joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413c70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rcx, qword [0x00424048]
test rcx, rcx
jne 0x413c91
lea rcx, [0x00424048]
call dbg.lazy_init
mov rcx, rax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x413cff
mov rsi, rax
test rax, rax
jne 0x413d03
call sub.KERNEL32.dll_GetProcessHeap
xor edx, edx
mov r8d, 0x20
mov rcx, rax
call fcn.0041d08c
test rax, rax
je 0x413d11
mov rdi, rax
lea rax, [0x00424048]
mov qword [rdi], rax
mov rsi, rdi
add rsi, 8
mov qword [rdi + 8], 0
mov rcx, qword [0x00424048]
test rcx, rcx
jne 0x413cf5
lea rcx, [0x00424048]
call dbg.lazy_init
mov rcx, rax
mov rdx, rdi
call sub.KERNEL32.dll_TlsSetValue
jmp 0x413d07
xor esi, esi
jmp 0x413d07
add rsi, 8
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 0x20
mov edx, 8
call dbg.handle_alloc_error
ud2

Function at 0x413d30
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
mov qword [rsp + 0x20], rcx
mov rsi, qword [rcx]
mov rcx, qword [rsi]
test rcx, rcx
jne 0x413d54
mov rcx, rsi
call dbg.lazy_init
mov rcx, rax
mov edx, 1
call sub.KERNEL32.dll_TlsSetValue
cmp qword [rdi + 8], 0
je 0x413d81
mov rax, qword [rdi + 0x18]
test rax, rax
je 0x413d81
lock sub qword [rax], 1
jne 0x413d81
lea rcx, [rdi + 0x18]
call dbg.drop_slow<std::thread::Inner>
call sub.KERNEL32.dll_GetProcessHeap
xor edx, edx
mov rcx, rax
mov r8, rdi
call fcn.0041d084
mov rcx, qword [rsi]
test rcx, rcx
jne 0x413da6
mov rcx, rsi
call dbg.lazy_init
mov rcx, rax
xor edx, edx
call sub.KERNEL32.dll_TlsSetValue
nop
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x414040
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rcx, qword [0x00424010]
test rcx, rcx
jne 0x414061
lea rcx, [0x00424010]
call dbg.lazy_init
mov rcx, rax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x4140cf
mov rsi, rax
test rax, rax
jne 0x4140d3
call sub.KERNEL32.dll_GetProcessHeap
xor edx, edx
mov r8d, 0x18
mov rcx, rax
call fcn.0041d08c
test rax, rax
je 0x4140e1
mov rdi, rax
lea rax, [0x00424010]
mov qword [rdi], rax
mov rsi, rdi
add rsi, 8
mov qword [rdi + 8], 0
mov rcx, qword [0x00424010]
test rcx, rcx
jne 0x4140c5
lea rcx, [0x00424010]
call dbg.lazy_init
mov rcx, rax
mov rdx, rdi
call sub.KERNEL32.dll_TlsSetValue
jmp 0x4140d7
xor esi, esi
jmp 0x4140d7
add rsi, 8
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 0x18
mov edx, 8
call dbg.handle_alloc_error
ud2
Function at 0x414100
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x41411d
mov rcx, rsi
call dbg.lazy_init
mov rcx, rax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x41417c
mov rdi, rax
test rax, rax
jne 0x414180
call sub.KERNEL32.dll_GetProcessHeap
xor edx, edx
mov r8d, 0x28
mov rcx, rax
call fcn.0041d08c
test rax, rax
je 0x41418f
mov rbx, rax
mov qword [rax], rsi
mov rdi, rax
add rdi, 8
mov qword [rax + 8], 0
mov rcx, qword [rsi]
test rcx, rcx
jne 0x414172
mov rcx, rsi
call dbg.lazy_init
mov rcx, rax
mov rdx, rbx
call sub.KERNEL32.dll_TlsSetValue
jmp 0x414184
xor edi, edi
jmp 0x414184
add rdi, 8
mov rax, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov ecx, 0x28
mov edx, 8
call dbg.handle_alloc_error
ud2

Function at 0x4141a0
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rdi, rcx
mov qword [rsp + 0x28], rcx
mov rsi, qword [rcx]
mov rcx, qword [rsi]
test rcx, rcx
jne 0x4141c4
mov rcx, rsi
call dbg.lazy_init
mov rcx, rax
mov edx, 1
call sub.KERNEL32.dll_TlsSetValue
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x30]
call dbg.drop_in_place<alloc::boxed::Box<std::thread::local::os::Value<core::cell::RefCell<core::option::Option<alloc::boxed::Box<Write>>>>>>
mov rcx, qword [rsi]
test rcx, rcx
jne 0x4141f0
mov rcx, rsi
call dbg.lazy_init
mov rcx, rax
xor edx, edx
call sub.KERNEL32.dll_TlsSetValue
nop
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x4142f0
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
mov qword [rsp + 0x20], rcx
mov rsi, qword [rcx]
mov rcx, qword [rsi]
test rcx, rcx
jne 0x414314
mov rcx, rsi
call dbg.lazy_init
mov rcx, rax
mov edx, 1
call sub.KERNEL32.dll_TlsSetValue
call sub.KERNEL32.dll_GetProcessHeap
xor edx, edx
mov rcx, rax
mov r8, rdi
call fcn.0041d084
mov rcx, qword [rsi]
test rcx, rcx
jne 0x414343
mov rcx, rsi
call dbg.lazy_init
mov rcx, rax
xor edx, edx
call sub.KERNEL32.dll_TlsSetValue
nop
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x4175c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, qword [rsp + 0x80]
mov r15, qword [rsp + 0x78]
mov r11, qword [rsp + 0x70]
mov ebx, ecx
shr ebx, 8
lea r8, [rdx + r8*2]
xor eax, eax
movzx esi, byte [rdx + 1]
lea r10, [rax + rsi]
cmp byte [rdx], bl
lea rdx, [rdx + 2]
jne 0x417620
cmp r10, rax
jb 0x417680
cmp r10, r11
ja 0x41768d
add rax, r9
xor edi, edi
nop
cmp rsi, rdi
je 0x417622
cmp byte [rax + rdi], cl
lea rdi, [rdi + 1]
jne 0x417610
jmp 0x417670
ja 0x41762a
mov rax, r10
cmp rdx, r8
jne 0x4175e8
add r14, r15
mov rdx, r15
add rdx, 1
movzx ecx, cx
mov al, 1
nop dword [rax]
movzx ebx, byte [r15]
test bl, bl
jns 0x41765c
cmp rdx, r14
je 0x41769a
movzx edi, byte [rdx]
add rdx, 1
and ebx, 0x7f
shl ebx, 8
or ebx, edi
mov r15, rdx
sub ecx, ebx
js 0x417672
xor al, 1
lea rdx, [r15 + 1]
cmp r15, r14
jne 0x417640
jmp 0x417672
xor eax, eax
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, rax
mov rdx, r10
call dbg.slice_index_order_fail
mov rcx, r10
mov rdx, r11
call dbg.slice_index_len_fail
lea rcx, [0x004291e8]
call dbg.panic
Function at 0x41d7a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov ecx, dword [0x00431704]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x41d8b8
mov rax, qword [0x00431708]
xor ebx, ebx
add rax, 8
mov rdx, qword [rax]
cmp rsi, rdx
jb 0x41d7ec
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rsi, rdx
jb 0x41d89e
add ebx, 1
add rax, 0x18
cmp ebx, ecx
jne 0x41d7d0
mov rcx, rsi
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x41d8f0
movsxd rbx, ebx
lea rbx, [rbx + rbx*2]
shl rbx, 3
mov r13, rbx
add r13, qword [0x00431708]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call sym._GetPEImageBase
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
mov qword [r13 + 8], rax
mov rax, qword [0x00431708]
lea rdx, [rsp + 0x20]
mov rcx, qword [rax + rbx + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x41d8d3
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x41d897
sub eax, 4
and eax, 0xfffffffb
je 0x41d897
add rbx, qword [0x00431708]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x41d8bf
add dword [0x00431704], 1
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.memcpy
xor ebx, ebx
jmp 0x41d7f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov rax, qword [0x00431708]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rbx + 8]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call sym.__report_error
nop

Function at 0x41e070
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004319e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004319c0]
test rbx, rbx
je 0x41e0c4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x41e0bb
test rsi, rsi
je 0x41e0bb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x41e0a0
lea rcx, [0x004319e0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x41e300
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x41e310
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x41e320
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x41e361
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x41e358
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x41e363
add rax, 0x28
cmp rax, r9
jne 0x41e344
xor eax, eax
ret
Function at 0x41e400
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x0042b5f0]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
je 0x41e420
mov rax, rdx
add rsp, 0x28
ret
mov rcx, r9
call sym._ValidateImageBase.part.0
test eax, eax
je 0x41e418
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add rax, r9
movzx edx, word [rax + 0x14]
lea rdx, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x41e47d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x41e474
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x41e418
add rdx, 0x28
cmp rdx, r9
jne 0x41e460
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret

Function at 0x41e590
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x0042b5f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x41e5b0
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x41e5a8
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x41e60d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x41e604
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x41e614
add rax, 0x28
cmp rax, r9
jne 0x41e5f0
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x41e630
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x0042b5f0]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
je 0x41e651
mov rax, r9
add rsp, 0x28
ret
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x41e649
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x41e649
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x41e649
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
nop dword [rax + rax]
mov r9d, dword [rdx + 0xc]
cmp rax, r9
mov rcx, r9
jb 0x41e6a4
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x41e6c0
add rdx, 0x28
cmp rdx, r10
jne 0x41e690
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jne 0x41e6d8
jmp 0x41e6ad
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x41e6e6
mov edx, dword [rax + 0xc]
test edx, edx
je 0x41e6ad
test r8d, r8d
jg 0x41e6d0
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret
Function at 0x41f580
Capabilities:
Read file on windows

Disassembly:
push rbp
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x80]
mov r12, qword [rbp]
mov rsi, qword [rbp + 0x10]
mov r13d, edx
mov rdi, rcx
mov edx, r8d
mov ecx, r13d
xor r8d, r8d
mov rbx, r9
call sym.lseek
test eax, eax
js 0x41f640
mov r9, qword [rbp + 8]
mov rcx, rdi
mov r8, r12
mov rdx, rbx
xor edi, edi
call dbg.backtrace_alloc
test rax, rax
mov qword [rsi + 8], rax
je 0x41f5fd
mov qword [rsi], rax
mov r8d, ebx
mov rdx, rax
mov ecx, r13d
mov qword [rsi + 0x10], rbx
call sym.read
test eax, eax
js 0x41f670
cdqe
mov edi, 1
cmp rbx, rax
ja 0x41f610
mov eax, edi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
ret
xor r8d, r8d
mov rcx, qword [rbp + 8]
xor edi, edi
lea rdx, str.file_too_short
call r12
mov rcx, qword [rsi + 8]
call sym.free
mov eax, edi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
ret
call qword [sym.imp.msvcrt.dll__errno]
mov rcx, qword [rbp + 8]
xor edi, edi
mov r8d, dword [rax]
lea rdx, str.lseek
call r12
mov eax, edi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
ret
call qword [sym.imp.msvcrt.dll__errno]
mov rcx, qword [rbp + 8]
lea rdx, str.read
mov r8d, dword [rax]
call r12
mov rcx, qword [rsi + 8]
call sym.free
jmp 0x41f5fd
Function at 0x140001000
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, r9
mov r14, r8
mov rbp, rdx
mov rsi, rcx
test r9, r9
jle 0x14000111d
xor r8d, r8d
mov qword [rsp + 0x50], r15
xor edx, edx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
xor r15d, r15d
test rdi, rdi
je 0x140001119
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], r12
mov r12d, 0x400
nop
cmp rdi, r12
movsxd rdx, r14d
mov rbx, rdi
mov rcx, rsi
cmova rbx, r12
xor r8d, r8d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
mov r9, rsi
lea rcx, [0x140005120]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rbx, rax
test rax, rax
jne 0x1400010a3
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
test eax, eax
jne 0x140001112
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
test eax, eax
jne 0x1400010f3
movsxd rdx, r15d
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
mov r9, rbp
lea rcx, [0x140005120]
mov r8, rbx
mov edx, 1
sub rdi, rbx
add r14d, ebx
add r15d, ebx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, rbx
jne 0x140001112
test rax, rax
jne 0x1400010ea
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
test eax, eax
jne 0x140001112
test rdi, rdi
jne 0x140001050
xor eax, eax
mov r12, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov eax, 0xffffffff
jmp 0x1400010f5
xor eax, eax
jmp 0x1400010ff
mov rbp, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140049eb0]
mov dword [rax], 1
mov rax, qword [0x140049ec0]
mov dword [rax], 1
mov rax, qword [0x140049ed0]
mov dword [rax], 1
mov rax, qword [0x140049e60]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140025880
Capabilities:
Query environment variable

Disassembly:
push rsi
mov eax, 0x10078
push rbx
call fcn.14002d880
sub rsp, rax
xor eax, eax
xor edx, edx
lea rbx, [rsp + 0x20]
lea rsi, [rsp + 0x70]
mov word [rsp + 0x70], ax
mov rcx, rbx
mov word [rsp + 0x20], dx
call fcn.1400257c0
mov rdx, rsi
mov r8d, 0x10000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [rax - 1]
xor eax, eax
cmp edx, 0xffff
ja 0x1400258d6
mov rcx, rsi
call sub.msvcrt.dll__wcsdup
add rsp, 0x10078
pop rbx
pop rsi
ret
Function at 0x14002c560
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.14003dce0
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.14003dce0
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x14002d232
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x1400521e8]
test eax, eax
je 0x14002d2ca
lea rax, [0x1400521c0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x1400521f0]
mov qword [rbp - 8], rax
jmp 0x14002d2ae
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x14002d2a2
cmp qword [rbp - 0x10], 0
je 0x14002d2a2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x14002d268
lea rax, [0x1400521c0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14002d2cb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x14002d3d0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x14002d3f8
mov eax, 0
jmp 0x14002d446
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14002d421
mov eax, 0
jmp 0x14002d446
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x14002d441
mov eax, 0
jmp 0x14002d446
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x14002d44c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14002d4ca
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x14002d4c1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x14002d4c1
mov rax, qword [rbp - 8]
jmp 0x14002d4df
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x14002d494
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400044c0
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x470
mov rax, qword [0x140068040]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rsi, rcx
mov qword [rsp + 0x38], rcx
xor r15d, r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.UGL_External_Version_Checker
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rbx, rax
test rax, rax
je 0x140004642
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
lea rdx, str.https:__refinetweaks.shop_ugl_latest_freeugl_version.txt
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov r14, rax
test rax, rax
je 0x140004639
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov ebx, r15d
mov qword [rsp + 0x50], rbx
mov ebp, 0xf
mov qword [rsp + 0x58], rbp
mov byte [rsp + 0x40], bl
lea r9, [rsp + 0x38]
mov r8d, 0x400
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x14000461d
nop dword [rax]
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x14000461d
mov edi, eax
mov rax, rbp
sub rax, rbx
cmp rdi, rax
ja 0x1400045da
lea rax, [rbx + rdi]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
cmp rbp, 0xf
cmova rax, qword [rsp + 0x40]
add rbx, rax
mov r8d, edi
lea rdx, [rsp + 0x60]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
jmp 0x1400045f1
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x60]
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140006110
lea r9, [rsp + 0x38]
mov r8d, 0x400
lea rdx, [rsp + 0x60]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x14000461d
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
jmp 0x140004590
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x10], xmm1
jmp 0x140004662
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r15
xor r8d, r8d
lea rdx, [0x140057a51]
mov rcx, rsi
call fcn.1400062a0
mov rax, rsi
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.140054490
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret