joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140114744
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.1401140b8
mov ebx, eax
test eax, eax
jne 0x140114774
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x1401147d7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401147ce
test al, 0x10
je 0x1401147ce
bt eax, 0xa
jae 0x1401147c7
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.1401147e8
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x1401147c3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1401147c3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
test edi, edi
jne 0x1401147ce
and dword [rsp + 0x3c], 0
jmp 0x1401147d3
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14011592c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140115976
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140115976
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140115976
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140115976
cmp dword [rcx + 0x84], 0xe
jbe 0x140115976
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140115978
xor al, al
add rsp, 0x28
ret
Function at 0x4015b5
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rbx
xor r9d, r9d
lea r11, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov rax, rcx
lea ebx, [r8 - 2]
mov esi, r9d
cmp ebx, r9d
jle 0x401655
mov r10b, byte [rdx + r9]
add rax, 4
shr r10b, 2
and r10d, 0x3f
mov r10b, byte [r11 + r10]
mov byte [rax - 4], r10b
movsx r10d, byte [rdx + r9]
movsx esi, byte [rdx + r9 + 1]
shl r10d, 4
sar esi, 4
and r10d, 0x30
and esi, 0xf
or r10d, esi
movsxd r10, r10d
mov r10b, byte [r11 + r10]
mov byte [rax - 3], r10b
movsx r10d, byte [rdx + r9 + 1]
movsx esi, byte [rdx + r9 + 2]
shl r10d, 2
sar esi, 6
and r10d, 0x3c
and esi, 3
or r10d, esi
movsxd r10, r10d
mov r10b, byte [r11 + r10]
mov byte [rax - 2], r10b
mov r10b, byte [rdx + r9 + 2]
add r9, 3
and r10d, 0x3f
mov r10b, byte [r11 + r10]
mov byte [rax - 1], r10b
jmp 0x4015c8
cmp r9d, r8d
jge 0x4016d8
movsxd r11, r9d
lea r9, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
dec r8d
lea rbx, [rdx + r11]
mov r10b, byte [rbx]
shr r10b, 2
and r10d, 0x3f
cmp r8d, esi
mov r10b, byte [r9 + r10]
mov byte [rax], r10b
movsx r8d, byte [rbx]
jne 0x40169b
shl r8d, 4
mov byte [rax + 2], 0x3d
and r8d, 0x30
mov dl, byte [r9 + r8]
mov byte [rax + 1], dl
jmp 0x4016d0
lea r10, [rdx + r11 + 1]
shl r8d, 4
movsx edx, byte [r10]
and r8d, 0x30
sar edx, 4
and edx, 0xf
or r8d, edx
movsxd r8, r8d
mov dl, byte [r9 + r8]
mov byte [rax + 1], dl
movsx edx, byte [r10]
shl edx, 2
and edx, 0x3c
mov dl, byte [r9 + rdx]
mov byte [rax + 2], dl
mov byte [rax + 3], 0x3d
add rax, 4
mov byte [rax], 0
inc rax
sub rax, rcx
pop rbx
pop rsi
ret

Function at 0x401810
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x260
lea rcx, [0x0040a0c0]
call fcn.00405bb0
mov rsi, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r8d, r8d
mov r9d, 0x108
mov r13, rax
lea rax, [rsp + 0x48]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov rdx, r13
call rsi
mov r12d, eax
test eax, eax
jne 0x401935
lea rcx, [0x0040a12f]
xor ebx, ebx
call fcn.00405bb0
mov rdi, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov r14, rax
lea r15, [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x44]
mov edx, ebx
mov dword [rsp + 0x44], 0x104
mov r8, r15
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rdi
test eax, eax
jne 0x401920
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
mov rdx, r15
mov qword [rsp + 0x20], rax
mov r9d, 0x101
call rsi
test eax, eax
jne 0x401919
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x50]
cmp eax, 1
adc r12d, 0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
jmp 0x40187a
mov rcx, r14
call fcn.00405c32
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401938
xor r12d, r12d
mov rcx, r13
call fcn.00405c32
mov eax, r12d
add rsp, 0x260
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x4019ce
Capabilities:
Get system information on windows

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x50
lea rcx, [0x0040a192]
call fcn.00405bb0
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, r12
mov r13, rax
call fcn.00405c32
lea rcx, [0x0040a1b3]
call fcn.00405b30
mov rcx, r13
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
mov rbx, rax
call fcn.00405c32
test rbx, rbx
lea rcx, [rsp + 0x20]
je 0x401a2e
call rbx
jmp 0x401a34
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop r12
pop r13
ret

Function at 0x401cd6
Capabilities:
Get common file path

Disassembly:
push r12
sub rsp, 0x240
xor r8d, r8d
xor r9d, r9d
mov edx, 0x1a
xor ecx, ecx
lea r12, [rsp + 0x38]
mov qword [rsp + 0x20], r12
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov r8d, eax
xor eax, eax
test r8d, r8d
js 0x401d0e
mov rcx, r12
call fcn.00401a65
add rsp, 0x240
pop r12
ret

Function at 0x401d18
Capabilities:
Check mutex on windows

Disassembly:
push r12
sub rsp, 0x20
mov r12, rcx
call fcn.00401c35
cmp eax, 0xe
jle 0x401d37
call fcn.004019ce
cmp eax, 3
ja 0x401d4d
jmp 0x401d67
call fcn.00401cd6
cmp eax, 4
jg 0x401d2b
call fcn.00401810
cmp eax, 4
jg 0x401d2b
jmp 0x401d7d
call fcn.00401956
cmp eax, 0xeff
jle 0x401d67
mov rcx, r12
add rsp, 0x20
pop r12
jmp 0x404e4c
call fcn.004019ce
cmp eax, 7
ja 0x401d59
call fcn.00401956
cmp eax, 0x16ff
jg 0x401d59
add rsp, 0x20
pop r12
ret
push r15
push r14
push r13
push r12
sub rsp, 0x28
mov qword [0x0040f0b0], rcx
mov r13, rcx
lea rcx, [0x004090a0]
call fcn.00405bb0
xor ecx, ecx
mov r12, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8, r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov r14, rax
test rax, rax
je 0x404edf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x404ecb
lea rcx, [0x0040a892]
call fcn.00405bb0
mov rcx, rax
mov r15, rax
call fcn.00406b16
test eax, eax
je 0x404ec1
mov rdx, r12
mov rcx, r13
call fcn.00404e0d
mov rcx, r15
call fcn.00405c32
jmp 0x404ed6
mov rdx, r12
mov rcx, r13
call fcn.00404e0d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
add rsp, 0x28
pop r12
pop r13
pop r14
pop r15
jmp fcn.00405c32
Function at 0x40325e
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x58
xor r12d, r12d
mov rsi, rdx
mov ebx, r8d
call fcn.004024dc
mov r14, rax
test rax, rax
je 0x403329
mov rcx, rax
call fcn.004023a5
mov r15, rax
test rax, rax
je 0x403321
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x403319
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x4c]
mov r8d, ebx
mov rdx, rsi
mov qword [rsp + 0x20], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r12d, eax
test eax, eax
je 0x403310
xor r12d, r12d
cmp dword [rsp + 0x4c], ebx
sete r12b
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call fcn.00404f58
mov rcx, r14
call fcn.00404f58
mov eax, r12d
add rsp, 0x58
pop rbx
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x40347c
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rsi, rdx
call fcn.004024dc
mov r13, rax
test rax, rax
je 0x403589
mov rcx, rax
call fcn.004023a5
mov r14, rax
test rax, rax
je 0x40357e
xor r9d, r9d
mov r8d, 7
mov rcx, rax
xor r12d, r12d
mov qword [rsp + 0x30], 0
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x403573
mov rdi, qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor r8d, r8d
xor edx, edx
mov rcx, rax
mov r9d, 2
call rdi
mov ebx, eax
cmp eax, 0x40000000
ja 0x403567
mov ecx, eax
call fcn.00404f00
mov r12, rax
test rax, rax
je 0x403567
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r15
call rdi
lea r9, [rsp + 0x4c]
mov r8d, ebx
mov rdx, r12
mov qword [rsp + 0x20], 0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40355f
cmp dword [rsp + 0x4c], ebx
jne 0x40355f
test rsi, rsi
je 0x40356a
mov dword [rsi], ebx
jmp 0x40356a
mov rcx, r12
call fcn.00404f58
xor r12d, r12d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
mov r14, r12
call fcn.00404f58
mov rcx, r13
mov r13, r14
call fcn.00404f58
mov rax, r13
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x40371e
Capabilities:
Set current directory

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x230
xor r12d, r12d
call fcn.004024b5
mov rcx, rax
mov rbx, rax
call sub.msvcrt.dll_wcslen
cmp rax, 1
jbe 0x403811
lea rcx, [0x0040a5b3]
call fcn.00405bb0
mov r8d, 2
mov rcx, rbx
mov r13, rax
mov rdx, rax
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
je 0x403774
xor r12d, r12d
jmp 0x403809
lea rcx, [rbx + 4]
call fcn.004024b5
mov rcx, rax
mov rbx, rax
call sub.msvcrt.dll_wcslen
test rax, rax
je 0x40376c
mov word [rsp + 0x28], 0
xor eax, eax
cmp word [rbx], 0x22
lea r12, [rsp + 0x28]
movabs r8, 0x100002601
jne 0x4037d6
mov cx, word [rbx + rax*2 + 2]
movsxd rdx, eax
test cx, cx
je 0x4037e5
cmp cx, 0x22
je 0x4037e5
mov word [r12 + rax*2], cx
inc rax
jmp 0x4037ab
bt r8, rcx
jb 0x4037e5
mov word [r12 + rax*2], cx
inc rax
mov cx, word [rbx + rax*2]
movsxd rdx, eax
cmp cx, 0x20
ja 0x4037ce
jmp 0x4037c8
mov rcx, r12
mov word [rsp + rdx*2 + 0x28], 0
call sub.msvcrt.dll_wcslen
test rax, rax
je 0x40376c
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov r12d, eax
mov rcx, r13
call fcn.00405c32
mov eax, r12d
add rsp, 0x230
pop rbx
pop r12
pop r13
ret
Function at 0x404191
Capabilities:
Delete file

Disassembly:
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x438
lea rcx, [0x0040a618]
call fcn.00405bb0
lea r14, [rsp + 0x20]
mov r13, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, r13
mov r12, rax
call fcn.00405c32
lea rcx, [0x0040a74d]
call fcn.00405b30
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
mov r13, rax
mov rdx, rax
call rsi
mov rcx, r13
mov rbx, rax
call fcn.00405c32
lea rcx, [0x0040a75f]
call fcn.00405b30
mov rcx, r12
mov r13, rax
mov rdx, rax
call rsi
mov rcx, r13
mov rdi, rax
call fcn.00405c32
lea rcx, [0x0040a774]
call fcn.00405b30
mov rcx, r12
lea r12, [rsp + 0x228]
mov r13, rax
mov rdx, rax
call rsi
mov rcx, r13
mov rsi, rax
call fcn.00405c32
call fcn.004040e8
mov r8d, 0x104
mov rdx, r14
mov rcx, qword [0x0040f0b0]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rdx, r12
mov ecx, 0x104
call rdi
lea rcx, [0x0040a78d]
call fcn.00405bb0
mov r9, r12
xor r8d, r8d
mov rcx, r12
mov r13, rax
mov rdx, rax
call rsi
mov rcx, r13
call fcn.00405c32
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, r12
mov rcx, r14
call rbx
xor eax, eax
add rsp, 0x438
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret
Function at 0x404e4c
Capabilities:
Check mutex on windows

Disassembly:
push r12
sub rsp, 0x20
mov r12, rcx
call fcn.00401c35
cmp eax, 0xe
jle 0x401d37
call fcn.004019ce
cmp eax, 3
ja 0x401d4d
jmp 0x401d67
call fcn.00401cd6
cmp eax, 4
jg 0x401d2b
call fcn.00401810
cmp eax, 4
jg 0x401d2b
jmp 0x401d7d
call fcn.00401956
cmp eax, 0xeff
jle 0x401d67
mov rcx, r12
add rsp, 0x20
pop r12
jmp 0x404e4c
call fcn.004019ce
cmp eax, 7
ja 0x401d59
call fcn.00401956
cmp eax, 0x16ff
jg 0x401d59
add rsp, 0x20
pop r12
ret
push r15
push r14
push r13
push r12
sub rsp, 0x28
mov qword [0x0040f0b0], rcx
mov r13, rcx
lea rcx, [0x004090a0]
call fcn.00405bb0
xor ecx, ecx
mov r12, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8, r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov r14, rax
test rax, rax
je 0x404edf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x404ecb
lea rcx, [0x0040a892]
call fcn.00405bb0
mov rcx, rax
mov r15, rax
call fcn.00406b16
test eax, eax
je 0x404ec1
mov rdx, r12
mov rcx, r13
call fcn.00404e0d
mov rcx, r15
call fcn.00405c32
jmp 0x404ed6
mov rdx, r12
mov rcx, r13
call fcn.00404e0d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
add rsp, 0x28
pop r12
pop r13
pop r14
pop r15
jmp fcn.00405c32
Function at 0x405d03
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbx
sub rsp, 0x58
xor r9d, r9d
xor r14d, r14d
mov qword [rsp + 0x30], 0
mov r13, rdx
mov ebx, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r8d, r8d
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x405d8e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
inc eax
je 0x405d85
lea r9, [rsp + 0x4c]
mov r8d, ebx
mov rdx, r13
mov rcx, r12
mov qword [rsp + 0x20], 0
xor r14d, r14d
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne r14b
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r14d
add rsp, 0x58
pop rbx
pop r12
pop r13
pop r14
ret
Function at 0x406090
Capabilities:
Link many functions at runtime

Disassembly:
push r12
sub rsp, 0x20
cmp dword [0x0040f200], 0
jne 0x4062c4
cmp qword [0x0040f1f8], 0
jne 0x4060d4
lea rcx, [0x0040ba30]
call fcn.00405bb0
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, r12
mov qword [0x0040f1f8], rax
call fcn.00405c32
cmp qword [0x0040f1f0], 0
jne 0x40610c
lea rcx, [0x0040ba51]
call fcn.00405b30
mov rcx, qword [0x0040f1f8]
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
mov qword [0x0040f1f0], rax
call fcn.00405c32
cmp qword [0x0040f1e8], 0
jne 0x406144
lea rcx, [0x0040ba66]
call fcn.00405b30
mov rcx, qword [0x0040f1f8]
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
mov qword [0x0040f1e8], rax
call fcn.00405c32
cmp qword [0x0040f1e0], 0
jne 0x40617c
lea rcx, [0x0040ba83]
call fcn.00405b30
mov rcx, qword [0x0040f1f8]
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
mov qword [0x0040f1e0], rax
call fcn.00405c32
cmp qword [0x0040f1d8], 0
jne 0x4061ad
lea rcx, [0x0040baa0]
call fcn.00405bb0
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, r12
mov qword [0x0040f1d8], rax
call fcn.00405c32
cmp qword [0x0040f1d0], 0
jne 0x4061e5
lea rcx, [0x0040babb]
call fcn.00405b30
mov rcx, qword [0x0040f1d8]
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
mov qword [0x0040f1d0], rax
call fcn.00405c32
cmp qword [0x0040f1c8], 0
jne 0x40621d
lea rcx, [0x0040bad2]
call fcn.00405b30
mov rcx, qword [0x0040f1d8]
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
mov qword [0x0040f1c8], rax
call fcn.00405c32
cmp qword [0x0040f1c0], 0
jne 0x406255
lea rcx, [0x0040baeb]
call fcn.00405b30
mov rcx, qword [0x0040f1d8]
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
mov qword [0x0040f1c0], rax
call fcn.00405c32
cmp qword [0x0040f1b8], 0
jne 0x406286
lea rcx, [0x0040bb02]
call fcn.00405bb0
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, r12
mov qword [0x0040f1b8], rax
call fcn.00405c32
cmp qword [0x0040f1b0], 0
jne 0x4062be
lea rcx, [0x0040bb21]
call fcn.00405b30
mov rcx, qword [0x0040f1b8]
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
mov qword [0x0040f1b0], rax
call fcn.00405c32
inc dword [0x0040f200]
add rsp, 0x20
pop r12
ret
Function at 0x406880
Capabilities:
Link many functions at runtime

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x40
cmp qword [0x0040f260], 0
jne 0x4068ba
lea rcx, [0x0040bb60]
call fcn.00405bb0
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, r12
mov qword [0x0040f260], rax
call fcn.00405c32
cmp qword [0x0040f250], 0
jne 0x4068f2
lea rcx, [0x0040bb81]
call fcn.00405b30
mov rcx, qword [0x0040f260]
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
mov qword [0x0040f250], rax
call fcn.00405c32
cmp qword [0x0040f248], 0
jne 0x40692a
lea rcx, [0x0040bb9b]
call fcn.00405b30
mov rcx, qword [0x0040f260]
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
mov qword [0x0040f248], rax
call fcn.00405c32
cmp qword [0x0040f240], 0
jne 0x40695b
lea rcx, [0x0040bbaf]
call fcn.00405bb0
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, r12
mov qword [0x0040f240], rax
call fcn.00405c32
cmp qword [0x0040f238], 0
jne 0x406993
lea rcx, [0x0040bbd0]
call fcn.00405b30
mov rcx, qword [0x0040f240]
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
mov qword [0x0040f238], rax
call fcn.00405c32
cmp qword [0x0040f230], 0
jne 0x4069cb
lea rcx, [0x0040bbe9]
call fcn.00405b30
mov rcx, qword [0x0040f240]
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
mov qword [0x0040f230], rax
call fcn.00405c32
cmp qword [0x0040f228], 0
jne 0x406a03
lea rcx, [0x0040bc05]
call fcn.00405b30
mov rcx, qword [0x0040f240]
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
mov qword [0x0040f228], rax
call fcn.00405c32
cmp qword [0x0040f220], 0
jne 0x406a3b
lea rcx, [0x0040bc25]
call fcn.00405b30
mov rcx, qword [0x0040f240]
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
mov qword [0x0040f220], rax
call fcn.00405c32
mov rbx, qword [0x0040f238]
xor r13d, r13d
call qword [0x0040f250]
lea r8, [rsp + 0x38]
mov edx, 0x18
mov rcx, rax
call rbx
test eax, eax
je 0x406af0
lea rbx, [rsp + 0x34]
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x19
mov dword [rsp + 0x34], 0
mov qword [rsp + 0x20], rbx
call qword [0x0040f230]
mov ecx, dword [rsp + 0x34]
call fcn.00404f00
mov r12, rax
test rax, rax
je 0x406ae5
mov qword [rsp + 0x20], rbx
mov r9d, dword [rsp + 0x34]
mov r8, rax
mov edx, 0x19
mov rcx, qword [rsp + 0x38]
call qword [0x0040f230]
test eax, eax
je 0x406add
mov rbx, qword [0x0040f220]
mov rcx, qword [r12]
call qword [0x0040f228]
mov rcx, qword [r12]
mov dl, byte [rax]
dec edx
movzx edx, dl
call rbx
mov r13d, dword [rax]
mov rcx, r12
call fcn.00404f58
mov rcx, qword [rsp + 0x38]
call qword [0x0040f248]
mov eax, r13d
add rsp, 0x40
pop rbx
pop r12
pop r13
ret
Function at 0x4071a0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00408340
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.00408340
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x407210
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x0040f854]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x4073b8
mov rax, qword [0x0040f858]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x40725c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x4072e7
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x407240
mov rcx, r12
call fcn.00407f70
mov rbp, rax
test rax, rax
je 0x4073f2
mov rax, qword [0x0040f858]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.004080a0
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x0040f858]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x407401
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x4072e0
sub eax, 4
and eax, 0xfffffffb
jne 0x407370
add dword [0x0040f854], 1
cmp ebx, 8
jae 0x407318
test bl, 4
jne 0x4073c0
test ebx, ebx
je 0x407309
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x4073e0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x407309
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x40734a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x0040f858]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x4072e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.004071a0
nop dword [rax]
xor edi, edi
jmp 0x407267
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x407309
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x407309
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.004071a0
mov rax, qword [0x0040f858]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.004071a0
nop
nop dword [rax]
Function at 0x407be0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0040fb40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0040fb20]
test rbx, rbx
je 0x407c34
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x407c2b
test r12, r12
je 0x407c2b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x407c10
lea rcx, [0x0040fb40]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x407f70
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x0040c040]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x407fe9
mov rcx, r10
call fcn.00407e40
test eax, eax
je 0x407fe9
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x407fe6
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x407fdd
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x407fe9
add r8, 0x28
cmp r8, r9
jne 0x407fc8
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret