joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401522fc
Capabilities:
Enumerate disk volumes

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x260
mov rax, qword [0x14017d140]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor ebx, ebx
or rbp, 0xffffffffffffffff
xor sil, sil
and qword [rsp + 0x30], rbx
mov r14, r8
mov r15, rcx
mov byte [r8], bl
test dl, 1
je 0x14015241c
lea rcx, [rsp + 0x30]
call fcn.1400b0e54
mov ebx, eax
test eax, eax
jns 0x140152383
mov ecx, 0xc0000452
call fcn.14005246c
cmp ebx, eax
je 0x14015237b
mov ecx, 0xc0000451
call fcn.14005246c
cmp ebx, eax
je 0x14015237b
mov ecx, 0xc000003a
call fcn.14005246c
cmp ebx, eax
jne 0x14015239a
mov byte [r14], 0
xor ebx, ebx
jmp 0x14015239a
mov rdx, qword [rsp + 0x30]
mov rcx, r15
call sub.msvcrt.dll__wcsicmp
test eax, eax
jne 0x140152397
mov sil, 1
mov byte [r14], sil
lea rsi, [0x14017d3a8]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp rbp, 0xffffffffffffffff
je 0x1401523bb
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
test ebx, ebx
jns 0x1401523f3
mov rcx, qword [0x14017d3a8]
cmp rcx, rsi
je 0x1401523f3
test byte [rcx + 0x1c], 1
je 0x1401523f3
cmp byte [rcx + 0x19], 2
jb 0x1401523f3
mov rcx, qword [rcx + 0x10]
lea r8, [0x140015d68]
mov edx, 0x17
mov r9, r15
mov dword [rsp + 0x20], ebx
call fcn.14001ecbc
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140168920
mov rbx, qword [rsp + 0x298]
add rsp, 0x260
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov edi, 0x104
lea rcx, [rsp + 0x40]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x14015249c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x14017d3a8]
lea rsi, [0x14017d3a8]
cmp rcx, rsi
je 0x140152474
test byte [rcx + 0x1c], 1
je 0x140152474
cmp byte [rcx + 0x19], 2
jb 0x140152474
lea edx, [rbp + 0x16]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140015d68]
mov r9d, eax
call fcn.14001de24
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
jmp 0x1401523a1
lea rdx, [rsp + 0x40]
mov r8d, edi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
je 0x1401524b2
lea rcx, [rsp + 0x40]
mov rdx, r15
call sub.msvcrt.dll__wcsicmp
test eax, eax
jne 0x140152487
jmp 0x140152394
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x12
je 0x140152397
mov rcx, qword [0x14017d3a8]
lea rsi, [0x14017d3a8]
cmp rcx, rsi
je 0x140152474
test byte [rcx + 0x1c], 1
je 0x140152474
cmp byte [rcx + 0x19], 2
jb 0x140152474
mov edx, 0x16
jmp 0x140152461
Function at 0x1401524f4
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
xor ebp, ebp
mov r14, r8
mov esi, edx
mov byte [rsp + 0x70], bpl
mov byte [r8], bpl
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
lea r15d, [rbp + 1]
movzx r9d, bpl
cmp eax, 3
mov ebx, ebp
cmove r9d, r15d
test r9b, r9b
je 0x1401525f6
lea r12, [0x14017d3a8]
test r15b, sil
jne 0x140152596
lea rdx, [rsp + 0x78]
mov rcx, rdi
call fcn.140152768
mov ebx, eax
test eax, eax
jns 0x14015258f
mov rcx, qword [0x14017d3a8]
cmp rcx, r12
je 0x1401525c5
test byte [rcx + 0x1c], r15b
je 0x1401525c5
cmp byte [rcx + 0x19], 2
jb 0x1401525c5
mov rcx, qword [rcx + 0x10]
lea edx, [rbp + 0x18]
lea r8, [0x140015d68]
mov r9, rdi
mov dword [rsp + 0x20], eax
call fcn.14001ecbc
jmp 0x1401525be
cmp byte [rsp + 0x78], bpl
je 0x1401525be
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.140152890
mov ebx, eax
test eax, eax
jns 0x1401525b4
cmp eax, 0x80780076
jne 0x1401525be
mov ebx, ebp
jmp 0x1401525be
cmp byte [rsp + 0x70], bpl
jne 0x1401525be
mov byte [r14], r15b
mov rcx, qword [0x14017d3a8]
test ebx, ebx
jns 0x1401525f6
cmp rcx, r12
je 0x1401525f6
test byte [rcx + 0x1c], r15b
je 0x1401525f6
cmp byte [rcx + 0x19], 2
jb 0x1401525f6
mov rcx, qword [rcx + 0x10]
lea r8, [0x140015d68]
mov edx, 0x19
mov r9, rdi
mov dword [rsp + 0x20], ebx
call fcn.14001ecbc
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140152b50
Capabilities:
Get disk size

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push r13
push r14
sub rsp, 0x40
and qword [rdx], 0
and qword [rax + 0x18], 0
mov rsi, rdx
lea rdx, [rax + 0x18]
mov r14, rcx
call fcn.1400a987c
lea r13, [0x14017d3a8]
mov ebx, eax
test eax, eax
js 0x140152cc0
and qword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x80]
and dword [rsp + 0x28], 0
mov r8d, 3
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140152c15
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x14017d3a8]
cmp rcx, r13
je 0x140152c02
test byte [rcx + 0x1c], 1
je 0x140152c02
cmp byte [rcx + 0x19], 2
jb 0x140152c02
mov r9, qword [rsp + 0x80]
mov rcx, qword [rcx + 0x10]
lea edx, [rbp + 0x26]
lea r8, [0x140015d68]
mov dword [rsp + 0x20], eax
call fcn.14001ecbc
mov rcx, qword [0x14017d3a8]
movzx ebx, si
or ebx, 0x80070000
test esi, esi
cmovle ebx, esi
jmp 0x140152cc7
xor eax, eax
xor r9d, r9d
xor r8d, r8d
and qword [rsp + 0x38], rax
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x88]
mov edx, 0x7405c
mov rcx, rbp
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140152cac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x14017d3a8]
cmp rcx, r13
je 0x140152c9c
test byte [rcx + 0x1c], 1
je 0x140152c9c
cmp byte [rcx + 0x19], 2
jb 0x140152c9c
mov r9, qword [rsp + 0x80]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140015d68]
mov edx, 0x26
mov dword [rsp + 0x20], eax
call fcn.14001ecbc
movzx ebx, si
or ebx, 0x80070000
test esi, esi
cmovle ebx, esi
jmp 0x140152cb7
mov rax, qword [rsp + 0x88]
mov qword [rsi], rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14017d3a8]
cmp qword [rsp + 0x80], 0
je 0x140152ce7
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x14017d3a8]
test ebx, ebx
jns 0x140152d1b
cmp rcx, r13
je 0x140152d1b
test dword [rcx + 0x1c], reloc.ADVAPI32.dll_TraceEvent
je 0x140152d1b
cmp byte [rcx + 0x19], 2
jb 0x140152d1b
mov rcx, qword [rcx + 0x10]
lea r8, [0x140015d68]
mov edx, 0x27
mov r9, r14
mov dword [rsp + 0x20], ebx
call fcn.14001ecbc
mov eax, ebx
add rsp, 0x40
pop r14
pop r13
pop rsi
pop rbp
pop rbx
ret
Function at 0x140153a9c
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x40
mov rbp, rcx
xor ebx, ebx
mov esi, 0x208
and dword [rsp + 0x78], ebx
and qword [rdx], rbx
mov ecx, esi
mov r14, rdx
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
lea r13, [0x14017d3a8]
mov rdi, rax
mov qword [rsp + 0x80], rax
test rax, rax
jne 0x140153af0
mov rcx, qword [0x14017d3a8]
mov ebx, 0x8007000e
jmp 0x140153c35
mov r8, rsi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
and dword [rsp + 0x38], ebx
and qword [rsp + 0x30], rbx
and qword [rsp + 0x28], rbx
and qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8d, 0x104
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x140153bf3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rsp + 0x78]
mov dl, 1
mov rcx, rbp
mov esi, eax
call fcn.140153ce4
test eax, eax
jns 0x140153b96
mov rcx, qword [0x14017d3a8]
cmp rcx, r13
je 0x140153b83
test byte [rcx + 0x1c], 1
je 0x140153b83
cmp byte [rcx + 0x19], 3
jb 0x140153b83
mov rcx, qword [rcx + 0x10]
lea r8, [0x140015d68]
mov edx, 0x40
mov r9, rbp
mov dword [rsp + 0x20], eax
call fcn.14001ecbc
mov rcx, qword [0x14017d3a8]
movzx ebx, si
or ebx, 0x80070000
test esi, esi
cmovle ebx, esi
jmp 0x140153c1c
mov eax, dword [rsp + 0x78]
shr eax, 0xb
test al, 1
je 0x140153c75
mov rcx, qword [0x14017d3a8]
cmp rcx, r13
je 0x140153bd5
test byte [rcx + 0x1c], 1
je 0x140153bd5
cmp byte [rcx + 0x19], 4
jb 0x140153bd5
mov rcx, qword [rcx + 0x10]
lea r8, [0x140015d68]
mov edx, 0x41
mov r9, rbp
call fcn.14001ec40
lea rdx, [rsp + 0x80]
mov rcx, rbp
call fcn.140153fec
mov rdi, qword [rsp + 0x80]
mov ebx, eax
test eax, eax
js 0x140153c15
test rdi, rdi
jne 0x140153c10
lea r8, [0x140015cd0]
lea rcx, [0x140015ca0]
mov edx, 0x5b9
call fcn.1400a8be8
mov qword [r14], rdi
xor edi, edi
mov rcx, qword [0x14017d3a8]
test rdi, rdi
je 0x140153c31
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x14017d3a8]
test ebx, ebx
jns 0x140153c62
cmp rcx, r13
je 0x140153c62
test byte [rcx + 0x1c], 1
je 0x140153c62
cmp byte [rcx + 0x19], 3
jb 0x140153c62
mov rcx, qword [rcx + 0x10]
lea r8, [0x140015d68]
mov edx, 0x44
mov r9, rbp
mov dword [rsp + 0x20], ebx
call fcn.14001ecbc
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
cmp esi, 0x3ed
je 0x140153c9a
cmp esi, 1
je 0x140153c9a
cmp esi, 0x57
je 0x140153c9a
movzx ebx, si
or ebx, 0x80070000
test esi, esi
cmovle ebx, esi
jmp 0x140153c15
mov rcx, qword [0x14017d3a8]
cmp rcx, r13
je 0x140153c1c
test byte [rcx + 0x1c], 1
je 0x140153c1c
cmp byte [rcx + 0x19], 5
jb 0x140153c1c
mov rcx, qword [rcx + 0x10]
lea r8, [0x140015d68]
mov edx, 0x43
mov r9, rbp
call fcn.14001ec40
jmp 0x140153c15
Function at 0x140162a34
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x240
mov rax, qword [0x14017d140]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor ebx, ebx
mov dword [0x14017e50c], ebx
mov dword [0x14017e550], ebx
mov rcx, qword [0x14017d3a8]
lea r15, [0x14017d3a8]
cmp rcx, r15
je 0x140162a9e
test byte [rcx + 0x1c], 0x20
je 0x140162a9e
cmp byte [rcx + 0x19], 4
jb 0x140162a9e
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0xa]
lea r8, [0x1400169d0]
call fcn.14001dd24
mov edi, 0x105
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, edi
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x20]
lea rcx, [0x140016910]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, edi
jbe 0x140162ad5
mov ebx, 0x8007000e
jmp 0x140162b83
lea rsi, [rsp + 0x20]
lea rdi, [0x1400168f8]
mov ecx, 4
repe cmpsw word [rsi], word [rdi]
jne 0x140162af4
mov word [0x14017d6c8], bx
jmp 0x140162b30
mov eax, 6
lea rsi, [rsp + 0x20]
lea rdi, [0x140016900]
mov ecx, eax
repe cmpsw word [rsi], word [rdi]
jne 0x140162b13
mov eax, 9
jmp 0x140162b29
lea rsi, [rsp + 0x20]
lea rdi, [0x140016968]
mov ecx, 5
repe cmpsw word [rsi], word [rdi]
jne 0x140162b30
mov word [0x14017d6c8], ax
call fcn.140167698
test eax, eax
jne 0x140162b7c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14017d3a8]
cmp rcx, r15
je 0x140162bb0
test byte [rcx + 0x1c], 0x20
je 0x140162b8a
cmp byte [rcx + 0x19], 2
jb 0x140162b8a
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400169d0]
mov edx, reloc.ADVAPI32.dll_TraceMessage
call fcn.14001dd24
jmp 0x140162b83
or dword [0x14017e50c], 1
mov rcx, qword [0x14017d3a8]
cmp rcx, r15
je 0x140162bb0
test byte [rcx + 0x1c], 0x20
je 0x140162bb0
cmp byte [rcx + 0x19], 4
jb 0x140162bb0
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400169d0]
mov edx, reloc.ADVAPI32.dll_GetTraceLoggerHandle
call fcn.14001dd24
mov eax, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140168920
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r15
ret
Function at 0x140165b78
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x14017e457], 0
movups xmm0, xmmword [0x14000ab48]
mov rbx, rcx
movdqu xmmword [rcx], xmm0
je 0x140165bad
mov ecx, dword [0x14017e56c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140165bad
movups xmm0, xmmword [rax]
movdqu xmmword [rbx], xmm0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x140167f20
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x14017d140]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov ebx, 0x104
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x30]
xor r15d, r15d
mov edx, ebx
mov esi, r15d
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp eax, ebx
jae 0x1401680a9
test eax, eax
jne 0x140167f86
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1401680ae
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x1401680a9
lea rcx, [rsp + 0x30]
cmp rax, rcx
je 0x1401680a9
mov word [rax], r15w
movzx ecx, word [rsp + 0x30]
mov r12d, 0x5c
cmp cx, 0x41
jb 0x140167fbd
cmp cx, 0x5a
jbe 0x140167fc6
lea eax, [rcx - 0x61]
cmp ax, 0x19
ja 0x140167fdf
cmp word [rsp + 0x32], 0x3a
jne 0x140167fdf
cmp word [rsp + 0x34], r12w
jne 0x1401680a9
lea rsi, [rsp + 0x34]
cmp cx, r12w
jne 0x14016801b
cmp word [rsp + 0x32], r12w
jne 0x14016801b
lea rcx, [rsp + 0x34]
mov edx, r12d
call sub.msvcrt.dll_wcschr
test rax, rax
je 0x1401680a9
lea rcx, [rax + 2]
mov edx, r12d
call sub.msvcrt.dll_wcschr
mov rsi, rax
test rax, rax
je 0x1401680a9
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, reloc.ADVAPI32.dll_TraceEvent
je 0x14016803a
and al, 0x10
neg al
sbb eax, eax
not eax
and eax, 0x10b
jmp 0x1401680ae
mov rdi, qword [rsp + 0x20]
lea rax, [rsp + 0x30]
cmp rdi, rax
jne 0x140168050
lea rdi, [rsp + 0x30]
jmp 0x140168054
add rdi, 0xfffffffffffffffe
cmp rdi, rsi
je 0x1401680a9
cmp word [rdi], r12w
jne 0x1401680a9
cmp rdi, rsi
jbe 0x1401680a9
lea rcx, [rsp + 0x30]
mov edx, r12d
mov word [rdi], r15w
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov r14, rax
test rax, rax
je 0x1401680a9
movzx ebx, word [rax + 2]
lea rcx, [rsp + 0x30]
mov word [rax + 2], r15w
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov word [r14 + 2], bx
cmp eax, reloc.ADVAPI32.dll_TraceEvent
jne 0x1401680d9
mov rdi, r14
cmp r14, rsi
ja 0x140168064
cmp rdi, rsi
ja 0x1401680ff
mov eax, reloc.KERNEL32.dll_HeapAlloc
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.140168920
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
test al, 0x10
jne 0x1401680a4
mov eax, 0x10b
jmp 0x1401680ae
cmp word [rdi + 2], r15w
je 0x140168115
mov rcx, rdi
mov word [rdi], r12w
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rdi, [rdi + rcx*2]
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1401680e4
jmp 0x140167f7b
xor eax, eax
jmp 0x1401680ae
Function at 0x14016869c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x14017f748], rbx
je 0x140168703
cmp rax, rbx
jne 0x1401686f6
mov ebx, 1
mov esi, ebx
jmp 0x140168708
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1401686db
mov ebx, 1
mov eax, dword [0x14017f750]
cmp eax, ebx
jne 0x14016871e
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x14016877e
mov eax, dword [0x14017f750]
test eax, eax
jne 0x140168778
mov dword [0x14017f750], ebx
lea r15, [0x1400010b0]
lea rdi, [0x140001098]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14016876a
test eax, eax
jne 0x14016876e
mov rcx, qword [rdi]
test rcx, rcx
je 0x14016875f
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x140168748
test eax, eax
je 0x14016877e
mov eax, 0xff
jmp 0x1401688cb
mov dword [0x14017deac], ebx
mov eax, dword [0x14017f750]
cmp eax, ebx
jne 0x1401687a5
lea rdx, [0x140001090]
lea rcx, [section..text]
call sub.msvcrt.dll__initterm
mov dword [0x14017f750], 2
test esi, esi
jne 0x1401687b3
mov rax, r14
xchg qword [0x14017f748], rax
cmp qword [0x14017f768], r14
je 0x1401687de
lea rcx, [0x14017f768]
call fcn.1401690a0
test eax, eax
je 0x1401687de
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14017f768]
call rax
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], r14
jne 0x1401687f4
mov eax, 0xff
jmp 0x1401688cb
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x14016887c
cmp word [rcx], r14w
je 0x140168827
test edx, edx
jne 0x14016887c
cmp word [rcx], r14w
je 0x140168827
cmp word [rcx], 0x20
ja 0x140168827
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x140168810
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400762c4
mov dword [0x14017dea8], eax
cmp dword [0x14017dec8], r14d
jne 0x140168865
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14017deac], r14d
jne 0x14016887a
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14017dea8]
jmp 0x1401688cb
cmp word [rcx], 0x22
jne 0x140168890
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x140168800
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.14021c000
add rsp, 0x28
jmp 0x14016869c
Function at 0x140168a94
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x140168f5c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
test rcx, rcx
je 0x140168fa9
cmp rcx, 0xffffffffffffffff
je 0x140168fa9
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140168fa1
cmp dword [rcx + 0x3c], edx
jl 0x140168fa1
cmp dword [rcx + 0x3c], reloc.ADVAPI32.dll_TraceEvent
jae 0x140168fa1
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], reloc.ADVAPI32.dll_TraceEvent
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140168fa9
mov rax, rdx
add rsp, 0x18
ret

Function at 0x140169208
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x540
mov rax, qword [0x14017d140]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x140169285
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x1401692a5
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, [0x1400011f0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.140168920
add rsp, 0x540
pop rbx
ret
Function at 0x1400017a0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov byte [rsp + 0x50], 0x50
mov byte [rsp + 0x51], 0x81
mov byte [rsp + 0x52], 0x9c
mov byte [rsp + 0x53], 0xcf
mov byte [rsp + 0x54], 0xfa
mov byte [rsp + 0x55], 0xe7
mov byte [rsp + 0x56], 0x48
mov byte [rsp + 0x57], 0x7b
mov byte [rsp + 0x58], 0xa6
mov byte [rsp + 0x59], 0x65
mov dword [rsp + 0x24], 0x9e6dc1e2
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
movsxd rax, dword [rsp + 0x20]
cmp rax, 0xa
jae 0x140001838
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
movzx eax, byte [rcx + rax]
sub eax, dword [rsp + 0x24]
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov byte [rdx + rcx], al
mov eax, dword [rsp + 0x24]
add eax, 0xf72b
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
jmp 0x1400017f5
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140001857
xor eax, eax
jmp 0x14000198e
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140001877
xor eax, eax
jmp 0x14000198e
mov rax, qword [rsp + 0x40]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
cmp dword [rax], 0x4550
je 0x1400018a4
xor eax, eax
jmp 0x14000198e
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x48]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1400018d8
xor eax, eax
jmp 0x14000198e
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x20], rcx
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x30]
mov ecx, dword [rcx + 0x18]
mov dword [rax + 0x18], ecx
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x70]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x70]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x20], 0
je 0x140001983
mov rax, qword [rsp + 0x70]
cmp dword [rax + 0x18], 0
je 0x140001983
mov rax, qword [rsp + 0x70]
cmp qword [rax + 8], 0
je 0x140001983
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x140001983
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x10], 0
jne 0x140001989
xor eax, eax
jmp 0x14000198e
mov eax, 1
add rsp, 0x68
ret
Function at 0x140243640
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14024368a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14024368a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14024368a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14024368a
cmp dword [rcx + 0x84], 0xe
jbe 0x14024368a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14024368c
xor al, al
add rsp, 0x28
ret

Function at 0x140246adc
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140246b4b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140246b4b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140246b4b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140246b4b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140246b4b
cmp dword [rcx + 0x84], 0xe
jbe 0x140246b4b
cmp dword [rcx + 0xf8], 0
je 0x140246b4b
mov ecx, ebx
call fcn.140246bfc
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1402469d8
nop
cmp dword [rbp + 0x20], 0
je 0x140246b99
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140246ba4
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x140246adc

Function at 0x140246ce0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140246adc