joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000abd0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2030
call fcn.14001ee40
sub rsp, rax
mov rax, qword [0x14002c008]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov r11d, dword [0x14002dd70]
lea rsi, [0x140038da0]
mov rdi, rcx
test r11d, r11d
jne 0x14000ac49
mov r8d, 0x1000
lea rdx, str._HOME_
lea rcx, [rsp + 0x20]
call fcn.14000a400
test al, al
je 0x14000ad2f
lea rcx, [rsp + 0x20]
call fcn.140013bc8
movsxd r11, dword [0x14002dd70]
mov qword [rsi + r11*8], rax
inc r11d
mov dword [0x14002dd70], r11d
xor r9d, r9d
test r11d, r11d
jle 0x14000ac84
mov r10, rsi
mov r8, qword [r10]
mov rax, rdi
sub r8, rdi
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000ac74
add rax, 2
test ecx, ecx
jne 0x14000ac60
test edx, edx
je 0x14000aca7
inc r9d
add r10, 8
cmp r9d, r11d
jl 0x14000ac54
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x14000ac90
cmp rax, 2
jne 0x14000acab
cmp word [rdi + 2], 0x3a
jne 0x14000acab
mov al, 1
jmp 0x14000ad0e
xor edx, edx
mov qword [rsp + 0x2048], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
test eax, eax
jne 0x14000acd8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000acd8
mov bl, 1
jmp 0x14000acdc
test bl, bl
je 0x14000ad03
cmp dword [0x14002dd70], 0x400
jge 0x14000ad03
mov rcx, rdi
call fcn.140013bc8
movsxd rdx, dword [0x14002dd70]
mov qword [rsi + rdx*8], rax
inc edx
mov dword [0x14002dd70], edx
movzx eax, bl
mov rbx, qword [rsp + 0x2048]
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.14000b560
mov rsi, qword [rsp + 0x2050]
add rsp, 0x2030
pop rdi
ret
lea rcx, str._HOME_
call fcn.14000aa20
int3
Function at 0x140018934
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400189bb
mov rsi, rbx
cmp word [rax], bp
je 0x14001897a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140018964
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140018960
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140016174
mov rdi, rax
test rax, rax
je 0x1400189a8
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14000d430
mov rbp, rdi
xor ecx, ecx
call fcn.1400152a4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001ed50
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001ed78
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001ed78
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140004a40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x140004a63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 4]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x140004a50
mov byte [rcx + 0x47], 0
mov rax, rcx
ret

Function at 0x140004a70
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x140004aa4
mov ecx, esi
lea eax, [rcx - 4]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x140004a90
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140004ad9
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140008d10
nop
cmp byte [rbx + 0xa], 0
je 0x140004b03
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 4]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 9
jb 0x140004af0
mov byte [rbx + 0xa], 0
lea rax, [rbx + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140004b38
mov r8d, 9
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140008d10
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.14000afc0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140004b8c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004b86
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004b86
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007f280
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140004bcc
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004bc7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004bc7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007f280
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140004be0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x140004c14
mov ecx, esi
lea eax, [rcx - 4]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x140004c00
mov byte [r8 + 7], sil
lea rax, [r8 + 6]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x140004c49
mov r8d, 6
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.140008d10
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140004c57
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.14000bf90
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140004ccc
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004cc7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004cc7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007f280
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140004ce0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x140004d14
mov ecx, esi
lea eax, [rcx - 4]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 9
jb 0x140004d00
mov byte [r8 + 0xa], sil
lea rax, [r8 + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x140004d49
mov r8d, 9
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.140008d10
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140004d57
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.14000bf90
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140004dcc
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004dc7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004dc7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007f280
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140004e60
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x140004e94
mov ecx, esi
lea eax, [rcx - 4]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x140004e80
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x140004ec9
mov r8d, listen
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.140008d10
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140004ed7
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.14000bf90
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140004f4c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004f47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004f47
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007f280
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400058d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x140005904
mov ecx, esi
lea eax, [rcx - 4]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x1400058f0
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140005939
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140008d10
nop
cmp byte [rbx + 0xd], 0
je 0x140005963
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 4]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 0xc
jb 0x140005950
mov byte [rbx + 0xd], 0
lea rax, [rbx + 0xc]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140005998
mov r8d, recvfrom
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140008d10
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.14000afc0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400059ec
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400059e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400059e6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007f280
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140005a2c
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a27
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005a27
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007f280
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140005f40
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x140005f74
mov ecx, esi
lea eax, [rcx - 4]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x140005f60
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140005fa9
mov r8d, listen
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140008d10
nop
cmp byte [rbx + 0xb], 0
je 0x140005fd3
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 4]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 0xa
jb 0x140005fc0
mov byte [rbx + 0xb], 0
lea rax, [rbx + 0xa]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140006008
mov r8d, 0xa
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140008d10
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.14000afc0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000605c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006056
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006056
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007f280
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14000609c
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006097
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006097
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007f280
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140006cf0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x140006d24
mov ecx, esi
lea eax, [rcx - 4]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x140006d10
mov byte [r8 + 9], sil
lea rax, [r8 + 8]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140006d59
mov r8d, 8
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140008d10
nop
cmp byte [rbx + 0xa], 0
je 0x140006d83
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 4]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 9
jb 0x140006d70
mov byte [rbx + 0xa], 0
lea rax, [rbx + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140006db8
mov r8d, 9
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140008d10
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.14000afc0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140006e0c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006e06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006e06
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007f280
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140006e4c
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006e47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006e47
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007f280
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400166e0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x278
mov dword [rsp + 0x30], 0x238
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
jne 0x140016711
xor eax, eax
jmp 0x140016790
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32FirstW
lea rdx, [rsp + 0x5c]
mov rcx, qword [rsp + 0x280]
call fcn.140030210
test eax, eax
jne 0x140016747
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x38]
jmp 0x140016790
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x140016783
lea rdx, [rsp + 0x5c]
mov rcx, qword [rsp + 0x280]
call fcn.140030210
test eax, eax
jne 0x140016781
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x38]
jmp 0x140016790
jmp 0x140016747
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x278
ret
Function at 0x1400178f0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x28]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
mov qword [rsp], rax
jmp 0x140017932
mov rax, qword [rsp]
add rax, 0x28
mov qword [rsp], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 6]
imul rax, rax, 0x28
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
cmp qword [rsp], rax
jae 0x1400179a0
mov rax, qword [rsp]
mov eax, dword [rax + 0xc]
cmp qword [rsp + 0x20], rax
jb 0x14001799e
mov rax, qword [rsp]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp]
add eax, dword [rcx + 8]
mov eax, eax
cmp qword [rsp + 0x20], rax
jae 0x14001799e
mov rax, qword [rsp]
mov eax, dword [rax + 0x14]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rsp + 0x20]
sub rdx, rcx
mov rcx, rdx
add rax, rcx
jmp 0x1400179a2
jmp 0x140017926
xor eax, eax
add rsp, 0x18
ret

Function at 0x140017de0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x50]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x50]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x28], rax
xor eax, eax
mov word [rsp + 0x20], ax
jmp 0x140017e2f
movzx eax, word [rsp + 0x20]
inc ax
mov word [rsp + 0x20], ax
mov rax, qword [rsp + 0x28]
add rax, 0x28
mov qword [rsp + 0x28], rax
movzx eax, word [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
movzx ecx, word [rcx + 6]
cmp eax, ecx
jge 0x140017e7d
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x14]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rsp + 0x40]
add rdx, rcx
mov rcx, rdx
xor r9d, r9d
mov rdx, qword [rsp + 0x28]
mov r8d, dword [rdx + 0x10]
mov rdx, rax
call fcn.140017340
jmp 0x140017e14
add rsp, 0x38
ret
Function at 0x140017e90
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x58]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x28], rax
xor eax, eax
mov word [rsp + 0x20], ax
jmp 0x140017eda
movzx eax, word [rsp + 0x20]
inc ax
mov word [rsp + 0x20], ax
mov rax, qword [rsp + 0x28]
add rax, 0x28
mov qword [rsp + 0x28], rax
movzx eax, word [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
movzx ecx, word [rcx + 6]
cmp eax, ecx
jge 0x140017f75
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x10], 0
jne 0x140017efd
jmp 0x140017ebf
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x24]
and eax, 0x2000000
test eax, eax
je 0x140017f70
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x10]
mov r9d, 4
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
xor r9d, r9d
mov rcx, qword [rsp + 0x28]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
call fcn.140017340
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140017ebf
add rsp, 0x48
ret
Function at 0x1400180f0
Capabilities:
Access pe header
Enumerate gui resources

Disassembly:
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0xc8
mov eax, dword [rsp + 0xd0]
mov edx, eax
lea rcx, [0x1400180a0]
call qword [sym.imp.USER32.dll_EnumWindows]
lea rdx, [rsp + 0x28]
mov rcx, qword [0x14014c7c0]
call fcn.140017f80
cmp dword [rsp + 0xd0], 0
je 0x14001813d
cmp dword [rsp + 0x28], 0
jne 0x140018144
xor eax, eax
jmp 0x140018350
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x140018163
mov eax, 1
jmp 0x140018350
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140018185
mov eax, 2
jmp 0x140018350
mov rax, qword [rsp + 0x30]
mov edx, dword [rax + 0x50]
xor ecx, ecx
call fcn.140017420
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x1400181ab
mov eax, 3
jmp 0x140018350
movzx eax, byte [rsp + 0xe0]
test eax, eax
je 0x1400181e3
movzx r8d, byte [rsp + 0x20]
lea rdx, [0x140085648]
lea rcx, [rsp + 0x5a]
call fcn.1400246a0
mov rcx, rax
call fcn.140030b10
mov rdx, qword [rsp + 0x38]
mov rcx, rax
call fcn.140031910
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
call fcn.140017a20
test eax, eax
jne 0x140018205
mov eax, 4
jmp 0x140018350
movzx eax, byte [rsp + 0xe0]
test eax, eax
je 0x140018238
movzx r8d, byte [rsp + 0x21]
lea rdx, str.relocate_sucess_n
lea rcx, [rsp + 0x48]
call fcn.140027230
mov rcx, rax
call fcn.140030900
mov rcx, rax
call fcn.140031910
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x28]
call fcn.140017c20
test eax, eax
jne 0x140018259
mov eax, 5
jmp 0x140018350
movzx eax, byte [rsp + 0xe0]
test eax, eax
je 0x14001828f
movzx r8d, byte [rsp + 0x22]
lea rdx, str.resolve_imports_sucess_n
lea rcx, [rsp + 0xa0]
call fcn.140023fc0
mov rcx, rax
call fcn.140030c70
mov rcx, rax
call fcn.140031910
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
call fcn.140017de0
movzx eax, byte [rsp + 0xe0]
test eax, eax
je 0x1400182d6
movzx r8d, byte [rsp + 0x23]
lea rdx, str.write_section_sucess_n
lea rcx, [rsp + 0x71]
call fcn.140024d00
mov rcx, rax
call fcn.140030b10
mov rcx, rax
call fcn.140031910
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x28]
call fcn.140017740
movzx eax, byte [rsp + 0xe0]
test eax, eax
je 0x14001831f
movzx r8d, byte [rsp + 0x24]
lea rdx, str.call_dll_main_success_n
lea rcx, [rsp + 0x88]
call fcn.140024340
mov rcx, rax
call fcn.140030bc0
mov rcx, rax
call fcn.140031910
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
call fcn.140017e90
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsp + 0x38]
call fcn.140017510
mov eax, 6
add rsp, 0xc8
ret
Function at 0x140022980
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rcx, qword [rsp + 0x30]
call fcn.140031910
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]