joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008f080
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x14008f0b2
call fcn.14007b664
mov dword [rax], 0x16
call fcn.14007b4f8
jmp 0x14008f1d1
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14008f1d1
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14008f1d1
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x14008f0e1
lock or dword [rcx + 0x14], 0x10
jmp 0x14008f1d1
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14008f0f5
call fcn.140092ff0
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.14008e1b0
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.14008e968
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x14008f1bf
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x14008f18a
mov rcx, rsi
call fcn.14008e1b0
cmp eax, edi
je 0x14008f175
mov rcx, rsi
call fcn.14008e1b0
cmp eax, 0xfffffffe
je 0x14008f175
mov rcx, rsi
call fcn.14008e1b0
movsxd rbx, eax
lea r14, [0x1400d7c80]
mov rcx, rsi
sar rbx, 6
call fcn.14008e1b0
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x14008f17c
lea rdx, [0x1400d0900]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14008f18a
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x14008f1ae
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x14008f1ae
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x14008f1ae
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x14008f1d4
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x14008f1ec
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x14008ef05
call fcn.14007b664
mov dword [rax], 0x16
call fcn.14007b4f8
jmp 0x14008f061
mov eax, dword [rcx + 0x14]
shr eax, 0xd
mov ebp, 1
test bpl, al
je 0x14008f061
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test bpl, al
jne 0x14008f061
mov eax, dword [rcx + 0x14]
shr eax, 1
test bpl, al
je 0x14008ef3c
lock or dword [rcx + 0x14], 0x10
jmp 0x14008f061
lock or dword [rcx + 0x14], ebp
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14008ef4f
call fcn.140092ff0
mov r14d, dword [rbx + 0x10]
cmp r14d, ebp
jne 0x14008ef60
mov rax, qword [rbx]
mov r15b, byte [rax]
jmp 0x14008ef63
xor r15b, r15b
mov rsi, qword [rbx + 8]
mov rcx, rbx
mov edi, dword [rbx + 0x20]
mov qword [rbx], rsi
call fcn.14008e1b0
mov r8d, edi
mov rdx, rsi
mov ecx, eax
call fcn.14008e968
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x14008f04f
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x14008eff6
mov rcx, rbx
call fcn.14008e1b0
cmp eax, 0xffffffff
je 0x14008efe1
mov rcx, rbx
call fcn.14008e1b0
cmp eax, 0xfffffffe
je 0x14008efe1
mov rcx, rbx
call fcn.14008e1b0
movsxd rdi, eax
lea rsi, [0x1400d7c80]
mov rcx, rbx
sar rdi, 6
call fcn.14008e1b0
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [rsi + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x14008efe8
lea rdx, [0x1400d0900]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14008eff6
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x14008f01c
mov eax, dword [rbx + 0x14]
shr eax, 6
test bpl, al
je 0x14008f01c
mov eax, dword [rbx + 0x14]
shr eax, 8
test bpl, al
jne 0x14008f01c
mov dword [rbx + 0x20], 0x1000
mov rdx, qword [rbx]
cmp r14d, ebp
jne 0x14008f037
movzx ecx, byte [rdx]
shl cx, 8
movzx eax, r15b
or cx, ax
dec dword [rbx + 0x10]
jmp 0x14008f043
movzx ecx, word [rdx]
mov ebp, 2
add dword [rbx + 0x10], 0xfffffffe
lea rax, [rdx + rbp]
mov qword [rbx], rax
movzx eax, cx
jmp 0x14008f066
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
jmp 0x14008eed0
Function at 0x140095f34
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140095f64
xor eax, eax
jmp 0x140096027
mov rbp, rbx
cmp word [rax], si
je 0x140095f89
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140095f70
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140095f6c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140094758
movsxd r14, eax
test eax, eax
jne 0x140095fc7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140095f5d
mov rcx, r14
call fcn.14008f784
mov rdi, rax
test rax, rax
jne 0x140095fe0
xor ecx, ecx
call fcn.14008e174
jmp 0x140095fbc
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140094758
test eax, eax
jne 0x140096011
mov rcx, rdi
call fcn.14008e174
jmp 0x14009601b
xor ecx, ecx
call fcn.14008e174
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14009c908
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14008f46c
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14008f46c
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14009ca58
cmp rax, 0xffffffffffffffff
je 0x14009ca58
xor edi, edi
test rbp, rbp
jle 0x14009ca03
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14009126c
mov rbx, rax
test rax, rax
jne 0x14009c990
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14009c9f9
mov edx, 0x8000
mov ecx, r14d
call fcn.14008b3ec
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400928e8
cmp eax, 0xffffffff
je 0x14009c9d9
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14009c9a0
mov edx, r15d
mov ecx, r14d
call fcn.14008b3ec
jmp 0x14009c9f9
cmp byte [rsi + 0x38], dil
je 0x14009c9f0
cmp dword [rsi + 0x34], 5
jne 0x14009c9f0
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14009c9f9
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14008e174
jmp 0x14009ca6c
jns 0x14009ca6c
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14008f46c
cmp rax, 0xffffffffffffffff
jne 0x14009ca24
cmp byte [rsi + 0x30], dil
je 0x14009ca6c
mov edi, dword [rsi + 0x2c]
jmp 0x14009ca6c
mov ecx, r14d
call fcn.140096710
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14009ca6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x14009ca6c
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14009ca65
mov eax, dword [rsi + 0x2c]
jmp 0x14009ca6a
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14008f46c
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14009e3d0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14009e3f8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14009e3f8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400010a3
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor eax, eax
cpuid
mov eax, 1
cpuid
movabs r9, 0xb2d05e00
cpuid
rdtsc
shl rdx, 0x20
or rax, rdx
mov rcx, rax
fldpi
frndint
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, rcx
cmp rax, r9
jb 0x1400010c6
push rbp
mov rbp, rsp
sub rsp, 8
mov r10, 0xa
mov rcx, 0xffffffff9f345678
dec rcx
xor r9, r9
mov rax, rcx
jne 0x1400010f1
xor rax, rax
mov rax, rbx
add rax, rdx
nop
nop
nop
dec r10
xor r11, r11
jne 0x1400010ea
xor rax, rax
mov rax, 0xa
dec rax
nop
nop
add rsp, 8
pop rbp
ret

Function at 0x140004000
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x190
mov rax, qword [0x140017320]
xor rax, rsp
mov qword [rsp + 0x180], rax
cmp qword [0x140019c40], 0
mov esi, edx
mov edi, ecx
je 0x14000403e
mov rax, qword [0x140019c48]
test rax, rax
jne 0x1400040bc
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x104
call fcn.1400056e0
lea rcx, [rsp + 0x70]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rdx, str.ntdll.dll
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x1400040b5
lea rdx, str.NtQueryInformationThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtReadVirtualMemory
mov rcx, rbx
mov qword [0x140019c40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140019c48], rax
jmp 0x1400040bc
mov rax, qword [0x140019c48]
cmp qword [0x140019c40], 0
mov dword [rsp + 0x30], 0
je 0x14000416f
test rax, rax
je 0x14000416f
xor edx, edx
lea rcx, [rsp + 0x38]
lea r8d, [rdx + 0x30]
call fcn.1400056e0
mov r8d, edi
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov r8d, esi
lea ecx, [rdx + 0x40]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_OpenThread]
lea r8, [rsp + 0x38]
mov r9d, 0x30
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x20], 0
mov rbx, rax
call qword [0x140019c40]
mov rdx, qword [rsp + 0x40]
lea r8, [rsp + 0x30]
mov r9d, 4
mov rcx, rdi
add rdx, 0x1720
mov qword [rsp + 0x20], 0
call qword [0x140019c48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x30]
jmp 0x140004171
xor eax, eax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140004fe0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400041a0
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x170
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x1a8], rbx
mov rax, qword [0x140017320]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov ebp, r8d
mov esi, edx
mov rbx, rcx
mov qword [rsp + 0x40], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
cmp qword [0x140019c50], rdi
jne 0x140004245
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x50]
call fcn.1400056e0
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rdx, str.advapi32.dll
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x140004245
lea rdx, str.I_QueryTagInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140019c50], rax
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
mov dword [rsp + 0x20], 1
cmp qword [0x140019c50], 0
je 0x1400042db
mov dword [rsp + 0x28], esi
mov edx, ebp
mov ecx, esi
call fcn.140004000
mov dword [rsp + 0x2c], eax
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x38], rdi
lea r8, [rsp + 0x28]
mov edx, 1
xor ecx, ecx
call qword [0x140019c50]
test eax, eax
jne 0x1400042d6
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x1400042bb
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea edi, [rcx - 1]
mov r8d, edi
mov rcx, rbx
call fcn.1400044d0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, rbx
jmp 0x1400042de
mov rax, rbx
jmp 0x1400042de
mov rax, rbx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140004fe0
mov rbx, qword [rsp + 0x1a8]
add rsp, 0x170
pop rdi
pop rsi
pop rbp
ret
Function at 0x140004310
Capabilities:
Accept command line arguments
Get system information on windows
Set registry value

Disassembly:
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x88
mov rbp, rdx
call fcn.140004840
or edi, 0xffffffff
xor r12d, r12d
mov esi, edi
mov dword [rsp + 0xb0], r12d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
test rax, rax
je 0x140004357
lea rdx, [rsp + 0xb0]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbp, rax
cmp dword [rsp + 0xb0], 3
jne 0x14000448a
mov rcx, qword [rbp + 8]
mov qword [rsp + 0x80], rbx
call fcn.1400050fc
mov rcx, qword [rbp + 0x10]
mov ebx, eax
call fcn.1400050fc
lea rcx, [rsp + 0xc8]
mov r8d, eax
mov edx, ebx
call fcn.1400041a0
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x30]
mov ebx, r12d
call fcn.1400056e0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x50]
cmp ax, 9
je 0x1400043c2
cmp ax, 6
jne 0x1400043c7
mov ebx, 1
mov qword [rsp + 0x40], r12
mov eax, 0x200
mov ecx, 0x100
test ebx, ebx
lea rdx, str.Software360SD
cmovne eax, ecx
lea rcx, [rsp + 0xc0]
xor r9d, r9d
mov qword [rsp + 0x38], rcx
or eax, 0x20006
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], eax
mov rcx, 0xffffffff80000001
xor r8d, r8d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rbx, qword [rsp + 0x80]
test eax, eax
jne 0x140004469
mov rax, qword [rsp + 0xc8]
lea rdx, str.svcName
mov r9d, 1
mov ecx, dword [rax - 0x10]
xor r8d, r8d
add ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0xc0]
test eax, eax
cmove esi, r12d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0xc8]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
dec edi
test edi, edi
jg 0x14000448a
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, esi
add rsp, 0x88
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x140008cf8
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.14000b988
nop
cmp dword [0x140018e20], 1
je 0x140008ca4
mov dword [0x140018e1c], 1
mov byte [0x140018e18], r12b
test ebx, ebx
jne 0x140008c90
mov rcx, qword [0x14001aed0]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140008c7d
mov rcx, qword [0x14001aec8]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
xor r8d, r8d
xor edx, edx
jmp 0x140008b6c

Function at 0x140008d04
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x140008b6c
pop rsp
invalid
invalid
invalid
Function at 0x140009fe3
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140009fc1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140019310]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140009fe3
mov rax, qword [rsp + 0x88]
mov qword [0x140019408], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400193a8], rax
mov rax, qword [0x140019408]
mov qword [0x140019280], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140019390], rax
mov dword [0x140019270], 0xc0000409
mov dword [0x140019274], 1
mov rax, qword [0x140017320]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140017328]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140019308], eax
mov ecx, 1
call fcn.14000a56c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400145a0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140019308], 0
jne 0x14000a06a
mov ecx, 1
call fcn.14000a56c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14000d368
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.140009ae8
xor ebx, ebx
mov rdi, rax
cmp qword [0x140019ac8], rbx
jne 0x14000d46e
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14000d543
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000d543
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140019ac8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140019ad0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x140019ad8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x140019ae8], rax
test rax, rax
je 0x14000d465
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x140019ae0], rax
jmp 0x14000d475
mov rax, qword [0x140019ae0]
jmp 0x14000d47c
mov rax, qword [0x140019ae0]
mov r11, qword [0x140019ae8]
cmp rax, rdi
je 0x14000d4e4
cmp r11, rdi
je 0x14000d4e4
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x140019ae8]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x14000d4e4
test rax, rax
je 0x14000d4e4
call rsi
test rax, rax
je 0x14000d4de
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14000d4de
test byte [rsp + 0x38], 1
jne 0x14000d4e4
bts ebp, 0x15
jmp 0x14000d522
mov rcx, qword [0x140019ad0]
cmp rcx, rdi
je 0x14000d522
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14000d522
call rax
mov rbx, rax
test rax, rax
je 0x14000d522
mov rcx, qword [0x140019ad8]
cmp rcx, rdi
je 0x14000d522
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14000d522
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140019ac8]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14000d543
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x14000d545
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1400015a8
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov r9, rdx
mov r8, rcx
mov qword [r11 - 0x10], rax
xor edi, edi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x14000166c
lea rcx, [0x1400f51e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400f51c8]
jmp 0x140001632
lea rsi, [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14000162f
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx]
lea rcx, [0x1400f51c8]
mov rdx, rsi
call fcn.1400073e4
jmp 0x140001632
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400015ff
mov rdi, qword [reloc.WS2_32.dll_accept]
lea rcx, [0x1400f51c8]
lea rdx, [rdi + 1]
mov qword [reloc.WS2_32.dll_accept], rdx
lea edx, [rbx + 0x20]
call fcn.1400073a0
lea rcx, [0x1400f51e0]
mov qword [rax], rbp
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rax, rdi
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140001780
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.1400016b0
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x1400f51e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400f51c8]
jmp 0x1400017bc
cmp qword [rbx + 0x18], rdi
je 0x1400017c3
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400017b3
jmp 0x1400017dd
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x1400f51c8]
call fcn.1400073e4
lea rcx, [0x1400f51e0]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140002078
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1c0
mov ebx, reloc.WS2_32.dll_recv
lea r8, [0x140001f94]
mov edx, ebx
lea ecx, [rbx + 0x28]
call fcn.14001a710
xor r8d, r8d
mov qword [0x1400f5298], rax
xor edx, edx
mov ecx, ebx
call fcn.140006960
xor ebx, ebx
mov qword [0x1400f52a8], rax
cmp word [0x1400f5290], bx
jne 0x14000219b
mov ecx, 0x101
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea edi, [rbx + 1]
test eax, eax
jne 0x1400020e0
movzx eax, di
jmp 0x1400020e2
mov eax, ebx
lea rcx, str.ws2_32.dll
mov word [0x1400f5290], ax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1400f52a0], rax
test rax, rax
je 0x14000219b
lea rdx, [0x1400d91f8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400f52a0]
lea rdx, [0x1400d9208]
mov qword [0x1400f5270], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400f52a0]
lea rdx, str.getnameinfo
mov qword [0x1400f5278], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400f52a0]
lea rdx, str.WSAStringToAddressA
mov qword [0x1400f5280], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x1400f5270], rbx
mov qword [0x1400f5288], rax
je 0x14000219b
cmp qword [0x1400f5278], rbx
je 0x14000219b
cmp qword [0x1400f5280], rbx
je 0x14000219b
mov ecx, dword [0x1400f5294]
test rax, rax
cmovne ecx, edi
mov dword [0x1400f5294], ecx
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x1c0
pop rdi
ret

Function at 0x140003280
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x1400f54a0]
jne 0x14000329e
mov rax, qword [0x1400f58d0]
add rsp, 0x28
ret
mov rcx, qword [0x1400f58f0]
add rsp, 0x28
jmp fcn.1400068c8

Function at 0x14000352c
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x230
xor ebx, ebx
test rcx, rcx
je 0x1400035b6
mov rdx, rcx
mov r8d, 0x104
lea rcx, [rsp + 0x20]
call fcn.14001d2ac
lea rcx, [rsp + 0x20]
mov word [rsp + 0x228], bx
call fcn.14001ce58
lea rcx, [rsp + 0x20]
lea rcx, [rcx + rax*2]
lea rax, [rsp + 0x20]
cmp rcx, rax
jbe 0x1400035a2
lea rdx, [rcx - 2]
movzx eax, word [rdx]
sub ax, 0x20
cmp ax, 0x3c
ja 0x1400035a2
movabs r8, 0x1000000000008001
bt r8, rax
jae 0x1400035a2
lea rax, [rsp + 0x20]
mov rcx, rdx
cmp rdx, rax
ja 0x140003574
mov word [rcx], bx
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cdqe
jmp 0x1400035b8
xor eax, eax
add rsp, 0x230
pop rbx
ret