joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400500a0
Capabilities:
Identify system language via api

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x278
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x270], rax
movzx eax, word [rcx + 0x28]
mov word [rsp + 0x260], ax
movzx eax, word [rcx + 0x2a]
mov word [rsp + 0x262], ax
mov rsi, qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call rsi
mov word [rsp + 0x264], ax
movzx eax, word [rbx + 0x2a]
mov word [rsp + 0x266], ax
movzx eax, word [rbx + 0x28]
mov word [rsp + 0x268], ax
mov bp, 0x4e4
mov word [rsp + 0x26a], bp
call rsi
mov word [rsp + 0x26c], ax
mov word [rsp + 0x26e], bp
xor ebp, ebp
lea rsi, [rsp + 0x50]
lea r15, str.StringFileInfo_04x_04x_ls
lea r12, [rsp + 0x48]
lea r13, [rsp + 0x44]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.140114200
movzx eax, word [rsp + rbp + 0x262]
movzx ecx, word [rsp + rbp + 0x260]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov edx, 0x104
mov r8d, 0x104
mov rcx, rsi
mov r9, r15
int3

Function at 0x140050750
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x278
mov r14, rcx
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rbx, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.140114200
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
dec edi
cmp edi, 0x102
ja 0x1400507ef
lea rsi, [rsp + 0x20]
mov qword [rsi], rbx
mov rcx, rbx
call fcn.14012c3a4
mov qword [rsi + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, rsi
int3
cmp edi, 0x103
setb bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140111870
mov eax, ebx
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140054ad0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete al
add rsp, 0x38
ret
Function at 0x140054b80
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
movaps xmmword [rsp + 0xa0], xmm6
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x98], rax
xor ebp, ebp
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
test eax, eax
jne 0x140054bf3
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140111870
mov eax, ebp
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, [rsp + 0x90]
mov qword [rax], 0
mov r9d, esi
or r9d, 8
mov qword [rsp + 0x20], rax
xor ebp, ebp
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140054c2c
cmp eax, 2
je 0x140054bc5
mov ebp, eax
jmp 0x140054bc5
movabs r15, 0x7fffffffffffffef
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x80], rax
movaps xmm0, xmmword [0x1401e90c0]
movaps xmmword [rsp + 0x70], xmm0
mov rcx, rdi
call fcn.14012c3a4
cmp rax, r15
ja 0x140054e27
mov rbp, rax
cmp rax, 0xb
jae 0x140054c7e
lea r14, [rsp + 0x70]
mov byte [r14 + 0x17], bpl
test rbp, rbp
jne 0x140054cab
jmp 0x140054cbc
lea r12, [rbp + 8]
and r12, 0xfffffffffffffff8
lea rcx, [r12 + r12]
int3
mov r8, rbp
add r8, rbp
mov rcx, r14
mov rdx, rdi
call fcn.140113df0
mov word [r14 + rbp*2], 0
mov al, byte [rsp + 0x87]
test al, al
mov rcx, qword [rsp + 0x78]
movzx r14d, al
mov rdx, r14
cmovs rdx, rcx
test rdx, rdx
je 0x140054d15
test al, al
jns 0x140054cec
mov rbp, qword [rsp + 0x70]
jmp 0x140054cf1
lea rbp, [rsp + 0x70]
cmp word [rbp + rdx*2 - 2], 0x5c
je 0x140054d15
lea rbp, [rsp + 0x70]
mov rcx, rbp
mov dx, 0x5c
int3
xorps xmm6, xmm6
lea r15, [rsp + 0x50]
movaps xmmword [r15], xmm6
test al, al
cmovs r14, rcx
mov qword [r15 + 0x10], 0
lea r12, [rsp + 0x4c]
mov rbp, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea r13, [rsp + 0x70]
mov dword [rsp + 0x4c], 0x104
mov edx, 0x104
mov rcx, r15
call fcn.140053eb0
mov rcx, qword [rsp + 0x90]
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
xor edx, edx
mov r8, rax
mov r9, r12
call rbp
test eax, eax
jne 0x140054dd7
mov edx, dword [rsp + 0x4c]
mov rcx, r15
xor r8d, r8d
call fcn.1400e5310
mov rcx, r13
mov rdx, r14
xor r8d, r8d
call fcn.1400e5310
movzx r8d, byte [rsp + 0x67]
mov rdx, r15
test r8b, r8b
jns 0x140054daa
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov rcx, r13
int3
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
mov rdx, rdi
mov r8d, esi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov ebp, eax
cmp byte [rsp + 0x67], 0
jns 0x140054e0a
mov rcx, qword [rsp + 0x50]
call fcn.1401109f8
cmp byte [rsp + 0x87], 0
jns 0x140054bc5
mov rcx, qword [rsp + 0x70]
call fcn.1401109f8
jmp 0x140054bc5
lea rcx, [rsp + 0x70]
int3
Function at 0x140054e50
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, 4
lea r9, [rsp + 0x3c]
mov dword [r9], eax
lea rdi, [rsp + 0x38]
mov dword [rdi], eax
lea rax, [rsp + 0x34]
mov dword [rax], 0
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x140054ec3
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x140054ec3
cmp dword [rsp + 0x38], 4
jne 0x140054ec3
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140111870
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x140054ee0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
mov rax, qword [rsp + 0x60]
mov rcx, qword [rcx]
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop
add rsp, 0x38
ret

Function at 0x140055080
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rcx, r8
call fcn.14012c3a4
add eax, eax
add eax, 2
mov rcx, qword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x140055470
Capabilities:
Query or enumerate registry key

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rcx
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x70], rax
or r9d, 0x20019
mov qword [rsp + 0x20], rcx
mov rcx, rdx
mov rdx, r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005554a
lea rdi, [rsp + 0x60]
mov dword [rdi], 0
mov rcx, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x58], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x140055541
mov edx, dword [rsp + 0x60]
dec edx
mov dword [rsi + 8], edx
mov rcx, qword [rsi]
test rcx, rcx
je 0x140055551
test edx, edx
js 0x140055551
lea r9, [rsp + 0x6c]
mov dword [r9], 0x104
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x60], rax
lea r8, [rsi + 0xc]
mov qword [rsp + 0x38], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140055557
jmp 0x140055551
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsi], 0
mov word [rsi + 0xc], 0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140111870
nop
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x14005dcd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
movaps xmmword [rsp + 0xa0], xmm7
movaps xmmword [rsp + 0x90], xmm6
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rax, rdx
shr rax, 1
xor esi, esi
cmp eax, 2
jb 0x14005dfca
mov rbx, rcx
lea ecx, [rax - 1]
mov esi, 0x80070057
cmp word [rbx + rcx*2], 0
jne 0x14005dfca
mov ecx, 0xfffffffe
add eax, ecx
cmp word [rbx + rax*2], 0
jne 0x14005dfca
mov rdi, rdx
movabs rax, 0x1fffffffe
and rdi, rax
add rdi, rbx
mov esi, 0
cmp rdi, rbx
jbe 0x14005dfca
mov r13, r8
movabs r15, 0x7fffffffffffffef
movabs r12, 0xaaaaaaaaaaaaaaaa
movaps xmm6, xmmword [0x1401e90c0]
xorps xmm7, xmm7
mov qword [rsp + 0x80], r12
movaps xmmword [rsp + 0x70], xmm6
mov rcx, rbx
call fcn.14012c3a4
cmp rax, r15
ja 0x14005e000
mov rsi, rax
cmp rax, 0xb
jae 0x14005ddcf
mov byte [rsp + 0x87], sil
cmp rsi, 3
jne 0x14005dfa2
movzx eax, word [rbx + 4]
mov word [rsp + 0x74], ax
mov eax, dword [rbx]
mov dword [rsp + 0x70], eax
lea rbp, [rsp + 0x70]
jmp 0x14005de0d
lea r14, [rsi + 8]
and r14, 0xfffffffffffffff8
lea rcx, [r14 + r14]
int3
mov r8, rsi
add r8, rsi
mov rcx, rbp
mov rdx, rbx
call fcn.140113df0
mov word [rbp + rsi*2], 0
movzx eax, byte [rsp + 0x87]
mov rcx, rax
test al, al
jns 0x14005de28
mov rcx, qword [rsp + 0x78]
lea rbx, [rbx + rcx*2]
add rbx, 2
cmp rbx, rdi
jb 0x14005de51
test al, al
jns 0x14005de43
mov rcx, qword [rsp + 0x70]
call fcn.1401109f8
cmp rbx, rdi
jb 0x14005dd80
jmp 0x14005dfc8
mov qword [rsp + 0x60], r12
movaps xmmword [rsp + 0x50], xmm6
mov rcx, rbx
call fcn.14012c3a4
cmp rax, r15
ja 0x14005e00a
mov rsi, rax
cmp rax, 0xb
jae 0x14005de9a
mov byte [rsp + 0x67], sil
cmp rsi, 3
jne 0x14005dfb5
movzx eax, word [rbx + 4]
mov word [rsp + 0x54], ax
mov eax, dword [rbx]
mov dword [rsp + 0x50], eax
lea r14, [rsp + 0x50]
jmp 0x14005ded7
lea rbp, [rsi + 8]
and rbp, 0xfffffffffffffff8
mov rcx, rbp
add rcx, rbp
int3
mov r8, rsi
add r8, rsi
mov rcx, r14
mov rdx, rbx
call fcn.140113df0
mov word [r14 + rsi*2], 0
movzx esi, byte [rsp + 0x67]
test sil, sil
jns 0x14005deed
mov rsi, qword [rsp + 0x58]
lea rbp, [rsp + 0x20]
mov rcx, rbp
lea rdx, [rsp + 0x70]
lea r8, [rsp + 0x50]
int3
lea rbp, [rsp + 0x70]
test rsi, rsi
je 0x14005de0d
jmp 0x14005ddfc
lea r14, [rsp + 0x50]
test rsi, rsi
je 0x14005ded7
jmp 0x14005dec6
xor esi, esi
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140111870
mov eax, esi
movaps xmm6, xmmword [rsp + 0x90]
movaps xmm7, xmmword [rsp + 0xa0]
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x70]
int3
lea rcx, [rsp + 0x50]
int3
Function at 0x140074530
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x140074557
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140074591
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400745b0
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140111870
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.140074670
mov sil, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140111870
mov eax, esi
add rsp, 0x198
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400e83a0
test al, al
je 0x140074667
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x25d
mov r9d, 2
int3
xor esi, esi
jmp 0x140074594

Function at 0x140074670
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x1a8
mov rsi, rcx
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
cmp byte [rcx + 0x17], 0
jns 0x140074697
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400746c9
mov dil, 1
test al, 0x10
je 0x140074785
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140111870
mov eax, edi
add rsp, 0x1a8
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400e83a0
test al, al
je 0x140074848
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x248
mov r9d, 2
int3
mov ecx, 2
call fcn.1400e83a0
test al, al
je 0x140074848
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x24c
mov r9d, 2
call fcn.14004a130
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
int3
xor edi, edi
jmp 0x1400746ad
Function at 0x140088310
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r12, r8
mov ebx, edx
mov edi, ecx
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [r8 + 0x17]
test al, al
jns 0x140088344
mov rax, qword [r12 + 8]
test rax, rax
je 0x14008843c
mov eax, ebx
not eax
test eax, 0x300
je 0x14008843c
cmp edi, 2
lea rax, [0x140225eb0]
lea rcx, [0x1402260b0]
cmove rcx, rax
cmp word [rcx], 0
jne 0x14008843c
xorps xmm0, xmm0
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsi], 0
je 0x14008843c
cmp byte [0x140225ea0], 0
setne al
bt ebx, 8
jb 0x14008843c
shr ebx, 9
and ebx, 1
or bl, al
je 0x14008843c
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea rsi, str.SOFTWARE
cmove rsi, rax
movzx r13d, byte [r12 + 0x17]
test r13b, r13b
jns 0x140088497
mov rbx, qword [r12]
mov r13, qword [r12 + 8]
mov r14d, 1
xor r15d, r15d
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
mov rdi, qword [rsi + 8]
mov rbp, r13
sub rbp, rdi
jb 0x140088429
mov rdx, qword [rsi]
mov rcx, rbx
mov r8, rdi
int3
add rsi, 0x28
inc r15
cmp r15, r14
jb 0x14008840b
cmp dword [rsp + 0x2c], 0
jne 0x14008849f
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140111870
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rbx, r12
jmp 0x1400883ec
cmp byte [r12 + 0x17], 0
js 0x140088507
mov rax, r12
mov rdx, qword [rsp + 0x30]
sub rdx, rax
sar rdx, 1
mov rcx, r12
mov r8, qword [rsp + 0x38]
call fcn.1400325f0
jmp 0x14008843c
mov rax, qword [r12]
jmp 0x1400884aa

Function at 0x1400948a0
Capabilities:
Modify service

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b8
mov rsi, rcx
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rax, qword [rdx + 0x28]
xor ebx, ebx
cmp rax, qword [rdx + 0x30]
cmovne rbx, rax
cmp byte [rdx + 0x27], 0
jns 0x1400948db
mov rdi, qword [rdx + 0x10]
jmp 0x1400948df
lea rdi, [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
mov eax, dword [rdx + 4]
mov r8d, dword [rdx + 8]
mov rcx, qword [rsi + 0xd0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], rbx
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x50], 0
mov edx, eax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov edi, eax
test eax, eax
jne 0x1400949b9
mov ecx, 1
call fcn.1400e83a0
test al, al
je 0x1400949b9
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_util_install_service_work_item_impl.cc
lea rcx, [rsp + 0x70]
mov r8d, 0x25a
mov r9d, 1
int3
test edi, edi
setne bl
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.140111870
mov eax, ebx
add rsp, 0x1b8
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140098500
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14021b038]
xor rax, rsp
mov ecx, 0xffffffff
cmp r8, rcx
mov ebx, 0xffffffff
cmovb ebx, r8d
mov qword [rsp + 0x30], rax
lea r14, [rsp + 0x2c]
mov r15, qword [sym.imp.KERNEL32.dll_ReadFile]
mov r12, qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r15
test eax, eax
je 0x1400985a8
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x140098597
cmp eax, 0xffffffff
je 0x1400985bc
mov esi, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140111870
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rdi
call r12
cmp eax, 3
je 0x140098546
mov eax, dword [rsp + 0x2c]
jmp 0x140098577
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
setne sil
neg rsi
jmp 0x140098579
int3

Function at 0x140098fb0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov edi, 0xffffffff
cmp r8, rdi
mov eax, 0xffffffff
cmovb eax, r8d
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400984e8
mov esi, dword [rsp + 0x2c]
cmp rsi, rdi
je 0x1400984f1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140111870
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
mov rsi, 0xffffffffffffffff
jmp 0x1400984d1
int3
mov rcx, qword [rcx + 8]
jmp 0x140098480

Function at 0x14009c320
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x140226648]
cmp rdi, 1
jbe 0x14009c349
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140100810
lea rcx, [0x140226648]
call fcn.14008ba60
test al, al
je 0x14009c38f
mov qword [0x140226650], 0
lea rbx, [0x140226648]
lea rdi, [0x140226650]
mov rcx, rdi
xor edx, edx
int3
mov rdi, qword [0x140226648]
jmp 0x14009c337

Function at 0x14009c7d0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14021eb08]
cmp ecx, 0xffffffff
je 0x14009c7f5
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
add rsp, 0x28
ret
xor eax, eax
jmp 0x14009c7f0
Function at 0x14009c800
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, rdx
mov r15, rcx
mov ecx, dword [0x14021eb08]
cmp ecx, 0xffffffff
je 0x14009c8de
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x14009c8de
mov eax, dword [0x140227ea8]
mov ecx, dword [0x14021ef3c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14009c8e8
mov rbx, qword [0x140227ea0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x14009c92e
mov rax, qword [0x140226698]
inc rax
xor ecx, ecx
lea rdx, [0x1402266a0]
lea edi, [rax + rcx]
movzx edi, dil
lea rsi, [rdi + rdi*2]
cmp dword [rdx + rsi*8], 0
jne 0x14009c93b
lea rax, [rdx + rsi*8]
mov dword [rax], 1
mov qword [rax + 8], r14
mov qword [0x140226698], rdi
mov dword [r15], edi
mov eax, dword [rax + 0x10]
mov dword [r15 + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [r15]
cmp eax, 0xffffffff
je 0x14009c950
cmp eax, 0x100
jge 0x14009c953
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.14009c960
jmp 0x14009c82e
lea rcx, [0x140227ea8]
int3
mov rcx, rbx
int3
inc rcx
cmp rcx, 0x100
jne 0x14009c87e
jmp 0x14009c8b2
int3
int3
Function at 0x1400a1a30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov qword [rsp + 0x48], r9
mov r14, rdx
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbp, qword [rcx + 8]
mov qword [rsp + 0x40], rcx
mov rdi, qword [rcx + 0x10]
movzx r12d, byte [r8 + 0x17]
test r12b, r12b
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov rdx, r12
mov qword [rsp + 0x38], rax
cmovs rdx, rax
mov rbx, r8
cmovs rbx, rcx
mov qword [rsp + 0x50], rdi
mov r13, rbp
mov qword [rsp + 0x20], rbp
sub rdi, rbp
je 0x1400a1b5c
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], r14
sar rdi, 3
movabs rax, 0xaaaaaaaaaaaaaaab
imul rdi, rax
mov r13, qword [rsp + 0x20]
mov rcx, rdi
shr rcx, 1
lea rax, [rcx + rcx*2]
lea r14, [rax*8]
add r14, r13
movzx r11d, byte [r14 + 0x17]
test r11b, r11b
jns 0x1400a1c25
mov r11, qword [r13 + rax*8 + 8]
cmp rdx, r11
setb r9b
mov r10, r11
cmovb r10, rdx
mov rax, qword [r14]
test r10, r10
je 0x1400a1b13
xor esi, esi
movzx r15d, word [rbx + rsi*2]
cmp word [rax + rsi*2], r15w
ja 0x1400a1b4b
jb 0x1400a1b24
inc rsi
cmp r10, rsi
jne 0x1400a1afd
cmp r11, rdx
movzx eax, r9b
mov ebp, 0xffffffff
cmovb eax, ebp
jmp 0x1400a1b29
mov eax, 0xffffffff
add r14, 0x18
mov rbp, rcx
not rbp
add rdi, rbp
test eax, eax
cmovns rdi, rcx
cmovs r13, r14
test rdi, rdi
jne 0x1400a1abd
jmp 0x1400a1b52
mov eax, 1
jmp 0x1400a1b29
mov r14, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
cmp r13, qword [rsp + 0x50]
je 0x1400a1bd1
movzx edx, byte [r13 + 0x17]
mov rax, r13
test dl, dl
jns 0x1400a1b99
mov rax, r13
mov rdx, qword [rsp + 0x20]
sub rax, rdx
sar rax, 3
movabs rbp, 0xaaaaaaaaaaaaaaab
imul rax, rbp
lea rax, [rax + rax*2]
mov rdx, qword [rdx + rax*8 + 8]
mov rax, qword [r13]
test r12b, r12b
cmovs r12, qword [rsp + 0x38]
cmovs r8, rcx
cmp rdx, r12
mov rsi, r12
cmovb rsi, rdx
test rsi, rsi
je 0x1400a1bcc
xor ebp, ebp
movzx ecx, word [rax + rbp*2]
cmp word [r8 + rbp*2], cx
ja 0x1400a1c1b
jb 0x1400a1bd1
inc rbp
cmp rsi, rbp
jne 0x1400a1bb7
cmp r12, rdx
jae 0x1400a1c1b
mov rcx, qword [rsp + 0x40]
add rcx, 8
lea rdi, [rsp + 0x58]
mov rdx, rdi
mov r8, r13
mov r9, qword [rsp + 0x48]
call fcn.1400a1c40
mov rax, qword [rdi]
mov qword [r14], rax
mov byte [r14 + 8], 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140111870
mov rax, r14
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [r14], r13
mov byte [r14 + 8], 0
jmp 0x1400a1bfa
cmp rdx, r11
setb r9b
mov r10, r11
cmovb r10, rdx
mov rax, r14
jmp 0x1400a1af6