joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400021dc
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140004650], rbx
je 0x140002228
cmp rax, rbx
jne 0x14000221b
mov ebx, 1
mov esi, ebx
jmp 0x14000222d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002200
mov ebx, 1
mov eax, dword [0x140004658]
cmp eax, ebx
jne 0x140002243
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x1400022a8
mov eax, dword [0x140004658]
test eax, eax
jne 0x1400022a2
mov dword [0x140004658], ebx
lea r15, [0x1400033b0]
lea rdi, [0x140003398]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140002294
test eax, eax
jne 0x140002298
cmp qword [rdi], 0
je 0x140002289
mov rax, qword [rdi]
mov rcx, qword [0x140003378]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000226a
test eax, eax
je 0x1400022a8
mov eax, 0xff
jmp 0x140002384
mov dword [0x140004064], ebx
mov eax, dword [0x140004658]
cmp eax, ebx
jne 0x1400022cf
lea rdx, [0x140003390]
lea rcx, [0x140003380]
call sub.msvcrt.dll__initterm
mov dword [0x140004658], 2
test esi, esi
jne 0x1400022dc
xor eax, eax
xchg qword [0x140004650], rax
cmp qword [0x140004660], 0
je 0x140002310
lea rcx, [0x140004660]
call fcn.140002540
test eax, eax
je 0x140002310
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140004660]
mov r9, qword [0x140003378]
call r9
mov r8, qword [0x140004078]
mov rdx, qword [0x140004070]
mov ecx, dword [0x140004068]
call fcn.140001800
mov dword [0x140004060], eax
cmp dword [0x140004080], 0
jne 0x140002340
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140004064], 0
jne 0x140002355
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140004060]
jmp 0x140002384
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.140173000
add rsp, 0x28
jmp 0x1400021dc

Function at 0x140002450
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000249c
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140002494
cmp dword [rcx + 0x3c], edx
jl 0x140002494
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140002494
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14000249c
mov rax, rdx
add rsp, 0x18
ret
Function at 0x14002a370
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x10090
call fcn.14002ebf0
sub rsp, rax
mov rax, qword [0x14006d278]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx edx, byte [rcx]
lea rbx, [rsp + 0x30]
xor eax, eax
mov rsi, rcx
mov word [rsp + 0x80], ax
mov word [rsp + 0x30], ax
lea edi, [rax + 0x28]
test dl, dl
je 0x14002a432
nop dword [rax + rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x14002a3dd
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x14002a3d0
cmp rcx, 1
jb 0x14002a48a
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
nop word [rax + rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x14002a400
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.14003dd04
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x14002a3c0
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x14002a463
lea rcx, [rsp + 0x80]
call fcn.140040b44
jmp 0x14002a465
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.14002e920
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.140032ad8
int3
Function at 0x14002e4a0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x14006d278]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
lea rbx, [rsp + 0x30]
mov rbp, rdx
mov word [rsp + 0x30], ax
movzx edx, byte [rcx]
mov rsi, rcx
lea edi, [rax + 0x28]
test dl, dl
je 0x14002e545
nop dword [rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x14002e4fd
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x14002e4f0
cmp rcx, 1
jb 0x14002e576
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x14002e513
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.14003dd04
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x14002e4e0
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14002e920
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
call fcn.140032ad8
int3

Function at 0x14002e7b0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x14006d278]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx edx, byte [rcx]
lea rbx, [rsp + 0x30]
xor eax, eax
mov rsi, rcx
mov word [rsp + 0x30], ax
lea edi, [rax + 0x28]
test dl, dl
je 0x14002e855
nop dword [rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x14002e80d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x14002e800
cmp rcx, 1
jb 0x14002e887
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x14002e823
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.14003dd04
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x14002e7f0
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14002e920
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.140032ad8
int3

Function at 0x14002f368
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002f3b2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002f3b2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002f3b2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002f3b2
cmp dword [rcx + 0x84], 0xe
jbe 0x14002f3b2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002f3b4
xor al, al
add rsp, 0x28
ret
Function at 0x140034348
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400341b3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400341b3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400341b3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400341b3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400341b3
cmp dword [rcx + 0x84], 0xe
jbe 0x1400341b3
cmp dword [rcx + 0xf8], 0
je 0x1400341b3
mov ecx, ebx
call fcn.140034264
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140034040
nop
cmp dword [rbp + 0x20], 0
je 0x140034201
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14003420c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140034144
Function at 0x140045db0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140045e37
mov rsi, rbx
cmp word [rax], bp
je 0x140045df6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140045de0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140045ddc
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140041330
mov rdi, rax
test rax, rax
je 0x140045e24
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14002f710
mov rbp, rdi
xor ecx, ecx
call fcn.140041e78
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400499ac
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400499c2
mov al, 1
jmp 0x140049a22
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400499d3
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140049a20
mov ecx, dword [rcx + 0x18]
nop
call fcn.140046554
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140049a20
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140049a20
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140049a20
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140049a22
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x1400021e0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x140002206
mov r8, rdx
mov rdx, qword [rbx]
call fcn.140002d00
jmp 0x14000226d
cmp byte [0x14003dc08], 0
jne 0x14000224a
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000223a
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14003dc00], rax
jmp 0x140002241
mov rax, qword [0x14003dc00]
mov byte [0x14003dc08], 1
jmp 0x140002251
mov rax, qword [0x14003dc00]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x140002267
mov r8d, dword [rbx + 8]
xor r9d, r9d
call rax
jmp 0x14000226d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140002ab4
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x14003b610]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r9d, dword [rcx + 8]
xor eax, eax
mov rsi, rdx
mov r8, rdx
mov rdx, qword [rcx]
mov rdi, rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x40]
or r9d, 0x2001f
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x50], rax
call fcn.140002618
jmp 0x140002b2d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.140002ab4
mov ebx, eax
test eax, eax
jne 0x140002b97
mov rcx, qword [rsp + 0x40]
xor ebx, ebx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x58], pe_nt_image_headers64
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140002b1e
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140002b86
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbx
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x48], ebx
call fcn.1400021e0
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140002ba7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140012230
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002d00
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140002d63
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002d77
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140002d77
mov rcx, qword [rbx]
and qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
jmp 0x140002d7c
cmp dword [rcx + 8], 0
je 0x140002d77
mov rdx, r8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x140002d7c
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140002fac
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x14003b610]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov r14, r8
mov rbx, rdx
xor edi, edi
mov qword [rsp + 0x50], rdi
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], rdi
xor edx, edx
mov r8d, 0x408
lea rcx, [rsp + 0x70]
call fcn.1400113a0
mov qword [rsp + 0x70], rdi
xor edx, edx
lea r8d, [rdi + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140003057
xor edx, edx
lea r8d, [rdi + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140003057
call fcn.140001d74
mov ebx, eax
jmp 0x140003168
mov r8, r15
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x140003078
call fcn.140001d74
jmp 0x140003157
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000306e
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x1400030b3
mov ebx, 0x8007000e
jmp 0x140003159
mov ecx, eax
test eax, eax
je 0x1400030eb
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x1400030e1
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x1400030eb
lea rcx, [rsp + 0x70]
call fcn.140001c3c
jmp 0x1400030f5
mov ecx, 0x80070216
call fcn.140001ebc
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x140003107
cmp qword [rsp + 0x70], rdi
je 0x1400030a9
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, r14
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x14000306e
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], di
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x58]
call fcn.140002e44
mov ebx, eax
test rsi, rsi
je 0x140003168
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x14000317f
lea rcx, [rsp + 0x70]
call fcn.140002278
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.140012230
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400039a4
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
xor ebx, ebx
mov rdi, r8
mov rbp, rdx
mov r14, rcx
test r8, r8
jne 0x1400039d2
lea eax, [rbx + 0xd]
jmp 0x140003a07
mov rsi, r8
mov rcx, rsi
call fcn.140011688
inc eax
lea rsi, [rsi + rax*2]
lea ebx, [rbx + rax*2]
cmp eax, 1
jne 0x1400039d5
mov rcx, qword [r14]
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14000a0d4
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14003b610]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
xor ebx, ebx
cmp qword [rcx + 0x78], rbx
je 0x14000a22f
cmp byte [rcx + 0x81], bl
je 0x14000a22f
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
cmp eax, 0xffffffff
jne 0x14000a135
xor al, al
jmp 0x14000a234
mov qword [rbp - 0x18], SafeArrayGetDim
mov qword [rbp - 0x20], rbx
mov byte [rbp - 0x30], bl
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rbp - 0x30]
call fcn.14000a9bc
nop
mov esi, 1
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea r8, [rbp - 0x30]
cmovae r8, qword [rbp - 0x30]
mov rcx, qword [rdi + 0x78]
mov r10, qword [rcx]
mov r9, qword [rbp - 0x20]
add r9, rdx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x84]
call qword [r10 + 0x40]
mov ecx, eax
test eax, eax
je 0x14000a19f
dec ecx
jne 0x14000a20b
jmp 0x14000a1a5
mov byte [rdi + 0x81], bl
lea rax, [rbp - 0x30]
mov r9, qword [rbp - 0x30]
mov r10, qword [rbp - 0x18]
cmp r10, 0x10
cmovae rax, r9
mov r14, qword [rbp - 0x38]
sub r14, rax
je 0x14000a1e5
lea rcx, [rbp - 0x30]
cmp r10, 0x10
cmovae rcx, r9
mov r9, qword [rdi + 0x90]
mov r8, r14
mov rdx, rsi
call fcn.140012c48
cmp r14, rax
jne 0x14000a215
cmp byte [rdi + 0x81], bl
je 0x14000a212
test r14, r14
jne 0x14000a15a
xor r8d, r8d
lea edx, [r14 + 8]
lea rcx, [rbp - 0x30]
call fcn.14000a908
jmp 0x14000a15a
cmp ecx, 2
jne 0x14000a21b
jmp 0x14000a218
mov bl, sil
mov sil, bl
mov bl, sil
cmp qword [rbp - 0x18], 0x10
jb 0x14000a22b
mov rcx, qword [rbp - 0x30]
call fcn.140010800
mov al, bl
jmp 0x14000a234
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140012230
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000afc4
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x14003b610]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov esi, edx
mov rdi, rcx
or ebx, 0xffffffff
cmp edx, ebx
jne 0x14000b006
xor eax, eax
jmp 0x14000b1c5
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x14000b040
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
mov rcx, r8
add rcx, qword [rax]
cmp qword [rax], rcx
jae 0x14000b040
lea ecx, [r8 - 1]
mov dword [rdx], ecx
mov rdx, qword [rdi + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], sil
mov eax, esi
jmp 0x14000b1c5
cmp qword [rdi + 0x90], 0
je 0x14000b1c3
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x80]
cmp qword [r8], rax
jne 0x14000b078
mov rdx, qword [rdi + 0x70]
mov rcx, qword [rdi + 0x68]
mov qword [r8], rcx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
cmp qword [rdi + 0x78], 0
jne 0x14000b099
movsx ecx, sil
mov rdx, qword [rdi + 0x90]
call fcn.140012848
cmp eax, ebx
cmovne ebx, esi
jmp 0x14000b1c3
mov byte [rbp - 1], sil
mov qword [rbp + 0x1f], SafeArrayGetDim
and qword [rbp + 0x17], 0
mov byte [rbp + 7], 0
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rbp + 7]
call fcn.14000a9bc
nop
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 0x10
cmovae rdx, qword [rbp + 7]
lea r8, [rbp + 7]
cmovae r8, qword [rbp + 7]
mov rcx, qword [rdi + 0x78]
mov r10, qword [rcx]
add rdx, qword [rbp + 0x17]
lea rax, [rbp - 9]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r8
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
lea r9, [rbp]
lea r8, [rbp - 1]
lea rdx, [rdi + 0x84]
call qword [r10 + 0x38]
test eax, eax
js 0x14000b1b3
cmp eax, 1
jg 0x14000b199
lea rax, [rbp + 7]
mov r9, qword [rbp + 7]
mov r10, qword [rbp + 0x1f]
cmp r10, 0x10
cmovae rax, r9
mov r14, qword [rbp - 9]
sub r14, rax
je 0x14000b15f
lea rcx, [rbp + 7]
cmp r10, 0x10
cmovae rcx, r9
mov r9, qword [rdi + 0x90]
mov r8, r14
mov edx, 1
call fcn.140012c48
cmp r14, rax
jne 0x14000b1b3
mov byte [rdi + 0x81], 1
lea rax, [rbp - 1]
cmp qword [rbp - 0x11], rax
jne 0x14000b195
test r14, r14
jne 0x14000b0bf
cmp qword [rbp + 0x17], 0x20
jae 0x14000b1b3
xor r8d, r8d
lea edx, [r14 + 8]
lea rcx, [rbp + 7]
call fcn.14000a908
jmp 0x14000b0bf
mov ebx, esi
jmp 0x14000b1b3
cmp eax, 3
jne 0x14000b1b3
movsx ecx, byte [rbp - 1]
mov rdx, qword [rdi + 0x90]
call fcn.140012848
cmp eax, ebx
cmovne ebx, esi
cmp qword [rbp + 0x1f], 0x10
jb 0x14000b1c3
mov rcx, qword [rbp + 7]
call fcn.140010800
mov eax, ebx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140012230
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000ded4
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14003b610]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x50], rax
test rax, rax
je 0x14000df45
lea rax, [rsp + 0x30]
lea r8, [0x14000da4c]
mov r9, rbx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x14000df42
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rbx + 0x50], rdi
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140012230
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x14000e020
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp byte [0x14003dcd0], 0
mov esi, edx
mov rdi, rcx
je 0x14000e042
or eax, 0xffffffff
jmp 0x14000e0ad
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov ebx, eax
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x14000e06f
cmp eax, 0x80010106
jne 0x14000e0ab
lea rcx, str.Mscoree.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x14000e073
jmp 0x14000e0ab
mov byte [rdi + 0x62], 1
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [rsp + 0x40]
mov rcx, rdi
mov rdx, rax
call fcn.14000da8c
cmp al, 1
jne 0x14000e09b
mov edx, esi
mov rcx, rdi
call fcn.14000de40
mov ebx, eax
jmp 0x14000e09f
mov ebx, dword [rsp + 0x40]
cmp byte [rdi + 0x62], 0
je 0x14000e0ab
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x14003dd40]
mov edx, r9d
jmp 0x14000e020