joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e670
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0xa0
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov rax, qword [0x140076350]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
xor edi, edi
mov qword [r11 - 0x28], rdi
lea rax, [r11 - 0x28]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetVideoLog
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000e701
mov dword [rsp + 0x28], eax
lea rax, [0x14005ac28]
mov r8d, 0x7ca
mov qword [rsp + 0x20], rax
lea r9, str.GetVideoResourcePath
lea rdx, str.ControlPanelTool.cpp
mov ecx, 0x20
call fcn.140001e40
xor eax, eax
jmp 0x14000e861
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, str.VideoPath
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000e747
mov dword [rsp + 0x28], eax
lea rax, str.RegQueryValueEx_Length_faild__d__n
mov r8d, 0x7d4
jmp 0x14000e6dd
mov ecx, dword [rsp + 0x78]
call fcn.140019744
mov rdi, rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, str.VideoPath
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000e79c
mov dword [rsp + 0x28], eax
lea rax, str.RegQueryValueEx_Data_faild__d__n
mov r8d, 0x7dc
jmp 0x14000e6dd
mov r8, rdi
lea rdx, [0x14005acc8]
lea rcx, [rsp + 0x30]
call fcn.140004200
mov rdx, rax
mov rcx, rbx
call fcn.1400068d0
cmp qword [rsp + 0x48], 8
jb 0x14000e7cd
mov rcx, qword [rsp + 0x30]
call fcn.14001a538
mov rcx, rdi
call fcn.14001bae4
cmp qword [rbx + 0x18], 8
jb 0x14000e7e1
mov rax, qword [rbx]
jmp 0x14000e7e4
mov rax, rbx
mov qword [rsp + 0x30], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.140004970
nop
cmp qword [rax + 0x18], 0x10
jb 0x14000e80c
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
lea rax, [0x14005acd0]
mov qword [rsp + 0x20], rax
lea r9, str.GetVideoResourcePath
mov r8d, 0x7e4
lea rdx, str.ControlPanelTool.cpp
mov ecx, 0x10
call fcn.140001e40
nop
cmp qword [rsp + 0x70], 0x10
jb 0x14000e84e
mov rcx, qword [rsp + 0x58]
call fcn.14001a538
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14001c3b0
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
Function at 0x14000fc20
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub rsp, 0x258
mov rax, qword [0x140076350]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rax, [rsp + 0x30]
lea rdx, str.SYSTEMCurrentControlSetEnumPCIVEN_10DEDEV_DEDESUBSYS_0000DEDEREV_A2FFFF
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000fcf9
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x1f3
mov byte [rsp + 0x40], al
call fcn.14001c4c0
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
lea r9, [rsp + 0x38]
lea rdx, str.HardwareID
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov dword [rsp + 0x3c], 0x1f4
mov dword [rsp + 0x38], 7
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000fd13
mov dword [rsp + 0x28], eax
mov r8d, 0x291
lea rax, [0x140059d88]
lea r9, str.ModifyVedioHardwareID
lea rdx, str.ControlPanelTool.cpp
mov ecx, 0x20
mov qword [rsp + 0x20], rax
call fcn.140001e40
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14001c3b0
add rsp, 0x258
ret
xor ecx, ecx
lea r8, str.PCIVEN_10DEDEV_DEDESUBSYS_0000DEDEREV_A2
nop dword [rax]
movzx eax, word [rcx + r8]
lea rcx, [rcx + 2]
mov word [rsp + rcx + 0x3e], ax
test ax, ax
jne 0x14000fd20
mov r9d, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
lea rdx, str.HardwareID
xor r8d, r8d
mov dword [rsp + 0x28], 0x1f4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000fd79
mov dword [rsp + 0x28], eax
mov r8d, 0x29b
lea rax, [0x140059e20]
jmp 0x14000fcd1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14001c3b0
add rsp, 0x258
ret
Function at 0x14000fda0
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x50
mov rax, qword [0x140076350]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x68], rbp
xor ebp, ebp
lea r8, [rsp + 0x38]
lea rdx, str.SystemCurrentControlSetServices_vdiskbusBootParam
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x38], rbp
mov esi, ebp
mov edi, ebp
mov dword [rsp + 0x30], 0x1f4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x14000fe9c
mov qword [rsp + 0x60], rbx
mov ebx, dword [rsp + 0x30]
mov ecx, ebx
call fcn.14001b6b8
mov r8d, ebx
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.14001c4c0
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.DisplayMountVol
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rbx, qword [rsp + 0x60]
test eax, eax
jne 0x14000fe9c
mov ecx, 0x1f4
mov dword [rsp + 0x30], 0x1f4
call fcn.14001b6b8
xor edx, edx
mov r8d, 0x1f4
mov rcx, rax
mov rdi, rax
call fcn.14001c4c0
lea rdx, str.__c_mountvol_A:__s
mov r8, rsi
mov rcx, rdi
call fcn.14001a814
lea r8, str.cmd.exe
lea rdx, str.open
mov r9, rdi
xor ecx, ecx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000feb1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], rbp
mov rbp, qword [rsp + 0x68]
test rsi, rsi
je 0x14000fec3
mov rcx, rsi
call fcn.14001b678
mov rsi, qword [rsp + 0x70]
test rdi, rdi
je 0x14000fed5
mov rcx, rdi
call fcn.14001b678
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14001c3b0
add rsp, 0x50
pop rdi
ret

Function at 0x140010c60
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x178
mov rax, qword [0x140076350]
xor rax, rsp
mov qword [rsp + 0x160], rax
lea rax, [rsp + 0x30]
mov rbx, r9
mov rdi, r8
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140010cf4
lea rcx, [rsp + 0x51]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x50], al
call fcn.14001c4c0
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x140010cf8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x140010d2e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x40]
mov rcx, qword [rbx + 0x18]
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
test rcx, rcx
je 0x140010d48
mov rax, qword [rcx]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x38]
call qword [rax + 0x10]
mov eax, 1
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14001c3b0
add rsp, 0x178
pop rdi
pop rbx
ret
call fcn.1400199a8
int3
Function at 0x140010d50
Capabilities:
Modify service
Query service status
Start service

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x140076350]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rcx
test rcx, rcx
jne 0x140010d7b
or eax, 0xffffffff
jmp 0x140010f38
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov qword [rsp + 0xa8], rsi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x140010da3
lea eax, [rsi - 2]
jmp 0x140010f30
mov r8d, 0x37
mov rdx, rbx
mov rcx, rax
mov qword [rsp + 0xb0], rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
test rax, rax
jne 0x140010dcd
lea edi, [rax - 3]
jmp 0x140010f1d
xor edi, edi
or r9d, 0xffffffff
mov rcx, rax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 2]
or edx, r9d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x140010e12
lea edi, [rax - 4]
jmp 0x140010f14
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x140010e2c
lea edi, [rax - 5]
jmp 0x140010f14
mov eax, dword [rsp + 0x64]
cmp eax, 4
jne 0x140010e8a
lea r8, [rsp + 0x60]
lea edx, [rax - 3]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x140010e52
lea edi, [rax - 6]
jmp 0x140010f14
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140010ec5
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rsp + 0x64], 1
je 0x140010ec5
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x140010e64
jmp 0x140010ec5
cmp eax, 3
jne 0x140010ec5
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140010ec5
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rsp + 0x64], 1
je 0x140010ec5
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x140010ea1
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x140010edc
lea edi, [rax - 7]
jmp 0x140010f14
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140010f14
nop
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rsp + 0x64], 4
je 0x140010f14
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x140010ef0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
mov rdi, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14001c3b0
add rsp, 0x90
pop rbx
ret
Function at 0x140010f60
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140076350]
xor rax, rsp
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140010fd8
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.OpenProcessToken_Error__d
mov r8d, 0x8a9
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea r9, str.SetDebugPrivilege
lea rdx, str.ControlPanelTool.cpp
mov ecx, 0x20
call fcn.140001e40
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14001c3b0
add rsp, 0x68
ret
lea r8, [rsp + 0x38]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x14001100e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x8ae
mov dword [rsp + 0x28], eax
lea rax, str.LookupPrivilegeValue_Error__d
mov qword [rsp + 0x20], rax
jmp 0x140010fac
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x44], rax
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x4c], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x14001106e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x8b6
mov dword [rsp + 0x28], eax
lea rax, str.AdjustTokenPrivilege_Errro__d
mov qword [rsp + 0x20], rax
jmp 0x140010fac
mov al, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14001c3b0
add rsp, 0x68
ret

Function at 0x140011090
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x70
mov rax, qword [0x140076350]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor edi, edi
lea rax, [rsp + 0x5c]
lea rdx, str.SOFTWAREControlPannelTool
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x5c], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14001112b
lea rax, str.Create_Regkey_Faild
lea r9, str.SetProgramExecutedFlag
lea rdx, str.ControlPanelTool.cpp
lea ecx, [rdi + 0x20]
mov r8d, 0x2ad
mov qword [rsp + 0x20], rax
call fcn.140001e40
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14001c3b0
add rsp, 0x70
pop rdi
ret
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
lea rdx, str.State
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x80], rbx
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov rbx, qword [rsp + 0x80]
sete dil
mov eax, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14001c3b0
add rsp, 0x70
pop rdi
ret
Function at 0x1400118a0
Capabilities:
Query service status
Stop service

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140076350]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
test rcx, rcx
jne 0x1400118d3
or eax, 0xffffffff
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14001c3b0
add rsp, 0x50
pop rbx
ret
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov qword [rsp + 0x68], rsi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x1400118f8
lea eax, [rsi - 2]
jmp 0x140011a03
mov r8d, 0x37
mov rdx, rbx
mov rcx, rax
mov qword [rsp + 0x70], rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
test rax, rax
jne 0x14001191f
lea edi, [rax - 3]
jmp 0x1400119f3
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x140011939
lea edi, [rax - 4]
jmp 0x1400119ea
mov ecx, dword [rsp + 0x24]
lea eax, [rcx - 2]
test eax, 0xfffffffd
je 0x140011996
cmp ecx, 3
jne 0x1400119e8
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1400119e8
nop word [rax + rax]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rsp + 0x24], 1
je 0x1400119e8
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x140011970
jmp 0x1400119e8
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x1400119b2
lea edi, [rax - 5]
jmp 0x1400119ea
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1400119e8
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rsp + 0x24], 1
je 0x1400119e8
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x1400119c4
xor edi, edi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14001c3b0
add rsp, 0x50
pop rbx
ret
Function at 0x14002a774
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14002a78a
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14002a78c
xor eax, eax
test eax, eax
je 0x14002a79c
mov ecx, eax
call fcn.14001b5b8
or eax, 0xffffffff
jmp 0x14002a79e
xor eax, eax
add rsp, 0x28
ret

Function at 0x14002a7a4
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14002a7bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14002a7be
xor eax, eax
test eax, eax
je 0x14002a7ce
mov ecx, eax
call fcn.14001b5b8
or eax, 0xffffffff
jmp 0x14002a7d0
xor eax, eax
add rsp, 0x28
ret
Function at 0x140039f64
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140039f77
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x20]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.14003a5d0
lea rdx, [0x140073b40]
lea rcx, [rsp + 0x20]
call fcn.14001bb4c
int3

Function at 0x140044438
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x14007b404]
xor edx, edx
jmp fcn.140039f64

Function at 0x140044de0
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x14007b404]
jmp fcn.140039f64

Function at 0x140044f00
Capabilities:
Get thread local storage value

Disassembly:
mov rcx, qword [rcx + 0x40]
jmp 0x140050458
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov r13, r9
mov r12, r8
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov qword [rax + 8], rcx
call fcn.14003a328
nop
mov edi, dword [rbx + 4]
mov esi, dword [rbx + 4]
dec esi
mov eax, dword [rbx]
cmp esi, eax
jl 0x140050432
lea ebp, [rsi + 1]
movsxd r15, esi
movsxd rcx, dword [rbx + 8]
and rcx, r15
mov rax, qword [rbx + 0x20]
mov r14, qword [rax + rcx*8]
test r14, r14
je 0x140050428
mov rdx, r12
mov rcx, r14
call qword [rsp + 0x78]
test al, al
je 0x140050428
mov rdx, r12
mov rcx, r14
call r13
test al, al
je 0x140050428
cmp ebp, edi
jne 0x140050418
dec edi
jmp 0x140050428
movsxd rcx, dword [rbx + 8]
and rcx, r15
mov rax, qword [rbx + 0x20]
and qword [rax + rcx*8], 0
dec esi
dec ebp
mov eax, dword [rbx]
cmp esi, eax
jge 0x1400503de
xchg dword [rbx + 4], edi
mov rcx, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp fcn.14003a370
add rcx, 0xb0
jmp 0x140050394

Function at 0x14005025c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r9, qword [rdx + 0x1a8]
mov r8, rcx
mov r9, qword [r9 + 8]
lea rdx, [0x140050318]
add rcx, 0x40
jmp fcn.140041db4

Function at 0x1400502f0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r9, qword [rdx + 0x1a8]
mov r8, rcx
mov r9, qword [r9 + 8]
lea rdx, [0x140050328]
add rcx, 0x40
jmp fcn.140041db4
Function at 0x14008b5a0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14008b5cd
xor al, al
jmp 0x14008b72f
mov rax, qword [0x1400ab6b0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1400ab6b8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1400ab6c0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1400ab6c8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1400ab6d0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1400ab6d8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1400ab6e0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1400ab6e8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x1400ab6f0]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x14008b721
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x14008b679
mov r11d, 2
jmp 0x14008b69d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x14008b693
mov r11d, 1
jmp 0x14008b69d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x14008b745
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14008b6e2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14008b6fa
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14008b70a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x14008b718
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x14008b660
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14008b72a

Function at 0x14009d510
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
neg rcx
test rax, 7
je 0x14009d52d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x14009d588
test al, 7
jne 0x14009d520
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x14009d541
mov rdx, qword [rax - 8]
test dl, dl
je 0x14009d5b2
test dh, dh
je 0x14009d5ac
shr rdx, 0x10
test dl, dl
je 0x14009d5a6
test dh, dh
je 0x14009d5a0
shr rdx, 0x10
test dl, dl
je 0x14009d59a
test dh, dh
je 0x14009d594
shr edx, 0x10
test dl, dl
je 0x14009d58e
test dh, dh
jne 0x14009d541
lea rax, [rcx + rax - 1]
ret
lea rax, [rcx + rax - 2]
ret
lea rax, [rcx + rax - 3]
ret
lea rax, [rcx + rax - 4]
ret
lea rax, [rcx + rax - 5]
ret
lea rax, [rcx + rax - 6]
ret
lea rax, [rcx + rax - 7]
ret
lea rax, [rcx + rax - 8]
ret
Function at 0x140436539
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
movzx eax, sp
push rdi
movsx si, r12b
movsxd rax, r14d
bswap eax
push rbp
mov sil, r13b
cmovne eax, edi
not sil
push rdx
movsx rax, r13w
cqo
push r11
push rcx
cwde
push rbx
rdtsc
cqo
push r9
movsx eax, r14w
push r8
push r13
jmp 0x1404434dd
ror edx, 3
stc
cmc
neg edx
test r11w, r10w
test r10d, 0x74881bcc
xor edx, 0xfd37441
jmp 0x14042eb78
ror edx, 3
test bl, sil
push r8
add r8w, ax
bt r8w, r12w
xor dword [rsp], edx
pop r8
movsxd rdx, edx
test bl, r8b
add r11, rdx
jmp r11
push rax
movzx eax, bx
movsx eax, r9w
jmp 0x14032c5d8
push r12
not dl
movsx edx, r11w
movzx r11w, r13b
pushfq
push r14
rdtsc
push r10
push r15
movabs rcx, 0
bts dx, bx
push rcx
bts si, r12w
movsx rdx, cx
mov rsi, qword [rsp + 0x90]
lahf
btr r11, r11
bt bx, bx
rol esi, 3
shr r8d, cl
shl r8w, cl
bswap esi
btc edx, 0xfa
not esi
neg esi
sbb bl, al
ror r8w, cl
cmovno rbx, rax
lea rsi, [rsi + rcx]
adc cx, 0x69f6
movabs rax, 0x100000000
ror rbx, cl
bt dx, 0x84
adc ecx, 0x5815532
add rsi, rax
cwd
mov rbx, rsp
shr r11b, 0xc5
stc
sub rsp, 0x180
xadd dl, r8b
and rsp, 0xfffffffffffffff0
dec r11b
mov r8, rsi
or dx, ax
cmovno rdx, rdi
movabs rcx, 0
sar r11b, 0x89
inc r11b
sub r8, rcx
sbb rdx, 0x3b0d3b77
ror r11, cl
bts r11w, si
lea r11, [0x1404435aa]
dec edx
ror rdx, cl
mov edx, dword [rsi]
cmp r8d, r11d
add rsi, 4
xor edx, r8d
cmc
jmp 0x140403604
Function at 0x140a54c19
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror edx, 3
stc
cmc
neg edx
test r11w, r10w
test r10d, 0x74881bcc
xor edx, 0xfd37441
jmp 0x1409cf3b2
ror edx, 3
test bl, sil
push r8
add r8w, ax
bt r8w, r12w
xor dword [rsp], edx
pop r8
movsxd rdx, edx
test bl, r8b
add r11, rdx
jmp r11
push rsi
movzx eax, sp
push rdi
movsx si, r12b
movsxd rax, r14d
bswap eax
push rbp
mov sil, r13b
cmovne eax, edi
not sil
push rdx
movsx rax, r13w
cqo
push r11
push rcx
cwde
push rbx
rdtsc
cqo
push r9
movsx eax, r14w
push r8
push r13
jmp 0x140a4ee03
push r12
not dl
movsx edx, r11w
movzx r11w, r13b
pushfq
push r14
rdtsc
push r10
push r15
movabs rcx, 0
bts dx, bx
push rcx
bts si, r12w
movsx rdx, cx
mov rsi, qword [rsp + 0x90]
lahf
btr r11, r11
bt bx, bx
rol esi, 3
shr r8d, cl
shl r8w, cl
bswap esi
btc edx, 0xfa
not esi
neg esi
sbb bl, al
ror r8w, cl
cmovno rbx, rax
lea rsi, [rsi + rcx]
adc cx, 0x69f6
movabs rax, 0x100000000
ror rbx, cl
bt dx, 0x84
adc ecx, 0x5815532
add rsi, rax
cwd
mov rbx, rsp
shr r11b, 0xc5
stc
sub rsp, 0x180
xadd dl, r8b
and rsp, 0xfffffffffffffff0
dec r11b
mov r8, rsi
or dx, ax
cmovno rdx, rdi
movabs rcx, 0
sar r11b, 0x89
inc r11b
sub r8, rcx
sbb rdx, 0x3b0d3b77
ror r11, cl
bts r11w, si
lea r11, [0x140a4eed0]
dec edx
ror rdx, cl
mov edx, dword [rsi]
cmp r8d, r11d
add rsi, 4
xor edx, r8d
cmc
jmp 0x1409b9ec4
push rax
movzx eax, bx
movsx eax, r9w
jmp 0x140a49146