joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005a9c
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140005aff
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140005b13
lea rdx, str.RegDeleteKeyTransactedA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005b13
mov rcx, qword [rbx]
and qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
jmp 0x140005b18
cmp dword [rcx + 8], 0
je 0x140005b13
mov rdx, r8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x140005b18
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140005cb8
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x140005cde
mov r8, rdx
mov rdx, qword [rbx]
call fcn.140005a9c
jmp 0x140005d45
cmp byte [0x14005c380], 0
jne 0x140005d22
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140005d12
lea rdx, [0x140046460]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14005c378], rax
jmp 0x140005d19
mov rax, qword [0x14005c378]
mov byte [0x14005c380], 1
jmp 0x140005d29
mov rax, qword [0x14005c378]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x140005d3f
mov r8d, dword [rbx + 8]
xor r9d, r9d
call rax
jmp 0x140005d45
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140005fa4
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
xor edi, edi
mov rbx, r8
mov rbp, rdx
mov r12, rcx
test r8, r8
jne 0x140005fd2
lea eax, [rdi + 0xd]
jmp 0x140006009
mov rsi, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov ecx, eax
add edi, eax
add rsi, rcx
cmp eax, 1
jne 0x140005fd5
mov rcx, qword [r12]
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
Function at 0x14000d518
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x48
and qword [rsp + 0x30], 0
mov eax, 4
lea rdx, str.SOFTWAREIntelDisplayigfxcuiigfxtrayTrayIcon
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x30]
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], 0x3a98
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000d590
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
lea rdx, str.FadeAwayTime
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x58]
add rsp, 0x48
ret
Function at 0x14000ef68
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov dword [rsp + 0x10], edx
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x60
and qword [rbp - 8], 0
and dword [rbp + 0x30], 0
and dword [rbp - 0x10], 0
and dword [rbp + 0x20], 0
mov edi, ecx
mov eax, 0x20019
lea ecx, [rax + 6]
mov ebx, 1
lea rdx, str.SOFTWAREIntelDisplayigfxcuiigfxtrayTrayIcon
cmp edi, ebx
mov dword [rbp + 0x38], 4
cmove eax, ecx
lea rcx, [rbp - 0x10]
xor r9d, r9d
mov qword [rsp + 0x40], rcx
lea rcx, [rbp - 8]
xor r8d, r8d
mov qword [rsp + 0x38], rcx
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
and dword [rsp + 0x20], 0
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14000f0d7
mov rcx, qword [rbp - 8]
lea rdx, [0x140046e50]
test edi, edi
jne 0x14000f086
lea rax, [rbp + 0x30]
lea r9, [rbp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20]
mov dword [rbp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14000f081
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rbp - 8]
lea rdx, str.SOFTWAREIntelDisplayigfxcuiigfxtrayTrayIcon
mov r9d, ebx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000f0a4
mov rcx, qword [rbp - 8]
lea rax, [rbp + 0x30]
lea r9, [rbp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20]
lea rdx, [0x140046e50]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000f0a4
mov ebx, dword [rbp + 0x20]
jmp 0x14000f0a4
mov r9d, dword [rbp + 0x38]
lea rax, [rbp + 0x28]
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rdx, str.Intel_R__Graphics
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14000f0cd
movsxd r9, dword [rbp + 0x28]
xor r8d, r8d
mov edx, 0x1729
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x60
pop rdi
pop rbx
pop rbp
ret
Function at 0x14000f0e4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
and qword [rbp - 8], 0
and dword [rbp + 0x18], 0
and dword [rbp - 0x10], 0
and dword [rbp + 0x20], 0
lea rax, [rbp - 0x10]
lea rdx, str.SoftwareIntelDisplayigfxcuiHotKeys
mov qword [r11 - 0x28], rax
lea rax, [rbp - 8]
xor r9d, r9d
mov qword [r11 - 0x30], rax
and qword [r11 - 0x38], 0
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20019
and dword [rsp + 0x20], 0
mov dword [rbp + 0x28], 4
mov ebx, 1
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14000f200
mov rcx, qword [rbp - 8]
lea rax, [rbp + 0x18]
lea r9, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20]
lea rdx, str.Enable
xor r8d, r8d
mov dword [rbp + 0x18], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000f18e
mov ebx, dword [rbp + 0x20]
jmp 0x14000f1f6
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rbp - 8]
lea rdx, str.SoftwareIntelDisplayigfxcuiHotKeys
mov r9d, ebx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000f1f6
mov rcx, qword [rbp - 8]
lea rax, [rbp + 0x18]
lea r9, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20]
lea rdx, str.Enable
xor r8d, r8d
mov dword [rbp + 0x18], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
cmove ebx, dword [rbp + 0x20]
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x14001b084
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
lea rbp, [rax - 0xa8]
sub rsp, 0x190
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140059d90]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov r13, rdx
mov rbx, rcx
and qword [rsp + 0x48], 0
xor esi, esi
mov dword [rsp + 0x40], 0x104
xor dil, dil
mov r9, qword [rdx + 8]
mov r8, qword [rdx]
lea rdx, [rsp + 0x68]
mov rcx, r13
call fcn.140019b8c
lea r11, [rsp + 0x48]
mov qword [rsp + 0x20], r11
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.Softwareinteldisplayigfxcui_schemes
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14001b21d
and qword [rsp + 0x38], rsi
and qword [rsp + 0x30], rsi
and qword [rsp + 0x28], rsi
and qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x14001b21d
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.14000f640
mov r12d, eax
lea edi, [rsi + 1]
add esi, edi
cmp r12d, edi
jne 0x14001b1cc
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.1400026fc
nop
lea rdx, [rsp + 0x50]
mov rcx, r13
call fcn.140019f00
nop
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x14001b1cc
or ecx, 0xffffffff
lock xadd dword [rax + 0x10], ecx
dec ecx
jne 0x14001b1c6
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001b1b0
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001b1be
call fcn.14002098c
mov rcx, rbx
call fcn.140020508
and qword [rsp + 0x50], 0
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x70]
call fcn.1400213f0
mov dword [rsp + 0x40], 0x104
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov edx, esi
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x14001b162
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001b22d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, dil
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140021570
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rbp
ret
Function at 0x1400267b3
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140059d90]
jne 0x14002158a
rol rcx, 0x10
test cx, 0xffff
jne 0x140021586
repz ret
ror rcx, 0x10
jmp 0x14002670c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14005ca10]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14005cb08]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140026791
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14005ca10]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400267b3
mov rax, qword [rsp + 0x88]
mov qword [0x14005cb08], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14005caa8], rax
mov rax, qword [0x14005cb08]
mov qword [0x14005c980], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14005ca90], rax
mov dword [0x14005c970], 0xc0000409
mov dword [0x14005c974], 1
mov rax, qword [0x140059d90]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140059d98]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14005ca08], eax
mov ecx, 1
call fcn.140035a58
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14004b068]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14005ca08], 0
jne 0x14002683a
mov ecx, 1
call fcn.140035a58
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x140028d74
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140028be4
Function at 0x14003a87c
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140059d90]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140024ba4
xor ebx, ebx
cmp qword [0x14005d9c0], rbx
mov rdi, rax
jne 0x14003a98f
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14003aa66
lea rdx, [0x14004d508]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003aa66
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14005d9c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14005d9c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14005d9d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14005d9e0], rax
test rax, rax
je 0x14003a986
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14005d9d8], rax
jmp 0x14003a996
mov rax, qword [0x14005d9d8]
jmp 0x14003a99d
mov rax, qword [0x14005d9d8]
mov r11, qword [0x14005d9e0]
cmp rax, rdi
je 0x14003aa04
cmp r11, rdi
je 0x14003aa04
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14005d9e0]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x14003aa04
test rax, rax
je 0x14003aa04
call rsi
test rax, rax
je 0x14003a9fe
lea rcx, [rsp + 0x30]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14003a9fe
test byte [rsp + 0x40], 1
jne 0x14003aa04
bts ebp, 0x15
jmp 0x14003aa44
mov rcx, qword [0x14005d9c8]
cmp rcx, rdi
je 0x14003aa44
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14003aa44
call rax
mov rbx, rax
test rax, rax
je 0x14003aa44
mov rcx, qword [0x14005d9d0]
cmp rcx, rdi
je 0x14003aa44
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14003aa44
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14005d9c0]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14003aa66
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x14003aa68
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140021570
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140001480
Capabilities:
Check for outputdebugstring error
Print debug messages

Disassembly:
sub rsp, 0x38
mov ecx, 0x457
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, str._api_
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x457
jne 0x140001513
call fcn.14109f320
cmp byte [rax + 2], 0
jne 0x140001513
test byte [rax + 0xbc], 0x70
jne 0x140001513
call fcn.14109f8e0
mov qword [rsp + 0x30], 0xffffffffffffffff
mov rax, qword [0x1410a3508]
mov edx, dword [rax]
mov rax, qword [0x1410a3510]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
mov rcx, qword [0x1410a3500]
lea r8, [rsp + 0x30]
mov r9d, 1
call fcn.140001450
test rax, rax
sete al
cmp qword [rsp + 0x30], 0xffffffffffffffff
sete cl
or cl, al
movzx eax, cl
neg eax
add rsp, 0x38
ret
xor ecx, ecx
call sub.msvcrt.dll_exit
int3
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
call fcn.1410a02d0
nop
add rsp, 0x20
pop rbp
jmp 0x140001480

Function at 0x140001520
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
mov ecx, 0x457
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, str._api_
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x457
jne 0x140001513
call fcn.14109f320
cmp byte [rax + 2], 0
jne 0x140001513
test byte [rax + 0xbc], 0x70
jne 0x140001513
call fcn.14109f8e0
mov qword [rsp + 0x30], 0xffffffffffffffff
mov rax, qword [0x1410a3508]
mov edx, dword [rax]
mov rax, qword [0x1410a3510]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
mov rcx, qword [0x1410a3500]
lea r8, [rsp + 0x30]
mov r9d, 1
call fcn.140001450
test rax, rax
sete al
cmp qword [rsp + 0x30], 0xffffffffffffffff
sete cl
or cl, al
movzx eax, cl
neg eax
add rsp, 0x38
ret
xor ecx, ecx
call sub.msvcrt.dll_exit
int3
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
call fcn.1410a02d0
nop
add rsp, 0x20
pop rbp
jmp 0x140001480

Function at 0x14109f330
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
ret
Function at 0x14109fe30
Capabilities:
Allocate or change rwx memory

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
movsxd r13, dword [rcx + 0x3c]
mov ebx, dword [rcx + r13 + 0x54]
mov r8, rbx
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x14109fe9a
lea r9, [rsp + 0x20]
mov rcx, rsi
mov rdx, rbx
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14109fe9a
mov rcx, rsi
mov rdx, rdi
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rcx, rsi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx eax, word [rdi + r13 + 6]
test ax, ax
je 0x14109ff3d
movsxd rcx, dword [rdi + 0x3c]
lea rbp, [rcx + rdi]
add rbp, 0x110
xor ebx, ebx
jmp 0x14109fed5
movzx eax, word [rdi + r13 + 6]
inc rbx
movzx ecx, ax
add rbp, 0x28
cmp rbx, rcx
jae 0x14109ff3d
cmp dword [rbp + 0x1c], 0
js 0x14109fec6
mov r14d, dword [rbp]
mov r15d, dword [rbp + 4]
lea r12, [rdi + r15]
add r15, rsi
mov rcx, r12
mov rdx, r15
mov r8, r14
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x14109fec0
mov rcx, r15
mov rdx, r14
mov r8d, 0x40
lea r9, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14109fec0
mov rcx, r15
mov rdx, r12
mov r8, r14
call sub.msvcrt.dll_memcpy
mov r8d, dword [rsp + 0x24]
mov rcx, r15
mov rdx, r14
lea r9, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x14109fec0
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14109ffc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
test rcx, rcx
je 0x1410a0194
mov r14, rdx
mov rbx, rcx
movsxd rcx, dword [rcx + 0x3c]
mov r15d, dword [rcx + rbx + 0x88]
mov r13d, dword [r15 + rbx + 0x1c]
add r13, rbx
mov rax, rdx
shr rax, 0x10
test ax, ax
je 0x1410a0054
mov ebp, dword [rbx + r15 + 0x18]
test ebp, ebp
je 0x1410a0194
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r8
mov r12d, dword [rbx + r15 + 0x20]
mov esi, dword [rbx + r15 + 0x24]
add r12, rbx
add rsi, rbx
xor edi, edi
nop dword [rax + rax]
mov ecx, dword [r12]
add rcx, rbx
mov rdx, r14
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1410a006a
add r12, 4
add rsi, 2
dec ebp
jne 0x1410a0030
jmp 0x1410a019b
movzx eax, r14w
mov ecx, dword [rbx + r15 + 0x10]
sub rax, rcx
mov edi, dword [r13 + rax*4]
jmp 0x1410a0198
movzx eax, word [rsi]
mov edi, dword [r13 + rax*4]
cmp r15d, edi
ja 0x1410a0198
mov rax, qword [rsp + 0x38]
add r15d, dword [rbx + rax + 0x8c]
cmp edi, r15d
jae 0x1410a0198
add rdi, rbx
mov rcx, rdi
mov edx, 0x2e
call sub.msvcrt.dll_strchr
mov rbx, rax
inc rbx
mov rsi, rbx
sub rsi, rdi
lea rcx, [rsi + 4]
mov edx, 2
call sub.msvcrt.dll_calloc
test rax, rax
je 0x1410a0194
mov r14, rax
lea r8, [rsi + 1]
mov qword [rsp + 0x20], rsi
xor ecx, ecx
mov rdx, rax
mov r9, rdi
call qword [sym.imp.msvcrt.dll_mbstowcs_s]
mov dword [r14 + rsi*2], 0x6c0064
mov word [r14 + rsi*2 + 4], 0x6c
lea rdx, [0x1410a3002]
mov r8d, 4
mov rcx, r14
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
je 0x1410a0122
lea rdx, str.ext_
mov r8d, 4
mov rcx, r14
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
jne 0x1410a0170
lea r8, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
mov rdx, r14
call fcn.14109f350
test rax, rax
je 0x1410a0170
mov rsi, rax
mov rcx, r14
call sub.msvcrt.dll_free
mov rdi, qword [rsp + 0x40]
lea rcx, [rdi + 1]
mov edx, 2
call sub.msvcrt.dll_calloc
test rax, rax
je 0x1410a0194
mov r14, rax
add rdi, rdi
mov rcx, rax
mov rdx, rsi
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov rdx, rbx
mov r8, r14
call fcn.14109ffc0
mov rdi, rax
mov rcx, r14
call sub.msvcrt.dll_free
jmp 0x1410a019b
xor edi, edi
jmp 0x1410a019b
add rdi, rbx
mov rax, rdi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1410a04e0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1410a1330
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.1410a1330
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x1410a0550
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1410a60a4]
mov rbx, rcx
test esi, esi
jle 0x1410a0680
mov rax, qword [0x1410a60a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x1410a059b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x1410a0625
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x1410a0580
mov rcx, rbx
call fcn.1410a0fa0
mov rdi, rax
test rax, rax
je 0x1410a06a2
mov rax, qword [0x1410a60a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.1410a10e0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1410a60a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1410a0687
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1410a061e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1410a0630
add dword [0x1410a60a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1410a60a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1410a061e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1410a04e0
nop dword [rax]
xor esi, esi
jmp 0x1410a05a8
mov rax, qword [0x1410a60a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1410a04e0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.1410a04e0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1410a0c10
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x1410a6100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1410a60e0]
test rbx, rbx
je 0x1410a0c6c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x1410a0c63
test rsi, rsi
je 0x1410a0c63
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1410a0c48
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]