joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002a654
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x50
and qword [rsp + 0x68], 0
lea rdx, [rsp + 0x68]
call qword [sym.imp.RPCRT4.dll_UuidToStringW]
test eax, eax
jne 0x14002a710
and qword [rsp + 0x40], 0
and qword [rsp + 0x70], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
lea rdx, [0x140003240]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 2
and dword [rsp + 0x20], 0
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCreateKeyExW]
test eax, eax
jne 0x14002a6f5
mov rdx, qword [rsp + 0x68]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
mov r9d, 1
xor r8d, r8d
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
mov rcx, qword [rsp + 0x70]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, [0x140005818]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
lea rcx, [rsp + 0x68]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14002a710
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
add rsp, 0x50
pop rdi
ret
Function at 0x14002d764
Capabilities:
Inspect load icon resource

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
and qword [rcx + 8], 0
and qword [rcx + 0x18], 0
and qword [rcx + 0x20], 0
lea rax, [0x1400061c8]
mov rsi, rcx
mov qword [rcx], rax
and qword [rcx + 0x30], 0
and qword [rcx + 0x38], 0
and qword [rcx + 0x40], 0
and qword [rcx + 0x48], 0
and qword [rcx + 0x50], 0
and qword [rcx + 0x68], 0
and dword [rcx + 0x70], 0
and dword [rcx + 0x74], 0
mov rcx, qword [0x140049be8]
mov al, byte [rcx + 0x60]
mov rcx, qword [rcx]
neg al
sbb rdx, rdx
and rdx, 0xfffffffffffffffe
add rdx, 0x72
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rsi + 0x58], rax
mov rcx, qword [0x140049be8]
mov al, byte [rcx + 0x60]
mov rcx, qword [rcx]
neg al
sbb rdx, rdx
and rdx, 0xfffffffffffffffe
add rdx, 0x73
call qword [sym.imp.USER32.dll_LoadIconW]
mov ebx, 1
lea r9, [rsi + 0x40]
mov qword [rsi + 0x60], rax
mov rax, qword [rsi + 0x58]
lea rdx, [0x140006298]
lea rcx, [rsp + 0x20]
mov r8d, ebx
mov dword [rsp + 0x24], 3
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x18
call qword [sym.imp.OLEAUT32.dll_OleCreateFontIndirect]
mov r11, qword [rsi + 0x60]
lea r9, [rsi + 0x48]
lea rdx, [0x140006298]
lea rcx, [rsp + 0x20]
mov r8d, ebx
mov qword [rsp + 0x28], r11
call qword [sym.imp.OLEAUT32.dll_OleCreateFontIndirect]
mov rcx, qword [0x140049be8]
mov edx, 0x7530
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [rsi + 0x68], rax
test rax, rax
je 0x14002d8a7
lea r9, [rsi + 0x50]
lea rdx, [0x140006298]
lea rcx, [rsp + 0x38]
mov r8d, ebx
mov dword [rsp + 0x3c], 3
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x18
call qword [sym.imp.OLEAUT32.dll_OleCreateFontIndirect]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rax, rsi
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14003522c
Capabilities:
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x480
mov rax, qword [0x140048148]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r12, qword [rsp + 0x4c0]
mov rsi, rdx
lea rdx, [rsp + 0x260]
mov ecx, 0x104
mov ebp, r8d
xor edi, edi
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x1400352a6
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140035290
mov edi, 0x8000ffff
jmp 0x140035393
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
js 0x140035393
lea r9, [rsp + 0x50]
lea rdx, [0x140006cb0]
lea rcx, [rsp + 0x260]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x1400352df
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140035286
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
js 0x140035393
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x50]
not rcx
lea r8d, [rcx - 1]
mov rcx, r12
call fcn.14000d0f0
and qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x2100
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x140035343
call fcn.14000e5fc
mov edi, eax
jmp 0x140035348
mov rbx, rax
xor edi, edi
test edi, edi
js 0x140035385
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, ebp
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140035373
call fcn.14000e5fc
mov edi, eax
jmp 0x140035375
xor edi, edi
test rbx, rbx
je 0x140035393
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
test rbx, rbx
je 0x140035393
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140037b50
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140035730
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0xe0
mov rax, qword [0x140048148]
xor rax, rsp
mov qword [rsp + 0xd0], rax
xor r12d, r12d
mov rbx, rcx
mov rbp, rdx
lea rcx, [rsp + 0x48]
lea r9d, [r12 + 1]
xor r8d, r8d
xor edx, edx
mov edi, 0x80004005
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.CRYPTSP.dll_CryptAcquireContextW]
cmp eax, r12d
je 0x140035904
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPTSP.dll_CryptCreateHash]
cmp eax, r12d
je 0x1400358f7
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x38]
xor eax, eax
mov byte [rsp + 0x50], r12b
mov qword [rsp + 0x51], rax
mov qword [rsp + 0x59], rax
mov word [rsp + 0x61], ax
mov byte [rsp + 0x63], al
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x40], r12d
mov r8d, dword [rdx - 0x10]
xor r9d, r9d
add r8d, r8d
call qword [sym.imp.CRYPTSP.dll_CryptHashData]
cmp eax, r12d
je 0x1400358ec
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x30]
lea edx, [r12 + 4]
mov dword [rsp + 0x40], 4
mov dword [rsp + 0x20], r12d
call qword [sym.imp.CRYPTSP.dll_CryptGetHashParam]
cmp eax, r12d
je 0x1400358ec
mov rcx, qword [rsp + 0x38]
lea ebx, [r12 + 0x14]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x50]
lea edx, [rbx - 0x12]
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.CRYPTSP.dll_CryptGetHashParam]
cmp eax, r12d
je 0x1400358ec
mov edi, dword [rsp + 0x30]
lea r8d, [r12 + 0x50]
lea rcx, [rsp + 0x72]
cmp edi, ebx
mov word [rsp + 0x70], r12w
cmova edi, ebx
xor edx, edx
mov dword [rsp + 0x30], edi
call sub.msvcrt.dll_memset
mov rsi, r12
cmp edi, r12d
jbe 0x1400358c7
mov rdi, r12
lea rbx, [rsp + 0x70]
movzx r9d, byte [rsp + rsi + 0x50]
mov edx, 0x29
lea r8, [0x140006e28]
sub rdx, rdi
mov rcx, rbx
call sub.msvcrt.dll_swprintf_s
mov eax, dword [rsp + 0x30]
inc rsi
add rdi, 2
add rbx, 4
cmp rsi, rax
jb 0x140035896
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x70]
not rcx
lea r8d, [rcx - 1]
mov rcx, rbp
call fcn.14000d0f0
mov edi, r12d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.CRYPTSP.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.CRYPTSP.dll_CryptReleaseContext]
mov eax, edi
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140037b50
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140035cb4
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x60
and qword [r11 - 0x28], 0
lea rax, [r11 - 0x18]
mov rbx, r9
mov qword [r11 - 0x30], rax
and qword [r11 - 0x38], 0
mov rdi, r8
lea rdx, [0x140003240]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20106
and dword [rsp + 0x20], 0
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCreateKeyExW]
test eax, eax
jne 0x140035d3d
mov rcx, qword [rsp + 0x50]
lea r9d, [rax + 4]
xor r8d, r8d
mov dword [rsp + 0x28], r9d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
test eax, eax
je 0x140035d37
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, ebx
jmp 0x140035d3d
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret

Function at 0x140035d50
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x40
and qword [rax - 0x10], 0
mov dword [rax - 0x18], 4
lea rax, [rax - 0x10]
mov rbx, r9
mov rdi, r8
mov r9d, 0x20119
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x140035dd6
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x140035dc9
cmp dword [rsp + 0x34], 4
jne 0x140035dc9
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
jmp 0x140035dd6
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140035de8
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r12
sub rsp, 0x40
mov rbx, qword [rsp + 0x70]
mov rsi, r8
lea rax, [r11 - 0x18]
mov r12, rcx
mov rcx, qword [rbx]
mov qword [r11 - 0x20], rax
mov rdi, r9
mov qword [r11 - 0x28], r9
mov rbp, rdx
lea r9, [r11 - 0x14]
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x30], 4
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140035e44
cmp dword [rsp + 0x34], 4
je 0x140035e94
mov rcx, qword [rbx]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov r9d, 0x20119
xor r8d, r8d
mov rdx, rbp
mov rcx, r12
mov qword [rsp + 0x20], rbx
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x140035e71
and qword [rbx], 0
jmp 0x140035e94
mov rcx, qword [rbx]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x140037180
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor ebx, ebx
mov r13, r8
mov r14, rdx
mov qword [rdx], rbx
mov rbp, rcx
or r15, 0xffffffffffffffff
mov dword [r8], ebx
mov r12d, ebx
cmp qword [rbp + 0xe8], rbx
je 0x1400371d0
mov rcx, qword [rbp + 0xe8]
xor r8d, r8d
xor edx, edx
mov rax, qword [rcx]
call qword [rax]
jmp 0x1400371da
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
movsxd rcx, eax
mov edi, eax
mov eax, 8
mul rcx
cmovo rax, r15
mov rcx, rax
call fcn.140037718
mov rsi, rax
cmp rax, rbx
je 0x140037236
cmp edi, ebx
je 0x14003722b
cmp qword [rbp + 0xe8], rbx
je 0x14003721c
mov rcx, qword [rbp + 0xe8]
mov r8, rax
mov edx, edi
mov r9, qword [rcx]
call qword [r9]
jmp 0x140037227
mov rdx, rax
mov ecx, edi
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
cmp edi, eax
je 0x14003724e
mov rcx, rsi
call sub.msvcrt.dll_free
mov rsi, rbx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
inc r12d
cmp r12d, 5
jl 0x1400371b4
cmp edi, ebx
jle 0x14003728c
movsxd rbp, edi
mov eax, 2
mul rbp
cmovo rax, r15
mov rcx, rax
call fcn.140037718
cmp rax, rbx
je 0x14003728c
cmp rbp, rbx
jle 0x140037283
movzx ecx, word [rsi + rbx*8]
mov word [rax + rbx*2], cx
inc rbx
cmp rbx, rbp
jl 0x140037273
mov qword [r14], rax
mov bl, 1
mov dword [r13], edi
mov rcx, rsi
call sub.msvcrt.dll_free
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov al, bl
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140037b50
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140048148]
jne 0x140037b6b
rol rcx, 0x10
test cx, 0xffff
jne 0x140037b67
ret 0
ror rcx, 0x10
jmp 0x14003816c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140049580]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x140049678]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400381f1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140049580]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x140038213
mov rax, qword [rsp + 0x88]
mov qword [0x140049678], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140049618], rax
mov rax, qword [0x140049678]
mov qword [0x1400494f0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140049600], rax
mov dword [0x1400494e0], 0xc0000409
mov dword [0x1400494e4], 1
mov rax, qword [0x140048148]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140048150]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140001ec0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x140038008
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x140038055
cmp rcx, 0xffffffffffffffff
je 0x140038055
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14003804d
cmp dword [rcx + 0x3c], edx
jl 0x14003804d
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14003804d
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140038055
mov rax, rdx
add rsp, 0x18
ret

Function at 0x1400382c4
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x530
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x14003832f
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x14003834f
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0xf8], rax
lea rcx, [0x140001ed0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x530
pop rbx
ret
Function at 0x1400388ec
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x140048148]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call sub.msvcrt.dll_memset
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x140000000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x14003897f
cmp dword [rsp + 0x24], 5
jb 0x140038999
jmp 0x140038995
cmp dword [rsp + 0x30], esi
jne 0x140038999
cmp dword [rsp + 0x24], 4
ja 0x140038995
jne 0x140038999
cmp dword [rsp + 0x28], 0
jbe 0x140038999
mov byte [rbx + 0x18], sil
lea rax, [0x1400023e8]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.14000b6d0
movzx ecx, byte [0x140049d48]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x140049d48], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140037b50
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14003ca00
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14003ca0d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14003ca1d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14003ca05
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14003ca35
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14003ca22
sub eax, 3
jb 0x14003ca4f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14003ca86
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14003ca76
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14003ca74
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14003ca63
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14003c9c2
jmp 0x14003ca0d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x23e00
mov dl, reloc.COMCTL32.dll_InitCommonControls
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14003cad2
cmp rsi, rcx
jae 0x14003cada
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14003cab9
cmp al, 0x8f
ja 0x14003cab9
cmp byte [rsi - 2], 0xf
je 0x14003cabf
sub al, 0xe8
cmp al, 1
ja 0x14003caa3
cmp rsi, rcx
jae 0x14003cada
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14003caa9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14003cada
lodsb al, byte [rsi]
jmp 0x14003cab9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x39000]
mov eax, dword [rdi]
or eax, eax
je 0x14003cb43
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x40fd0]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14003cae7
jns 0x14003cb1c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14003cb26
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14003cb3d
mov qword [rbx], rax
add rbx, 8
jmp 0x14003cb07
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x18f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14003cb9b
sub rsp, 0xffffffffffffff80
jmp 0x1400242ac
Function at 0x4131e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41336b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432400
xorps xmm15, xmm15
mov r14, qword [0x00621620]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x413245
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x413254
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x413273
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x413283
cmp rbx, 0x1000
jae 0x41324b
jmp 0x4132ed
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x413295
xor edx, edx
jmp 0x4132e4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432400
xorps xmm15, xmm15
mov r14, qword [0x00621620]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x413279
jmp 0x413268
call fcn.0046f3a0
xorps xmm15, xmm15
mov r14, qword [0x00621620]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00436bc0
lea rax, [0x00500e90]
mov ebx, 0x18
nop dword [rax]
call fcn.00437440
mov rax, qword [rsp + 0x38]
call fcn.00437180
lea rax, [0x005014ef]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00437440
mov rax, qword [rsp + 0x30]
call fcn.00437180
call fcn.00436e00
call fcn.00436c20
lea rax, [0x00504112]
mov ebx, 0x21
call fcn.00466320
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046bc80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004131e0
Function at 0x4133a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4135c6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00432480
xorps xmm15, xmm15
mov r14, qword [0x00621620]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x413413
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x413422
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x413445
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x413455
cmp rbx, 0x1000
jae 0x413419
nop
jmp 0x4134d8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x41346d
xor esi, esi
jmp 0x4134ca
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00432480
xorps xmm15, xmm15
mov r14, qword [0x00621620]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41344b
jmp 0x413436
call fcn.0046f3a0
xorps xmm15, xmm15
mov r14, qword [0x00621620]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x413560
nop dword [rax + rax]
call fcn.00436bc0
lea rax, [0x00501508]
mov ebx, 0x19
call fcn.00437440
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.00437180
lea rax, [0x005014ef]
mov ebx, 0x19
call fcn.00437440
mov eax, dword [rsp + 0x34]
call fcn.00437180
nop
call fcn.00436e00
call fcn.00436c20
lea rax, [0x004fd04c]
mov ebx, 0xd
call fcn.00466320
nop dword [rax + rax]
cmp eax, 0x5af
je 0x413500
call fcn.00436bc0
lea rax, [0x00501508]
mov ebx, 0x19
call fcn.00437440
mov rax, qword [rsp + 0x38]
call fcn.00437180
lea rax, [0x005014ef]
mov ebx, 0x19
call fcn.00437440
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00437180
call fcn.00436e00
call fcn.00436c20
lea rax, [0x005038da]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00466320
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046bc80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.004133a0