joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400018a0
Capabilities:
Enumerate processes

Disassembly:
sub rsp, 0x178
mov qword [rsp + 0x168], 0xfffffffffffffffe
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x160], rax
mov dword [rsp + 0x30], 0x130
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x160]
call sub.KERNEL32.dll_Process32First
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x140001937
lea rdx, str.lsass.exe
lea rcx, [rsp + 0x5c]
call fcn.140005760
test eax, eax
jne 0x14000191f
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x1f0fff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
jmp 0x140001948
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x160]
call sub.KERNEL32.dll_Process32Next
mov dword [rsp + 0x28], eax
jmp 0x1400018e5
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor eax, eax
add rsp, 0x178
ret
Function at 0x140001960
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xc8
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xd8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
jne 0x140001a8c
mov qword [rsp + 0x60], 0
cmp dword [0x140017d20], 0
jne 0x140001a0d
cmp qword [0x140017d18], 0
jne 0x140001a03
lea rcx, [0x1400118e4]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.RtlCreateUserThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140017d18], rax
mov dword [0x140017d20], 1
cmp qword [0x140017d18], 0
je 0x140001a7c
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xd0]
call qword [0x140017d18]
mov dword [rsp + 0x68], eax
mov ecx, dword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140001a87
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140001bbe
cmp qword [rsp + 0x60], 0
jne 0x140001bbe
mov r8d, 0x38
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.140004b80
mov dword [rsp + 0xa8], 0
mov dword [rsp + 0xac], 0
mov dword [rsp + 0x70], 0x38
mov dword [rsp + 0x74], 0x10003
mov dword [rsp + 0x78], 8
lea rax, [rsp + 0xac]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x88], 0
mov dword [rsp + 0x8c], 0x10004
mov dword [rsp + 0x90], 4
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x98], rax
mov dword [rsp + 0xa0], 0
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtCreateThreadEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xd0]
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rsp + 0x60]
call qword [rsp + 0xb8]
mov dword [rsp + 0xb0], eax
cmp dword [rsp + 0xb0], 0
je 0x140001bbe
xor eax, eax
jmp 0x140001bce
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rsp + 0x60]
add rsp, 0xc8
ret
Function at 0x1400021b0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x34], 0
mov r9d, 1
lea r8, [rsp + 0x34]
mov edx, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0xffffffff
jne 0x1400021fe
xor eax, eax
jmp 0x1400022f9
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
xor r9d, r9d
lea r8, [rsp + 0x38]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xffffffff
jne 0x140002237
xor eax, eax
jmp 0x1400022f9
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, 4
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14000226e
xor eax, eax
jmp 0x1400022f9
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, 4
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14000229a
xor eax, eax
jmp 0x1400022f9
mov dword [rsp + 0x3c], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, 4
lea rdx, [rsp + 0x3c]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400022ce
xor eax, eax
jmp 0x1400022f9
xor r9d, r9d
lea r8, [rsp + 0x34]
mov edx, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0xffffffff
jne 0x1400022f4
xor eax, eax
jmp 0x1400022f9
mov eax, 1
add rsp, 0x58
ret

Function at 0x140002350
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x34], 0
mov r9d, 1
lea r8, [rsp + 0x34]
mov edx, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0xffffffff
jne 0x140002395
xor eax, eax
jmp 0x140002432
mov dword [rsp + 0x30], 8
mov dword [rsp + 0x38], 0
xor r9d, r9d
lea r8, [rsp + 0x38]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xffffffff
jne 0x1400023cb
xor eax, eax
jmp 0x140002432
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x3c], 1
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, 4
lea rdx, [rsp + 0x3c]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140002407
xor eax, eax
jmp 0x140002432
xor r9d, r9d
lea r8, [rsp + 0x34]
mov edx, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0xffffffff
jne 0x14000242d
xor eax, eax
jmp 0x140002432
mov eax, 1
add rsp, 0x58
ret
Function at 0x140002590
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x34], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov r8d, 4
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400025e1
mov eax, dword [rsp + 0x34]
cmp rax, 4
je 0x1400025e8
xor al, al
jmp 0x14000269c
mov rcx, qword [rsp + 0x60]
call fcn.140005a94
shl rax, 1
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov r8d, 4
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000262b
mov eax, dword [rsp + 0x34]
cmp rax, 4
je 0x14000262f
xor al, al
jmp 0x14000269c
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140002660
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x34], eax
je 0x140002664
xor al, al
jmp 0x14000269c
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov r8d, 4
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140002696
mov eax, dword [rsp + 0x34]
cmp rax, 4
je 0x14000269a
xor al, al
jmp 0x14000269c
mov al, 1
add rsp, 0x48
ret
Function at 0x140004690
Capabilities:
Check os version

Disassembly:
push rdi
sub rsp, 0xc0
mov dword [rsp + 0x20], 0x94
lea rdi, [rsp + 0x24]
xor eax, eax
mov ecx, 0x90
rep stosb byte [rdi], al
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x1400046c4
xor eax, eax
jmp 0x1400046d4
cmp dword [rsp + 0x24], 6
jb 0x1400046d2
mov eax, 1
jmp 0x1400046d4
xor eax, eax
add rsp, 0xc0
pop rdi
ret

Function at 0x1400046f0
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
mov eax, 0x22d8
call fcn.14000fbf0
sub rsp, rax
call fcn.140004600
test eax, eax
je 0x140004710
mov eax, 1
jmp 0x14000488d
mov r8d, 0x105
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14000488b
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x22c0], rax
mov byte [rsp + 0x2b0], 0
mov rax, qword [rsp + 0x22c0]
movzx eax, word [rax]
test eax, eax
je 0x1400047ca
mov rax, qword [rsp + 0x22c0]
movzx eax, word [rax]
cmp eax, 0x22
jne 0x140004793
movzx eax, byte [rsp + 0x2b0]
test eax, eax
jne 0x140004779
mov dword [rsp + 0x22cc], 1
jmp 0x140004784
mov dword [rsp + 0x22cc], 0
movzx eax, byte [rsp + 0x22cc]
mov byte [rsp + 0x2b0], al
movzx eax, byte [rsp + 0x2b0]
test eax, eax
jne 0x1400047b1
mov rax, qword [rsp + 0x22c0]
movzx eax, word [rax]
cmp eax, 0x20
jne 0x1400047b1
jmp 0x1400047ca
mov rax, qword [rsp + 0x22c0]
add rax, 2
mov qword [rsp + 0x22c0], rax
jmp 0x140004741
mov r8d, 0x70
xor edx, edx
lea rcx, [rsp + 0x240]
call fcn.140004b80
mov dword [rsp + 0x240], 0x70
lea rax, str.runas
mov qword [rsp + 0x250], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x258], rax
mov rax, qword [rsp + 0x22c0]
mov qword [rsp + 0x260], rax
mov qword [rsp + 0x248], 0
mov dword [rsp + 0x270], 0
mov rax, qword [rsp + 0x22c0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
lea r8, str.szPath:__S__cmdline:__S
mov edx, 0x2000
lea rcx, [rsp + 0x2c0]
call fcn.14000619c
lea rcx, [rsp + 0x240]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x14000488b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x22c8], eax
cmp dword [rsp + 0x22c8], 0x4c7
jne 0x14000488b
mov eax, 0xffffffff
jmp 0x14000488d
xor eax, eax
add rsp, 0x22d8
ret
Function at 0x140007b74
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140007fe8
nop
cmp dword [0x140017dc8], 1
je 0x140007b20
mov dword [0x140017dc4], 1
mov byte [0x140017dc0], r12b
test ebx, ebx
jne 0x140007b0c
mov rcx, qword [0x140018be0]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140007af9
mov rcx, qword [0x140018bd8]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x140007a98
call fcn.140008164
cmp qword [rdi], rax
jne 0x140007a98
jmp 0x140007a7e
cmp rdi, rsi
jb 0x140007af9
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.140008164
mov qword [rdi], rax
call rbx
mov rcx, qword [0x140018be0]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x140018bd8]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x140007ad7
cmp r13, rax
je 0x140007af7
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x140007a7e
lea rdx, [0x140011480]
lea rcx, [0x140011468]
call fcn.1400078c8
lea rdx, [0x140011490]
lea rcx, [0x140011488]
call fcn.1400078c8
nop
test r12d, r12d
je 0x140007b2f
mov ecx, 8
call fcn.140007ee8
test r12d, r12d
jne 0x140007b5a
mov dword [0x140017dc8], 1
lea ecx, [r12 + 8]
call fcn.140007ee8
mov ecx, r15d
call fcn.14000785c
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400079e8

Function at 0x140007b80
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1400079e8
Function at 0x14000d9bc
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.140008164
xor ebx, ebx
mov rdi, rax
cmp qword [0x1400184e0], rbx
jne 0x14000dac2
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14000db97
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000db97
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1400184e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1400184e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x1400184f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x140018500], rax
test rax, rax
je 0x14000dab9
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x1400184f8], rax
jmp 0x14000dac9
mov rax, qword [0x1400184f8]
jmp 0x14000dad0
mov rax, qword [0x1400184f8]
mov r11, qword [0x140018500]
cmp rax, rdi
je 0x14000db38
cmp r11, rdi
je 0x14000db38
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x140018500]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x14000db38
test rax, rax
je 0x14000db38
call rsi
test rax, rax
je 0x14000db32
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14000db32
test byte [rsp + 0x38], 1
jne 0x14000db38
bts ebp, 0x15
jmp 0x14000db76
mov rcx, qword [0x1400184e8]
cmp rcx, rdi
je 0x14000db76
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14000db76
call rax
mov rbx, rax
test rax, rax
je 0x14000db76
mov rcx, qword [0x1400184f0]
cmp rcx, rdi
je 0x14000db76
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14000db76
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1400184e0]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14000db97
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x14000db99
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14000ecab
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140017030]
jne 0x14000ba4a
rol rcx, 0x10
test cx, 0xffff
jne 0x14000ba46
repz ret
ror rcx, 0x10
jmp 0x14000ec04
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400185c0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x1400186b8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14000ec89
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400185c0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14000ecab
mov rax, qword [rsp + 0x88]
mov qword [0x1400186b8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140018658], rax
mov rax, qword [0x1400186b8]
mov qword [0x140018530], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140018640], rax
mov dword [0x140018520], 0xc0000409
mov dword [0x140018524], 1
mov rax, qword [0x140017030]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140017038]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1400185b8], eax
mov ecx, 1
call fcn.14000ba88
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140013348]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400185b8], 0
jne 0x14000ed32
mov ecx, 1
call fcn.14000ba88
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14025c4e0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push r14
mov r14, rcx
mov rsi, r8
mov rbp, rdx
sub r14, qword [r8 + 0x30]
je 0x14025c662
test byte [r8 + 0x5e], 0x40
jne 0x14025c50d
xor eax, eax
mov rbp, qword [rsp + 0x30]
pop r14
pop rsi
ret
movzx edx, word [rsi + 0x14]
movzx eax, word [rsi + 6]
add rdx, 0x18
mov r8d, dword [r8 + 0xb0]
add rdx, rsi
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp rdx, r9
jae 0x14025c662
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x14025c546
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x14025c55d
add rdx, 0x28
cmp rdx, r9
jb 0x14025c534
mov eax, 1
mov rbp, qword [rsp + 0x30]
pop r14
pop rsi
ret
mov qword [rsp + 0x18], rbx
mov ebx, dword [rdx + 0x14]
sub rbx, rcx
mov qword [rsp + 0x28], r15
mov r15d, dword [rsi + 0xb4]
add rbx, r8
add rbx, rbp
add r15, rbx
test rbx, rbx
je 0x14025c658
cmp rbx, r15
jae 0x14025c658
mov qword [rsp + 0x20], rdi
mov eax, dword [rbx + 4]
test eax, eax
je 0x14025c653
add eax, 0xfffffff8
shr eax, 1
je 0x14025c644
lea r11, [rbx + 8]
mov edi, eax
movzx r8d, word [r11]
movzx eax, r8w
shr ax, 0xc
and r8d, 0x80000fff
jge 0x14025c5d2
dec r8d
or r8d, 0xfffff000
inc r8d
cmp ax, 3
je 0x14025c5de
cmp ax, 0xa
jne 0x14025c636
movzx eax, word [rsi + 0x14]
movzx ecx, word [rsi + 6]
add rax, 0x18
mov r9d, dword [rbx]
add rax, rsi
lea rdx, [rcx + rcx*4]
lea r10, [rax + rdx*8]
cmp rax, r10
jae 0x14025c62b
nop dword [rax]
mov edx, dword [rax + 0xc]
cmp r9, rdx
jb 0x14025c612
mov ecx, dword [rax + 8]
add ecx, edx
cmp r9, rcx
jb 0x14025c61d
add rax, 0x28
cmp rax, r10
jb 0x14025c600
jmp 0x14025c62b
mov ecx, dword [rax + 0x14]
sub rcx, rdx
add rcx, r9
add rcx, rbp
jne 0x14025c62e
mov rcx, rbp
movzx eax, r8w
add qword [rax + rcx], r14
add r11, 2
sub rdi, 1
jne 0x14025c5b0
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, r15
jb 0x14025c594
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov r15, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov eax, 1
pop r14
pop rsi
ret
Function at 0x14025db3c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14025db86
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14025db86
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14025db86
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14025db86
cmp dword [rcx + 0x84], 0xe
jbe 0x14025db86
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14025db88
xor al, al
add rsp, 0x28
ret
Function at 0x140004907
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.1400123e0
mov r15, qword [0x14002048c]
cmp r15, 1
jne 0x1400049d6
push qword [0x14002057c]
pop rcx
call fcn.14000d5b4
mov r15, rax
and r15, r15
jle 0x14000496c
mov rcx, qword [0x14002057c]
call fcn.14000d5bc
mov rcx, qword [0x14002057c]
call fcn.14000d5d0
or rax, rax
je 0x14000496c
mov rbp, qword [0x140020584]
push qword [rbp + 0x10]
pop rcx
call fcn.14000da6c
jmp 0x140004949
push qword [0x14002056c]
pop rcx
call fcn.14000d5b4
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x1400049d6
push 5
push 0
push 1
push qword [0x14002056c]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140009070
mov rcx, qword [0x14002056c]
call fcn.14000d5bc
mov rcx, qword [0x14002056c]
call fcn.14000d5d0
or rax, rax
je 0x1400049d6
mov rbp, qword [0x140020574]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
jmp 0x1400049b3
mov rax, 1
jmp 0x1400049e2
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140006a58
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f190]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x14000720c
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.14000719c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021170]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400205b8]
jmp 0x140007248
cmp qword [rbx + 0x18], rdi
je 0x14000724f
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000723f
jmp 0x140007269
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x1400205b8]
call fcn.140011c68
lea rcx, [0x140021170]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
invalid
jmp rax
imul ebx
movsb byte [rdi], byte [rsi]
push rsi
jmp 0x14003f5de
invalid
out dx, eax
invalid
invalid
push 0x75ff6564
insd dword [rdi], dx
outsb dx, byte [rsi]
dec dword [rdi - 0x5c007e7c]
pop qword [rcx + rax*4 - 0x716b5c01]
pop qword [rcx + rax*4 - 0x716b5c01]
push qword [rcx - 0x4a006962]
lahf
xchg esi, eax
push qword [rsi - 0x4d00695c]
movabs dword [0xacbdff93a4b4ff92], eax
xchg edx, eax
push qword [rsp + riz*4 - 0x5342006d]
xchg edx, eax
push qword [rsp + riz*4 - 0x5342006d]
wait
dec edx
retf 0xa8b8
dec ebp
invalid
test al, 0xff
int 0xb9
test eax, 0xa7b7ccff
dec ebp
mov eax, 0xb8ceffa6
cmpsd dword [rsi], dword [rdi]
dec ebp
mov dh, 0xa2
call rbx
mov ebp, 0xbbd1ffa6
cmpsb byte [rsi], byte [rdi]
inc esi
mov cl, 0x9c
push qword [rcx - 0x61007562]
invalid