joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004d5e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
xor r9d, r9d
lea rdi, [rbp + 0x18]
mov rbx, qword [rdi]
movabs r14, 0xd82201df9a1a1267
mov qword [rdi], r9
mov r11, r14
mov byte [rbp - 0x20], 0x2e
mov r10d, r9d
mov byte [rbp - 0x1f], 0x1a
lea esi, [r9 + 0xf]
mov byte [rbp - 0x1e], 0x3e
mov byte [rbp - 0x1d], 0x18
mov byte [rbp - 0x1c], 4
mov byte [rbp - 0x1b], 0x1f
mov byte [rbp - 0x1a], 0x2e
mov byte [rbp - 0x19], 9
mov byte [rbp - 0x18], 0xa
mov byte [rbp - 0x17], 0x18
mov byte [rbp - 0x16], 0x13
mov byte [rbp - 0x15], 6
mov byte [rbp - 0x14], 0x3c
mov byte [rbp - 0x13], 0x19
mov byte [rbp - 0x12], 8
mov byte [rbp - 0x11], 8
mov byte [rbp - 0x10], 0x15
mov byte [rbp - 0xf], 0x37
mov byte [rbp - 0xe], 0x15
mov byte [rbp - 0xd], 0xb
mov byte [rbp - 0xc], 4
mov byte [rbp - 0xb], 9
mov byte [rbp - 0xa], 0x77
movzx eax, byte [rbp - 0x20]
lea rax, [rbp - 0x20]
sub r11, rax
nop dword [rax]
mov rcx, r10
lea rdx, [rbp - 0x20]
add rdx, r10
and ecx, esi
cmp rcx, rsi
mov rax, r14
cmovae rcx, rsi
movsx r8, byte [rdx]
add dl, r11b
shl cl, 2
shr rax, cl
and al, sil
xor al, dl
xor al, r8b
mov byte [rbp + r10 - 0x20], al
inc r10
cmp r10, 0x17
jb 0x14004d680
mov byte [rbp + 0x20], 0x57
movabs r11, 0x9d7d1b26b8f18e27
mov byte [rbp + 0x21], 0x43
mov r10, r11
mov byte [rbp + 0x22], 0x49
mov byte [rbp + 0x23], 0x11
mov byte [rbp + 0x24], 0x18
mov byte [rbp + 0x25], 0x56
mov byte [rbp + 0x26], 0x25
movzx eax, byte [rbp + 0x20]
lea rax, [rbp + 0x20]
sub r10, rax
nop dword [rax]
mov rcx, r9
lea rdx, [rbp + 0x20]
add rdx, r9
and ecx, esi
cmp rcx, rsi
mov rax, r11
cmovae rcx, rsi
movzx r8d, byte [rdx]
add dl, r10b
shl cl, 2
shr rax, cl
and al, sil
xor al, dl
xor al, r8b
mov byte [rbp + r9 + 0x20], al
inc r9
cmp r9, 7
jb 0x14004d6f0
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
jne 0x14004d792
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtUserInjectMouseInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
jne 0x14004d792
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.InjectMouseInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
je 0x14004d7ef
movups xmm1, xmmword [rcx]
movdqu xmmword [0x14033a8e8], xmm1
movsd xmm0, qword [rcx + 0x10]
movsd qword [0x14033a8f8], xmm0
mov eax, dword [rcx + 0x18]
movdqa xmm0, xmmword [0x14006aac0]
mov dword [0x14033a900], eax
xorps xmm0, xmm1
movzx eax, word [rcx + 0x1c]
lea rcx, [0x14033a8e8]
mov word [0x14033a904], ax
mov eax, 0x10
movdqu xmmword [0x14033a8e8], xmm0
nop dword [rax]
xor byte [rax + rcx], 0xfa
inc rax
cmp rax, 0x1e
jb 0x14004d7e0
mov al, 1
mov rsi, qword [rsp + 0x70]
mov qword [rdi], rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
Function at 0x140059280
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x2b0
mov rax, qword [0x140074040]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x50], rdx
mov dword [rsp + 0x20], 1
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
xor r14d, r14d
mov qword [rcx], r14
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
mov dword [rsp + 0x20], 1
cmp qword [rdx + 0x10], r14
jne 0x1400592ea
mov rdx, qword [rdx + 0x18]
jmp 0x14005940b
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400593fd
nop word [rax + rax]
lea rdx, [rsp + 0x8c]
lea rcx, [rsp + 0x30]
call fcn.14005f1f0
mov r8, rax
mov rcx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140059342
mov rcx, qword [rbx]
mov rdx, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140059350
mov r8, qword [rax]
cmp rdx, qword [rbx + 0x10]
jne 0x140059379
test rdx, rdx
je 0x140059374
sub r8, rcx
nop
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x140059379
add rcx, 2
sub rdx, 1
jne 0x140059360
mov dil, 1
jmp 0x14005937c
xor dil, dil
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x1400593be
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400593b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005947d
call fcn.140061010
test dil, dil
je 0x1400593e7
mov rdx, qword [rsi + 8]
cmp rdx, qword [rsi + 0x10]
je 0x1400593da
mov eax, dword [rsp + 0x68]
mov dword [rdx], eax
add qword [rsi + 8], 4
jmp 0x1400593e7
lea r8, [rsp + 0x68]
mov rcx, rsi
call fcn.1400605a0
lea rdx, [rsp + 0x60]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140059320
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 7
jbe 0x140059442
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14005943d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140059484
mov rcx, r8
call fcn.140061010
mov word [rbx], r14w
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r14
mov rax, rsi
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.140060a00
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14005de60
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x14005de81
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14005deae
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14005deb0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14005df09
test ecx, ecx
jle 0x14005dee9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14005df09
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14005df09
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
call 0x1bbb5068c
invalid
Function at 0x14005df30
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14005df52
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x14005df61
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14005df84
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14005df86
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14005dfc2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14005e05e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14005dffd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14005e03e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14005e05e
cmp rbx, rax
ja 0x14005e010
test rbx, rbx
je 0x14005e05e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp byte [rbx + 0x60eb42a9], 0xef
imul ebx, dword [rax - 0x18f3ef64], 0x7b403581
ror byte [rdi], 0x8d
scasd eax, dword [rdi]
scasb al, byte [rdi]
xchg edi, eax
test byte [rbx + 0x6cc9cb7d], ah
push rbp
fiadd dword [rax]
add dh, al
Function at 0x14005e4c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140074040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14005e4ed
xor eax, eax
jmp 0x14005e659
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14005e527
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14005e527
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14005e659
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14005e64c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14005e56a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14005e595
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14005e651
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14005e604
sub eax, 1
je 0x14005e604
cmp eax, 2
jne 0x14005e64c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14005e651
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14005e632
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14005e64c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14005e651
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140060a00
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14005f660
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140074040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14005f733
cmp byte [rcx + 0x71], 0
je 0x14005f733
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14005f72f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14005f6f4
sub eax, 1
je 0x14005f6f8
cmp eax, 2
jne 0x14005f72f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140060a00
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14005f726
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14005f72f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14005f6dc
xor al, al
jmp 0x14005f6dc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140060a00
add rsp, 0x60
pop rbx
ret

Function at 0x14006168c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400616d6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400616d6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400616d6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400616d6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400616d6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400616d8
xor al, al
add rsp, 0x28
ret
Function at 0x1407ecc5e
Capabilities:
Encode data using xor

Disassembly:
mov r10d, 0x8e928e8d
lea r9, [0x1407e96e8]
lea rsp, [rsp + 8]
mov r10d, 0x12129425
movzx r10d, byte [rdi + r10 - 0x12129425]
push 0xffffffffa2ac9437
xor r10d, edx
and r10d, 0xff
push 0x1e3bf4aa
mov r10d, dword [r9 + r10*4]
shr edx, 8
shl qword [rsp + 6], 0x58
xor edx, r10d
inc rdi
neg qword [rsp + 4]
xor edx, 0xfd88788e
dec rsi
lea rsp, [rsp + 0x10]
jne 0x1407ecc70
jmp 0x1407e54cd

Function at 0x14080d83e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
neg si
not si
inc si
mov qword [rsp], 0x3688491a
not si
rol word [rsp + 3], 9
neg si
xor si, 0x3296
rol si, 1
xor bp, si
mov qword [rsp + 8], 0xffffffff92b63ebb
lea rsi, [rsp + rsi + 0x10]
and dword [rsp + 8], 0x568566b1
sal word [rsp + 0xc], 0x23
movzx ax, byte [rsi]
jne 0x14080d82a
sub rdi, 2
mov word [rdi], ax
not qword [rsp + 3]
call fcn.1407ec739
mov edx, 0xec17ec9d
movsx r8d, dl
movsx esi, r8b
mov rcx, qword [r10]
movzx eax, r8w
shl si, 0xcb
lea r10, [r10 + rax*2 - 0x1ff32]
or al, 0x8a
jl 0x14081a786
movzx ebp, dx
mov r8, rcx
movzx edi, sil
movsx ebx, dil
or rdi, r10
jmp 0x140802998
Function at 0x140001df8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001e42
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001e42
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001e42
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001e42
cmp dword [rcx + 0x84], 0xe
jbe 0x140001e42
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001e44
xor al, al
add rsp, 0x28
ret

Function at 0x140001d40
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call fcn.140002290
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call fcn.140002290
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
int3

Function at 0x1400023b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x14000c008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x14000241c
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000241c
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x14000241c
movzx edx, word [rax + 6]
test edx, edx
je 0x14000241c
sub rcx, qword [0x14000c008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x140002408
add rax, 0x28
dec edx
je 0x14000241c
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x140002400
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x140002400
jmp 0x14000241e
xor eax, eax
ret

Function at 0x140002420
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x14000c008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x140002455
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x140002455
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x140002455
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x1400024d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000c008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1400024fc
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400024fc
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x1400024fe
xor eax, eax
ret
Function at 0x100024c80
Capabilities:
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
mov rsi, rcx
xor ebp, ebp
cmp qword [rcx + 0x218], rbp
jne 0x100024cb8
mov rax, 0xffffffff80004003
jmp 0x100024df7
mov eax, 0x8d0
cmp r8w, ax
jne 0x100024df5
mov rax, qword [0x1000a1180]
mov qword [rsp + 0x20], rax
mov ebx, 0x21
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.100016600
mov r8d, ebx
mov rdx, rax
mov rcx, qword [rsi + 0x150]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rsp + 0x20]
call fcn.1000166e4
mov rbx, qword [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [rbx - 8], eax
movsxd rcx, eax
mov word [rbx + rcx*2], bp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rdi, [rbx - 0xc]
cmp dword [rdi], ebp
jl 0x100024d36
mov qword [rsp + 0x50], rbx
lock add dword [rdi], 1
jmp 0x100024d5b
mov rax, qword [0x1000a1180]
mov qword [rsp + 0x50], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rbx
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.100016504
nop
mov rbx, qword [rsi + 0x218]
lea rcx, [rbx + 0x448]
mov r10, qword [rcx]
mov rax, qword [rsp + 0x50]
mov rdx, rax
sub r10, rax
movzx r8d, word [rdx]
movzx r9d, word [rdx + r10]
sub r8d, r9d
jne 0x100024d8e
add rdx, 2
test r9d, r9d
jne 0x100024d77
cmp r8d, ebp
je 0x100024dae
lea rdx, [rsp + 0x50]
call fcn.10001c054
inc dword [rbx + 0x528]
inc dword [rbx + 0x534]
mov rax, qword [rsp + 0x50]
lea rcx, [rax - 0xc]
lea rsi, [0x1000a1170]
or ebx, 0xffffffff
cmp rcx, rsi
je 0x100024ddc
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
cmp eax, ebp
jg 0x100024ddc
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
nop
cmp rdi, rsi
je 0x100024df5
mov eax, ebx
lock xadd dword [rdi], eax
add eax, ebx
cmp eax, ebp
jg 0x100024df5
mov rcx, rdi
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x10002c100
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x1d0
mov rax, qword [0x1000a1108]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rbp, rcx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetParent]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x40c
mov r13, rax
call qword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
cmp eax, ebx
mov r12, rax
mov edi, ebx
jle 0x10002c230
lea rcx, [rsp + 0xa4]
xor edx, edx
mov r8d, VarUI4FromDisp
mov esi, 0x80
mov dword [rsp + 0xa0], VarUI4FromDisp
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, ebx
je 0x10002c1aa
cmp dword [rsp + 0xa4], 6
jb 0x10002c1aa
call fcn.10002d7e8
cmp al, bl
jne 0x10002c1af
mov esi, 0x6c
xor edx, edx
lea rcx, [rsp + 0x28]
mov dword [rsp + 0x20], esi
lea r8d, [rdx + 0x78]
mov dword [rsp + 0x24], 0x11
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x20]
movsxd r8, edi
mov edx, 0x41c
mov rcx, r13
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, ebx
je 0x10002c1f0
mov rax, qword [rbp + 8]
cmp qword [rsp + 0x48], rax
je 0x10002c1fc
inc edi
cmp edi, r12d
jge 0x10002c230
jmp 0x10002c160
bt dword [rsp + 0x28], 9
jae 0x10002c230
movsxd r8, edi
xor r9d, r9d
mov edx, 0x42b
mov rcx, r13
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rbp + 8]
xor r9d, r9d
lea r8d, [r9 + 0x28]
mov edx, pe_nt_image_headers64
call qword [sym.imp.USER32.dll_PostMessageW]
mov bl, 1
mov al, bl
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.10007a3b0
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret

Function at 0x10002e280
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x1000a1108]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x50]
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, VarUI4FromDisp
mov dword [rbx], 0x50
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], VarUI4FromDisp
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10002e2ed
cmp dword [rsp + 0x24], 5
jae 0x10002e2f3
cmp dword [rsp + 0x24], 4
jne 0x10002e2ed
cmp dword [rsp + 0x28], 0x5a
jae 0x10002e2f3
mov dword [rbx], 0x44
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.10007a3b0
add rsp, 0x150
pop rbx
ret