joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001180
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x140004480]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
mov rax, qword gs:[0x30]
mov rsi, qword [rax + 8]
jmp 0x1400011c0
cmp rsi, rax
je 0x140001320
mov ecx, 0x3e8
call rbp
mov rax, rdi
lock cmpxchg qword [rbx], rsi
test rax, rax
jne 0x1400011b0
mov rsi, qword [0x140004490]
xor edi, edi
mov eax, dword [rsi]
cmp eax, 1
je 0x140001337
mov eax, dword [rsi]
test eax, eax
je 0x1400013a0
mov dword [0x140007008], 1
mov eax, dword [rsi]
cmp eax, 1
je 0x14000134c
test edi, edi
je 0x14000136d
mov rax, qword [0x1400043f0]
mov rax, qword [rax]
test rax, rax
je 0x140001223
xor r8d, r8d
mov edx, 2
xor ecx, ecx
call rax
call fcn.140001980
mov rcx, qword [0x140004510]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rdx, qword [0x140004470]
lea rcx, section..text
mov qword [rdx], rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.140001790
mov ebx, dword [0x140007028]
lea edi, [rbx + 1]
movsxd rdi, edi
shl rdi, 3
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r12, qword [0x140007020]
mov rbp, rax
test ebx, ebx
jle 0x1400013c0
sub rdi, 8
xor ebx, ebx
mov rcx, qword [r12 + rbx]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea rsi, [rax + 1]
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r8, rsi
mov qword [rbp + rbx], rax
mov rdx, qword [r12 + rbx]
mov rcx, rax
add rbx, 8
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
cmp rdi, rbx
jne 0x140001280
add rdi, rbp
mov qword [rdi], 0
mov qword [0x140007020], rbp
call fcn.140001590
mov rax, qword [0x140004400]
mov r8, qword [0x140007018]
mov ecx, dword [0x140007028]
mov rax, qword [rax]
mov qword [rax], r8
mov rdx, qword [0x140007020]
call fcn.1400029b0
mov ecx, dword [0x14000700c]
mov dword [0x140007010], eax
test ecx, ecx
je 0x1400013c8
mov edx, dword [0x140007008]
test edx, edx
je 0x140001380
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [0x140004490]
mov edi, 1
mov eax, dword [rsi]
cmp eax, 1
jne 0x1400011e1
mov ecx, 0x1f
call fcn.140002730
mov eax, dword [rsi]
cmp eax, 1
jne 0x140001200
mov rdx, qword [0x1400044b0]
mov rcx, qword [0x1400044a0]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [rsi], 2
test edi, edi
jne 0x140001208
xor eax, eax
xchg qword [rbx], rax
jmp 0x140001208
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x140007010]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, qword [0x1400044d0]
mov rcx, qword [0x1400044c0]
mov dword [rsi], 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
jmp 0x1400011f5
mov rdi, rax
jmp 0x1400012b5
mov ecx, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
sub rsp, 0x28
mov rax, qword [0x140004420]
mov dword [rax], 1
call fcn.140001180
nop
nop
add rsp, 0x28
ret
Function at 0x1400017a0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call fcn.1400025a0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
nop dword [rax]

Function at 0x140001810
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x140007094]
mov rbx, rcx
test esi, esi
jle 0x140001940
mov rax, qword [0x140007098]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14000185b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x1400018e5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140001840
mov rcx, rbx
call fcn.140002280
mov rdi, rax
test rax, rax
je 0x140001962
mov rax, qword [0x140007098]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.1400023c0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x140007098]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140001947
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x1400018de
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x1400018f0
add dword [0x140007094], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x140007098]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400018de
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400017a0
nop dword [rax]
xor esi, esi
jmp 0x140001868
mov rax, qword [0x140007098]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400017a0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.1400017a0
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x140001ef0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140007100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400070e0]
test rbx, rbx
je 0x140001f4c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x140001f43
test eax, eax
jne 0x140001f43
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140001f28
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140002280
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400043c0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400022a0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400022a8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400022a0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400022fd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400022f4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400022a0
add rax, 0x28
cmp rax, r9
jne 0x1400022e0
xor eax, eax
ret

Function at 0x140002300
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400043c0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000231f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002328
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000231f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400023c0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400043c0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400023df
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400023e8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x1400029b0
Capabilities:
Execute command

Disassembly:
push rbx
sub rsp, 0x20
call fcn.140001590
mov rbx, qword [sym.imp.libstdc_6.dll_std::cout]
mov r8d, 3
lea rdx, section..rdata
mov rcx, rbx
call fcn.1400014b8
mov rcx, rbx
call fcn.140001450
mov r8d, 0xa
lea rdx, str.Hello_Stub
mov rcx, rbx
call fcn.1400014b8
mov rcx, rbx
call fcn.140001450
lea rcx, str.pause
call sub.api_ms_win_crt_runtime_l1_1_0.dll_system
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x180011d1c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180011d4c
xor eax, eax
jmp 0x180011e0f
mov rbp, rbx
cmp word [rax], si
je 0x180011d71
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180011d58
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180011d54
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180011c3c
movsxd r14, eax
test eax, eax
jne 0x180011daf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180011d45
mov rcx, r14
call fcn.18000f4c0
mov rdi, rax
test rax, rax
jne 0x180011dc8
xor ecx, ecx
call fcn.18000f484
jmp 0x180011da4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180011c3c
test eax, eax
jne 0x180011df9
mov rcx, rdi
call fcn.18000f484
jmp 0x180011e03
xor ecx, ecx
call fcn.18000f484
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x2fc4ce0a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4cf180
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4ceaa2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f1108]
test eax, eax
je 0x2fc4ceb3a
lea rax, [0x2fc4f10e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f1110]
mov qword [rbp - 8], rax
jmp 0x2fc4ceb1e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4ceb12
cmp qword [rbp - 0x10], 0
je 0x2fc4ceb12
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4cead8
lea rax, [0x2fc4f10e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4ceb3b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4cec40
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4cec68
mov eax, 0
jmp 0x2fc4cecb6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4cec91
mov eax, 0
jmp 0x2fc4cecb6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4cecb1
mov eax, 0
jmp 0x2fc4cecb6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4cecbc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4ced3a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4ced31
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4ced31
mov rax, qword [rbp - 8]
jmp 0x2fc4ced4f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4ced04
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021210]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020640]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020640]
call fcn.1400123b8
lea rcx, [0x140021210]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
jnp 0x14003f72d
jnp 0x14003f6cf
add byte [rax], al
add byte [rbp - 0x12fbfbfc], dh
add byte [rax], al
add bh, bh
add eax, 0xeff0505
invalid
add byte [rax], al
add bh, bh
add al, byte [rdx]
add bh, bh
add byte [rax], al
add bh, bh
add al, 2
inc dword [rax]
add byte [rax], al
inc dword [rdx + rax]
add bh, bh
add eax, 0x7ff0303
add edi, edi
invalid
add eax, 0x406ff05
add al, 0xff
add eax, dword [rcx]
add edi, edi
or byte [rsi], al
add edi, edi
invalid
invalid
add bh, bh
add byte [rax], al
add bh, bh
adc eax, 0xff1515
add byte [rax], al
dec dword [rbx]
or eax, 0xea0d
add byte [rcx + rbx*4 + 0x1ea1a1], dh
cdq
movabs eax, dword [0x1ea1]
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
scasd eax, dword [rdi]
test al, 0xaf
and eax, dword [rax]
cdq
movabs eax, dword [0x1ea1]
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
scasd eax, dword [rdi]
test al, 0xaf
and eax, dword [rax]
add byte [rcx], al
loopne 0x14003f72b
add dword [rbx], eax
cli
add al, byte [rdx]
add bh, bh
add al, 4
add al, byte [rdx]
inc dword [rsp + rax]
add al, 0xff
add byte [rax], al
add bh, bh
add al, byte [rdx]
add bh, bh
add byte [rcx], al
add bh, bh
add byte [rcx], al
add bh, bh
invalid
Function at 0x2fc539c60
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc53ad40
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc53a662
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc55d108]
test eax, eax
je 0x2fc53a6fa
lea rax, [0x2fc55d0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc55d110]
mov qword [rbp - 8], rax
jmp 0x2fc53a6de
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc53a6d2
cmp qword [rbp - 0x10], 0
je 0x2fc53a6d2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc53a698
lea rax, [0x2fc55d0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc53a6fb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc53a800
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc53a828
mov eax, 0
jmp 0x2fc53a876
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc53a851
mov eax, 0
jmp 0x2fc53a876
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc53a871
mov eax, 0
jmp 0x2fc53a876
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc53a87c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc53a8fa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc53a8f1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc53a8f1
mov rax, qword [rbp - 8]
jmp 0x2fc53a90f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc53a8c4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400035a0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x840
mov rax, qword [0x1400101f0]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov rdi, rcx
lea rcx, [rsp + 0x32]
xor ebx, ebx
xor edx, edx
mov r8d, 0x7fe
mov word [rsp + 0x30], bx
call sub.MSVCR100.dll_memset
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x30]
lea ecx, [rbx + 2]
mov dword [rsp + 0x28], 0x400
mov qword [rsp + 0x20], rbx
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x14000360e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call qword [sym.imp.VBoxRT.dll_RTErrConvertFromWin32]
jmp 0x14000364b
lea r8, str.F:_tinderboxwin_6.1_srcVBoxFrontendsVBoxAutostartVBoxAutostart_win.cpp
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call qword [sym.imp.VBoxRT.dll_RTUtf16ToUtf8Tag]
mov rdx, qword [rsp + 0x20]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.VBoxRT.dll_public:_class_RTCString____ptr64___cdecl_RTCString::operator_char_const____ptr64____ptr64]
mov rcx, rdi
call qword [sym.imp.VBoxRT.dll_public:_class_RTCString____ptr64___cdecl_RTCString::toLower_void____ptr64]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.VBoxRT.dll_RTStrFree]
mov eax, ebx
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.140005930
mov rbx, qword [rsp + 0x858]
add rsp, 0x840
pop rdi
ret

Function at 0x140003670
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1400101f0]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor eax, eax
mov rdi, rcx
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
xor ebx, ebx
mov dword [rsp + 0x28], reloc.OLEAUT32.dll_SafeArrayGetDim
mov qword [rsp + 0x32], rax
mov qword [rsp + 0x3a], rax
mov qword [rsp + 0x42], rax
mov word [rsp + 0x30], bx
mov dword [rsp + 0x4a], eax
mov word [rsp + 0x4e], ax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x1400036d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call qword [sym.imp.VBoxRT.dll_RTErrConvertFromWin32]
jmp 0x14000371b
lea r8, str.F:_tinderboxwin_6.1_srcVBoxFrontendsVBoxAutostartVBoxAutostart_win.cpp
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.VBoxRT.dll_RTUtf16ToUtf8Tag]
mov rdx, qword [rsp + 0x20]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.VBoxRT.dll_public:_class_RTCString____ptr64___cdecl_RTCString::operator_char_const____ptr64____ptr64]
mov rcx, rdi
call qword [sym.imp.VBoxRT.dll_public:_class_RTCString____ptr64___cdecl_RTCString::toLower_void____ptr64]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.VBoxRT.dll_RTStrFree]
mov eax, ebx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140005930
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140003740
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov ebx, edx
mov rdi, rcx
lea rbp, str.VBoxAutostartSvc
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov rsi, rax
test rax, rax
je 0x1400037e9
xor r9d, r9d
dec ebx
mov qword [rsp + 0x50], rbp
lea ecx, [r9 + 2]
movzx edx, r9w
mov qword [rsp + 0x58], rdi
je 0x1400037b2
dec ebx
je 0x1400037ab
dec ebx
je 0x1400037a6
dec ebx
jne 0x1400037b6
cmp byte [0x140010290], r9b
je 0x1400037e9
lea edx, [rcx + 2]
jmp 0x1400037b6
movzx edx, cx
jmp 0x1400037b6
mov edx, 1
jmp 0x1400037b6
movzx edx, r9w
mov qword [rsp + 0x40], r9
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r9d
mov word [rsp + 0x28], cx
mov rcx, rsi
mov qword [rsp + 0x20], r9
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret