joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ae8c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x50
xor ebx, ebx
mov r13d, r9d
mov esi, r8d
mov r12d, edx
mov r15, rcx
mov r14d, ebx
test rcx, rcx
je 0x1400ae8fe
lea r8d, [rbx + 2]
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
mov rbp, rax
jmp 0x1400ae905
mov rbp, qword [0x140117728]
test rbp, rbp
je 0x1400aeace
mov qword [rsp + 0x80], rdi
lea rdi, [0x1401190d4]
test r12d, r12d
jns 0x1400ae92e
movzx eax, r12w
neg ax
movzx edx, ax
jmp 0x1400ae966
mov eax, 1
test r12d, r12d
lea r9, [rsp + 0x40]
cmovne eax, r12d
lea r8, [0x1400ae8a0]
mov edx, SafeArrayGetElemsize
mov rcx, rbp
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x40], eax
call qword [sym.imp.KERNEL32.DLL_EnumResourceNamesW]
mov rdx, qword [rsp + 0x48]
cmp rdx, rdi
je 0x1400aea97
mov r8d, SafeArrayGetElemsize
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_FindResourceW]
test rax, rax
je 0x1400aea97
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_LoadResource]
test rax, rax
je 0x1400aea97
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_LockResource]
mov rdi, rax
test rax, rax
je 0x1400aea97
cmp esi, 0xffffffff
cmove esi, r13d
test esi, esi
jne 0x1400ae9c7
lea ecx, [rsi + 0xb]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, eax
movzx eax, word [rdi + 4]
lea r8, [rdi + 6]
mov r11, rbx
mov r9d, ebx
test eax, eax
jle 0x1400aea97
mov rdx, r8
mov r10d, eax
mov edi, 0x100
nop dword [rax + rax]
movzx ecx, byte [r8]
mov eax, ebx
test ecx, ecx
cmove ecx, edi
cmp ecx, r9d
jle 0x1400aea08
cmp r9d, esi
setl al
jmp 0x1400aea0d
cmp ecx, esi
setge al
test eax, eax
je 0x1400aea17
mov r11, rdx
mov r9d, ecx
add rdx, 0xe
add r8, 0xe
dec r10
jne 0x1400ae9f0
test r11, r11
je 0x1400aea97
movzx edx, word [r11 + 0xc]
lea r8d, [r10 + 3]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_FindResourceW]
mov rdi, rax
test rax, rax
je 0x1400aea97
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_LoadResource]
test rax, rax
je 0x1400aea97
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_LockResource]
mov rsi, rax
test rax, rax
je 0x1400aea97
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_SizeofResource]
mov dword [rsp + 0x30], ebx
mov r9d, 0x30000
mov r8d, 1
mov rcx, rsi
mov edx, eax
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateIconFromResourceEx]
mov r14, rax
mov rcx, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0x80]
test rcx, rcx
je 0x1400aeab6
test r14, r14
je 0x1400aeab6
mov qword [rcx], rbp
jmp 0x1400aeac4
test r15, r15
je 0x1400aeac4
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_FreeLibrary]
test r14, r14
je 0x1400aeace
mov rax, r14
jmp 0x1400aeaf0
test r12d, r12d
jle 0x1400aeada
lea ebx, [r12 - 1]
jmp 0x1400aeae2
cmp r12d, 0xffffffff
cmovl ebx, r12d
mov r8d, ebx
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ExtractIconW]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
Function at 0x1400b07f0
Capabilities:
Write clipboard data

Disassembly:
push rbx
push rsi
sub rsp, 0x28
mov rsi, rcx
lea rcx, [0x140119dc8]
mov rbx, rdx
call fcn.140006620
test eax, eax
jne 0x1400b082d
lea r8, [0x1400e245c]
lea rdx, str.Cant_open_clipboard_for_writing.
