joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140092262
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x1400c8108]
test eax, eax
je 0x1400922fa
lea rax, [0x1400c80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x1400c8110]
mov qword [rbp - 8], rax
jmp 0x1400922de
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1400922d2
cmp qword [rbp - 0x10], 0
je 0x1400922d2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140092298
lea rax, [0x1400c80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1400922fb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140092400
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140092428
mov eax, 0
jmp 0x140092476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140092451
mov eax, 0
jmp 0x140092476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140092471
mov eax, 0
jmp 0x140092476
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x14009247c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1400924fa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1400924f1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1400924f1
mov rax, qword [rbp - 8]
jmp 0x14009250f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x1400924c4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1000026d0
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0xe0]
mov qword [rbp - 8], rcx
mov qword [rbp - 0xa8], 0
mov qword [rbp - 0xa0], 0
mov qword [rbp - 0x98], 0
mov qword [rbp - 0x90], 0
mov qword [rbp - 0x88], 0
mov qword [rbp - 0x80], 0
mov qword [rbp - 0x78], 0
mov qword [rbp - 0x70], 0
mov qword [rbp - 0x68], 0
mov qword [rbp - 0x28], 0
nop
lea rcx, [rbp - 0x28]
call fcn.100006d40
mov eax, 0x6f
lea rcx, [rbp - 0x68]
mov edx, eax
call dbg.ERASKETCH
mov rax, qword [rbp - 0x68]
mov qword [rbp - 0x60], rax
mov edx, 0x79
lea rcx, [rbp - 0x70]
call dbg.ERASKETCH
mov rax, qword [rbp - 0x70]
mov qword [rbp - 0x58], rax
mov edx, 0x70
lea rcx, [rbp - 0x78]
call dbg.ERASKETCH
mov rax, qword [rbp - 0x78]
mov qword [rbp - 0x50], rax
mov edx, 0x93
lea rcx, [rbp - 0x80]
call dbg.ERASKETCH
mov rax, qword [rbp - 0x80]
mov qword [rbp - 0x48], rax
mov edx, 0x71
lea rcx, [rbp - 0x88]
call dbg.ERASKETCH
mov rax, qword [rbp - 0x88]
mov qword [rbp - 0x40], rax
mov edx, 0x84
lea rcx, [rbp - 0x90]
call dbg.ERASKETCH
mov rax, qword [rbp - 0x90]
mov qword [rbp - 0x38], rax
mov edx, 0x71
lea rcx, [rbp - 0x98]
call dbg.ERASKETCH
mov rax, qword [rbp - 0x98]
mov qword [rbp - 0x30], rax
lea rdx, [rbp - 0x60]
xor r9d, r9d
mov r8d, 6
lea rcx, [rbp - 0x28]
call fcn.1000071b0
mov rax, qword [rbp - 0x28]
test rax, rax
jne 0x10000281d
lea rax, [0x100028570]
mov qword [rbp - 0x10], rax
mov ecx, dword [0x10001a160]
call dbg.LAYERILLEGALDUMB
mov qword [rbp - 0x18], rax
mov ecx, dword [0x10001a160]
call dbg.IRONCOACHREMOVE
mov qword [rbp - 0x20], rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
lea rcx, [rbp - 0xa0]
call fcn.100006d40
mov rdx, qword [rbp - 0x20]
xor r8d, r8d
lea rcx, [rbp - 0xa8]
call fcn.100007830
mov rdx, qword [rbp - 0xa8]
mov r8, qword [rbp - 8]
xor r9d, r9d
lea rcx, [rbp - 0xa0]
call fcn.100006ee0
mov r9, qword [rbp - 0xa0]
test r9, r9
jne 0x10000289c
lea r9, [0x100028570]
mov r8, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x18]
xor ecx, ecx
call sub.shell32.dll_ShellExecuteA
nop
mov rcx, rbp
call dbg.fin$00000093
nop
lea rsp, [rbp]
pop rbp
ret
Function at 0x10000c590
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
push rdi
push rsi
lea rsp, [rsp - 0x20]
mov ax, word [0x10001a4b0]
cmp ax, 0xcb
je 0x10000c6cc
cmp ax, 0xcc
je 0x10000c6cc
nop
mov rax, qword [0x100028ae0]
test rax, rax
je 0x10000c5cd
mov ecx, dword [0x1000288d0]
call rax
mov rbx, rax
jmp 0x10000c5d4
lea rbx, [0x1000288d8]
cmp word [0x1000288c0], 0
jle 0x10000c5fc
lea rcx, [0x100028890]
call fcn.10000c8b0
mov rcx, rbx
call fcn.10000c050
mov rcx, rbx
call fcn.10000c0e0
nop
mov rsi, qword [rbx]
jmp 0x10000c629
mov rdi, qword [rsi + 8]
mov rax, qword [rsi]
and rax, 1
jne 0x10000c622
mov rdx, rsi
mov rcx, rbx
call fcn.10000b2d0
jmp 0x10000c626
and qword [rsi], 0xfffffffffffffffe
mov rsi, rdi
test rsi, rsi
jne 0x10000c608
mov qword [rbx], 0
mov dword [rbx + 0x90], 0
cmp word [0x1000288c0], 0
jle 0x10000c6cc
lea rdx, [0x1000287a0]
mov rcx, rbx
call fcn.10000b450
mov rsi, rax
test rax, rax
je 0x10000c698
mov rax, qword [0x100028840]
mov qword [rsi + 0x18], rax
cmp qword [0x100028840], 0
je 0x10000c688
mov rax, qword [0x100028840]
mov qword [rax + 0x10], rsi
nop dword [rax]
mov rax, qword [rbx + 0xa0]
mov qword [0x100028840], rax
nop
sub word [0x1000288c0], 1
cmp word [0x1000288c0], 0
sete bl
lea rcx, [0x100028890]
call fcn.10000c8d0
test bl, bl
je 0x10000c6cc
lea rcx, [0x100028890]
call fcn.10000c890
nop dword [rax]
nop
lea rsp, [rsp + 0x20]
pop rsi
pop rdi
pop rbx
ret
Function at 0x10000f690
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push rsi
push r12
push r13
push r14
lea rsp, [rsp - 0x128]
xor esi, esi
mov qword [0x1000284b0], 0
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x24]
mov r8d, 0x104
xor ecx, ecx
call sub.kernel32.dll_GetModuleFileNameA
mov ebx, eax
and eax, eax
mov byte [rsp + rax + 0x24], 0
mov r8d, ebx
xor edx, edx
mov rcx, rsp
call fcn.10000f870
movsxd rax, ebx
lea r8, [rax + 1]
mov rax, qword [0x1000284b0]
mov rdx, qword [rax]
lea rcx, [rsp + 0x24]
call fcn.100003e90
call sub.kernel32.dll_GetCommandLineA
mov qword [0x10001a520], rax
mov r14, rax
jmp 0x10000f817
add r14, 1
movzx eax, byte [r14]
sub eax, 1
cmp eax, 0x20
jb 0x10000f718
cmp byte [r14], 0
je 0x10000f821
nop
xor dil, dil
mov r12, r14
xor ebx, ebx
jmp 0x10000f780
mov al, byte [r14]
cmp al, 1
jb 0x10000f778
sub al, 0x20
jbe 0x10000f754
sub al, 2
je 0x10000f760
jmp 0x10000f778
test dil, dil
je 0x10000f786
add ebx, 1
jmp 0x10000f77c
cmp byte [r14 + 1], 0x22
je 0x10000f770
test dil, dil
sete dil
jmp 0x10000f77c
add r14, 1
jmp 0x10000f77c
add ebx, 1
nop
add r14, 1
cmp byte [r14], 0
jne 0x10000f740
test esi, esi
je 0x10000f814
mov r8d, ebx
mov edx, esi
mov rcx, rsp
call fcn.10000f870
xor dil, dil
mov r14, r12
mov rdx, qword [0x1000284b0]
movsxd rax, esi
mov r13, qword [rdx + rax*8]
jmp 0x10000f808
mov al, byte [r14]
cmp al, 1
jb 0x10000f7f8
sub al, 0x20
jbe 0x10000f7cc
sub al, 2
je 0x10000f7e0
jmp 0x10000f7f8
test dil, dil
je 0x10000f80e
mov al, byte [r14]
mov byte [r13], al
add r13, 1
jmp 0x10000f804
cmp byte [r14 + 1], 0x22
je 0x10000f7f0
test dil, dil
sete dil
jmp 0x10000f804
add r14, 1
jmp 0x10000f804
mov al, byte [r14]
mov byte [r13], al
add r13, 1
nop
add r14, 1
cmp byte [r14], 0
jne 0x10000f7b8
mov byte [r13], 0
nop
add esi, 1
cmp byte [r14], 0
jne 0x10000f71c
mov dword [0x1000284a0], esi
movsxd rax, esi
lea rdx, [rax + 1]
shl rdx, 3
lea rcx, [0x1000284b0]
call fcn.10000c370
mov rax, qword [0x1000284b0]
movsxd rsi, esi
mov qword [rax + rsi*8], 0
nop
lea rsp, [rsp + 0x128]
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
ret

Function at 0x1000131d0
Capabilities:
Hash data with crc32

Disassembly:
mov dx, 0xffff
nop dword [rax]
add dx, 1
movsx eax, dx
mov ecx, eax
xor r8w, r8w
nop
add r8w, 1
mov eax, ecx
and eax, 1
je 0x100013202
mov eax, ecx
shr eax, 1
xor eax, 0xedb88320
mov ecx, eax
jmp 0x100013204
shr ecx, 1
cmp r8w, 8
jl 0x1000131e8
movzx eax, dx
lea r9, [0x1001318d0]
mov dword [r9 + rax*4], ecx
cmp dx, 0xff
jl 0x1000131d8
ret

Function at 0x100013230
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rdi
push rsi
lea rsp, [rsp - 0x20]
mov ebx, ecx
mov rsi, rdx
mov edi, r8d
cmp dword [0x1001318d4], 0
jne 0x100013250
call fcn.1000131d0
nop
mov eax, ebx
not eax
cmp edi, 1
jl 0x10001328c
xor edx, edx
nop dword [rax + rax]
add edx, 1
mov cl, al
xor cl, byte [rsi]
and ecx, 0xff
mov r8d, eax
shr r8d, 8
lea r9, [0x1001318d0]
xor r8d, dword [r9 + rcx*4]
mov eax, r8d
add rsi, 1
cmp edi, edx
jg 0x100013260
nop
not eax
nop
lea rsp, [rsp + 0x20]
pop rsi
pop rdi
pop rbx
ret
Function at 0x100017cd0
Capabilities:
Get geographical location

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x50]
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], r13
mov rsi, rcx
mov edi, edx
mov r12d, r8d
mov r13, r9
mov qword [rbp - 8], 0
nop
mov edx, r12d
mov ecx, edi
xor r9d, r9d
xor r8, r8
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
test ebx, ebx
jle 0x100017d51
movsxd rdx, ebx
sub rdx, 1
lea rcx, [rbp - 8]
call fcn.100008f20
cmp ebx, 1
jle 0x100017d40
mov r8, qword [rbp - 8]
mov r9d, ebx
mov edx, r12d
mov ecx, edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
nop
mov rcx, rsi
mov rdx, qword [rbp - 8]
xor r8d, r8d
call fcn.100008b80
jmp 0x100017d5c
mov rcx, rsi
mov rdx, r13
call fcn.100006dc0
nop
mov rcx, rbp
call fcn.100017cb0
mov rbx, qword [rbp - 0x30]
mov rdi, qword [rbp - 0x28]
mov rsi, qword [rbp - 0x20]
mov r12, qword [rbp - 0x18]
mov r13, qword [rbp - 0x10]
lea rsp, [rbp]
pop rbp
ret

Function at 0x100017f40
Capabilities:
Get geographical location

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x60]
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], 0
nop
xor ebx, ebx
nop dword [rax]
add ebx, 1
mov eax, ebx
lea rdx, [0x100131ee0]
lea rcx, [rdx + rax*8 - 8]
xor edx, edx
call fcn.100006dc0
mov eax, ebx
lea rdx, [0x100131f20]
mov dword [rdx + rax*4 - 4], 0xffffffff
cmp ebx, 7
jl 0x100017f60
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
lea r8, [rbp - 0xc]
mov ecx, esi
mov r9d, 0xb
mov edx, 0x100b
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x100018014
nop
mov byte [rsp + 0x20], 1
lea rdx, [rbp - 0xc]
xor r9d, r9d
mov r8d, 0xa
lea rcx, [rbp - 0x18]
call fcn.1000078e0
mov rcx, qword [rbp - 0x18]
mov edx, 1
call fcn.100013ad0
mov ebx, eax
sub eax, 3
cmp eax, 3
jae 0x100018014
lea rcx, [0x100017de0]
mov r8d, ebx
mov edx, esi
mov r9d, 4
call sub.kernel32.dll_EnumCalendarInfoA
lea rcx, [0x100017e90]
mov r8d, ebx
mov edx, esi
mov r9d, 3
call sub.kernel32.dll_EnumCalendarInfoA
nop dword [rax]
nop
mov rcx, rbp
call fcn.100017f20
mov rbx, qword [rbp - 0x28]
mov rsi, qword [rbp - 0x20]
lea rsp, [rbp]
pop rbp
ret
Function at 0x1000186d0
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x70]
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r13
mov rbx, rcx
mov qword [rbp - 8], 0
mov qword [rbp - 0x10], 0
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0
nop
lea rcx, [rbp - 0x18]
call fcn.100013ab0
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp - 8]
call fcn.100006dc0
lea rcx, [rbp - 8]
mov r8b, 1
mov edx, 1
call fcn.100008460
mov rcx, rbx
xor edx, edx
call fcn.100006dc0
call sub.kernel32.dll_GetEnvironmentStringsA
mov rsi, rax
mov rdi, rsi
jmp 0x100018815
mov rdx, rdi
lea rcx, [rbp - 0x10]
xor r8d, r8d
call fcn.100007830
mov rax, qword [rbp - 0x10]
test rax, rax
je 0x10001877c
mov rax, qword [rax - 8]
mov r13d, eax
lea rcx, [rbp - 0x10]
xor r8b, r8b
mov edx, 1
call fcn.100008460
mov rdx, qword [rbp - 0x10]
mov r8d, 1
mov ecx, 0x3d
call fcn.100007ef0
mov r12d, eax
movsxd r9, eax
sub r9, 1
mov rdx, qword [rbp - 0x10]
mov r8d, 1
lea rcx, [rbp - 0x28]
call fcn.100007d80
mov rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x20]
call fcn.100013ab0
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 8]
call fcn.100007aa0
test rax, rax
jne 0x100018808
mov r9, qword [rbp - 0x10]
test r9, r9
je 0x1000187ed
mov r9, qword [r9 - 8]
movsxd rax, r12d
sub r9, rax
movsxd rax, r12d
lea r8, [rax + 1]
mov rcx, rbx
mov rdx, qword [rbp - 0x10]
call fcn.100007d80
jmp 0x10001881e
movsxd rax, r13d
add rax, rdi
add rax, 1
mov rdi, rax
cmp byte [rdi], 0
jne 0x100018760
mov rcx, rsi
call sub.kernel32.dll_FreeEnvironmentStringsA
nop
mov rcx, rbp
call fcn.100018690
mov rbx, qword [rbp - 0x50]
mov rdi, qword [rbp - 0x48]
mov rsi, qword [rbp - 0x40]
mov r12, qword [rbp - 0x38]
mov r13, qword [rbp - 0x30]
lea rsp, [rbp]
pop rbp
ret

Function at 0x100018870
Capabilities:
Check os version

Disassembly:
lea rsp, [rsp - 0xb8]
mov qword [0x100131f60], 0
mov dword [rsp + 0x20], 0x94
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_GetVersionExA
mov eax, dword [rsp + 0x30]
mov dword [0x100131da0], eax
mov eax, dword [rsp + 0x24]
mov dword [0x100131db0], eax
mov eax, dword [rsp + 0x28]
mov dword [0x100131dc0], eax
mov eax, dword [rsp + 0x2c]
mov dword [0x100131dd0], eax
lea rdx, [0x100131de1]
lea rcx, [rsp + 0x34]
mov r8d, pe_nt_image_headers64
call fcn.100003e90
lea rcx, [rsp + 0x34]
call fcn.100004ac0
mov byte [0x100131de0], al
lea rcx, str.kernel32
call sub.kernel32.dll_GetModuleHandleA
mov qword [0x100131f70], rax
test rax, rax
je 0x100018918
mov rcx, qword [0x100131f70]
lea rdx, str.GetDiskFreeSpaceExA
call sub.kernel32.dll_GetProcAddress
mov qword [0x100131f60], rax
nop
cmp dword [0x100131db0], 6
jae 0x10001892c
mov dword [0x10001acc0], 0
nop
cmp dword [0x100131db0], 6
jb 0x100018948
cmp dword [0x100131dc0], 1
jb 0x100018948
mov dword [0x10001acd0], 2
nop
lea rsp, [rsp + 0xb8]
ret
Function at 0x140005610
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov eax, dword [rcx + 0x48]
lea rbx, [rcx + 0x28]
mov rdi, qword [rcx]
lea r11, [rcx + 0x28]
add rbx, rax
mov r9, rcx
movabs rbp, 0xc2b2ae3d27d4eb4f
movabs rsi, 0x9e3779b185ebca87
movabs r14, 0x27d4eb2f165667c5
movabs r15, 0x7a1435883d4d519d
cmp rdi, 0x20
jb 0x140005709
mov r8, qword [r9 + 0x18]
mov rdx, qword [rcx + 8]
mov rax, r8
mov r9, qword [r9 + 0x20]
mov rcx, qword [rcx + 0x10]
mov r10, r9
rol r10, 0x12
rol rax, 0xc
add r10, rax
mov rax, rcx
rol rax, 7
add r10, rax
mov rax, rdx
rol rax, 1
add r10, rax
movabs rax, 0x85ebca77c2b2ae63
imul rdx, rbp
imul rcx, rbp
imul r8, rbp
imul r9, rbp
rol rdx, 0x1f
imul rdx, rsi
rol rcx, 0x1f
xor r10, rdx
rol r8, 0x1f
imul r10, rsi
imul rcx, rsi
imul r8, rsi
sub r10, r15
rol r9, 0x1f
xor r10, rcx
imul r10, rsi
imul r9, rsi
sub r10, r15
xor r10, r8
imul r10, rsi
sub r10, r15
xor r10, r9
imul r10, rsi
add rax, r10
add rax, rdi
jmp 0x140005711
lea rax, [rdi + r14]
add rax, qword [rcx + 0x18]
lea rdx, [r11 + 8]
cmp rdx, rbx
ja 0x14000574a
nop word [rax + rax]
mov rcx, qword [r11]
add rdx, 8
imul rcx, rbp
add r11, 8
rol rcx, 0x1f
imul rcx, rsi
xor rax, rcx
rol rax, 0x1b
imul rax, rsi
sub rax, r15
cmp rdx, rbx
jbe 0x140005720
lea rdx, [r11 + 4]
movabs r8, 0x165667b19e3779f9
cmp rdx, rbx
ja 0x140005775
mov ecx, dword [r11]
mov r11, rdx
imul rcx, rsi
xor rax, rcx
rol rax, 0x17
imul rax, rbp
add rax, r8
cmp r11, rbx
jae 0x14000579b
nop word [rax + rax]
movzx ecx, byte [r11]
inc r11
imul rcx, r14
xor rax, rcx
rol rax, 0xb
imul rax, rsi
cmp r11, rbx
jb 0x140005780
mov rbx, qword [rsp + 0x18]
mov rcx, rax
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
shr rcx, 0x21
xor rcx, rax
imul rcx, rbp
mov rbp, qword [rsp + 0x20]
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
ret

Function at 0x14000b050
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, r8
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000b095
xor al, al
jmp 0x14000b0e2
cmp word [rbx], 0
je 0x14000b0ad
nop dword [rax + rax]
add rbx, 2
dec rdi
cmp word [rbx], 0
jne 0x14000b0a0
cmp word [rsp + 0x30], 0
je 0x14000b0db
lea rcx, [rsp + 0x30]
sub rcx, rbx
nop dword [rax]
cmp rdi, 1
jb 0x14000b103
movzx eax, word [rcx + rbx]
dec rdi
mov word [rbx], ax
add rbx, 2
cmp word [rcx + rbx], 0
jne 0x14000b0c0
xor eax, eax
mov word [rbx], ax
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000d120
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
call fcn.140010acc
int3
Function at 0x14000b1d0
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
movzx eax, cl
mov rcx, qword [0x140031b00]
test rcx, rcx
je 0x14000b241
test al, al
je 0x14000b216
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
test eax, eax
jne 0x14000b20f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_send_CTRL_C_to_child_process.
call fcn.14000c2c0
mov rcx, qword [0x140031b00]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000b234
mov rcx, qword [0x140031b00]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x140031b00]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x140031b0c], 0
je 0x14000b339
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x140025b70]
mov qword [rsp + 0x80], rsi
lea rsi, [0x140040390]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000b31a
test al, 0x10
je 0x14000b31a
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000b2c0
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x14000c460
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
mov edi, 0x28
test al, al
je 0x14000c511
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.140010e00
cmp rax, 1
jne 0x14000c547
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x14000c4ed
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x14000c4e0
cmp rcx, 1
jb 0x14000c547
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x14000c4b0
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14000d120
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.140010acc
int3
Function at 0x14000d9e0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000da2a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000da2a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000da2a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000da2a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000da2a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000da2c
xor al, al
add rsp, 0x28
ret

Function at 0x1400108bc
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14001092b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001092b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001092b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001092b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001092b
cmp dword [rcx + 0x84], 0xe
jbe 0x14001092b
cmp dword [rcx + 0xf8], 0
je 0x14001092b
mov ecx, ebx
call fcn.1400109dc
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400107b8
nop
cmp dword [rbp + 0x20], 0
je 0x140010979
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140010984
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400108bc

Function at 0x140010ac0
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14001092b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001092b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001092b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001092b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001092b
cmp dword [rcx + 0x84], 0xe
jbe 0x14001092b
cmp dword [rcx + 0xf8], 0
je 0x14001092b
mov ecx, ebx
call fcn.1400109dc
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400107b8
nop
cmp dword [rbp + 0x20], 0
je 0x140010979
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140010984
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400108bc