joyce8/EMBER2024-capa huggingface dataset:
Function at 0x749b60
Capabilities:
Get file version info

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rbp, rsp
mov dword [rbp + 0x28], ecx
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x58], 0
nop
mov rax, qword [0x007dc1c8]
mov rcx, qword [rax]
lea rdx, [rbp + 0x58]
call fcn.006c3d00
mov rcx, qword [rbp + 0x58]
call fcn.00411370
mov rdi, rax
mov rcx, rdi
lea rdx, [rbp + 0x44]
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jne 0x749bf5
call sub.kernel32.dll_GetLastError
mov dword [rbp + 0x44], eax
lea rcx, [rbp + 0x30]
mov edx, dword [rbp + 0x44]
call fcn.004329d0
lea rcx, [rbp + 0x38]
lea rdx, [0x00749cf8]
mov r8, qword [rbp + 0x30]
call fcn.004117d0
mov rax, qword [rbp + 0x38]
mov rcx, rax
or edx, 0xffffffff
or r8d, 0xffffffff
call fcn.0061fc90
mov r13d, ebx
mov rcx, r13
call fcn.004090f0
mov rsi, rax
mov rcx, rdi
xor edx, edx
mov r8d, ebx
mov r9, rsi
call sub.version.dll_GetFileVersionInfoW
mov rcx, rsi
lea rdx, [0x00749d38]
lea r8, [rbp + 0x48]
lea r9, [rbp + 0x54]
call sub.version.dll_VerQueryValueW
mov eax, dword [rbp + 0x28]
sub eax, 1
cmp eax, 0xffffffff
je 0x749c49
test eax, eax
je 0x749c59
sub eax, 1
test eax, eax
je 0x749c6c
sub eax, 1
test eax, eax
jne 0x749c8d
jmp 0x749c7c
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 8]
shr eax, 0x10
mov word [rbp + 0x2e], ax
jmp 0x749c8d
mov rax, qword [rbp + 0x48]
movzx rax, word [rax + 8]
and ax, 0xffff
mov word [rbp + 0x2e], ax
jmp 0x749c8d
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0xc]
shr eax, 0x10
mov word [rbp + 0x2e], ax
jmp 0x749c8d
mov rax, qword [rbp + 0x48]
movzx rax, word [rax + 0xc]
and ax, 0xffff
mov word [rbp + 0x2e], ax
mov rcx, rsi
mov rdx, r13
call fcn.00409120
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.0040fe40
lea rcx, [rbp + 0x58]
call fcn.0040fd60
movzx rax, word [rbp + 0x2e]
lea rsp, [rbp + 0x60]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret
Function at 0x74d4d0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push rbp
sub rsp, 0x300
mov rbp, rsp
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0x310], rcx
mov byte [rbp + 0x318], dl
nop
mov rcx, qword [rbp + 0x310]
call fcn.0040fd60
mov cx, 0x101
lea rdx, [rbp + 0x168]
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x74d632
nop
lea rcx, [rbp + 0x60]
mov edx, pe_nt_image_headers64
call sub.wsock32.dll_gethostname
test eax, eax
jne 0x74d624
lea rcx, [rbp + 0x60]
call sub.wsock32.dll_gethostbyname
mov qword [rbp + 0x160], rax
cmp qword [rbp + 0x160], 0
je 0x74d624
mov rax, qword [rbp + 0x160]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x58], rax
cmp qword [rbp + 0x58], 0
je 0x74d624
mov rax, qword [rbp + 0x58]
cmp qword [rax], 0
je 0x74d624
mov rax, qword [rbp + 0x58]
mov rax, qword [rax]
mov ecx, dword [rax]
call sub.wsock32.dll_inet_ntoa
lea rcx, [rbp + 0x40]
mov rdx, rax
call fcn.00434860
mov rcx, qword [rbp + 0x310]
mov rdx, qword [rbp + 0x40]
call fcn.004114b0
add qword [rbp + 0x58], 8
jmp 0x74d610
cmp byte [rbp + 0x318], 0
jne 0x74d60b
mov ecx, dword [rax]
call sub.wsock32.dll_inet_ntoa
lea rcx, [rbp + 0x38]
mov rdx, rax
call fcn.00434860
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x38]
call fcn.004114b0
mov rcx, qword [rbp + 0x310]
mov edx, 3
mov rax, qword [rbp + 0x310]
mov r8, qword [rax]
lea r9, [0x0074d6b8]
mov rax, qword [rbp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.00411900
add qword [rbp + 0x58], 8
mov rax, qword [rbp + 0x58]
mov rax, qword [rax]
test rax, rax
jne 0x74d5b7
nop
call sub.wsock32.dll_WSACleanup
jmp 0x74d631
xor ecx, ecx
mov rdx, qword [rbp + 0x48]
call fcn.0074d660
jmp 0x74d632
nop
lea rcx, [rbp + 0x30]
call fcn.0040fd60
lea rcx, [rbp + 0x38]
mov edx, 2
call fcn.0040fe70
mov rax, qword [rbp + 0x310]
lea rsp, [rbp + 0x300]
pop rbp
ret
Function at 0x74e2c0
Capabilities:
Open clipboard

Disassembly:
push rbp
sub rsp, 0x60
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0x70], rcx
nop
mov rcx, qword [rbp + 0x70]
call fcn.0040fd60
call fcn.004384c0
movsd qword [rbp + 0x50], xmm0
mov dword [rbp + 0x5c], 0
cmp dword [rbp + 0x5c], 0x14
jge 0x74e366
add dword [rbp + 0x5c], 1
call sub.user32.dll_GetForegroundWindow
mov dword [rbp + 0x58], eax
cmp dword [rbp + 0x58], 0
je 0x74e356
mov eax, dword [rbp + 0x58]
mov rcx, qword [0x007dc1c8]
mov rcx, qword [rcx]
cmp rax, qword [rcx + 0x2d0]
je 0x74e356
mov rcx, qword [0x007ea158]
call fcn.00592a80
mov ecx, dword [rbp + 0x58]
cmp rcx, rax
je 0x74e356
mov dword [rbp + 0x5c], 0x14
jmp 0x74e360
mov ecx, 0x32
call sub.kernel32.dll_Sleep
cmp dword [rbp + 0x5c], 0x14
jl 0x74e311
nop
mov cl, 0x11
xor edx, edx
xor r8, r8
xor r9, r9
call sub.user32.dll_keybd_event
mov cl, 0x43
xor edx, edx
xor r8, r8
xor r9, r9
call sub.user32.dll_keybd_event
mov cl, 0x43
xor edx, edx
mov r8d, 2
xor r9, r9
call sub.user32.dll_keybd_event
mov cl, 0x11
xor edx, edx
mov r8d, 2
xor r9, r9
call sub.user32.dll_keybd_event
mov dword [rbp + 0x5c], 0
cmp dword [rbp + 0x5c], 0x1e
jge 0x74e421
mov rax, qword [0x007dc1c8]
mov rcx, qword [rax]
call fcn.006c2df0
movsd xmm0, qword [0x007d8030]
comisd xmm0, xmmword [rbp + 0x50]
jbe 0x74e40d
lea rcx, [rbp + 0x38]
mov rdx, qword [0x007d8028]
xor r8, r8
call fcn.00748a20
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x38]
call fcn.00431e00
mov rcx, qword [rbp + 0x70]
mov rdx, qword [rbp + 0x40]
lea r8, [0x0074e4f8]
xor r9, r9
call fcn.0053c670
jmp 0x74e421
add dword [rbp + 0x5c], 1
mov ecx, 0x64
call sub.kernel32.dll_Sleep
cmp dword [rbp + 0x5c], 0x1e
jl 0x74e3b6
nop
cmp dword [rbp + 0x5c], 0x1e
jne 0x74e4a1
mov rax, qword [rbp + 0x70]
cmp qword [rax], 0
jne 0x74e4a1
mov rax, qword [0x007dc1c8]
mov rax, qword [rax]
mov rcx, qword [rax + 0x2d0]
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x74e4a1
nop
call fcn.005da5b0
mov rcx, rax
mov dx, 1
call fcn.005da570
test al, al
je 0x74e4a1
call fcn.005da5b0
mov rcx, rax
lea rdx, [rbp + 0x28]
call fcn.005d9ea0
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x28]
lea r8, [0x0074e4f8]
xor r9, r9
call fcn.0053c670
mov rcx, qword [rbp + 0x70]
mov rdx, qword [rbp + 0x30]
call fcn.00431e00
jmp 0x74e4a1
nop
lea rcx, [rbp + 0x28]
mov edx, 4
call fcn.0040fe40
mov rax, qword [rbp + 0x70]
lea rsp, [rbp + 0x60]
pop rbp
ret
Function at 0x74eab0
Capabilities:
Get file attributes

Disassembly:
push rbp
sub rsp, 0x30
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x48], rdx
mov rcx, qword [rbp + 0x48]
call fcn.0040fef0
nop
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x48]
call fcn.00410390
mov rcx, qword [rbp + 0x48]
call fcn.006fe140
test al, al
je 0x74eb72
lea rcx, [rbp + 0x28]
mov rdx, qword [rbp + 0x48]
call fcn.006fe500
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x28]
call fcn.00410410
cmp byte [0x007ea2a7], 1
jne 0x74eb20
mov rcx, qword [rbp + 0x48]
call fcn.006fe600
test al, al
jne 0x74eb24
xor eax, eax
jmp 0x74eb26
mov al, 1
test al, al
jne 0x74eb72
mov rcx, qword [rbp + 0x48]
call fcn.00411370
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
test eax, eax
je 0x74eb72
mov ecx, eax
test ecx, 0x10
je 0x74eb72
cmp eax, 0xffffffff
je 0x74eb72
lea rcx, [0x0074ebc4]
mov rdx, qword [rbp + 0x48]
call fcn.0053c800
test al, al
jne 0x74eb72
mov rcx, qword [rbp + 0x20]
lea rdx, [0x0074ebc4]
call fcn.00411700
nop
lea rcx, [rbp + 0x28]
call fcn.0040fd60
lea rcx, [rbp + 0x48]
call fcn.0040fd60
mov rax, qword [rbp + 0x20]
lea rsp, [rbp + 0x30]
pop rbp
ret
Function at 0x750ac0
Capabilities:
Get common file path

Disassembly:
push rbp
sub rsp, 0x2b0
mov rbp, rsp
mov byte [rbp + 0x27], cl
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x2a8], 0
mov qword [rbp + 0x2a0], 0
mov qword [rbp + 0x298], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x70], 0
nop
movzx rax, byte [rbp + 0x27]
test al, al
je 0x750c60
lea rcx, [rbp + 0x78]
xor edx, edx
call fcn.004098d0
lea rcx, [rbp + 0x2a8]
mov rdx, qword [0x007dbe98]
call fcn.0056b010
lea rcx, [rbp + 0x2a0]
mov rdx, qword [rbp + 0x2a8]
lea r8, [0x00750da8]
call fcn.00416610
lea rcx, [rbp + 0x298]
mov rdx, qword [rbp + 0x2a8]
lea r8, [0x00750db8]
call fcn.00416610
mov rcx, qword [rbp + 0x78]
call fcn.00411370
mov rcx, qword [rbp + 0x2a0]
mov rdx, rax
mov rax, qword [rbp + 0x2a0]
mov rax, qword [rax]
call qword [rax + 0xa0]
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x78]
call fcn.00433f50
mov rcx, qword [rbp + 0x68]
call fcn.00411370
mov rcx, qword [rbp + 0x2a0]
mov rdx, rax
mov rax, qword [rbp + 0x2a0]
mov rax, qword [rax]
call qword [rax + 0x48]
xor ecx, ecx
mov edx, 9
lea r8, [rbp + 0x290]
call sub.shell32.dll_SHGetSpecialFolderLocation
mov rcx, qword [rbp + 0x290]
lea rdx, [rbp + 0x86]
call sub.shell32.dll_SHGetPathFromIDListW
lea rax, [rbp + 0x86]
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], 0xa
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x50], rax
mov byte [rbp + 0x58], 0x11
lea rcx, [rbp + 0x60]
lea rdx, [0x00750dd4]
lea r8, [rbp + 0x40]
mov r9d, 1
call fcn.00434b60
lea rcx, [rbp + 0x70]
mov rdx, qword [rbp + 0x60]
call fcn.00411510
mov rcx, qword [rbp + 0x70]
call fcn.004110c0
mov rcx, qword [rbp + 0x298]
mov rdx, rax
xor r8, r8
mov rax, qword [rbp + 0x298]
mov rax, qword [rax]
call qword [rax + 0x30]
jmp 0x750cde
xor ecx, ecx
mov edx, 9
lea r8, [rbp + 0x290]
call sub.shell32.dll_SHGetSpecialFolderLocation
mov rcx, qword [rbp + 0x290]
lea rdx, [rbp + 0x86]
call sub.shell32.dll_SHGetPathFromIDListW
lea rax, [rbp + 0x86]
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], 0xa
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x50], rax
mov byte [rbp + 0x58], 0x11
lea rcx, [rbp + 0x38]
lea rdx, [0x00750dd4]
lea r8, [rbp + 0x40]
mov r9d, 1
call fcn.00434b60
lea rcx, [rbp + 0x70]
mov rdx, qword [rbp + 0x38]
call fcn.00411510
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x70]
call fcn.004114e0
mov rcx, qword [rbp + 0x30]
call fcn.00433d00
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.0040fe40
lea rcx, [rbp + 0x60]
mov edx, 2
call fcn.0040fe40
lea rcx, [rbp + 0x70]
call fcn.0040fe00
lea rcx, [rbp + 0x78]
call fcn.0040fd60
lea rcx, [rbp + 0x298]
call fcn.00416580
lea rcx, [rbp + 0x2a0]
call fcn.00416580
lea rcx, [rbp + 0x2a8]
call fcn.00416580
lea rsp, [rbp + 0x2b0]
pop rbp
ret
Function at 0x755a00
Capabilities:
Power down monitor
Shutdown system

Disassembly:
push rbp
sub rsp, 0x30
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x48], rdx
mov rcx, qword [rbp + 0x48]
call fcn.0040fef0
nop
xor eax, eax
mov byte [rbp + 0x2f], al
lea rcx, [0x007d8000]
call fcn.0040fd60
lea rcx, [0x00755bc4]
mov rdx, qword [rbp + 0x48]
mov r8d, 1
call fcn.00411c00
test eax, eax
jle 0x755a53
xor ecx, ecx
xor edx, edx
call sub.user32.dll_ExitWindowsEx
mov al, 1
mov byte [rbp + 0x2f], al
lea rcx, [0x00755be4]
mov rdx, qword [rbp + 0x48]
mov r8d, 1
call fcn.00411c00
test eax, eax
jle 0x755a84
mov rcx, rbp
call fcn.00755930
or ecx, 0xffffffff
xor edx, edx
call sub.kernel32.dll_SetSystemPowerState
mov al, 1
mov byte [rbp + 0x2f], al
lea rcx, [0x00755c04]
mov rdx, qword [rbp + 0x48]
mov r8d, 1
call fcn.00411c00
test eax, eax
jle 0x755ab4
mov rcx, rbp
call fcn.00755930
xor ecx, ecx
xor edx, edx
call sub.kernel32.dll_SetSystemPowerState
mov al, 1
mov byte [rbp + 0x2f], al
lea rcx, [0x00755c28]
mov rdx, qword [rbp + 0x48]
mov r8d, 1
call fcn.00411c00
test eax, eax
jle 0x755ae7
mov rcx, rbp
call fcn.00755930
mov ecx, 2
xor edx, edx
call sub.user32.dll_ExitWindowsEx
mov al, 1
mov byte [rbp + 0x2f], al
lea rcx, [0x00755c48]
mov rdx, qword [rbp + 0x48]
mov r8d, 1
call fcn.00411c00
test eax, eax
jle 0x755b1a
mov rcx, rbp
call fcn.00755930
mov ecx, 1
xor edx, edx
call sub.user32.dll_ExitWindowsEx
mov al, 1
mov byte [rbp + 0x2f], al
lea rcx, [0x00755c6c]
mov rdx, qword [rbp + 0x48]
mov r8d, 1
call fcn.00411c00
test eax, eax
jle 0x755b60
mov al, 1
mov byte [rbp + 0x2f], al
mov rax, qword [0x007dc1c8]
mov rax, qword [rax]
mov rcx, qword [rax + 0x2d0]
mov edx, 0x112
mov r8d, 0xf170
mov r9d, 2
call sub.user32.dll_SendMessageW
lea rcx, [0x00755c8c]
mov rdx, qword [rbp + 0x48]
mov r8d, 1
call fcn.00411c00
test eax, eax
jle 0x755b88
mov al, 1
mov byte [rbp + 0x2f], al
mov rcx, qword [rbp + 0x20]
call fcn.006bbce0
nop
lea rcx, [rbp + 0x48]
call fcn.0040fd60
movzx rax, byte [rbp + 0x2f]
lea rsp, [rbp + 0x30]
pop rbp
ret
Function at 0x76a3d0
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], 0
nop
mov rax, qword [rbp + 0x20]
mov byte [rax + 0x87], 1
mov rcx, qword [0x00458a98]
mov dl, 1
call fcn.004915e0
mov qword [0x007ea150], rax
lea rcx, [0x00767d30]
xor edx, edx
call sub.user32.dll_EnumWindows
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0xb0]
mov rax, qword [rax + 0x870]
mov rax, qword [rax + 0x500]
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x28]
mov esi, eax
mov rcx, qword [0x007ea150]
mov rax, qword [0x007ea150]
mov rax, qword [rax]
call qword [rax + 0x28]
xor ecx, ecx
mov edi, eax
sub edi, 1
mov ebx, ecx
cmp ebx, edi
jg 0x76a505
sub edi, ecx
add edi, 1
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0xb0]
mov rax, qword [rax + 0x870]
mov rax, qword [rax + 0x500]
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x28]
cmp eax, dword [0x007ea1cc]
jg 0x76a505
mov rcx, qword [0x007ea150]
lea rdx, [rbp + 0x28]
mov r8d, ebx
mov rax, qword [0x007ea150]
mov r13, qword [rax]
call qword [r13 + 0x18]
mov rcx, qword [0x007ea150]
mov edx, ebx
mov rax, qword [0x007ea150]
mov rax, qword [rax]
call qword [rax + 0x30]
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx + 0xb0]
mov rcx, qword [rcx + 0x870]
mov rcx, qword [rcx + 0x500]
mov rdx, rcx
mov r8, qword [rbp + 0x28]
mov r9, rax
mov rax, qword [rcx]
mov rcx, rdx
mov rdx, r8
mov r8, r9
call qword [rax + 0x80]
add ebx, 1
sub edi, 1
test edi, edi
jne 0x76a466
nop
cmp byte [0x007ea200], 0
je 0x76a563
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0xb0]
mov rax, qword [rax + 0x870]
mov rax, qword [rax + 0x500]
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x28]
cmp esi, eax
je 0x76a563
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0xb0]
mov rax, qword [rax + 0x870]
mov rax, qword [rax + 0x500]
mov rcx, rax
mov edx, esi
lea r8, [0x0076a5b4]
mov rbx, qword [rax]
call qword [rbx + 0xc8]
mov rcx, qword [0x007ea150]
call fcn.0040cd20
nop
lea rcx, [rbp + 0x28]
call fcn.0040fd60
lea rsp, [rbp + 0x30]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret
Function at 0x772890
Capabilities:
Get file system object information

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0x320
mov rbp, rsp
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x318], 0
mov qword [rbp + 0x58], rbp
mov qword [rbp + 0x340], rcx
nop
mov rax, qword [0x007dc728]
mov byte [rax], 0
mov rax, qword [0x007dc358]
mov byte [rax], 0
lea rcx, [0x00772b8c]
call sub.user32.dll_RegisterWindowMessageW
mov dword [0x007ea798], eax
lea rcx, [rbp + 0x50]
call fcn.00434440
lea rcx, [0x007ea7b0]
mov rdx, qword [rbp + 0x50]
call fcn.00410390
lea rdi, [0x007ea3e8]
lea rsi, [0x00772baa]
mov ecx, 0x20
rep movsq qword [rdi], qword [rsi]
cmp qword [0x007d7f78], 0
jne 0x772988
mov rcx, qword [0x0057ae80]
mov dl, 1
xor r8, r8
call fcn.0068d710
mov qword [0x007d7f78], rax
mov rcx, qword [0x007d7f78]
mov dl, 1
call fcn.0068dc50
lea rcx, [0x00772caa]
xor edx, edx
lea r8, [rbp + 0x60]
mov r9d, 0x2b8
mov dword [rsp + 0x20], 0x4000
call sub.shell32.dll_SHGetFileInfoW
mov rcx, qword [0x007d7f78]
mov rdx, rax
call fcn.0068dd20
cmp qword [0x007d7f70], 0
jne 0x7729e7
mov rcx, qword [0x0057ae80]
mov dl, 1
xor r8, r8
call fcn.0068d710
mov qword [0x007d7f70], rax
mov rcx, qword [0x007d7f70]
mov dl, 1
call fcn.0068dc50
lea rcx, [0x00772caa]
xor edx, edx
lea r8, [rbp + 0x60]
mov r9d, 0x2b8
mov dword [rsp + 0x20], 0x4001
call sub.shell32.dll_SHGetFileInfoW
mov rcx, qword [0x007d7f70]
mov rdx, rax
call fcn.0068dd20
mov rcx, qword [0x00560238]
mov dl, 1
call fcn.00560d90
mov qword [0x007ea170], rax
mov rcx, qword [0x00458a98]
mov dl, 1
call fcn.004915e0
mov qword [0x007ea178], rax
mov rcx, qword [0x00458a98]
mov dl, 1
call fcn.004915e0
mov qword [0x007ea180], rax
mov rcx, qword [0x00740d18]
mov dl, 1
call fcn.0040cc60
mov qword [0x007d7fb0], rax
mov rcx, qword [0x004538a8]
mov dl, 1
call fcn.0040cc60
mov rcx, qword [0x007d7fb0]
mov qword [rcx + 8], rax
mov rcx, qword [0x00458a98]
mov dl, 1
call fcn.004915e0
mov qword [0x007d7f50], rax
mov rcx, qword [0x00458a98]
mov dl, 1
call fcn.004915e0
mov qword [0x007d7fc8], rax
mov rax, qword [0x007dc1c8]
mov rcx, qword [rax]
lea rdx, [rbp + 0x38]
call fcn.006c3d00
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x38]
call fcn.00433f50
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x40]
call fcn.0043df60
lea rcx, [0x007ea168]
mov rdx, qword [rbp + 0x48]
call fcn.00410390
mov rcx, qword [rbp + 0x340]
xor edx, edx
call fcn.00763320
call fcn.00747fa0
test al, al
je 0x772aef
mov byte [0x007ea2a7], 1
mov dword [0x007ea198], 1
lea rcx, [0x007ea1d8]
call fcn.0040fd60
cmp qword [0x007ea328], 0
setne al
test byte [0x007ea330], al
je 0x772b30
call fcn.00747fa0
test al, al
jne 0x772b30
mov qword [rbp + 0x318], 0
nop
lea rcx, [rbp + 0x318]
call fcn.00780290
nop
lea rcx, [rbp + 0x318]
call fcn.0040fd60
nop
lea rcx, [rbp + 0x38]
mov edx, 4
call fcn.0040fe40
lea rsp, [rbp + 0x320]
pop rsi
pop rdi
pop rbp
ret
Function at 0x783520
Capabilities:
Terminate process

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x30
mov rbp, rsp
mov rbx, rcx
cmp qword [0x007d8048], 0
je 0x7835ad
mov rcx, qword [0x007d8048]
mov rdx, qword [0x007416e0]
call fcn.0040d100
test al, al
je 0x7835ad
mov rax, qword [0x007d8048]
mov ecx, dword [rax + 8]
lea rdx, [rbp + 0x2c]
call sub.user32.dll_GetWindowThreadProcessId
mov ecx, 1
or edx, 0xffffffff
mov r8d, dword [rbp + 0x2c]
call sub.kernel32.dll_OpenProcess
mov rsi, rax
mov rcx, rsi
xor edx, edx
call sub.kernel32.dll_TerminateProcess
mov rcx, rsi
call sub.kernel32.dll_CloseHandle
mov rax, qword [0x007dc1c8]
mov rcx, qword [rax]
call fcn.006c2df0
mov ecx, 0x1f4
call sub.kernel32.dll_Sleep
mov rcx, rbx
mov edx, 3
call fcn.00778ce0
lea rsp, [rbp + 0x30]
pop rbx
pop rsi
pop rbp
ret
Function at 0x140001154
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x10], 0
mov dword [rbp - 0x1c], 0x30
mov eax, dword [rbp - 0x1c]
mov rax, qword gs:[rax]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov rax, qword [rax + 8]
mov qword [rbp - 0x18], rax
mov dword [rbp - 4], 0
jmp 0x1400011ac
mov rax, qword [rbp - 0x10]
cmp rax, qword [rbp - 0x18]
jne 0x14000119e
mov dword [rbp - 4], 1
jmp 0x1400011e3
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [0x1400054f0]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x40], 0
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x30]
lock cmpxchg qword [rdx], rcx
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x14000118b
mov rax, qword [0x140005500]
mov eax, dword [rax]
cmp eax, 1
jne 0x1400011fd
mov ecx, 0x1f
call sym._amsg_exit
jmp 0x14000123c
mov rax, qword [0x140005500]
mov eax, dword [rax]
test eax, eax
jne 0x140001232
mov rax, qword [0x140005500]
mov dword [rax], 1
mov rax, qword [0x140005540]
mov rdx, rax
mov rax, qword [0x140005530]
mov rcx, rax
call sym._initterm
jmp 0x14000123c
mov dword [0x14000a024], 1
mov rax, qword [0x140005500]
mov eax, dword [rax]
cmp eax, 1
jne 0x140001270
mov rax, qword [0x140005520]
mov rdx, rax
mov rax, qword [0x140005510]
mov rcx, rax
call sym._initterm
mov rax, qword [0x140005500]
mov dword [rax], 2
cmp dword [rbp - 4], 0
jne 0x140001294
mov rax, qword [0x1400054f0]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
mov rdx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
xchg qword [rax], rdx
mov rax, qword [0x140005440]
mov rax, qword [rax]
test rax, rax
je 0x1400012bf
mov rax, qword [0x140005440]
mov rax, qword [rax]
mov r8d, 0
mov edx, 2
mov ecx, 0
call rax
call sym._pei386_runtime_relocator
mov rax, qword [sym._gnu_exception_handler]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call rax
mov rdx, qword [0x1400054e0]
mov qword [rdx], rax
lea rax, [sym.__mingw_invalidParameterHandler]
mov rcx, rax
call sym._set_invalid_parameter_handler
call sym._fpreset
mov eax, dword [0x14000a004]
lea rdx, [0x14000a008]
mov ecx, eax
call sym.duplicate_ppstrings
call sym.__main
mov rax, qword [0x140005470]
mov rax, qword [rax]
mov rdx, qword [0x14000a010]
mov qword [rax], rdx
mov rcx, qword [0x14000a010]
mov rdx, qword [0x14000a008]
mov eax, dword [0x14000a004]
mov r8, rcx
mov ecx, eax
call dbg.main
mov dword [0x14000a01c], eax
mov eax, dword [0x14000a020]
test eax, eax
jne 0x14000135d
mov eax, dword [0x14000a01c]
mov ecx, eax
call sym.exit
mov eax, dword [0x14000a024]
test eax, eax
jne 0x14000136c
call sym._cexit
mov eax, dword [0x14000a01c]
add rsp, 0x70
pop rbp
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1400054a0]
mov dword [rax], 1
mov rax, qword [0x1400054b0]
mov dword [rax], 1
mov rax, qword [0x1400054c0]
mov dword [rax], 1
mov rax, qword [0x140005460]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001aa0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x140002772
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x14000a168]
test eax, eax
je 0x14000280a
lea rax, [0x14000a140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x14000a170]
mov qword [rbp - 8], rax
jmp 0x1400027ee
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1400027e2
cmp qword [rbp - 0x10], 0
je 0x1400027e2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1400027a8
lea rax, [0x14000a140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14000280b
nop
add rsp, 0x30
pop rbp
ret