joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007050
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rbx
lea rdx, str._s__n
mov rcx, rax
call fcn.1400070e0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1400070e0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
push rbp
push rdi
push r12
push r13
push r14
sub rsp, 0x58
mov rbx, rdx
lea rdi, [rax + 0x18]
mov r14, rcx
call fcn.140006860
xor r13d, r13d
mov qword [rsp + 0x28], rdi
mov r9, rbx
mov qword [rsp + 0x20], r13
xor r8d, r8d
xor edx, edx
mov rcx, qword [rax]
mov rbp, rax
or rcx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsprintf]
test eax, eax
mov r12d, 0xffffffff
cmovs eax, r12d
test eax, eax
jle 0x1400072bd
mov qword [rsp + 0x50], rsi
movsxd rsi, eax
lea rcx, [rsi + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x140007166
mov eax, r12d
jmp 0x1400072b8
mov rcx, qword [rbp]
lea rax, [rsp + 0xa0]
mov r9, qword [rsp + 0x98]
or rcx, 1
mov qword [rsp + 0x28], rax
mov r8, rsi
mov rdx, rdi
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x48], r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsprintf]
test eax, eax
mov byte [rdi + rsi], r13b
mov ebx, eax
cmovs ebx, r12d
test ebx, ebx
jle 0x1400072a8
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
mov rbp, rax
test rax, rax
jns 0x1400071d0
mov ebx, r12d
jmp 0x1400072a8
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__isatty]
test eax, eax
je 0x14000728b
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x14000728b
mov dword [rsp + 0x28], r13d
mov r9d, r12d
mov r8, rdi
mov qword [rsp + 0x20], r13
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
test eax, eax
je 0x1400071c8
mov rcx, rbx
add rcx, rcx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x1400071c8
mov dword [rsp + 0x28], ebx
mov r9d, r12d
mov r8, rdi
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x14000725c
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ebx, r12d
jmp 0x1400072a8
lea r8d, [rbx - 1]
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x30]
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov ebx, r12d
mov rcx, rsi
test eax, eax
cmovne ebx, dword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400072a8
mov r9, r14
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
test eax, eax
mov rbx, rax
cmove ebx, r12d
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r15, qword [rsp + 0x48]
mov eax, ebx
mov rsi, qword [rsp + 0x50]
add rsp, 0x58
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x1400013c0
Capabilities:
Delete registry key

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r9, str.SystemCurrentControlSetServices_ws
mov qword [rsp + 0x20], rbx
mov edx, 0x104
lea rcx, [rsp + 0x30]
mov r8, 0xffffffffffffffff
call fcn.1400010a0
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov r8d, 0x100
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
test eax, eax
je 0x140001441
mov edx, eax
lea rcx, str._OpSec__could_not_remove_service_registry_key:__d
call fcn.140001070
jmp 0x140001446
mov eax, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140003010
add rsp, 0x250
pop rbx
ret
Function at 0x140002e10
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push rdi
push r14
sub rsp, 0x58
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, rcx
mov dword [rsp + 0x40], 0
xor ecx, ecx
mov edx, 0x3e8
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x140002e6e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.FindResource
lea rcx, str._s:__d_n
call fcn.140001010
xor eax, eax
jmp 0x140002fde
mov rdx, rdi
mov qword [rsp + 0x78], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
jne 0x140002ea9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x140004ea0]
lea rcx, str._s:__d_n
call fcn.140001010
xor eax, eax
jmp 0x140002fd9
mov rcx, rbx
mov qword [rsp + 0x50], rsi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
jne 0x140002ee2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x140004eb0]
lea rcx, str._s:__d_n
call fcn.140001010
xor eax, eax
jmp 0x140002fd4
mov rdx, rdi
mov qword [rsp + 0x80], rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
test eax, eax
jne 0x140002f1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.SizeOfResource
lea rcx, str._s:__d_n
call fcn.140001010
xor eax, eax
jmp 0x140002fcc
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140002f74
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.WriteResourceToDisk.CreateFile
lea rcx, str._s:__d_n
call fcn.140001010
xor eax, eax
jmp 0x140002fcc
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, ebp
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140002fb5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.WriteResourceToDisk.WriteFile
lea rcx, str._s:__d_n
call fcn.140001010
xor eax, eax
jmp 0x140002fcc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, 1
mov rbp, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140003010
add rsp, 0x58
pop r14
pop rdi
ret

Function at 0x1400038d0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000391a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000391a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000391a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000391a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000391a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000391c
xor al, al
add rsp, 0x28
ret
Function at 0x1400095a3
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov r14d, 0xffffffff
cmp r9, r14
cmovb r14, r9
lea r15, [rsp + 0x3c]
and qword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, rdi
mov r8d, r14d
mov r9, r15
call sub.KERNEL32.dll_ReadFile
test eax, eax
jne 0x140009610
call sub.KERNEL32.dll_GetLastError
cmp ax, 0x3e3
je 0x1400095c9
movzx eax, ax
cmp eax, 0x26
je 0x140009601
cmp eax, 0x40
je 0x140009618
cmp eax, 0x6d
jne 0x140009629
and word [rsp + 0x38], 0
and dword [rsp + 0x34], 0
xor eax, eax
jmp 0x140009614
mov eax, dword [rsp + 0x3c]
xor ecx, ecx
jmp 0x14000962d
and word [rsp + 0x38], 0
and dword [rsp + 0x34], 0
mov cx, 0x20
jmp 0x14000962d
mov cx, 0x18
movzx edx, word [rsp + 0x38]
mov word [rsi + 0xe], dx
mov edx, dword [rsp + 0x34]
mov dword [rsi + 0xa], edx
mov qword [rsi], rax
mov word [rsi + 8], cx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14000abe4
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov rdi, rdx
mov qword [rsp + 0x70], rcx
lea rax, [rdx + 0x18]
mov qword [rsp + 0x88], rax
mov rbp, qword [rdx + 8]
mov r14, qword [rdx + 0x10]
xor esi, esi
mov rbx, rbp
cmp rbp, r14
jb 0x14000ac97
mov rcx, qword [rdi]
mov al, byte [rdi + 0x418]
mov byte [rsp + 0x50], al
mov byte [rsp + 0x40], sil
and qword [rsp + 0x48], 0
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x30], 0x400
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtQueryDirectoryFile
mov byte [rdi + 0x418], sil
mov r14, qword [rsp + 0x98]
test r14, r14
je 0x14000addb
and qword [rdi + 8], 0
mov qword [rdi + 0x10], r14
test eax, eax
jne 0x14000adb0
mov ebx, eax
lea r15, [rdi + rbx]
add r15, 0x76
mov eax, dword [r15 - 0x5e]
lea rbp, [rbx + rax]
test rax, rax
mov eax, 0x400
cmove rbp, rax
mov qword [rdi + 8], rbp
mov r13d, dword [r15 - 0x22]
mov r12, r13
shr r12, 1
mov r9d, 1
mov rcx, r15
mov rdx, r12
lea r8, [0x141331b8e]
call fcn.14000b595
test al, 1
jne 0x14000ac15
mov r9d, 2
mov rcx, r15
mov rdx, r12
lea r8, [0x141331ba0]
call fcn.14000b595
test al, 1
jne 0x14000ac15
lea r12, [rdi + rbx]
add r12, 0x18
add rdi, 0x419
mov eax, r13d
and eax, 0xfffffffe
xor esi, esi
cmp r13d, 2
cmovb rax, rsi
mov ecx, 2
cmovb r15, rcx
lea rbx, [rsp + 0xa0]
mov qword [rbx], r15
mov qword [rbx + 8], rax
and qword [rbx + 0x10], 0
lea r14, [rsp + 0x78]
lea r15, [rsp + 0x68]
mov rcx, r14
mov rdx, rbx
call fcn.1400100af
cmp word [rsp + 0x80], 0
jne 0x14000adf1
mov al, byte [rsp + 0x7a]
mov byte [rsp + 0x66], al
movzx eax, word [rsp + 0x78]
mov word [rsp + 0x64], ax
cmp byte [rsp + 0x7c], 0
je 0x14000adf1
movzx eax, byte [rsp + 0x66]
shl eax, 0x10
movzx edx, word [rsp + 0x64]
or edx, eax
lea r8, [rdi + rsi]
mov r9d, 0x2fd
sub r9, rsi
mov rcx, r15
call fcn.140010180
cmp word [rsp + 0x68], 0
jne 0x14000adf1
movzx eax, byte [rsp + 0x6a]
add rsi, rax
jmp 0x14000ad47
cmp eax, 0xc0000022
jne 0x14000ae27
movups xmm0, xmmword [0x141331ab0]
mov rax, qword [rsp + 0x70]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [0x141331aa0]
movups xmmword [rax], xmm0
mov qword [rax + 0x20], 0xb
jmp 0x14000ae32
xorps xmm0, xmm0
mov rax, qword [rsp + 0x70]
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax], xmm0
and qword [rax + 0x20], 0
jmp 0x14000ae32
mov eax, dword [r12 + 0x38]
bt eax, 0xa
setae cl
or cl, 4
test al, 0x10
movzx eax, cl
mov ecx, 2
cmove ecx, eax
mov rax, qword [rsp + 0x70]
and word [rax + 0x20], 0
mov byte [rax + 0x18], 1
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov byte [rax + 0x10], cl
jmp 0x14000ae32
mov rax, qword [rsp + 0x70]
mov word [rax + 0x20], 0x18
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000db06
Capabilities:
Create pipe

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x230
mov rsi, rdx
mov rdi, rcx
call sub.KERNEL32.dll_GetCurrentProcessId
mov ebx, 1
lock xadd dword [0x141337058], ebx
lea rcx, [rsp + 0x1b0]
lea r14, [rsp + 0x50]
mov qword [r14], rcx
mov qword [r14 + 8], 0x80
and qword [r14 + 0x10], 0
mov ebp, eax
mov qword [rsp + 0x48], r14
lea rcx, [rsp + 0x68]
mov qword [rcx], r14
lea rdx, [0x141332290]
mov r8d, 0x1a
call fcn.140008d15
test ax, ax
jne 0x14000dbd2
lea rdx, [rsp + 0x48]
mov ecx, ebp
call fcn.14000fa64
test ax, ax
jne 0x14000dbd2
lea rcx, [rsp + 0x70]
mov qword [rcx], r14
lea rdx, [0x1413322ad]
mov r8d, 1
call fcn.140008d15
test ax, ax
jne 0x14000dbd2
lea rdx, [rsp + 0x48]
mov ecx, ebx
call fcn.14000fa64
test ax, ax
jne 0x14000dbd2
lea rcx, [rsp + 0x78]
mov qword [rcx], r14
lea rdx, [0x1413322b1]
mov r8d, 1
call fcn.140008d15
test ax, ax
je 0x14000dcdb
lea rbx, [rsp + 0x80]
lea r14, [rsp + 0xb0]
mov rcx, rbx
mov rdx, r14
call fcn.14000e2c7
mov rax, qword [rbx]
and word [rsp + rax*2 + 0xb0], 0
lea rax, [0x141331d80]
mov qword [rsp + 0x38], rax
mov eax, 0x1000
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
and dword [rsp + 0x30], 0
mov rcx, r14
mov edx, 0x40000001
xor r8d, r8d
mov r9d, 1
call sub.KERNEL32.dll_CreateNamedPipeW
cmp rax, 0xffffffffffffffff
je 0x14000dca9
mov rbx, rax
mov rax, qword [0x141331d90]
lea r9, [rsp + 0x90]
mov qword [r9 + 0x10], rax
movups xmm0, xmmword [0x141331d80]
movaps xmmword [r9], xmm0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea rcx, [rsp + 0xb0]
mov edx, 0x40000000
xor r8d, r8d
call sub.KERNEL32.dll_CreateFileW
cmp rax, 0xffffffffffffffff
je 0x14000dcb0
mov r14, rax
mov rcx, rbx
call fcn.14000da71
test ax, ax
je 0x14000dcd1
mov ebp, eax
mov rcx, r14
call sub.ntdll.dll_NtClose
mov rcx, rbx
call sub.ntdll.dll_NtClose
jmp 0x14000dcc1
call sub.KERNEL32.dll_GetLastError
jmp 0x14000dcbd
call sub.KERNEL32.dll_GetLastError
mov rcx, rbx
call sub.ntdll.dll_NtClose
mov bp, 0x18
mov eax, ebp
add rsp, 0x230
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov qword [rdi], rbx
mov qword [rsi], r14
xor ebp, ebp
jmp 0x14000dcc1
mov r8, qword [rsp + 0x50]
mov r9, qword [rsp + 0x60]
dec r9
jmp 0x14000dbd2
Function at 0x14000f388
Capabilities:
Create process on windows

Disassembly:
push rsi
sub rsp, 0x50
movaps xmm0, xmmword [rsp + 0x80]
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 1
xor esi, esi
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_CreateProcessW
test eax, eax
jne 0x14000f3dc
call sub.KERNEL32.dll_GetLastError
movzx eax, ax
lea ecx, [rax - 0xbc]
cmp ecx, 0xf
jae 0x14000f3e4
mov si, 0x39
mov eax, esi
add rsp, 0x50
pop rsi
ret
lea ecx, [rax - 2]
cmp ecx, 2
jb 0x14000f40f
cmp eax, 5
je 0x14000f415
cmp eax, 0xb
je 0x14000f3d8
cmp eax, 0x7b
je 0x14000f41b
cmp eax, 0xce
je 0x14000f421
cmp eax, 0xd8
je 0x14000f3d8
mov si, 0x18
jmp 0x14000f3dc
mov si, 0x11
jmp 0x14000f3dc
mov si, 0xb
jmp 0x14000f3dc
mov si, 0x3c
jmp 0x14000f3dc
mov si, 0x10
jmp 0x14000f3dc

Function at 0x140010314
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x40
mov rax, r8
mov rsi, rcx
mov r8d, 0xffffffff
cmp r9, r8
cmovb r8, r9
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
mov rcx, rdx
mov rdx, rax
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x140010351
mov ecx, dword [rsp + 0x3c]
xor eax, eax
jmp 0x1400103dc
call sub.KERNEL32.dll_GetLastError
cmp ax, 6
je 0x140010394
movzx eax, ax
cmp eax, 8
je 0x140010383
cmp eax, 0x21
je 0x1400103a5
cmp eax, 0x6d
je 0x1400103b6
cmp eax, 0x3e3
je 0x1400103c7
cmp eax, 0x6f8
je 0x140010383
cmp eax, 0x718
jne 0x1400103d8
and word [rsp + 0x38], 0
and dword [rsp + 0x34], 0
mov ax, 0x12
jmp 0x1400103dc
and word [rsp + 0x38], 0
and dword [rsp + 0x34], 0
mov ax, 0x2d
jmp 0x1400103dc
and word [rsp + 0x38], 0
and dword [rsp + 0x34], 0
mov ax, 0x2e
jmp 0x1400103dc
and word [rsp + 0x38], 0
and dword [rsp + 0x34], 0
mov ax, 0x1c
jmp 0x1400103dc
and word [rsp + 0x38], 0
and dword [rsp + 0x34], 0
mov ax, 0x1b
jmp 0x1400103dc
mov ax, 0x18
mov qword [rsi], rcx
mov word [rsi + 8], ax
mov eax, dword [rsp + 0x34]
mov dword [rsi + 0xa], eax
movzx eax, word [rsp + 0x38]
mov word [rsi + 0xe], ax
add rsp, 0x40
pop rsi
ret
Function at 0x14001093d
Capabilities:
Set file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov rsi, rcx
bt r9d, 9
mov eax, 0x200040
mov ebx, 0x200001
cmovae ebx, eax
lea eax, [r8 + r8]
mov word [rsp + 0x70], ax
mov word [rsp + 0x72], ax
mov qword [rsp + 0x78], rdx
cmp word [rdx], 0x2e
jne 0x140010995
movzx eax, word [rdx + 2]
cmp eax, 0x2e
je 0x14001098a
test eax, eax
jne 0x140010995
and word [rsp + 0x70], 0
jmp 0x140010995
cmp word [rdx + 4], 0
je 0x140010ad8
lea rdi, [rsp + 0x90]
mov dword [rdi], 0x30
mov rcx, rdx
mov rdx, r8
call fcn.1400103f9
xor ecx, ecx
test al, 1
cmovne rsi, rcx
mov qword [rdi + 8], rsi
and dword [rdi + 0x18], 0
lea rax, [rsp + 0x70]
mov qword [rdi + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rdi + 0x20], xmm0
and dword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
and dword [rsp + 0x28], 0
mov dword [rsp + 0x40], ebx
and qword [rsp + 0x20], 0
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 7
lea rcx, [rsp + 0x60]
lea r9, [rsp + 0x80]
mov edx, 0x110000
mov r8, rdi
call sub.ntdll.dll_NtCreateFile
cmp eax, 0xc0000022
je 0x140010af4
mov ecx, eax
mov ax, 0x11
cmp ecx, 0xc0000034
je 0x140010b18
cmp ecx, 0xc000003a
je 0x140010b18
cmp ecx, 0xc0000043
je 0x140010ad8
cmp ecx, 0xc0000056
je 0x140010ace
cmp ecx, 0xc00000ba
je 0x140010ae4
cmp ecx, 0xc00000be
je 0x140010ad2
cmp ecx, 0xc00000cc
je 0x140010ad2
cmp ecx, 0xc0000103
je 0x140010ade
test ecx, ecx
jne 0x140010b14
lea r8, [rsp + 0x68]
mov byte [r8], 1
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x20], 0xd
lea rdx, [rsp + 0x80]
mov r9d, 1
call sub.ntdll.dll_NtSetInformationFile
cmp eax, 0xc0000022
je 0x140010aea
cmp eax, 0xc00000a2
je 0x140010aea
cmp eax, 0xc0000101
je 0x140010afa
cmp eax, 0xc0000121
je 0x140010aea
test eax, eax
jne 0x140010b0a
mov rcx, qword [rsp + 0x60]
call sub.ntdll.dll_NtClose
xor eax, eax
jmp 0x140010b18
mov ax, 0x17
jmp 0x140010b18
mov ax, 0x2b
jmp 0x140010b18
mov ax, 0x14
jmp 0x140010b18
mov ax, 0x1a
jmp 0x140010b18
mov rcx, qword [rsp + 0x60]
call sub.ntdll.dll_NtClose
mov ax, 0xb
jmp 0x140010b18
mov rcx, qword [rsp + 0x60]
call sub.ntdll.dll_NtClose
mov ax, 0x50
jmp 0x140010b18
mov rcx, qword [rsp + 0x60]
call sub.ntdll.dll_NtClose
mov ax, 0x18
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
ret

Function at 0x140015c5f
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov r8, qword [rdx + 8]
mov r9, qword [rcx + 0x10]
mov r10, r8
sub r10, r9
add qword [rcx + 0x80], r10
mov eax, dword [rcx + 0x20]
test r10, r10
je 0x140015ca5
mov rdx, qword [rdx]
not eax
lea r10, [0x141338180]
movzx r11d, byte [rdx + r9]
movzx esi, al
xor esi, r11d
shr eax, 8
xor eax, dword [r10 + rsi*4]
inc r9
cmp r8, r9
jne 0x140015c89
not eax
mov dword [rcx + 0x20], eax
pop rsi
ret
Function at 0x14001612c
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov eax, dword [0x14133814c]
test eax, eax
jle 0x14001618a
mov rcx, qword [0x141338178]
lea rdx, [rax*8]
lea rdx, [rdx + rdx*4]
xor r8d, r8d
mov r9, qword [rcx + r8 + 0x18]
cmp r9, rsi
ja 0x14001617f
mov r10, qword [rcx + r8 + 0x20]
mov r10d, dword [r10 + 8]
add r9, r10
cmp r9, rsi
ja 0x14001629e
add r8, 0x28
cmp rdx, r8
jne 0x140016160
jmp 0x14001618c
xor eax, eax
mov rcx, qword [0x140019010]
movzx edx, word [rcx]
cmp edx, 0x5a4d
jne 0x1400161f6
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x1400161f6
add rcx, rdx
movzx edx, word [rcx + 0x18]
cmp edx, 0x20b
jne 0x1400161f6
movzx edx, word [rcx + 6]
test edx, edx
je 0x1400161f6
mov r8, rsi
sub r8, qword [0x140019010]
movzx r9d, word [rcx + 0x14]
lea r15, [rcx + r9]
add r15, 0x18
mov ecx, dword [r15 + 0xc]
cmp r8, rcx
jb 0x1400161ee
mov r9d, dword [r15 + 8]
add r9d, ecx
cmp r8, r9
jb 0x140016205
add r15, 0x28
dec edx
jne 0x1400161d9
lea rcx, [0x1413359c7]
mov rdx, rsi
call fcn.1400162e9
mov rdx, qword [0x141338178]
lea r14, [rax + rax*4]
mov qword [rdx + r14*8 + 0x20], r15
mov dword [rdx + r14*8], 0
add rcx, qword [0x140019010]
mov qword [rdx + r14*8 + 0x18], rcx
lea rdx, [rsp + 0x20]
mov r8d, 0x30
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400162b9
mov eax, dword [rsp + 0x44]
cmp eax, 7
jle 0x14001625b
cmp eax, 8
je 0x140016298
cmp eax, 0x40
je 0x140016298
cmp eax, 0x80
je 0x140016298
jmp 0x14001626b
mov r8d, 4
cmp eax, 2
je 0x140016271
cmp eax, 4
je 0x140016298
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rax, qword [0x141338178]
lea r9, [rax + r14*8]
mov qword [r9 + 8], rcx
mov rdx, qword [rsp + 0x38]
mov qword [r9 + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400162d5
inc dword [0x14133814c]
mov rcx, rsi
mov rdx, rbx
mov r8, rdi
call fcn.14000370d
nop
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov edx, dword [r15 + 8]
mov rax, qword [0x141338178]
mov r8, qword [rax + r14*8 + 0x18]
lea rcx, [0x1413359e7]
call fcn.1400162e9
call sub.KERNEL32.dll_GetLastError
lea rcx, [0x141335a18]
mov edx, eax
call fcn.1400162e9
int3
Function at 0x140001df0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001e3a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001e3a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001e3a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001e3a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001e3a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001e3c
xor al, al
add rsp, 0x28
ret
Function at 0x180007410
Capabilities:
Encode data using xor

Disassembly:
xchg esi, eax
adc ebx, dword [rsi - 0x2473ba80]
add dword [rax - 0x5b], ecx
cmp byte [rdx - 0x79], ah
push 4
sbb dh, cl
ror dword [rcx - 0x2afade66], 1
xor dword [rbp - 0x32], eax
adc edi, dword [rbx - 0x5a]
cmp dword [rax - 0x51b3c240], 0x6b
push 0xffffffffffffff91
invalid
xor ebx, dword [rdi]
test al, 0xcf
loopne sym.D3DCOMPILER_47.dll_D3DReflectLibrary
cwde
pop rdx
sub dword [rsi], edi
scasb al, byte [rdi]
adc bh, ah
or ch, byte [rsi - 0x35]
jae 0x1800073b8
add esp, edx
cmp al, 0xda
in al, 0x9b
cmpsd dword [rsi], dword [rdi]
in eax, 0xfa
test byte [rdx + rbx*4], 0x96
mov esp, 0x5a6df5d6
invalid

Function at 0x18147b688
Capabilities:
Encode data using xor

Disassembly:
jmp 0x18147b692
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x18147b6bb
pop rbp
sub rbp, 0x33
sub rbp, 0x147b688
cmp edx, 1
je 0x18147b6fe
ldmxcsr dword [rsp]
add rsp, 8
popfq
pop r15
pop r14
pop r13
pop r12
pop r11
pop r10
pop r9
pop r8
pop rdi
pop rsi
pop rbp
pop rbx
pop rdx
pop rcx
pop rax
xor rax, rax
ret
sub rsp, 0x20
jmp 0x18147b70e
mov rax, 0x147b688
add rax, rbp
add rax, 0xb8
mov rcx, 0x60b
mov rdx, 0x6590e84d
xor byte [rax], dl
inc rax
dec rcx
jne 0x18147b72d
jmp 0x18147b744
add eax, 0xc4c6a4c4
jno 0x18147b798
add rax, 0x4c458ccc
add rax, 0xffffffff8a05a44c
lea ecx, [rdx + 0x4d]
add rax, 0x4d658f8a
add rax, 0x4c05afba
mov esi, es
int3
movsb byte [rdi], byte [rsi]
pop rbx
mov word [r13 + 0x55c7c4f], fs
int3
Function at 0x140002446
Capabilities:
Get common file path
Set current directory

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x258
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1401b46a8]
xor rax, rsp
mov qword [rsp + 0x250], rax
lea rbx, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.140135a50
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, eax
lea rbp, [rsp + 0x28]
mov rcx, rdi
mov rdx, rbp
call fcn.14002b570
test byte [rbp], 1
je 0x1400024ab
mov rcx, qword [rsp + 0x38]
jmp 0x1400024b0
lea rcx, [rsp + 0x2a]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rcx, rbp
call fcn.14002a9e0
movabs r8, 0x7fffffffffffffff
mov rcx, rdi
mov dl, 1
call fcn.140040080
mov ebp, eax
test byte [rdi], 1
je 0x1400024df
mov rdi, qword [rdi + 0x10]
jmp 0x1400024e3
add rdi, 2
mov rcx, rdi
xor edx, edx
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test ebx, ebx
je 0x140002506
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov qword [rsi], rdi
mov dword [rsi + 8], ebp
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140132550
mov rax, rsi
add rsp, 0x258
pop rbx
pop rbp
pop rdi
pop rsi
ret