joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004af94
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14004b01b
mov rsi, rbx
cmp word [rax], bp
je 0x14004afda
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14004afc4
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14004afc0
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140045700
mov rdi, rax
test rax, rax
je 0x14004b008
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14002d5d0
mov rbp, rdi
xor ecx, ecx
call fcn.140044d58
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14004f824
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14004788c
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14004788c
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14004f974
cmp rax, 0xffffffffffffffff
je 0x14004f974
xor edi, edi
test rbp, rbp
jle 0x14004f91f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140044f38
mov rbx, rax
test rax, rax
jne 0x14004f8ac
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14004f915
mov edx, 0x8000
mov ecx, r14d
call fcn.14004438c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.140049064
cmp eax, 0xffffffff
je 0x14004f8f5
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14004f8bc
mov edx, r15d
mov ecx, r14d
call fcn.14004438c
jmp 0x14004f915
cmp byte [rsi + 0x38], dil
je 0x14004f90c
cmp dword [rsi + 0x34], 5
jne 0x14004f90c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14004f915
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140044d58
jmp 0x14004f988
jns 0x14004f988
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14004788c
cmp rax, 0xffffffffffffffff
jne 0x14004f940
cmp byte [rsi + 0x30], dil
je 0x14004f988
mov edi, dword [rsi + 0x2c]
jmp 0x14004f988
mov ecx, r14d
call fcn.14004b9f4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14004f988
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x14004f988
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14004f981
mov eax, dword [rsi + 0x2c]
jmp 0x14004f986
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14004788c
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140004e00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x60
xor r12d, r12d
lea r15, [0x140128a68]
mov esi, r12d
lea r14, [0x140127820]
cmp byte [r15], r12b
je 0x140004ed4
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], reloc.WSOCK32.dll_gethostbyname
mov ecx, esi
mov dword [rsp + 0x24], 0x80
call qword [sym.imp.WINMM.dll_joyGetPosEx]
test eax, eax
jne 0x140004ed4
mov eax, dword [rsp + 0x40]
mov ebp, eax
xor ebp, dword [r14]
mov dword [r14], eax
and ebp, eax
je 0x140004ed4
movzx edx, word [0x140128a9c]
mov ebx, r12d
cmp r12w, dx
jae 0x140004ed4
mov rdi, r12
nop
mov rax, qword [0x140128a88]
mov rax, qword [rdi + rax]
cmp byte [rax + 0x12], 4
jne 0x140004ec7
movzx ecx, byte [rax + 0x10]
cmp ecx, esi
jne 0x140004ec7
movzx ecx, word [rax + 8]
sub ecx, 0xc
movzx eax, cl
bt ebp, eax
jae 0x140004ec7
mov rcx, qword [0x140127a60]
xor r9d, r9d
movsxd r8, ebx
mov edx, 0x312
call qword [sym.imp.USER32.dll_PostMessageW]
movzx edx, word [0x140128a9c]
inc ebx
movzx eax, dx
add rdi, 8
cmp ebx, eax
jl 0x140004e80
inc esi
inc r15
add r14, 4
cmp esi, 0x10
jl 0x140004e32
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14000f8e0
Capabilities:
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
cmp byte [0x14012bba0], 0
mov rbp, rdx
mov rdi, rcx
je 0x14000f9ba
mov esi, dword gs:[0x48]
cmp dword [0x14012af90], esi
