joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00408630]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x00408640]
mov dword [rax], 1
mov rax, qword [0x00408650]
mov dword [rax], 1
mov rax, qword [0x00408620]
mov dword [rax], 1
mov rax, qword [0x004084e0]
cmp word [rax], 0x5a4d
je 0x4010d0
mov rax, qword [0x00408610]
mov dword [0x0040b008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010c2
mov ecx, 2
call sym.__set_app_type
mov rcx, 0xffffffffffffffff
call dbg._encode_pointer
mov rdx, qword [0x00408570]
mov qword [rdx], rax
mov rdx, qword [0x00408560]
mov qword [rdx], rax
mov rax, qword [0x004085d0]
mov edx, dword [rax]
mov rax, qword [sym.imp.msvcrt.dll__fmode]
mov rax, qword [rax]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x00408490]
cmp dword [rax], 1
je 0x401120
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401133
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058
Function at 0x404bc0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x0040b074]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x404cda
mov rax, qword [0x0040b078]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x404c0e
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x404cc0
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x404bf2
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x404d12
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x0040b078]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call dbg._GetPEImageBase
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x0040b078]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x404cf5
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x404cb9
sub eax, 0x40
and eax, 0xffffffbf
je 0x404cb9
mov r9, rbp
add r9, qword [0x0040b078]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x404ce1
add dword [0x0040b074], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.memcpy
xor ebp, ebp
jmp 0x404c1b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
mov rax, qword [0x0040b078]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbp + 8]
call dbg.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call dbg.__report_error
nop
nop word cs:[rax + rax]

Function at 0x4058f0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x405900
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x405910
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x405951
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x405948
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x405953
add rax, 0x28
cmp rax, r9
jne 0x405934
xor eax, eax
repz ret

Function at 0x405a00
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x004084e0]
cmp word [rbx], 0x5a4d
je 0x405a20
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, rcx
mov rcx, rbx
call sym._ValidateImageBase.part.0
test eax, eax
je 0x405a14
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp dbg._FindPESection
Function at 0x405c70
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0040b9c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0040b9a0]
test rbx, rbx
je 0x405cc4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x405cbb
test rsi, rsi
je 0x405cbb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x405ca0
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x0040b9c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
Function at 0x1400017a2
Capabilities:
Encode data using xor

Disassembly:
mov r8, qword [rsp + 0x38]
movabs r10, 0x228f149203a4350c
call fcn.140209990

Function at 0x14001b550
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbp, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14001b57c
xor al, al
jmp 0x14001b6a0
movdqa xmm0, xmmword [0x14003bae0]
movdqa xmm1, xmmword [0x14003baf0]
mov rax, qword [r9]
xor r11d, r11d
mov qword [rsp + 0x50], r12
mov rcx, r8
movdqa xmmword [rsp], xmm0
movdqa xmm0, xmmword [0x14003bb00]
movdqa xmmword [rsp + 0x10], xmm1
lea r12, [r8 + rax]
mov edx, r11d
movdqa xmm1, xmmword [0x14003bb10]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmmword [rsp + 0x30], xmm1
test rbx, rbx
je 0x14001b692
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x14001b5f9
mov r11d, 2
jmp 0x14001b61d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x14001b613
mov r11d, 1
jmp 0x14001b61d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, r12
ja 0x14001b6b5
mov eax, r10d
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov eax, r10d
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14001b65a
mov byte [rcx + 2], 0x3d
jmp 0x14001b66a
shr r10, 6
and r10d, 0x3f
movzx eax, byte [rsp + r10]
mov byte [rcx + 2], al
add rcx, 3
add r8, 3
test r11, r11
je 0x14001b67c
mov byte [rcx], 0x3d
jmp 0x14001b683
movzx eax, byte [rsp + r9]
mov byte [rcx], al
inc rcx
inc r8
cmp rdx, rbx
jb 0x14001b5e0
sub rcx, rsi
mov al, 1
mov qword [rbp], rcx
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
xor al, al
jmp 0x14001b69b

Function at 0x1401d2a48
Capabilities:
Encode data using xor

Disassembly:
mov r9, qword [rsp + 0x78]
setb byte [rsp + 0x48]
xor qword [rsp + 0x48], 0x2e2206d8
neg qword [rsp + 0x48]
neg word [rsp + 0x48]
call fcn.1401ffa62
push r15
pushfq

Function at 0x1402b6d93
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], 0xffffffffbed833a7
push r12
pushfq
add qword [rsp + 0x10], 0xffffffffbfcc49ab
push qword [rsp]
popfq
lea rsp, [rsp + 0x18]
call fcn.140726cbc
in eax, dx
sub byte [rdx + 0x239e5a9e], bl
invalid

Function at 0x140331238
Capabilities:
Encode data using xor

Disassembly:
movabs rsi, 0x6ce544a942e4524e
mov rsi, qword [rsp + 0x78]
test byte [rsp + 0xa8], 0x1d
call fcn.1404040a4
xchg esi, eax
xchg ebx, eax
xor eax, 0xf712fc09
scasb al, byte [rdi]
imul esi, dword [rdi - 0x5a], 0xffffffaa
push rdx
invalid
or byte [rsp + 0x88], 0x62
ja 0x1401387c9
Function at 0x1403cae46
Capabilities:
Encode data using xor

Disassembly:
seta r14b
not dword [rsp + 0x10]
add r14d, dword [rsp + 0x13]
add qword [rsp + 0x40], 0xffffffffbfb71419
add qword [rsp], 0xffffffffbfdb3518
not byte [rsp + 0x10]
test dword [rsp + 0x10], r14d
mov r14, qword [rsp + 0x38]
mov byte [rsp + 0x10], 0x6e
setne byte [rsp + 0x10]
sub qword [rsp + 0x10], 0x633815cf
xor word [rsp + 0x10], 0x7def
jb 0x1403cae6e
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x48]
call fcn.1406b6240

Function at 0x1403cee4e
Capabilities:
Encode data using xor

Disassembly:
push 0x28824b62
pushfq
xor qword [rsp + 8], 0xa7b6754
setl byte [rsp + 8]
mov qword [rsp + 0x10], 0x1b1bc9e2
js 0x1403cee53
add dword [rsp + 8], 0x35526071
or dword [rsp + 8], 0x60336e9d
not byte [rsp + 8]
push r13
push rbx
cmp qword [rsp + 0x18], 0x4b8e6a48
mov word [rsp + 0x18], 0x23e6
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x20]
call fcn.14063f04e

Function at 0x1404025be
Capabilities:
Encode data using xor

Disassembly:
xor r12, r13
jle fcn.1404025be
seto r12b
mov r13, qword [rsp + 0x28]
sub r12, r12
cmp r12b, 0xc7
call fcn.1403ca3fd

Function at 0x1404707aa
Capabilities:
Encode data using xor

Disassembly:
not word [rsp + 0x18]
xchg qword [rsp + r10 - 0x6f], rbx
mov word [rsp + 0x50], 0x1300
js fcn.140249b5a
add qword [rsp + 0x58], 0xcf12c
call fcn.1401dfb25
scasb al, byte [rdi]
clc
imul ebp, dword [rsi - 0x5f], 0xee97966b
add eax, 0x6e69a3a0
and al, 0x7b
fcom dword [rsi + rbp*8 - 0x6bab66fe]
adc ebp, eax
mov eax, 0x51116b81
adc eax, 0xeeee6884
jne 0x140470858
xchg ecx, eax
adc dword [rax], edx
add ebp, esp
push 0xffffffffffffffee
pop rdi
ror al, 1
popfq
outsb dx, byte [rsi]
jne 0x1404707d3
xchg dword [rbx - 0x4db4706f], ebx
invalid
wait
clc
sbb eax, 0xa54e5974
in al, dx
xchg esi, eax
xchg ecx, eax
mov bh, 0x53
or byte [rbp + 0x7f], cl
int1
xlatb
mov ds, word [0x10e9fa6f9]
mov dl, 0xec
test eax, 0x293fa964
mov ebp, 0x36b9b83c
cmp al, 0xf6
push 0x18
stc
xor al, dh
stosd dword [rdi], eax
out 0xa0, al
jo 0x140470872
sahf
nop
retf 0x543c

Function at 0x14048af72
Capabilities:
Encode data using xor

Disassembly:
neg dword [rsp + 0x60]
add qword [rsp + 0x50], 0xffffffffffedf4e9
call fcn.14019f4f5
cli
js 0x1402b33b8
jmp 0x1292b21b1
out 0x6c, al
fild word [rdx - 0x5bf0df0d]
jg 0x1402b3442
jmp 0xccaa5c41
mov edx, 0xb6cab149
imul ebx, dword [rcx - 0x70642a73], 0x912ec483
mov cl, 0xca
invalid
not rdi
je 0x1402b33af
add edi, 0x58ff7553
call fcn.1403b44b3
Function at 0x140783951
Capabilities:
Encode data using xor

Disassembly:
mov r14, qword [rsp + 0x20]
jno 0x1407c1267
invalid
setg byte [rsp + 0x10]
neg byte [rsp + 8]
call fcn.140fa30ff
push rdi
sti
jns 0x1407c12b1
shr byte [rsi], 1
or dword [rbx - 0x1af83448], eax
pop rsp
sti
push rsi
movabs byte [0xf5f79a9c7a6c42e2], al
loope 0x1407c12f4
enter 0xffffffffffff9036, 0x7a
cmp byte [rdi + 0xe], dh
ja 0x1407c12a8
or bl, byte [rbx]
xor esi, ecx
outsd dx, dword [rsi]
fidivr dword [rsi + 8]
div byte [rbp - 0x76]
out dx, al
or al, 0xf2
jne 0x1407c1298
bnd jne 0x1407c1298
pop rdx
invalid
nop
jrcxz 0x1407c1301
shr dword cs:[rsp + riz*4 + 0x2d], 0x34
jnp 0x1407c12ae
mov ah, 0x96
invalid
pop rdx
nop
jmp 0x177753e9f
pop rdx
mov ch, ch
xchg edi, eax
add al, 0xa0
invalid
Function at 0x1407629a8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1407629b2
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1407629db
pop rbp
sub rbp, 0x33
sub rbp, 0x7629a8
sub rsp, 0x20
jmp 0x1407629fa
mov rax, 0x7629a8
add rax, rbp
add rax, 0x84
mov rcx, 0x647
mov rdx, 0x3d6cf6cd
xor byte [rax], dl
inc rax
dec rcx
jne 0x140762a19
jmp 0x140762a30
test dword [rsp + 0x46], eax
int1
int 0xcd
int 0x85
or al, 0xc5
int3
Function at 0x140001088
Capabilities:
Get common file path
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
xor ebx, ebx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
je 0x140001111
mov ebx, esi
add rbx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
lea edx, [rdi + 8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x14000110a
mov rdx, rax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x140001123
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, 0x1f
test edi, edi
cmove edi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x140001123
xor ebx, ebx
jmp 0x140001123
mov edi, 0xe
jmp 0x140001123
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, 0x1f
test edi, edi
cmove edi, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rbx, rbx
je 0x140001154
mov rdx, rbx
lea rcx, str.ORIGINAL_SETUP_WORKINGDIR_ENV_VAR
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140001300
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
lea r8, str.Microsoft.Windows.Setup.Autorun_F2F632C7_AC94_4B7A_D06B_97D56ED9DC8B
xor ecx, ecx
xor edx, edx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
test rax, rax
je 0x14000134a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000134a
mov rcx, rbx
mov edi, 1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
test rsi, rsi
je 0x140001354
mov qword [rsi], rbx
xor ebx, ebx
test rbx, rbx
je 0x140001362
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140001558
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xe0
mov rsi, rdx
mov rbx, rcx
mov edi, 0x68
lea rcx, [rsp + 0x70]
mov r8d, edi
xor edx, edx
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x50]
mov dword [rsp + 0x70], edi
mov qword [rsp + 0x48], rax
xor edi, edi
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], rdi
mov rdx, rbx
mov qword [rsp + 0x30], rdi
xor ecx, ecx
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400015e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
jmp 0x14000163c
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14000161f
test rsi, rsi
je 0x140001624
mov rcx, qword [rsp + 0x50]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x140001624
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x140001624
mov edi, 0x8000ffff
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140001658
Capabilities:
Check if file exists
Get file attributes
Get system information on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x288
mov rax, qword [0x140004008]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor r15d, r15d
mov r14, r9
mov rbp, r8
mov rbx, rdx
mov rsi, rcx
cmp word [rcx], r15w
je 0x140001824
test rdx, rdx
je 0x140001824
cmp word [rdx], r15w
je 0x140001824
xor edx, edx
lea r8d, [r15 + 0x30]
lea rcx, [rsp + 0x30]
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x30]
test eax, eax
je 0x1400016e2
cmp eax, 9
je 0x1400016d9
mov eax, 0x8000ffff
jmp 0x140001829
lea rdi, [0x1400032e8]
jmp 0x1400016e9
lea rdi, [0x1400032f0]
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x208
call sub.msvcrt.dll_memset
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], r15w
jne 0x1400016ff
mov ecx, 0x5c
mov qword [rsp + 0x28], rbx
cmp cx, word [rsi + rax*2 - 2]
lea r8, [0x1400032f8]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rdi
mov r9, rsi
mov edx, 0x104
je 0x14000173a
lea r8, str._s_s_s
call fcn.140001008
test eax, eax
js 0x140001829
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140001771
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
jmp 0x140001829
test al, 0x10
je 0x14000177f
mov eax, 0x800700a1
jmp 0x140001829
mov ecx, 0x18
call fcn.140001e48
mov rdi, rax
test rax, rax
je 0x1400017b6
lea rax, [0x1400033f8]
mov qword [rdi + 0x10], r15
lea r8, [rdi + 8]
mov qword [rdi], rax
lea rdx, [rsp + 0x60]
mov dword [r8], r15d
call fcn.140001a00
mov qword [rdi + 0x10], rax
jmp 0x1400017b9
mov rdi, r15
test rbp, rbp
je 0x140001801
lea rdx, [0x1400032e4]
mov rcx, rdi
call fcn.140001be4
test eax, eax
je 0x1400017e0
mov rdx, rbp
mov rcx, rdi
call fcn.140001be4
test eax, eax
jne 0x140001801
test rdi, rdi
je 0x1400017fe
mov rax, qword [rdi]
mov rbx, qword [rax]
mov rcx, rbx
call qword [0x140003220]
mov edx, 1
mov rcx, rdi
call rbx
mov rdi, r15
test rdi, rdi
je 0x140001757
cmp qword [rdi + 0x10], r15
lea rcx, [0x140003400]
mov rdx, r14
cmovne rcx, qword [rdi + 0x10]
call fcn.140001558
jmp 0x140001829
mov eax, 0x80070057
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140002270
add rsp, 0x288
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140001850
Capabilities:
Enumerate gui resources
Set current directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov r12, rcx
xor esi, esi
and dword [rbp - 0x10], esi
xor ecx, ecx
mov qword [rbp - 8], rsi
mov r15, r8
call fcn.140001300
test eax, eax
je 0x1400018a1
and dword [rbp - 0xc], esi
lea rdx, [rbp - 0xc]
lea rcx, [0x140001380]
call qword [sym.imp.USER32.dll_EnumWindows]
mov eax, 0xb7
jmp 0x1400019b1
call fcn.14000116c
mov rdi, rax
test rax, rax
je 0x140001997
call fcn.14000123c
mov rbx, rax
test rax, rax
je 0x140001997
call fcn.140001088
cmp qword [rbx + 0x10], rsi
lea r14, [0x140003400]
mov rdx, r14
mov rcx, r14
cmovne rdx, qword [rbx + 0x10]
cmp qword [rdi + 0x10], rsi
cmovne rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x1400018fa
lea r9, [rbp - 0x10]
mov r8, r15
call fcn.140001658
jmp 0x1400018ff
mov eax, 0x80070057
test eax, eax
jns 0x140001979
lea rcx, [rbp - 8]
call fcn.140001300
test eax, eax
je 0x14000192b
and dword [rbp - 0xc], esi
lea rdx, [rbp - 0xc]
lea rcx, [0x140001380]
call qword [sym.imp.USER32.dll_EnumWindows]
mov eax, 0xb7
jmp 0x140001972
lea rdx, str.Sources_
mov rcx, rdi
call fcn.140001be4
cmp qword [rdi + 0x10], rsi
mov rcx, r14
cmovne rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rdx, str.autorun.dll
mov rcx, rdi
call fcn.140001be4
cmp qword [rdi + 0x10], rsi
mov r8, r15
mov rcx, r12
cmovne r14, qword [rdi + 0x10]
mov rdx, r14
call fcn.1400013f8
mov rsi, qword [rbp - 8]
mov dword [rbp - 0x10], eax
mov rax, qword [rdi]
mov rbx, qword [rax]
mov rcx, rbx
call qword [0x140003220]
mov edx, 1
mov rcx, rdi
call rbx
mov eax, dword [rbp - 0x10]
jmp 0x1400019a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x10], eax
test rsi, rsi
je 0x1400019b1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp - 0x10]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140001fc0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0xb0
xor r15d, r15d
mov dword [rsp + 0x20], r15d
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov r14d, r15d
xor eax, eax
lock cmpxchg qword [0x1400045e8], rbx
je 0x140002029
cmp rax, rbx
jne 0x14000201c
mov edi, 1
mov r14d, edi
jmp 0x14000202e
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002000
mov edi, 1
mov eax, dword [0x1400045f0]
cmp eax, edi
jne 0x140002046
mov esi, 0x1f
mov ecx, esi
call sub.msvcrt.dll__amsg_exit
jmp 0x1400020b7
mov eax, dword [0x1400045f0]
test eax, eax
jne 0x1400020ac
mov dword [0x1400045f0], edi
lea r12, [0x140003260]
lea rbx, [0x140003248]
mov qword [rsp + 0x30], rbx
mov eax, r15d
mov dword [rsp + 0x24], eax
cmp rbx, r12
jae 0x14000209e
test eax, eax
jne 0x1400020a2
mov rsi, qword [rbx]
test rsi, rsi
je 0x140002093
mov rcx, rsi
mov rax, qword [0x140003220]
call rax
call rsi
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x140002070
test eax, eax
je 0x1400020b2
mov eax, 0xff
jmp 0x140002213
mov dword [0x140004024], edi
mov esi, 0x1f
mov eax, dword [0x1400045f0]
cmp eax, edi
jne 0x1400020de
lea rdx, [0x140003240]
lea rcx, [0x140003230]
call sub.msvcrt.dll__initterm
mov dword [0x1400045f0], 2
test r14d, r14d
jne 0x1400020ed
mov rax, r15
xchg qword [0x1400045e8], rax
cmp qword [0x1400045f8], r15
je 0x140002124
lea rcx, [0x1400045f8]
call fcn.140002430
test eax, eax
je 0x140002124
mov rbx, qword [0x1400045f8]
mov rcx, rbx
mov rax, qword [0x140003220]
call rax
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call rbx
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rdx, qword [rax]
test rdx, rdx
jne 0x14000213d
mov eax, 0xff
jmp 0x140002213
mov qword [rsp + 0x28], rdx
mov ecx, dword [rsp + 0x20]
cmp word [rdx], 0x20
ja 0x1400021c4
cmp word [rdx], r15w
je 0x140002156
test ecx, ecx
jne 0x1400021c4
movzx eax, word [rdx]
sub ax, di
cmp ax, si
ja 0x14000216c
add rdx, 2
mov qword [rsp + 0x28], rdx
jmp 0x140002156
mov ecx, dword [rsp + 0x7c]
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
and cl, dil
cmovne r9d, eax
mov r8, rdx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001850
mov dword [0x140004020], eax
cmp dword [0x140004040], r15d
jne 0x1400021ad
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140004024], r15d
jne 0x1400021c2
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140004020]
jmp 0x140002213
cmp word [rdx], 0x22
jne 0x1400021d8
mov eax, r15d
test ecx, ecx
sete al
mov ecx, eax
mov dword [rsp + 0x20], eax
add rdx, 2
mov qword [rsp + 0x28], rdx
jmp 0x140002146
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret
sub rsp, 0x28
call fcn.1400a0000
add rsp, 0x28
jmp 0x140001fc0
Function at 0x14000231c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140002368
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140002360
cmp dword [rcx + 0x3c], edx
jl 0x140002360
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140002360
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140002368
mov rax, rdx
add rsp, 0x18
ret