joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002700
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [rsp + 0x70], 0
je 0x18000271e
cmp qword [rsp + 0x78], 0
jne 0x180002725
xor eax, eax
jmp 0x180002861
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 0x3c]
mov rax, qword [rsp + 0x70]
add rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
add rax, 0x88
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
cmp dword [rax + 4], 0
jne 0x18000275d
xor eax, eax
jmp 0x180002861
mov rax, qword [rsp + 0x48]
mov ecx, dword [rax]
mov rax, qword [rsp + 0x70]
add rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x18], 0
je 0x180002787
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x14], 0
jne 0x18000278e
xor eax, eax
jmp 0x180002861
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax + 0x20]
mov rax, qword [rsp + 0x70]
add rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax + 0x24]
mov rax, qword [rsp + 0x70]
add rax, rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], 0
jmp 0x1800027e9
mov eax, dword [rsp + 0x50]
add eax, 1
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x40]
add rax, 4
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x20]
add rax, 2
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 0x50], eax
jae 0x18000285f
mov rax, qword [rsp + 0x40]
mov ecx, dword [rax]
mov rax, qword [rsp + 0x70]
add rax, rcx
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x180002815
jmp 0x18000285f
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x78]
call fcn.1800686ac
test eax, eax
jne 0x18000285a
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
shl eax, 2
cdqe
mov eax, dword [rcx + rax]
mov dword [rsp + 0x54], eax
mov ecx, dword [rsp + 0x54]
mov rax, qword [rsp + 0x70]
add rax, rcx
jmp 0x180002861
jmp 0x1800027c2
xor eax, eax
add rsp, 0x68
ret

Function at 0x18001f4bc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xb0], rdx
test rdx, 0xffffffffffff0000
jne 0x18001f4fb
cmp dword [rcx + 0xa8], 0
jne 0x18001f4fb
movzx eax, dx
mov dword [rcx + 0xa8], eax
call fcn.180020b10
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.18001f460
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180021e9c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.1800358b8
mov rsi, rax
test rax, rax
je 0x180021f18
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
test rbx, rbx
je 0x180021f13
cmp dword [rbx], 0x40
jb 0x180021f13
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_SendMessageA]
bt rax, 0xd
jb 0x180021f13
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x180021f1c
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18002a670
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x18002a6d8
call fcn.180020b10
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
je 0x18002a6d8
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x18002a6fa
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.18002a088
mov esi, eax
test rdi, rdi
je 0x18002a6f8
test rbx, rbx
je 0x18002a6f8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x18002b6b8
Capabilities:
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
movsxd rsi, r8d
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0xa0], 0
jne 0x18002b6f6
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x18002b7aa
call fcn.18002f624
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x18002b715
mov ecx, 0x80004005
call fcn.180003710
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rcx, qword [rbx + 0xa0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0x118]
mov rdx, rsi
or rsi, 0xffffffffffffffff
mov r9, rsi
mov r8, qword [rsp + 0x40]
mov rcx, rdi
call fcn.18006abb0
test eax, eax
je 0x18002b77d
cmp eax, 0xc
je 0x18002b777
cmp eax, 0x16
je 0x18002b771
cmp eax, 0x22
je 0x18002b771
cmp eax, 0x50
je 0x18002b77d
call fcn.1800335c4
int3
call fcn.1800335c4
int3
call fcn.18003357c
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x18002b7a8
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180033cfc
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xa8], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x180033d73
call fcn.180033c88
mov rsi, rax
test rax, rax
jne 0x180033d2f
mov eax, edi
jmp 0x180033d89
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
cmove edi, dword [rsp + 0x30]
jmp 0x180033d2b
mov r9, qword [rcx + 0xd0]
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x180048a74
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rdi, r9
mov rsi, r8
mov rbx, rcx
lea rcx, [rsp + 0x40]
call fcn.18001b14c
nop
cmp rbx, 0xffffffff80000000
jne 0x180048b00
call fcn.18001f858
cmp eax, 1
jne 0x180048b00
lea r8, [rsp + 0x40]
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x20]
call fcn.18001d66c
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.18001d52c
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180048af9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, 0xffffffff80000001
mov r9, rdi
mov r8, rsi
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x180048b37
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180048b4c
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rdi, r9
mov esi, r8d
mov rbx, rcx
lea rcx, [rsp + 0x50]
call fcn.18001b14c
nop
cmp rbx, 0xffffffff80000000
jne 0x180048bd8
call fcn.18001f858
cmp eax, 1
jne 0x180048bd8
lea r8, [rsp + 0x50]
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x30]
call fcn.18001d66c
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.18001d52c
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180048bd1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, 0xffffffff80000001
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
mov r9, rdi
mov r8d, esi
mov rdx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ebx, eax
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x180048c17
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x180048c2c
Capabilities:
Delete registry key