je 0x14000f91c
mov rcx, qword [0x14012af98]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x14000f923
cmp word [rdi], 0
je 0x14000f9c9
lea rax, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
mov rdx, rdi
mov dword [rsp + 0x20], 3
lea rcx, [0x14012afc0]
call fcn.14004edf0
test rax, rax
jne 0x14000f98e
cmp byte [rsp + 0x60], al
lea rcx, [0x14012afc0]
mov r9d, dword [rsp + 0x68]
mov r8, rbx
setne al
mov rdx, rdi
inc eax
mov dword [rsp + 0x20], eax
call fcn.14004f330
test rax, rax
je 0x14000f9c9
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov rdx, rbp
mov rcx, rax
lea r8, [r9 - 1]
call fcn.1400d3350
cmp dword [0x14012af90], esi
je 0x14000f9ba
mov rcx, qword [0x14012af98]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
cmp dword [0x14012af90], esi
je 0x14000f9de
mov rcx, qword [0x14012af98]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rsp + 0x50]
mov eax, 0xffffffff
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x140025450
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x20
movzx ebx, cx
mov eax, ebx
cmp ebx, 0x11c
ja 0x14002552e
je 0x140025526
sub eax, 0x1d
cmp eax, 0x36
ja case.0x140025553.286
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0x25624]
mov ecx, dword [rdx + rax*4 + 0x255d8]
add rcx, rdx
jmp rcx
mov al, 0xa0
add rsp, 0x20
pop rbx
ret
mov al, 0xa2
add rsp, 0x20
pop rbx
ret
mov al, 0xa4
add rsp, 0x20
pop rbx
ret
mov al, 0x6a
add rsp, 0x20
pop rbx
ret
mov al, 0x6d
add rsp, 0x20
pop rbx
ret
mov al, 0x6b
add rsp, 0x20
pop rbx
ret
mov al, 0x2e
add rsp, 0x20
pop rbx
ret
mov al, reloc.WSOCK32.dll_ioctlsocket
add rsp, 0x20
pop rbx
ret
mov al, 0x2d
add rsp, 0x20
pop rbx
ret
mov al, 0x26
add rsp, 0x20
pop rbx
ret
mov al, 0x28
add rsp, 0x20
pop rbx
ret
mov al, 0x25
add rsp, 0x20
pop rbx
ret
mov al, 0x27
add rsp, 0x20
pop rbx
ret
mov al, 0x24
add rsp, 0x20
pop rbx
ret
mov al, reloc.OLEAUT32.dll_SafeArrayAllocDescriptor
add rsp, 0x20
pop rbx
ret
mov al, 0x21
add rsp, 0x20
pop rbx
ret
mov al, SafeArrayAllocDescriptor
add rsp, 0x20
pop rbx
ret
mov al, reloc.WSOCK32.dll_send
add rsp, 0x20
pop rbx
ret
mov al, 0xd
add rsp, 0x20
pop rbx
ret
sub eax, 0x11d
cmp eax, 0x40
ja case.0x140025553.286
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0x25684]
mov ecx, dword [rdx + rax*4 + 0x2565c]
add rcx, rdx
jmp rcx
mov al, 0xa1
add rsp, 0x20
pop rbx
ret
mov al, 0xa3
add rsp, 0x20
pop rbx
ret
mov al, 0xa5
add rsp, 0x20
pop rbx
ret
mov al, 0x5b
add rsp, 0x20
pop rbx
ret
mov al, 0x5c
add rsp, 0x20
pop rbx
ret
mov al, 0x90
add rsp, 0x20
pop rbx
ret
mov al, reloc.WSOCK32.dll_WSAGetLastError
add rsp, 0x20
pop rbx
ret
mov al, 0x5d
add rsp, 0x20
pop rbx
ret
mov al, 0x2c
add rsp, 0x20
pop rbx
ret
bt bx, 8
jae 0x1400255bc
movzx ecx, bl
mov edx, 1
or ecx, 0xe000
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
jne 0x1400255d0
movzx ecx, bl
mov edx, 1
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_MapVirtualKeyW]
add rsp, 0x20
pop rbx
ret
xchg ebx, eax
mov edi, 0x437a77c5
ja 0x1402115e5
fidiv word [r8 + 0x63426b8b]
movsb byte [rdi], byte [rsi]
bsf eax, dword [rdi + 0x55bfaf28]
ret 0x8ccf
fdivr st(5)
or byte [rcx + 0x7432dccf], bh
xor dh, byte [rax + riz + 0x76]
invalid
xchg esp, eax
invalid
push rbp
lea edi, [rcx]
xor al, 0x5c
lahf
cmp ch, byte [0xd3009158]
sti
sbb edi, dword [rcx + 0x1f]
xchg edi, ebx
movabs byte [0xdaef852c2bde8a43], al
mov bl, r14b
sub ebp, dword [rax*4 + 0x7ea2daef]
fisub dword [rdx + 0x7f723a7e]
loopne 0x14021159f
xchg dword [rbx - 0xe], esp
xchg ecx, eax
mov bl, r14b
sub ebp, dword [rax*4 + 0x7ea2daef]
fisub dword [rdx + 0x7f723a7e]
loopne 0x14021159f
xchg dword [rbx - 0xe], esp
xchg ecx, eax
int3
mov ss, edi
adc ebp, ebx
push rbx
push rax
int3
push rdx
invalid
fadd dword [rdx - 0xe]
in al, 0xae
jnp 0x1402115d4
mov esi, 0xb1613ded
and eax, 0xb17e49d9
xchg edx, eax
mov eax, 0x2f6e6559
pop rcx
outsb dx, byte gs:[rsi]
invalid
stosd dword [rdi], eax
stosb byte [rdi], al
invalid
invalid
Function at 0x140031080
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x28]
cmp rdi, 0x40000000
jbe 0x1400310bb
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x140128ac8]
lea r15, [rdi + 0x40000000]
cmp qword [rsp + 0x30], r15
cmovbe r15, qword [rsp + 0x30]
sub r15, 0xfff
test rsi, rsi
je 0x1400310fd
cmp rsi, r14
jb 0x1400310f5
cmp rsi, r15
jae 0x1400310f5
cmp qword [rsi + 8], 0
jne 0x1400312bd
mov rsi, qword [rsi]
test rsi, rsi
jne 0x1400310e0
mov qword [rsp + 0xa0], rbx
mov rbx, rdi
mov qword [rsp + 0xa8], rbp
cmp rdi, r14
jb 0x140031182
nop word [rax + rax]
mov ebp, dword [rsp + 0x48]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x140031179
nop word [rax + rax]
mov r8d, gethostbyname
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140031179
cmp dword [rsp + 0x70], 0x10000
je 0x1400311fb
mov rbx, qword [rsp + 0x58]
cmp rbx, rbp
jb 0x140031179
sub rbx, rbp
cmp rbx, r14
jae 0x140031140
test rsi, rsi
jne 0x140031266
cmp rdi, r15
ja 0x1400312ad
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x1400312ad
mov r8d, gethostbyname
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400312ad
cmp dword [rsp + 0x70], 0x10000
je 0x140031234
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x68]
add rdi, qword [rsp + 0x50]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x1400311b2
jmp 0x1400312ad
test rbx, rbx
je 0x140031179
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x140031266
cmp rbx, r14
jae 0x140031120
jmp 0x140031182
test rdi, rdi
je 0x1400312ad
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x140031266
cmp rdi, r15
jbe 0x140031190
jmp 0x1400312ad
xor eax, eax
lea rcx, [rsi + 0x40]
mov rdx, rcx
mov qword [rsi + 8], rax
sub rdx, rsi
mov dword [rsi + 0x10], eax
nop dword [rax]
mov rax, qword [rsi + 8]
add rdx, 0x40
mov qword [rcx], rax
mov qword [rsi + 8], rcx
add rcx, 0x40
cmp rdx, 0xfc0
jbe 0x140031280
mov rax, qword [0x140128ac8]
mov qword [rsi], rax
mov qword [0x140128ac8], rsi
mov rbp, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
mov rax, rsi
mov rsi, qword [rsp + 0xb0]
add rsp, 0x80
pop r15
pop r14
pop rdi
ret
Function at 0x140065bf0
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x140
movsxd rax, dword [rcx]
movzx r12d, r9b
mov edi, r8d
mov r15, rdx
mov r14, rcx
cmp eax, 6
ja case.0x140065c2d.1
lea r9, [0x140000000]
mov eax, dword [r9 + rax*4 + 0x65e4c]
add rax, r9
jmp rax
lea rax, str.Timeout
jmp 0x140065c60
lea rax, str.Match
jmp 0x140065c60
mov qword [rsp + 0x170], rsi
mov rsi, r15
test r15, r15
jne 0x140065c76
lea rax, str.EndKey
mov rsi, qword [rsp + 0x170]
mov rdi, qword [rsp + 0x178]
add rsp, 0x140
pop r15
pop r14
pop r12
ret
test r12b, r12b
je 0x140065c8c
movups xmm0, xmmword [str.EndKey:]
lea rsi, [rdx + 0xe]
sub edi, 7
movups xmmword [rdx], xmm0
movzx eax, word [rcx + 0x6a]
mov qword [rsp + 0x168], rbp
test ax, ax
je 0x140065cab
xor ebp, ebp
mov word [rsi], ax
mov word [rsi + 2], bp
jmp 0x140065dfe
cmp byte [rcx + 0x6d], 0
mov qword [rsp + 0x160], rbx
je 0x140065d35
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x100
call sub.VCRUNTIME140.dll_memset
mov byte [rsp + 0x50], 0x80
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, rax
call fcn.140023830
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx ecx, byte [r14 + 0x66]
xor ebp, ebp
mov ebx, ebp
mov rdi, rax
cmp dword [0x1401278bc], ebx
setne bl
xor edx, edx
call fcn.140024e60
movzx ecx, byte [r14 + 0x66]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x30], rdi
mov r9, rsi
movzx edx, ax
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_ToUnicodeEx]
movsxd rcx, eax
mov word [rsi + rcx*2], bp
jmp 0x140065df6
xor ebp, ebp
movzx ecx, bp
mov word [rsi], bp
cmp byte [r14 + 0x6c], cl
je 0x140065d90
movzx edx, word [r14 + 0x68]
lea rax, [0x140124228]
mov ecx, ebp
lea r8, [0x1401242f8]
cmp word [rax], dx
je 0x140065d6a
inc ecx
add rax, 0x10
cmp rax, r8
jl 0x140065d58
jmp 0x140065d95
movsxd rdx, ecx
mov rcx, rsi
add rdx, rdx
movsxd rbx, edi
mov rdx, qword [r9 + rdx*8 + 0x124220]
lea r8, [rbx - 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov word [rsi + rbx*2 - 2], bp
movzx ecx, word [rsi]
test cx, cx
jne 0x140065ddb
test r12b, r12b
je 0x140065da2
mov ecx, ebp
cmp byte [r14 + 0x6c], cl
jne 0x140065dbd
cmp byte [r14 + 0x6c], bpl
mov r8d, edi
movzx ecx, byte [r14 + 0x66]
mov rdx, rsi
sete r9b
call fcn.140023b40
movzx ecx, word [rsi]
test cx, cx
jne 0x140065ddb
movzx r9d, word [r14 + 0x68]
lea r8, str.sc_03X
mov edx, edi
mov rcx, rsi
call fcn.1400ce300
movzx ecx, word [rsi]
lea eax, [rcx - 0x61]
cmp ax, 0x19
ja 0x140065df6
cmp word [rsi + 2], bp
jne 0x140065df6
test r12b, r12b
je 0x140065df6
sub cx, 0x20
mov word [rsi], cx
mov rbx, qword [rsp + 0x160]
mov rbp, qword [rsp + 0x168]
lea rax, str.EndKey
test r12b, r12b
cmovne rax, r15
jmp 0x140065c58
lea rax, [0x1401092f8]
jmp 0x140065c60
lea rax, str.NewInput
jmp 0x140065c60
lea rax, str.Stopped
jmp 0x140065c60
lea rax, [0x1400ef7e4]
jmp 0x140065c60
Function at 0x140076a90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rdi, rdx
xor esi, esi
xor edx, edx
mov r10d, 0xffffffff
mov ebp, r9d
mov dword [rsp + 0x68], r10d
mov r14, r8
mov dword [rsp + 0x6c], edx
movzx eax, word [rdi]
mov r15, rcx
test ax, ax
je 0x140076bad
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], r12
lea r12, [0x140000000]
nop dword [rax + rax]
movzx ebx, ax
test ebx, 0xffffff80
je 0x140076aef
xor eax, eax
jmp 0x140076b05
mov edx, 2
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
mov edx, dword [rsp + 0x6c]
mov r10d, dword [rsp + 0x68]
mov ecx, ebx
and ecx, 0xffffffdf
test eax, eax
cmove ecx, ebx
add ecx, 0xffffffd5
cmp ecx, 0x33
ja case.0x140076b2e.51
movsxd rax, ecx
movzx eax, byte [r12 + rax + 0x76c0c]
mov ecx, dword [r12 + rax*4 + 0x76be8]
add rcx, r12
jmp rcx
movzx esi, word [rdi]
jmp case.0x140076b2e.51
mov ecx, 1
jmp 0x140076b64
mov ecx, SafeArrayAllocDescriptor
jmp 0x140076b64
mov ecx, 4
jmp 0x140076b64
mov ecx, 2
jmp 0x140076b64
mov ecx, 0x80
jmp 0x140076b64
mov ecx, 0x1000
jmp 0x140076b64
mov ecx, 0x100
cmp esi, 0x2b
je 0x140076b80
cmp esi, 0x2d
je 0x140076b77
cmp esi, 0x5e
jne case.0x140076b2e.51
xor edx, ecx
jmp 0x140076b8e
not ecx
and r10d, ecx
and edx, ecx
jmp 0x140076b89
mov eax, ecx
not eax
and r10d, eax
or edx, ecx
mov dword [rsp + 0x68], r10d
mov dword [rsp + 0x6c], edx
movzx eax, word [rdi + 2]
add rdi, 2
test ax, ax
jne 0x140076ae0
mov r12, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
movzx r9d, byte [rsp + 0x80]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov r8d, ebp
lea rax, [0x140076c40]
mov rdx, r14
mov rcx, r15
mov qword [rsp + 0x20], rax
call fcn.140076c80
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140077590
Capabilities:
Get file size

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x290
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov r14, r8
mov rdi, rdx
mov rbp, rcx
xor edx, edx
mov rcx, qword [0x140129dc0]
lea r8, [r9 - 1]
call fcn.1400d3350
test rdi, rdi
je 0x14007774d
cmp word [rdi], 0
je 0x14007774d
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x2b0], rbx
mov edx, 0x80
mov dword [rsp + 0x28], 0
mov rcx, rdi
mov qword [rsp + 0x2c0], rsi
lea r8d, [r9 + 7]
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140077643
lea rdx, [rsp + 0x2b8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x140077643
mov rcx, qword [rsp + 0x2b8]
jmp 0x1400776ad
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
jne 0x14007768d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140124200]
mov dl, 1
mov dword [rcx + 0x40], eax
mov rcx, rbp
call fcn.14005f650
mov rbx, qword [rsp + 0x2b0]
mov rsi, qword [rsp + 0x2c0]
add rsp, 0x290
pop r14
pop rdi
pop rbp
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [rsp + 0x5c]
mov eax, dword [rsp + 0x60]
shl rcx, 0x20
or rcx, rax
mov qword [rsp + 0x2b8], rcx
movzx ebx, word [r14]
test ebx, 0xffffff80
je 0x1400776bd
xor eax, eax
jmp 0x1400776d2
mov edx, 2
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
mov rcx, qword [rsp + 0x2b8]
mov edx, ebx
and edx, 0xffffffdf
test eax, eax
cmove edx, ebx
cmp edx, 0x4b
je 0x1400776fa
cmp edx, 0x4d
jne 0x140077714
mov rax, rcx
cqo
and edx, 0xfffff
add rax, rdx
sar rax, 0x14
jmp 0x14007770c
mov rax, rcx
cqo
and edx, 0x3ff
add rax, rdx
sar rax, 0xa
mov qword [rsp + 0x2b8], rax
mov rax, qword [0x140124200]
xor edx, edx
mov rcx, rbp
mov dword [rax + 0x40], 0
call fcn.14005f650
mov rdx, qword [rsp + 0x2b8]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, qword [0x140129dc0]
call fcn.140001580
mov eax, 1
jmp 0x140077671
mov rax, qword [0x140124200]
mov dl, 1
mov rcx, rbp
mov dword [rax + 0x40], 0x57
call fcn.14005f650
add rsp, 0x290
pop r14
pop rdi
pop rbp
ret
Function at 0x1400962c0
Capabilities:
Get file version info

Disassembly:
push rbx
push rdi
sub rsp, 0x148
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov rbx, rdx
mov rdi, rcx
mov rcx, qword [0x140129dc0]
xor edx, edx
lea r8, [r9 - 1]
call fcn.1400d3350
test rbx, rbx
je 0x140096459
cmp word [rbx], 0
je 0x140096459
lea rdx, [rsp + 0x168]
mov qword [rsp + 0x140], rsi
mov rcx, rbx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test eax, eax
jne 0x140096348
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140124200]
mov dl, 1
mov dword [rcx + 0x40], eax
mov rcx, rdi
call fcn.14005f650
mov rsi, qword [rsp + 0x140]
add rsp, 0x148
pop rdi
pop rbx
ret
mov rcx, rsi
mov qword [rsp + 0x160], rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8d, esi
xor edx, edx
mov r9, rax
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x140096434
lea r9, [rsp + 0x170]
mov rcx, rbp
lea r8, [rsp + 0x178]
lea rdx, [0x140107270]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x140096434
mov rax, qword [rsp + 0x178]
lea r8, str._u._u._u._u
mov edx, dword [rax + 0xc]
mov r9d, dword [rax + 8]
movzx ecx, dx
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x40]
shr edx, 0x10
mov dword [rsp + 0x28], edx
mov edx, 0x80
movzx eax, r9w
shr r9d, 0x10
mov dword [rsp + 0x20], eax
call fcn.1400ce300
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [0x140124200]
xor edx, edx
mov rcx, rdi
mov dword [rax + 0x40], 0
call fcn.14005f650
mov rcx, qword [0x140129dc0]
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400d3350
mov rbp, qword [rsp + 0x160]
mov rsi, qword [rsp + 0x140]
add rsp, 0x148
pop rdi
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140124200]
mov dword [rcx + 0x40], eax
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov dl, 1
mov rcx, rdi
call fcn.14005f650
jmp 0x14009641a
mov rax, qword [0x140124200]
mov dl, 1
mov rcx, rdi
mov dword [rax + 0x40], 0x57
call fcn.14005f650
add rsp, 0x148
pop rdi
pop rbx
ret
Function at 0x18000777b
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov edi, dword [0x1803c6388]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
lea rsi, [rax + 0x10]
mov rbx, qword [rax + 0x10]
cmp rsi, rbx
je 0x18000783e
mov rcx, qword [rbx + 0x60]
call fcn.18000771d
cmp edi, eax
je 0x1800077ce
mov rbx, qword [rbx]
cmp rsi, rbx
jne 0x1800077b2
mov ebx, 0
jmp 0x1800077d2
mov rbx, qword [rbx + 0x30]
mov edx, dword [0x1803c63a4]
mov edx, edx
mov r9d, 4
mov r8d, 0x1000
mov ecx, 0
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
mov esi, dword [0x1803c63bc]
mov r14d, dword [0x1803c63c0]
mov eax, dword [0x1803c6398]
movsxd rdx, dword [rbx + 0x3c]
mov eax, eax
lea rax, [rbx + rax*8 + 0x80]
mov eax, dword [rdx + rax + 8]
add rax, rbx
mov qword [rsp + 0x48], rax
mov r13d, dword [rax + 0x20]
mov ebx, 0
jmp 0x1800077d2
Function at 0x180007d70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add dword [rbx + 0x3be6453d], ecx
add byte [rax - 0x77], cl
jmp 0x17ffa5d66

Function at 0x18000d480
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov rcx, qword [rcx + 0x50]
call sym.VBoxRT.dll_RTTlsGet
mov rbx, rax
test rax, rax
jne 0x18000d5b6
call sym.VBoxRT.dll_RTThreadIsSelfAlive
test al, al
jne 0x18000d4be
lea rax, [rsi + 0x78]
jmp 0x18000d5bd
mov rcx, qword [rsi + 0x50]
lea rbx, [rsi + 0x78]
mov rdx, rbx
call sym.VBoxRT.dll_RTTlsSet
test eax, eax
js 0x18000d5b6
lea rdx, str.D:_tinderboxwin_4.2_srcVBoxRuntimecommon_allocmemtracker.cpp
mov ecx, 0x100
call sym.VBoxRT.dll_RTMemAllocZTag
mov rdi, rax
test rax, rax
je 0x18000d5b6
mov r9d, 1
lea rcx, [rax + 0x18]
xor r8d, r8d
lea edx, [r9 + 6]
mov qword [rsp + 0x20], 0
call sym.VBoxRT.dll_RTCritSectInitEx
test eax, eax
js 0x18000d5ae
mov qword [rdi], rdi
mov qword [rdi + 8], rdi
lea rax, [rdi + 0x48]
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rdi + 0x10], rsi
mov dword [rdi + 0x58], 1
call sym.VBoxRT.dll_RTThreadSelfName
test rax, rax
je 0x18000d555
lea rcx, [rdi + 0xe0]
mov r8, rax
mov edx, 0x20
call sym.VBoxRT.dll_RTStrCopy
mov rcx, qword [rsi + 0x50]
mov rdx, rdi
call sym.VBoxRT.dll_RTTlsSet
test eax, eax
js 0x18000d5a5
lea rcx, [rsi + 8]
call sym.VBoxRT.dll_RTCritSectEnter
mov eax, dword [rsi + 0x48]
lea rdx, [rsi + 0x38]
mov dword [rdi + 0x5c], eax
inc dword [rsi + 0x48]
mov rax, qword [rdx + 8]
mov qword [rax], rdi
mov rax, qword [rdx + 8]
mov qword [rdi], rdx
mov qword [rdi + 8], rax
mov qword [rdx + 8], rdi
inc dword [rsi + 0x20c]
lea rcx, [rsi + 8]
call sym.VBoxRT.dll_RTCritSectLeave
mov rax, rdi
jmp 0x18000d5bd
lea rcx, [rdi + 0x18]
call sym.VBoxRT.dll_RTCritSectDelete
mov rcx, rdi
call sym.VBoxRT.dll_RTMemFree
lock inc dword [rbx + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret