joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e2be8
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
cmp byte [0x140241ca3], 0
je 0x1400e2c02
test cl, cl
je 0x1400e2d70
lea rax, [rbp - 0x10]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCInstaller_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400e2d69
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400e2d69
and dword [rbp + 0x20], eax
and dword [rbp + 0x18], eax
cmp byte [0x140241ca3], al
mov dword [rbp + 0x28], 4
jne 0x1400e2c8c
lea rax, [rbp + 0x28]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x20]
lea rax, [rbp + 0x18]
lea rdx, str.bIsSingleClientApp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e2c8c
cmp dword [rbp + 0x20], 4
jne 0x1400e2c8c
cmp dword [rbp + 0x18], eax
setne byte [0x140241ca1]
cmp byte [0x140241ca1], 0
je 0x1400e2d5f
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x28]
and dword [rbp + 0x18], 0
lea r9, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rdx, str.bIsSCAcroAppInstalled
lea rax, [rbp + 0x18]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e2cdb
cmp dword [rbp + 0x20], 4
jne 0x1400e2cdb
cmp dword [rbp + 0x18], eax
setne byte [0x140241ca0]
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x28]
and dword [rbp + 0x18], 0
lea r9, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rdx, str.SCAPackageLevel
lea rax, [rbp + 0x18]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e2d21
mov eax, dword [0x140233500]
cmp dword [rbp + 0x20], 4
cmove eax, dword [rbp + 0x18]
mov dword [0x140233500], eax
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x20]
lea rax, [rbp + 0x18]
xor r8d, r8d
lea rdx, str.IsAcrInstalledInRdrMode
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e2d5f
cmp dword [rbp + 0x20], 4
jne 0x1400e2d5f
cmp dword [rbp + 0x18], eax
setne byte [0x140241ca2]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [0x140241ca3], 1
add rsp, 0x40
pop rbp
ret
Function at 0x1400f1ee8
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rax, vtable.rna::messaging::NamedPipeChannelServer.0
mov qword [rcx], rax
call fcn.140183110
mov rcx, qword [rdi + 0x10]
mov ebx, 1
cmp rcx, 0xffffffffffffffff
je 0x1400f1f39
mov edx, 0xfa
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, ebx
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x108]
xor esi, esi
test rcx, rcx
je 0x1400f1f55
mov rax, qword [rcx]
mov edx, ebx
mov rax, qword [rax]
call qword [str.PLe_]
mov rcx, qword [rdi + 0x110]
test rcx, rcx
je 0x1400f1f6f
mov rax, qword [rcx]
mov edx, ebx
mov rax, qword [rax]
call qword [str.PLe_]
lea rcx, [rdi + 0x118]
call fcn.140059a28
lea rbx, [rdi + 0xd8]
lea rcx, [rbx + 0x28]
call fcn.140059a28
mov rcx, rbx
call fcn.1400cf070
mov rcx, qword [rbx]
mov qword [rbx], rsi
mov edx, 0x10
call fcn.1401489f0
nop
lea rcx, [rdi + 0x78]
call fcn.1400c8698
mov rdx, qword [rdi + 0x70]
cmp rdx, 8
jb 0x1400f1fc8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi + 0x58]
call fcn.14004ecdc
mov qword [rdi + 0x68], rsi
mov ebx, 7
mov qword [rdi + 0x70], rbx
mov word [rdi + 0x58], si
mov rdx, qword [rdi + 0x50]
cmp rdx, 8
jb 0x1400f1ff4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi + 0x38]
call fcn.14004ecdc
mov qword [rdi + 0x48], rsi
mov qword [rdi + 0x50], rbx
mov word [rdi + 0x38], si
lea rax, vtable.rna::messaging::IpcChannelBase.0
mov qword [rdi], rax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400f242c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov ebx, r9d
mov rdi, r8
mov r14, rdx
mov rsi, rcx
mov ecx, pe_nt_image_headers64
call fcn.1401489b4
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1400f247b
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8, rdi
mov rdx, qword [r14]
mov rcx, rax
call fcn.1400f1ca0
mov rdi, rax
jmp 0x1400f247d
xor edi, edi
mov qword [rsp + 0x50], rdi
mov ecx, 0x10
call fcn.1401489b4
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400f24a9
lea rax, vtable.ServerChannelStateChangeHandler.0
mov qword [rbx], rax
mov qword [rbx + 8], rsi
jmp 0x1400f24ab
xor ebx, ebx
mov rcx, qword [rdi + 0x108]
test rcx, rcx
je 0x1400f24c8
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [str.PLe_]
mov qword [rdi + 0x108], rbx
lea rcx, [rsi + 0x10]
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x1400f24e7
mov qword [rdx], rdi
add qword [rcx + 8], 8
jmp 0x1400f24f1
lea r8, [rsp + 0x50]
call fcn.14004efa4
mov rcx, rdi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
jmp 0x140183604
push rbx
sub rsp, 0x30
and dword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r8, [0x140183720]
and dword [rsp + 0x20], 0
mov rbx, rcx
mov r9, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x10], rax
add rsp, 0x30
pop rbx
ret
Function at 0x140105358
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
movabs rax, 0xf2b9d6480f2b9d65
mul r8
shr rdx, 8
imul rax, rdx, 0x10e
mov rdx, r8
sub rdx, rax
lea rax, [0x1401d99b0]
mov al, byte [rdx + rax]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x27b
jb 0x14010535b
mov byte [rcx + 0x27b], 0
mov rax, rcx
ret

Function at 0x1401053a0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
movabs rax, 0xf2b9d6480f2b9d65
mul r8
shr rdx, 8
imul rax, rdx, 0x10e
mov rdx, r8
sub rdx, rax
lea rax, [0x1401d99b0]
mov al, byte [rdx + rax]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x22a
jb 0x1401053a3
mov byte [rcx + 0x22a], 0
mov rax, rcx
ret

Function at 0x1401053e8
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
movabs rax, 0xf2b9d6480f2b9d65
mul r8
shr rdx, 8
imul rax, rdx, 0x10e
mov rdx, r8
sub rdx, rax
lea rax, [0x1401d99b0]
mov al, byte [rdx + rax]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x134
jb 0x1401053eb
mov byte [rcx + 0x134], 0
mov rax, rcx
ret

Function at 0x140105430
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
movabs rax, 0xf2b9d6480f2b9d65
mul r8
shr rdx, 8
imul rax, rdx, 0x10e
mov rdx, r8
sub rdx, rax
lea rax, [0x1401d99b0]
mov al, byte [rdx + rax]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x132
jb 0x140105433
mov byte [rcx + 0x132], 0
mov rax, rcx
ret

Function at 0x140105478
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
movabs rax, 0xf2b9d6480f2b9d65
mul r8
shr rdx, 8
imul rax, rdx, 0x10e
mov rdx, r8
sub rdx, rax
lea rax, [0x1401d99b0]
mov al, byte [rdx + rax]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x74
jb 0x14010547b
mov byte [rcx + 0x74], 0
mov rax, rcx
ret

Function at 0x1401054b8
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
movabs rax, 0xf2b9d6480f2b9d65
mul r8
shr rdx, 8
imul rax, rdx, 0x10e
mov rdx, r8
sub rdx, rax
lea rax, [0x1401d99b0]
mov al, byte [rdx + rax]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x64
jb 0x1401054bb
mov byte [rcx + 0x64], 0
mov rax, rcx
ret

Function at 0x1401054f8
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
movabs rax, 0xf2b9d6480f2b9d65
mul r8
shr rdx, 8
imul rax, rdx, 0x10e
mov rdx, r8
sub rdx, rax
lea rax, [0x1401d99b0]
mov al, byte [rdx + rax]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x25
jb 0x1401054fb
mov byte [rcx + 0x25], 0
mov rax, rcx
ret

Function at 0x140105538
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
movabs rax, 0xf2b9d6480f2b9d65
mul r8
shr rdx, 8
imul rax, rdx, 0x10e
mov rdx, r8
sub rdx, rax
lea rax, [0x1401d99b0]
mov al, byte [rdx + rax]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x18
jb 0x14010553b
mov byte [rcx + 0x18], 0
mov rax, rcx
ret

Function at 0x140105578
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
movabs rax, 0xf2b9d6480f2b9d65
mul r8
shr rdx, 8
imul rax, rdx, 0x10e
mov rdx, r8
sub rdx, rax
lea rax, [0x1401d99b0]
mov al, byte [rdx + rax]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x15
jb 0x14010557b
mov byte [rcx + 0x15], 0
mov rax, rcx
ret
Function at 0x1401055b8
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
movabs rax, 0xf2b9d6480f2b9d65
mul r8
shr rdx, 8
imul rax, rdx, 0x10e
mov rdx, r8
sub rdx, rax
lea rax, [0x1401d99b0]
mov al, byte [rdx + rax]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x14
jb 0x1401055bb
mov byte [rcx + 0x14], 0
mov rax, rcx
ret

Function at 0x1401055f8
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
movabs rax, 0xf2b9d6480f2b9d65
mul r8
shr rdx, 8
imul rax, rdx, 0x10e
mov rdx, r8
sub rdx, rax
lea rax, [0x1401d99b0]
mov al, byte [rdx + rax]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0xa
jb 0x1401055fb
mov byte [rcx + 0xa], 0
mov rax, rcx
ret

Function at 0x140105638
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
movabs rax, 0xf2b9d6480f2b9d65
mul r8
shr rdx, 8
imul rax, rdx, 0x10e
mov rdx, r8
sub rdx, rax
lea rax, [0x1401d99b0]
mov al, byte [rdx + rax]
xor byte [r8 + rcx], al
inc r8
cmp r8, 9
jb 0x14010563b
mov byte [rcx + 9], 0
mov rax, rcx
ret

Function at 0x140105678
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
movabs rax, 0xf2b9d6480f2b9d65
mul r8
shr rdx, 8
imul rax, rdx, 0x10e
mov rdx, r8
sub rdx, rax
lea rax, [0x1401d99b0]
mov al, byte [rdx + rax]
xor byte [r8 + rcx], al
inc r8
cmp r8, 7
jb 0x14010567b
mov byte [rcx + 7], 0
mov rax, rcx
ret

Function at 0x1401056b8
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
movabs rax, 0xf2b9d6480f2b9d65
mul r8
shr rdx, 8
imul rax, rdx, 0x10e
mov rdx, r8
sub rdx, rax
lea rax, [0x1401d99b0]
mov al, byte [rdx + rax]
xor byte [r8 + rcx], al
inc r8
cmp r8, 4
jb 0x1401056bb
mov byte [rcx + 4], 0
mov rax, rcx
ret
Function at 0x140106128
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
cmp ecx, 0xffffffff
je 0x1401062b0
cmp ecx, 0x7c
je 0x1401062b0
cmp ecx, 0x29
jne 0x14010616b
cmp dword [rbx + 0x1c], 0
jne 0x1401062b0
test dword [rbx + 0x80], 0x10000000
je 0x1401062d7
cmp ecx, 0x2e
jne 0x14010618b
lea rcx, [rbx + 0x40]
mov edx, 5
call fcn.140108570
mov rcx, rbx
call fcn.1401085c8
jmp 0x14010629e
cmp ecx, 0x5c
jne 0x1401061ec
mov rcx, rbx
call fcn.1401085c8
test byte [rbx + 0x80], 0x80
je 0x1401061df
mov al, byte [rbx + 0x78]
cmp al, 0x62
jne 0x1401061c3
mov edx, 4
lea rcx, [rbx + 0x40]
call fcn.140108570
mov rcx, rbx
call fcn.1401085c8
jmp 0x1401062a6
cmp al, 0x42
jne 0x1401061df
lea rcx, [rbx + 0x40]
mov edx, 4
call fcn.140108570
mov rax, qword [rbx + 0x48]
xor dword [rax + 0xc], 1
jmp 0x1401061b6
mov rcx, rbx
call fcn.1401062f4
jmp 0x14010629e
cmp ecx, 0x5b
jne 0x140106210
mov rcx, rbx
call fcn.1401085c8
mov rcx, rbx
call fcn.1401068dc
cmp dword [rbx + 0x7c], 0x5d
jne 0x1401062c9
jmp 0x14010617e
cmp ecx, 0x28
jne 0x140106234
mov rcx, rbx
call fcn.1401085c8
mov rcx, rbx
call fcn.140108c94
cmp dword [rbx + 0x7c], 0x29
mov dil, al
jne 0x1401062d7
jmp 0x140106291
cmp ecx, 0x5e
jne 0x140106241
lea edx, [rcx - 0x5c]
jmp 0x1401061ad
cmp ecx, 0x24
jne 0x14010624e
lea edx, [rcx - 0x21]
jmp 0x1401061ad
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x1401062bb
cmp ecx, 0x3f
je 0x1401062bb
cmp ecx, 0x7b
je 0x1401062bb
cmp ecx, 0x7d
jne 0x140106271
test dword [rbx + 0x80], 0x10000000
je 0x1401062e5
cmp ecx, 0x5d
jne 0x140106282
test dword [rbx + 0x80], 0x10000000
je 0x1401062c9
mov dl, byte [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.1401057dc
mov dil, 1
mov rcx, rbx
call fcn.1401085c8
test dil, dil
je 0x1401062a6
mov rcx, rbx
call fcn.140108618
mov ecx, dword [rbx + 0x7c]
mov al, 1
jmp 0x14010613a
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 0xa
mov rcx, rbx
call fcn.140107ba4
int3
mov edx, 4
mov rcx, rbx
call fcn.140107ba4
int3
mov edx, 5
mov rcx, rbx
call fcn.140107ba4
int3
mov edx, 6
mov rcx, rbx
call fcn.140107ba4
int3
Function at 0x140120220
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [0x140241f04], 0x12c
mov rdi, rcx
jg 0x1401202ef
lea rdx, [rcx + 0x20]
add rcx, 0x50
lea r8, [rsp + 0x38]
call fcn.140183c80
lea rbx, [rdi + 0x18]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x1401202b3
cmp dword [rsp + 0x38], 0
jne 0x1401202b3
cmp byte [rdi + 0x70], 0
lea rdx, [rsp + 0x38]
mov rcx, rbx
je 0x14012027c
call fcn.140183eb8
test al, al
jne 0x14012028b
jmp 0x1401202b3
mov r8d, 0x493e0
call fcn.140183f1c
test al, al
je 0x1401202ef
and dword [0x140241f04], 0
mov rcx, qword [rdi + 0x28]
mov byte [rdi + 0x70], 1
test rcx, rcx
je 0x1401202b3
mov rax, qword [rcx]
mov rdx, rbx
mov rax, qword [rax + 8]
call qword [str.PLe_]
test al, al
jne 0x1401202e4
cmp qword [rbx], 0xffffffffffffffff
je 0x1401202cc
cmp dword [rsp + 0x38], 0
jne 0x1401202e4
mov rcx, rbx
call fcn.140183b2c
or qword [rbx], 0xffffffffffffffff
cmp dword [rsp + 0x38], 0
je 0x1401202e4
inc dword [0x140241f04]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1401598ac
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1401596d8
Function at 0x14017d300
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov al, byte [rcx + 8]
test al, al
je 0x14017d3b7
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [str.PLe_]
test al, al
je 0x14017d3b7
xor eax, eax
xchg byte [rbx + 8], al
mov rdi, qword [rbx + 0x10]
test rdi, rdi
je 0x14017d359
mov rcx, qword [rdi + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x14017d34c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov edx, 0x18
mov rcx, rdi
call fcn.1401489f0
mov ecx, 0x18
call fcn.1401489b4
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14017d385
lea rax, [0x14017d2c0]
mov qword [rdi], rax
mov qword [rdi + 8], rbx
or qword [rdi + 0x10], 0xffffffffffffffff
jmp 0x14017d387
xor edi, edi
mov qword [rbx + 0x10], rdi
and dword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
mov r9, rdi
lea r8, [0x14017d470]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 0x10], rax
mov al, byte [rbx + 8]
test al, al
sete al
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140183c80
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
or rsi, 0xffffffffffffffff
mov dword [r8], 7
cmp qword [rcx + 0x10], 0
mov rbx, r8
mov rdi, rcx
jne 0x140183cb3
mov dword [r8], 1
jmp 0x140183d6b
and qword [rsp + 0x70], 0
lea r8, [rsp + 0x70]
xor r9d, r9d
lea rcx, str.S:_ML__NW___LW_
lea edx, [r9 + 1]
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
and dword [rsp + 0x50], 0
cmp qword [rdi + 0x18], 8
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], 0x18
jb 0x140183cf2
mov rdi, qword [rdi]
mov al, byte [0x1402344a8]
mov r9d, 0xff
neg al
mov r8d, 8
lea rax, [rsp + 0x40]
mov rcx, rdi
mov qword [rsp + 0x38], rax
sbb edx, edx
and dword [rsp + 0x30], 0
mov eax, 0x400
and edx, 0x80000
mov dword [rsp + 0x28], eax
inc edx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rcx, qword [rsp + 0x70]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp rsi, 0xffffffffffffffff
jne 0x140183d61
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], eax
call fcn.140183a84
mov dword [rbx], eax
jmp 0x140183d6b
and dword [rbx], 0
mov byte [0x1402344a8], 0
lea r11, [rsp + 0x60]
mov rax, rsi
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140183eb8
Capabilities:
Connect pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rcx, qword [rcx]
mov rsi, rdx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
xor ebx, ebx
test eax, eax
jne 0x140183f03
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
je 0x140183f03
mov dil, bl
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x38], eax
call fcn.140183a84
mov ebx, eax
jmp 0x140183f06
mov dil, 1
mov dword [rsi], ebx
mov al, dil
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140183f1c
Capabilities:
Create thread

Disassembly:
mov dword [rsp + 0x18], r8d
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x50
mov rdi, rdx
mov rbx, rcx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbp + 0x20], rax
mov ecx, 0x18
call fcn.1401489b4
test rax, rax
je 0x140183f69
lea rcx, [rbp + 0x30]
mov qword [rax], rcx
lea rcx, [rbp + 0x20]
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rbx
mov qword [rbp + 0x38], rax
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x28], rcx
and dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140183900]
xor edx, edx
xor ecx, ecx
call fcn.1401b3dcc
mov qword [rbp - 0x20], rax
test rax, rax
je 0x140183fff
mov rdx, rdi
mov rcx, rbx
call fcn.140183eb8
mov bl, al
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [rbp - 0x18], 0
je 0x14018400e
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp - 0x18], eax
je 0x140184019
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x10], xmm0
xor edx, edx
lea rcx, [rbp - 0x10]
call fcn.1401b32b4
test eax, eax
jne 0x140184024
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x20], xmm0
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp dword [rbp - 0x18], 0
jne 0x140183ff9
mov al, bl
add rsp, 0x50
pop rdi
pop rbx
pop rbp
ret
call fcn.140167fdc
nop
and dword [rbp - 0x18], 0
mov ecx, 6
call fcn.1401b38dc
nop
mov ecx, 1
call fcn.1401b38dc
int3
mov ecx, 5
call fcn.1401b38dc
int3
mov ecx, 2
call fcn.1401b38dc
int3
Function at 0x1401b21d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov r14, r8
mov rsi, rdx
mov rdi, rcx
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x1401b21f5
mov rcx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
cmp eax, 0xffffffff
jne 0x1401b2215
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call fcn.1401b20d0
jmp 0x1401b233e
mov edx, ebp
mov rcx, rsi
call fcn.1401b1fa0
mov r15d, eax
xor r12d, r12d
bt ebp, 0xa
jae 0x1401b22fc
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x1401b223c
mov rdx, qword [rsi]
movdqa xmm0, xmmword [0x1401c60a0]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], r12w
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], r12w
jne 0x1401b2260
lea rcx, [rsp + 0x48]
call fcn.140054c6c
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x48]
call fcn.1400510b0
cmp rbx, 0xffffffffffffffff
jne 0x1401b22d2
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call fcn.1401b20d0
nop
jmp 0x1401b233e
mov rcx, rsi
call fcn.1401b1e80
test al, al
jne 0x1401b22f3
mov dword [rdi], 9
mov dword [rdi + 4], r15d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1401b233e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x1401b2314
mov dword [r14], r12d
mov byte [r14 + 4], 0
lea rax, [0x1401d04d8]
mov qword [r14 + 8], rax
and ebp, 0x10
je 0x1401b231f
mov eax, dword [rsp + 0x40]
jmp 0x1401b2327
mov eax, r15d
mov r15d, dword [rsp + 0x40]
test ebp, ebp
setne r12b
add r12d, 2
mov dword [rdi], r12d
test ebp, ebp
cmove r15d, eax
mov dword [rdi + 4], r15d
mov rax, rdi
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400026f4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000273e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000273e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000273e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000273e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000273e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002740
xor al, al
add rsp, 0x28
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14011e0f0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x14011e100]
mov dword [rax], 1
mov rax, qword [0x14011e110]
mov dword [rax], 1
mov rax, qword [0x14011e0e0]
mov dword [rax], 1
mov rax, qword [0x14011df80]
cmp word [rax], 0x5a4d
jne 0x140001067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010d0
mov rax, qword [0x14011e0d0]
mov dword [0x140121020], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010c0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x14011e090]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x14011e070]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x14011df10]
cmp dword [rax], 1
je 0x140001108
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001120
cmp dx, 0x20b
jne 0x140001067
cmp dword [rax + 0x84], 0xe
jbe 0x140001067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x140001067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x140001067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x140001067