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
lea rcx, [rsp + 0x40]
call fcn.18001b14c
nop
cmp rbx, 0xffffffff80000000
jne 0x180048ca8
call fcn.18001f858
cmp eax, 1
jne 0x180048ca8
lea r8, [rsp + 0x40]
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x50]
call fcn.18001d66c
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.18001d52c
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180048ca1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, 0xffffffff80000001
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x180048cd9
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x1800698cc
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x180069734

Function at 0x180071d8b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1806b3590]
jne 0x180068b0a
rol rcx, 0x10
test cx, 0xffff
jne 0x180068b06
repz ret
ror rcx, 0x10
jmp 0x180071ce4
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1806b8be0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x1806b8cd8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180071d69
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1806b8be0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180071d8b
mov rax, qword [rsp + 0x88]
mov qword [0x1806b8cd8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1806b8c78], rax
mov rax, qword [0x1806b8cd8]
mov qword [0x1806b8b50], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1806b8c60], rax
mov dword [0x1806b8b40], 0xc0000409
mov dword [0x1806b8b44], 1
mov rax, qword [0x1806b3590]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1806b3598]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1806b8bd8], eax
mov ecx, 1
call fcn.180088c38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1800abce8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1806b8bd8], 0
jne 0x180071e12
mov ecx, 1
call fcn.180088c38
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x180089f0c
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.18006d8c8
xor ebx, ebx
mov rdi, rax
cmp qword [0x1806b9910], rbx
jne 0x18008a012
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x18008a0e7
lea rdx, [0x1800ae7f8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18008a0e7
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x1800ae7e8]
mov rcx, rsi
mov qword [0x1806b9910], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x1800ae7d0]
mov rcx, rsi
mov qword [0x1806b9918], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x1806b9920], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x1806b9930], rax
test rax, rax
je 0x18008a009
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x1806b9928], rax
jmp 0x18008a019
mov rax, qword [0x1806b9928]
jmp 0x18008a020
mov rax, qword [0x1806b9928]
mov r11, qword [0x1806b9930]
cmp rax, rdi
je 0x18008a088
cmp r11, rdi
je 0x18008a088
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x1806b9930]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x18008a088
test rax, rax
je 0x18008a088
call rsi
test rax, rax
je 0x18008a082
lea rcx, [rsp + 0x88]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18008a082
test byte [rsp + 0x38], 1
jne 0x18008a088
bts ebp, 0x15
jmp 0x18008a0c6
mov rcx, qword [0x1806b9918]
cmp rcx, rdi
je 0x18008a0c6
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18008a0c6
call rax
mov rbx, rax
test rax, rax
je 0x18008a0c6
mov rcx, qword [0x1806b9920]
cmp rcx, rdi
je 0x18008a0c6
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18008a0c6
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1806b9910]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18008a0e7
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x18008a0e9
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140007dec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140007e38
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140007e30
cmp dword [rcx + 0x3c], edx
jl 0x140007e30
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140007e30
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140007e38
mov rax, rdx
add rsp, 0x18
ret
Function at 0x180001db0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
Function at 0x180012d90
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0
mov qword [rsp + 8], 0
mov qword [rsp], 0
mov qword [rsp + 0x20], 0
mov rax, qword gs:[0x60]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
mov rax, qword [rax + 0x238]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x18]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
mov qword [rsp], rax
mov rax, qword [rsp]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x180012e3d
mov rax, qword [rsp]
cmp dword [rax + 0x3c], 0
jle 0x180012e3d
mov rax, qword [rsp]
cmp dword [rax + 0x3c], 0x190
jge 0x180012e3d
mov rax, qword [rsp]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
cmp dword [rax], 0x4550
jne 0x180012e3d
jmp 0x180012e4c
mov rax, qword [rsp + 8]
dec rax
mov qword [rsp + 8], rax
jmp 0x180012de9
mov rax, qword [rsp + 8]
add rsp, 0x38
ret
Function at 0x180014570
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x308
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0xb0], 0
Function at 0x140002640
Capabilities:
Manipulate console buffer

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov r14, r9
mov ebx, r8d
mov ebp, edx
movzx edi, word [rsp + 0x90]
lea rsi, [rsp + 0x38]
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], 1
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
add ebp, ebp
mov dword [rsp + 0x28], ebp
mov esi, ebx
not esi
and ebx, 0xdd4fe7c4
mov eax, esi
and eax, 0x22b0183b
or eax, ebx
xor eax, 0x22b0e7c4
and esi, 0xffff0000
or esi, eax
mov eax, esi
not eax
and eax, 0x1fc721b8
and esi, 0xe038de47
or esi, eax
xor esi, 0xe038de47
mov eax, 0x30908a3f
mov rbx, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbp, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop dword [rax]
cmp eax, 0xdd6fc886
je 0x140002710
cmp eax, 0x30908a3f
jne 0x1400026e0
mov eax, dword [rsp + 0x28]
mov word [rsp + 0x26], ax
mov ecx, 0xfffffff5
call rbx
mov rcx, rax
mov edx, edi
call rbp
mov dword [rsp + 0x2c], esi
mov eax, 0xdd6fc886
jmp 0x1400026e0
mov eax, dword [rsp + 0x2c]
shl eax, 0x10
movzx r8d, word [rsp + 0x26]
mov edi, eax
not edi
mov ecx, edi
and ecx, 0x134407fd
and eax, 0xecbb0000
or eax, ecx
mov r9d, eax
xor r9d, 0x84334002
mov ebx, r8d
not ebx
xor eax, 0x134407fd
mov ecx, eax
or ecx, 0x9c4c300f
or edi, 0x63b3cff0
xor edi, ecx
mov esi, edi
not esi
mov ecx, r8d
or ecx, 0x84403005
mov edx, ebx
or edx, 0x22038e70
and ecx, 0x8440be75
mov ebp, ebx
and ebp, 0x41b04180
or ebp, ecx
and edx, 0xa643be75
mov ecx, r8d
and ecx, 0xa
or ecx, edx
xor ecx, ebp
and esi, 0x76211779
and edi, 0x89de0080
or edi, esi
mov edx, ecx
not edx
and edx, 0x5420df79
and ecx, 0x1922086
or ecx, edx
xor ecx, edi
mov edx, eax
and edx, 0x78cc0000
and r9d, 0x8733439a
or r9d, edx
or eax, r8d
and r8d, 0xbc65
and ebx, 0x8733439a
or ebx, r8d
xor ebx, r9d
not eax
or eax, ebx
mov edx, eax
not edx
and edx, 0xc316b974
and eax, 0x3ce9468b
or eax, edx
mov edx, eax
xor edx, 0x24c14480
xor eax, 0xc316b974
mov esi, ecx
not esi
mov ebp, esi
and ebp, 0x183a3b3b
and ecx, 0xe7c5c4c4
or ecx, ebp
or esi, eax
and eax, 0x183a3b3b
and edx, 0xe7c5c4c4
or edx, eax
xor edx, ecx
not esi
or esi, edx
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, esi
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea rcx, [0x1400c1ae0]
mov rdx, r14
call fcn.1400043a0
mov rax, qword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140003540
Capabilities:
Manipulate console buffer

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov r14d, r9d
mov r12d, r8d
mov ebx, edx
movzx ebp, word [rsp + 0xa0]
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov eax, 0x80db16b
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0x30584eaf
je 0x14000359d
cmp eax, 0x80db16b
jne 0x140003580
mov dword [rsp + 0x28], 1
mov eax, 0x30584eaf
jmp 0x140003580
lea rax, [rsp + 0x2c]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov dword [rax], 0
mov r15, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call r15
lea rdx, [rsp + 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
add ebx, ebx
mov ecx, 0xfffffff5
call r15
mov rcx, rax
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
shl r12d, 0x10
mov ecx, ebx
not ecx
mov edx, ecx
and edx, 0xffff0000
movzx eax, bx
or eax, edx
not eax
or eax, ecx
mov edx, eax
not edx
mov ecx, r12d
not ecx
and ecx, 0xbf80b5e9
mov edi, r12d
and edi, 0x407f0000
or edi, ecx
mov r8d, edi
xor r8d, 0x407f4a16
mov ebp, eax
and ebp, 0x592344c2
xor eax, 0x13c9a198
and eax, edx
mov ebx, edx
and ebx, 0xa6dcbb3c
or ebx, ebp
mov ebp, ebx
xor ebp, 0xa6dcbb3d
xor edi, 0x53b6eb8f
and edi, r8d
mov esi, r12d
xor esi, 0xec360000
and esi, r12d
xor ebx, 0xb5151aa4
and ebx, ebp
mov edx, edi
not edx
mov ecx, esi
not ecx
mov r9d, edx
and r9d, 0x54efa459
and edi, 0xab105a26
or edi, r9d
or edx, ecx
and ecx, 0x54efa459
and esi, 0xab100000
or esi, ecx
xor esi, edi
not edx
or edx, esi
mov ecx, ebx
and ecx, eax
xor eax, ebx
or eax, ecx
mov ecx, edx
not ecx
and ecx, 0x6ca303a
and edx, 0xf935cfc5
or edx, ecx
mov ecx, eax
not ecx
and ecx, 0x6ca303a
and eax, 0xf935cfc5
or eax, ecx
xor eax, edx
mov ecx, r8d
and ecx, ebp
xor ebp, r8d
or ebp, ecx
mov ecx, ebp
not ecx
and ecx, 0x75979436
and ebp, 0x8a686bc9
or ebp, ecx
xor ebp, 0x8a686bc9
mov ecx, eax
and ecx, ebp
xor ebp, eax
or ebp, ecx
mov ecx, 0xfffffff5
call r15
mov rcx, rax
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea rcx, [0x1400c1ae0]
mov edx, r14d
call fcn.14000aaa0
mov rax, qword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret