joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001114
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rbp, rdx
xor r8d, r8d
mov rsi, rcx
mov rcx, qword [rcx + 0x38]
mov r9d, 2
mov ebx, 0xc0000089
lea rdx, [r8 - 0x20]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointerEx]
nop dword [rax + rax]
test eax, eax
je 0x18000118f
mov rcx, qword [rsi + 0x38]
lea r9, [rsp + 0x40]
and qword [rsp + 0x20], 0
mov r8d, 0x20
mov rdx, rbp
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
nop dword [rax + rax]
test eax, eax
je 0x18000118f
cmp dword [rsp + 0x40], 0x20
jne 0x18000118f
mov qword [rdi], 0x20
xor ebx, ebx
mov rbp, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1800011b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rbp, r8
mov rsi, rcx
xor r9d, r9d
mov rcx, qword [rcx + 0x38]
xor r8d, r8d
mov ebx, 0xc0000089
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x180001225
mov rcx, qword [rsi + 0x38]
lea r9, [rsp + 0x40]
and qword [rsp + 0x20], 0
mov r8d, 0x20
mov rdx, rbp
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
nop dword [rax + rax]
test eax, eax
je 0x180001225
cmp dword [rsp + 0x40], 0x20
jne 0x180001225
mov qword [rdi], 0x20
xor ebx, ebx
mov rbp, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x18000a5f8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
sub rsp, 0x140
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rbp + 0xe0], rax
xor esi, esi
mov rbx, rdx
mov qword [rbp], rsi
mov rdi, rcx
test rdx, rdx
je 0x18000a704
call fcn.18000b3f4
test eax, eax
je 0x18000a704
lea r9, [rbp]
mov qword [rsp + 0x20], rsi
mov r8, rbx
lea edx, [rsi + 0x20]
lea rcx, [rbp + 0x40]
call fcn.18000b120
mov rbx, qword [rbp]
lea rax, [rbp + 0x40]
cmp rbx, rax
jbe 0x18000a704
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 8]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x80]
lea r8d, [rdx + 0x5a]
call sub.ntdll.dll_memset
mov rcx, qword [0x1800b2d18]
lea rax, [rbp]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x80]
mov r8d, 2
mov dword [rsp + 0x20], 0x5a
lea rdx, [rbp + 8]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
nop dword [rax + rax]
test eax, eax
je 0x18000a743
add rbx, 0xfffffffffffffffe
lea rax, [rbp + 0x40]
cmp rbx, rax
jbe 0x18000a667
mov rax, rbx
cmp word [rbx], 0x2d
je 0x18000a73b
cmp word [rbx], 0x5f
je 0x18000a73b
lea rbx, [rax - 2]
lea rcx, [rbp + 0x40]
mov rax, rbx
cmp rbx, rcx
ja 0x18000a6e3
jmp 0x18000a667
movups xmm0, xmmword [0x180085408]
mov rax, rdi
movdqu xmmword [rdi], xmm0
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.180024680
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov word [rbx], si
jmp 0x18000a667
lea rdx, [rbp + 0x8c]
lea rcx, [rbp + 0x18]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x18]
call qword [sym.imp.ntdll.dll_RtlGUIDFromString]
nop dword [rax + rax]
test eax, eax
js 0x18000a6d3
movups xmm0, xmmword [rbp + 0x28]
jmp 0x18000a70b
Function at 0x18000b820
Capabilities:
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r14
sub rsp, 0x40
xor ebx, ebx
mov r14, rdx
mov qword [rax - 0x18], rbx
xor r9d, r9d
mov dword [rax - 0x20], 0x80
mov edx, 0x80000000
mov dword [rax - 0x28], 3
lea r8d, [rbx + 1]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
nop dword [rax + rax]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18002ebc9
mov qword [rsp + 0x28], rbx
lea r8d, [rbx + 2]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_CreateFileMappingW]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x18002ebba
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
lea edx, [rbx + 4]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_MapViewOfFile]
nop dword [rax + rax]
test rax, rax
je 0x18000b8c8
mov qword [r14], rax
mov ebx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
xor eax, eax
jmp 0x18000b8e8
Function at 0x18000e1e0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x40
mov r9d, 8
mov dword [rsp + 0x20], 4
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
nop dword [rax + rax]
test eax, eax
js 0x18002f758
mov eax, dword [rsp + 0x64]
mov ebx, eax
and ebx, 1
and eax, 0x10
or ebx, eax
jne 0x18002f777
mov rax, qword [rsp + 0x60]
cmp eax, 2
jb 0x18000e23f
cmp eax, 3
jbe 0x18000e248
cmp eax, 0x12
je 0x18000e248
cmp eax, 0x14
je 0x18000e248
mov eax, ebx
add rsp, 0x40
pop rbx
ret
mov ebx, 1
jmp 0x18002f777
mov edx, eax
lea rcx, str.BasepIsRemovableMedia:_NtQueryVolumeInformationFile_failed_0x_lx_n
call qword [sym.imp.ntdll.dll_DbgPrint]
nop dword [rax + rax]
mov eax, 1
jmp 0x18000e241
lea rcx, str.BasepIsRemovableMedia:_Host_device_is_removable__Shim_cache_deactivated_n
call qword [sym.imp.ntdll.dll_DbgPrint]
nop dword [rax + rax]
nop
jmp 0x18000e23f
Function at 0x18000e714
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xor ebx, ebx
mov rdi, rcx
and dword [rcx], ebx
and qword [rbp - 0x19], rbx
mov edx, dword [0x1800b2304]
cmp edx, 0xffffffff
jne 0x18000e841
lea rdx, str.RegistryMACHINESoftwareMicrosoftWindowsCurrentVersionSideBySide
lea rcx, [rbp - 9]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
and qword [rbp + 0xf], rbx
lea rax, [rbp - 9]
xorps xmm0, xmm0
mov qword [rbp + 0x17], rax
lea r8, [rbp + 7]
mov dword [rbp + 7], 0x30
mov edx, 0x20019
mov dword [rbp + 0x1f], 0x40
lea rcx, [rbp - 0x19]
movdqu xmmword [rbp + 0x27], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKey]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x18002fbee
lea rdx, str.PreferExternalManifest
lea rcx, [rbp - 9]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x19]
lea rax, [rbp - 0x11]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x37]
mov r8d, 2
mov dword [rsp + 0x20], 0x14
lea rdx, [rbp - 9]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x18002fc03
cmp eax, 0xc0000034
jne 0x18000e808
xor ebx, ebx
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x18000e81d
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.180024680
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
mov dword [rdi], edx
jmp 0x18000e808
cmp eax, 0xc0000034
je 0x18000e806
cmp eax, 0xc000003a
jmp 0x18000e804
cmp dword [rbp + 0x3b], 4
jne 0x18002fc17
cmp dword [rbp + 0x3f], 4
jne 0x18002fc17
mov edx, dword [rbp + 0x43]
cmp edx, 0xffffffff
jne 0x18002fc1c
mov edx, 1
or eax, 0xffffffff
lock cmpxchg dword [0x1800b2304], edx
cmp eax, 0xffffffff
cmovne edx, eax
jmp 0x18000e841
Function at 0x18000e84c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rbp + 0x2f], rax
xor edi, edi
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
mov rax, qword gs:[0x30]
mov r14, rdx
mov r15, rcx
mov esi, dword [rax + 0x179c]
and qword [rbp - 0x41], rdi
mov rax, qword [0x1800b2da8]
mov qword [rbp - 0x49], rax
test esi, esi
jne 0x18000e970
test rax, rax
je 0x18000e970
lea rdx, str.AppCompatFlagsLayers
lea rcx, [rbp - 0x31]
call sub.ntdll.dll_RtlInitUnicodeStringEx
mov ebx, eax
test eax, eax
js 0x18000e90c
mov rax, qword [rbp - 0x49]
lea r8, [rbp - 0x11]
mov qword [rbp - 9], rax
lea rcx, [rbp - 0x41]
lea rax, [rbp - 0x31]
mov dword [rbp - 0x11], 0x30
xorps xmm0, xmm0
mov qword [rbp - 1], rax
mov edx, 0x101
mov dword [rbp + 7], 0x40
movdqu xmmword [rbp + 0xf], xmm0
call sub.ntdll.dll_NtOpenKey
test eax, eax
jns 0x18002fc32
xor ebx, ebx
and qword [rbp - 0x41], rbx
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x18000e922
cmp rcx, qword [0x1800b2da8]
jne 0x18000e9f4
mov rcx, qword [rbp - 0x41]
test rcx, rcx
jne 0x18002fc80
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp - 0x19]
mov rcx, qword [rcx + 0x30]
call sub.ntdll.dll_RtlFreeHeap
mov eax, ebx
mov dword [r15], edi
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.180024680
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersion
lea rcx, [rbp - 0x21]
call fcn.18000f380
mov ebx, eax
test eax, eax
js 0x18000e90c
and qword [rbp - 9], rdi
lea rax, [rbp - 0x21]
xorps xmm0, xmm0
mov qword [rbp - 1], rax
lea r8, [rbp - 0x11]
mov dword [rbp - 0x11], 0x30
mov edx, 8
mov dword [rbp + 7], 0x40
lea rcx, [rbp - 0x49]
movdqu xmmword [rbp + 0xf], xmm0
call sub.ntdll.dll_NtOpenKey
test eax, eax
js 0x18000ea00
test esi, esi
jne 0x18000e8b0
mov rcx, qword [rbp - 0x49]
xor eax, eax
lock cmpxchg qword [0x1800b2da8], rcx
je 0x18000e8b0
mov rcx, qword [rbp - 0x49]
call sub.ntdll.dll_NtClose
mov rax, qword [0x1800b2da8]
mov qword [rbp - 0x49], rax
jmp 0x18000e8b0
call sub.ntdll.dll_NtClose
mov ebx, eax
jmp 0x18000e922
xor ebx, ebx
and qword [rbp - 0x49], rbx
jmp 0x18000e922
mov rdx, r14
lea rcx, [rbp - 0x31]
call sub.ntdll.dll_RtlInitUnicodeStringEx
mov ebx, eax
test eax, eax
js 0x18000e90c
mov rcx, qword [rbp - 0x41]
lea rax, [rbp - 0x39]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x1f]
mov r8d, 2
mov dword [rsp + 0x20], 0x10
lea rdx, [rbp - 0x31]
call sub.ntdll.dll_NtQueryValueKey
cmp eax, 0xc0000034
setne dil
xor ebx, ebx
jmp 0x18000e90c
call sub.ntdll.dll_NtClose
mov ebx, eax
jmp 0x18000e92f
Function at 0x18000eb88
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor r15d, r15d
mov r8, rdx
or rbp, 0xffffffffffffffff
mov r14, rcx
mov rax, rbp
mov esi, r15d
inc rax
cmp word [rdx + rax*2], r15w
jne 0x18000ebba
cmp rax, 8
jb 0x18002fea4
cmp word [rdx + 2], 0x3a
jne 0x18000ecbf
mov edx, 5
lea r9, [0x180085600]
lea rax, [rsp + 0x30]
lea rcx, [rsp + 0x30]
sub r9, rax
lea edi, [rdx - 4]
lea rax, [rdx + 0x7ffffff9]
test rax, rax
je 0x18000ec17
movzx eax, word [r9 + rcx]
test ax, ax
je 0x18000ec17
mov word [rcx], ax
add rcx, 2
sub rdx, rdi
jne 0x18000ebf5
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r15w
mov rax, rdx
neg rax
