joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400096b0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x48]
sub rsp, 0x140
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
mov rax, qword [0x14001e040]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov rbx, rcx
mov qword [rsp + 0x68], rcx
xor edi, edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x1400174c0]
movdqu xmmword [rbp - 0x80], xmm1
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x68], rdi
lea r9, [rsp + 0x68]
xor r8d, r8d
mov edx, 0x8000
lea rcx, [0x1400167a0]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
xorps xmm0, xmm0
test eax, eax
jns 0x14000973e
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], dil
jmp 0x140009839
xor eax, eax
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], rax
lea rcx, [rbp - 0x70]
call fcn.140004310
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov rdx, qword [rsp + 0x68]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140009790
lea rcx, [rsp + 0x20]
call fcn.140002280
nop
lea r8, [rsp + 0x20]
cmp qword [rsp + 0x38], 7
cmova r8, qword [rsp + 0x20]
mov rax, qword [rsp + 0x30]
lea r9, [r8 + rax*2]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x70]
call fcn.140004920
movups xmm6, xmmword [rsp + 0x48]
movups xmm7, xmmword [rsp + 0x58]
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x14000981d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009818
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009818
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140013218
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
movups xmmword [rbx], xmm6
movups xmmword [rbx + 0x10], xmm7
lea rcx, [rbp - 0x70]
call fcn.140004220
nop
mov rax, rbx
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.140012e00
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140013a88
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140013ad2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140013ad2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140013ad2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140013ad2
cmp dword [rcx + 0x84], 0xe
jbe 0x140013ad2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140013ad4
xor al, al
add rsp, 0x28
ret
Function at 0x140007bd0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x1a8]
sub rsp, 0x2a0
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1402f1140]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rsi, rcx
xor ebx, ebx
mov dword [rsp + 0x40], ebx
mov edx, 0x104
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x103
ja 0x140007d2b
xor eax, eax
mov qword [rsp + 0x78], rax
or edi, 0xffffffff
mov r8d, edi
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x30]
call fcn.140005580
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.140028160
movzx r8d, word [rax]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140005670
nop
lea r8, str.Temp
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.140005730
nop
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx]
test eax, eax
je 0x140007c9b
cmp eax, edi
je 0x140007caa
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140007caa
mov rcx, qword [rsp + 0x28]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002cd80
nop
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx]
test eax, eax
je 0x140007cca
cmp eax, 0xffffffff
je 0x140007cd8
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140007cd8
mov rcx, qword [rsp + 0x30]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002cd80
mov rax, qword [rsp + 0x78]
mov qword [rsi], rax
lea rax, [0x140172000]
mov qword [rsp + 0x78], rax
mov ecx, dword [0x140172000]
test ecx, ecx
je 0x140007d15
cmp ecx, 0xffffffff
je 0x140007dcf
lock xadd dword [0x140172000], edi
cmp edi, 1
jne 0x140007dcf
mov rax, qword [rsp + 0x78]
mov edx, 2
lea r8d, [rdx + 6]
mov rcx, rax
call fcn.14002cd80
jmp 0x140007dcf
mov qword [rsp + 0x50], 2
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
lea rax, str.default
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x50]
call fcn.14000f950
mov rbx, rax
or edi, 0xffffffff
mov r8d, edi
lea rdx, str.Failed_to_get_Windows_directory.
lea rcx, [rsp + 0x38]
call fcn.140004060
nop
mov rdx, rax
mov rcx, qword [rbx]
call fcn.14002a980
nop
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx]
test eax, eax
je 0x140007d9c
cmp eax, edi
je 0x140007daa
lock xadd dword [rcx], edi
cmp edi, 1
jne 0x140007daa
mov rcx, qword [rsp + 0x38]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002cd80
mov rcx, qword [rbx]
cmp byte [rcx + 0x20], 0
je 0x140007dbb
mov dl, 0x20
call fcn.14002aa00
nop
lea rcx, [rsp + 0x48]
call fcn.140022ff0
lea rax, [0x140172000]
mov qword [rsi], rax
mov rax, rsi
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.14010a180
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400080b0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x2d0
mov qword [rax - 0x260], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rax, qword [0x1402f1140]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov r14, rcx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
movsd xmm6, qword [0x1402bc228]
mov ebx, ebp
lea r15, str.default
or esi, 0xffffffff
movsd xmm7, qword [0x1402bc220]
nop word [rax + rax]
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm7
subsd xmm6, xmm0
mov qword [rsp + 0x48], 2
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.14000f950
mov rdi, rax
mov r8d, esi
lea rdx, str.SysWow64_folder_obfuscation_value:
lea rcx, [rsp + 0x20]
call fcn.140004060
nop
mov rdx, rax
mov rcx, qword [rdi]
call fcn.14002a980
nop
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x14000819a
cmp eax, 0xffffffff
je 0x1400081a8
mov eax, esi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1400081a8
mov rcx, qword [rsp + 0x20]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002cd80
mov rcx, qword [rdi]
cmp byte [rcx + 0x20], 0
je 0x1400081b8
mov dl, 0x20
call fcn.14002aa00
movaps xmm1, xmm6
mov rcx, qword [rdi]
call fcn.14002ac60
mov rcx, qword [rdi]
cmp byte [rcx + 0x20], 0
je 0x1400081d4
mov dl, 0x20
call fcn.14002aa00
nop
lea rcx, [rsp + 0x38]
call fcn.140022ff0
inc ebx
cmp ebx, 0x1e
jl 0x140008120
mov edx, 0x104
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
jne 0x1400082a4
mov qword [rsp + 0x68], 2
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], r15
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.14000f950
mov rbx, rax
mov r8d, esi
lea rdx, str.Failed_to_get_SysWow64_directory.
lea rcx, [rsp + 0x28]
call fcn.140004060
nop
mov rdx, rax
mov rcx, qword [rbx]
call fcn.14002a980
nop
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx]
test eax, eax
je 0x14000826f
cmp eax, 0xffffffff
je 0x14000827d
lock xadd dword [rcx], esi
cmp esi, 1
jne 0x14000827d
mov rcx, qword [rsp + 0x28]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002cd80
mov rcx, qword [rbx]
cmp byte [rcx + 0x20], 0
je 0x14000828e
mov dl, 0x20
call fcn.14002aa00
nop
lea rcx, [rsp + 0x40]
call fcn.140022ff0
lea rax, [0x140172000]
mov qword [r14], rax
jmp 0x1400082b7
mov r8d, esi
lea rdx, [rsp + 0x90]
mov rcx, r14
call fcn.140005580
mov rax, r14
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.14010a180
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14000c570
Capabilities:
Enumerate process modules

Disassembly:
push rsi
mov eax, 0x1250
call fcn.14010aae0
sub rsp, rax
mov rax, qword [0x1402f1140]
xor rax, rsp
mov qword [rsp + 0x1240], rax
mov rsi, rcx
lea r8, [rsp + 0x28]
lea rcx, [rsp + 0x30]
mov edx, 0x1000
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x14000c70b
mov qword [rsp + 0x1260], rbx
xor ebx, ebx
mov qword [rsp + 0x1268], rbp
mov ebp, dword [rsp + 0x28]
shr ebp, 2
mov qword [rsp + 0x1270], rdi
mov qword [rsp + 0x1278], r14
test ebp, ebp
je 0x14000c6e9
or r14, 0xffffffffffffffff
nop word [rax + rax]
mov r8d, dword [rsp + rbx*4 + 0x30]
mov eax, ebx
test r8d, r8d
je 0x14000c6df
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14000c6df
lea r9, [rsp + 0x2c]
mov r8d, 8
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x14000c6d6
mov rdx, qword [rsp + 0x20]
lea r8, [rsp + 0x1030]
mov r9d, 0x104
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x14000c6d6
cmp word [rsp + 0x1030], 0
jne 0x14000c669
xor eax, eax
jmp 0x14000c67e
lea rcx, [rsp + 0x1030]
mov rax, r14
inc rax
cmp word [rcx + rax*2], 0
jne 0x14000c674
cmp qword [rsi + 0x18], 8
jb 0x14000c68a
mov rdx, qword [rsi]
jmp 0x14000c68d
mov rdx, rsi
mov r10, qword [rsi + 0x10]
mov r9, rax
cmp r10, rax
cmovb r9, r10
test r9, r9
je 0x14000c6c7
lea r8, [rsp + 0x1030]
nop dword [rax + rax]
movzx ecx, word [r8]
cmp word [rdx], cx
jne 0x14000c724
add rdx, 2
add r8, 2
sub r9, 1
jne 0x14000c6b0
xor r9d, r9d
test r9d, r9d
jne 0x14000c6d6
cmp r10, rax
jb 0x14000c6d6
jbe 0x14000c733
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, ebp
jb 0x14000c5f0
xor al, al
mov rdi, qword [rsp + 0x1270]
mov rbp, qword [rsp + 0x1268]
mov rbx, qword [rsp + 0x1260]
mov r14, qword [rsp + 0x1278]
mov rcx, qword [rsp + 0x1240]
xor rcx, rsp
call fcn.14010a180
add rsp, 0x1250
pop rsi
ret
cmp word [rdx], cx
mov r9d, 1
cmovb r9d, r14d
jmp 0x14000c6ca
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x14000c6eb
Function at 0x14000d020
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1402f1140]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000d0b3
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000d0aa
lea rax, [rsp + 0x4c]
mov r8, rdi
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000d094
add rax, 2
test ecx, ecx
jne 0x14000d080
mov rcx, rbx
test edx, edx
je 0x14000d0d6
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000d070
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14010a180
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x14000d0b5
Function at 0x14000e730
Capabilities:
Contain obfuscated stackstrings
Enumerate process modules

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf70]
mov eax, 0x1070
call fcn.14010aae0
sub rsp, rax
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x10a0], rbx
mov qword [rsp + 0x10b0], rsi
mov qword [rsp + 0x10b8], rdi
mov rax, qword [0x1402f1140]
xor rax, rsp
mov qword [rbp + 0xf68], rax
mov rdi, rdx
mov dword [rbp + 0xf50], 0x360033
mov dword [rbp + 0xf54], 0x740030
mov dword [rbp + 0xf58], 0x610072
mov dword [rbp + 0xf5c], 0x2e0079
mov dword [rbp + 0xf60], 0x780065
mov dword [rbp + 0xf64], reloc.WS2_32.dll_WSAAsyncSelect
xor esi, esi
lea rcx, [rbp + 0xf50]
call fcn.14000d020
mov ebx, eax
test eax, eax
je 0x14000e944
lea r8, [rsp + 0x28]
mov edx, 0x1000
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x14000e944
mov edx, dword [rsp + 0x28]
shr edx, 2
mov ecx, esi
test edx, edx
je 0x14000e944
mov eax, ecx
cmp dword [rsp + rax*4 + 0x50], ebx
je 0x14000e819
inc ecx
cmp ecx, edx
jb 0x14000e806
jmp 0x14000e944
cmp qword [rdi + 0x10], rsi
je 0x14000e944
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.14000d6b0
nop
call fcn.14000d7e0
mov dword [rbp + 0xf50], 0x73006c
mov dword [rbp + 0xf54], 0x730061
mov dword [rbp + 0xf58], 0x2e0073
mov dword [rbp + 0xf5c], 0x780065
mov dword [rbp + 0xf60], reloc.WS2_32.dll_WSAAsyncSelect
lea rdx, [rbp + 0xf50]
call fcn.14000d210
test eax, eax
jne 0x14000e8e0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000e944
mov rax, qword [rsp + 0x40]
sub rax, rcx
cmp rax, 0x1000
jb 0x14000e93f
test cl, 0x1f
je 0x14000e8b6
call fcn.14010e940
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14000e8c5
call fcn.14010e940
int3
sub rcx, rax
cmp rcx, 8
jae 0x14000e8d4
call fcn.14010e940
int3
cmp rcx, 0x27
jbe 0x14000e93c
call fcn.14010e940
nop
lea r8, [rsp + 0x30]
mov edx, eax
call fcn.14000d950
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000e944
mov rax, qword [rsp + 0x40]
sub rax, rcx
cmp rax, 0x1000
jb 0x14000e93f
test cl, 0x1f
je 0x14000e912
call fcn.14010e940
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14000e921
call fcn.14010e940
int3
sub rcx, rax
cmp rcx, 8
jae 0x14000e930
call fcn.14010e940
int3
cmp rcx, 0x27
jbe 0x14000e93c
call fcn.14010e940
int3
mov rcx, rax
call fcn.14010a1f0
mov rcx, qword [rbp + 0xf68]
xor rcx, rsp
call fcn.14010a180
lea r11, [rsp + 0x1070]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14000fa80
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
sub rsp, 0x58
mov qword [r11 - 0x20], 0xfffffffffffffffe
lea rax, [r11 + 0x18]
mov qword [r11 - 0x18], rax
mov qword [r11 - 0x38], rax
mov r9, rdx
mov r8, rcx
mov edx, 3
lea rcx, [r11 - 0x28]
call fcn.1400111d0
nop
lea rcx, [0x140172000]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx]
test eax, eax
je 0x14000fae7
cmp eax, 0xffffffff
je 0x14000faf6
or eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14000faf6
mov rcx, qword [rsp + 0x30]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002cd80
nop
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
nop
test eax, eax
je 0x14000fb0d
mov ecx, 7
int 0x29
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop
mov rcx, rax
mov edx, 0x40000015
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
int3
Function at 0x140010330
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
lea rbp, [rsp - 0x4f]
sub rsp, 0xa8
mov qword [rbp + 0x2f], 0xfffffffffffffffe
mov ebx, ecx
lea r8, [rbp + 0x77]
mov qword [rbp + 0x37], r8
lea rcx, [rbp - 0x31]
call fcn.140021880
nop
mov edx, ebx
lea rcx, [rbp - 0x29]
call fcn.14004b9a0
nop
mov byte [rbp - 0x39], 0x29
mov dword [rbp - 0x21], 2
lea rcx, [0x14013d24c]
mov qword [rbp - 0x19], rcx
lea rcx, [rbp - 0x21]
mov qword [rbp - 0x11], rcx
mov qword [rbp - 9], rax
lea rax, [rbp - 0x11]
mov qword [rbp - 1], rax
lea rax, [rbp - 0x39]
mov qword [rbp + 7], rax
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x31]
call fcn.14000efd0
nop
mov rcx, qword [rbp - 0x29]
mov eax, dword [rcx]
or ebx, 0xffffffff
test eax, eax
je 0x1400103d5
cmp eax, ebx
je 0x1400103e3
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1400103e3
mov rcx, qword [rbp - 0x29]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002cd80
mov qword [rbp + 0xf], 2
xor eax, eax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x17], xmm0
mov qword [rbp + 0x27], rax
lea r8, [rbp - 0x31]
lea rdx, [rbp + 0xf]
lea ecx, [rax + 2]
call fcn.1400112c0
mov ecx, dword [0x14147aaf0]
mov rax, qword gs:[0x58]
mov edx, 8
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x14147632c], eax
jle 0x14001045f
lea rcx, [0x14147632c]
call fcn.14010a8f4
cmp dword [0x14147632c], 0xffffffff
jne 0x14001045f
lea rcx, str.QT_FATAL_CRITICALS
call fcn.14000f740
mov dword [0x141476328], eax
lea rcx, [0x14147632c]
call fcn.14010a894
cmp dword [0x141476328], 0
je 0x1400104a0
mov eax, ebx
lock xadd dword [0x141476328], eax
cmp eax, 1
jne 0x1400104a0
lea ecx, [rax + 0x16]
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14001048b
mov ecx, 7
int 0x29
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x40000015
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rcx, qword [rbp - 0x31]
mov eax, dword [rcx]
test eax, eax
je 0x1400104bc
cmp eax, 0xffffffff
je 0x1400104ca
lock xadd dword [rcx], ebx
cmp ebx, 1
jne 0x1400104ca
mov rcx, qword [rbp - 0x31]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002cd80
add rsp, 0xa8
pop rbx
pop rbp
ret
Function at 0x1400104e0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
lea rbp, [rsp - 0x4f]
sub rsp, 0xa8
mov qword [rbp + 0x2f], 0xfffffffffffffffe
or ebx, 0xffffffff
mov edx, ebx
lea rcx, [rbp - 0x29]
call fcn.14004b9a0
nop
lea r8, [rbp + 0x6f]
mov qword [rbp + 0x37], r8
mov rdx, qword [rbp + 0x67]
lea rcx, [rbp - 0x31]
call fcn.140021880
nop
mov byte [rbp - 0x39], 0x29
mov dword [rbp - 0x21], 2
lea rax, [0x14013d24c]
mov qword [rbp - 0x19], rax
lea rax, [rbp - 0x21]
mov qword [rbp - 0x11], rax
lea rax, [rbp - 0x29]
mov qword [rbp - 9], rax
lea rax, [rbp - 0x11]
mov qword [rbp - 1], rax
lea rax, [rbp - 0x39]
mov qword [rbp + 7], rax
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x31]
call fcn.14000efd0
mov qword [rbp + 0xf], 2
xor eax, eax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x17], xmm0
mov qword [rbp + 0x27], rax
lea r8, [rbp - 0x31]
lea rdx, [rbp + 0xf]
lea ecx, [rbx + 3]
call fcn.1400112c0
mov ecx, dword [0x14147aaf0]
mov rax, qword gs:[0x58]
mov edx, 8
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x14147632c], eax
jle 0x1400105ed
lea rcx, [0x14147632c]
call fcn.14010a8f4
cmp dword [0x14147632c], ebx
jne 0x1400105ed
lea rcx, str.QT_FATAL_CRITICALS
call fcn.14000f740
mov dword [0x141476328], eax
lea rcx, [0x14147632c]
call fcn.14010a894
cmp dword [0x141476328], 0
je 0x14001062e
mov eax, ebx
lock xadd dword [0x141476328], eax
cmp eax, 1
jne 0x14001062e
lea ecx, [rax + 0x16]
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x140010619
mov ecx, 7
int 0x29
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x40000015
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rcx, qword [rbp - 0x31]
mov eax, dword [rcx]
test eax, eax
je 0x14001064c
cmp eax, 0xffffffff
je 0x14001065b
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14001065b
mov rcx, qword [rbp - 0x31]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002cd80
nop
mov rcx, qword [rbp - 0x29]
mov eax, dword [rcx]
test eax, eax
je 0x140010677
cmp eax, 0xffffffff
je 0x140010685
lock xadd dword [rcx], ebx
cmp ebx, 1
jne 0x140010685
mov rcx, qword [rbp - 0x29]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002cd80
add rsp, 0xa8
pop rbx
pop rbp
ret
Function at 0x1400128c0
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
sub rsp, 0x58
mov qword [r11 - 0x20], 0xfffffffffffffffe
lea rax, [r11 + 0x18]
mov qword [r11 - 0x18], rax
mov qword [r11 - 0x38], rax
mov r9, rdx
mov r8, rcx
mov edx, 1
lea rcx, [r11 - 0x28]
call fcn.1400111d0
nop
mov ecx, dword [0x14147aaf0]
mov rax, qword gs:[0x58]
mov edx, 8
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x141476334], eax
jle 0x140012952
lea rcx, [0x141476334]
call fcn.14010a8f4
cmp dword [0x141476334], 0xffffffff
jne 0x140012952
lea rcx, str.QT_FATAL_WARNINGS
call fcn.14000f740
mov dword [0x141476330], eax
lea rcx, [0x141476334]
call fcn.14010a894
or edx, 0xffffffff
cmp dword [0x141476330], 0
je 0x140012996
mov eax, edx
lock xadd dword [0x141476330], eax
cmp eax, 1
jne 0x140012996
lea ecx, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x140012981
mov ecx, 7
int 0x29
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x40000015
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx]
test eax, eax
je 0x1400129b4
cmp eax, 0xffffffff
je 0x1400129c2
lock xadd dword [rcx], edx
cmp edx, 1
jne 0x1400129c2
mov rcx, qword [rsp + 0x30]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002cd80
add rsp, 0x58
ret

Function at 0x1400129d0
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov rbx, r8
mov rdi, rdx
mov esi, ecx
call fcn.140012560
test al, al
je 0x1400129fe
xor al, al
jmp 0x140012a6d
mov r9, rbx
mov r8, rdi
mov edx, esi
lea rcx, [rsp + 0x20]
call fcn.140010690
nop
mov eax, 0xa
mov word [rsp + 0x58], ax
movzx edx, ax
lea rcx, [rsp + 0x20]
call fcn.1400175b0
lea rcx, [rsp + 0x20]
call fcn.140021850
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x140012a5d
cmp eax, 0xffffffff
je 0x140012a6b
or eax, 0xffffffff
lock xadd dword [rcx], eax
sub eax, 1
jne 0x140012a6b
mov rcx, qword [rsp + 0x20]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002cd80
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140030c30
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0xc0
mov rax, qword [0x1402f1140]
xor rax, rsp
mov qword [rsp + 0xb0], rax
xor eax, eax
lea rdx, str.SOFTWAREMicrosoftCryptography
mov dword [rsp + 0x40], eax
mov rdi, rcx
mov qword [rsp + 0x38], rax
mov r9d, 0x20119
lea rax, [rsp + 0x38]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140030d03
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.MachineGuid
lea rax, [rsp + 0x60]
mov qword [rsp + 0xd8], rbx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x30], 0x4a
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
sete bl
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
mov rbx, qword [rsp + 0xd8]
je 0x140030d03
mov edx, dword [rsp + 0x30]
lea rax, [rsp + 0x60]
dec edx
mov qword [rsp + 0x50], rax
shr rdx, 1
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], rdx
mov rdx, rdi
call fcn.140031610
jmp 0x140030d0d
lea rax, [0x140172000]
mov qword [rdi], rax
mov rax, rdi
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14010a180
add rsp, 0xc0
pop rdi
ret