joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003fac0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rsi
sub rsp, 0x60
lea rax, [r11 + 0x20]
mov rsi, rdx
xor edx, edx
mov qword [r11 - 0x28], rax
lea rax, [r11 - 0x18]
mov qword [r11 - 0x18], rdx
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x38], rdx
mov rbx, r8
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], edx
mov rdx, rcx
mov rcx, 0xffffffff80000001
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14003fb59
or rcx, 0xffffffffffffffff
xor eax, eax
mov qword [rsp + 0x70], rdi
mov rdi, rbx
mov r9d, 1
xor r8d, r8d
repne scasw ax, word [rdi]
mov rdx, rsi
not rcx
lea eax, [rcx + rcx]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rsi
ret

Function at 0x14003fb70
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x60
lea rax, [r11 - 0x18]
xor edi, edi
mov rbp, rdx
mov qword [r11 - 0x28], rax
lea rax, [r11 - 0x10]
mov ebx, r9d
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x38], rdi
mov rsi, r8
mov rdx, rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20006
mov qword [r11 - 0x10], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14003fbd1
xor eax, eax
jmp 0x14003fc06
mov rcx, qword [rsp + 0x58]
mov r9d, 3
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete dil
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x14003fc20
Capabilities:
Delete registry value

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x50]
mov rbx, rdx
mov rdx, rcx
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003fc72
mov rcx, qword [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret
Function at 0x14003fd00
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x870
mov rax, qword [0x14014dcf0]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov rsi, r9
movsxd r9, dword [rsp + 0x8c0]
mov rbp, rdx
mov rbx, rcx
mov eax, r9d
xor r12d, r12d
cdq
mov dword [rsp + 0x38], 0x820
mov rdi, r9
sub eax, edx
mov rdx, r9
mov qword [rsp + 0x30], r12
sar eax, 1
movsxd rcx, eax
mov word [rsi + rcx*2 - 2], r12w
mov rcx, rsi
call fcn.14003fc80
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x820
call fcn.1400a4ea0
lea r11, [rsp + 0x30]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003fe14
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003fe14
shr rdi, 1
je 0x14003fe14
cmp rdi, 0x7fffffff
ja 0x14003fe14
lea r8, [rsp + 0x40]
mov edx, 0x7ffffffe
mov rcx, rsi
sub rdx, rdi
sub r8, rsi
lea rax, [rdx + rdi]
test rax, rax
je 0x14003fe07
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14003fe07
mov word [rcx], ax
add rcx, 2
dec rdi
jne 0x14003fde6
jmp 0x14003fe0c
test rdi, rdi
jne 0x14003fe10
sub rcx, 2
mov word [rcx], r12w
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14003fe24
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rsi
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.1400a4e70
add rsp, 0x870
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14004ab90
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
mov eax, 0x1070
call fcn.1400a5130
sub rsp, rax
mov rax, qword [0x14014dcf0]
xor rax, rsp
mov qword [rsp + 0x1060], rax
test ecx, ecx
mov rbp, r8
mov rdi, rdx
mov rcx, rdx
jne 0x14004ac09
lea r9, [rsp + 0x40]
mov r8d, 0x200
mov rdx, rbp
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14004abf8
cmp dword [rsp + 0x40], 0x200
je 0x14004abff
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14004ad10
mov eax, 1
jmp 0x14004ad10
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
xor r8d, r8d
mov edx, 0x70000
mov dword [rsp + 0x28], 0x18
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x14004abf8
mov qword [rsp + 0x1080], rbx
mov ebx, dword [rsp + 0x5c]
lea eax, [rbx - 0x200]
cmp eax, 0xe00
ja 0x14004acfb
cmp ebx, 0x200
je 0x14004acb4
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x60]
mov r8d, ebx
mov rcx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14004ad06
mov eax, dword [rsp + 0x40]
cmp eax, dword [rsp + 0x5c]
jne 0x14004acfb
neg eax
mov r9d, 1
xor r8d, r8d
movsxd rdx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14004ad06
mov ebx, dword [rsp + 0x5c]
lea rcx, [rsp + 0x60]
mov rdx, rbp
mov r8d, 0x200
call fcn.1400a4990
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x60]
mov r8d, ebx
mov rcx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14004ad06
mov eax, dword [rsp + 0x5c]
cmp dword [rsp + 0x40], eax
jne 0x14004acfb
mov eax, 1
jmp 0x14004ad08
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x1080]
mov rcx, qword [rsp + 0x1060]
xor rcx, rsp
call fcn.1400a4e70
mov rbp, qword [rsp + 0x1098]
add rsp, 0x1070
pop rdi
ret
Function at 0x14004e710
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x28
mov dword [rsp], 0
movdqa xmm0, xmmword [0x1400d6fa0]
aesenc xmm0, xmmword [0x1400d6fb0]
movdqa xmmword [rsp + 0x10], xmm0
movabs rax, 0x2f4654b9485061fa
cmp qword [rsp + 0x10], rax
jne 0x14004e75b
movabs rax, 0xc8b51f1fe1256f99
cmp qword [rsp + 0x18], rax
jne 0x14004e75b
mov dword [rsp], 1
jmp 0x14004e75d
mov eax, dword [rsp]
add rsp, 0x28
ret
Function at 0x14004eec0
Capabilities:
Encode data using xor

Disassembly:
add rcx, 0x10
mov r8d, 4
add rdx, 2
nop
movzx eax, byte [rdx - 2]
and al, 0xf
xor byte [rcx - 0x10], al
movzx eax, byte [rdx - 2]
shr al, 4
xor byte [rcx], al
movzx eax, byte [rdx - 1]
and al, 0xf
xor byte [rcx + 0x10], al
movzx eax, byte [rdx - 1]
shr al, 4
xor byte [rcx + 0x20], al
movzx eax, byte [rdx]
and al, 0xf
xor byte [rcx + 0x30], al
movzx eax, byte [rdx]
shr al, 4
xor byte [rcx + 0x40], al
movzx eax, byte [rdx + 1]
and al, 0xf
xor byte [rcx + 0x50], al
movzx eax, byte [rdx + 1]
shr al, 4
xor byte [rcx + 0x60], al
movzx eax, byte [rdx + 2]
and al, 0xf
xor byte [rcx - 0xf], al
movzx eax, byte [rdx + 2]
shr al, 4
xor byte [rcx + 1], al
movzx eax, byte [rdx + 3]
and al, 0xf
xor byte [rcx + 0x11], al
movzx eax, byte [rdx + 3]
shr al, 4
xor byte [rcx + 0x21], al
movzx eax, byte [rdx + 4]
and al, 0xf
xor byte [rcx + 0x31], al
movzx eax, byte [rdx + 4]
shr al, 4
xor byte [rcx + 0x41], al
movzx eax, byte [rdx + 5]
and al, 0xf
xor byte [rcx + 0x51], al
movzx eax, byte [rdx + 5]
shr al, 4
xor byte [rcx + 0x61], al
movzx eax, byte [rdx + 6]
and al, 0xf
xor byte [rcx - 0xe], al
movzx eax, byte [rdx + 6]
shr al, 4
xor byte [rcx + 2], al
movzx eax, byte [rdx + 7]
and al, 0xf
xor byte [rcx + 0x12], al
movzx eax, byte [rdx + 7]
shr al, 4
xor byte [rcx + 0x22], al
movzx eax, byte [rdx + 8]
and al, 0xf
xor byte [rcx + 0x32], al
movzx eax, byte [rdx + 8]
shr al, 4
xor byte [rcx + 0x42], al
movzx eax, byte [rdx + 9]
and al, 0xf
xor byte [rcx + 0x52], al
movzx eax, byte [rdx + 9]
shr al, 4
xor byte [rcx + 0x62], al
movzx eax, byte [rdx + 0xa]
and al, 0xf
xor byte [rcx - 0xd], al
movzx eax, byte [rdx + 0xa]
shr al, 4
xor byte [rcx + 3], al
movzx eax, byte [rdx + 0xb]
and al, 0xf
xor byte [rcx + 0x13], al
movzx eax, byte [rdx + 0xb]
add rcx, 4
add rdx, 0x10
shr al, 4
xor byte [rcx + 0x1f], al
movzx eax, byte [rdx - 4]
and al, 0xf
xor byte [rcx + 0x2f], al
movzx eax, byte [rdx - 4]
shr al, 4
xor byte [rcx + 0x3f], al
movzx eax, byte [rdx - 3]
and al, 0xf
xor byte [rcx + 0x4f], al
movzx eax, byte [rdx - 3]
shr al, 4
xor byte [rcx + 0x5f], al
dec r8
jne 0x14004eed0
repz ret
Function at 0x1400559c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov rax, qword [0x14014dcf0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rax, qword [rcx + 0x498]
mov rbp, r8
mov r12, rdx
mov rbx, rcx
cmp rax, r8
ja 0x140055b5d
mov r8, qword [rcx + 0x490]
mov qword [rsp + 0x98], r13
test r8, r8
je 0x140055a18
sub rcx, r8
xor edx, edx
add rcx, 0x490
call fcn.1400a4ea0
lea r9, [rbx + 0x90]
lea rdx, [rbx + 0x90]
mov r8d, 0x400
mov rcx, rbx
call fcn.140055de0
mov rax, qword [rbx + 0x4a0]
test rax, rax
je 0x140055aee
mov esi, 0x28
lea rcx, [rsp + 0x20]
mov edx, esi
call rax
lea rcx, [rsp + 0x20]
lea rdi, [rsp + 0x21]
lea r8, [rsp + 0x22]
lea r9, [rsp + 0x23]
lea r10, [rsp + 0x24]
sub rcx, rbx
sub rdi, rbx
sub r8, rbx
sub r9, rbx
lea rdx, [rbx + 0x90]
lea r11d, [rsi - 0x20]
sub r10, rbx
nop word [rax + rax]
movzx eax, byte [rcx + rdx - 0x90]
add rdx, 5
xor byte [rdx - 5], al
movzx eax, byte [rdi + rdx - 0x95]
xor byte [rdx - 4], al
movzx eax, byte [r8 + rdx - 0x95]
xor byte [rdx - 3], al
movzx eax, byte [r9 + rdx - 0x95]
xor byte [rdx - 2], al
movzx eax, byte [r10 + rdx - 0x95]
xor byte [rdx - 1], al
dec r11
jne 0x140055a90
lea rdi, [rsp + 0x20]
xor eax, eax
mov rcx, rsi
rep stosb byte [rdi], al
lea rdx, [rsp + 0x20]
mov byte [rdx], al
inc rdx
dec rsi
jne 0x140055ae4
lea r8, [rbx + 0xb0]
lea rdx, [rbx + 0x90]
mov r9d, 0x14
mov rcx, rbx
call fcn.140055d70
xor edx, edx
lea rcx, [rbx + 0x90]
mov qword [rbx + 0x90], rdx
mov qword [rbx + 0x98], rdx
mov qword [rbx + 0xa0], rdx
mov qword [rbx + 0xa8], rdx
mov qword [rbx + 0xb0], rdx
mov r8d, 0x400
mov qword [rbx + 0x490], rdx
call fcn.1400a4ea0
mov r13, qword [rsp + 0x98]
mov qword [rbx + 0x498], 0x186a00
jmp 0x140055b67
sub rax, r8
mov qword [rcx + 0x498], rax
test rbp, rbp
je 0x140055c3d
mov rax, qword [rbx + 0x490]
test rax, rax
je 0x140055bc1
cmp rbp, rax
mov rdi, rax
mov rsi, rbx
cmovb rdi, rbp
sub rsi, rax
test r12, r12
je 0x140055ba6
lea rdx, [rsi + 0x490]
mov r8, rdi
mov rcx, r12
call fcn.1400a4990
add r12, rdi
lea rcx, [rsi + 0x490]
mov r8, rdi
xor edx, edx
call fcn.1400a4ea0
sub rbp, rdi
sub qword [rbx + 0x490], rdi
cmp qword [rbx + 0x490], 0
jne 0x140055c34
lea r9, [rbx + 0x90]
lea rdx, [rbx + 0x90]
mov r8d, 0x400
mov rcx, rbx
call fcn.140055de0
lea r8, [rbx + 0xb0]
lea rdx, [rbx + 0x90]
mov r9d, 0x14
mov rcx, rbx
call fcn.140055d70
xor r11d, r11d
mov qword [rbx + 0x90], r11
mov qword [rbx + 0x98], r11
mov qword [rbx + 0xa0], r11
mov qword [rbx + 0xa8], r11
mov qword [rbx + 0xb0], r11
mov qword [rbx + 0x490], 0x3d8
test rbp, rbp
jne 0x140055b70
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400a4e70
add rsp, 0x50
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140055d70
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov r10, rdx
mov eax, r9d
cdq
sub eax, edx
sar eax, 1
mov dword [rcx + 0x88], eax
xor eax, eax
mov qword [rcx + 0x80], rax
mov qword [rcx + 0x70], rax
mov rax, qword [r10]
mov qword [rcx + 0x50], rax
mov rax, qword [r10 + 8]
mov qword [rcx + 0x58], rax
mov rax, qword [r10 + 0x10]
mov qword [rcx + 0x60], rax
mov rax, qword [r10 + 0x18]
mov qword [rcx + 0x68], rax
mov rax, qword [r8]
mov dword [rcx + 0x40], 0x61707865
mov dword [rcx + 0x44], 0x3320646e
mov dword [rcx + 0x48], 0x79622d32
mov dword [rcx + 0x4c], 0x6b206574
mov qword [rcx + 0x78], rax
ret
Function at 0x140059a00
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov r9d, dword [rcx]
lea rsi, [rcx + 0x10]
mov rbp, rcx
and r9d, 0x3f
mov r12, rdx
xor edx, edx
mov byte [r9 + rsi], 0x80
inc r9d
mov ecx, r9d
add rcx, rsi
cmp r9d, 0x20
ja 0x140059a51
mov r8d, 0x20
sub r8d, r9d
call fcn.1400a4ea0
jmp 0x140059a82
mov r8d, 0x40
sub r8d, r9d
call fcn.1400a4ea0
mov r8d, 0x40
mov rdx, rsi
mov rcx, rbp
call fcn.140059830
xor r11d, r11d
mov qword [rsi], r11
mov qword [rsi + 8], r11
mov qword [rsi + 0x10], r11
mov qword [rsi + 0x18], r11
xor ebx, ebx
mov ecx, ebx
nop word [rax + rax]
mov rax, qword [rsi + rcx*8]
inc rcx
bswap rax
mov qword [rsi + rcx*8 - 8], rax
cmp rcx, 4
jb 0x140059a90
mov qword [rsi + 0x20], rbx
mov qword [rsi + 0x28], rbx
mov rcx, qword [rbp + 8]
mov rax, qword [rbp]
mov rdx, rsi
shr rax, 0x3d
lea rax, [rax + rcx*8]
lea rcx, [rbp + 0x50]
mov qword [rsi + 0x30], rax
mov rax, qword [rbp]
shl rax, 3
mov qword [rsi + 0x38], rax
call fcn.140058f40
nop dword [rax]
mov rax, qword [rbp + rbx*8 + 0x50]
inc rbx
bswap rax
mov qword [rbp + rbx*8 + 0x48], rax
cmp rbx, 8
jb 0x140059ae0
mov rax, qword [rbp + 0x50]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov qword [r12], rax
mov rax, qword [rbp + 0x58]
mov qword [r12 + 8], rax
mov rax, qword [rbp + 0x60]
mov qword [r12 + 0x10], rax
mov rax, qword [rbp + 0x68]
mov qword [r12 + 0x18], rax
mov rax, qword [rbp + 0x70]
mov qword [r12 + 0x20], rax
mov rax, qword [rbp + 0x78]
mov qword [r12 + 0x28], rax
mov rax, qword [rbp + 0x80]
mov qword [r12 + 0x30], rax
mov rax, qword [rbp + 0x88]
mov rbp, qword [rsp + 0x38]
mov qword [r12 + 0x38], rax
add rsp, 0x20
pop r12
ret

Function at 0x14005bf90
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rcx + 0x18], 0
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov dword [rcx + 0x10], 0xc3d2e1f0
mov byte [0x14014ccc0], 0x80
ret
Function at 0x1400a5084
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400a509a
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400a509c
xor eax, eax
test eax, eax
je 0x1400a50ac
mov ecx, eax
call fcn.1400aaad4
or eax, 0xffffffff
jmp 0x1400a50ae
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400a5c20
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400a5a90

Function at 0x1400a7350
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
test rcx, rcx
jne 0x1400a737a
call fcn.1400aaab4
and dword [rax], 0
call fcn.1400aaa94
mov ebx, 0x16
mov dword [rax], ebx
call fcn.1400a85e8
mov eax, ebx
jmp 0x1400a73ca
test edx, 0xfffffff9
jne 0x1400a735d
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400a73a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400aaad4
call fcn.1400aaa94
mov eax, dword [rax]
jmp 0x1400a73ca
test al, 0x10
jne 0x1400a73c8
test al, 1
je 0x1400a73c8
test bl, 2
je 0x1400a73c8
call fcn.1400aaab4
mov dword [rax], 5
call fcn.1400aaa94
mov dword [rax], 0xd
jmp 0x1400a739a
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400abb1b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14014dcf0]
jne 0x1400a4e8a
rol rcx, 0x10
test cx, 0xffff
jne 0x1400a4e86
repz ret
ror rcx, 0x10
jmp 0x1400aba74
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1401ac870]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1401ac968]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400abaf9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1401ac870]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400abb1b
mov rax, qword [rsp + 0x88]
mov qword [0x1401ac968], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1401ac908], rax
mov rax, qword [0x1401ac968]
mov qword [0x1401ac7e0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1401ac8f0], rax
mov dword [0x1401ac7d0], 0xc0000409
mov dword [0x1401ac7d4], 1
mov rax, qword [0x14014dcf0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14014dcf8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1401ac868], eax
mov ecx, 1
call fcn.1400b4354
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140131340]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1401ac868], 0
jne 0x1400abba2
mov ecx, 1
call fcn.1400b4354
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1400b9d08
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x14014dcf0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.1400acf10
xor ebx, ebx
cmp qword [0x1401ad928], rbx
mov rdi, rax
jne 0x1400b9e1b
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1400b9ef2
lea rdx, [0x1401325d8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b9ef2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x1401325c8]
mov rcx, rsi
mov qword [0x1401ad928], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1401ad930], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x140132590]
mov rcx, rsi
mov qword [0x1401ad938], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1401ad948], rax
test rax, rax
je 0x1400b9e12
lea rdx, [0x140132578]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1401ad940], rax
jmp 0x1400b9e22
mov rax, qword [0x1401ad940]
jmp 0x1400b9e29
mov rax, qword [0x1401ad940]
mov r11, qword [0x1401ad948]
cmp rax, rdi
je 0x1400b9e90
cmp r11, rdi
je 0x1400b9e90
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1401ad948]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x1400b9e90
test rax, rax
je 0x1400b9e90
call rsi
test rax, rax
je 0x1400b9e8a
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400b9e8a
test byte [rsp + 0x40], 1
jne 0x1400b9e90
bts ebp, 0x15
jmp 0x1400b9ed0
mov rcx, qword [0x1401ad930]
cmp rcx, rdi
je 0x1400b9ed0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400b9ed0
call rax
mov rbx, rax
test rax, rax
je 0x1400b9ed0
mov rcx, qword [0x1401ad938]
cmp rcx, rdi
je 0x1400b9ed0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400b9ed0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1401ad928]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400b9ef2
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x1400b9ef4
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400a4e70
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x6d8cb440
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6d8ec5e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6d8cb5c8
mov rax, qword [0x6d8ec5e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6d8cb48c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6d8cb515
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6d8cb470
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6d8cb5fd
mov rax, qword [0x6d8ec5e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6d8ec5e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6d8cb5e0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6d8cb50e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6d8cb570
add dword [0x6d8ec5e4], 1
cmp edi, 8
jae 0x6d8cb543
test dil, 4
jne 0x6d8cb5b4
test edi, edi
je 0x6d8cb538
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6d8cb5cf
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6d8cb538
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6d8cb55c
jmp 0x6d8cb538
add rsi, qword [0x6d8ec5e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6d8cb50e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6d8cb538
xor esi, esi
jmp 0x6d8cb497
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6d8cb538
mov rax, qword [0x6d8ec5e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6d8cbd50
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6d8ec8c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6d8ec8a0]
test rbx, rbx
je 0x6d8cbda4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6d8cbd9b
test rsi, rsi
je 0x6d8cbd9b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6d8cbd80
lea rcx, [0x6d8ec8c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]