joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451840
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov esi, ecx
cmp byte [0x0045c0b4], 0
je 0x4518a2
mov ecx, dword [0x0047ea00]
call sub.KERNEL32_TlsGetValue
test rax, rax
jne 0x4518ae
call fcn.00451690
mov edi, eax
test edi, edi
je 0x451895
call sub.KERNEL32_GetProcessHeap
movsxd r8, edi
mov edx, 8
mov rcx, rax
call sub.KERNEL32_HeapAlloc
mov ecx, dword [0x0047ea00]
mov rdx, rax
call sub.KERNEL32_TlsSetValue
mov ecx, dword [0x0047ea00]
call sub.KERNEL32_TlsGetValue
jmp 0x4518ae
mov rax, qword gs:[0x58]
mov rax, qword [rax]
movsxd rcx, esi
add rcx, rax
mov rax, rcx
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001b710
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14001b732
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x14001b741
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x20], rdi
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14001b764
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14001b766
xor ecx, ecx
mov qword [rsp + 0x28], rbx
movsxd rax, ecx
test ecx, ecx
je 0x14001b7a0
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
sub rdi, rbx
add r14, rbx
mov r8, rdi
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14001b847
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x14001b7db
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rbx, r8
cmp r8, 0xfff
jbe 0x14001b821
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
add r14, rax
mov rbx, rdi
cmp rax, 0xfff
jne 0x14001b860
cmp rdi, rax
ja 0x14001b7f0
mov r8, rbx
test rbx, rbx
je 0x14001b847
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rbx
sub r8, rax
sub rbp, r8
mov rbx, qword [rsp + 0x28]
mov rax, rbp
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rbp, rdi
jmp 0x14001b84a
lodsd eax, dword [rsi]
nop
out dx, al
jg fcn.14005eb29
adc ecx, edx
cmp dword [rbp - 0x80], ebx
add byte [rdi + 0x3a], bh
invalid
loop 0x14005ebc4
out 0x58, al
invalid
fisub dword [rdx + 0x2352fdcd]
imul ecx, dword [rbp + 0x74], 0xa3fb0de5
loopne fcn.14005eb34
mov dword [rsi - 0x32028010], ebp
sahf
jl 0x14005eb13
jnp 0x14005ec00
invalid
invalid
wait
jnp 0x14005eb4f
push 0xfffffffffffffff9
fcmovne st(0), st(6)
and edi, dword [rcx + 0x5c]
enter 0xffffffffffffada1, 0xffffffffffffff80
mov cl, dh
nop
jb 0x14005ebdc
xor byte [rdi*2 - 0x1f56f504], al
jae 0x14005ec5a
test eax, 0xfd7a73e0
std
jae 0x14005eb85
xchg esp, edi
in eax, dx
stc
shl byte [rsi], cl
cvtdq2ps xmm5, xmm2
cmp edx, edi
call 0xc381dc45
std
invalid
push rdi
cld
loope 0x14005eb93
or al, 0x29
or dl, byte [rdi + 0x68]
scasd eax, dword [rdi]
add byte [rbp - 0x7311c51b], bl
xchg dword [rsi + 0x778ebf52], edx
stc
in eax, dx
movabs dword [0xdd8192fe82d52ecf], eax
add ah, byte [rdi - 0x5c1a63]
invalid
push rcx
adc eax, 0x1b4a41fb
call qword [rdi - 0x4aa57801]
push rdx
imul edx, dword [rdx - 0x44], 0xffffffb5
invalid
Function at 0x14006470c
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rbx, rdx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
xor esi, esi
mov qword [rbp - 0x10], rsi
mov dword [rbp + 0x30], esi
lea r8, [rbp + 0x30]
xor edx, edx
lea ecx, [rsi + 3]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
nop dword [rax + rax]
test eax, eax
je 0x140064754
lea edi, [rsi + 0xd]
jmp 0x14006480f
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
cmp eax, 0xea
jne 0x14006480f
mov word [rbp + 0x20], si
mov edx, dword [rbp + 0x30]
mov r8, qword [rbp - 0x18]
mov rcx, r8
mov rdi, qword [rbp - 0x20]
sub rcx, rdi
sar rcx, 1
cmp rdx, rcx
jae 0x140064794
lea rax, [rdi + rdx*2]
mov qword [rbp - 0x18], rax
jmp 0x1400647d5
jbe 0x1400647d5
mov rax, qword [rbp - 0x10]
sub rax, rdi
sar rax, 1
cmp rdx, rax
jbe 0x1400647b8
lea r8, [rbp + 0x20]
lea rcx, [rbp - 0x20]
call fcn.140040dd4
mov rdi, qword [rbp - 0x20]
jmp 0x1400647d5
sub rdx, rcx
je 0x1400647d1
movzx eax, si
mov rdi, r8
mov rcx, rdx
rep stosw word [rdi], ax
lea r8, [r8 + rdx*2]
mov rdi, qword [rbp - 0x20]
mov qword [rbp - 0x18], r8
lea r8, [rbp + 0x30]
mov rdx, rdi
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
nop dword [rax + rax]
test eax, eax
jne 0x140064801
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
jmp 0x14006480f
mov rdx, qword [rbp - 0x20]
mov rcx, rbx
call fcn.140003904
mov edi, esi
lea rcx, [rbp - 0x20]
call fcn.14001e804
mov eax, edi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x140065270
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400b1340], eax
call fcn.140065710
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400b1340], 0
jne case.default.0x1400652c6
mov ecx, 1
call fcn.140065710
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
scasb al, byte [rdi]
call qword [rsi]
sti
xchg edi, eax
invalid
Function at 0x140007ad0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140007b1a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140007b1a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140007b1a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140007b1a
cmp dword [rcx + 0x84], 0xe
jbe 0x140007b1a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140007b1c
xor al, al
add rsp, 0x28
ret
Function at 0x140c5611c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rdi
ret
push rbp
push r9
mov bpl, r9b
xchg bpl, bpl
push r10
movsx ebp, sp
mov r9b, 0x50
push rax
lahf
cdqe
push rcx
movsx r9d, cx
xchg ecx, r9d
push rdx
movzx eax, ax
push rbx
mov dl, r8b
push r8
push rsi
push rdi
push r11
setne bl
movsx rdx, r10w
push r15
setns dil
cbw
push r12
push r14
movzx ebx, di
push r13
cwde
pushfq
rdtsc
mov r11, rsp
cqo
movabs rcx, 0
lahf
cdq
push rcx
cmovle r9d, r9d
mov r11b, dil
mov rbx, qword [rsp + 0x90]
cmovnp dx, r12w
dec ebx
xor ebx, 0xb963cd
setne r9b
rol r9w, 0x35
cmc
rol ebx, 1
jmp 0x140cee8f2
dec edx
test r11d, r10d
clc
neg edx
push r9
shr r9b, 0x81
movsx r9d, sp
shr r9b, cl
xor dword [rsp], edx
rcr r9d, cl
bt r9w, 0xe7
sub r9b, bpl
pop r9
cmp ax, 0x513e
cmp al, r10b
movsxd rdx, edx
add rdi, rdx
jmp 0x140bcf1e4
not ebx
not r9w
rdtsc
mov edx, 0x674206a8
inc ebx
movzx ebp, r11w
sal edi, 0xf4
lea rbx, [rbx + rcx]
sar ax, 0x70
cmovg bp, bp
movabs rax, 0x100000000
bsr ebp, ecx
bsf rbp, r10
lea rbx, [rbx + rax]
mov r11, rsp
bsr di, r14w
sub rsp, 0x180
sar edi, 0xb6
xor r9w, 0x3262
and rsp, 0xfffffffffffffff0
mov r9, rbx
movzx di, r10b
or ebp, 0x46e46138
shld edx, ecx, 0x13
movabs rbp, 0
inc dh
sub r9, rbp
lea rdi, [0x140cee969]
sub rbx, 4
mov edx, dword [rbx]
test r10b, 0x58
xor edx, r9d
cmc
ror edx, 3
xor edx, 0x74fc1f2a
jmp 0x140c610b4
Function at 0x1405aa160
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1405aa2e7
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1405aa191
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405aa177
add dl, dl
jne 0x1405aa19e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405aa1fe
xor eax, eax
add dl, dl
jne 0x1405aa1ad
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405aa2b5
add dl, dl
jne 0x1405aa1be
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405aa1cb
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405aa1d8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405aa1e5
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1405aa1f2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1405aa186
mov eax, 1
add dl, dl
jne 0x1405aa20e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405aa21b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405aa203
sub eax, ebx
mov ebx, 1
jne 0x1405aa254
mov ecx, 1
add dl, dl
jne 0x1405aa236
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405aa243
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405aa22b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405aa186
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1405aa270
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405aa27d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405aa265
cmp eax, 0x7d00
jae 0x1405aa2a3
cmp eax, 0x500
jb 0x1405aa29e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405aa186
cmp eax, 0x7f
ja 0x1405aa2a6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405aa186
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1405aa2da
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1405aa186
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001fc0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push r15
sub rsp, 0x60
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x58], rsi
xorps xmm0, xmm0
mov qword [rsp + 0x48], r12
xor eax, eax
mov r12, rcx
mov qword [rsp + 0x40], r14
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
movups xmmword [rsp + 0x20], xmm0
call fcn.140001b60
mov rax, qword gs:[0x60]
xor r15d, r15d
mov r14, qword [rax + 0x18]
add r14, 0x20
mov rsi, qword [r14]
cmp rsi, r14
je 0x140002097
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x50], rdi
nop
mov rdi, qword [rsi + 0x40]
mov rbx, r15
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rdi + rax*2], bx
jne 0x140002040
movsxd rbp, eax
test eax, eax
jle 0x140002066
movzx ecx, word [rdi + rbx*2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
mov word [rdi + rbx*2], ax
inc rbx
cmp rbx, rbp
jl 0x140002050
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
jne 0x140002081
mov rsi, qword [rsi]
cmp rsi, r14
jne 0x140002030
jmp 0x140002085
mov r15, qword [rsi + 0x20]
mov rbp, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x20]
mov r14, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
test rcx, rcx
je 0x1400020e5
mov rdx, qword [rsp + 0x30]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1400020e0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400020e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004bbc
mov rax, r15
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140004b60
add rsp, 0x60
pop r15
ret
Function at 0x140002100
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0xf0
mov eax, 0x5a4d
mov rbp, rdx
mov rbx, rcx
cmp word [rcx], ax
jne 0x140002247
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x140002247
movups xmm0, xmmword [rax + 0x18]
lea r8, [rsp]
xor r9d, r9d
movups xmm1, xmmword [rax + 0x28]
movups xmmword [r8], xmm0
movups xmm0, xmmword [rax + 0x38]
movups xmmword [r8 + 0x10], xmm1
movups xmm1, xmmword [rax + 0x48]
movups xmmword [r8 + 0x20], xmm0
movups xmm0, xmmword [rax + 0x58]
movups xmmword [r8 + 0x30], xmm1
movups xmm1, xmmword [rax + 0x68]
movups xmmword [r8 + 0x40], xmm0
movups xmm0, xmmword [rax + 0x78]
movups xmmword [r8 + 0x50], xmm1
movups xmmword [r8 + 0x60], xmm0
lea r8, [r8 + 0x80]
movups xmm0, xmmword [rax + 0x88]
sub rax, 0xffffffffffffff68
movups xmmword [r8 - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movups xmmword [r8], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [r8 + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [r8 + 0x20], xmm1
movups xmm1, xmmword [rax + 0x40]
movups xmmword [r8 + 0x30], xmm0
movups xmm0, xmmword [rax + 0x50]
movups xmmword [r8 + 0x40], xmm1
movups xmm1, xmmword [rax + 0x60]
movups xmmword [r8 + 0x50], xmm0
movups xmmword [r8 + 0x60], xmm1
mov eax, dword [rsp + 0x70]
add rax, rcx
mov r10d, dword [rax + 0x20]
mov r14d, dword [rax + 0x1c]
add r10, rcx
mov r11d, dword [rax + 0x24]
add r14, rcx
mov esi, dword [rax + 0x14]
add r11, rcx
test esi, esi
je 0x140002247
movzx eax, word [r11]
mov r8d, dword [r10]
add r8, rbx
mov edi, dword [r14 + rax*4]
mov rax, rbp
add rdi, rbx
sub r8, rbp
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140002233
inc rax
test ecx, ecx
jne 0x140002220
test edx, edx
je 0x140002267
inc r9d
add r11, 2
add r10, 4
cmp r9d, esi
jb 0x140002202
xor eax, eax
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov rax, rdi
jmp 0x140002249
Function at 0x140003370
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140003398
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1400033be
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400033c0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140003419
test ecx, ecx
jle 0x1400033f9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140003419
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140003419
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140003440
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140003462
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140003478
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140003494
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140003496
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400034d2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000356e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000350d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000354e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000356e
cmp rbx, rax
ja 0x140003520
test rbx, rbx
je 0x14000356e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x1400039d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400039fd
xor eax, eax
jmp 0x140003b69
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140003a37
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140003a37
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140003b69
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140003b5c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140003a7a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140003aa5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140003b61
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003b14
sub eax, 1
je 0x140003b14
cmp eax, 2
jne 0x140003b5c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140003b61
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140003b42
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140003b5c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140003b61
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140004b60
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140003ed0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140003fa3
cmp byte [rcx + 0x71], 0
je 0x140003fa3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140003f9f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003f64
sub eax, 1
je 0x140003f68
cmp eax, 2
jne 0x140003f9f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004b60
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140003f96
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140003f9f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140003f4c
xor al, al
jmp 0x140003f4c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004b60
add rsp, 0x60
pop rbx
ret

Function at 0x1400054e8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005532
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005532
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005532
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005532
cmp dword [rcx + 0x84], 0xe
jbe 0x140005532
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140005534
xor al, al
add rsp, 0x28
ret
Function at 0x180001290
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x18015f960
push rdi
sub rsp, 0x90
lea rdi, [rsp + 0x20]
mov ecx, 0x1c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1805a6200]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea rcx, [0x180c39350]
call fcn.1800192b0
lea rcx, [0x1808e8f20]
call qword [sym.imp.ntdll.dll_RtlInitializeSListHead]
mov r8d, 0x200
mov edx, 0xd0
lea rcx, [0x1808e8f30]
call sym.ProcessMonitor.dll_PhInitializeFreeList
mov r8d, 0x40
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180013180
lea rax, [rsp + 0x30]
mov qword [0x1808e8f58], rax
mov eax, 8
imul rax, rax, 0
lea rcx, [0x180c39520]
lea rdx, [rsp + 0x30]
mov qword [rcx + rax], rdx
xor r8d, r8d
xor edx, edx
lea rcx, str.Type
call sym.ProcessMonitor.dll_PhCreateObjectType
mov qword [0x1808e8f58], rax
mov rax, qword [0x1808e8f58]
movzx eax, byte [rax + 2]
mov rcx, qword [0x1808e8f58]
mov word [rcx - 0xa0], ax
mov rax, qword [0x1808e8f58]
mov dword [rax + 4], 1
xor r8d, r8d
xor edx, edx
lea rcx, str.Alloc
call sym.ProcessMonitor.dll_PhCreateObjectType
mov qword [0x1808e8f60], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1808e8f78], eax
cmp dword [0x1808e8f78], 0xffffffff
jne 0x18015fa63
xor al, al
jmp 0x18015fa65
mov al, 1
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1804ac0d0]
call fcn.180014e20
mov rax, rdi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18000ce90
add rsp, 0x90
pop rdi
ret
Function at 0x180002020
Capabilities:
Modify service

Disassembly:
jmp 0x1801b8a20
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
lea rdi, [rsp + 0x20]
mov ecx, 8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x50]
movzx eax, byte [rsp + 0x58]
mov dword [rsp + 0x24], eax
lea r8, [rsp + 0x24]
mov edx, 3
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
je 0x1801b8a70
mov dword [rsp + 0x34], 1
jmp 0x1801b8a78
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
mov edi, eax
mov rcx, rsp
lea rdx, [0x1804ca440]
call fcn.180014e20
mov eax, edi
add rsp, 0x40
pop rdi
ret