joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400567a0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xe0
movzx esi, dl
xor edx, edx
movzx ebx, r8b
mov rdi, rcx
lea r8d, [rdx + 0x60]
lea rcx, [rsp + 0x78]
movzx ebp, r9b
call fcn.1400ac250
xor r8d, r8d
test bl, bl
mov eax, 5
mov dword [rsp + 0x70], 0x68
cmovne ax, r8w
cmp qword [rdi + 0x20], 8
mov dword [rsp + 0xac], 1
mov word [rsp + 0xb0], ax
jb 0x14005680c
mov rdx, qword [rdi + 8]
jmp 0x140056810
lea rdx, [rdi + 8]
lea rcx, [rsp + 0x50]
movzx eax, bpl
xor r9d, r9d
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x28], r8d
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14005688c
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test sil, sil
je 0x140056868
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x110]
test rcx, rcx
je 0x14005687f
mov rax, qword [rsp + 0x50]
mov qword [rcx], rax
jmp 0x14005688a
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1400568f0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0xf0
mov rdi, rdx
xor edx, edx
movzx ebx, r8b
mov rbp, rcx
lea r8d, [rdx + 0x60]
lea rcx, [rax - 0x70]
mov rsi, r9
call fcn.1400ac250
cmp byte [rsp + 0x120], 0
lea rax, [0x1400e8df4]
mov dword [rsp + 0x80], 0x68
cmove rax, qword [rsp + 0x90]
xor r12d, r12d
mov qword [rsp + 0x90], rax
test bl, bl
je 0x14005696e
mov dword [rsp + 0xbc], 1
mov word [rsp + 0xc0], r12w
lea rcx, [rsp + 0x60]
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x60], r12
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
jne 0x14005698e
xor al, al
jmp 0x140056a23
cmp qword [rdi + 0x20], 8
jb 0x14005699b
mov r8, qword [rdi + 8]
jmp 0x14005699f
lea r8, [rdi + 8]
movzx ecx, byte [rsp + 0x128]
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x80]
xor edx, edx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x400
mov dword [rsp + 0x28], ecx
mov rcx, rbp
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov rcx, qword [rsp + 0x60]
mov ebx, eax
call sub.USERENV.dll_DestroyEnvironmentBlock
test ebx, ebx
je 0x140056987
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x140056a16
mov rax, qword [rsp + 0x68]
mov qword [rsi], rax
jmp 0x140056a21
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x140057800
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx esi, r8b
mov edi, edx
mov r8d, ecx
mov ecx, 0x100001
xor edx, edx
mov dword [rsp + 0x48], 0
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x140057845
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne dil
test dil, dil
je 0x14005786e
test sil, sil
je 0x14005786e
mov edx, 0xea60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov al, dil
add rsp, 0x20
pop rdi
ret

Function at 0x140058b20
Capabilities:
Parse pe header

Disassembly:
mov rdx, qword [rcx + 8]
mov eax, 0x5a4d
cmp word [rdx], ax
je 0x140058b31
xor al, al
ret
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x140058b2e
mov ecx, 0xf0
cmp word [rax + 0x14], cx
jne 0x140058b2e
mov ecx, 0x20b
cmp word [rax + 0x18], cx
sete al
ret

Function at 0x140058c20
Capabilities:
Enumerate pe sections

Disassembly:
mov r10, qword [rcx + 8]
mov r11, rdx
xor r8d, r8d
nop word [rax + rax]
movsxd r9, dword [r10 + 0x3c]
add r9, r10
movzx eax, word [r9 + 6]
cmp r8d, eax
jae 0x140058c80
movzx edx, word [r9 + 0x14]
lea rcx, [r8 + r8*4]
lea rax, [r9 + rdx]
lea rdx, [rax + rcx*8 + 0x18]
test rdx, rdx
je 0x140058c80
mov eax, dword [rdx + 0xc]
test eax, eax
jne 0x140058c63
xor ecx, ecx
jmp 0x140058c6c
lea rcx, [r10 + rax]
cmp rcx, r11
ja 0x140058c77
mov eax, dword [rdx + 8]
add rax, rcx
cmp rax, r11
ja 0x140058c7c
inc r8d
jmp 0x140058c30
mov rax, rdx
ret
xor eax, eax
ret
Function at 0x140058c90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push r12
push r14
sub rsp, 0x30
mov r14, r8
mov r12, rdx
mov rbp, rcx
test r8, r8
jne 0x140058cb4
xor al, al
add rsp, 0x30
pop r14
pop r12
pop rbp
ret
mov rax, qword [rcx + 8]
mov qword [rsp + 0x28], r13
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
mov rax, qword [rbp]
mov edx, dword [rcx + 0x88]
mov rcx, rbp
call qword [rax]
mov r13, rax
test rax, rax
jne 0x140058cea
mov r13, qword [rsp + 0x28]
add rsp, 0x30
pop r14
pop r12
pop rbp
ret
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x20], r15
cmp r12d, 0xffff
ja 0x140058d12
mov word [r14], r12w
mov al, 1
jmp 0x140058d9f
mov rax, qword [rbp]
mov edx, dword [r13 + 0x20]
mov rcx, rbp
call qword [rax]
mov ecx, dword [r13 + 0x18]
lea rdi, [rax + rcx*4]
mov r15, rax
mov rsi, rax
cmp rax, rdi
je 0x140058d9d
nop word [rax + rax]
mov rax, rdi
mov rcx, rbp
sub rax, rsi
sar rax, 2
cqo
sub rax, rdx
sar rax, 1
lea rbx, [rsi + rax*4]
mov rax, qword [rbp]
mov edx, dword [rbx]
call qword [rax]
movzx edx, byte [r12]
mov rcx, r12
test dl, dl
je 0x140058d81
nop dword [rax]
cmp dl, byte [rax]
jne 0x140058d81
mov dl, byte [rcx + 1]
inc rcx
inc rax
test dl, dl
jne 0x140058d70
movzx edx, byte [rcx]
movzx eax, byte [rax]
sub edx, eax
je 0x140058dc2
test edx, edx
jle 0x140058d95
lea rsi, [rbx + 4]
jmp 0x140058d98
mov rdi, rbx
cmp rsi, rdi
jne 0x140058d40
xor al, al
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
add rsp, 0x30
pop r14
pop r12
pop rbp
ret
mov rax, qword [rbp]
mov edx, dword [r13 + 0x24]
mov rcx, rbp
call qword [rax]
sub rbx, r15
sar rbx, 2
movzx eax, word [rax + rbx*2]
add ax, word [r13 + 0x10]
mov word [r14], ax
mov al, 1
jmp 0x140058d9f
Function at 0x1400973f0
Capabilities:
Read pipe
Write file on windows
Write pipe

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x130
mov ebx, dword [rcx + 0x38]
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xe8], ebx
xor ebx, ebx
mov dword [rsp + 0xe4], eax
lea rcx, [rsp + 0x108]
mov dword [rsp + 0xe0], 1
lea rax, [rdi + 0x5c]
mov qword [rsp + 0x30], rbx
lea r9, [rsp + 0x40]
mov qword [rsp + 0xf0], rax
lea rax, [rdi + 0x60]
lea r8d, [rbx + 0x50]
mov qword [rsp + 0xf8], rax
lea rax, [rdi + 0x68]
lea rdx, [rsp + 0xe0]
mov qword [rsp + 0x100], rax
mov rax, qword [rdi + 0x28]
mov dword [rsp + 0x40], ebx
mov qword [rcx], rax
mov rax, qword [rdi + 0x30]
mov dword [rsp + 0x44], ebx
mov qword [rcx + 8], rax
xor eax, eax
mov rcx, rsi
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x140]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x118], rbx
mov qword [rsp + 0x120], rbx
mov dword [rsp + 0x20], 0x50
mov qword [rsp + 0x128], rbx
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbx
mov dword [rsp + 0x140], ebx
call qword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
je 0x1400975e7
cmp dword [rsp + 0x40], 2
jne 0x1400975e7
cmp dword [rsp + 0x44], ebx
je 0x1400975e7
cmp qword [rsp + 0x78], rbx
je 0x1400975e7
cmp qword [rsp + 0x80], rbx
je 0x1400975e7
cmp qword [rsp + 0x88], rbx
je 0x1400975e7
xor eax, eax
lea r9, [rsp + 0x140]
lea r8d, [rbx + 0x50]
lea rdx, [rsp + 0x90]
mov rcx, rsi
mov dword [rsp + 0x94], ebx
mov dword [rsp + 0x98], ebx
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rbx
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xd8], rbx
mov dword [rsp + 0x90], 3
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400975e7
mov rax, qword [rsp + 0x78]
mov qword [rdi + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rdi + 0x48], rax
mov rax, qword [rsp + 0x88]
mov qword [rdi + 0x50], rax
mov eax, dword [rsp + 0x44]
mov dword [rdi + 0x58], eax
mov al, 1
jmp 0x1400975e9
xor al, al
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140099f70
Capabilities:
Get common file path
Get program files directory

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x3b0
mov rax, qword [0x140112ac0]
xor rax, rsp
mov qword [rsp + 0x3a0], rax
mov rsi, rcx
xor ebx, ebx
lea rcx, [rsp + 0x192]
xor edx, edx
mov r8d, 0x206
mov dword [rsp + 0x30], ebx
mov word [rsp + 0x190], bx
call fcn.1400ac250
lea rdx, [rsp + 0x190]
mov qword [rsp + 0x20], rdx
lea edx, [rbx + 0x26]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14009a0b5
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x3c8], rdi
xor eax, eax
lea rdi, [rsp + 0x190]
lea rdx, [rsp + 0x190]
mov qword [rsp + 0x80], 7
repne scasw ax, word [rdi]
mov qword [rsp + 0x78], rbx
mov word [rsp + 0x68], bx
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x60]
call fcn.1400041c0
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
mov rdx, rsi
mov qword [rsp + 0x58], 7
repne scasw ax, word [rdi]
mov qword [rsp + 0x50], rbx
mov word [rsp + 0x40], bx
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x38]
call fcn.1400041c0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
xor r8d, r8d
call fcn.14005f590
test al, al
sete dil
cmp qword [rsp + 0x58], 8
jb 0x14009a080
mov rcx, qword [rsp + 0x40]
call fcn.1400ab7f0
cmp qword [rsp + 0x80], 8
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rbx
mov word [rsp + 0x40], bx
jb 0x14009a0a8
mov rcx, qword [rsp + 0x68]
call fcn.1400ab7f0
mov al, dil
mov rdi, qword [rsp + 0x3c8]
jmp 0x14009a10c
cmp byte [0x1401148b0], bl
je 0x14009a0f8
call fcn.14003e110
cmp eax, 3
jg 0x14009a0f8
mov ebx, 1
lea rdx, str..installerutilinstall_util.cc
lea rcx, [rsp + 0x88]
lea r9d, [rbx + 2]
lea r8d, [r9 + 0x7f]
call fcn.1400403f0
lea rdx, str.Check_failed:_false.
lea rcx, [rax + 8]
call fcn.140005bd0
test bl, 1
je 0x14009a10a
lea rcx, [rsp + 0x88]
call fcn.14003feb0
mov al, 1
mov rcx, qword [rsp + 0x3a0]
xor rcx, rsp
call fcn.1400ac220
mov rbx, qword [rsp + 0x3d0]
add rsp, 0x3b0
pop rsi
ret

Function at 0x14009b8b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x14009b8e3
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14009b927
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x14009b922
cmp rbx, r11
jae 0x14009b927
add edi, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x14009b910
cmp rbx, r11
jb 0x14009b92b
xor eax, eax
jmp 0x14009b937
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400ac520
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x1400ac5a9
movsxd rax, dword [0x14000003c]
lea rdi, [0x140000000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x1400ac56b
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x1400ac5b9
mov ecx, 0x20b
cmp word [rax + 0x18], cx
je 0x1400ac581
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x1400ac5b9
cmp dword [rax + 0x84], 0xe
ja 0x1400ac595
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x1400ac5b9
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xb0], ebx
jmp 0x1400ac5b9
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
lea rdi, [0x140000000]
mov ecx, 1
call fcn.1400b963c
test eax, eax
jne 0x1400ac5e9
cmp dword [0x140115b00], 1
jne 0x1400ac5d5
call fcn.1400b891c
mov ecx, 0x1c
call fcn.1400b86c8
mov ecx, 0xff
call fcn.1400b0ef4
call fcn.1400b8458
test eax, eax
jne 0x1400ac614
cmp dword [0x140115b00], 1
jne 0x1400ac600
call fcn.1400b891c
mov ecx, 0x10
call fcn.1400b86c8
mov ecx, 0xff
call fcn.1400b0ef4
call fcn.1400b95cc
nop
call fcn.1400b9270
test eax, eax
jns 0x1400ac62d
mov ecx, 0x1b
call fcn.1400b0e88
call sub.KERNEL32.dll_GetCommandLineW
mov qword [0x140117dc8], rax
call fcn.1400b91dc
mov qword [0x140115af8], rax
call fcn.1400b90ec
test eax, eax
jns 0x1400ac658
mov ecx, 8
call fcn.1400b0e88
call fcn.1400b8e14
test eax, eax
jns 0x1400ac66b
mov ecx, 9
call fcn.1400b0e88
mov ecx, 1
call fcn.1400b1024
test eax, eax
je 0x1400ac680
mov ecx, eax
call fcn.1400b0e88
call fcn.1400b8db8
test byte [rsp + 0x6c], 1
movzx edx, word [rsp + 0x70]
mov r9d, 0xa
cmovne r9d, edx
mov r8, rax
xor edx, edx
mov rcx, rdi
call fcn.140009ee0
mov edi, eax
mov dword [rsp + 0x20], eax
test ebx, ebx
jne 0x1400ac6b7
mov ecx, eax
call fcn.1400b1260
call fcn.1400b1278
jmp 0x1400ac6d8
mov eax, edi
jmp 0x1400ac6e1
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
sub rsp, 0x28
call fcn.1400b96b0
add rsp, 0x28
jmp 0x1400ac520

Function at 0x1400b1260
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400b10d4
Function at 0x1400b126c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.1400c26f4
nop
cmp dword [0x140115b60], 1
je 0x1400b120c
mov dword [0x140115b5c], 1
mov byte [0x140115b58], r12b
test ebx, ebx
jne 0x1400b11f8
mov rcx, qword [0x140116d98]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400b11e5
mov rcx, qword [0x140116d90]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x1400b1184
call fcn.1400b8114
cmp qword [rdi], rax
jne 0x1400b1184
jmp 0x1400b116a
cmp rdi, rsi
jb 0x1400b11e5
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.1400b8114
mov qword [rdi], rax
call rbx
mov rcx, qword [0x140116d98]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x140116d90]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x1400b11c3
cmp r13, rax
je 0x1400b11e3
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x1400b116a
lea rdx, [0x1400e8a18]
lea rcx, [0x1400e8a00]
call fcn.1400b0f24
lea rdx, [0x1400e8a28]
lea rcx, [0x1400e8a20]
call fcn.1400b0f24
nop
test r12d, r12d
je 0x1400b121b
mov ecx, 8
call fcn.1400c25d4
test r12d, r12d
jne 0x1400b1246
mov dword [0x140115b60], 1
lea ecx, [r12 + 8]
call fcn.1400c25d4
mov ecx, r15d
call fcn.1400b0eb8
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1400b10d4
Function at 0x1400b8623
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140112ac0]
jne 0x1400ac23a
rol rcx, 0x10
test cx, 0xffff
jne 0x1400ac236
repz ret
ror rcx, 0x10
jmp 0x1400b857c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140115c20]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140115d18]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400b8601
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140115c20]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400b8623
mov rax, qword [rsp + 0x88]
mov qword [0x140115d18], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140115cb8], rax
mov rax, qword [0x140115d18]
mov qword [0x140115b90], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140115ca0], rax
mov dword [0x140115b80], 0xc0000409
mov dword [0x140115b84], 1
mov rax, qword [0x140112ac0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140112ac8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140115c18], eax
mov ecx, 1
call fcn.1400b8104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400f49a0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140115c18], 0
jne 0x1400b86aa
mov ecx, 1
call fcn.1400b8104
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1400cb0f4
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.1400b8114
xor ebx, ebx
mov rdi, rax
cmp qword [0x1401169e0], rbx
jne 0x1400cb1fa
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1400cb2cf
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400cb2cf
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1401169e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1401169e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x1401169f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x140116a00], rax
test rax, rax
je 0x1400cb1f1
lea rdx, [0x1400f5e88]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x1401169f8], rax
jmp 0x1400cb201
mov rax, qword [0x1401169f8]
jmp 0x1400cb208
mov rax, qword [0x1401169f8]
mov r11, qword [0x140116a00]
cmp rax, rdi
je 0x1400cb270
cmp r11, rdi
je 0x1400cb270
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x140116a00]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x1400cb270
test rax, rax
je 0x1400cb270
call rsi
test rax, rax
je 0x1400cb26a
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400cb26a
test byte [rsp + 0x38], 1
jne 0x1400cb270
bts ebp, 0x15
jmp 0x1400cb2ae
mov rcx, qword [0x1401169e8]
cmp rcx, rdi
je 0x1400cb2ae
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400cb2ae
call rax
mov rbx, rax
test rax, rax
je 0x1400cb2ae
mov rcx, qword [0x1401169f0]
cmp rcx, rdi
je 0x1400cb2ae
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400cb2ae
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1401169e0]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400cb2cf
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x1400cb2d1
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140015860
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x20
mov rsi, qword [0x140047c70]
xor edi, edi
mov r15, rcx
mov dword [rsi + 0x2d9c], edi
test rcx, rcx
je 0x140015999
mov qword [rsp + 0x40], rbx
lea rbx, [rsi + 0x2da0]
mov dword [rsi + 0x2d9c], edi
mov ecx, dword [rbx + 4]
mov qword [rsp + 0x48], rbp
test ecx, ecx
jns 0x1400158ba
mov eax, ecx
cdq
sub eax, edx
mov edx, edi
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.140016a20
mov dword [rbx], edi
cmp dword [rbx + 4], edi
jne 0x1400158ce
mov edx, 8
mov rcx, rbx
call fcn.140016a20
movsxd rcx, dword [rbx]
mov ebp, edi
mov rax, qword [rbx + 8]
mov byte [rcx + rax], dil
inc dword [rbx]
mov eax, dword [rsi + 0x2db0]
test eax, eax
jle 0x140015939
mov qword [rsp + 0x50], r14
mov r14, rdi
cmp edi, eax
jl 0x14001590d
mov r8d, 0x5b2
lea rdx, str.C:Users0Documents_nova_efi_source_mainImguiimgui.h
lea rcx, str.i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov r9, qword [rsi + 0x2db8]
mov r8, rbx
add r9, r14
mov rcx, rsi
mov rdx, r9
call qword [r9 + 0x20]
mov eax, dword [rsi + 0x2db0]
inc ebp
add r14, 0x30
cmp ebp, eax
jl 0x14001590d
mov r14, qword [rsp + 0x50]
cmp qword [rbx + 8], rdi
je 0x140015943
mov edi, dword [rbx]
dec edi
mov rax, qword [rsi + 0x2da8]
lea rdx, [0x14003abc0]
test rax, rax
movsxd rbp, edi
lea rdi, [0x140047c68]
mov rcx, r15
cmovne rdi, rax
call fcn.140003870
mov rbx, rax
test rax, rax
je 0x14001598f
mov r9, rax
mov r8, rbp
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret