joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400623f1
Capabilities:
Query environment variable

Disassembly:
jmp 0x1400edc64
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
mov rbx, rax
test rax, rax
je 0x1400edd4c
mov rsi, rax
cmp word [rax], r14w
je 0x1400edcb7
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], r14w
jne 0x1400edc9f
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], r14w
jne 0x1400edc9b
mov qword [rsp + 0x38], r14
sub rsi, rbx
mov qword [rsp + 0x30], r14
add rsi, 2
sar rsi, 1
mov r8, rbx
mov r9d, esi
mov dword [rsp + 0x28], r14d
xor edx, edx
mov qword [rsp + 0x20], r14
xor ecx, ecx
call fcn.140063909
movsxd rbp, eax
test eax, eax
je 0x1400edd4c
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov rcx, rbp
lea edx, [r9 - 0x64]
call fcn.1400625ae
mov rdi, rax
test rax, rax
je 0x1400edd3a
mov qword [rsp + 0x38], r14
mov r9d, esi
mov qword [rsp + 0x30], r14
mov r8, rbx
mov dword [rsp + 0x28], ebp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.140063909
test eax, eax
je 0x1400edd3a
mov rsi, rdi
mov rdi, r14
jmp 0x1400edd3d
mov rsi, r14
mov edx, 2
mov rcx, rdi
call fcn.140063a8a
jmp 0x1400edd4f
mov rsi, r14
test rbx, rbx
je 0x1400edd5d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140062b44
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x14006dc20
mov qword [rsp + 8], rcx
sub rsp, 0x38
call fcn.14006d590
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14006dc57
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
call qword [0x14016d010]
jmp 0x14006dc5d
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x38
ret
Function at 0x14006317a
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400e4e30
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret

Function at 0x140063382
Capabilities:
Set environment variable

Disassembly:
jmp 0x14010aeb0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
lea rcx, [rsp + 0x70]
call fcn.140064183
lea rcx, [rsp + 0x40]
call fcn.140064183
call fcn.140063dc3
mov r8d, eax
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0xb0]
call fcn.140061663
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14010af1f
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x40]
call fcn.140063f67
lea rcx, [rsp + 0x70]
call fcn.140063f67
mov eax, dword [rsp + 0x24]
jmp 0x14010afac
call fcn.140063dc3
mov r8d, eax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0xb8]
call fcn.140061663
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x14010af66
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x40]
call fcn.140063f67
lea rcx, [rsp + 0x70]
call fcn.140063f67
mov eax, dword [rsp + 0x2c]
jmp 0x14010afac
lea rcx, [rsp + 0x40]
call fcn.140061023
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x70]
call fcn.140061023
mov rcx, qword [rsp + 0x38]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x40]
call fcn.140063f67
lea rcx, [rsp + 0x70]
call fcn.140063f67
mov eax, dword [rsp + 0x30]
add rsp, 0xa8
ret

Function at 0x140063454
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x14006dd40
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x38
call fcn.14006d650
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14006dd7f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
call qword [0x14016d010]
jmp 0x14006dd8e
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x38
ret

Function at 0x1400637a1
Capabilities:
Parse pe header

Disassembly:
jmp 0x14006a090
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14006a0b0
xor al, al
jmp 0x14006a131
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14006a0c3
xor al, al
jmp 0x14006a131
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14006a0ed
xor al, al
jmp 0x14006a131
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14006a101
xor al, al
jmp 0x14006a131
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14006a113
xor al, al
jmp 0x14006a131
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14006a12f
xor al, al
jmp 0x14006a131
mov al, 1
add rsp, 0x38
ret
Function at 0x140063a5d
Capabilities:
Terminate process

Disassembly:
jmp 0x1400e01f0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1400e021e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.140063bb1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140063cba
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1400f9a70
mov qword [rsp + 8], rcx
sub rsp, 0x38
call fcn.1400f8ac0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400f9aa7
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
call qword [0x14016d010]
jmp 0x1400f9aad
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x38
ret

Function at 0x140063e54
Capabilities:
Get geographical location

Disassembly:
jmp 0x1400f9d40
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1400f8cc0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400f9d93
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
call qword [0x14016d010]
jmp 0x1400f9db5
xor edx, edx
mov rcx, qword [rsp + 0x50]
call fcn.1400627c5
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x48
ret
Function at 0x140001154
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x10], 0
mov dword [rbp - 0x1c], 0x30
mov eax, dword [rbp - 0x1c]
mov rax, qword gs:[rax]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov rax, qword [rax + 8]
mov qword [rbp - 0x18], rax
mov dword [rbp - 4], 0
jmp 0x1400011ac
mov rax, qword [rbp - 0x10]
cmp rax, qword [rbp - 0x18]
jne 0x14000119e
mov dword [rbp - 4], 1
jmp 0x1400011e3
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [0x1400064b0]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x40], 0
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x30]
lock cmpxchg qword [rdx], rcx
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x14000118b
mov rax, qword [0x1400064c0]
mov eax, dword [rax]
cmp eax, 1
jne 0x1400011fd
mov ecx, 0x1f
call sym._amsg_exit
jmp 0x14000123c
mov rax, qword [0x1400064c0]
mov eax, dword [rax]
test eax, eax
jne 0x140001232
mov rax, qword [0x1400064c0]
mov dword [rax], 1
mov rax, qword [0x140006500]
mov rdx, rax
mov rax, qword [0x1400064f0]
mov rcx, rax
call sym._initterm
jmp 0x14000123c
mov dword [0x14000a024], 1
mov rax, qword [0x1400064c0]
mov eax, dword [rax]
cmp eax, 1
jne 0x140001270
mov rax, qword [0x1400064e0]
mov rdx, rax
mov rax, qword [0x1400064d0]
mov rcx, rax
call sym._initterm
mov rax, qword [0x1400064c0]
mov dword [rax], 2
cmp dword [rbp - 4], 0
jne 0x140001294
mov rax, qword [0x1400064b0]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
mov rdx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
xchg qword [rax], rdx
mov rax, qword [0x140006400]
mov rax, qword [rax]
test rax, rax
je 0x1400012bf
mov rax, qword [0x140006400]
mov rax, qword [rax]
mov r8d, 0
mov edx, 2
mov ecx, 0
call rax
call sym._pei386_runtime_relocator
mov rax, qword [sym._gnu_exception_handler]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call rax
mov rdx, qword [0x1400064a0]
mov qword [rdx], rax
lea rax, [sym.__mingw_invalidParameterHandler]
mov rcx, rax
call sym._set_invalid_parameter_handler
call sym._fpreset
mov eax, dword [0x14000a004]
lea rdx, [0x14000a008]
mov ecx, eax
call sym.duplicate_ppstrings
call sym.__main
mov rax, qword [0x140006430]
mov rax, qword [rax]
mov rdx, qword [0x14000a010]
mov qword [rax], rdx
mov rcx, qword [0x14000a010]
mov rdx, qword [0x14000a008]
mov eax, dword [0x14000a004]
mov r8, rcx
mov ecx, eax
call sym.main
mov dword [0x14000a01c], eax
mov eax, dword [0x14000a020]
test eax, eax
jne 0x14000135d
mov eax, dword [0x14000a01c]
mov ecx, eax
call sym.exit
mov eax, dword [0x14000a024]
test eax, eax
jne 0x14000136c
call sym._cexit
mov eax, dword [0x14000a01c]
add rsp, 0x70
pop rbp
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140006460]
mov dword [rax], 1
mov rax, qword [0x140006470]
mov dword [rax], 1
mov rax, qword [0x140006480]
mov dword [rax], 1
mov rax, qword [0x140006420]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400028a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x140003572
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x14000a188]
test eax, eax
je 0x14000360a
lea rax, [0x14000a160]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x14000a190]
mov qword [rbp - 8], rax
jmp 0x1400035ee
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1400035e2
cmp qword [rbp - 0x10], 0
je 0x1400035e2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1400035a8
lea rax, [0x14000a160]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14000360b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140003710
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140003738
mov eax, 0
jmp 0x140003786
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140003761
mov eax, 0
jmp 0x140003786
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140003781
mov eax, 0
jmp 0x140003786
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x14000378c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14000380a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140003801
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140003801
mov rax, qword [rbp - 8]
jmp 0x14000381f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x1400037d4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x142f11ddc
Capabilities:
Encode data using xor

Disassembly:
jmp 0x142f11de6
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x142f11e0f
pop rbp
sub rbp, 0x33
sub rbp, 0x2f11ddc
sub rsp, 0x20
jmp 0x142f11e2e
mov rax, 0x2f11ddc
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xcce9c0f
xor byte [rax], dl
inc rax
dec rcx
jne 0x142f11e4d
jmp 0x142f11e64
xchg r14b, r12b
test byte [rsi + 0xf0f0f33], al
mov cs, r14d
invalid
Function at 0x140001d53
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [section..data]
jne 0x14000192a
rol rcx, 0x10
test cx, 0xffff
jne 0x140001926
repz ret
ror rcx, 0x10
jmp 0x140001cac
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14001b0c0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14001b1b8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140001d31
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14001b0c0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140001d53
mov rax, qword [rsp + 0x88]
mov qword [0x14001b1b8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14001b158], rax
mov rax, qword [0x14001b1b8]
mov qword [0x14001b030], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14001b140], rax
mov dword [0x14001b020], 0xc0000409
mov dword [0x14001b024], 1
mov rax, qword [section..data]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14001a008]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14001b0b8], eax
mov ecx, 1
call fcn.140003ff4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140014650]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14001b0b8], 0
jne 0x140001dda
mov ecx, 1
call fcn.140003ff4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x14000222c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14000209c
Function at 0x140005288
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140003204
xor ebx, ebx
cmp qword [0x14001c0c0], rbx
mov rdi, rax
jne 0x14000539b
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140005472
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005472
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14001c0c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14001c0c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14001c0d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14001c0e0], rax
test rax, rax
je 0x140005392
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14001c0d8], rax
jmp 0x1400053a2
mov rax, qword [0x14001c0d8]
jmp 0x1400053a9
mov rax, qword [0x14001c0d8]
mov r11, qword [0x14001c0e0]
cmp rax, rdi
je 0x140005410
cmp r11, rdi
je 0x140005410
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14001c0e0]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140005410
test rax, rax
je 0x140005410
call rsi
test rax, rax
je 0x14000540a
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14000540a
test byte [rsp + 0x40], 1
jne 0x140005410
bts ebp, 0x15
jmp 0x140005450
mov rcx, qword [0x14001c0c8]
cmp rcx, rdi
je 0x140005450
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140005450
call rax
mov rbx, rax
test rax, rax
je 0x140005450
mov rcx, qword [0x14001c0d0]
cmp rcx, rdi
je 0x140005450
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140005450
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14001c0c0]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140005472
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140005474
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140001910
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800019c0
Capabilities:
Read .ini file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x798]
sub rsp, 0x898
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x18006e080]
xor rax, rsp
mov qword [rbp + 0x780], rax
mov ebx, r9d
mov rsi, r8
mov rdi, rdx
mov r14, rcx
lea r9, [rcx + 0xc0]
cmp qword [r9 + 0x18], 8
jb 0x180001a0f
mov r9, qword [r9]
mov r8d, ebx
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, ebx
jne 0x180001b32
mov qword [rsp + 0x50], 7
xor r15d, r15d
mov qword [rsp + 0x48], r15
mov word [rsp + 0x38], r15w
xor r8d, r8d
lea rdx, [0x18004e740]
lea rcx, [rsp + 0x38]
call fcn.180004c30
nop
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp - 0x80]
call fcn.180032950
mov r8d, ebx
lea rdx, [0x18004e938]
lea rcx, [rbp - 0x80]
call fcn.180004fc0
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov r9, rsi
mov r8, rdi
lea rdx, [rsp + 0x58]
mov rcx, r14
call fcn.180001980
mov rbx, rax
lea rax, [rsp + 0x38]
cmp rax, rbx
je 0x180001ade
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x180001abc
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.180004d80
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r15
mov word [rsp + 0x38], r15w
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.180004250
nop
mov r8, qword [rsp + 0x70]
cmp r8, 8
jb 0x180001afb
inc r8
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x58]
call fcn.180004d80
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call fcn.180034e10
mov ebx, eax
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x180001b32
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.180004d80
mov eax, ebx
mov rcx, qword [rbp + 0x780]
xor rcx, rsp
call fcn.180011890
add rsp, 0x898
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180001b60
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x888
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x18006e080]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov r14, r9
mov rbp, r8
mov rdi, rdx
mov r15, rcx
mov qword [rsp + 0x40], rdx
mov rsi, qword [rsp + 0x8e0]
xor ebx, ebx
mov dword [rsp + 0x30], ebx
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x70]
call fcn.180032950
lea rax, [r15 + 0xc0]
cmp qword [rax + 0x18], 8
jb 0x180001bcd
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x70]
mov r8, rsi
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbx
cmp qword [rdi + 0x18], 8
jb 0x180001c06
mov rax, qword [rdi]
jmp 0x180001c09
mov rax, rdi
mov word [rax], bx
cmp word [rsp + 0x70], bx
je 0x180001c2a
lea rax, [rsp + 0x70]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x180001c20
mov r8, rbx
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.180004c30
mov dword [rsp + 0x30], 1
cmp qword [rdi + 0x18], 8
jb 0x180001c4e
mov rax, qword [rdi]
jmp 0x180001c51
mov rax, rdi
mov r11, rsi
sub r11, rax
nop word [rax + rax]
movzx r10d, word [rax]
movzx edx, word [rax + r11]
sub r10d, edx
jne 0x180001c76
add rax, 2
test edx, edx
jne 0x180001c60
test r10d, r10d
jne 0x180001cbb
mov qword [rsp + 0x20], rsi
mov r9, r14
mov r8, rbp
lea rdx, [rsp + 0x48]
mov rcx, r15
call fcn.180001980
mov rdx, rax
mov rcx, rdi
call fcn.180001800
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x180001cbb
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.180004d80
mov rax, rdi
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.180011890
add rsp, 0x888
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret