joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f0f0
Capabilities:
Get disk information

Disassembly:
mov byte [rsp + 8], cl
sub rsp, 0x48
mov rax, qword [0x0042d620]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x28], al
mov byte [rsp + 0x29], 0x3a
mov byte [rsp + 0x2a], 0x5c
mov byte [rsp + 0x2b], 0
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
je 0x40f139
mov dword [rsp + 0x30], 1
jmp 0x40f141
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.00416330
add rsp, 0x48
ret

Function at 0x40f320
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x158
mov rax, qword [0x0042d620]
xor rax, rsp
mov qword [rsp + 0x148], rax
mov rdx, qword [rsp + 0x160]
lea rcx, [rsp + 0x30]
call fcn.004164f0
movsx eax, byte [rsp + 0x30]
test eax, eax
je 0x40f381
lea rcx, [rsp + 0x30]
call fcn.0040f000
sub rax, 1
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movsx eax, byte [rax]
cmp eax, 0x5c
jne 0x40f381
mov rax, qword [rsp + 0x20]
mov byte [rax], 0
movsx eax, byte [rsp + 0x31]
cmp eax, 0x3a
jne 0x40f3d6
movsx eax, byte [rsp + 0x32]
test eax, eax
jne 0x40f3d6
lea rdx, [0x00426c68]
lea rcx, [rsp + 0x30]
call fcn.00416450
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 1
je 0x40f3c2
mov dword [rsp + 0x140], 1
jmp 0x40f3cd
mov dword [rsp + 0x140], 0
mov eax, dword [rsp + 0x140]
jmp 0x40f449
mov rcx, qword [rsp + 0x160]
call fcn.0040f160
cmp eax, 2
jne 0x40f3ef
mov eax, 1
jmp 0x40f449
mov rdx, qword [rsp + 0x160]
lea rcx, [rsp + 0x30]
call fcn.004164f0
lea rcx, [rsp + 0x30]
call fcn.0040f030
lea rdx, [0x00426c64]
lea rcx, [rsp + 0x30]
call fcn.00416450
lea rcx, [rsp + 0x30]
call fcn.0040f160
test eax, eax
je 0x40f437
mov dword [rsp + 0x144], 1
jmp 0x40f442
mov dword [rsp + 0x144], 0
mov eax, dword [rsp + 0x144]
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
call fcn.00416330
add rsp, 0x158
ret
Function at 0x40fdb0
Capabilities:
Read file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40fdfd
call fcn.00417870
mov dword [rax], 0
mov eax, dword [rsp + 0x30]
jmp 0x40fe1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0040ef00
mov dword [rsp + 0x34], eax
call fcn.00417870
mov ecx, dword [rsp + 0x34]
mov dword [rax], ecx
mov eax, 0xffffffff
add rsp, 0x48
ret
Function at 0x4127a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x58
mov eax, dword [0x00431264]
mov dword [rsp + 0x44], eax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41284f
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x40], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.EnableLUA
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x412844
cmp dword [rsp + 0x40], 0
je 0x412834
mov dword [rsp + 0x4c], 1
jmp 0x41283c
mov dword [rsp + 0x4c], 0
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x44], eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x44]
add rsp, 0x58
ret
Function at 0x412d50
Capabilities:
Read pipe
Write pipe

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x468
mov rax, qword [0x0042d620]
xor rax, rsp
mov qword [rsp + 0x458], rax
mov dword [rsp + 0x450], 0xffffffff
cmp qword [rsp + 0x470], 0xffffffffffffffff
jne 0x412d9a
mov eax, dword [rsp + 0x450]
jmp 0x412e3f
mov rcx, qword [rsp + 0x478]
call fcn.00417030
lea eax, [rax + rax + 2]
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x800
mov r9, qword [rsp + 0x480]
mov r8d, eax
mov rdx, qword [rsp + 0x478]
mov rcx, qword [rsp + 0x470]
call qword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
je 0x412e38
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x3ff
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rsp + 0x480]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, [rsp + 0x50]
call fcn.00416350
mov dword [rsp + 0x450], eax
mov eax, dword [rsp + 0x450]
mov rcx, qword [rsp + 0x458]
xor rcx, rsp
call fcn.00416330
add rsp, 0x468
ret

Function at 0x413aa0
Capabilities:
Get user security identifier

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x48], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
xor r8d, r8d
mov rdx, qword [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x413b84
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x413b84
mov eax, dword [rsp + 0x44]
mov rdx, rax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x48]
shl eax, 1
mov eax, eax
mov rdx, rax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x50], 0
je 0x413b84
cmp qword [rsp + 0x58], 0
je 0x413b84
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x413b84
mov rax, qword [rsp + 0x50]
jmp 0x413b86
xor eax, eax
add rsp, 0x68
ret
Function at 0x413c90
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
cmp dword [0x0042eb60], 0
jne 0x413ce3
mov dword [0x0042eb60], 1
lea rcx, str.secur32.dll
call fcn.00415800
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x413ce3
lea rdx, str.GetUserNameExW
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x0042eb58], rax
cmp qword [0x0042eb58], 0
je 0x413d08
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov ecx, 2
call qword [0x0042eb58]
mov dword [rsp + 0x20], eax
jmp 0x413d10
mov dword [rsp + 0x20], 0
cmp dword [rsp + 0x20], 0
jne 0x413d2b
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x413f60
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x2d8
mov rax, qword [0x0042d620]
xor rax, rsp
mov qword [rsp + 0x2c8], rax
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0xa0], 0
movzx eax, word [0x0042f9a0]
test eax, eax
je 0x4140f6
mov r8d, 0x103
lea rdx, [0x0042f9a0]
lea rcx, str.administrator
call fcn.00415400
mov edx, 1
lea rcx, [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x4140d0
mov dword [rsp + 0x2c0], 0x207
lea rdx, [rsp + 0x2c0]
lea rcx, [rsp + 0xb0]
call fcn.00413c90
test eax, eax
je 0x414050
lea rax, str.administrator
add rax, 0x208
mov r8d, 0x103
lea rdx, [rsp + 0xb0]
mov rcx, rax
call fcn.00415400
lea rcx, [rsp + 0xb0]
call fcn.00413aa0
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x414050
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
lea r9, [rsp + 0x70]
lea r8, [0x0042d610]
lea rdx, str.administrator
mov ecx, 2
call fcn.00413dd0
test eax, eax
je 0x414089
xor r9d, r9d
mov r8, qword [rsp + 0x70]
mov edx, 1
lea rcx, [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov r8w, 0x1000
mov dx, 0x1000
lea rcx, [rsp + 0x78]
call fcn.00413d40
lea rcx, [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_IsValidSecurityDescriptor]
test eax, eax
jne 0x4140d0
xor r9d, r9d
lea r8, str.tcmadmin
lea rdx, str.Failed_to_create_security_descriptor_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, 0xffffffffffffffff
jmp 0x41419a
mov dword [rsp + 0x58], 0x18
mov dword [rsp + 0x68], 0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
jmp 0x4140ff
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x800
mov dword [rsp + 0x20], 0x800
mov r9d, 1
mov r8d, 6
mov edx, 3
mov rcx, qword [rsp + 0x2e0]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x41416f
xor r9d, r9d
lea r8, str.tcmadmin
lea rdx, str.Failed_to_create_pipe_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, 0xffffffffffffffff
jmp 0x41419a
cmp qword [rsp + 0x70], 0
je 0x414182
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rsp + 0x50], 0
je 0x414195
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x2c8]
xor rcx, rsp
call fcn.00416330
add rsp, 0x2d8
ret
Function at 0x415800
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x378
mov rax, qword [0x0042d620]
xor rax, rsp
mov qword [rsp + 0x360], rax
mov qword [rsp + 0x140], 0
lea rdx, str.comctl32.dll
mov rcx, qword [rsp + 0x380]
call fcn.00416c00
test eax, eax
jne 0x41585a
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x380]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x415a08
cmp dword [0x00430e1c], 0
je 0x415947
mov word [rsp + 0x150], 0
mov edx, 0x104
lea rcx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r8d, 0x104
lea rdx, [0x00426c68]
lea rcx, [rsp + 0x150]
call fcn.00415640
mov r8d, 0x104
mov rdx, qword [rsp + 0x380]
lea rcx, [rsp + 0x150]
call fcn.00415640
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rsp + 0x140], rax
cmp qword [rsp + 0x140], 0
jne 0x415942
mov edx, 0x104
lea rcx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov r8d, 0x104
lea rdx, [0x00426c68]
lea rcx, [rsp + 0x150]
call fcn.00415640
mov r8d, 0x104
mov rdx, qword [rsp + 0x380]
lea rcx, [rsp + 0x150]
call fcn.00415640
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rsp + 0x140], rax
jmp 0x415a00
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r8d, 0x104
lea rdx, [0x00426c68]
lea rcx, [rsp + 0x30]
call fcn.00415470
mov r8d, 0x104
mov rdx, qword [rsp + 0x380]
lea rcx, [rsp + 0x30]
call fcn.00415470
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rsp + 0x140], rax
cmp qword [rsp + 0x140], 0
jne 0x415a00
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov r8d, 0x104
lea rdx, [0x00426c68]
lea rcx, [rsp + 0x30]
call fcn.00415470
mov r8d, 0x104
mov rdx, qword [rsp + 0x380]
lea rcx, [rsp + 0x30]
call fcn.00415470
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rsp + 0x140], rax
mov rax, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.00416330
add rsp, 0x378
ret
Function at 0x419917
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x0042d620]
jne 0x41634a
rol rcx, 0x10
test cx, 0xffff
jne 0x416346
repz ret
ror rcx, 0x10
jmp 0x419870
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x0042ec80]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x0042ed78]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x4198f5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x0042ec80]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x419917
mov rax, qword [rsp + 0x88]
mov qword [0x0042ed78], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x0042ed18], rax
mov rax, qword [0x0042ed78]
mov qword [0x0042ebf0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x0042ed00], rax
mov dword [0x0042ebe0], 0xc0000409
mov dword [0x0042ebe4], 1
mov rax, qword [0x0042d620]
mov qword [rsp + 0x68], rax
mov rax, qword [0x0042d628]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x0042ec78], eax
mov ecx, 1
call fcn.0041f020
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x00428630]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x0042ec78], 0
jne 0x41999e
mov ecx, 1
call fcn.0041f020
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x420bf0
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.00419140
xor ebx, ebx
cmp qword [0x0042f8a0], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x420d21
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x420c53
xor eax, eax
jmp 0x420e01
lea rdx, [0x00429650]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x420c4c
mov rcx, rax
call fcn.004190d0
lea rdx, str.GetActiveWindow
mov rcx, rbp
mov qword [0x0042f8a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.004190d0
lea rdx, str.GetLastActivePopup
mov rcx, rbp
mov qword [0x0042f8a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.004190d0
lea rcx, [rsp + 0x30]
mov qword [0x0042f8b0], rax
call fcn.0041b790
test eax, eax
je 0x420cd7
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.004196b0
cmp dword [rsp + 0x30], 2
jne 0x420d21
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.004190d0
test rax, rax
mov qword [0x0042f8c0], rax
je 0x420d21
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.004190d0
mov qword [0x0042f8b8], rax
mov rcx, qword [0x0042f8b8]
cmp rcx, rsi
je 0x420db3
cmp qword [0x0042f8c0], rsi
je 0x420db3
call fcn.004191a0
call rax
test rax, rax
mov rbp, rax
je 0x420d7e
mov rcx, qword [0x0042f8c0]
call fcn.004191a0
lea rcx, [rsp + 0x38]
mov r9d, InitCommonControls
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x420d7e
test byte [rsp + 0x48], 1
jne 0x420db3
lea rcx, [rsp + 0x34]
call fcn.0041b7e0
test eax, eax
je 0x420da0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.004196b0
cmp dword [rsp + 0x34], 4
jb 0x420dad
bts edi, 0x15
jmp 0x420de7
bts edi, 0x12
jmp 0x420de7
mov rcx, qword [0x0042f8a8]
cmp rcx, rsi
je 0x420de7
call fcn.004191a0
call rax
test rax, rax
mov rbx, rax
je 0x420de7
mov rcx, qword [0x0042f8b0]
cmp rcx, rsi
je 0x420de7
call fcn.004191a0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x0042f8a0]
call fcn.004191a0
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x1400021dc
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140004650], rbx
je 0x140002228
cmp rax, rbx
jne 0x14000221b
mov ebx, 1
mov esi, ebx
jmp 0x14000222d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002200
mov ebx, 1
mov eax, dword [0x140004658]
cmp eax, ebx
jne 0x140002243
mov ecx, 0x1f
call fcn.140165000
jmp 0x1400022a8
mov eax, dword [0x140004658]
test eax, eax
jne 0x1400022a2
mov dword [0x140004658], ebx
lea r15, [0x1400033b0]
lea rdi, [0x140003398]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140002294
test eax, eax
jne 0x140002298
cmp qword [rdi], 0
je 0x140002289
mov rax, qword [rdi]
mov rcx, qword [0x140003378]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000226a
test eax, eax
je 0x1400022a8
mov eax, 0xff
jmp 0x140002384
mov dword [0x140004064], ebx
mov eax, dword [0x140004658]
cmp eax, ebx
jne 0x1400022cf
lea rdx, [0x140003390]
lea rcx, [0x140003380]
call sub.msvcrt.dll__initterm
mov dword [0x140004658], 2
test esi, esi
jne 0x1400022dc
xor eax, eax
xchg qword [0x140004650], rax
cmp qword [0x140004660], 0
je 0x140002310
lea rcx, [0x140004660]
call fcn.140002540
test eax, eax
je 0x140002310
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140004660]
mov r9, qword [0x140003378]
call r9
mov r8, qword [0x140004078]
mov rdx, qword [0x140004070]
mov ecx, dword [0x140004068]
call fcn.140001800
mov dword [0x140004060], eax
cmp dword [0x140004080], 0
jne 0x140002340
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140004064], 0
jne 0x140002355
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140004060]
jmp 0x140002384
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.1400025c0
add rsp, 0x28
jmp 0x1400021dc

Function at 0x140002450
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000249c
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140002494
cmp dword [rcx + 0x3c], edx
jl 0x140002494
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140002494
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14000249c
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140017550
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14001755d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14001756d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140017555
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140017585
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140017572
sub eax, 3
jb 0x14001759f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400175d6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x1400175c6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1400175c4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1400175b3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.140017512
jmp 0x14001755d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x8600
mov dl, 5
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140017622
cmp rsi, rcx
jae 0x14001762a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140017609
cmp al, 0x8f
ja 0x140017609
cmp byte [rsi - 2], 0xf
je 0x14001760f
sub al, 0xe8
cmp al, 1
ja 0x1400175f3
cmp rsi, rcx
jae 0x14001762a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400175f9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14001762a
lodsb al, byte [rsi]
jmp 0x140017609
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x15000]
mov eax, dword [rdi]
or eax, eax
je 0x140017687
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x18164]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140017637
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140017681
mov qword [rbx], rax
add rbx, 8
jmp 0x140017657
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1400176c1
cmp al, 0xef
ja 0x1400176b3
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140017693
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x1400176a2
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140017740], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140017740
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140017730
sub rsp, 0xffffffffffffff80
jmp 0x1400014e0
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00503920]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x00503930]
mov dword [rax], 1
mov rax, qword [0x00503940]
mov dword [rax], 1
mov rax, qword [0x00503910]
mov dword [rax], 1
mov rax, qword [0x00503800]
cmp word [rax], 0x5a4d
je 0x4010b0
mov rax, qword [0x00503900]
mov dword [0x00509008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010a0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x005038c0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x005037b0]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401103
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058