joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6b7ea0
Capabilities:
Hide graphical window

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbx, rcx
cmp qword [rbx + 0xc0], 0
jne 0x6b7f56
mov rcx, qword [rbx + 0x10]
call fcn.005cefc0
mov rcx, qword [0x005e22f8]
mov dl, 1
mov r8, rax
call fcn.005c5c20
mov qword [rbx + 0xc0], rax
mov rsi, qword [rbx + 0xc0]
mov rcx, rsi
xor rdx, rdx
call fcn.005ea570
lea rax, [rsi + 0x498]
mov qword [rax + 8], rbx
lea rcx, [0x006b7510]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xc0]
call fcn.005cefc0
mov rsi, rax
mov ecx, 3
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor rdx, rdx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xc0]
call fcn.005cefc0
mov rcx, rax
xor rdx, rdx
call sub.user32.dll_ShowWindow
cmp qword [rbx + 0xe0], 0
jne 0x6b8001
mov rcx, qword [rbx + 0x10]
call fcn.005cefc0
mov rcx, qword [0x005e22f8]
mov dl, 1
mov r8, rax
call fcn.005c5c20
mov qword [rbx + 0xe0], rax
mov rsi, qword [rbx + 0xe0]
mov rcx, rsi
mov dl, 1
call fcn.005ea570
lea rax, [rsi + 0x498]
mov qword [rax + 8], rbx
lea rcx, [0x006b7570]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xe0]
call fcn.005cefc0
mov rsi, rax
mov ecx, 2
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor rdx, rdx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xe0]
call fcn.005cefc0
mov rcx, rax
xor rdx, rdx
call sub.user32.dll_ShowWindow
cmp qword [rbx + 0xd0], 0
jne 0x6b809d
mov rcx, qword [rbx + 0x10]
call fcn.005cefc0
mov rcx, qword [0x005e32b8]
mov dl, 1
mov r8, rax
call fcn.005c5c20
mov qword [rbx + 0xd0], rax
mov rax, qword [rbx + 0xd0]
mov byte [rax + 0x468], 1
mov rcx, qword [rbx + 0xd0]
call fcn.005cefc0
mov rsi, rax
mov ecx, 2
call sub.user32.dll_GetSystemMetrics
mov edi, eax
mov ecx, 3
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor rdx, rdx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xd0]
call fcn.005cefc0
mov rcx, rax
xor rdx, rdx
call sub.user32.dll_ShowWindow
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret

Function at 0x6e2840
Capabilities:
Shutdown system

Disassembly:
push rbp
push rbx
sub rsp, 0x68
mov rbp, rsp
mov ebx, ecx
mov rax, qword [0x007ab890]
cmp dword [rax], 2
jne 0x6e28d3
call sub.kernel32.dll_GetCurrentProcess
mov rcx, rax
mov edx, 0x28
lea r8, [rbp + 0x58]
call sub.advapi32.dll_OpenProcessToken
test eax, eax
setne cl
test cl, cl
je 0x6e28d3
xor rcx, rcx
lea rdx, [0x006e28e4]
lea r8, [rbp + 0x4c]
call sub.advapi32.dll_LookupPrivilegeValueW
test eax, eax
setne cl
mov dword [rbp + 0x48], 1
mov dword [rbp + 0x54], 2
mov eax, 0x10
mov dword [rbp + 0x34], 0
test cl, cl
je 0x6e28d3
mov rcx, qword [rbp + 0x58]
xor rdx, rdx
lea r8, [rbp + 0x48]
mov r9d, eax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x34]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_AdjustTokenPrivileges
mov ecx, ebx
xor rdx, rdx
call sub.user32.dll_ExitWindowsEx
lea rsp, [rbp + 0x68]
pop rbx
pop rbp
ret
Function at 0x70e8f0
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rbx
sub rsp, 0x128
mov rbp, rsp
mov rbx, rcx
mov rcx, rdx
lea rdx, [rbp + 0x21]
mov r8d, 0xff
call sub.user32.dll_GetWindowTextA
mov rcx, rbx
lea rdx, [rbp + 0x21]
mov r8d, 0xff
call fcn.0040edf0
cmp qword [rbx], 0
je 0x70e9b5
jmp 0x70e958
lea rcx, [0x0070e9d0]
mov rdx, qword [rbx]
mov r8d, 1
call fcn.0040f620
mov rcx, rbx
mov edx, eax
mov r8d, 1
call fcn.0040f3f0
lea rcx, [0x0070e9d0]
mov rdx, qword [rbx]
mov r8d, 1
call fcn.0040f620
test eax, eax
jg 0x70e931
jmp 0x70e99b
lea rcx, [0x0070e9e0]
mov rdx, qword [rbx]
mov r8d, 1
call fcn.0040f620
mov rcx, rbx
mov edx, eax
mov r8d, 1
call fcn.0040f3f0
lea rcx, [0x0070e9e0]
mov rdx, qword [rbx]
mov r8d, 1
call fcn.0040f620
test eax, eax
jg 0x70e974
mov rax, rbx
lea rsp, [rbp + 0x128]
pop rbx
pop rbp
ret
Function at 0x70e9f0
Capabilities:
Get disk information

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x38], rcx
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x98], rdx
mov rcx, qword [rbp + 0x98]
call fcn.0040db00
nop
lea rcx, [0x0070ec7c]
mov rdx, qword [rbp + 0x98]
mov r8d, 2
call fcn.0040f620
mov ebx, eax
lea rcx, [0x0070ec7c]
mov rdx, qword [rbp + 0x98]
mov r8d, ebx
add r8d, 1
call fcn.0040f620
mov ebx, eax
xor rax, rax
cmp qword [rbp + 0x98], 0
je 0x70ea89
mov rax, qword [rbp + 0x98]
mov eax, dword [rax - 4]
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x98]
movsxd r8, ebx
movsxd r9, eax
call fcn.0040f390
xor rax, rax
cmp qword [rbp + 0x98], 0
je 0x70eab6
mov rax, qword [rbp + 0x98]
mov eax, dword [rax - 4]
lea rcx, [rbp + 0x98]
mov edx, ebx
mov r8d, eax
call fcn.0040f3f0
mov bx, 0x61
lea rcx, [rbp + 0x68]
mov edx, 0x104
call fcn.0040efb0
lea rcx, [rbp + 0x48]
mov edx, ebx
call fcn.0040ed70
lea rcx, [rbp + 0x48]
lea rdx, [0x0070ec8c]
call fcn.0040f090
mov rcx, qword [rbp + 0x48]
call fcn.0040ed20
mov rsi, rax
mov rcx, qword [rbp + 0x68]
call fcn.0040ed20
mov rcx, rsi
mov rdx, rax
mov r8d, 0x104
call sub.kernel32.dll_QueryDosDeviceW
test eax, eax
je 0x70ebc1
mov rcx, qword [rbp + 0x68]
call fcn.0040ed20
lea rcx, [rbp + 0x68]
mov rdx, rax
call fcn.0040edc0
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x98]
call fcn.0040e040
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x68]
call fcn.0040e040
mov rax, qword [rbp + 0x60]
cmp rax, qword [rbp + 0x58]
jne 0x70eb64
mov al, 1
jmp 0x70eb89
cmp qword [rbp + 0x60], 0
je 0x70eb72
cmp qword [rbp + 0x58], 0
jne 0x70eb77
xor rax, rax
jmp 0x70eb89
mov rcx, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x58]
call fcn.0042f480
test eax, eax
sete al
nop
test al, al
je 0x70ebc1
lea rcx, [rbp + 0x40]
mov edx, ebx
call fcn.0040ed70
mov rcx, qword [rbp + 0x38]
mov edx, 3
mov r8, qword [rbp + 0x40]
lea r9, [0x0070ec8c]
mov rax, qword [rbp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
call fcn.0040f2a0
jmp 0x70ebda
add bx, 1
cmp bx, 0x7b
jne 0x70eacb
nop
mov rcx, qword [rbp + 0x38]
call fcn.0040d970
nop
lea rcx, [rbp + 0x40]
mov edx, 2
call fcn.0040da50
lea rcx, [rbp + 0x58]
mov edx, 3
call fcn.0040da50
lea rcx, [rbp + 0x98]
call fcn.0040d970
mov rax, qword [rbp + 0x38]
lea rsp, [rbp + 0x70]
pop rbx
pop rsi
pop rbp
ret
Function at 0x7189d0
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x24], 0xca
jne 0x718a1f
mov rcx, qword [rsp + 0x40]
call fcn.007197e0
mov r11, qword [rsp + 0x40]
cmp dword [r11 + 0x58], 0
je 0x718a13
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x24], 0xcf
mov eax, 1
jmp 0x718b69
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x24], 0xcb
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x24], 0xcb
jne 0x718b20
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x240]
cmp dword [rax + 0x20], 0
je 0x718b08
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x10], 0
je 0x718a63
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov rcx, qword [rsp + 0x40]
call qword [rax]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x240]
mov rcx, qword [rsp + 0x40]
call qword [rax]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x718a88
xor eax, eax
jmp 0x718b69
cmp dword [rsp + 0x20], 2
jne 0x718a91
jmp 0x718b08
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x10], 0
je 0x718b03
cmp dword [rsp + 0x20], 3
je 0x718aab
cmp dword [rsp + 0x20], 1
jne 0x718b03
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov ecx, dword [rax + 8]
add ecx, 1
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov dword [rax + 8], ecx
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x10]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov eax, dword [rax + 0xc]
cmp dword [rcx + 8], eax
jl 0x718b03
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov ecx, dword [rax + 0xc]
mov rax, qword [rsp + 0x40]
add ecx, dword [rax + 0x1a4]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov dword [rax + 0xc], ecx
jmp 0x718a47
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xac]
mov dword [rcx + 0xb4], eax
jmp 0x718b5f
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x24], 0xcc
je 0x718b5f
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov dword [rax + 0x28], 0x14
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x24]
mov dword [rcx + 0x2c], eax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
call qword [rax]
mov rcx, qword [rsp + 0x40]
call fcn.00718b80
add rsp, 0x38
ret
Function at 0x718b80
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x24], 0xcc
je 0x718bc6
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x220]
mov rcx, qword [rsp + 0x40]
call qword [rax]
mov r11, qword [rsp + 0x40]
mov dword [r11 + 0xa8], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x24], 0xcc
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x220]
cmp dword [rax + 0x10], 0
je 0x718ccd
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x8c]
cmp dword [rcx + 0xa8], eax
jae 0x718c91
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x10], 0
je 0x718c42
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x10]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xa8]
mov dword [rcx + 8], eax
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x10]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x8c]
mov dword [rcx + 0xc], eax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov rcx, qword [rsp + 0x40]
call qword [rax]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xa8]
mov dword [rsp + 0x20], eax
mov r8, qword [rsp + 0x40]
add r8, 0xa8
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x228]
xor r9d, r9d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [rax + 8]
mov r11, qword [rsp + 0x40]
mov eax, dword [rsp + 0x20]
cmp dword [r11 + 0xa8], eax
jne 0x718c8c
xor eax, eax
jmp 0x718cfb
jmp 0x718bdc
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x220]
mov rcx, qword [rsp + 0x40]
call qword [rax + 8]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x220]
mov rcx, qword [rsp + 0x40]
call qword [rax]
mov r11, qword [rsp + 0x40]
mov dword [r11 + 0xa8], 0
jmp 0x718bc6
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x5c], 0
je 0x718ce2
mov dword [rsp + 0x24], 0xce
jmp 0x718cea
mov dword [rsp + 0x24], 0xcd
mov rcx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x24]
mov dword [rcx + 0x24], eax
mov eax, 1
add rsp, 0x38
ret
Function at 0x748ab0
Capabilities:
Get file version info

Disassembly:
push rbp
add rsp, 0xffffffffffffff80
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x58], rbp
mov qword [rbp + 0x90], rcx
mov qword [rbp + 0x98], rdx
nop
mov rcx, qword [rbp + 0x98]
call fcn.0040ed20
mov rcx, rax
lea rdx, [rbp + 0x74]
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [rbp + 0x70], eax
cmp dword [rbp + 0x70], 0
je 0x748c0c
mov ecx, dword [rbp + 0x70]
call fcn.00408400
mov qword [rbp + 0x78], rax
nop
mov rcx, qword [rbp + 0x98]
call fcn.0040ed20
mov rcx, rax
xor rdx, rdx
mov r8d, dword [rbp + 0x70]
mov r9, qword [rbp + 0x78]
call sub.version.dll_GetFileVersionInfoW
test eax, eax
jne 0x748b41
xor rcx, rcx
mov rdx, qword [rbp + 0x58]
call fcn.00748c30
jmp 0x748c0c
mov rcx, qword [rbp + 0x78]
lea rdx, [0x00748c9c]
lea r8, [rbp + 0x68]
lea r9, [rbp + 0x70]
call sub.version.dll_VerQueryValueW
test eax, eax
jne 0x748b6e
xor rcx, rcx
mov rdx, qword [rbp + 0x58]
call fcn.00748c30
jmp 0x748c0c
mov rax, qword [rbp + 0x68]
movzx eax, word [rax]
mov dword [rbp + 0x38], eax
mov byte [rbp + 0x40], 0
mov rax, qword [rbp + 0x68]
movzx eax, word [rax + 2]
mov dword [rbp + 0x48], eax
mov byte [rbp + 0x50], 0
lea rcx, [rbp + 0x60]
lea rdx, [0x00748cdc]
lea r8, [rbp + 0x38]
mov r9d, 1
call fcn.00431e00
lea rcx, [rbp + 0x30]
mov edx, 3
lea r8, [0x00748cfc]
mov r9, qword [rbp + 0x60]
lea rax, [0x00748d2c]
mov qword [rsp + 0x20], rax
call fcn.0040f2a0
mov rcx, qword [rbp + 0x30]
call fcn.0040ed20
mov rcx, qword [rbp + 0x78]
mov rdx, rax
lea r8, [rbp + 0x68]
lea r9, [rbp + 0x70]
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x748c01
mov rax, qword [rbp + 0x90]
lea rcx, [rax + 8]
mov rdx, qword [rbp + 0x68]
call fcn.0040edc0
nop
mov rcx, qword [rbp + 0x78]
call fcn.00408430
nop
lea rcx, [rbp + 0x30]
call fcn.0040d970
lea rcx, [rbp + 0x60]
call fcn.0040d970
mov rax, qword [rbp + 0x90]
lea rsp, [rbp + 0x80]
pop rbp
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14001d440]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x14001d450]
mov dword [rax], 1
mov rax, qword [0x14001d460]
mov dword [rax], 1
mov rax, qword [0x14001d3f0]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x14001d430]
mov dword [0x14002000c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x14001d500]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x14001d4e0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x14001d3a0]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x1400014a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
movsxd rax, dword [rcx + 0x3c]
mov r13d, dword [rcx + rax + 0x88]
add r13, rcx
mov rsi, rcx
mov rbp, rdx
mov edi, dword [r13 + 0x18]
mov eax, dword [r13 + 0x20]
test edi, edi
je 0x140001520
xor ebx, ebx
lea r12, [rcx + rax]
jmp 0x1400014e1
add rbx, 1
cmp rbx, rdi
je 0x140001520
mov edx, dword [r12 + rbx*4]
mov rcx, rbp
add rdx, rsi
call sym.strcmp
test eax, eax
jne 0x1400014d8
mov eax, dword [r13 + 0x24]
lea rdx, [rsi + rbx*2]
movzx edx, word [rdx + rax]
mov eax, dword [r13 + 0x1c]
lea rdx, [rsi + rdx*4]
mov eax, dword [rdx + rax]
add rax, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x140001970
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400200c4]
mov rbx, rcx
test esi, esi
jle 0x140001aa0
mov rax, qword [0x1400200c8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x1400019bb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140001a45
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x1400019a0
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
mov rdi, rax
test rax, rax
je 0x140001ac2
mov rax, qword [0x1400200c8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call dbg._GetPEImageBase
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400200c8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140001aa7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140001a3e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140001a50
add dword [0x1400200c4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1400200c8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001a3e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop dword [rax]
xor esi, esi
jmp 0x1400019c8
mov rax, qword [0x1400200c8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140002030
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140020120]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020100]
test rbx, rbx
je 0x14000208c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140002083
test rsi, rsi
je 0x140002083
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140002068
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x1400022a0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x1400022b8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x1400022c0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret
Function at 0x1400022d0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x14000231d
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x140002314
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x14000231f
add rax, 0x28
cmp rax, r9
jne 0x140002300
xor eax, eax
ret

Function at 0x140002320
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x1400023b0
mov rdx, qword [0x14001d3f0]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x14000239e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x14000239e
cmp word [rax + 0x18], 0x20b
jne 0x14000239e
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x1400023b0
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x140002389
add rbx, 0x28
cmp rbx, rdi
je 0x1400023b0
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x140002380
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x1400023c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14001d3f0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400023e0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400023e8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400023e0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000243d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002434
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400023e0
add rax, 0x28
cmp rax, r9
jne 0x140002420
xor eax, eax
ret

Function at 0x140002440
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14001d3f0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000245f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002468
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000245f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140002480
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x14001d3f0]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x1400024a0
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x1400024a8
ret
cmp word [rdx + 0x18], 0x20b
jne 0x1400024a0
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x1400024f0
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x1400024e7
test rcx, rcx
je 0x1400024a0
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x1400024d8
xor eax, eax
ret
Function at 0x140002500
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14001d3f0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000251f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002528
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140002540
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14001d3f0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002560
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002568
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002560
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x140002560
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x1400025b4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x1400025c0
add rdx, 0x28
cmp r9, rdx
jne 0x1400025a0
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x1400025d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x14001d3f0]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x1400025f2
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140002600
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400025f2
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x1400025f2
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x1400025f2
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x140002655
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x140002668
add rdx, 0x28
cmp rdx, r10
jne 0x140002640
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x140002677
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x140002687
mov edx, dword [rax + 0xc]
test edx, edx
je 0x14000265e
test ecx, ecx
jg 0x140002670
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x1400019d0
Capabilities:
Listen for remote procedure calls

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x30], 0xffffffff
xor r9d, r9d
mov r8, qword [rsp + 0x58]
mov edx, 0xa
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140001a96
lea rax, [0x1400017e0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9d, 8
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x1400030c0]
call qword [sym.imp.RPCRT4.dll_RpcServerRegisterIfEx]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140001a96
xor r9d, r9d
xor r8d, r8d
mov edx, 0xa
xor ecx, ecx
call qword [sym.imp.RPCRT4.dll_RpcServerRegisterAuthInfoW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140001a96
xor r8d, r8d
mov edx, 0x4d2
mov ecx, 1
call qword [sym.imp.RPCRT4.dll_RpcServerListen]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140001a96
jmp 0x140001a96
mov eax, dword [rsp + 0x30]
add rsp, 0x48
ret