joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001120
Capabilities:
Get common file path

Disassembly:
sub rsp, 0xd8
lea r8, str.GlobalAmdlogServiceMutex
xor edx, edx
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
test rax, rax
je 0x140001153
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0xd8
ret
lea rdx, [rsp + 0x68]
mov qword [rsp + 0xd0], rbx
lea rcx, [rsp + 0xa8]
call fcn.140008d20
lea r8, str.GlobalAmdlogServiceMutex
xor edx, edx
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbx, rax
test rax, rax
je 0x1400012c7
mov ecx, 0x58
call fcn.140012d48
test rax, rax
je 0x1400011a4
mov rcx, rax
call fcn.1400012e0
mov qword [0x140077e10], rax
test rax, rax
jne 0x1400011cb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0xd0]
xor eax, eax
add rsp, 0xd8
ret
call fcn.140008d80
test eax, eax
je 0x1400012a3
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x80]
call fcn.140008d20
xor r9d, r9d
lea rcx, [rsp + 0x30]
xor r8d, r8d
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x140077e00], rax
test rax, rax
je 0x1400012a3
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x80]
call fcn.140008d20
xor r9d, r9d
lea rcx, [rsp + 0x30]
xor r8d, r8d
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x140077e18], rax
test rax, rax
je 0x1400012a3
xorps xmm0, xmm0
lea rcx, [rsp + 0x48]
mov edx, SQLGetDiagRec
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov r9, qword [0x140077e10]
lea r8, [0x1400010f0]
mov edx, 8
mov qword [rsp + 0x28], 0
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140077e08], rax
test rax, rax
je 0x1400012a3
mov rcx, qword [0x140077e10]
call fcn.140001a90
call section..text
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140077e10]
test rcx, rcx
je 0x1400012c7
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rbx, qword [rsp + 0xd0]
xor eax, eax
add rsp, 0xd8
ret
Function at 0x140002990
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
push rdi
sub rsp, 0x248
mov rbx, rcx
lea rdi, [rax + 0x10]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x200
call fcn.140013e20
call fcn.140002a30
mov qword [rsp + 0x30], rdi
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rbx
mov ebx, 0x1ff
mov rcx, qword [rax]
mov r9d, ebx
lea r8d, [rbx + 1]
call fcn.140038eb4
test eax, eax
mov ecx, 0xffffffff
cmovs eax, ecx
cmp eax, ecx
lea rcx, [rsp + 0x40]
cmove eax, ebx
cdqe
mov byte [rsp + rax + 0x40], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x248
pop rdi
pop rbx
ret

Function at 0x140003250
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
test rdx, rdx
je 0x14000328e
movups xmm0, xmmword [rdx]
xor eax, eax
lea r8, [0x1400032a0]
mov r9, rcx
mov qword [rsp + 0x28], rax
movups xmmword [rcx + 0x18], xmm0
xor ecx, ecx
mov dword [rsp + 0x20], eax
lea edx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
add rsp, 0x38
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x38
ret
Function at 0x1400034b0
Capabilities:
Get common file path

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
test byte [rcx + 0x40], 1
mov rdi, rdx
mov rbx, rcx
je 0x1400034dc
mov al, 1
add rsp, 0x2c0
pop rdi
pop rbx
pop rbp
ret
xorps xmm0, xmm0
mov qword [rsp + 0x2f8], r14
xor eax, eax
lea rcx, [rbp - 0x70]
xor edx, edx
mov dword [rbp - 0x78], eax
mov r8d, 0x100
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x58], xmm0
xor r14b, r14b
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rsp + 0x40], xmm0
call fcn.140013e20
mov dword [rbp + 0x1f0], 0x100
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
test rdi, rdi
jne 0x140003534
lea rdi, [rbx + 8]
lea rax, [rbp + 0x1f0]
mov r9d, 4
mov qword [rsp + 0x28], rax
lea r8, str.DumpFile
lea rax, [rbp - 0x70]
mov rcx, 0xffffffff80000002
lea rdx, str.SYSTEMCurrentControlSetControlCrashControl
mov qword [rsp + 0x20], rax
call fcn.140002300
test eax, eax
jne 0x1400035a3
mov edx, dword [rbp + 0x1f0]
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rcx, [rbp - 0x70]
dec rcx
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x140003584
movsd xmm0, qword [str.MEMORY.DMP]
mov eax, dword [0x140060c20]
movsd qword [rcx], xmm0
mov dword [rcx + 8], eax
lea rdx, [rsp + 0x30]
mov byte [rbp + 0x1e0], r14b
lea rcx, [rbp - 0x70]
call fcn.140009340
test al, al
je 0x1400036cb
mov qword [rsp + 0x2e8], rsi
lea rdx, [rsp + 0x30]
lea rsi, [rbx + 0x44]
mov rcx, rsi
call fcn.140009bf0
test al, al
je 0x1400036c3
cmp word [rdi], 0
je 0x1400035fc
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140009bf0
test al, al
je 0x1400036c3
mov r8d, dword [rbp + 0x1f0]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x90]
call fcn.140008eb0
lea r9, [rbp + 0x1e0]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x90]
call fcn.140009060
lea rcx, [rbp + 0x90]
movzx r14d, al
call fcn.140009010
test r14b, r14b
je 0x1400036c3
cmp byte [rbp + 0x1e0], 0
je 0x1400036c3
cmp dword [rbx + 0x40], 0
jne 0x14000367d
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.1400082d0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.1400078f0
mov ecx, 3
call fcn.14000acc0
or dword [rbx + 0x40], 1
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140009bf0
test al, al
je 0x1400036c3
movups xmm0, xmmword [rsp + 0x30]
mov dword [rsp + 0x28], SQLPrepare
lea r8, str.Last_AmdlogSr_LastBsodWt
mov r9d, 1
mov qword [rsp + 0x20], rsi
lea rdx, str.SoftwareAMDLOG
mov rcx, 0xffffffff80000002
movups xmmword [rsi], xmm0
call fcn.1400027b0
mov rsi, qword [rsp + 0x2e8]
movzx eax, r14b
mov r14, qword [rsp + 0x2f8]
add rsp, 0x2c0
pop rdi
pop rbx
pop rbp
ret
Function at 0x1400053c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r14, rcx
mov ebp, r9d
mov ecx, 0xa8
mov rdi, r8
mov rsi, rdx
call fcn.140012d48
mov rbx, rax
test rax, rax
je 0x140005539
xorps xmm0, xmm0
lea r8, [0x140004530]
xor r15d, r15d
mov r9, rbx
mov qword [rax + 0x68], r15
xor ecx, ecx
mov dword [rax + 0x70], r15d
movups xmmword [rax], xmm0
xor eax, eax
mov qword [rsp + 0x28], r15
mov qword [rbx + 0x30], rax
lea edx, [r15 + 8]
movups xmmword [rbx + 0x40], xmm0
mov dword [rsp + 0x20], r15d
movups xmmword [rbx + 0x50], xmm0
movups xmmword [rbx + 0x60], xmm0
movups xmmword [rbx + 0x70], xmm0
movups xmmword [rbx + 0x80], xmm0
movups xmmword [rbx + 0x90], xmm0
mov qword [rbx + 0xa0], rax
mov rax, qword [rsp + 0x78]
mov qword [rbx + 0x10], rax
mov eax, dword [rsp + 0x70]
mov dword [rbx + 0x3c], eax
mov qword [rbx + 0x28], rdi
mov qword [rbx + 0x20], rsi
mov qword [rbx + 0x18], r14
mov dword [rbx + 0x38], ebp
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x50], rax
test rax, rax
je 0x14000552c
test rdi, rdi
je 0x1400054db
cmp qword [rdi + 0x1c8], r15
jne 0x1400054b2
mov qword [rdi + 0x1c0], rbx
mov al, 1
mov qword [rdi + 0x1c8], rbx
mov qword [rbx], r15
mov qword [rbx + 8], r15
inc dword [rdi + 0x1d0]
jmp 0x14000553b
mov qword [rbx], r15
mov al, 1
mov rcx, qword [rdi + 0x1c8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 0x1c8]
mov qword [rcx], rbx
inc dword [rdi + 0x1d0]
mov qword [rdi + 0x1c8], rbx
jmp 0x14000553b
cmp qword [rsi + 0x3a0], r15
jne 0x140005503
mov qword [rsi + 0x398], rbx
mov al, 1
mov qword [rsi + 0x3a0], rbx
mov qword [rbx], r15
mov qword [rbx + 8], r15
inc dword [rsi + 0x3a8]
jmp 0x14000553b
mov qword [rbx], r15
mov rax, qword [rsi + 0x3a0]
mov qword [rbx + 8], rax
mov rax, qword [rsi + 0x3a0]
mov qword [rax], rbx
mov al, 1
inc dword [rsi + 0x3a8]
mov qword [rsi + 0x3a0], rbx
jmp 0x14000553b
mov edx, 0xa8
mov rcx, rbx
call fcn.140012d84
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x1400064e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
xor edi, edi
mov rbx, rcx
mov qword [rcx + 0x2370], rdi
cmp dword [0x140077e20], edi
je 0x140006523
mov r9, rcx
mov qword [rsp + 0x28], rdi
xor ecx, ecx
mov dword [rsp + 0x20], edi
lea r8, [0x140004db0]
lea edx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x2370], rax
mov rax, qword [rbx + 0x2360]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov rax, qword [0x140077e00]
mov r9d, 0xffffffff
mov qword [rsp + 0x38], rax
mov rax, qword [0x140077e18]
lea ecx, [r8 + 3]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x1400065ab
mov rcx, rbx
call fcn.140005690
mov rax, qword [rbx + 0x2360]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov rax, qword [0x140077e00]
mov r9d, 0xffffffff
mov qword [rsp + 0x38], rax
mov rax, qword [0x140077e18]
lea ecx, [r8 + 3]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
je 0x140006563
mov rcx, rbx
call fcn.140006400
mov rcx, qword [rbx + 0x2370]
test rcx, rcx
je 0x1400065de
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x2370]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x2370], rdi
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x140009cd0
Capabilities:
Compress data via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
push rbx
push rdi
push r15
sub rsp, 0x80
mov rdi, rcx
xor r15b, r15b
xor ecx, ecx
mov ebx, 0x200
mov dword [rax + 8], ecx
mov r11d, ebx
mov dword [rax - 0x58], ecx
mov r10d, dword [rdi + 4]
sub r10d, 1
je 0x140009d18
cmp r10d, 1
jne 0x140009d1b
mov r11d, 0x100
jmp 0x140009d1b
mov r11d, ecx
mov ecx, dword [rdi]
mov qword [rsp + 0x70], rsi
sub ecx, 1
je 0x140009d41
sub ecx, 1
je 0x140009d3a
cmp ecx, 1
jne 0x140009eb0
lea esi, [rcx + 3]
jmp 0x140009d46
mov esi, 3
jmp 0x140009d46
mov esi, 2
cmp r11d, ebx
je 0x140009eb0
test rdx, rdx
je 0x140009eb0
test r8d, r8d
je 0x140009eb0
test r9, r9
je 0x140009eb0
mov qword [rsp + 0x68], r12
mov r12d, dword [rsp + 0xc0]
test r12d, r12d
je 0x140009eab
mov qword [rsp + 0x60], r13
mov r13, qword [rsp + 0xc8]
test r13, r13
je 0x140009ea6
lea rcx, str.ntdll.dll
mov qword [rsp + 0x78], rbp
or si, r11w
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
test rax, rax
je 0x140009ea1
lea rdx, str.RtlGetCompressionWorkSpaceSize
mov qword [rsp + 0x58], r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlCompressBuffer
mov rcx, rbp
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x48], rax
test r14, r14
je 0x140009e9c
test rax, rax
je 0x140009e9c
lea r8, [rsp + 0x40]
movzx ecx, si
lea rdx, [rsp + 0xa0]
call r14
test eax, eax
jne 0x140009e9c
mov eax, dword [rsp + 0xa0]
test eax, eax
je 0x140009e9c
mov ecx, eax
call fcn.140012dc4
mov rbp, rax
test rax, rax
je 0x140009e9c
mov edx, dword [rdi + 8]
sub edx, 1
je 0x140009e51
sub edx, 1
je 0x140009e4c
sub edx, 1
je 0x140009e45
mov ebx, 0x1000
jmp 0x140009e51
mov ebx, 0x800
jmp 0x140009e51
mov ebx, 0x400
mov r9, qword [rsp + 0xb8]
movzx ecx, si
mov r8d, dword [rsp + 0xb0]
mov rdx, qword [rsp + 0xa8]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], r12d
call qword [rsp + reloc.ODBC32.dll_SQLBindParameter]
mov rcx, rbp
mov ebx, eax
call fcn.140012dcc
test ebx, ebx
movzx r15d, r15b
mov eax, 1
cmove r15d, eax
mov r14, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x78]
mov r13, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
movzx eax, r15b
add rsp, 0x80
pop r15
pop rdi
pop rbx
ret
Function at 0x140009ed0
Capabilities:
Compress data via winapi

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rsi, r9
mov ebp, r8d
mov r14, rdx
mov edi, 0xffffffff
cmp ecx, 1
jne 0x140009f5d
lea rcx, str.ntdll.dll
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x140009f58
lea rdx, str.RtlDecompressBuffer
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140009f4f
mov rax, qword [rsp + 0x68]
mov r9, rsi
mov qword [rsp + 0x28], rax
mov r8d, ebp
mov eax, dword [rsp + 0x60]
mov rdx, r14
mov ecx, 2
mov dword [rsp + 0x20], eax
call r10
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
test edi, edi
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
sete al
add rsp, 0x30
pop r14
ret
Function at 0x140009f90
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0xa0
xor edi, edi
movzx ebp, r8b
mov qword [rcx], rdi
mov esi, edx
mov qword [rcx + 8], rdi
mov r14, rcx
add rcx, 0x10
xor edx, edx
mov r8d, 0x100
mov r15d, r9d
call fcn.140013e20
mov qword [r14 + 0x110], rdi
mov qword [r14 + 0x118], rdi
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
xorps xmm0, xmm0
lea rcx, [rsp + 0x60]
mov qword [r14 + 0x110], rax
movups xmmword [rsp + 0x60], xmm0
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rdx, [0x140077010]
mov eax, edi
mov rcx, rdx
nop dword [rax + rax]
cmp esi, dword [rcx]
je 0x14000a021
inc eax
add rcx, 0xc
cmp eax, 9
jb 0x14000a010
jmp 0x14000a02a
lea rcx, [rax + rax*2]
mov rdi, qword [rdx + rcx*4 + 4]
xorps xmm0, xmm0
lea rcx, [rsp + 0x70]
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x90], rax
dec rcx
movups xmmword [rsp + 0x80], xmm0
nop dword [rax]
cmp byte [rcx + 1], al
lea rcx, [rcx + 1]
jne 0x14000a050
mov eax, dword [0x140060dd8]
lea rdx, [r14 + 0x10]
movsd xmm0, qword [str._SystemRoot_]
mov r8d, 0x100
movsd qword [rcx], xmm0
mov dword [rcx + 8], eax
movzx eax, byte [0x140060ddc]
mov byte [rcx + 0xc], al
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea rcx, [r14 + 0xf]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x14000a091
movups xmm0, xmmword [str.System32AMDReal_]
movups xmmword [rcx], xmm0
mov eax, dword [0x140061588]
mov dword [rcx + 0x10], eax
test bpl, bpl
je 0x14000a0d2
lea rcx, [r14 + 0xf]
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x14000a0c0
mov eax, dword [0x14006158c]
mov dword [rcx], eax
lea rcx, [r14 + 0xf]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x14000a0d6
movzx eax, word [0x140061590]
mov word [rcx], ax
movzx eax, byte [0x140061592]
mov byte [rcx + 2], al
lea rcx, [r14 + 0xf]
nop dword [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x14000a100
xor edx, edx
nop dword [rax]
movzx eax, byte [rdi + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14000a110
lea rcx, [r14 + 0xf]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x14000a123
movzx eax, word [0x140061594]
movzx edx, word [rsp + 0x6e]
movzx r8d, word [rsp + 0x6c]
movzx r9d, word [rsp + 0x6a]
movzx r10d, word [rsp + 0x68]
movzx r11d, word [rsp + 0x66]
movzx edi, word [rsp + 0x62]
movzx esi, word [rsp + 0x60]
mov word [rcx], ax
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r14 + rax + 0x10], 0
jne 0x14000a165
mov dword [rsp + 0x50], edx
lea rcx, [r14 + 0x10]
mov dword [rsp + 0x48], r8d
lea rdx, str.grp__d_cat__d__d__d__d__d__d__d__d.log
mov dword [rsp + 0x40], r9d
mov r8d, r15d
mov r9d, dword [rsp + 0xe0]
mov dword [rsp + 0x38], r10d
mov dword [rsp + 0x30], r11d
mov eax, eax
mov dword [rsp + 0x28], edi
add rcx, rax
mov dword [rsp + 0x20], esi
call fcn.140007200
lea r11, [rsp + 0xa0]
mov rax, r14
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14000acc0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp dword [0x140077e24], 0
je case.default.0x14000acf4
xor eax, eax
movsxd r9, ecx
mov qword [rsp + 0x28], rax
lea r8, [0x14000a4c0]
xor ecx, ecx
mov dword [rsp + 0x20], eax
lea edx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
add rsp, 0x38
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x38
ret

Function at 0x14000b200
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x330]
sub rsp, 0x430
mov rsi, r8
mov qword [rsp + 0x58], 0
mov r15, rdx
mov rbx, rcx
xor edx, edx
lea rcx, [rbp - 0x10]
mov r8d, 0x338
mov r14d, r9d
xor dil, dil
call fcn.140013e20
cmp rbx, 0xffffffffffffffff
je 0x14000b3b5
xor eax, eax
mov qword [rsp + 0x38], 0
test rsi, rsi
mov qword [rsp + 0x44], r15
mov r9d, SQLGetDiagRec
mov qword [rsp + 0x4c], rsi
setne al
mov dword [rsp + 0x54], r14d
add eax, 5
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov edx, 0xdc7fe404
lea rax, [rbp + 0x350]
mov rcx, rbx
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x10]
mov dword [rsp + 0x28], 0x338
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, 1
sete dil
jne 0x14000b3b5
cmp dword [rbp - 0x10], 0
jne 0x14000b3b5
mov rbx, qword [rbp + 0x370]
lea rdx, str.System32AMD
movups xmm0, xmmword [rbp - 0xc]
mov rcx, rbx
movups xmm1, xmmword [rbp + 4]
movups xmmword [rbx], xmm0
movups xmm0, xmmword [rbp + 0x14]
movups xmmword [rbx + 0x10], xmm1
movups xmm1, xmmword [rbp + 0x24]
movups xmmword [rbx + 0x20], xmm0
movups xmm0, xmmword [rbp + 0x34]
movups xmmword [rbx + 0x30], xmm1
movups xmm1, xmmword [rbp + 0x44]
movups xmmword [rbx + 0x40], xmm0
movups xmm0, xmmword [rbp + 0x54]
movups xmmword [rbx + 0x50], xmm1
movups xmm1, xmmword [rbp + 0x64]
movups xmmword [rbx + 0x60], xmm0
movups xmmword [rbx + 0x70], xmm1
mov eax, dword [0x140060dd8]
movsd xmm0, qword [str._SystemRoot_]
mov dword [rsp + 0x68], eax
movzx eax, byte [0x140060ddc]
mov byte [rsp + 0x6c], al
xor eax, eax
movsd qword [rsp + 0x60], xmm0
xorps xmm0, xmm0
mov dword [rbp - 0x23], eax
movups xmmword [rsp + 0x6d], xmm0
movups xmmword [rsp + 0x7d], xmm0
movups xmmword [rbp - 0x73], xmm0
movups xmmword [rbp - 0x63], xmm0
movups xmmword [rbp - 0x53], xmm0
movups xmmword [rbp - 0x43], xmm0
movups xmmword [rbp - 0x33], xmm0
call fcn.140013fb0
mov r9, rax
test rax, rax
je 0x14000b3b5
lea rcx, [rsp + 0x60]
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x14000b380
xor r8d, r8d
nop dword [rax]
movzx eax, byte [r9 + r8]
mov byte [rcx + r8], al
lea r8, [r8 + 1]
test al, al
jne 0x14000b390
mov r8d, 0x80
lea rcx, [rsp + 0x60]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea r11, [rsp + 0x430]
test dil, dil
mov rbx, qword [r11 + 0x28]
mov eax, 8
cmovne eax, dword [rbp - 0x10]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000b3e0
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0xb0
mov eax, dword [0x140060dd8]
lea rdx, str.System32AMD
movsd xmm0, qword [str._SystemRoot_]
mov rbx, rcx
mov dword [rsp + 0x28], eax
movzx eax, byte [0x140060ddc]
mov byte [rsp + 0x2c], al
xor eax, eax
movsd qword [rsp + 0x20], xmm0
xorps xmm0, xmm0
mov dword [rsp + 0x9d], eax
movups xmmword [rsp + 0x2d], xmm0
movups xmmword [rsp + 0x3d], xmm0
movups xmmword [rsp + 0x4d], xmm0
movups xmmword [rsp + 0x5d], xmm0
movups xmmword [rsp + 0x6d], xmm0
movups xmmword [rsp + 0x7d], xmm0
movups xmmword [rsp + 0x8d], xmm0
call fcn.140013fb0
mov r8, rax
test rax, rax
je 0x14000b494
lea rcx, [rsp + 0x20]
dec rcx
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x14000b460
xor edx, edx
nop dword [rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14000b470
mov r8d, 0x80
lea rcx, [rsp + 0x20]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
add rsp, 0xb0
pop rbx
ret
Function at 0x14000e1b0
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov edi, r9d
mov qword [rcx + 0x38], 1
mov rsi, r8
mov qword [rsp + 0x20], 1
mov ebp, edx
mov rbx, rcx
call sym.amdfendrsr.exe_amdlogumlib_get_timestamp_frequency
mov rdx, qword [rbx]
lea r8, [rsp + 0x20]
mov rcx, rbx
mov qword [rsp + 0x28], rax
call fcn.14000e560
lea rcx, [rbx + 0x178]
mov r9d, edi
mov r8, rsi
mov edx, ebp
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp 0x14000eb80
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
xorps xmm0, xmm0
xorps xmm1, xmm1
xor esi, esi
mov rax, r8
mov r14d, edx
mov rbx, rcx
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm1
movups xmmword [rsp + 0x40], xmm1
movups xmmword [rsp + 0x50], xmm1
movups xmmword [rsp + 0x60], xmm1
movups xmmword [rsp + 0x70], xmm1
movups xmmword [rbp - 0x80], xmm1
movups xmmword [rbp - 0x70], xmm1
movups xmmword [rbp - 0x60], xmm1
test r8, r8
je 0x14000ec26
test r9d, r9d
je 0x14000ec26
mov r8d, r9d
lea rcx, [rsp + 0x30]
mov rdx, rax
call fcn.140014470
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
jne 0x14000ec4b
lea eax, [rsi + 0xa]
jmp 0x14000ecff
movups xmm0, xmmword [str.SystemRootSystem32AMD]
movzx eax, byte [0x140061cc0]
movsd xmm1, qword [0x140061cb8]
movaps xmmword [rsp + 0x30], xmm0
movsd qword [rsp + 0x40], xmm1
mov byte [rsp + 0x48], al
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x300], rdi
call fcn.14000b3e0
lea r9, [rsp + 0x30]
mov edx, 0x80
lea r8, str._s.log
lea rcx, [rbp - 0x50]
call fcn.14000f570
lea rdx, [rbp + 0xb0]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000ecf5
lea rax, [rbp + 0xdc]
mov edx, 0x80
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r8, str._s_s
lea rcx, [rbp + 0x30]
call fcn.14000f570
mov r8d, r14d
lea rdx, [rbp + 0x30]
mov rcx, rbx
call fcn.14000ed30
mov esi, eax
test eax, eax
je 0x14000ecd8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0xf8], eax
lea rdx, [rbp + 0xb0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14000ec91
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdi, qword [rsp + 0x300]
mov eax, esi
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret