joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10000e798
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xf0
mov rsi, rcx
mov rdi, r9
lea rdx, [0x1000066f0]
lea rcx, [rsp + 0x20]
mov r9d, 1
mov r8d, 0xfd
call fcn.100018130
and qword [rsp + 0x60], 0
and qword [rsp + 0x70], 0
and dword [rsp + 0x80], 0
lea r11, [0x100005960]
xor edx, edx
lea r8d, [rdx + 0x6c]
lea rcx, [rsp + 0x84]
mov qword [rsp + 0x58], r11
mov qword [rsp + 0x68], r11
call sub.msvcrt.dll_memset
mov r11d, 0x103
mov word [rsp + 0x24], r11w
lea eax, [r11 + 1]
test rdi, rdi
jne 0x10000e82d
mov ebx, 0x80070057
mov dword [rsp + 0x20], ebx
mov word [rsp + 0x26], ax
jmp 0x10000e965
and dword [rsp + 0x20], 0
lea rdx, [0x1000069f0]
lea rcx, [rsp + 0x68]
mov word [rsp + 0x24], ax
call fcn.10001bc5c
mov ebx, eax
mov dword [rsp + 0x20], eax
test eax, eax
mov eax, 0x106
js 0x10000e823
lea rdx, [0x10000610c]
lea rcx, [rsp + 0x58]
mov r8, rdi
mov word [rsp + 0x24], ax
call fcn.10001b7dc
mov ebx, eax
mov dword [rsp + 0x20], eax
test eax, eax
mov eax, 0x108
js 0x10000e823
mov word [rsp + 0x24], ax
lea rax, [0x100006708]
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x68]
mov dword [rsp + 0x84], 0x540
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x58]
mov dword [rsp + 0x80], 0x70
mov qword [rsp + 0x88], rsi
mov dword [rsp + 0xb0], 1
mov qword [rsp + 0xa0], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x10000e961
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov dword [rsp + 0x20], ebx
mov rcx, qword [0x10001f120]
lea rax, [0x10001f120]
cmp rcx, rax
je 0x10000e936
bt dword [rcx + 0x1c], 9
jae 0x10000e936
mov rcx, qword [rcx + 0x10]
lea r8, [0x100005c80]
mov edx, 0xa
mov r9d, ebx
call fcn.10000e640
mov ebx, dword [rsp + 0x20]
cmp ebx, 0x800704c7
jne 0x10000e953
mov ebx, 1
mov eax, 0x11d
mov dword [rsp + 0x20], ebx
mov word [rsp + 0x24], ax
jmp 0x10000e965
mov eax, 0x121
test ebx, ebx
jns 0x10000e94c
jmp 0x10000e823
mov ebx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0xe8]
test rcx, rcx
je 0x10000e985
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rsp + 0xe8], 0
mov ebx, dword [rsp + 0x20]
lea rcx, [rsp + 0x68]
call fcn.10001ae4c
lea rcx, [rsp + 0x58]
call fcn.10001ae4c
lea rcx, [rsp + 0x20]
call fcn.100018248
lea r11, [rsp + 0xf0]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x10000e9c0
Capabilities:
Get file system object information

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x560
mov rax, qword [0x10001f110]
xor rax, rsp
mov qword [rsp + 0x550], rax
mov rdi, rdx
mov rbx, rcx
lea rdx, [0x100006718]
lea rcx, [rsp + 0x30]
mov r9d, 1
mov r8d, 0x142
call fcn.100018130
and qword [rsp + 0x70], 0
lea rcx, [rsp + 0x78]
xor edx, edx
mov r8d, 0x2b0
call sub.msvcrt.dll_memset
and dword [rsp + 0x330], 0
lea rcx, [rsp + 0x338]
xor edx, edx
mov r8d, 0x218
call sub.msvcrt.dll_memset
test rdi, rdi
je 0x10000ea40
and qword [rdi], 0
mov eax, 0x14c
test rbx, rbx
jne 0x10000ea5d
mov ebx, 0x80070057
mov dword [rsp + 0x30], ebx
mov word [rsp + 0x36], ax
jmp 0x10000eaf0
mov word [rsp + 0x34], ax
mov eax, 0x14d
test rdi, rdi
je 0x10000ea4a
and dword [rsp + 0x30], 0
lea r8, [rsp + 0x70]
mov r9d, 0x2b8
xor edx, edx
mov rcx, rbx
mov word [rsp + 0x34], ax
mov dword [rsp + 0x20], 0x101
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
jne 0x10000eade
lea r8, [rsp + 0x330]
lea ecx, [rax + 8]
mov edx, 0x101
mov dword [rsp + 0x330], 0x220
call qword [sym.imp.SHELL32.dll_SHGetStockIconInfo]
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
mov eax, 0x15a
jns 0x10000eacf
mov ebx, 0x80004005
jmp 0x10000ea4f
mov word [rsp + 0x34], ax
mov rax, qword [rsp + 0x338]
jmp 0x10000eae7
mov rax, qword [rsp + 0x70]
mov ebx, dword [rsp + 0x30]
and qword [rsp + 0x70], 0
mov qword [rdi], rax
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x10000eb0a
call qword [sym.imp.USER32.dll_DestroyIcon]
and qword [rsp + 0x70], 0
mov ebx, dword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.100018248
mov eax, ebx
mov rcx, qword [rsp + 0x550]
xor rcx, rsp
call fcn.10001c420
mov rbx, qword [rsp + 0x580]
add rsp, 0x560
pop rdi
ret
Function at 0x10001385c
Capabilities:
Get disk information

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xe0
mov rax, qword [0x10001f110]
xor rax, rsp
mov qword [rsp + 0xd8], rax
mov rbx, rcx
mov r14d, 1
lea rdx, [0x100006b70]
lea rcx, [r11 - 0x80]
mov r8d, 0xa96
mov r9d, r14d
call fcn.100018130
lea r12, [rbx + 0x90]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdi, qword [rbx + 0x80]
test rdi, rdi
je 0x100013a48
mov r15d, 0x750
mov rbx, qword [rdi]
test rbx, rbx
je 0x10001395d
mov dword [rsp + 0x38], 0xa
lea rax, [rsp + 0xc0]
xor r9d, r9d
mov qword [rsp + 0x30], rax
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x10001395d
lea rdx, [0x1000066d8]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x100013944
lea rdx, [0x1000066e8]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x10001395d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ecx, ecx
cmp eax, 2
sete cl
test ecx, ecx
jne 0x100013a31
mov rbx, qword [rdi]
test rbx, rbx
je 0x100013a35
lea rdx, [0x100007440]
lea rcx, [rsp + 0x50]
mov r9d, r14d
mov r8d, 0x73d
call fcn.100018130
and qword [rsp + 0x48], 0
and dword [rsp + 0x50], 0
mov eax, 0x74a
lea rdx, [rsp + 0x48]
mov rcx, rbx
mov dword [rsp + 0x40], r14d
mov ebp, r14d
mov word [rsp + 0x54], ax
call fcn.10001a17c
mov rsi, qword [rsp + 0x48]
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x1000139c2
mov word [rsp + 0x56], r15w
jmp 0x100013a0c
xor ebx, ebx
mov word [rsp + 0x54], r15w
cmp dword [rsi], ebx
jbe 0x1000139f5
lea rbp, [rsi + 8]
mov ecx, dword [rbp]
lea rdx, [rsp + 0x40]
call fcn.10001a88c
test eax, eax
js 0x1000139f5
cmp dword [rsp + 0x40], 0
jne 0x1000139f5
add ebx, r14d
add rbp, 0x18
cmp ebx, dword [rsi]
jb 0x1000139d2
xor ebp, ebp
cmp ebx, dword [rsi]
mov eax, 0x762
setne bpl
and dword [rsp + 0x50], 0
mov word [rsp + 0x54], ax
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov ebx, dword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.100018248
test ebx, ebx
mov r11d, r14d
cmovns r11d, ebp
test r11d, r11d
jne 0x100013a35
xor eax, eax
jmp 0x100013a38
mov eax, r14d
mov dword [rdi + 0x30], eax
mov rdi, qword [rdi + 0x58]
test rdi, rdi
jne 0x1000138d0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, dword [rsp + 0x88]
lea rcx, [rsp + 0x88]
call fcn.100018248
mov eax, ebx
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.10001c420
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x100017a08
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rbx, r8
mov edi, 1
lea rdx, [0x100007110]
lea rcx, [rsp + 0x20]
mov r8d, 0x32d
mov r9d, edi
call fcn.100018130
mov dword [rsp + 0x80], edi
mov eax, 0x331
test rbx, rbx
je 0x100017a8c
and dword [rsp + 0x20], 0
lea r9d, [rdi + 1]
lea r8, [rsp + 0x80]
mov edx, 0x20001009
mov ecx, 0x400
mov dword [rbx], 0
mov word [rsp + 0x24], ax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ecx, dword [rsp + 0x80]
test eax, eax
cmove ecx, edi
mov dword [rbx], ecx
mov ebx, dword [rsp + 0x20]
mov dword [rsp + 0x80], ecx
jmp 0x100017a9a
mov ebx, 0x80070057
mov word [rsp + 0x26], ax
mov dword [rsp + 0x20], ebx
lea rcx, [rsp + 0x20]
call fcn.100018248
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x1000197d4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov esi, r9d
mov r9d, 2
mov rdi, r8
mov rbx, rdx
mov rbp, rcx
lea r8d, [r9 + 0x1f]
lea rdx, [0x1000072c8]
lea rcx, [rsp + 0x38]
call fcn.100018130
and dword [rsp + 0x30], 0
and dword [rsp + 0xa0], 0
and dword [rsp + 0x98], 0
test rdi, rdi
je 0x100019827
mov dword [rdi], 0
mov eax, 0x2a
test rbx, rbx
jne 0x100019840
mov ebx, 0x80070057
mov word [rsp + 0x3e], ax
jmp 0x100019919
mov word [rsp + 0x3c], ax
mov eax, 0x2b
test rdi, rdi
je 0x100019831
and dword [rsp + 0x38], 0
mov word [rsp + 0x3c], ax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
lea r9, [rsp + 0xa0]
xor r8d, r8d
mov rdx, rbx
mov rcx, rbp
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x98], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test esi, esi
je 0x1000198a3
cmp eax, 2
jne 0x1000198a3
lea ebx, [rax - 1]
lea eax, [rbx + 0x30]
jmp 0x100019914
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x34
mov dword [rsp + 0x38], ebx
test ebx, ebx
jns 0x1000198cd
mov word [rsp + 0x3e], ax
mov dword [rsp + 0x40], 1
jmp 0x10001991d
cmp dword [rsp + 0xa0], 4
mov word [rsp + 0x3c], ax
mov eax, 0x36
je 0x1000198eb
mov ebx, 0x8007065d
jmp 0x100019836
cmp dword [rsp + 0x98], 4
mov word [rsp + 0x3c], ax
je 0x100019909
mov ebx, 0x80004005
mov eax, 0x37
jmp 0x100019836
mov eax, dword [rsp + 0x30]
xor ebx, ebx
mov dword [rdi], eax
lea eax, [rbx + 0x3b]
mov word [rsp + 0x3c], ax
mov dword [rsp + 0x38], ebx
lea rcx, [rsp + 0x38]
call fcn.100018248
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x10001a03c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x280
mov rax, qword [0x10001f110]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbx, rcx
lea rdx, [0x100007408]
lea rcx, [rsp + 0x20]
mov r9d, 1
mov r8d, 0x393
call fcn.100018130
lea rcx, [rsp + 0x62]
xor edi, edi
xor edx, edx
mov r8d, 0x208
mov word [rsp + 0x60], di
call sub.msvcrt.dll_memset
cmp rbx, rdi
jne 0x10001a0b1
mov ebx, 0x80070057
mov eax, 0x398
mov dword [rsp + 0x20], ebx
mov word [rsp + 0x26], ax
jmp 0x10001a146
mov eax, 0x399
lea rdx, [rsp + 0x60]
lea rcx, [0x100007420]
mov r8d, 0x105
mov dword [rsp + 0x20], edi
mov word [rbx], di
mov word [rsp + 0x24], ax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r11d, eax
cmp eax, edi
jne 0x10001a0f3
call fcn.100019754
mov ebx, eax
mov dword [rsp + 0x20], eax
mov eax, 0x3a2
jmp 0x10001a0a7
mov eax, 0x3a2
mov word [rsp + 0x24], ax
mov eax, 0x3a3
cmp r11d, 0x105
jbe 0x10001a112
mov ebx, 0x8007007a
jmp 0x10001a0a3
lea rcx, [rsp + 0x60]
mov r8d, 0x105
mov rdx, rbx
mov dword [rsp + 0x20], edi
mov word [rsp + 0x24], ax
call fcn.100019d18
mov ebx, eax
mov dword [rsp + 0x20], eax
cmp eax, edi
mov eax, 0x3a5
jl 0x10001a0a7
mov word [rsp + 0x24], ax
lea rcx, [rsp + 0x20]
call fcn.100018248
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.10001c420
mov rbx, qword [rsp + 0x298]
add rsp, 0x280
pop rdi
ret
Function at 0x10001bc5c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, rdx
mov rbx, rcx
cmp dword [rcx + 8], esi
je 0x10001bc81
mov rax, qword [rcx]
mov dword [rcx + 8], esi
mov word [rax], si
cmp rdx, rsi
jne 0x10001bc8d
mov edx, 0x80070057
jmp 0x10001bcf4
mov r8d, dword [rcx + 0xc]
mov rdx, qword [rcx]
jmp 0x10001bcc2
cmp r11d, dword [rbx + 0xc]
jbe 0x10001bd06
cmp dword [rbx + 8], esi
je 0x10001bcaa
mov rax, qword [rbx]
mov dword [rbx + 8], esi
mov word [rax], si
mov edx, r11d
mov rcx, rbx
call fcn.10001b0b0
cmp eax, esi
mov edx, eax
jl 0x10001bcf4
mov r8d, dword [rbx + 0xc]
mov rdx, qword [rbx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r11d, eax
cmp eax, esi
jne 0x10001bc96
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
or edx, 0x80070000
cmp eax, esi
cmovle edx, eax
cmp dword [rbx + 8], esi
je 0x10001bcf4
mov rax, qword [rbx]
mov dword [rbx + 8], esi
mov word [rax], si
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, edx
add rsp, 0x20
pop rdi
ret
lea eax, [r11 - 1]
mov edx, esi
cmp eax, dword [rbx + 0xc]
ja 0x10001bc86
mov dword [rbx + 8], eax
mov ecx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], si
jmp 0x10001bcf4
Function at 0x10001c0e8
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
push r12
sub rsp, 0xb0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x100020c20], rdi
je 0x10001c141
cmp rax, rdi
jne 0x10001c134
mov esi, 1
jmp 0x10001c141
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10001c11b
mov eax, dword [0x100020c18]
cmp eax, 1
jne 0x10001c156
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x10001c1bb
mov eax, dword [0x100020c18]
test eax, eax
jne 0x10001c1b1
mov dword [0x100020c18], 1
lea r12, [0x1000016f8]
lea rdi, [0x1000016e0]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], eax
cmp rdi, r12
jae 0x10001c1a3
test eax, eax
jne 0x10001c1a3
mov rcx, qword [rdi]
test rcx, rcx
je 0x10001c198
call rcx
mov dword [rsp + 0x30], eax
add rdi, 8
mov qword [rsp + 0x38], rdi
jmp 0x10001c181
test eax, eax
je 0x10001c1bb
mov eax, 0xff
jmp 0x10001c305
mov dword [0x100020434], 1
mov eax, dword [0x100020c18]
cmp eax, 1
jne 0x10001c1e3
lea rdx, [0x1000016d8]
lea rcx, [0x1000016c8]
call sub.msvcrt.dll__initterm
mov dword [0x100020c18], 2
test esi, esi
jne 0x10001c1f0
xor eax, eax
xchg qword [0x100020c20], rax
cmp qword [0x100020c28], 0
je 0x10001c219
lea rcx, [0x100020c28]
call fcn.10001c58c
test eax, eax
je 0x10001c219
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100020c28]
mov rax, qword [sym.imp.msvcrt.dll__acmdln]
mov rdi, qword [rax]
mov qword [rsp + 0x28], rdi
mov esi, dword [rsp + 0x20]
cmp byte [rdi], 0x20
ja 0x10001c2a4
cmp byte [rdi], 0
je 0x10001c23a
test esi, esi
jne 0x10001c2a4
cmp byte [rdi], 0
je 0x10001c24e
cmp byte [rdi], 0x20
ja 0x10001c24e
inc rdi
mov qword [rsp + 0x28], rdi
jmp 0x10001c23a
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rdi
xor edx, edx
lea rcx, [0x100000000]
call fcn.1000080d8
mov dword [0x100020430], eax
cmp dword [0x100020414], 0
jne 0x10001c28d
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x100020434], 0
jne 0x10001c2a2
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x100020430]
jmp 0x10001c305
cmp byte [rdi], 0x22
jne 0x10001c2b6
xor eax, eax
test esi, esi
sete al
mov esi, eax
mov dword [rsp + 0x20], eax
movzx ecx, byte [rdi]
call qword [sym.imp.msvcrt.dll__ismbblead]
test eax, eax
je 0x10001c2cb
inc rdi
mov qword [rsp + 0x28], rdi
inc rdi
mov qword [rsp + 0x28], rdi
jmp 0x10001c22c
lea r11, [rsp + 0xb0]
mov rsi, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r12
ret
sub rsp, 0x28
call fcn.10001c6a0
add rsp, 0x28
jmp 0x10001c0e8
Function at 0x10001c420
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x10001f110]
jne 0x10001c43b
rol rcx, 0x10
test cx, 0xffff
jne 0x10001c437
ret 0
ror rcx, 0x10
jmp 0x10001c75c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1000204f0]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x1000205e8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x10001c7e1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1000204f0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x10001c803
mov rax, qword [rsp + 0x88]
mov qword [0x1000205e8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x100020588], rax
mov rax, qword [0x1000205e8]
mov qword [0x100020460], rax
mov rax, qword [rsp + 0x90]
mov qword [0x100020570], rax
mov dword [0x100020450], 0xc0000409
mov dword [0x100020454], 1
mov rax, qword [0x10001f110]
mov qword [rsp + 0x68], rax
mov rax, qword [0x10001f118]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x100001720]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x10001c5f8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x10001c645
cmp rcx, 0xffffffffffffffff
je 0x10001c645
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x10001c63d
cmp dword [rcx + 0x3c], edx
jl 0x10001c63d
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10001c63d
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x10001c645
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140001ec4
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x60
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
cmp dword [rcx + 0x118], 6
jae 0x140002006
xor edi, edi
cmp qword [0x140035300], rdi
jne 0x140001ffd
bt qword [0x1400223f8], 0
lea rdx, str.NtOpenKeyedEvent
lea rcx, [0x140034038]
call fcn.1400024ec
mov rbx, rax
test rax, rax
jne 0x140001f2f
xor r9d, r9d
lea edx, [rdi + 1]
xor r8d, r8d
mov ecx, 0xc0000264
call qword [sym.imp.KERNEL32.dll_RaiseException]
or rcx, 0xffffffffffffffff
lea r9, str.KernelObjectsCritSecOutOfMemoryEvent
mov rax, r9
mov rdx, rdi
lea r8d, [rcx + 3]
cmp word [rax], di
je 0x140001f55
inc rdx
add rax, r8
sub rcx, 1
jne 0x140001f44
lea rcx, [rdx + rdx]
mov qword [rsp + 0x28], r9
mov edx, 0xffff
mov dword [rsp + 0x30], 0x30
cmp rcx, rdx
mov qword [rsp + 0x38], rdi
movzx eax, cx
cmova ax, dx
mov word [rsp + 0x20], ax
lea rax, [rcx + 2]
add cx, r8w
lea r8, [rsp + 0x30]
cmp rax, rdx
lea rax, [rsp + 0x20]
mov qword [rsp + 0x40], rax
cmova cx, dx
xor eax, eax
mov word [rsp + 0x22], cx
mov edx, 0x2000000
movaps xmm0, xmmword [rsp + 0x20]
lea rcx, [rsp + 0x70]
movdqa xmmword [rsp + 0x20], xmm0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rax
call rbx
test eax, eax
jns 0x140001fe1
xor r9d, r9d
xor r8d, r8d
mov ecx, 0xc0000264
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov rcx, qword [rsp + 0x70]
xor eax, eax
lock cmpxchg qword [0x140035300], rcx
je 0x140001ffd
mov rcx, qword [rsp + 0x70]
call fcn.1400011c0
mov rax, qword [0x140035300]
jmp 0x140002008
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x1400025b8
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x168]
sub rsp, 0x240
xor r12d, r12d
mov r15d, r8d
xor eax, eax
mov rbx, rdx
mov rsi, rcx
lock cmpxchg qword [rcx], r12
je 0x14000261f
or rdi, 0xffffffffffffffff
cmp rax, rdi
jne 0x1400025fe
xor eax, eax
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
or rdi, 0xffffffffffffffff
mov qword [rbp + 0x188], r12
test r15b, 1
je 0x14000263e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
jmp 0x140002783
bt qword [0x140022438], 0
lea rdx, str.LoadLibraryExW
lea rcx, [0x140034078]
call fcn.1400024ec
mov r14, rax
test rax, rax
je 0x1400025fc
mov r13d, 2
test r13b, r15b
je 0x140002675
mov r8d, r13d
jmp 0x14000277b
test r15b, 4
je 0x140002683
xor r8d, r8d
jmp 0x14000277b
bt qword [0x140022418], 0
lea rdx, str.AddDllDirectory
lea rcx, [0x140034058]
call fcn.1400024ec
test rax, rax
jne 0x140002775
bt qword [0x140022410], 0
lea rdx, str.LdrLoadDll
lea rcx, [0x140034050]
call fcn.1400024ec
mov r15, rax
test rax, rax
je 0x1400025fc
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.140020b20
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x102
ja 0x14000267b
mov rdx, rdi
mov rax, rbx
mov rcx, r12
test rbx, rbx
je 0x14000271b
cmp word [rax], r12w
je 0x14000271b
inc rcx
add rax, r13
sub rdx, 1
jne 0x140002709
add rcx, rcx
mov qword [rsp + 0x28], rbx
movzx eax, cx
lea r9, [rbp + 0x188]
mov edx, 0xffff
lea r8, [rsp + 0x20]
cmp rcx, rdx
cmova ax, dx
mov word [rsp + 0x20], ax
lea rax, [rcx + 2]
add cx, r13w
cmp rax, rdx
cmova cx, dx
xor edx, edx
mov word [rsp + 0x22], cx
lea rcx, [rsp + 0x30]
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
call r15
mov rax, qword [rbp + 0x188]
jmp 0x14000278a
mov r8d, 0x800
xor edx, edx
mov rcx, rbx
call r14
mov qword [rbp + 0x188], rax
test rax, rax
jne 0x140002797
xchg qword [rsi], rdi
jmp 0x1400025fc
xchg qword [rsi], rax
test rax, rax
je 0x1400027ac
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [rbp + 0x188]
jmp 0x1400025fe
Function at 0x140005914
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140005942
xor eax, eax
jmp 0x140005a28
cmp qword [rcx + 0x68], 0
je 0x140005953
call fcn.140005a44
jmp 0x140005a28
mov rax, qword [rcx + 0x38]
mov rbp, rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x14000596a
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000596c
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000599e
cmp rax, rdi
mov rbx, rdi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.140020480
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rbp, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140005a22
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400059d5
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x1400059fe
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.14000d678
add r14, rax
sub rbp, rax
cmp rax, rbx
jne 0x140005a22
cmp rbp, rbx
ja 0x1400059dc
test rbp, rbp
je 0x140005a22
mov r9, qword [rsi + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, r14
call fcn.14000d678
sub rbp, rax
sub rdi, rbp
mov rax, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1400074e0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000752a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000752a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000752a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000752a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000752a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000752c
xor al, al
add rsp, 0x28
ret