lea rcx, [0x140119170]
add rsp, 0x28
pop rsi
pop rbx
jmp fcn.1400406a0
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x20], r14
call qword [sym.imp.USER32.dll_EmptyClipboard]
lea rbp, [rsi + rbx]
lea rbx, [rsi + 4]
xor r14d, r14d
cmp rbx, rbp
ja 0x1400b08f2
mov r13d, dword [rsi]
test r13d, r13d
je 0x1400b08f2
mov rax, rbx
add rbx, 8
cmp rbx, rbp
ja 0x1400b08f2
mov edi, dword [rax]
mov rsi, rbx
add rbx, rdi
cmp rbx, rbp
ja 0x1400b08f2
mov rdx, r14
test rdi, rdi
mov ecx, 0x42
sete dl
add rdx, rdi
call qword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov r12, rax
test rax, rax
je 0x1400b09b0
test rdi, rdi
je 0x1400b08d9
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GlobalLock]
test rax, rax
je 0x1400b0951
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call fcn.1400cab30
mov rcx, r12
call qword [sym.imp.KERNEL32.DLL_GlobalUnlock]
mov rsi, rbx
mov rdx, r12
mov ecx, r13d
call qword [sym.imp.USER32.dll_SetClipboardData]
lea rbx, [rsi + 4]
cmp rbx, rbp
jbe 0x1400b0860
cmp dword [0x140119df4], r14d
je 0x1400b092c
cmp qword [0x140119dd8], r14
je 0x1400b0918
mov rcx, qword [0x140119dc8]
call qword [sym.imp.KERNEL32.DLL_GlobalUnlock]
mov qword [0x140119dd8], r14
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x140119df4], r14d
mov qword [0x140119dc8], r14
mov eax, 1
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbx
ret
mov rcx, r12
call qword [sym.imp.KERNEL32.DLL_GlobalFree]
cmp dword [0x140119df4], r14d
je 0x1400b0994
cmp qword [0x140119dd8], r14
je 0x1400b0980
mov rcx, qword [0x140119dc8]
call qword [sym.imp.KERNEL32.DLL_GlobalUnlock]
mov qword [0x140119dd8], r14
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x140119df4], r14d
mov qword [0x140119dc8], r14
lea r8, [0x1400e245c]
lea rdx, [0x1400e2868]
lea rcx, [0x140119170]
call fcn.1400406a0
jmp 0x1400b0931
cmp dword [0x140119df4], r14d
je 0x1400b09ea
cmp qword [0x140119dd8], r14
je 0x1400b09d6
mov rcx, qword [0x140119dc8]
call qword [sym.imp.KERNEL32.DLL_GlobalUnlock]
mov qword [0x140119dd8], r14
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x140119df4], r14d
mov qword [0x140119dc8], r14
lea r8, [0x1400e245c]
lea rdx, str.Out_of_memory.
lea rcx, [0x140119170]
call fcn.1400406a0
jmp 0x1400b0931
Function at 0x1400b0e60
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
movzx ecx, byte [rcx + 0x23]
mov rbx, rdx
test ecx, ecx
je 0x1400b10a0
dec ecx
mov qword [rsp + 0x50], rsi
je 0x1400b0efa
dec ecx
je 0x1400b0ec3
dec ecx
je 0x1400b0ea7
mov rdx, qword [rdi + 0x28]
mov rcx, rbx
call qword [rdi + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
test rdx, rdx
je 0x1400b0eb1
xor esi, esi
mov word [rdx], si
xor eax, eax
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
lea rcx, [0x140119dc8]
call fcn.140005ee0
xor esi, esi
mov ecx, 0xffffffff
cmp rax, rcx
cmove rax, rsi
test rbx, rbx
je 0x1400b103d
mov word [rbx + rax*2], si
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, rdi
call fcn.140001130
cmp dword [0x1401178c8], 0
jne 0x1400b0ffb
cmp qword [rdi + 0x10], 0
jne 0x1400b0ffb
cmp qword [0x14011ad08], rdi
jne 0x1400b0f28
test rbx, rbx
jne 0x1400b0fa7
mov rcx, qword [rdi + 0x28]
lea rdx, [rsp + 0x40]
xor r8d, r8d
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
test eax, eax
je 0x1400b0fa2
xor esi, esi
mov qword [0x14011ad08], rsi
test rbx, rbx
je 0x1400b0f90
mov edx, dword [0x1401178a4]
test edx, edx
je 0x1400b0f72
mov r9, qword [rdi + 0x28]
lea r8, str.An_environment_variable_is_being_accessed__see_NoEnv.
lea rcx, [0x140119170]
mov qword [rsp + 0x20], rsi
call fcn.140041150
mov rcx, qword [rdi + 0x28]
mov rdx, rbx
call fcn.1400adef0
mov rsi, qword [rsp + 0x50]
mov eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
dec eax
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
test rbx, rbx
je 0x1400b0fe2
cmp byte [rdi + 0x23], 0
jne 0x1400b0fb3
mov rax, qword [rdi + 0x10]
jmp 0x1400b0fb6
mov rax, rdi
test byte [rax + 0x21], 4
je 0x1400b0fc4
mov rcx, rdi
call fcn.1400412b0
xor esi, esi
xor eax, eax
mov word [rbx], si
mov qword [0x14011ad08], rsi
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x50]
mov qword [0x14011ad08], rdi
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov r8, qword [rdi + 0x10]
mov qword [rsp + 0x48], rbp
mov rbp, r8
shr rbp, 1
test rbx, rbx
je 0x1400b109b
test r8, r8
jne 0x1400b104d
xor esi, esi
mov rax, rdi
cmp byte [rdi + 0x23], sil
cmove rax, rsi
test byte [rax + 0x21], 4
je 0x1400b1033
mov rcx, rdi
call fcn.1400412b0
mov word [rbx], si
xor eax, eax
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdi + 8]
cmp rbx, rdx
je 0x1400b109b
cmp r8, 0x186a0
jae 0x1400b108d
movzx eax, word [rdx]
test ax, ax
je 0x1400b1083
nop word [rax + rax]
add rdx, 2
mov word [rbx], ax
add rbx, 2
movzx eax, word [rdx]
test ax, ax
jne 0x1400b1070
xor esi, esi
mov rax, rbp
mov word [rbx], si
jmp 0x1400b1038
mov rcx, rbx
call fcn.1400cab30
xor esi, esi
mov word [rbx + rbp*2], si
mov rax, rbp
jmp 0x1400b1038
mov rcx, qword [rdi + 0x10]
call fcn.1400b0e60
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1400b1ec0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
test r8b, r8b
je 0x1400b1edb
call fcn.140081d00
jmp 0x1400b1eeb
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
test edi, edi
js 0x1400b1f5e
je 0x1400b1f5e
mov qword [rsp + 0x30], rsi
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov edx, 1
mov ecx, 0x8000012f
mov esi, eax
call fcn.140001a70
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400b1f4b
add edi, esi
nop dword [rax]
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x1400b1f4b
mov edx, 1
mov ecx, 0x8000012f
call fcn.140001a70
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400b1f20
mov rax, rbx
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b49d0
Capabilities:
Check for time delay via gettickcount
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
movzx ebp, dl
mov rbx, rcx
jne 0x1400b49f7
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret
mov qword [rsp + 0x38], rdi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8, qword [0x1401124a8]
mov rdx, rax
mov rcx, rbx
mov rdi, rax
call fcn.1400b5040
cmp byte [rbx], 0
je 0x1400b4a3f
test rax, rax
jne 0x1400b4a48
xor r8d, r8d
movzx edx, bpl
mov rcx, rbx
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
jmp fcn.1400b4b60
test rax, rax
jne 0x1400b4b19
test rdi, rdi
je 0x1400b4add
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 0x10]
mov qword [rsp + 0x30], rsi
call qword [sym.imp.USER32.dll_PostMessageW]
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov edx, 1
mov ecx, 0x8000012f
mov esi, eax
call fcn.140001a70
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400b4abf
nop dword [rax]
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
lea ecx, [rsi + 0x1f4]
sub ecx, eax
cmp ecx, 5
jle 0x1400b4abf
mov edx, 1
mov ecx, 0x8000012f
call fcn.140001a70
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400b4a90
mov rax, qword [0x1401124a8]
mov rsi, qword [rsp + 0x30]
mov ecx, dword [rax + 0x74]
cmp ecx, 0xffffffff
jle 0x1400b4add
mov edx, 1
call fcn.140001a70
cmp byte [rbx], 0
je 0x1400b4b3c
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, rdi
je 0x1400b4b19
mov r8, qword [0x1401124a8]
mov rdx, rax
mov rcx, rbx
call fcn.1400b5040
test rax, rax
je 0x1400b4b19
mov eax, 1
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret
cmp byte [rbx], 0
je 0x1400b4b3c
xor r8d, r8d
movzx edx, bpl
mov rcx, rbx
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
jmp fcn.1400b4b60
movzx edx, bpl
mov rcx, rbx
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
jmp fcn.1400b4db0
Function at 0x1400ca49c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400ca30c

Function at 0x1400d4108
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1401112b0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.1400cdf38
xor ebx, ebx
cmp qword [0x1401159e8], rbx
mov rdi, rax
jne 0x1400d421b
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1400d42f2
lea rdx, [0x1400e19e0]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
test rax, rax
je 0x1400d42f2
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1401159e8], rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1401159f0], rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x1401159f8], rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_EncodePointer]
mov r11, rax
mov qword [0x140115a08], rax
test rax, rax
je 0x1400d4212
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_EncodePointer]
mov qword [0x140115a00], rax
jmp 0x1400d4222
mov rax, qword [0x140115a00]
jmp 0x1400d4229
mov rax, qword [0x140115a00]
mov r11, qword [0x140115a08]
cmp rax, rdi
je 0x1400d4290
cmp r11, rdi
je 0x1400d4290
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_DecodePointer]
mov rcx, qword [0x140115a08]
mov rsi, rax
call qword [sym.imp.KERNEL32.DLL_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x1400d4290
test rax, rax
je 0x1400d4290
call rsi
test rax, rax
je 0x1400d428a
lea rcx, [rsp + 0x30]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400d428a
test byte [rsp + 0x40], 1
jne 0x1400d4290
bts ebp, 0x15
jmp 0x1400d42d0
mov rcx, qword [0x1401159f0]
cmp rcx, rdi
je 0x1400d42d0
call qword [sym.imp.KERNEL32.DLL_DecodePointer]
test rax, rax
je 0x1400d42d0
call rax
mov rbx, rax
test rax, rax
je 0x1400d42d0
mov rcx, qword [0x1401159f8]
cmp rcx, rdi
je 0x1400d42d0
call qword [sym.imp.KERNEL32.DLL_DecodePointer]
test rax, rax
je 0x1400d42d0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1401159e8]
call qword [sym.imp.KERNEL32.DLL_DecodePointer]
test rax, rax
je 0x1400d42f2
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x1400d42f4
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d16f0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400d645f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1401112b0]
jne 0x1400d170a
rol rcx, 0x10
test cx, 0xffff
jne 0x1400d1706
repz ret
ror rcx, 0x10
jmp 0x1400d63b8
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140115b30]
call qword [sym.imp.KERNEL32.DLL_RtlCaptureContext]
mov rax, qword [0x140115c28]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.DLL_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400d643d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140115b30]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.DLL_RtlVirtualUnwind
jmp 0x1400d645f
mov rax, qword [rsp + 0x88]
mov qword [0x140115c28], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140115bc8], rax
mov rax, qword [0x140115c28]
mov qword [0x140115aa0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140115bb0], rax
mov dword [0x140115a90], 0xc0000409
mov dword [0x140115a94], 1
mov rax, qword [0x1401112b0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1401112b8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.DLL_IsDebuggerPresent]
mov dword [0x140115b28], eax
mov ecx, 1
call fcn.1400d3e28
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_SetUnhandledExceptionFilter]
lea rcx, [0x1400e23b0]
call qword [sym.imp.KERNEL32.DLL_UnhandledExceptionFilter]
cmp dword [0x140115b28], 0
jne 0x1400d64e6
mov ecx, 1
call fcn.1400d3e28
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_TerminateProcess]
add rsp, 0x88
ret
Function at 0x43e4e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x240
mov rbp, rsp
mov rbx, rcx
mov rcx, rbx
call fcn.0040f840
mov r13d, eax
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call fcn.00418010
mov esi, eax
cmp esi, 0x104
jbe 0x43e53b
mov ecx, esi
add ecx, ecx
mov ecx, ecx
call fcn.00409130
mov rdi, rax
jmp 0x43e53f
lea rdi, [rbp + 0x38]
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], esi
call fcn.00418010
mov rcx, rdi
call sub.user32.dll_CharUpperW
xor ebx, ebx
xor ecx, ecx
mov edx, esi
sub edx, 1
mov eax, ecx
cmp eax, edx
jg 0x43e595
sub edx, ecx
add edx, 1
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movsxd rcx, eax
movzx ecx, word [rdi + rcx*2]
xor ebx, ecx
add eax, 1
sub edx, 1
test edx, edx
jne 0x43e576
nop
lea rax, [rbp + 0x38]
cmp rdi, rax
je 0x43e5a7
mov rcx, rdi
call fcn.00409160
mov eax, ebx
lea rsp, [rbp + 0x240]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret

Function at 0x43fc60
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x828
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
mov rcx, rbx
call fcn.0040efc0
mov rcx, rsi
call fcn.00410340
mov rdi, rax
mov rcx, rdi
lea rdx, [rbp + 0x20]
mov r8d, 0x400
call sub.kernel32.dll_GetEnvironmentVariableW
mov esi, eax
cmp esi, 0x400
jge 0x43fcb4
mov rcx, rbx
lea rdx, [rbp + 0x20]
mov r8d, esi
call fcn.0040f2c0
jmp 0x43fcd7
mov rcx, rbx
mov edx, esi
sub edx, 1
call fcn.004105c0
mov rcx, qword [rbx]
call fcn.00410340
mov rcx, rdi
mov rdx, rax
mov r8d, esi
call sub.kernel32.dll_GetEnvironmentVariableW
mov rax, rbx
lea rsp, [rbp + 0x828]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x45a050
Capabilities:
Encode data using xor

Disassembly:
mov al, 0xb5
mov r8, rcx
xor edx, edx
mov ecx, edx
and ecx, 0x3f
mov r9, r8
shr r9, cl
and r9b, 0xff
xor al, r9b
add edx, 1
cmp edx, 8
jne 0x45a057
nop
ret

Function at 0x460c80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, r8d
mov edx, edx
lea rdx, [rcx + rdx]
cmp rcx, rdx
jae 0x460ca4
movzx r8, byte [rcx]
xor eax, r8d
imul eax, eax, 0x1000193
add rcx, 1
cmp rcx, rdx
jb 0x460c8e
nop
ret
Function at 0x140021320
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x14003c1e0], rbx
je 0x14002136c
cmp rax, rbx
jne 0x14002135f
mov ebx, 1
mov esi, ebx
jmp 0x140021371
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140021344
mov ebx, 1
mov eax, dword [0x14003c1e8]
cmp eax, ebx
jne 0x140021387
mov ecx, 0x1f
call fcn.1400d4000
jmp 0x1400213ec
mov eax, dword [0x14003c1e8]
test eax, eax
jne 0x1400213e6
mov dword [0x14003c1e8], ebx
lea r15, [0x140026030]
lea rdi, [0x140026018]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x1400213d8
test eax, eax
jne 0x1400213dc
cmp qword [rdi], 0
je 0x1400213cd
mov rax, qword [rdi]
mov rcx, qword [0x140025fc8]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x1400213ae
test eax, eax
je 0x1400213ec
mov eax, 0xff
jmp 0x1400214c8
mov dword [0x14003bac4], ebx
mov eax, dword [0x14003c1e8]
cmp eax, ebx
jne 0x140021413
lea rdx, [0x140026010]
lea rcx, [0x140025fd0]
call sub.msvcrt.dll__initterm
mov dword [0x14003c1e8], 2
test esi, esi
jne 0x140021420
xor eax, eax
xchg qword [0x14003c1e0], rax
cmp qword [0x14003c200], 0
je 0x140021454
lea rcx, [0x14003c200]
call fcn.140021a40
test eax, eax
je 0x140021454
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14003c200]
mov r9, qword [0x140025fc8]
call r9
mov r8, qword [0x14003bad8]
mov rdx, qword [0x14003bad0]
mov ecx, dword [0x14003bac8]
call fcn.140001984
mov dword [0x14003bac0], eax
cmp dword [0x14003bae0], 0
jne 0x140021484
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14003bac4], 0
jne 0x140021499
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14003bac0]
jmp 0x1400214c8
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.140021ad4
add rsp, 0x28
jmp 0x140021320

Function at 0x14002192c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140021978
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140021970
cmp dword [rcx + 0x3c], edx
jl 0x140021970
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140021970
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140021978
mov rax, rdx
add rsp, 0x18
ret