joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140033720
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x140077040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, qword [0x140077e28]
mov rbp, rcx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14003393e
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14003393e
mov qword [rsp + 0x80], rbx
mov ecx, 0x50
mov qword [rsp + 0x88], rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, qword [0x140077e28]
xor ebx, ebx
mov rdi, rax
test r8, r8
je 0x1400337f4
movsx rdx, word [r8 + 0x60e0]
lea rax, [r8 + 0x60e4]
mov r9d, dword [r8 + 0x3f68]
lea rax, [rax + rdx*8]
cmp dword [rax], r9d
je 0x1400337e9
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60e0], cx
movsx rax, cx
lea rax, [rax*8 + 0x60e4]
add rax, r8
mov dword [rax], r9d
mov dword [rax + 4], ebx
inc word [rax + 4]
inc dword [r8 + 0x60d8]
test rdi, rdi
je 0x140033811
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
jmp 0x140033814
mov rdi, rbx
or dword [rsi + 0xc], 6
lea rax, [0x140068af8]
mov qword [rsi + 0x80], rax
mov qword [rsi + 0x90], rdi
mov qword [rdi], rbp
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x28], 9
test r8, r8
je 0x140033857
mov rsi, qword [r8 + 0x90]
jmp 0x14003385a
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rsi + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x140033885
mov dword [rsi + 0x2c], ebx
mov rax, qword [0x140077e28]
mov rcx, qword [rax + 0x4b28]
mov rax, qword [rcx]
mov qword [rax + 0x28], rbp
lea rax, str.xinput1_4.dll
mov qword [rsp + 0x30], rax
lea rax, str.xinput1_3.dll
mov qword [rsp + 0x38], rax
lea rax, str.xinput9_1_0.dll
mov qword [rsp + 0x40], rax
lea rax, str.xinput1_2.dll
mov qword [rsp + 0x48], rax
lea rax, str.xinput1_1.dll
mov qword [rsp + 0x50], rax
mov byte [rdi + 0x31], 1
nop word [rax + rax]
mov rcx, qword [rsp + rbx*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x1400338fe
inc rbx
cmp rbx, 5
jl 0x1400338e0
jmp 0x14003392a
lea rdx, str.XInputGetCapabilities
mov qword [rdi + 0x38], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.XInputGetState
mov rcx, rsi
mov qword [rdi + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x48], rax
mov rdi, qword [rsp + 0x88]
mov al, 1
mov rbx, qword [rsp + 0x80]
jmp 0x140033940
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14005f4a0
mov rbp, qword [rsp + 0x90]
add rsp, 0x70
pop rsi
ret
Function at 0x14004c210
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x168
mov rax, qword [0x140077040]
xor rax, rsp
mov qword [rsp + 0x140], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
jne 0x14004c24c
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14005f4a0
add rsp, 0x168
ret
mov qword [rsp + 0x170], rbx
lea rdx, [rsp + 0x40]
mov r8d, pe_nt_image_headers64
mov qword [rsp + 0x180], rsi
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextA]
xorps xmm0, xmm0
lea rax, [rsp + 0x40]
movups xmmword [rsp + 0x20], xmm0
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x14004c284
movabs rsi, 0x7fffffffffffffff
cmp rbx, rsi
ja 0x14004c4a2
mov qword [rsp + 0x160], rdi
cmp rbx, 0xf
ja 0x14004c2e7
mov r8, rbx
mov qword [rsp + 0x30], rbx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x38], 0xf
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x20], 0
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x20]
jmp 0x14004c37f
mov rax, rbx
or rax, 0xf
cmp rax, rsi
jbe 0x14004c320
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14005f4c0
test rax, rax
je 0x14004c45b
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14004c35c
mov ecx, 0x16
mov rsi, rax
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
test rcx, rcx
jne 0x14004c33c
xor edi, edi
jmp 0x14004c35c
cmp rcx, 0x1000
jb 0x14004c354
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004c4a8
jmp 0x14004c301
call fcn.14005f4c0
mov rdi, rax
mov r8, rbx
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x30], rbx
mov rcx, rdi
mov qword [rsp + 0x38], rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rbx], 0
mov qword [rsp + 0x178], rbp
cmp rsi, 0xf
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x158], r14
cmova rbp, rdi
mov qword [rsp + 0x150], r15
cmp rbx, 0x10
jb 0x14004c40a
lea r8, [rbp - 0xf]
mov edx, 0x43
add r8, rbx
mov rcx, rbp
sub r8, rbp
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x14004c40a
movabs r14, 0x2d7265746e756f43
movabs r15, 0x3220656b69727453
nop word [rax + rax]
cmp qword [rax], r14
jne 0x14004c3eb
cmp qword [rax + 8], r15
je 0x14004c462
inc rax
lea r8, [rbp - 0xf]
add r8, rbx
mov edx, 0x43
sub r8, rax
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x14004c3e0
mov rax, 0xffffffffffffffff
mov r15, qword [rsp + 0x150]
cmp rax, 0xffffffffffffffff
mov r14, qword [rsp + 0x158]
mov rbp, qword [rsp + 0x178]
setne bl
cmp rsi, 0xf
jbe 0x14004c46f
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14004c467
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004c467
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rax, rbp
jmp 0x14004c411
mov rcx, rdi
call fcn.14005f744
mov rdi, qword [rsp + 0x160]
movzx eax, bl
mov rbx, qword [rsp + 0x170]
mov rsi, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14005f4a0
add rsp, 0x168
ret
call fcn.14004a3b0
int3
call fcn.1400011e0
int3
Function at 0x14004d900
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14004d928
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14004d94e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14004d950
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14004d9a9
test ecx, ecx
jle 0x14004d989
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14004d9a9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14004d9a9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x14004d9d0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14004d9f2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x14004da08
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14004da24
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14004da26
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14004da62
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14004dafe
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14004da9d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14004dade
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14004dafe
cmp rbx, rax
ja 0x14004dab0
test rbx, rbx
je 0x14004dafe
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x14004df60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140077040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14004df8d
xor eax, eax
jmp 0x14004e0f9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14004dfc7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14004dfc7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14004e0f9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14004e0ec
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14004e00a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14004e035
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14004e0f1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14004e0a4
sub eax, 1
je 0x14004e0a4
cmp eax, 2
jne 0x14004e0ec
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14004e0f1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14004e0d2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14004e0ec
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14004e0f1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14005f4a0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14004fb40
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140077040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14004fc13
cmp byte [rcx + 0x71], 0
je 0x14004fc13
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14004fc0f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14004fbd4
sub eax, 1
je 0x14004fbd8
cmp eax, 2
jne 0x14004fc0f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14005f4a0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14004fc06
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14004fc0f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14004fbbc
xor al, al
jmp 0x14004fbbc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14005f4a0
add rsp, 0x60
pop rbx
ret

Function at 0x1400600e4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006012e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006012e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006012e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006012e
cmp dword [rcx + 0x84], 0xe
jbe 0x14006012e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140060130
xor al, al
add rsp, 0x28
ret
Function at 0x1406520b0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1406520bd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1406520cd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1406520b5
lea eax, [rcx + 1]
jmp 0x1406520db
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1406520ee
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1406520d4
sub eax, 3
jb 0x14065210e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14065215d
sar eax, 1
movsxd rbp, eax
jb 0x140652144
jmp 0x14065211c
add ebx, ebx
jne 0x14065211a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140652144
inc ecx
add ebx, ebx
jne 0x14065212a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140652144
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14065213d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14065212c
add ecx, 2
jmp 0x140652149
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140652072
jmp 0x1406520bd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2a5800
mov dl, 0x2d
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1406521a9
cmp rsi, rcx
jae 0x1406521b1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140652190
cmp al, 0x8f
ja 0x140652190
cmp byte [rsi - 2], 0xf
je 0x140652196
sub al, 0xe8
cmp al, 1
ja 0x14065217a
cmp rsi, rcx
jae 0x1406521b1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140652180
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1406521b1
lodsb al, byte [rsi]
jmp 0x140652190
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x64e000]
mov eax, dword [rdi]
or eax, eax
je 0x14065221a
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x653b30]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1406521be
jns 0x1406521f3
movzx rdx, word [rdi]
add rdi, 2
jmp 0x1406521fd
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140652214
mov qword [rbx], rax
add rbx, 8
jmp 0x1406521de
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14065225e
cmp al, 0xef
ja 0x140652246
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140652226
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x140652235
mov eax, dword [rdi]
add rdi, 4
jmp 0x140652235
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x257]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1406522b2
sub rsp, 0xffffffffffffff80
jmp 0x140280878
Function at 0x402ce0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x18001117c
Capabilities:
Create process on windows

Disassembly:
jmp 0x1800116c0
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x518
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0xd2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x538]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x4b8], rax
lea rcx, [0x180022001]
call fcn.1800112f8
nop
mov eax, dword [rbp + 0x4e8]
mov dword [rbp + 0x4b4], eax
cmp dword [rbp + 0x4b4], 1
je 0x18001172d
jmp 0x180011841
mov r8d, 0x68
xor edx, edx
lea rcx, [rbp + 0x10]
call fcn.180011267
nop
mov dword [rbp + 0x10], 0x68
mov r8d, 0x18
xor edx, edx
lea rcx, [rbp + 0x98]
call fcn.180011267
nop
lea rax, str.cmd.exe
mov qword [rbp + 0xc8], rax
mov qword [rbp + 0xe8], 0
lea rax, [rbp + 0x98]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x180011812
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x104], eax
mov r8d, dword [rbp + 0x104]
lea rdx, str.Failed_to_create_process__Error_code:__d
lea rcx, [rbp + 0x130]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
mov r9d, 0x10
lea r8, str.Error
lea rdx, [rbp + 0x130]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
xor eax, eax
jmp 0x180011846
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x18001a950]
call fcn.1800112a3
mov rax, rdi
mov rcx, qword [rbp + 0x4b8]
xor rcx, rbp
call fcn.18001116d
lea rsp, [rbp + 0x4c8]
pop rdi
pop rbp
ret

Function at 0x1800111ae
Capabilities:
Terminate process

Disassembly:
jmp 0x180012e60
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00410a00]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x00410a10]
mov dword [rax], 1
mov rax, qword [0x00410a20]
mov dword [rax], 1
mov rax, qword [0x004109f0]
mov dword [rax], 1
mov rax, qword [0x004108e0]
cmp word [rax], 0x5a4d
je 0x4010b0
mov rax, qword [0x004109e0]
mov dword [0x00413008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010a0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x004109a0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x00410860]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401103
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058
Function at 0x401bb7
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
call sym.createFiles2__
mov ecx, 0x2710
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
lea r8, str.C:_boot_loader_windows.bat
lea rdx, str.open
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov ecx, 0x1388
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov ecx, 0
call sym.exit
nop

Function at 0x4021bd
Capabilities:
Check internet connectivity via wininet

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 8], 0
lea rax, [rbp - 8]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetGetConnectedState]
call rax
test eax, eax
setne al
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
add rsp, 0x30
pop rbp
ret