joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14019e8d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
xor ebx, ebx
mov dword [rsp + 0x68], 8
cmp qword [r8 + 0x18], 8
mov qword [rsp + 0x58], rbx
jb 0x14019e8ef
mov r8, qword [r8]
cmp qword [rdx + 0x18], 8
jb 0x14019e8f9
mov rdx, qword [rdx]
lea rax, [rsp + 0x68]
or r9d, 0x40
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
cmove rbx, qword [rsp + 0x58]
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x14019e930
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
xor ebx, ebx
mov dword [rsp + 0x58], 4
cmp qword [r8 + 0x18], 8
mov dword [rsp + 0x68], ebx
jb 0x14019e94e
mov r8, qword [r8]
cmp qword [rdx + 0x18], 8
jb 0x14019e958
mov rdx, qword [rdx]
lea rax, [rsp + 0x58]
or r9d, 0x10
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
cmove ebx, dword [rsp + 0x68]
mov eax, ebx
add rsp, 0x40
pop rbx
ret

Function at 0x14019e990
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x140351248]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, r8
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x30], r9
mov r9d, dword [rsp + 0xa0]
mov eax, VariantTimeToDosDateTime
test r9d, r9d
cmove r9d, eax
cmp qword [r8 + 0x18], 8
jb 0x14019e9d0
mov r8, qword [r8]
cmp qword [rdx + 0x18], 8
jb 0x14019e9da
mov rdx, qword [rdx]
mov dword [rsp + 0x28], 8
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
test eax, eax
jne 0x14019ea11
mov rcx, rbx
call fcn.1400c2be0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401c0070
add rsp, 0x70
pop rbx
ret
mov r8d, eax
lea rdx, str.Cannot_set_DWORD64_to_registry
lea rcx, [rsp + 0x38]
call fcn.14019e140
lea rdx, [0x1402cf080]
lea rcx, [rsp + 0x38]
call fcn.1401f657c
int3

Function at 0x14019ea40
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x140351248]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, r8
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x30], r9d
mov r9d, dword [rsp + 0xa0]
mov eax, 4
test r9d, r9d
cmove r9d, eax
cmp qword [r8 + 0x18], 8
jb 0x14019ea80
mov r8, qword [r8]
cmp qword [rdx + 0x18], 8
jb 0x14019ea8a
mov rdx, qword [rdx]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
test eax, eax
jne 0x14019eabd
mov rcx, rbx
call fcn.1400c2be0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401c0070
add rsp, 0x70
pop rbx
ret
mov r8d, eax
lea rdx, str.Cannot_set_DWORD_to_registry
lea rcx, [rsp + 0x38]
call fcn.14019e140
lea rdx, [0x1402cf080]
lea rcx, [rsp + 0x38]
call fcn.1401f657c
int3
Function at 0x14019eaf0
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov qword [rsp + 0x58], rdx
mov rdi, r8
mov qword [rsp + 0x58], r8
mov rbx, rdx
cmp qword [rdx + 0x18], 8
mov rsi, rcx
mov dword [rsp + 0x50], r9d
jb 0x14019eb1a
mov rdx, qword [rdx]
lea rax, [rsp + 0x58]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14019eb79
cmp qword [rbx + 0x18], 8
mov rdx, rbx
jb 0x14019eb44
mov rdx, qword [rbx]
xor ecx, ecx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rcx
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14019ebbb
cmp qword [rdi + 0x18], 8
mov rdx, rdi
jb 0x14019eb86
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14019ebd5
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.1400c2be0
mov rcx, rdi
call fcn.1400c2be0
xor eax, eax
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
mov rcx, rbx
call fcn.1400c2be0
mov rcx, rdi
call fcn.1400c2be0
mov eax, 1
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret

Function at 0x14019ec00
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x68
mov qword [rsp + 0x50], rdx
mov rdi, r9
mov qword [rsp + 0x50], r8
mov rsi, r8
mov qword [rsp + 0x50], r9
mov rbx, rdx
cmp qword [rdx + 0x18], 8
mov rbp, rcx
jb 0x14019ec2e
mov rdx, qword [rdx]
lea rax, [rsp + 0x50]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14019ec8d
cmp qword [rbx + 0x18], 8
mov rdx, rbx
jb 0x14019ec58
mov rdx, qword [rbx]
xor ecx, ecx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rcx
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ecx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14019ecdd
cmp qword [rdi + 0x18], 8
mov rcx, rdi
jb 0x14019ec9a
mov rcx, qword [rdi]
cmp qword [rsi + 0x18], 8
mov rdx, rsi
jb 0x14019eca7
mov rdx, qword [rsi]
mov eax, dword [rdi + 0x10]
mov r9d, 1
xor r8d, r8d
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14019ed00
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.1400c2be0
mov rcx, rsi
call fcn.1400c2be0
mov rcx, rdi
call fcn.1400c2be0
xor eax, eax
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, rbx
call fcn.1400c2be0
mov rcx, rsi
call fcn.1400c2be0
mov rcx, rdi
call fcn.1400c2be0
mov eax, 1
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401a3430
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1401a3446
xor al, al
add rsp, 0x28
ret
shr eax, 4
and al, 1
add rsp, 0x28
ret
Function at 0x1400012f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
lea rsi, [rcx + 2]
mov ebp, 4
nop dword [rax]
movzx r8d, byte [rsi - 1]
movzx r11d, byte [rsi - 2]
movzx edi, byte [rsi + 1]
movzx r10d, byte [rsi]
movzx edx, r8b
movzx r9d, dil
xor dl, r11b
xor r9b, r10b
mov al, 0x1b
movzx ecx, dl
add dl, dl
movzx ebx, r9b
shr cl, 7
xor bl, r8b
add rsi, 4
xor bl, r11b
imul cl
xor al, dl
movzx edx, r8b
xor al, r11b
xor dl, r10b
xor al, bl
movzx ecx, dl
add dl, dl
mov byte [rsi - 6], al
shr cl, 7
mov al, 0x1b
imul cl
xor al, dl
movzx ecx, r9b
xor al, r8b
shr cl, 7
add r9b, r9b
xor al, bl
movzx edx, dil
mov byte [rsi - 5], al
xor dl, r11b
mov al, 0x1b
imul cl
xor al, r9b
movzx ecx, dl
xor al, r10b
shr cl, 7
add dl, dl
xor al, bl
mov byte [rsi - 4], al
mov al, 0x1b
imul cl
xor al, dl
xor al, dil
xor al, bl
dec rbp
mov byte [rsi - 3], al
jne 0x140001310
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x1400017c0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov rdi, rdx
mov rbp, rdx
mov rbx, rcx
mov r8, rcx
mov r9d, 4
sub rdi, rcx
nop
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [rdi + r8]
inc r8
xor byte [r8 - 1], al
dec rcx
jne 0x140001800
dec r9
jne 0x1400017f0
mov sil, 1
lea r12, str.cw
mov r8, rbx
mov r9d, 4
nop dword [rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
add rcx, 4
dec rdx
movzx eax, byte [rax + r12]
mov byte [rcx - 4], al
jne 0x140001840
inc r8
dec r9
jne 0x140001830
movzx eax, byte [rbx + 5]
movzx ecx, byte [rbx + 1]
mov byte [rbx + 1], al
movzx eax, byte [rbx + 9]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xd]
mov byte [rbx + 0xd], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 0xf], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 7], cl
mov byte [rbx + 0xb], al
cmp sil, 0xa
je 0x14000190d
mov rcx, rbx
call fcn.1400012f0
movzx r8d, sil
mov rcx, rbx
shl r8, 4
mov r9d, 4
sub r8, rbx
add r8, rbp
nop word [rax + rax]
mov edx, 4
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
inc rcx
xor byte [rcx - 1], al
dec rdx
jne 0x1400018f0
dec r9
jne 0x1400018e0
inc sil
jmp 0x140001820
mov edx, 4
nop word [rax + rax]
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [rdi + rbx + 0xa0]
inc rbx
xor byte [rbx - 1], al
dec rcx
jne 0x140001930
dec rdx
jne 0x140001920
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x140001970
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov r10, rdx
mov rsi, rdx
mov rbx, rcx
mov r8, rcx
mov r11d, 4
sub r10, rcx
nop dword [rax]
mov r9d, 4
nop word [rax + rax]
movzx eax, byte [r10 + r8 + 0xa0]
inc r8
xor byte [r8 - 1], al
dec r9
jne 0x1400019b0
dec r11
jne 0x1400019a0
mov dil, 9
lea rbp, [0x1400cbcc0]
nop word [rax + rax]
movzx eax, byte [rbx + 9]
movzx ecx, byte [rbx + 0xd]
mov r8, rbx
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov r9d, 4
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xf], cl
mov byte [rbx + 0xb], al
nop dword [rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
add rcx, 4
dec rdx
movzx eax, byte [rax + rbp]
mov byte [rcx - 4], al
jne 0x140001a50
inc r8
dec r9
jne 0x140001a40
movzx r8d, dil
mov rcx, rbx
lea r9d, [rdx + 4]
shl r8, 4
sub r8, rbx
add r8, rsi
mov edx, 4
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
inc rcx
xor byte [rcx - 1], al
dec rdx
jne 0x140001a90
dec r9
jne 0x140001a80
test dil, dil
je 0x140001aba
mov rcx, rbx
call fcn.1400013d0
dec dil
jmp 0x1400019e0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140001ee0
Capabilities:
Encode data using xor
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1100
call fcn.1400c9460
sub rsp, rax
mov rax, qword [0x1400ce008]
xor rax, rsp
mov qword [rsp + 0x10f0], rax
mov r15, rdx
mov rbp, r9
mov r14, r8
mov ebx, 0x1000
lea rdx, [rsp + 0xf0]
xor r9d, r9d
mov r8d, ebx
mov r13, rcx
xor r12d, r12d
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x140001fa1
nop dword [rax + rax]
movsxd rdi, eax
lea rsi, [rdi + r12]
cmp rsi, rbx
jbe 0x140001f68
mov rcx, qword [rbp]
add rbx, rbx
mov rdx, rbx
call fcn.1400c2198
mov qword [rbp], rax
test rax, rax
je 0x140002063
mov rax, qword [rbp]
lea rdx, [rsp + 0xf0]
mov r8, rdi
lea rcx, [r12 + rax]
call fcn.1400c6e10
lea rdx, [rsp + 0xf0]
xor r9d, r9d
mov r8d, 0x1000
mov rcx, r13
mov r12, rsi
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x140001f40
lea rcx, [rsp + 0x30]
mov rdx, r15
call section..text
mov rbx, qword [rbp]
movups xmm0, xmmword [r14]
movaps xmmword [rsp + 0xe0], xmm0
test r12, r12
je 0x140002035
lea rsi, [r12 - 1]
lea rdi, [rsp + 0xe0]
shr rsi, 4
sub rdi, rbx
inc rsi
nop word [rax + rax]
mov rax, qword [rbx]
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
call fcn.140001970
mov ecx, reloc.WS2_32.dll_recv
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
inc rbx
xor byte [rbx - 1], al
dec rcx
jne 0x140002010
movups xmm0, xmmword [rsp + 0x20]
sub rdi, 0x10
dec rsi
movaps xmmword [rsp + 0xe0], xmm0
jne 0x140001fe0
mov rax, r12
mov rcx, qword [rsp + 0x10f0]
xor rcx, rsp
call fcn.1400c2030
mov rbx, qword [rsp + 0x1148]
add rsp, 0x1100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
jmp 0x140002038
Function at 0x1400c253b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400ce008]
jne 0x1400c204a
rol rcx, 0x10
test cx, 0xffff
jne 0x1400c2046
repz ret
ror rcx, 0x10
jmp 0x1400c2494
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400cefa0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1400cf098]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400c2519
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400cefa0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400c253b
mov rax, qword [rsp + 0x88]
mov qword [0x1400cf098], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400cf038], rax
mov rax, qword [0x1400cf098]
mov qword [0x1400cef10], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400cf020], rax
mov dword [0x1400cef00], 0xc0000409
mov dword [0x1400cef04], 1
mov rax, qword [0x1400ce008]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400ce010]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1400cef98], eax
mov ecx, 1
call fcn.1400c41fc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400ca320]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400cef98], 0
jne 0x1400c25c2
mov ecx, 1
call fcn.1400c41fc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x1400c2bf0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400c2a60
Function at 0x1400c5568
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1400ce008]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.1400c3d90
xor ebx, ebx
cmp qword [0x1400cfe90], rbx
mov rdi, rax
jne 0x1400c567b
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1400c5752
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400c5752
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x1400cafc0]
mov rcx, rsi
mov qword [0x1400cfe90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1400cfe98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x1400cfea0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1400cfeb0], rax
test rax, rax
je 0x1400c5672
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1400cfea8], rax
jmp 0x1400c5682
mov rax, qword [0x1400cfea8]
jmp 0x1400c5689
mov rax, qword [0x1400cfea8]
mov r11, qword [0x1400cfeb0]
cmp rax, rdi
je 0x1400c56f0
cmp r11, rdi
je 0x1400c56f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1400cfeb0]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x1400c56f0
test rax, rax
je 0x1400c56f0
call rsi
test rax, rax
je 0x1400c56ea
lea rcx, [rsp + 0x30]
mov r9d, recv
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400c56ea
test byte [rsp + 0x40], 1
jne 0x1400c56f0
bts ebp, 0x15
jmp 0x1400c5730
mov rcx, qword [0x1400cfe98]
cmp rcx, rdi
je 0x1400c5730
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400c5730
call rax
mov rbx, rax
test rax, rax
je 0x1400c5730
mov rcx, qword [0x1400cfea0]
cmp rcx, rdi
je 0x1400c5730
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400c5730
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1400cfe90]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400c5752
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x1400c5754
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400c2030
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140004ccc
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x140004cfa
xor eax, eax
jmp 0x140004de6
cmp qword [rcx + 0x68], 0
je 0x140004d0e
lfence
call fcn.140004e04
jmp 0x140004de6
mov rax, qword [rcx + 0x38]
mov rbp, rsi
mov rdx, qword [rax]
test rdx, rdx
je 0x140004d25
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140004d27
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140004d59
cmp rax, rsi
mov rbx, rsi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.14001f730
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rbp, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x140004ddd
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x140004d90
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x140004db9
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.14000cae4
add r14, rax
sub rbp, rax
cmp rax, rbx
jne 0x140004ddd
cmp rbp, rbx
ja 0x140004d97
test rbp, rbp
je 0x140004ddd
mov r9, qword [rdi + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, r14
call fcn.14000cae4
sub rbp, rax
sub rsi, rbp
mov rax, rsi
lfence
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140006918
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006962
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140006962
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140006962
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140006962
cmp dword [rcx + 0x84], 0xe
jbe 0x140006962
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140006964
xor al, al
add rsp, 0x28
ret
Function at 0x14000f578
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000f5e7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000f5e7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000f5e7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000f5e7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000f5e7
cmp dword [rcx + 0x84], 0xe
jbe 0x14000f5e7
cmp dword [rcx + 0xf8], 0
je 0x14000f5e7
mov ecx, ebx
call fcn.14000f698
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000f474
nop
cmp dword [rbp + 0x20], 0
je 0x14000f635
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000f640
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x14000f578

Function at 0x14000f77c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000f578
Function at 0x1400149b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.1400064a0
sub rsp, rax
mov rax, qword [0x140030040]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.140013590
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x1400149ff
mov rax, rbp
jmp 0x140014b07
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x328a0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.140015ad0
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x328a0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x140014b03
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140014b03
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.140015ad0
test rax, rax
js 0x140014b03
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x140014b03
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x140014af5
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x140014af5
cmp byte [rcx], 0xd
jne 0x140014adb
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x140014aea
cmp byte [rcx + 1], 0xa
jne 0x140014aea
inc rcx
jmp 0x140014aea
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x30470]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x140014abd
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x140014b07
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140006470
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x140014d28
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140014d3e
mov al, 1
jmp 0x140014d9e
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140014d4f
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140014d9c
mov ecx, dword [rcx + 0x18]
nop
call fcn.140019df0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140014d9c
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140014d9c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140014d9c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140014d9e
xor al, al
add rsp, 0x20
pop rbx
ret