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180001f10
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r11, rax
mov eax, 0x5a4d
cmp word [r11], ax
jne 0x180001fb3
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
cmp dword [rcx], 0x4550
jne 0x180001fb3
movzx eax, word [rcx + 0x14]
lea rbx, [rcx + 0x18]
movzx r10d, word [rcx + 6]
add rbx, rax
xor edx, edx
test r10d, r10d
je 0x180001fb3
lea rdi, str..text
nop dword [rax]
movsxd r9, edx
xor ecx, ecx
lea rax, [r9 + r9*4]
lea r8, [rbx + rax*8]
nop dword [rax]
movzx eax, byte [rdi + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x180001fac
cmp rcx, 6
jne 0x180001f80
lea rax, [r9 + r9*4]
lea rcx, [rbx + rax*8]
mov ebx, dword [rbx + rax*8 + 0xc]
mov eax, dword [rcx + 8]
add rbx, r11
mov dword [rsp + 0x30], eax
jmp 0x180001fb5
inc edx
cmp edx, r10d
jl 0x180001f70
xor ebx, ebx
mov esi, dword [rsp + 0x30]
lea rdx, [0x19d10a060]
add rsi, rbx
mov r9d, 7
mov r8, rsi
mov rcx, rbx
call fcn.180001df0
test rax, rax
je 0x180001ff9
mov edx, dword [rax + 0x15]
mov dword [rdx + rax + 0x1a], 0
mov edx, 0xefff
mov rax, qword gs:[0x30]
and word [rax + 0x17ee], dx
mov rbp, qword gs:[0x60]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
je 0x1800020f0
lea rdx, str.RtlLeaveCriticalSection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp + 0x110]
call rax
lea rdx, str.LdrFastFailInLoaderCallout
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180002056
mov ecx, dword [rax + 0x18]
mov dword [rcx + rax + 0x1d], 2
jmp 0x18000207e
mov r9d, 0xa
lea rdx, [0x18000a040]
mov r8, rsi
mov rcx, rbx
call fcn.180001df0
test rax, rax
je 0x18000207e
mov ecx, dword [rax + 5]
mov dword [rcx + rax + 9], 2
lea rdx, str.LdrGetDllFullName
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1800020f0
mov r9d, 7
lea r8, [rax + 0x80]
lea rdx, [0x19d10a058]
mov rcx, rax
call fcn.180001df0
mov rcx, rax
test rax, rax
jne 0x1800020d7
lea r9d, [rax + 7]
mov rcx, rbx
lea r8, [rbx + 0x80]
lea rdx, [0x19d10a050]
call fcn.180001df0
mov rcx, rax
test rcx, rcx
je 0x1800020f0
mov eax, dword [rcx + 3]
mov rcx, qword [rax + rcx + 7]
mov rax, qword [rcx + 0x98]
add qword [rax + 0x38], 2
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400154dc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14001555a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140015551
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140015551
mov rax, qword [rbp - 8]
jmp 0x14001556f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140015524
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140130507
Capabilities:
Get number of processors
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
jrcxz 0x140130513
jl 0x14013054d
test eax, 0xf56e1793
rcl r11d, 0xb1
rcl ebx, 0xb1
mul r14
inc rcx
call rax
mov r8d, 0x519191cf
movabs rsi, 0x69ba579623cf36eb
ret
Function at 0x1400011c0
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push r15
sub rsp, 0x30
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor r15d, r15d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rbp, rax
test rax, rax
jne 0x1400011e9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
mov qword [rsp + 0x58], rbx
mov rcx, rbp
mov qword [rsp + 0x68], r14
mov rbx, r15
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], bx
jne 0x140001200
test rax, rax
je 0x140001234
nop
lea rcx, [rcx + rax*2]
inc rbx
add rbx, rax
lea rcx, [rcx + 2]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r15w
jne 0x140001225
test rax, rax
jne 0x140001210
xorps xmm0, xmm0
movabs r14, 0x7ffffffffffffffe
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r15
cmp rbx, r14
ja 0x140001352
mov qword [rsp + 0x60], rsi
cmp rbx, 7
ja 0x140001287
mov qword [rdi + 0x10], rbx
mov rdx, rbp
add rbx, rbx
mov qword [rdi + 0x18], 7
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rdi], r15w
jmp 0x14000132e
mov rax, rbx
or rax, 7
cmp rax, r14
jbe 0x1400012d2
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
cmp rcx, 0x1000
jb 0x140001305
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001358
mov rcx, rax
call fcn.140001920
test rax, rax
je 0x1400012fe
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14000130d
mov ecx, 0xa
mov r14, rax
cmp rax, rcx
movabs rax, 0x7fffffffffffffff
cmovb r14, rcx
lea rcx, [r14 + 1]
cmp rcx, rax
ja 0x140001358
add rcx, rcx
jne 0x1400012a1
mov rsi, r15
jmp 0x14000130d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001920
mov rsi, rax
mov qword [rdi + 0x10], rbx
mov rdx, rbp
add rbx, rbx
mov qword [rdi], rsi
mov r8, rbx
mov qword [rdi + 0x18], r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rsi], r15w
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rsi, qword [rsp + 0x60]
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov r14, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop rdi
pop rbp
ret
call fcn.1400011a0
int3
call fcn.140001100
int3
Function at 0x140001360
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x80], rax
lea rcx, [rsp + 0x68]
call fcn.1400011c0
nop
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
sub rax, rdi
xor esi, esi
cmp rax, 9
jb 0x1400013e7
lea rax, [rdi + 9]
mov qword [rsp + 0x78], rax
lea rbx, [rsp + 0x68]
cmp rcx, 7
cmova rbx, qword [rsp + 0x68]
lea rcx, [rbx + rdi*2]
mov r8d, 0x12
lea rdx, str.myvarboo
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2 + 0x12], si
jmp 0x1400013ff
mov qword [rsp + 0x20], 9
mov edx, 9
lea rcx, [rsp + 0x68]
call fcn.140001730
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rbp - 0x80]
cmp rcx, rdx
jae 0x14000142a
lea rax, [rcx + 1]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x68]
cmp rdx, 7
cmova rax, qword [rsp + 0x68]
mov dword [rax + rcx*2], esi
jmp 0x140001437
xor r9d, r9d
lea rcx, [rsp + 0x68]
call fcn.1400015a0
mov dword [rbp - 0x70], 0x68
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movaps xmm0, xmmword [str.LauncherJavaBinjavaw.exe__jar_LauncherFD2RebornLauncher.jar]
movaps xmmword [rbp], xmm0
movaps xmm1, xmmword [0x1400033b0]
movaps xmmword [rbp + 0x10], xmm1
movaps xmm0, xmmword [0x1400033c0]
movaps xmmword [rbp + 0x20], xmm0
movaps xmm1, xmmword [0x1400033d0]
movaps xmmword [rbp + 0x30], xmm1
movaps xmm0, xmmword [0x1400033e0]
movaps xmmword [rbp + 0x40], xmm0
movaps xmm1, xmmword [0x1400033f0]
movaps xmmword [rbp + 0x50], xmm1
movaps xmm0, xmmword [0x140003400]
movaps xmmword [rbp + 0x60], xmm0
movaps xmm1, xmmword [0x140003410]
movaps xmmword [rbp + 0x70], xmm1
lea rax, [rsp + 0x68]
cmp qword [rbp - 0x80], 7
cmova rax, qword [rsp + 0x68]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x70]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140001507
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x140002280
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400022ca
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400022ca
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400022ca
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400022ca
cmp dword [rcx + 0x84], 0xe
jbe 0x1400022ca
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400022cc
xor al, al
add rsp, 0x28
ret