sbb ebx, ebx
not ebx
and ebx, 0x80000005
test rdx, rdx
je 0x18002fee7
movzx eax, word [r8]
mov word [rsp + 0x30], ax
call fcn.18001bba4
lea rcx, [rsp + 0x30]
inc rbp
cmp word [rcx + rbp*2], r15w
jne 0x18000ec52
mov r8, rbp
lea rcx, [rsp + 0x30]
mov rdx, rax
call sub.ntdll.dll__wcsnicmp
test eax, eax
jne 0x18000ec9a
mov ebx, r15d
mov dword [r14], esi
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180024680
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
nop dword [rax + rax]
mov ecx, eax
add eax, 0xfffffffe
test eax, 0xfffffffc
jne 0x18000ec70
cmp ecx, 3
cmovne esi, edi
jmp 0x18000ec70
cmp word [rdx + 2], 0x5c
mov ebx, r15d
je 0x18000ec73
jmp 0x18002feb9
mov dword [rsp + 0x28], r15d
mov ebx, r15d
mov qword [rsp + 0x20], r8
mov r8d, 0x107
jmp 0x18002fec9
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r8
mov r8d, 0x112
lea r9, str._ws_not_a_full_path_we_can_operate_on___x_
mov ecx, 1
lea rdx, str.AslPathIsOnRemovableMedia
call fcn.18001188c
nop
jmp 0x18000ec73
lea r9, str.RtlStringCchCopyW_failed_for_c:___x_
mov dword [rsp + 0x20], ebx
mov r8d, 0x123
lea rdx, str.AslPathIsOnRemovableMedia
mov ecx, edi
call fcn.18001188c
nop
jmp 0x18000ec73
Function at 0x18000edb4
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov r14, rdx
mov r15, rcx
mov r12d, 0x105
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov ecx, r12d
mov esi, ebx
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetTempPathW]
nop dword [rax + rax]
dec eax
cmp eax, 0x103
ja 0x18002ff2c
or rdi, 0xffffffffffffffff
lea rax, [rsp + 0x30]
mov r8, rdi
inc r8
cmp word [rax + r8*2], bx
jne 0x18000ee23
lea rdx, [rsp + 0x30]
mov rcx, r14
call sub.ntdll.dll__wcsnicmp
test eax, eax
je 0x18000ef3a
call fcn.18001bba4
mov r8, rax
lea rcx, [rsp + 0x30]
mov rdx, r12
call qword [sym.imp.ntdll.dll_wcscpy_s]
nop dword [rax + rax]
lea r8, str.TEMP_
mov rdx, r12
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_wcscat_s]
nop dword [rax + rax]
lea rax, [rsp + 0x30]
mov word [rbp + 0x138], bx
mov r8, rdi
inc r8
cmp word [rax + r8*2], bx
jne 0x18000ee88
lea rdx, [rsp + 0x30]
mov rcx, r14
call sub.ntdll.dll__wcsnicmp
test eax, eax
je 0x18000ef3a
call fcn.18001bba4
mov r8, rax
lea rcx, [rsp + 0x30]
mov rdx, r12
call qword [sym.imp.ntdll.dll_wcscpy_s]
nop dword [rax + rax]
lea r8, str.TEMP_
mov edx, 0x103
lea rcx, [rsp + 0x34]
call qword [sym.imp.ntdll.dll_wcscpy_s]
nop dword [rax + rax]
lea rax, [rsp + 0x30]
mov word [rbp + 0x138], bx
inc rdi
cmp word [rax + rdi*2], bx
jne 0x18000eeec
mov r8, rdi
lea rdx, [rsp + 0x30]
mov rcx, r14
call sub.ntdll.dll__wcsnicmp
test eax, eax
je 0x18000ef3a
mov dword [r15], ebx
mov eax, esi
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.180024680
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov ebx, 1
jmp 0x18000ef09
mov esi, 0xc0000023
lea r9, str.Failed_to_retrieve_temporary_directory___x_
mov r8d, 0x25c
mov dword [rsp + 0x20], esi
lea rdx, str.AslPathIsTemporaryDirectory
mov ecx, 1
call fcn.18001188c
nop
jmp 0x18000ef09
Function at 0x18000ef48
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov r14, rcx
mov r15, r8
mov r8d, 0x200
mov rbx, rdx
mov dword [rax - 0x28], r8d
mov esi, 8
mov rcx, qword gs:[0x60]
mov edx, esi
movzx ebp, r9w
mov rcx, qword [rcx + 0x30]
call sub.ntdll.dll_RtlAllocateHeap
mov rdi, rax
test rax, rax
je 0x18002ff5a
mov r9, rax
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNELBASE.dll_PackageIdFromFullName]
nop dword [rax + rax]
cmp eax, 0x7a
je 0x18002ff64
mov rax, qword [rdi + 0x20]
mov r9, qword [rdi + 0x28]
mov r8, qword [rdi + 0x10]
mov qword [rsp + 0x20], rax
call fcn.18000f170
mov rcx, qword gs:[0x60]
mov r8, rax
mov edx, esi
mov rbx, rax
mov rcx, qword [rcx + 0x30]
call sub.ntdll.dll_RtlAllocateHeap
mov rsi, rax
test rax, rax
je 0x18002ffc7
mov rax, qword [rdi + 0x20]
mov rdx, rbx
mov r9, qword [rdi + 8]
mov rcx, rsi
mov r8d, dword [rdi + 4]
mov word [rsp + 0x40], bp
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], rax
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x28], rax
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x20], rax
call fcn.18000f088
test eax, eax
je 0x18000f07a
xor ebx, ebx
mov qword [r14], rsi
xor esi, esi
test rsi, rsi
jne 0x18002ffd1
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call sub.ntdll.dll_RtlFreeHeap
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov ebx, 0xc00000e5
jmp 0x18000f03d
mov ebx, 0xc0000017
jmp 0x18000f05d
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call sub.ntdll.dll_RtlFreeHeap
mov rcx, qword gs:[0x60]
mov edx, esi
mov r8d, dword [rsp + 0x50]
mov rcx, qword [rcx + 0x30]
call sub.ntdll.dll_RtlAllocateHeap
mov rdi, rax
test rax, rax
je 0x18002ff5a
mov r9, rax
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNELBASE.dll_PackageIdFromFullName]
nop dword [rax + rax]
test eax, eax
je 0x18000efbe
mov ebx, 0xc00000e5
jmp 0x18000f046
mov ebx, 0xc0000017
jmp 0x18000f046
mov rcx, qword gs:[0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call sub.ntdll.dll_RtlFreeHeap
nop
jmp 0x18000f046
Function at 0x18000f1e8
Capabilities:
Set file attributes
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov rdi, qword [rcx + 0x10]
xor esi, esi
test rdi, rdi
je 0x18000f2b8
lea r14, [rdi + 0x38]
cmp qword [r14], rsi
je 0x18000f24a
cmp dword [rdi + 0x50], 0xffffffff
jne 0x18000f2d0
mov r9d, 0x8000
lea r8, [rdi + 0x48]
mov rdx, r14
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
nop dword [rax + rax]
and qword [r14], 0
and qword [rdi + 0x40], 0
and qword [rdi + 0x48], 0
cmp byte [rdi + 0x32], 0
je 0x18000f280
and qword [rbp + 0x20], 0
lea r9, [rbp + 0x28]
or qword [rbp + 0x28], 0xffffffffffffffff
lea r8, [rbp + 0x20]
mov eax, dword [0x1800b2248]
lea rdx, [rbp - 0x10]
mov rcx, qword [rdi + 0x28]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_NtUnlockFile]
nop dword [rax + rax]
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
test esi, esi
mov r8, rdi
cmovns esi, eax
and qword [rdi + 0x28], 0
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
lea r11, [rsp + 0x60]
mov eax, esi
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
cmp byte [rdi + 0x30], sil
je 0x18000f21f
and dword [rbp + 0x24], esi
lea rcx, [0x1800b2248]
mov eax, dword [rdi + 0x50]
xor r9d, r9d
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov dword [rbp + 0x20], eax
lea rcx, [rbp + 0x20]
mov eax, dword [rdi + 0x50]
xor edx, edx
mov ebx, dword [rdi + 0x54]
mov qword [rsp + 0x38], rcx
sub ebx, eax
add rax, qword [r14]
mov rcx, qword [rdi + 0x28]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
nop dword [rax + rax]
mov esi, eax
test eax, eax
js 0x18000f21f
mov eax, ebx
cmp qword [rbp - 8], rax
jne 0x18002fffa
mov eax, dword [rdi + 0x34]
lea r8, [rbp + 0x28]
mov qword [rbp + 0x28], rax
lea rdx, [rbp - 0x10]
mov rcx, qword [rdi + 0x28]
mov r9d, 8
mov dword [rsp + 0x20], 0x14
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov esi, eax
jmp 0x18000f21f
mov esi, 0xc000007f
jmp 0x18000f21f
Function at 0x18000f380
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov rdi, rcx
xorps xmm0, xmm0
lea rcx, [rax - 0x18]
mov rbp, rdx
movups xmmword [rax - 0x18], xmm0
call qword [sym.imp.ntdll.dll_RtlFormatCurrentUserKeyPath]
nop dword [rax + rax]
xor r14d, r14d
mov ebx, eax
test eax, eax
js 0x180030004
mov word [rdi], r14w
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], r14w
jne 0x18000f3cb
mov esi, 1
add ax, si
add ax, ax
add ax, word [rsp + 0x30]
movzx r8d, ax
lea edx, [rsi + 7]
mov word [rdi + 2], r8w
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rdi + 8], rax
test rax, rax
je 0x18003002c
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
nop dword [rax + rax]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeToString]
nop dword [rax + rax]
mov ebx, r14d
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
nop dword [rax + rax]
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
lea r9, str.RtlFormatCurrentUserKeyPath_failed___x_
mov dword [rsp + 0x20], eax
mov r8d, 0x5c4
lea rdx, str.AslRegistryBuildUserPath
mov ecx, 1
call fcn.18001188c
nop
jmp 0x18000f441
lea r9, str.Out_of_memory
mov r8d, 0x5d0
lea rdx, str.AslRegistryBuildUserPath
mov ecx, esi
mov ebx, 0xc0000017
call fcn.18001188c
nop
jmp 0x18000f441

Function at 0x180010090
Capabilities:
Parse pe header

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rsi, rdx
xor ebx, ebx
cmp qword [rcx + 0x10], rbx
je 0x1800302b9
cmp qword [rcx + 0x20], rbx
je 0x1800302b9
lea edi, [rbx + 3]
cmp qword [rcx + 0x10], 0x40
jb 0x180030288
mov rdx, qword [rcx + 0x18]
mov dword [rsp + 0x30], edi
lea rax, [rdx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x18003028c
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x180010128
lea edi, [rbx + 4]
mov dword [rsp + 0x30], edi
mov eax, dword [rdx + 0x3c]
mov dword [rsp + 0x70], eax
mov r8d, eax
add rax, rdi
cmp qword [rcx + 0x10], rax
jb 0x180010128
lea rax, [r8 + rdx]
mov qword [r11 + 0x18], rax
cmp dword [rax], 0x4550
jne 0x180010114
lea edi, [rbx + 6]
jmp 0x180010124
mov edx, 5
mov ecx, 0x454e
cmp word [rax], cx
cmove edi, edx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x34], ebx
jmp 0x18001015f
mov dword [rsi], edi
mov eax, ebx
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
mov dword [rdx], edi
jmp 0x1800302bf
mov ebx, 0xc000000d
mov dword [rsp + 0x20], ebx
lea r9, str.File_mapping_invalid___x_
mov r8d, 0x4e8
lea rdx, str.AslpFileMappingGetFileKind
mov ecx, 1
call fcn.18001188c
nop
jmp 0x18001015f
mov dword [rdx], 1
xor eax, eax
jmp 0x180010163