joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140139a80
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x14065f200]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x14068b16b]
call fcn.1401223be
nop
mov edx, 8
lea rcx, [rbp + 8]
call fcn.14014b8e0
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.14013e430
nop
lea rax, [0x140138730]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.14014fa40
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x140139b5c
lea rcx, [rbp + 8]
call fcn.140150cf0
nop
jmp 0x140139b75
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.14011c950
nop
lea rcx, [rbp + 8]
call fcn.1401443b0
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x14036f2a0]
call fcn.140120fbe
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.14011e705
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret

Function at 0x140139c00
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x14065f200]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x14068b16b]
call fcn.1401223be
nop
mov edx, 8
lea rcx, [rbp + 8]
call fcn.14014b920
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.14013e500
nop
lea rax, [0x140138840]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.14014fa90
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x140139cdc
lea rcx, [rbp + 8]
call fcn.140150d50
nop
jmp 0x140139cf5
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.14011c950
nop
lea rcx, [rbp + 8]
call fcn.140144440
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x14036f320]
call fcn.140120fbe
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.14011e705
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret
Function at 0x140139d80
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x14065f200]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x14068b16b]
call fcn.1401223be
nop
mov edx, 8
lea rcx, [rbp + 8]
call fcn.14014b960
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.14013e5d0
nop
lea rax, [0x140138950]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.14014fae0
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x140139e5c
lea rcx, [rbp + 8]
call fcn.140150db0
nop
jmp 0x140139e75
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.14011c950
nop
lea rcx, [rbp + 8]
call fcn.1401444d0
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x14036f3a0]
call fcn.140120fbe
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.14011e705
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret

Function at 0x140139f00
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x14065f200]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x14068b16b]
call fcn.1401223be
nop
mov edx, 8
lea rcx, [rbp + 8]
call fcn.14014b9a0
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.14013e6a0
nop
lea rax, [0x140138a60]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.14014fb30
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x140139fdc
lea rcx, [rbp + 8]
call fcn.140150e10
nop
jmp 0x140139ff5
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.14011c950
nop
lea rcx, [rbp + 8]
call fcn.140144560
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x14036f420]
call fcn.140120fbe
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.14011e705
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret
Function at 0x1401d2030
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x14065f200]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x14068bf4a]
call fcn.1401223be
nop
mov edx, 8
lea rcx, [rbp + 8]
call fcn.1401e6fc0
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.1401d46c0
nop
lea rax, [0x1401d1920]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.1401ec970
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x1401d210c
lea rcx, [rbp + 8]
call fcn.1401ed400
nop
jmp 0x1401d2125
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.14011c950
nop
lea rcx, [rbp + 8]
call fcn.1401d72a0
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x1403878b0]
call fcn.140120fbe
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.14011e705
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret

Function at 0x140299400
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x20]
lea rcx, [0x14068c55d]
call fcn.1401223be
nop
call fcn.1402977d0
mov qword [rbp + 8], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
shr rax, 0x10
and rax, 0xffff
movzx eax, ax
mov dword [rbp + 0x44], eax
mov rax, qword [rbp + 8]
add rax, 0x2c
mov r9d, 4
mov r8, rax
mov edx, 0x20001004
mov ecx, dword [rbp + 0x44]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x140299473
mov rax, qword [rbp + 8]
mov dword [rax + 0x2c], 0
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x140353d50
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140122805
movzx eax, al
test eax, eax
jne 0x140353d70
mov ecx, 7
call fcn.14012107c
nop
mov byte [rsp + 0x20], 0
call fcn.140121257
mov byte [rsp + 0x21], al
cmp dword [0x140667ac0], 1
jne 0x140353d94
mov ecx, 7
call fcn.14012107c
nop
jmp 0x140353dec
cmp dword [0x140667ac0], 0
jne 0x140353de7
mov dword [0x140667ac0], 1
lea rdx, [0x14036c8c8]
lea rcx, [0x14036c598]
call fcn.14011e5cf
test eax, eax
je 0x140353dc8
mov eax, 0xff
jmp 0x140353ef1
lea rdx, [0x14036c488]
lea rcx, [section..rdata]
call fcn.140121207
mov dword [0x140667ac0], 2
jmp 0x140353dec
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140120f23
call fcn.140120244
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140353e49
mov rcx, qword [rsp + 0x30]
call fcn.14011db75
movzx eax, al
test eax, eax
je 0x140353e49
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x14068f020]
nop
call fcn.1401207bc
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140353e7d
mov rcx, qword [rsp + 0x38]
call fcn.14011db75
movzx eax, al
test eax, eax
je 0x140353e7d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14012203f
nop
call fcn.140353fa0
mov dword [rsp + 0x28], eax
call fcn.14011ff47
movzx eax, al
test eax, eax
jne 0x140353e9c
mov ecx, dword [rsp + 0x28]
call fcn.14011b816
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140353eab
call fcn.140122193
nop
xor edx, edx
mov cl, 1
call fcn.14011d945
mov eax, dword [rsp + 0x28]
jmp 0x140353ef1
add rsp, 0x68
ret
Function at 0x140001b60
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rsi, rcx
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0x20a
call fcn.14002d290
lea rdx, [rbp - 0x60]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x104
ja 0x140001c01
mov r8, 0xffffffffffffffff
lea rcx, [rbp - 0x60]
mov rax, r8
nop dword [rax]
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140001bc0
xor ebx, ebx
cmp word [rbp + rax*2 - 0x62], 0x5c
jne 0x140001bdb
mov word [rbp + rax*2 - 0x62], bx
xorps xmm0, xmm0
mov qword [rsp + 0x50], rbx
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x58], rbx
lea rax, [rbp - 0x60]
inc r8
cmp word [rax + r8*2], bx
jne 0x140001bf1
lea rdx, [rbp - 0x60]
jmp 0x140001c1f
xor ebx, ebx
lea rdx, [0x1400395f0]
xorps xmm0, xmm0
mov qword [rsp + 0x50], rbx
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x58], rbx
xor r8d, r8d
lea rcx, [rsp + 0x40]
call fcn.140008ae0
mov rdi, qword [rsp + 0x50]
mov qword [rsp + 0x2c0], r14
test rdi, rdi
jne 0x140001ca5
xorps xmm0, xmm0
lea rdx, [0x1400395f0]
movups xmmword [rsi], xmm0
xor r8d, r8d
mov qword [rsi + 0x10], rbx
mov rcx, rsi
mov qword [rsi + 0x18], rbx
call fcn.140008ae0
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140001ddb
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001dd6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001e05
jmp 0x140001dd6
lea rcx, [rsp + 0x60]
call fcn.140001a70
movabs rcx, 0x7ffffffffffffffe
mov r14, rax
sub rcx, rdi
cmp rcx, 1
jb 0x140001e0b
cmp qword [rsp + 0x58], 7
lea rax, [0x1400395f4]
mov qword [rsp + 0x30], 1
lea r9, [rsp + 0x40]
cmova r9, qword [rsp + 0x40]
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call fcn.140009250
mov r9, r14
lea r8, [rbp - 0x80]
mov rcx, rsi
call fcn.140009030
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x140001d4c
mov rcx, qword [rbp - 0x80]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d47
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001dff
call fcn.140013630
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x140001d8a
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d85
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001dff
call fcn.140013630
mov rdx, qword [rsp + 0x58]
movdqa xmm0, xmmword [0x1400423d0]
mov word [rsp + 0x60], bx
movdqu xmmword [rsp + 0x70], xmm0
cmp rdx, 7
jbe 0x140001ddb
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001dd6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001dff
call fcn.140013630
mov r14, qword [rsp + 0x2c0]
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x18]
mov rax, rsi
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.14001b408
int3
call fcn.14001b408
int3
call fcn.1400012d0
int3
Function at 0x140005640
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x20
mov r15, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x140005664
xor eax, eax
add rsp, 0x20
pop r15
pop r14
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
je 0x1400056f2
mov rdi, r15
mov qword [rsp + 0x40], rbp
lea rsi, [rcx + 0x50]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400056c0
mov rax, qword [rsi]
movsxd rcx, dword [rax]
test ecx, ecx
jle 0x1400056c0
cmp rdi, rcx
mov rbp, rdi
cmovge rbp, rcx
mov rcx, r14
mov r8, rbp
call fcn.14002cbe0
mov rax, qword [rsi]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1400056dd
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x1400056e5
mov byte [r14], al
lea rsi, [rbx + 0x50]
dec rdi
mov ebp, 1
add r14, rbp
test rdi, rdi
jg 0x140005681
mov rbp, qword [rsp + 0x40]
sub r15, rdi
jmp 0x1400057d0
mov rax, qword [rcx + 0x38]
mov rsi, r15
mov rdx, qword [rax]
test rdx, rdx
je 0x140005709
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000570b
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000573d
cmp rax, r15
mov rdi, r15
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.14002cbe0
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1400057cd
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140005778
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rsi, 0xfff
jbe 0x1400057ae
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.14001abe4
add r14, rax
sub rsi, rax
cmp rax, 0xfff
jne 0x1400057cd
cmp rsi, rax
ja 0x140005781
test rsi, rsi
je 0x1400057cd
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.14001abe4
sub rsi, rax
sub r15, rsi
mov rsi, qword [rsp + 0x48]
mov rax, r15
mov rdi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rbx
ret
Function at 0x14000bdf0
Capabilities:
Get explorer pid

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
mov dword [rsp + 0x30], ebx
call qword [sym.imp.USER32.dll_GetShellWindow]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call fcn.14000b440
mov r9d, eax
call fcn.14000a180
movsx r10d, al
call fcn.14000a170
movsx ecx, al
imul r10d, ecx
call fcn.14000a1b0
movsx r11d, al
lea r8d, [r10 + r10*2]
movsx eax, byte [0x140048cf1]
xor edx, edx
movsx ecx, byte [0x140048cf0]
add eax, r11d
lea eax, [rax + r8*2]
div ecx
movsx ecx, byte [0x140048cf3]
cmp eax, ecx
je 0x14000bf97
movsx eax, byte [0x140048cf2]
movd xmm1, eax
movsx eax, byte [0x140048cf4]
cmp r9d, dword [rsp + 0x30]
cvtdq2pd xmm1, xmm1
sete bl
xor edx, edx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
xorps xmm0, xmm0
cvtsi2sd xmm0, rbx
mulsd xmm1, xmm0
movsd qword [rsp + 0x38], xmm1
movsx eax, byte [0x140048cf1]
movsx ecx, byte [0x140048cf0]
add eax, r11d
lea eax, [rax + r10*8]
div ecx
movsx ecx, byte [0x140048cf3]
cmp eax, ecx
je 0x14000bf06
call fcn.14000a190
movsx edx, al
movsx eax, byte [0x14004ac58]
imul edx, eax
lea r8d, [rdx + rdx*2]
call fcn.14000a1c0
movsx ecx, al
sub r8d, ecx
call fcn.14000a1a0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x140048cf4]
add ecx, r8d
je 0x14000bf06
mov r9d, 8
jmp 0x14000bf69
movsx eax, byte [0x140048cf1]
lea edx, [r10 + r10*4]
movsx ecx, byte [0x140048cf0]
add eax, r11d
lea eax, [rax + rdx*2]
xor edx, edx
div ecx
movsx ecx, byte [0x140048cf3]
cmp eax, ecx
je 0x14000bf64
movsx eax, byte [0x140048cf1]
xor edx, edx
movsx ecx, byte [0x140048cf0]
add eax, r11d
xorps xmm0, xmm0
lea eax, [rax + r10*4]
div ecx
movsx ecx, byte [0x140048cf3]
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x38]
cvttsd2si r9d, xmm0
jmp 0x14000bf69
mov r9d, dword [rsp + 0x30]
movsx eax, byte [0x140048cf1]
xor edx, edx
movsx ecx, byte [0x140048cf0]
add eax, r11d
add eax, r10d
div ecx
movsx ecx, byte [0x140048cf3]
sub eax, ecx
imul eax, r9d
test eax, eax
je 0x14000bf97
call fcn.14000e880
add rsp, 0x20
pop rbx
ret
Function at 0x14000f6a0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, 0x5a4d
mov r8, rdx
cmp word [rcx], ax
jne 0x14000f746
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x14000f746
test rax, rax
je 0x14000f746
mov edx, dword [rax + 0xd8]
test edx, edx
je 0x14000f739
mov rdi, qword [rdx + rcx + 0x58]
test rdi, rdi
je 0x14000f739
sub rcx, r8
movabs rsi, 0x2b992ddfa232
add rdi, rcx
cmp qword [rdi], rsi
jne 0x14000f746
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
movabs rax, 0x2b992ddfa233
xor rcx, rbx
mov rbx, qword [rsp + 0x30]
xor rcx, rsi
cmp rcx, rsi
cmove rcx, rax
mov al, 1
mov qword [rdi], rcx
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov al, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rsi, qword [rsp + 0x38]
xor al, al
add rsp, 0x20
pop rdi
ret

Function at 0x14000fe00
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov eax, 0x5a4d
mov rsi, rdx
mov rdi, rcx
cmp word [rdx], ax
jne 0x14000ff29
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x14000ff29
test rax, rax
je 0x14000ff29
mov ecx, dword [rax + 0xb0]
xor edx, edx
mov qword [rsp + 0x30], rdx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
test ecx, ecx
jne 0x14000fe6d
mov qword [rdi], rdx
mov rax, rdi
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], rdx
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov qword [rsp + 0x60], rbx
lea rbx, [rsi + rcx]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x68], rbp
mov ebp, dword [rax + 0xb4]
add rbp, rbx
cmp rbx, rbp
jae 0x14000ff01
nop
mov r8d, dword [rbx + 4]
test r8d, r8d
je 0x14000ff01
mov eax, dword [rbx]
add rax, rsi
mov qword [rsp + 0x38], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x40], rax
lea rax, [r8 - 8]
shr rax, 1
mov dword [rsp + 0x48], eax
cmp rcx, rdx
je 0x14000feda
movups xmm0, xmmword [rsp + 0x38]
movsd xmm1, qword [rsp + 0x48]
movups xmmword [rcx], xmm0
movsd qword [rcx + 0x10], xmm1
add rcx, 0x18
mov qword [rsp + 0x28], rcx
jmp 0x14000fef6
mov rdx, rcx
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.1400105e0
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, rbp
jb 0x14000fe90
mov rax, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov qword [rdi], rax
mov rax, rdi
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rdx
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov rsi, qword [rsp + 0x70]
xor edx, edx
mov qword [rcx], rdx
mov rax, rdi
mov qword [rcx + 8], rdx
mov qword [rcx + 0x10], rdx
add rsp, 0x50
pop rdi
ret
Function at 0x140011030
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rbx, rcx
lea rcx, [0x140039608]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
je 0x14001122d
mov rcx, qword [rbx + 0x10]
mov qword [rsp + 0xa0], rdi
movabs rdi, 0x7ffffffffffffffe
mov rax, rdi
sub rax, rcx
cmp rax, 0x34
jb 0x140011248
cmp qword [rbx + 0x18], 7
mov rax, rbx
jbe 0x140011096
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
lea r9, str.RegistryMachineSystemCurrentControlSetServices_
mov qword [rsp + 0x28], rax
lea rcx, [rbp + 0x37]
mov qword [rsp + 0x20], 0x34
call fcn.140009250
cmp qword [rbp + 0x4f], 7
lea rdx, [rbp + 0x37]
lea rcx, [rbp + 7]
cmova rdx, qword [rbp + 0x37]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rax, qword [rbx + 0x10]
sub rdi, rax
cmp rdi, 0x22
jb 0x140011248
cmp qword [rbx + 0x18], 7
jbe 0x1400110ec
mov rbx, qword [rbx]
mov qword [rsp + 0x30], rax
lea r9, str.SYSTEMCurrentControlSetServices_
mov qword [rsp + 0x28], rbx
lea rcx, [rbp + 0x17]
mov qword [rsp + 0x20], 0x22
call fcn.140009250
cmp qword [rbp + 0x2f], 7
lea rdx, [rbp + 0x17]
lea r8, [rbp + 0x6f]
mov rcx, 0xffffffff80000002
cmova rdx, qword [rbp + 0x17]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x14001113a
cmp eax, 2
sete bl
jmp 0x140011197
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.NtUnloadDriver
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp + 7]
call rax
lea rdx, [rbp + 0x17]
mov rcx, 0xffffffff80000002
test eax, eax
je 0x14001117d
cmp qword [rbp + 0x2f], 7
cmova rdx, qword [rbp + 0x17]
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
xor bl, bl
jmp 0x140011197
cmp qword [rbp + 0x2f], 7
cmova rdx, qword [rbp + 0x17]
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
test eax, eax
je 0x140011195
xor bl, bl
jmp 0x140011197
mov bl, 1
mov rdx, qword [rbp + 0x2f]
cmp rdx, 7
jbe 0x1400111d3
mov rcx, qword [rbp + 0x17]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400111ce
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011242
call fcn.140013630
mov rdx, qword [rbp + 0x4f]
xor eax, eax
movdqa xmm0, xmmword [0x1400423d0]
mov word [rbp + 0x17], ax
movdqu xmmword [rbp + 0x27], xmm0
cmp rdx, 7
jbe 0x140011222
mov rcx, qword [rbp + 0x37]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001121d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011242
call fcn.140013630
mov rdi, qword [rsp + 0xa0]
movzx eax, bl
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.14001b408
int3
call fcn.1400012d0
int3