joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400461d4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
and dword [rsp + 0x58], 0
mov ebx, edx
lea rdx, [rcx + 0x40]
mov dword [rsp + 0x40], r9d
cmp qword [rdx + 0x18], 8
jb 0x1400461f8
mov rdx, qword [rdx]
mov rcx, qword [rcx + 0x60]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
je 0x140046273
mov edx, 0x5c
lea rcx, str.admin_appman_appv_sharedclientconfigurationRegistryValue.h
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x140046247
inc rax
jmp 0x14004624e
lea rax, str.admin_appman_appv_sharedclientconfigurationRegistryValue.h
mov rdx, rax
lea rcx, [0x1400b38d0]
call fcn.140015fd4
shl rax, 0x34
movabs rcx, 0x342500000000
or rax, rdi
or rax, rcx
jmp 0x1400462cb
cmp ebx, dword [rsp + 0x58]
je 0x1400462c1
mov edx, 0x5c
lea rcx, str.admin_appman_appv_sharedclientconfigurationRegistryValue.h
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x14004629b
inc rax
jmp 0x1400462a2
lea rax, str.admin_appman_appv_sharedclientconfigurationRegistryValue.h
mov rdx, rax
lea rcx, [0x1400b38d0]
call fcn.140015fd4
shl rax, 0x34
movabs rcx, 0x350500040002
jmp 0x14004626e
movabs rax, 0x8000000000
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140046430
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
and dword [rax + 0x20], 0
mov esi, edx
and dword [rax + 8], 0
lea rdx, [rcx + 0x40]
cmp qword [rdx + 0x18], 8
mov rdi, r8
jb 0x14004645b
mov rdx, qword [rdx]
mov rcx, qword [rcx + 0x60]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
and qword [rsp + 0x20], 0
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 0xea
je 0x1400464e1
test eax, eax
je 0x1400464e1
mov edx, 0x5c
lea rcx, str.admin_appman_appv_sharedclientconfigurationRegistryValue.h
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x1400464b2
inc rax
jmp 0x1400464b9
lea rax, str.admin_appman_appv_sharedclientconfigurationRegistryValue.h
mov rdx, rax
lea rcx, [0x1400b38d0]
call fcn.140015fd4
shl rax, 0x34
movabs rcx, 0x312500000000
or rax, rbx
or rax, rcx
jmp 0x140046591
cmp esi, dword [rsp + 0x40]
je 0x14004652f
mov edx, 0x5c
lea rcx, str.admin_appman_appv_sharedclientconfigurationRegistryValue.h
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x140046509
inc rax
jmp 0x140046510
lea rax, str.admin_appman_appv_sharedclientconfigurationRegistryValue.h
mov rdx, rax
lea rcx, [0x1400b38d0]
call fcn.140015fd4
shl rax, 0x34
movabs rcx, 0x320500040002
jmp 0x1400464d9
mov eax, dword [rsp + 0x58]
cmp eax, 0x4000
jb 0x140046585
mov edx, 0x5c
lea rcx, str.admin_appman_appv_sharedclientconfigurationRegistryValue.h
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x14004655c
inc rax
jmp 0x140046563
lea rax, str.admin_appman_appv_sharedclientconfigurationRegistryValue.h
mov rdx, rax
lea rcx, [0x1400b38d0]
call fcn.140015fd4
shl rax, 0x34
movabs rcx, 0x330500040003
jmp 0x1400464d9
mov dword [rdi], eax
movabs rax, 0x8000000000
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140063e50
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
mov r14, rdx
mov rdi, rcx
mov rdx, rcx
mov rcx, r14
call fcn.1400378d8
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140063e87
mov rcx, qword [rdi]
mov qword [rsp + 0x20], 1
lea r9, [0x14008d16c]
xor r8d, r8d
mov rdx, qword [rdi + 0x10]
call fcn.140042e30
cmp rax, 0xffffffffffffffff
jne 0x140063eb0
mov al, 1
jmp 0x140063f5a
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140063ebd
mov rcx, qword [rdi]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
mov ebp, eax
xor esi, esi
test eax, eax
je 0x140063f5a
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rsi
test eax, eax
je 0x140063f1c
mov rdx, rbp
call fcn.1400039a4
mov rsi, rax
mov qword [rsp + 0x30], rax
lea r8, [rbp*2]
lea rbx, [r8 + rax]
mov qword [rsp + 0x40], rbx
xor edx, edx
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov qword [rsp + 0x38], rbx
cmp qword [rdi + 0x18], 8
jb 0x140063f26
mov rdi, qword [rdi]
mov r8d, ebp
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
cmp ebp, eax
sete bl
jne 0x140063f4e
mov rdx, rsi
mov rcx, r14
call fcn.140003924
nop
lea rcx, [rsp + 0x30]
call fcn.14001f3e4
mov al, bl
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x140065d9c
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rbx, rdx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
xor esi, esi
mov qword [rbp - 0x10], rsi
mov dword [rbp + 0x30], esi
lea r8, [rbp + 0x30]
xor edx, edx
lea ecx, [rsi + 3]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
nop dword [rax + rax]
test eax, eax
je 0x140065de4
lea edi, [rsi + 0xd]
jmp 0x140065e9f
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
cmp eax, 0xea
jne 0x140065e9f
mov word [rbp + 0x20], si
mov edx, dword [rbp + 0x30]
mov r8, qword [rbp - 0x18]
mov rcx, r8
mov rdi, qword [rbp - 0x20]
sub rcx, rdi
sar rcx, 1
cmp rdx, rcx
jae 0x140065e24
lea rax, [rdi + rdx*2]
mov qword [rbp - 0x18], rax
jmp 0x140065e65
jbe 0x140065e65
mov rax, qword [rbp - 0x10]
sub rax, rdi
sar rax, 1
cmp rdx, rax
jbe 0x140065e48
lea r8, [rbp + 0x20]
lea rcx, [rbp - 0x20]
call fcn.1400419b4
mov rdi, qword [rbp - 0x20]
jmp 0x140065e65
sub rdx, rcx
je 0x140065e61
movzx eax, si
mov rdi, r8
mov rcx, rdx
rep stosw word [rdi], ax
lea r8, [r8 + rdx*2]
mov rdi, qword [rbp - 0x20]
mov qword [rbp - 0x18], r8
lea r8, [rbp + 0x30]
mov rdx, rdi
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
nop dword [rax + rax]
test eax, eax
jne 0x140065e91
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
jmp 0x140065e9f
mov rdx, qword [rbp - 0x20]
mov rcx, rbx
call fcn.140003924
mov edi, esi
lea rcx, [rbp - 0x20]
call fcn.14001f3e4
mov eax, edi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x140066900
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400b3380], eax
call fcn.140066da0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400b3380], 0
jne case.default.0x140066956
mov ecx, 1
call fcn.140066da0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
in al, dx
movabs dword [0xb1c1b88639406f3e], eax
invalid
jne 0x14011f7bc
invalid
jp 0x14011f81b
insd dword [rdi], dx
invalid
out 0x2f, eax
jbe 0x14011f7f2
stosb byte [rdi], al
outsd dx, dword [rsi]
and eax, 0x9db94a92
jle 0x14011f8a3
mov ecx, 0x5e1dba3c
sub edx, dword [rsi + rbp*8 - 0x490c1974]
cmp dword [rbp - 0x155f1765], ebx
xchg edx, eax
sbb byte [rsi], dh
invalid
lahf
fdiv qword [rbx - 0x3a98c0ce]
jne 0x14011f869
jl 0x14011f802
movabs dword [0x6ca6f0f10bcd9312], eax
xchg ebx, eax
mov r8d, 0xc0ec7ae8
xlatb
xor ch, byte [rsi - 0x1b0ac94c]
sub dl, byte ss:[rsi]
leave
invalid
insb byte [rdi], dx
add ch, byte [rbp - 0x42]
push 0xffffffff95e41860
adc dword [rcx + 0x76013f77], 0x5f1b92d
jno 0x14011f86b
leave
call 0x196cd5d1c
invalid
Function at 0x1400128a0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov rax, qword [0x1400ee100]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rdx, qword [rsp + 0xd0]
lea rcx, [rsp + 0x60]
call fcn.14000fa90
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
lea r8, [0x1400d9548]
mov rdx, qword [rsp + 0xc8]
lea rcx, [rsp + 0x40]
call fcn.14001d040
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x80]
call fcn.14000c210
nop
lea rcx, [rsp + 0x40]
call fcn.14000a910
nop
lea rcx, [rsp + 0x60]
call fcn.14000a910
lea rcx, [rsp + 0x80]
call fcn.14000a5d0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x80]
call fcn.14000a910
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14004f810
add rsp, 0xb8
ret
Function at 0x140012980
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x198
mov rax, qword [0x1400ee100]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov dword [rsp + 0x2c], 0
mov rax, qword [rsp + 0x1a8]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x48], 0
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x70], 0
mov eax, dword [rsp + 0x28]
mov qword [rsp + 0x50], rax
mov eax, 2
mov rcx, qword [rsp + 0x50]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14004f8a4
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov edx, 0xf8
lea rcx, [rsp + 0x80]
call fcn.140008de0
mov edx, 1
lea rcx, [rsp + 0x80]
call fcn.1400165f0
nop
mov r9, qword [rsp + 0x20]
mov r8d, dword [rsp + 0x28]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x140012b44
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x68]
lea rdx, str...._
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x140012b44
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 0x10]
shr rax, 0x10
and rax, 0xffff
lea rcx, [rsp + 0x90]
movzx edx, ax
call fcn.140016b60
lea rdx, [0x1400d44d8]
mov rcx, rax
call fcn.14001d110
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 0x10]
and rax, 0xffff
lea rcx, [rsp + 0x90]
movzx edx, ax
call fcn.140016b60
lea rdx, [0x1400d44dc]
mov rcx, rax
call fcn.14001d110
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 0x14]
shr rax, 0x10
and rax, 0xffff
lea rcx, [rsp + 0x90]
movzx edx, ax
call fcn.140016b60
lea rdx, [0x1400d44e0]
mov rcx, rax
call fcn.14001d110
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 0x14]
and rax, 0xffff
lea rcx, [rsp + 0x90]
movzx edx, ax
call fcn.140016b60
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
call fcn.14004f870
cmp qword [rsp + 0x40], 0
jne 0x140012b6b
mov qword [rsp + 0x60], 0
jmp 0x140012b7e
mov qword [rsp + 0x20], 0x8123
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x1a0]
lea rcx, [rsp + 0x80]
call fcn.140016510
mov eax, dword [rsp + 0x2c]
or eax, 1
mov dword [rsp + 0x2c], eax
lea rcx, [rsp + 0x80]
call fcn.140012bd0
mov rax, qword [rsp + 0x1a0]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.14004f810
add rsp, 0x198
ret
Function at 0x140014e70
Capabilities:
Write file on windows

Disassembly:
mov word [rsp + 0x10], dx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov rax, qword [0x1400ee100]
xor rax, rsp
mov qword [rsp + 0xa8], rax
call fcn.14001a4f0
mov word [rsp + 0x44], ax
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x44]
call fcn.14001a570
movzx eax, al
test eax, eax
je 0x140014ec8
lea rcx, [rsp + 0xc8]
call fcn.14001a500
jmp 0x140015118
mov rcx, qword [rsp + 0xc0]
call fcn.140019860
test rax, rax
je 0x140014f37
mov rcx, qword [rsp + 0xc0]
call fcn.140019860
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0xc0]
call fcn.140019750
mov rcx, qword [rsp + 0x58]
cmp rcx, rax
jae 0x140014f37
lea rcx, [rsp + 0xc8]
call fcn.140015130
mov word [rsp + 0x46], ax
mov rcx, qword [rsp + 0xc0]
call fcn.140019550
movzx ecx, word [rsp + 0x46]
mov word [rax], cx
movzx eax, word [rsp + 0xc8]
jmp 0x140015118
mov rax, qword [rsp + 0xc0]
cmp qword [rax + 0x80], 0
jne 0x140014f53
call fcn.14001a4f0
jmp 0x140015118
mov rcx, qword [rsp + 0xc0]
call fcn.140018ba0
mov rax, qword [rsp + 0xc0]
cmp qword [rax + 0x68], 0
jne 0x140014fbd
lea rcx, [rsp + 0xc8]
call fcn.140015130
mov rcx, qword [rsp + 0xc0]
mov rdx, qword [rcx + 0x80]
movzx ecx, ax
call fcn.140012800
movzx eax, al
test eax, eax
je 0x140014fa9
movzx eax, word [rsp + 0xc8]
mov word [rsp + 0x40], ax
jmp 0x140014fb3
call fcn.14001a4f0
mov word [rsp + 0x40], ax
movzx eax, word [rsp + 0x40]
jmp 0x140015118
mov qword [rsp + 0x60], 0x20
lea rcx, [rsp + 0xc8]
call fcn.140015130
mov word [rsp + 0x78], ax
lea rax, [rsp + 0xa0]
lea rcx, [rsp + 0x7a]
mov rdx, qword [rsp + 0xc0]
add rdx, 0x74
lea r8, [rsp + 0x68]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, rcx
lea r8, [rsp + 0x78]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rax + 0x68]
call fcn.140011040
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
jl 0x140015113
cmp dword [rsp + 0x48], 1
jle 0x140015056
cmp dword [rsp + 0x48], 3
je 0x1400150d3
jmp 0x140015113
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jbe 0x1400150aa
mov rax, qword [rsp + 0xc0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
lea rcx, [rsp + 0x80]
call fcn.14007e8f8
cmp qword [rsp + 0x50], rax
je 0x1400150aa
call fcn.14001a4f0
jmp 0x140015118
mov rax, qword [rsp + 0xc0]
mov byte [rax + 0x72], 1
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x1400150cc
movzx eax, word [rsp + 0xc8]
jmp 0x140015118
call fcn.14001a4f0
jmp 0x140015118
mov rax, qword [rsp + 0xc0]
mov rdx, qword [rax + 0x80]
movzx ecx, word [rsp + 0x78]
call fcn.140012800
movzx eax, al
test eax, eax
je 0x140015102
movzx eax, word [rsp + 0xc8]
mov word [rsp + 0x42], ax
jmp 0x14001510c
call fcn.14001a4f0
mov word [rsp + 0x42], ax
movzx eax, word [rsp + 0x42]
jmp 0x140015118
call fcn.14001a4f0
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.14004f810
add rsp, 0xb8
ret
Function at 0x140018c50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x1400ee100]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0xa0]
cmp qword [rax + 0x68], 0
je 0x140018c8d
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax + 0x72]
test eax, eax
jne 0x140018c94
mov al, 1
jmp 0x140018ddf
call fcn.14001a4f0
mov rcx, qword [rsp + 0xa0]
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rcx
movzx edx, ax
mov rcx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x48]
call qword [rax + 0x18]
mov word [rsp + 0x30], ax
call fcn.14001a4f0
mov word [rsp + 0x32], ax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x32]
call fcn.14001a570
movzx eax, al
test eax, eax
je 0x140018ce8
xor al, al
jmp 0x140018ddf
mov qword [rsp + 0x50], 0x20
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0xa0]
add rcx, 0x74
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x60]
mov rdx, rcx
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rax + 0x68]
call fcn.1400110b0
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x140018d4d
cmp dword [rsp + 0x34], 1
je 0x140018d59
cmp dword [rsp + 0x34], 3
je 0x140018dcd
jmp 0x140018ddd
mov rax, qword [rsp + 0xa0]
mov byte [rax + 0x72], 0
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jbe 0x140018da4
mov rax, qword [rsp + 0xa0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x40]
mov edx, 1
lea rcx, [rsp + 0x60]
call fcn.14007e8f8
cmp qword [rsp + 0x40], rax
je 0x140018da4
xor al, al
jmp 0x140018ddf
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax + 0x72]
test eax, eax
jne 0x140018dbe
mov dword [rsp + 0x38], 1
jmp 0x140018dc6
mov dword [rsp + 0x38], 0
movzx eax, byte [rsp + 0x38]
jmp 0x140018ddf
mov rax, qword [rsp + 0xa0]
mov byte [rax + 0x72], 0
mov al, 1
jmp 0x140018ddf
xor al, al
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14004f810
add rsp, 0x98
ret
Function at 0x14002e560
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x1400ee100]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov edx, 8
lea rcx, [rsp + 0x60]
call fcn.140008de0
mov rcx, qword [rsp + 0x98]
call fcn.140008510
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x90]
call fcn.140008510
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x88]
call fcn.140008510
mov rcx, qword [rsp + 0x30]
mov r9, rcx
mov rcx, qword [rsp + 0x38]
mov r8, rcx
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14002f980
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14002fa60
nop
lea rcx, [rsp + 0x48]
call fcn.14002eea0
lea rax, [0x14002fab0]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x80]
add rax, 8
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x60]
call fcn.140009cb0
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x58]
xor edx, edx
xor ecx, ecx
call fcn.14007f264
mov rcx, qword [rsp + 0x80]
mov qword [rcx], rax
mov rax, qword [rsp + 0x80]
cmp qword [rax], 0
je 0x14002e672
lea rcx, [rsp + 0x60]
call fcn.14001ef70
jmp 0x14002e68c
mov rax, qword [rsp + 0x80]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.14004d23c
nop
lea rcx, [rsp + 0x60]
call fcn.14002eea0
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14004f810
add rsp, 0x78
ret

Function at 0x14002e820
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1400ee100]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov edx, 8
lea rcx, [rsp + 0x50]
call fcn.140008de0
mov rcx, qword [rsp + 0x78]
call fcn.140008510
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.14002fcf0
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14002fa60
nop
lea rcx, [rsp + 0x38]
call fcn.14002ee30
lea rax, [0x14002fd90]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
add rax, 8
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
call fcn.140009cb0
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call fcn.14007f264
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x14002e8e8
lea rcx, [rsp + 0x50]
call fcn.14001ef70
jmp 0x14002e8ff
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.14004d23c
nop
lea rcx, [rsp + 0x50]
call fcn.14002ee30
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14004f810
add rsp, 0x68
ret
Function at 0x1400434c0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x170
mov rax, qword [0x1400ee100]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
lea rdx, [rsp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [rsp + 0x24], eax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.14000aa20
nop
mov rdx, qword [rsp + 0x188]
lea rcx, [rsp + 0x28]
call fcn.14000a850
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x180]
call fcn.14000a9a0
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x28]
call fcn.14000a910
mov rax, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14004f810
add rsp, 0x170
pop rdi
ret
Function at 0x140052efc
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140052f0f
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.140053510
lea rdx, [0x1400ea310]
lea rcx, [rsp + 0x20]
call fcn.14006e288
int3

Function at 0x14005d6a0
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1400f3b98]
xor edx, edx
jmp fcn.140052efc

Function at 0x14005e018
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1400f3b98]
jmp fcn.140052efc

Function at 0x1400697e4
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x1400698a0]
mov r9, qword [r9 + 8]
jmp fcn.14005b0b8

Function at 0x140069878
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x1400698b0]
mov r9, qword [r9 + 8]
jmp fcn.14005b0b8

Function at 0x140083acc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400838f8
Function at 0x140089800
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x140089526
call fcn.14007f4d4
mov dword [rax], 0x16
call fcn.14007d164
jmp 0x140089671
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140089671
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x140089671
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x140089555
lock or dword [rcx + 0x14], 0x10
jmp 0x140089671
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x140089569
call fcn.14008908c
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x140089579
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x14008957c
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.140087768
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.14008bfbc
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x14008965f
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x14008960d
mov rcx, rbx
call fcn.140087768
cmp eax, 0xffffffff
je 0x1400895f8
mov rcx, rbx
call fcn.140087768
cmp eax, 0xfffffffe
je 0x1400895f8
mov rcx, rbx
call fcn.140087768
movsxd rdi, eax
lea r14, [0x1400f4370]
mov rcx, rbx
sar rdi, 6
call fcn.140087768
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x1400895ff
lea rdx, [0x1400ee550]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14008960d
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x140089631
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x140089631
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x140089631
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x14008964f
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x14008965a
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x140089676
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x1400894f0