joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400103c0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push r13
push r12
push rbx
sub rsp, 0x48
cmp dword [0x140118d40], 1
je 0x14001046b
lea r13, [0x1400e8150]
lea rbx, [0x140118d40]
mov rcx, r13
call fcn.14000fcc0
mov r12, qword [0x140118cf0]
test r12, r12
jne 0x140010411
jmp 0x140010605
mov rax, qword [r12 + 0x18]
test rax, rax
je 0x1400105d0
mov r12, rax
cmp qword [r12], rbx
jne 0x140010400
add dword [r12 + 0x10], 1
lea r14, [r12 + 8]
mov rcx, r13
call fcn.14000fd00
mov rcx, r14
call fcn.14000f640
mov ebx, dword [0x140118d40]
test ebx, ebx
jne 0x140010490
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1400e8168], eax
cmp eax, 0xffffffff
je 0x1400e78f0
mov dword [0x140118d40], 1
mov rcx, r14
call fcn.14000f960
mov rcx, r12
call fcn.14000fe60
mov ecx, dword [0x1400e8168]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x1400104c0
mov rax, r12
add rsp, 0x48
pop rbx
pop r12
pop r13
pop r14
ret
cmp ebx, 1
je 0x14001045b
mov ecx, 2
call qword [fcn.14000da70]
mov r9d, ebx
lea r8, [0x140118d40]
lea rdx, str._once__p_is__d_n
mov rcx, rax
call sub.msvcrt.dll_fprintf
jmp 0x14001045b
call fcn.1400102f0
cmp qword [0x14011b050], 0
mov rbx, rax
je 0x14001047f
test rax, rax
je 0x14001047f
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rbx + 0x70], eax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x38], 0xffffffffffffffff
lea rcx, [rbx + 0x68]
mov qword [rbx + 0x30], rax
call fcn.14000fcb0
cmp eax, 1
je 0x14001062a
mov r14, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x68], 0xffffffffffffffff
mov dword [rbx + 0xb8], 0
mov qword [rbx + 0x28], 0
call r14
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r12, rax
call r14
lea r9, [rbx + 0x28]
mov r8, r13
mov rdx, r12
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1400e78f0
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov ecx, dword [0x1400e8168]
mov rdx, rbx
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0xc0], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1400e78f0
mov r12, rbx
mov rax, r12
add rsp, 0x48
pop rbx
pop r12
pop r13
pop r14
ret
mov edx, 0x20
mov ecx, 1
call sub.msvcrt.dll_calloc
mov qword [rax], rbx
mov dword [rax + 0x10], 1
mov qword [r12 + 0x18], rax
mov r12, rax
lea r14, [r12 + 8]
xor edx, edx
mov rcx, r14
call fcn.14000fae0
jmp 0x140010422
mov edx, 0x20
mov ecx, 1
call sub.msvcrt.dll_calloc
mov qword [rax], rbx
mov r12, rax
mov dword [rax + 0x10], 1
mov qword [0x140118cf0], rax
jmp 0x1400105f1
call fcn.14000fd30
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
mov rax, qword [0x28]
ud2
Function at 0x140094eb0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
jmp 0x140094ed7
call rbp
cmp dword [rax], 4
jne 0x140094ef4
mov rcx, qword [rdi]
call sub.msvcrt.dll__fileno_1
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sub.msvcrt.dll__read
movsxd r12, eax
cmp eax, 0xffffffff
je 0x140094ed0
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x100411cb0
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x35353535
xor eax, 0x9e3535b5
push rbp
lodsd eax, dword [rsi]
xor eax, 0x35353535
xor eax, 0x35353535
xor eax, 0x35353535
invalid
invalid
invalid
Function at 0x1400111ea
Capabilities:
Terminate process

Disassembly:
jmp 0x140014ef0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001125d
Capabilities:
Create process on windows

Disassembly:
jmp 0x140011780
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1400210a2]
call fcn.140011357
mov edx, 5
lea rcx, str.calc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor eax, eax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x140011267
Capabilities:
Parse pe header

Disassembly:
jmp 0x140012c00
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140012c20
xor al, al
jmp 0x140012ca1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140012c33
xor al, al
jmp 0x140012ca1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140012c5d
xor al, al
jmp 0x140012ca1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140012c71
xor al, al
jmp 0x140012ca1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140012c83
xor al, al
jmp 0x140012ca1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140012c9f
xor al, al
jmp 0x140012ca1
mov al, 1
add rsp, 0x38
ret
Function at 0x1103c5058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1103c51df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1103c5089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1103c506f
add dl, dl
jne 0x1103c5096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1103c50f6
xor eax, eax
add dl, dl
jne 0x1103c50a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1103c51ad
add dl, dl
jne 0x1103c50b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1103c50c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1103c50d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1103c50dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1103c50ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1103c507e
mov eax, 1
add dl, dl
jne 0x1103c5106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1103c5113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1103c50fb
sub eax, ebx
mov ebx, 1
jne 0x1103c514c
mov ecx, 1
add dl, dl
jne 0x1103c512e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1103c513b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1103c5123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1103c507e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1103c5168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1103c5175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1103c515d
cmp eax, 0x7d00
jae 0x1103c519b
cmp eax, 0x500
jb 0x1103c5196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1103c507e
cmp eax, 0x7f
ja 0x1103c519e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1103c507e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1103c51d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1103c507e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140005c20
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push r14
sub rsp, 0x30
mov r14, r9
mov rdi, r8
mov rbx, rdx
mov esi, ecx
mov qword [rsp + 0x20], rdx
call fcn.140006530
test rax, rax
je 0x140005cbb
test rbx, rbx
jne 0x140005c6a
mov ecx, esi
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140005cbb
and rdi, 0xfffffffffffff000
mov rsi, qword [rsp + 0x68]
mov qword [rsi], rdi
xor eax, eax
mov rdi, qword [rsp + 0x60]
mov qword [rdi], rax
mov dword [r14], eax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
nop
mov rdx, r14
mov rcx, qword [rsi]
call fcn.1400054d0
sub rax, qword [rsi]
mov qword [rdi], rax
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
test rbx, rbx
jne 0x140005cb9
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x140005cbb
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140006050
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push r12
push r14
push r15
sub rsp, 0x30
mov r15d, r9d
mov rbx, r8
mov rsi, rdx
mov eax, ecx
mov rcx, rdx
mov qword [rsp + 0x28], rdx
mov r12d, 0xc0000001
mov edi, r12d
test rdx, rdx
jne 0x1400060ac
mov ecx, eax
lea rdx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x1400060a7
xor al, al
jmp 0x140006180
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
nop
mov rcx, rbx
call fcn.140005ce0
test al, al
je 0x140006159
lea rcx, [rbx - 1]
add rcx, r15
call fcn.140005ce0
test al, al
je 0x140006159
cmp dword [0x14001879c], 0
je 0x1400060f3
call fcn.1400017d0
call fcn.14000a410
cmp dword [0x14001879c], 0
jne 0x14000611d
movabs rax, 0x8000000000000000
cmp rbx, rax
jb 0x14000611d
mov r8d, r15d
mov rdx, rbx
mov rcx, qword [rsp + 0x70]
call fcn.140006920
xor edi, edi
cmp eax, r15d
cmovne edi, r12d
jmp 0x14000612f
mov r8, r15
mov rdx, rbx
mov rcx, qword [rsp + 0x70]
call fcn.14000c780
xor edi, edi
mov dword [rsp + 0x20], edi
cmp dword [0x14001879c], 0
je 0x140006159
call fcn.14000a4b0
mov rbx, rax
call fcn.14000a460
call fcn.1400017e0
test rbx, rbx
cmovne edi, r12d
mov dword [rsp + 0x20], edi
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
jmp 0x14000616b
test rsi, rsi
jne 0x14000617b
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test edi, edi
setns al
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x140006220
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13d, r9d
mov r14, r8
mov r15, rdx
mov eax, ecx
mov rcx, rdx
mov qword [rsp + 0x28], rdx
mov ebx, 0xc0000001
test rdx, rdx
jne 0x140006276
mov ecx, eax
lea rdx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140006271
xor al, al
jmp 0x1400063b6
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
nop
mov rcx, r14
call fcn.140005ce0
test al, al
je 0x14000638f
lea rcx, [r14 - 1]
add rcx, r13
call fcn.140005ce0
test al, al
je 0x14000638f
xor esi, esi
mov edi, esi
mov dword [rsp + 0x24], esi
cmp dword [0x14001879c], esi
jne 0x1400062b9
cmp dword [0x14001875c], esi
je 0x1400062ee
call fcn.1400017d0
cmp dword [0x14001879c], esi
je 0x1400062cb
call fcn.14000a410
cmp dword [0x14001875c], esi
je 0x1400062ee
call fcn.140001b70
btr rax, 0x10
mov rcx, rax
call fcn.140001c20
mov edi, 1
mov dword [rsp + 0x24], edi
cmp dword [0x14001879c], esi
jne 0x140006329
movabs rax, 0x8000000000000000
cmp r14, rax
jb 0x140006329
mov r8d, r13d
mov rdx, qword [rsp + 0x80]
mov rcx, r14
call fcn.140006920
mov ebx, esi
cmp eax, r13d
mov r14d, 0xc0000001
cmovne ebx, r14d
jmp 0x140006344
mov r8, r13
mov rdx, qword [rsp + 0x80]
mov rcx, r14
call fcn.14000c780
mov ebx, esi
mov r14d, 0xc0000001
mov dword [rsp + 0x20], ebx
cmp dword [0x14001879c], esi
jne 0x140006354
test edi, edi
je 0x14000638f
test edi, edi
je 0x14000636a
call fcn.140001b70
bts rax, 0x10
mov rcx, rax
call fcn.140001c20
cmp dword [0x14001879c], esi
je 0x14000637f
call fcn.14000a4b0
mov rsi, rax
call fcn.14000a460
call fcn.1400017e0
test rsi, rsi
cmovne ebx, r14d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
jmp 0x1400063a1
test r15, r15
jne 0x1400063b1
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test ebx, ebx
setns al
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x140006530
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x14000f090]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rcx, qword [0x14000f120]
test rcx, rcx
jne 0x1400065fa
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
test eax, eax
je 0x14000658a
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14000c4e0
add rsp, 0x158
ret
cmp dword [rsp + 0x24], 0xa
jb 0x1400065e9
cmp dword [rsp + 0x2c], 0x3839
jb 0x1400065e9
call fcn.140001b90
and rax, 0xfffffffffffff000
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmGetVirtualForPhysical]
mov rcx, rax
movabs rax, 0xffffff8000000000
and rcx, rax
movabs rax, 0x7ffffffff8
add rax, rcx
mov qword [0x140018780], rax
movabs rax, 0x7b7ffffff8
add rax, rcx
mov qword [0x140018788], rax
jmp 0x1400065f3
movabs rcx, 0xfffff68000000000
mov qword [0x14000f120], rcx
mov rax, rcx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14000c4e0
add rsp, 0x158
ret
Function at 0x1400073d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
xor r12d, r12d
xor dil, dil
mov r15d, r12d
call fcn.140001790
movsxd rcx, eax
lea r13, [0x1400187e0]
mov rbx, qword [r13 + rcx*8]
call fcn.140001790
cdqe
mov r14d, r12d
mov rax, qword [r13 + rax*8]
mov rcx, qword [rax + 8]
cmp rcx, qword [rbx + 0x18]
setae r14b
jb 0x14000742b
call fcn.14000a240
call fcn.140001790
movsxd rcx, eax
mov rbx, qword [r13 + rcx*8]
call fcn.140001790
mov rsi, qword [rbx + 8]
cdqe
mov rax, qword [r13 + rax*8]
sub rsi, qword [rax]
call qword [sym.imp.ntoskrnl.exe_KeGetCurrentIrql]
cmp al, 2
jae 0x14000746d
mov r15d, 1
call qword [sym.imp.ntoskrnl.exe_KeGetCurrentIrql]
movzx edi, al
mov eax, 2
mov cr8, rax
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbp, rax
test rax, rax
je 0x1400075f0
call fcn.140001790
movsxd rcx, eax
mov r8, rsi
mov rdx, qword [r13 + rcx*8]
mov rcx, rbp
mov rdx, qword [rdx]
call fcn.14000c780
call fcn.140001790
movsxd rcx, eax
mov rbx, qword [r13 + rcx*8]
call fcn.140001790
movsxd rcx, eax
mov rax, qword [rbx]
mov rdx, qword [r13 + rcx*8]
mov qword [rdx + 8], rax
test r15d, r15d
je 0x1400074cd
movzx eax, dil
mov cr8, rax
cmp dword [0x1400123c8], r12d
je 0x14000750d
mov rcx, qword [0x1400123c0]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], r12
xor r9d, r9d
mov qword [rsp + 0x38], r12
xor r8d, r8d
mov dword [rsp + 0x30], esi
xor edx, edx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
jmp 0x1400075f8
cmp qword [0x140012348], r12
je 0x1400075f8
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
lea rcx, [0x1400123a0]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
test eax, eax
jne 0x1400075f8
lea rcx, [0x140012360]
call qword [sym.imp.ntoskrnl.exe_ExAcquireFastMutex]
mov rax, qword [0x140012348]
test rax, rax
je 0x1400075e1
mov edx, dword [0x14000f008]
mov ecx, r12d
test edx, edx
jle 0x1400075e1
cmp dword [rax], r12d
jne 0x140007584
inc ecx
add rax, 0x30
cmp ecx, edx
jl 0x140007566
lea rcx, [0x140012360]
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
jmp 0x1400075f8
movsxd rax, ecx
lea rbx, [rax + rax*2]
mov rax, qword [0x140012348]
shl rbx, 4
mov dword [rbx + rax], r12d
test ecx, ecx
js 0x1400075e1
mov rax, qword [0x140012348]
mov qword [rbx + rax + 8], rbp
mov rax, qword [0x140012348]
mov dword [rbx + rax + 0x10], esi
call fcn.140001790
mov r8, qword [0x140012348]
mov dword [rbx + r8 + 0x14], eax
xor r8d, r8d
mov rcx, qword [0x140012348]
add rcx, 0x18
add rcx, rbx
lea edx, [r8 + 1]
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
lea rcx, [0x140012360]
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
jmp 0x1400075f8
movzx eax, dil
mov cr8, rax
call fcn.1400017d0
lea r11, [rsp + 0x60]
mov eax, r14d
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140009280
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x14000f090]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rax, qword [0x14000f4e0]
lea r9, [0x14000f500]
movsxd rdx, ecx
lea r8, str._sCPU_d.trace
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0xb0]
mov rbx, qword [rax + rdx*8]
mov edx, 0xc8
call sub.ntoskrnl.exe_swprintf_s
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x90]
mov dword [rsp + 0x60], 0x30
xorps xmm0, xmm0
mov qword [rsp + 0x70], rax
xor edi, edi
mov dword [rsp + 0x78], 0x240
movdqu xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x68], rdi
lea rcx, [rsp + 0x60]
mov qword [rbx + 0x110], rdi
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
mov dword [rsp + 0x50], edi
lea r9, [rsp + 0xa0]
mov qword [rsp + 0x48], rdi
lea r8, [rsp + 0x60]
mov dword [rsp + 0x40], 0x24
lea rcx, [rbx + 0x110]
mov dword [rsp + 0x38], edi
mov edx, 0x10100005
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000c4e0
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x140001000
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rdx, [0x1400032e0]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x1400032e8]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
call fcn.140001170
mov rcx, rax
lea rdx, [0x140001350]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rbx, [rsp + 0x20]
mov edi, 6
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
add rbx, 4
sub rdi, 1
jne 0x140001070
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003308]
call fcn.140001170
mov rcx, rax
lea rdx, [0x140001350]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor ebx, ebx
nop
mov edx, dword [rsp + rbx*4 + 0x20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140003318]
call fcn.140001170
inc rbx
cmp rbx, 6
jb 0x1400010b0
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400013a0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140001c68
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001cb2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001cb2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001cb2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001cb2
cmp dword [rcx + 0x84], 0xe
jbe 0x140001cb2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001cb4
xor al, al
add rsp, 0x28
ret
Function at 0x140058670
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x1402dc040]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rdx
mov qword [rsp + 0x58], rdx
xor edi, edi
mov rax, qword [0x1402de818]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x38]
call fcn.14005ebc0
nop
mov ecx, Ordinal_41
call fcn.14016e120
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rax + 8], xmm0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rax + 0x18], xmm1
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x38], dil
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140074e20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140058780
lea rcx, [rsp + 0x38]
call fcn.1400633d0
cmp dword [rsp + 0x68], edi
je 0x140058774
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140058774
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov rcx, rbx
call fcn.1400633d0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14016dfe0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x68], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3