joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180031a18
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x180031a46
xor eax, eax
jmp 0x180031b2c
cmp qword [rcx + 0x68], 0
je 0x180031a57
call fcn.180031b48
jmp 0x180031b2c
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x180031a6e
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180031a70
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180031aa2
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.180034d60
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x180031b26
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x180031ad9
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x180031b02
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.180033228
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x180031b26
cmp rsi, rbx
ja 0x180031ae0
test rsi, rsi
je 0x180031b26
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.180033228
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1800326e0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180032708
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180032708
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1800347c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.18001a040
sub rsp, rax
mov rax, qword [0x180049040]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.180025168
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x18003480f
mov rax, rbp
jmp 0x18003491b
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x180000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x4ced0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.18002e328
mov r13, rax
lea rax, [0x180000000]
mov rcx, qword [rax + rbx*8 + 0x4ced0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x180034917
mov dword [rsp + 0x30], edi
lea r9, [rsp + 0x30]
mov rcx, qword [rcx + r12*8 + 0x28]
lea rdx, [rsp + 0x40]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180034917
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.18002e328
test rax, rax
js 0x180034917
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x180034917
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x180034909
lea r8, [0x180000000]
cmp rcx, rdx
jae 0x180034909
cmp byte [rcx], 0xd
jne 0x1800348ef
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x1800348fe
cmp byte [rcx + 1], 0xa
jne 0x1800348fe
inc rcx
jmp 0x1800348fe
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x499c0]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x1800348d1
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x18003491b
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.180019bb0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800a2bce
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rbp
cmova ebp, r14d
push rax
movsx eax, di
xchg al, bpl
push rdx
xchg bp, ax
push r9
push r8
cdqe
mov al, r13b
movzx rdx, r12w
push rdi
cwde
push rbx
lahf
rdtsc
cbw
push r12
push r15
xchg bh, dl
lahf
pushfq
lahf
rdtsc
cqo
push r11
push rsi
mov bl, bpl
push r14
bts ax, bx
push rcx
cqo
push r13
rol sil, 0x62
cwde
push r10
not sil
rol bpl, 0xb8
mov bx, sp
movabs rdx, 0
push rdx
movzx ecx, r9w
mov bp, bx
bt cx, r11w
mov rbx, qword [rsp + 0x90]
cdqe
lahf
movsx rbp, r10w
rol ebx, 3
movzx esi, si
movzx rbp, sp
dec rsi
dec ebx
rcl r9w, 0xa1
bswap rsi
not ebx
seta r9b
rcr cx, cl
rol ebx, 1
and r11w, r11w
cmp r8b, r10b
add rbx, rdx
movabs rax, 0x100000000
sar cx, cl
lea rbx, [rbx + rax]
mov rsi, rsp
and bp, r15w
sub rsp, 0x180
movsx ecx, di
and rsp, 0xfffffffffffffff0
rcr r9d, cl
mov r11, rbx
movsxd r9, ebp
test ebx, 0x7b127695
sbb bpl, dil
movabs rbp, 0
bt r9w, 0x4e
sub r11, rbp
shld ecx, r14d, 0x2a
movzx cx, r8b
lea r9, [0x1800a2ccb]
mov ecx, 0x71b2647b
sbb rcx, 0x151769a3
mov ecx, r13d
sub rbx, 4
jmp 0x1800a47ab
mov ecx, dword [rbx]
cmc
xor ecx, r11d
stc
cmp r12b, r12b
cmc
sub ecx, 0x59bd42e8
test r14w, r11w
clc
xor ecx, 0x383726ce
jmp 0x1800e800e
add ecx, 0x2e8b2a2d
test rdx, r10
xor ecx, 0x3c742839
jmp 0x18013423a
bswap ecx
test ecx, r15d
clc
push r11
btr r11w, 0x28
shr r11, cl
xor dword [rsp], ecx
rcl r11d, cl
shld r11, rdx, 8
sbb r11d, 0xc461243
pop r11
movsxd rcx, ecx
add r9, rcx
push r9
ret
Function at 0x140733058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1407331df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140733089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14073306f
add dl, dl
jne 0x140733096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407330f6
xor eax, eax
add dl, dl
jne 0x1407330a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407331ad
add dl, dl
jne 0x1407330b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407330c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407330d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407330dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407330ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14073307e
mov eax, 1
add dl, dl
jne 0x140733106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140733113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407330fb
sub eax, ebx
mov ebx, 1
jne 0x14073314c
mov ecx, 1
add dl, dl
jne 0x14073312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14073313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140733123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14073307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140733168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140733175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14073315d
cmp eax, 0x7d00
jae 0x14073319b
cmp eax, 0x500
jb 0x140733196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14073307e
cmp eax, 0x7f
ja 0x14073319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14073307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407331d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14073307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001154
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x10], 0
mov dword [rbp - 0x1c], 0x30
mov eax, dword [rbp - 0x1c]
mov rax, qword gs:[rax]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov rax, qword [rax + 8]
mov qword [rbp - 0x18], rax
mov dword [rbp - 4], 0
jmp 0x1400011ac
mov rax, qword [rbp - 0x10]
cmp rax, qword [rbp - 0x18]
jne 0x14000119e
mov dword [rbp - 4], 1
jmp 0x1400011e3
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [0x140005490]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x40], 0
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x30]
lock cmpxchg qword [rdx], rcx
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x14000118b
mov rax, qword [0x1400054a0]
mov eax, dword [rax]
cmp eax, 1
jne 0x1400011fd
mov ecx, 0x1f
call sym._amsg_exit
jmp 0x14000123c
mov rax, qword [0x1400054a0]
mov eax, dword [rax]
test eax, eax
jne 0x140001232
mov rax, qword [0x1400054a0]
mov dword [rax], 1
mov rax, qword [0x1400054e0]
mov rdx, rax
mov rax, qword [0x1400054d0]
mov rcx, rax
call sym._initterm
jmp 0x14000123c
mov dword [0x140009024], 1
mov rax, qword [0x1400054a0]
mov eax, dword [rax]
cmp eax, 1
jne 0x140001270
mov rax, qword [0x1400054c0]
mov rdx, rax
mov rax, qword [0x1400054b0]
mov rcx, rax
call sym._initterm
mov rax, qword [0x1400054a0]
mov dword [rax], 2
cmp dword [rbp - 4], 0
jne 0x140001294
mov rax, qword [0x140005490]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
mov rdx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
xchg qword [rax], rdx
mov rax, qword [0x1400053f0]
mov rax, qword [rax]
test rax, rax
je 0x1400012bf
mov rax, qword [0x1400053f0]
mov rax, qword [rax]
mov r8d, 0
mov edx, 2
mov ecx, 0
call rax
call sym._pei386_runtime_relocator
mov rax, qword [sym._gnu_exception_handler]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call rax
mov rdx, qword [0x140005480]
mov qword [rdx], rax
lea rax, [sym.__mingw_invalidParameterHandler]
mov rcx, rax
call sym._set_invalid_parameter_handler
call sym._fpreset
mov eax, dword [0x140009004]
lea rdx, [0x140009008]
mov ecx, eax
call sym.duplicate_ppstrings
call sym.__main
mov rax, qword [0x140005410]
mov rax, qword [rax]
mov rdx, qword [0x140009010]
mov qword [rax], rdx
mov rcx, qword [0x140009010]
mov rdx, qword [0x140009008]
mov eax, dword [0x140009004]
mov r8, rcx
mov ecx, eax
call sym.main
mov dword [0x14000901c], eax
mov eax, dword [0x140009020]
test eax, eax
jne 0x14000135d
mov eax, dword [0x14000901c]
mov ecx, eax
call sym.exit
mov eax, dword [0x140009024]
test eax, eax
jne 0x14000136c
call sym._cexit
mov eax, dword [0x14000901c]
add rsp, 0x70
pop rbp
ret
Function at 0x14000cbcc
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
mov eax, 0x1020
call fcn.140023900
sub rsp, rax
xor r14d, r14d
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
cmp word [rcx], r14w
je 0x14000cd7b
call fcn.14000cda4
mov rcx, rbx
call fcn.1400282c8
mov rcx, rbx
mov rbp, rax
call fcn.14000cdd4
test al, al
je 0x14000ccb0
mov rcx, rbx
call fcn.14000cda4
test al, al
je 0x14000cc64
lea rax, [rbp + 4]
cmp rdi, rax
jbe 0x14000cd7b
mov r8, rdi
lea rdx, [0x140038bd8]
mov rcx, rsi
call fcn.140012090
mov rdx, rbx
mov r8, rdi
mov rcx, rsi
call fcn.14001204c
mov al, 1
jmp 0x14000cd7d
cmp word [rbx], 0x5c
jne 0x14000cd7b
cmp word [rbx + 2], 0x5c
jne 0x14000cd7b
lea rax, [rbp + 6]
cmp rdi, rax
jbe 0x14000cd7b
mov r8, rdi
lea rdx, [0x140038bd8]
mov rcx, rsi
call fcn.140012090
mov r8, rdi
lea rdx, [0x140038be8]
mov rcx, rsi
call fcn.14001204c
lea rdx, [rbx + 2]
jmp 0x14000cc52
lea rdx, [rsp + 0x20]
mov ecx, 0x7ff
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
dec eax
cmp eax, 0x7fe
ja 0x14000cd7b
cmp word [rbx], 0x5c
je 0x14000cd45
cmp word [rbx], 0x2f
je 0x14000cd45
mov edx, 0x800
lea rcx, [rsp + 0x20]
call fcn.14000c62c
lea rcx, [rsp + 0x20]
call fcn.1400282c8
lea rcx, [rax + 4]
add rcx, rbp
cmp rdi, rcx
jbe 0x14000cd7b
mov r8, rdi
lea rdx, [0x140038bd8]
mov rcx, rsi
call fcn.140012090
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.14001204c
cmp word [rbx], 0x2e
jne 0x14000cc4f
cmp word [rbx + 2], 0x5c
je 0x14000cd3c
cmp word [rbx + 2], 0x2f
jne 0x14000cc4f
add rbx, 4
jmp 0x14000cc4f
lea rax, [rbp + 6]
cmp rdi, rax
jbe 0x14000cd7b
mov r8, rdi
lea rdx, [0x140038bd8]
mov rcx, rsi
call fcn.140012090
mov r8, rdi
mov word [rsp + 0x24], r14w
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.14001204c
jmp 0x14000cc4f
xor al, al
lea r11, [rsp + 0x1020]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret

Function at 0x14000dd0c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov edi, r8d
mov rsi, r9
mov r10b, bl
cmp r8d, 1
jbe 0x14000dd40
lea rcx, [rdx + 1]
lea r8d, [rdi - 1]
xor r10b, byte [rcx]
inc rcx
sub r8, 1
jne 0x14000dd34
cmp r10b, byte [rdx]
jne 0x14000dd7c
mov r8, rdi
or ecx, 0xffffffff
call fcn.140006380
lea rdx, [0x140048060]
not eax
mov rcx, rdx
cmp dword [rcx + 4], eax
jne 0x14000dd65
cmp dword [rcx], edi
je 0x14000dd72
inc ebx
add rcx, 0xc
cmp ebx, 6
jae 0x14000dd7c
jmp 0x14000dd5c
lea rcx, [rbx + rbx*2]
mov eax, dword [rdx + rcx*4 + 8]
mov dword [rsi], eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140002945
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 8], rcx
push r15
xor rax, rax
push rax
sub rsp, 0x28
call fcn.140012b50
mov r15, qword [rsp + 0x28]
cmp r15, 1
jne 0x140002981
push qword [0x1400204d4]
pop rcx
call fcn.140007168
and rax, rax
je 0x140002981
push qword [0x1400204d4]
pop rcx
call fcn.140007204
push qword [0x140020584]
pop rcx
call fcn.14000e1bc
push qword [0x140020564]
pop rcx
call fcn.14000e1bc
call fcn.140004884
push qword [0x140020524]
pop rcx
call fcn.14000e1bc
push qword [0x1400204fc]
pop rcx
call sub.KERNEL32.DLL_RemoveDirectoryW
push qword [0x140020594]
pop rcx
call sub.KERNEL32.DLL_RemoveDirectoryW
mov rax, qword [rsp + 0x40]
mov qword [0x1400204cc], rax
jmp 0x140001250
Function at 0x14000348c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.140012b50
push qword [rsp + 0x48]
push qword [rsp + 0x48]
pop rcx
pop rdx
call sub.KERNEL32.DLL_LoadResource
mov qword [rsp + 0x28], rax
push qword [rsp + 0x48]
push qword [rsp + 0x48]
pop rcx
pop rdx
call sub.KERNEL32.DLL_SizeofResource
mov qword [0x1400204e4], rax
push qword [0x1400204e4]
pop rcx
call fcn.14000d130
mov qword [rsp + 0x30], rax
push qword [0x1400204e4]
push qword [rsp + 0x38]
push qword [rsp + 0x38]
pop rcx
pop rdx
pop r8
call fcn.14000d260
push qword [rsp + 0x28]
pop rcx
call sub.KERNEL32.DLL_FreeResource
mov rax, qword [rsp + 0x30]
jmp 0x14000350a
add rsp, 0x38
ret

Function at 0x14000475f
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
xor rax, rax
push rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.140012b50
mov rcx, qword [rsp + 0x70]
call fcn.140006b38
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.140012a60
add rsp, 0x10
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x30]
sub rsp, 0x10
call fcn.140012a60
add rsp, 0x10
push rcx
sub rsp, 0x28
call fcn.140012930
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140012930
add rsp, 0x28
pop rcx
push rax
push 0x800
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140008160
add rsp, 0x28
lea rcx, [rsp + 0x40]
pop rdx
call fcn.140012980
push 0x800
push qword [rsp + 0x40]
pop rcx
pop rdx
call sub.KERNEL32.DLL_GetSystemDirectoryW
push qword [rsp + 0x38]
pop rcx
call sub.SHLWAPI.DLL_PathAddBackslashW
mov rcx, qword [rsp + 0x38]
push rcx
sub rsp, 0x28
call fcn.140012930
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140012bc0
add rsp, 0x28
pop rax
push rax
call fcn.140012d10
pop rdx
add rax, rdx
jmp 0x140004847
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.140012ad0
add rsp, 0x28
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.140012ad0
add rsp, 0x28
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.140012ad0
add rsp, 0x28
pop rax
add rsp, 0x48
ret
Function at 0x140004884
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.140012b50
mov r15, qword [0x140020504]
cmp r15, 1
jne 0x140004953
push qword [0x1400205f4]
pop rcx
call fcn.14000dd04
mov r15, rax
and r15, r15
jle 0x1400048e9
mov rcx, qword [0x1400205f4]
call fcn.14000dd0c
mov rcx, qword [0x1400205f4]
call fcn.14000dd20
or rax, rax
je 0x1400048e9
mov rbp, qword [0x1400205fc]
push qword [rbp + 0x10]
pop rcx
call fcn.14000e1bc
jmp 0x1400048c6
push qword [0x1400205e4]
pop rcx
call fcn.14000dd04
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x140004953
push 5
push 0
push 1
push qword [0x1400205e4]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140009060
mov rcx, qword [0x1400205e4]
call fcn.14000dd0c
mov rcx, qword [0x1400205e4]
call fcn.14000dd20
or rax, rax
je 0x140004953
mov rbp, qword [0x1400205ec]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.DLL_RemoveDirectoryW
jmp 0x140004930
mov rax, 1
jmp 0x14000495f
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140006b38
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.DLL_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f180]
call sub.KERNEL32.DLL_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.DLL_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_TerminateThread]
lea rcx, [0x140021200]
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov rbx, qword [0x140020630]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020630]
call fcn.1400123b8
lea rcx, [0x140021200]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
Function at 0x14000727c
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov r9, rdx
mov r8, rcx
mov qword [r11 - 0x10], rax
xor edi, edi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov rbp, rax
test rax, rax
je 0x140007342
lea rcx, [0x140021200]
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov rbx, qword [0x140020630]
jmp 0x140007306
lea rsi, [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
jne 0x140007303
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rbx, qword [rbx]
lea rcx, [0x140020630]
mov rdx, rsi
call fcn.1400123b8
jmp 0x140007306
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400072d3
mov rdx, qword [0x14001f110]
lea rcx, [0x140020630]
mov rdi, rdx
inc rdx
mov qword [0x14001f110], rdx
lea edx, [rbx + 0x20]
call fcn.140012400
lea rcx, [0x140021200]
mov qword [rax], rbp
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop rdi
ret

Function at 0x1400074d0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r12
push r13
push r15
sub rsp, 0x28
xor r15d, r15d
mov r13d, r9d
mov r12d, edx
mov ebp, r15d
cmp edx, 1
jl 0x140007634
mov qword [rsp + 0x50], rbx
test rcx, rcx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x20], r14
lea r14, [0x14001968c]
mov rbx, r14
mov edi, r15d
cmovne rbx, rcx
test r8, r8
cmovne r14, r8
mov rsi, rbx
movzx ecx, word [r14]
test cx, cx
je 0x140007600
cmp word [r14 + 2], di
je 0x140007600
or rax, 0xffffffffffffffff
nop
inc rax
cmp word [r14 + rax*2], di
jne 0x140007540
movsxd r15, eax
nop dword [rax]
mov r8, r15
mov rdx, r14
mov rcx, rbx
call sub.msvcrt.dll_wcsncmp
test eax, eax
je 0x14000756d
cmp word [rbx], bp
je 0x14000756d
add rbx, 2
jmp 0x140007550
inc edi
cmp edi, r12d
je 0x140007582
cmp word [rbx], bp
je 0x14000758b
lea rbx, [rbx + r15*2]
mov rsi, rbx
jmp 0x140007550
mov rbp, rbx
sub rbp, rsi
sar rbp, 1
xor r15d, r15d
mov rcx, rbx
call fcn.140012da0
mov r14, qword [rsp + 0x20]
mov edi, eax
test eax, eax
je 0x1400075ba
mov ecx, r13d
call fcn.140012e10
movsxd r8, ebp
mov rdx, rsi
mov rcx, rax
add r8, r8
call sub.msvcrt.dll_memmove
mov edx, r13d
mov ecx, ebp
call fcn.140012e40
test edi, edi
mov rdi, qword [rsp + 0x60]
mov rbx, rax
jne 0x1400075de
movsxd r8, ebp
mov rdx, rsi
mov rcx, rax
call sub.msvcrt.dll_wcsncpy
mov rsi, qword [rsp + 0x58]
movsxd rcx, ebp
mov word [rbx + rcx*2], r15w
mov rbx, qword [rsp + 0x50]
add rsp, 0x28
pop r15
pop r13
pop r12
pop rbp
ret
movzx eax, word [rbx]
cmp ax, cx
je 0x14000760d
test ax, ax
jne 0x140007620
inc edi
cmp edi, edx
je 0x140007626
test ax, ax
je 0x14000758e
lea rsi, [rbx + 2]
add rbx, 2
jmp 0x140007600
mov rbp, rbx
sub rbp, rsi
sar rbp, 1
jmp 0x14000758e
mov ecx, r9d
add rsp, 0x28
pop r15
pop r13
pop r12
pop rbp
jmp fcn.140012f20