joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140028f32
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp - 0x10], 0
mov rax, qword [rbp + 0x10]
mov dword [rbp - 4], eax
call sym.__pthread_self_lite
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov rdx, qword [rbp + 0x10]
mov qword [rax + 8], rdx
mov rax, qword [rbp - 0x18]
mov rax, qword [rax + 0x1d8]
mov rcx, rax
call sym._pthread_cleanup_dest
mov rax, qword [rbp - 0x18]
movzx eax, byte [rax + 0x40]
and eax, 0x30
test al, al
jne 0x140028f9f
mov rax, qword [rbp - 0x18]
add rax, 0xd0
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_longjmp]
call rax
mov eax, dword [0x1400325d0]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x1400290e3
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x14002903c
mov rax, qword [rbp - 0x10]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x140028ff7
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 8]
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.push_pthread_mem
mov qword [rbp - 0x10], 0
mov eax, dword [0x1400325d0]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
jmp 0x1400290e3
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 8]
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xbc], 1
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x140029076
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x44]
and eax, 4
test eax, eax
je 0x1400290e3
mov rax, qword [rbp - 0x10]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x28], 0
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.push_pthread_mem
mov qword [rbp - 0x10], 0
mov eax, dword [0x1400325d0]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
mov eax, dword [rbp - 4]
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll__endthreadex]
call rax
nop
Function at 0x140029d25
Capabilities:
Set thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov dword [rbp - 0x14], 0
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
call sym._fpreset
lea rax, [0x1400325e0]
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_lock
lea rax, [sym.pthread_tls_init]
mov rdx, rax
lea rax, [0x140042ff0]
mov rcx, rax
call sym._pthread_once_raw
mov eax, dword [0x1400325d0]
mov rdx, qword [rbp - 8]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov rdx, qword [rbp - 8]
mov dword [rdx + 0x70], eax
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rdx, rbp
mov rax, qword [rbp - 8]
add rax, 0xd0
mov rcx, rax
call sym._setjmp
test eax, eax
jne 0x140029e3a
mov qword [rbp - 0x10], pe_nt_image_headers64
lea rax, [0x1400325e0]
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x140029e08
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
mov rcx, rax
call rdx
mov qword [rbp - 0x10], rax
nop
nop
lea rax, [0x1400325e0]
mov rcx, rax
call sym.pthread_mutex_lock
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov qword [rax + 8], rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x1d8]
mov rcx, rax
call sym._pthread_cleanup_dest
jmp 0x140029e49
lea rax, [0x1400325e0]
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
mov dword [rbp - 0x14], eax
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x140029e85
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 8]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x140029ef3
mov rax, qword [rbp - 8]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_destroy
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.push_pthread_mem
mov qword [rbp - 8], 0
mov eax, dword [0x1400325d0]
mov rdx, qword [rbp - 8]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
jmp 0x140029f3d
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_destroy
mov rax, qword [rbp - 8]
mov qword [rax + 0x38], 0xffffffffffffffff
mov rax, qword [rbp - 8]
mov dword [rax + 0xbc], 1
jmp 0x140029f3d
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, [0x1400325e0]
mov rcx, rax
call sym.pthread_mutex_unlock
test eax, eax
je 0x140029f2f
mov eax, dword [rbp - 0x14]
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll__endthreadex]
call rax
nop
Function at 0x1400053f3
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1d8
movaps xmmword [rsp + 0x1c0], xmm6
test rdx, rdx
je 0x14000564c
mov r12, r8
mov rdi, rdx
mov rsi, rcx
xorps xmm0, xmm0
lea rbp, [rsp + 0x70]
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
xor ebx, ebx
lea rcx, [rsp + 0xb8]
mov r8d, 0x108
xor edx, edx
call fcn.140018940
mov r9d, 0x40
mov rcx, rsi
mov rdx, rbp
mov r8, rdi
call fcn.140004198
test al, al
je 0x14000564e
movzx eax, word [rsp + 0x70]
cmp eax, 0x5a4d
jne 0x14000564c
movsxd r8, dword [rsp + 0xac]
add r8, rdi
lea rdx, [rsp + 0xb8]
mov r9d, 0x108
mov rcx, rsi
call fcn.140004198
test al, al
je 0x14000564c
cmp dword [rsp + 0xb8], 0x4550
jne 0x14000564c
mov r13d, dword [rsp + 0x140]
xor ebx, ebx
test r13, r13
je 0x14000564e
mov ebp, dword [rsp + 0x144]
test ebp, ebp
je 0x14000564e
xor ecx, ecx
mov rdx, rbp
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
lea r8, [rdi + r13]
mov rcx, rsi
mov rdx, rax
mov qword [rsp + 0x38], r8
mov r9, rbp
call fcn.140004198
test al, al
je 0x140005637
mov qword [rsp + 0x28], rbp
cmp dword [r15 + 0x18], 0
je 0x140005637
mov rbp, r15
sub rbp, r13
mov eax, dword [r15 + 0x1c]
mov r14d, dword [r15 + 0x20]
add r14, rbp
mov ecx, dword [r15 + 0x24]
add rcx, rbp
mov qword [rsp + 0x60], rcx
add rax, rbp
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x38]
add qword [rsp + 0x28], rax
xor r13d, r13d
movaps xmm6, xmmword [0x140043760]
mov qword [rsp + 0x30], rbp
mov esi, dword [r14 + r13*4]
add rsi, rbp
mov qword [rsp + 0x40], 0
movups xmmword [rsp + 0x50], xmm6
mov byte [rsp + 0x40], 0
mov rcx, rsi
call fcn.140023b70
lea rcx, [rsp + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.140006dbc
cmp qword [r12 + 0x18], 0xf
mov rdx, r12
jbe 0x14000559f
mov rdx, qword [r12]
cmp qword [rsp + 0x58], 0xf
lea rcx, [rsp + 0x40]
jbe 0x1400055b1
mov rcx, qword [rsp + 0x40]
call fcn.14001ef20
mov esi, eax
test eax, eax
jne 0x14000560b
mov rax, qword [rsp + 0x60]
movzx eax, word [rax + r13*2]
mov rcx, qword [rsp + 0x68]
mov ebp, dword [rcx + rax*4]
cmp rbp, 0x1001
jae 0x1400055db
xor ebx, ebx
jmp 0x140005606
add rbp, rdi
mov rcx, r15
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
cmp rbp, qword [rsp + 0x28]
mov ebx, 0
cmova rbx, rbp
cmp rbp, qword [rsp + 0x38]
cmovb rbx, rbp
mov rbp, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140005623
mov rcx, qword [rsp + 0x40]
inc rdx
call fcn.14000703b
test esi, esi
je 0x14000564e
inc r13
mov eax, dword [r15 + 0x18]
cmp r13, rax
jb 0x14000555e
xor ebx, ebx
mov rcx, r15
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14000564e
xor ebx, ebx
mov rax, rbx
movaps xmm6, xmmword [rsp + 0x1c0]
add rsp, 0x1d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140007ebe
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test r8, r8
jle 0x140007ef7
mov r14, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x140007eff
mov rcx, rbx
mov rdx, rdi
mov r8, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp method.std::basic_streambuf_char__struct_std::char_traits_char__.virtual_64
xor r14d, r14d
jmp 0x140007fdb
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x140007f45
mov rax, qword [rbx + 0x50]
movsxd r15, dword [rax]
test r15, r15
je 0x140007f45
cmp r15, r14
cmovae r15, r14
mov rcx, rdi
mov r8, r15
call fcn.140018290
add rdi, r15
mov rsi, r14
sub rsi, r15
mov rax, qword [rbx + 0x50]
sub dword [rax], r15d
mov rax, qword [rbx + 0x38]
movsxd rcx, r15d
add qword [rax], rcx
jmp 0x140007f48
mov rsi, r14
cmp qword [rbx + 0x80], 0
je 0x140007fd8
mov rax, qword [rbx + 0x18]
lea rcx, [rbx + 0x70]
cmp qword [rax], rcx
jne 0x140007f82
mov ecx, dword [rbx + 0x90]
mov rdx, qword [rbx + 0x88]
mov qword [rax], rdx
mov rax, qword [rbx + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbx + 0x50]
mov dword [rax], ecx
cmp rsi, 0x1000
jb 0x140007fb5
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rdi
call fcn.140020234
add rdi, rax
sub rsi, rax
cmp rax, 0xfff
je 0x140007f82
jmp 0x140007fd8
test rsi, rsi
je 0x140007fd6
mov r9, qword [rbx + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, rsi
call fcn.140020234
sub rsi, rax
jmp 0x140007fd8
xor esi, esi
sub r14, rsi
mov rax, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, r8
mov rdi, r8
test r8, r8
jle 0x140008611
mov r15, rdx
mov rbx, rcx
mov rdi, r14
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400085f5
mov rax, qword [rbx + 0x50]
movsxd rsi, dword [rax]
test rsi, rsi
jle 0x1400085f5
cmp rdi, rsi
cmovl rsi, rdi
mov rcx, r15
mov r8, rsi
call fcn.140018290
add r15, rsi
sub rdi, rsi
mov rax, qword [rbx + 0x50]
sub dword [rax], esi
mov rax, qword [rbx + 0x38]
movsxd rcx, esi
add qword [rax], rcx
jmp 0x14000860c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140008611
mov byte [r15], al
inc r15
dec rdi
test rdi, rdi
jg 0x1400085b3
sub r14, rdi
mov rax, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14000d3f1
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x260
lea rbp, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
xor r14d, r14d
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x1d8], rax
cmp rax, 0xffffffffffffffff
je 0x14000d47b
mov rbx, rax
xor r14d, r14d
lea rsi, [rbp - 0x60]
mov r8d, 0x238
mov rcx, rsi
xor edx, edx
call fcn.140018940
mov dword [rsi], 0x238
mov rcx, rbx
mov rdx, rsi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14000d47b
lea rbx, [rbp - 0x60]
cmp dword [rbp - 0x58], edi
je 0x14000d477
mov rcx, qword [rbp + 0x1d8]
mov rdx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14000d45d
jmp 0x14000d47b
mov r14d, dword [rbp - 0x40]
mov rcx, qword [rbp + 0x1d8]
cmp rcx, 0xffffffffffffffff
je 0x14000d48e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r14d
add rsp, 0x260
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret

Function at 0x14000d4d4
Capabilities:
Get explorer pid

Disassembly:
push rsi
sub rsp, 0x30
mov rax, qword [0x14005f788]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rsi, [rsp + 0x24]
mov dword [rsi], 0
call qword [sym.imp.USER32.dll_GetShellWindow]
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call fcn.14000d3f1
cmp eax, dword [rsi]
jne 0x14000d54f
lea rsi, [0x140060d00]
lea rdx, str.___Pausing_to_allow_for_debugging
mov rcx, rsi
call fcn.140001c6b
mov rcx, rax
call fcn.14000165c
lea rdx, str.___Press_enter_to_close
mov rcx, rsi
call fcn.140001c6b
mov rcx, rax
call fcn.14000165c
lea rcx, [0x140060b50]
call fcn.14000d564
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140012be0
nop
add rsp, 0x30
pop rsi
ret
Function at 0x140010513
Capabilities:
Parse pe header

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
movzx eax, word [rdx]
cmp eax, 0x5a4d
jne 0x140010600
mov rdi, rdx
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x140010600
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], 0
mov ebx, dword [rdi + rax + 0xb0]
test rbx, rbx
je 0x140010600
add rbx, rdi
mov r12d, dword [rdi + rax + 0xb4]
add r12, rbx
cmp rbx, r12
jae 0x140010622
movabs r13, 0x1fffffff8
lea r14, [rbp - 0x20]
lea r15, [rbp - 0x38]
cmp dword [rbx + 4], 0
je 0x1400105f6
mov eax, dword [rbx]
add rax, rdi
mov qword [rbp - 0x38], rax
lea rax, [rbx + 8]
mov qword [rbp - 0x30], rax
mov eax, dword [rbx + 4]
add rax, r13
shr rax, 1
mov dword [rbp - 0x28], eax
mov rdx, qword [rbp - 0x18]
cmp rdx, qword [rbp - 0x10]
je 0x1400105e0
mov rax, qword [rbp - 0x28]
mov qword [rdx + 0x10], rax
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [rdx], xmm0
add qword [rbp - 0x18], 0x18
jmp 0x1400105eb
mov rcx, r14
mov r8, r15
call fcn.14001092c
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, r12
jb 0x14001059d
mov rax, qword [rbp - 0x10]
movaps xmm0, xmmword [rbp - 0x20]
jmp 0x140010624
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
xor eax, eax
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rax
jmp 0x14001060e
Function at 0x14001066d
Capabilities:
Parse pe header

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xd8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x40], xmm7
movaps xmmword [rbp + 0x30], xmm6
mov qword [rbp + 0x28], 0xfffffffffffffffe
movzx eax, word [rdx]
cmp eax, 0x5a4d
jne 0x140010811
mov rdi, rdx
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x140010811
mov r13d, dword [rdi + rax + 0x90]
test r13, r13
je 0x140010811
mov qword [rbp - 0x48], rcx
xorps xmm6, xmm6
lea rax, [rbp - 0x60]
movaps xmmword [rax], xmm6
mov qword [rax + 0x10], 0
add r13, rdi
xor r15d, r15d
movaps xmm7, xmmword [0x140043760]
mov rbx, rbp
cmp dword [r13 + 0x10], 0
je 0x14001083e
mov qword [rbp - 0x40], r15
movups xmmword [rbp - 0x30], xmm7
mov byte [rbp - 0x40], r15b
lea rax, [rbp - 0x20]
mov qword [rax + 0x10], r15
movups xmmword [rax], xmm6
mov esi, dword [r13 + 0xc]
add rsi, rdi
mov qword [rbp], r15
movups xmmword [rbp + 0x10], xmm7
mov byte [rbp], r15b
mov rcx, rsi
call fcn.140023b70
mov rcx, rbx
mov rdx, rsi
mov r8, rax
call fcn.140006dbc
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x140010752
mov rcx, qword [rbp - 0x40]
inc rdx
call fcn.14000703b
movups xmm0, xmmword [rbp]
movups xmm1, xmmword [rbp + 0x10]
movaps xmmword [rbp - 0x30], xmm1
movaps xmmword [rbp - 0x40], xmm0
mov r14d, dword [r13]
cmp qword [r14 + rdi], 0
je 0x1400107dc
add r14, rdi
mov r12d, dword [r13 + 0x10]
add r12, rdi
mov qword [rbp], 0
movups xmmword [rbp + 0x10], xmm7
mov byte [rbp], 0
mov rax, qword [r14]
lea rsi, [rax + rdi]
add rsi, 2
mov rcx, rsi
call fcn.140023b70
mov rcx, rbx
mov rdx, rsi
mov r8, rax
call fcn.140006dbc
mov qword [rbp + 0x20], r12
lea rcx, [rbp - 0x20]
mov rdx, rbx
call fcn.140010a6e
add r14, 8
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x1400107d2
mov rcx, qword [rbp]
inc rdx
call fcn.14000703b
add r12, 8
cmp qword [r14], 0
jne 0x140010777
lea rcx, [rbp - 0x60]
lea rdx, [rbp - 0x40]
call fcn.140010d70
lea rcx, [rbp - 0x20]
call fcn.140010126
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x140010808
mov rcx, qword [rbp - 0x40]
inc rdx
call fcn.14000703b
add r13, 0x14
jmp 0x1400106f1
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
mov rax, rcx
movaps xmm6, xmmword [rbp + 0x30]
movaps xmm7, xmmword [rbp + 0x40]
add rsp, 0xd8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [rbp - 0x60]
mov rax, qword [rcx + 0x10]
mov qword [rcx + 0x10], 0
movaps xmm0, xmmword [rcx]
xorps xmm1, xmm1
movaps xmmword [rcx], xmm1
mov rsi, qword [rbp - 0x48]
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rax
call fcn.140010094
mov rax, rsi
jmp 0x140010822
Function at 0x14001180f
Capabilities:
Delete registry key

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, rcx
lea rcx, [0x14004f9b2]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1400118b9
mov rsi, rax
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
lea rbx, [rbp - 0x48]
mov rcx, rbx
mov r8, rdi
call fcn.1400117a6
cmp qword [rbx + 0x18], 7
jbe 0x140011863
mov rbx, qword [rbp - 0x48]
lea rcx, [rbp - 0x58]
mov rdx, rbx
call sub.ntdll.dll_RtlInitUnicodeString
lea rdx, str.SYSTEMCurrentControlSetServices_
lea rbx, [rbp - 0x20]
mov rcx, rbx
mov r8, rdi
call fcn.1400117a6
cmp qword [rbp - 8], 7
jbe 0x140011890
mov rbx, qword [rbp - 0x20]
lea r8, [rbp - 0x28]
mov rcx, 0xffffffff80000002
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x1400118c0
mov sil, 1
cmp eax, 2
je 0x14001196d
jmp 0x14001196b
xor esi, esi
jmp 0x1400119a3
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.NtUnloadDriver
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x58]
call rax
mov esi, eax
lea rcx, [0x140060d00]
lea rdx, str.___NtUnloadDriver_Status_0x
call fcn.1400013b4
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov edx, 0xfffff1ff
and edx, dword [rax + rcx + 0x18]
or edx, 0x800
mov dword [rax + rcx + 0x18], edx
mov rcx, rax
mov edx, esi
call fcn.14000fc96
mov rcx, rax
call fcn.14000165c
test esi, esi
je 0x14001194d
lea rcx, [0x140060d00]
lea rdx, str.____Driver_Unload_Failed__
call fcn.1400013b4
mov rcx, rax
call fcn.14000165c
cmp qword [rbp - 8], 7
jbe 0x14001195a
mov rdx, qword [rbp - 0x20]
jmp 0x14001195e
cmp qword [rbp - 8], 7
jbe 0x1400119b1
mov rdx, qword [rbp - 0x20]
jmp 0x1400119b5
lea rdx, [rbp - 0x20]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
xor esi, esi
mov rax, qword [rbp - 8]
cmp rax, 8
jb 0x140011988
mov rcx, qword [rbp - 0x20]
lea rdx, [rax + rax]
add rdx, 2
call fcn.14000703b
mov rax, qword [rbp - 0x30]
cmp rax, 8
jb 0x1400119a3
mov rcx, qword [rbp - 0x48]
lea rdx, [rax + rax]
add rdx, 2
call fcn.14000703b
mov eax, esi
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rdx, [rbp - 0x20]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
test eax, eax
sete sil
jmp 0x14001196d
Function at 0x140011a3c
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x238
mov rsi, rcx
lea rdi, [rsp + 0x20]
mov r8d, 0x20a
mov rcx, rdi
xor edx, edx
call fcn.140018940
mov ecx, 0x105
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x105
jb 0x140011ab5
lea rcx, [0x140060d00]
lea rdx, str.____Failed_to_get_temp_path
call fcn.140001c6b
mov rcx, rax
call fcn.14000165c
mov qword [rsi], 0
movaps xmm0, xmmword [0x140043770]
movups xmmword [rsi + 0x10], xmm0
mov word [rsi], 0
lea rdx, [0x14005215a]
mov rcx, rsi
xor r8d, r8d
jmp 0x140011afb
lea rcx, [rsp + 0x20]
call fcn.1400245c8
cmp word [rsp + rax*2 + 0x1e], 0x5c
jne 0x140011ace
mov word [rsp + rax*2 + 0x1e], 0
mov qword [rsi], 0
movaps xmm0, xmmword [0x140043770]
movups xmmword [rsi + 0x10], xmm0
mov word [rsi], 0
lea rdi, [rsp + 0x20]
mov rcx, rdi
call fcn.1400245c8
mov rcx, rsi
mov rdx, rdi
mov r8, rax
call fcn.14000737e
mov rax, rsi
add rsp, 0x238
pop rdi
pop rsi
ret

Function at 0x140011d9e
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
movaps xmmword [rsp + 0x50], xmm6
mov r15, rcx
lea r9, [rsp + 0x2c]
mov dword [r9], 0
xor r12d, r12d
mov ecx, 0xb
xor edx, edx
xor r8d, r8d
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
jne 0x140011f24
xor edi, edi
mov rsi, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea rbx, [rsp + 0x2c]
mov r13, qword [sym.imp.KERNEL32.dll_VirtualFree]
test rdi, rdi
je 0x140011e07
mov rcx, rdi
xor edx, edx
mov r8d, 0x8000
call r13
mov edx, dword [rsp + 0x2c]
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 4
call rsi
mov rdi, rax
mov r8d, dword [rsp + 0x2c]
mov ecx, 0xb
mov rdx, rax
mov r9, rbx
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
je 0x140011df4
test eax, eax
js 0x140011f06
test rdi, rdi
je 0x140011f21
cmp dword [rdi], 0
je 0x140011f0b
mov rbx, rdi
add rbx, 0x30
xor esi, esi
movaps xmm6, xmmword [0x140043760]
lea r14, [rsp + 0x30]
movzx ebp, word [rbx - 2]
add rbp, rbx
mov qword [rsp + 0x30], 0
movups xmmword [rsp + 0x40], xmm6
mov byte [rsp + 0x30], 0
mov rcx, rbp
call fcn.140023b70
mov rcx, r14
mov rdx, rbp
mov r8, rax
call fcn.140006dbc
cmp qword [r15 + 0x18], 0xf
mov rdx, r15
jbe 0x140011ea6
mov rdx, qword [r15]
cmp qword [rsp + 0x48], 0xf
mov rcx, r14
jbe 0x140011eb6
mov rcx, qword [rsp + 0x30]
call fcn.14001ef20
mov ebp, eax
test eax, eax
jne 0x140011ed3
mov r12, qword [rbx - 0x18]
mov rcx, rdi
xor edx, edx
mov r8d, 0x8000
call r13
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140011eeb
mov rcx, qword [rsp + 0x30]
inc rdx
call fcn.14000703b
test ebp, ebp
je 0x140011f24
inc rsi
mov eax, dword [rdi]
add rbx, 0x128
cmp rsi, rax
jb 0x140011e69
jmp 0x140011f0b
test rdi, rdi
je 0x140011f21
xor r12d, r12d
mov rcx, rdi
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140011f24
xor r12d, r12d
mov rax, r12
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret