joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003110
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r11d, r8d
mov r10, rdx
mov r9d, ecx
test rdx, rdx
jne 0x140003129
xor eax, eax
add rsp, 8
ret
mov qword [rsp], rdi
not r9d
lea rdi, [0x14001e9c0]
cmp r11d, 8
jb 0x140003221
mov qword [rsp + 0x10], rbx
mov rbx, r11
shr rbx, 3
nop dword [rax]
movzx ecx, byte [r10]
mov eax, r9d
shr r9d, 8
xor rcx, rax
add r10, 8
add r11d, 0xfffffff8
movzx eax, cl
movzx ecx, byte [r10 - 7]
mov edx, dword [rdi + rax*4]
xor edx, r9d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 6]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 5]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 4]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 3]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 2]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 1]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov r9d, dword [rdi + rax*4]
xor r9d, edx
dec rbx
jne 0x140003150
mov rbx, qword [rsp + 0x10]
test r11d, r11d
je 0x14000324f
nop word [rax + rax]
movzx ecx, byte [r10]
mov eax, r9d
inc r10
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
dec r11d
jne 0x140003230
mov rdi, qword [rsp]
not r9d
mov eax, r9d
add rsp, 8
ret

Function at 0x140003a40
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, r8
mov rdi, r9
mov rbp, rdx
mov r10, rcx
imul esi, edx
cmp byte [r9], 0
je 0x140003a90
mov rdx, rcx
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x48]
mov r8d, esi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140003a8a
mov byte [rdi + 0x10], 1
mov eax, dword [rsp + 0x48]
jmp 0x140003ac1
mov edx, dword [r9 + 0x24]
mov ecx, dword [r9 + 0x20]
mov qword [rsp + 0x40], rbx
lea eax, [rdx + rsi]
cmp eax, ecx
jbe 0x140003aa8
sub ecx, edx
mov esi, ecx
add rdx, qword [r9 + 0x18]
mov r8d, esi
mov rcx, r10
call fcn.14000ec20
add dword [rdi + 0x24], esi
mov rbx, qword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x58]
xor edx, edx
div rbp
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140003ae0
Capabilities:
Read file on windows

Disassembly:
push rbx
push r12
sub rsp, 0x38
cmp byte [rcx], 0
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x30], rdi
mov edi, 1
mov r12, rdx
mov rbx, rcx
je 0x140003b30
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x60]
lea rdx, [rsp + 0x50]
mov r8d, edi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140003b2a
mov byte [rbx + 0x10], dil
mov esi, dword [rsp + 0x60]
jmp 0x140003b6a
mov qword [rsp + 0x58], rbp
mov ebp, dword [rcx + 0x24]
mov ecx, dword [rcx + 0x20]
lea eax, [rbp + 1]
cmp eax, ecx
jbe 0x140003b46
mov edi, ecx
sub edi, ebp
mov rdx, rbp
lea rcx, [rsp + 0x50]
mov r8d, edi
add rdx, qword [rbx + 0x18]
mov esi, edi
call fcn.14000ec20
lea r11d, [rbp + rdi]
mov rbp, qword [rsp + 0x58]
mov dword [rbx + 0x24], r11d
mov rdi, qword [rsp + 0x30]
cmp esi, 1
mov rsi, qword [rsp + 0x68]
jne 0x140003b8c
movzx eax, byte [rsp + 0x50]
mov dword [r12], eax
xor eax, eax
add rsp, 0x38
pop r12
pop rbx
ret
cmp byte [rbx], 0
je 0x140003b82
cmp byte [rbx + 0x10], 0
je 0x140003b82
or eax, 0xffffffff
add rsp, 0x38
pop r12
pop rbx
ret
Function at 0x140003c70
Capabilities:
Read file on windows

Disassembly:
push rsi
sub rsp, 0x70
cmp byte [rcx], 0
mov rsi, rcx
je 0x140003ca3
cmp byte [rcx + 1], 0
je 0x140003c9b
mov rcx, qword [rcx + 8]
mov r9d, 2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x140003ca9
xor eax, eax
add rsp, 0x70
pop rsi
ret
mov eax, dword [rcx + 0x20]
mov dword [rcx + 0x24], eax
cmp byte [rsi], 0
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x58], rdi
je 0x140003ce3
cmp byte [rsi + 1], 0
je 0x140003cdf
mov rcx, qword [rsi + 8]
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, eax
sub ebp, dword [rsi + 0x14]
jmp 0x140003ce6
xor ebp, ebp
jmp 0x140003ce6
mov ebp, dword [rsi + 0x24]
mov ebx, 0xffff
mov ecx, 0x404
mov dword [rsp + 0x88], ebp
cmp ebp, ebx
cmovb ebx, ebp
mov dword [rsp + 0x98], ebx
call fcn.140007c50
mov rdi, rax
test rax, rax
je 0x140003ea9
mov qword [rsp + 0x48], r13
xor r13d, r13d
mov qword [rsp + 0x38], r15
mov r15d, 4
mov dword [rsp + 0x80], r13d
cmp ebx, r15d
jbe 0x140003e94
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x40], r14
nop word [rax + rax]
lea eax, [r15 + 0x400]
mov r14d, ebp
mov r12d, ebp
cmp eax, ebx
mov r15d, eax
mov eax, 0x404
cmova r15d, ebx
sub r14d, r15d
sub r12d, r14d
cmp r12d, eax
cmova r12d, eax
cmp byte [rsi], 0
je 0x140003da0
cmp byte [rsi + 1], 0
je 0x140003e8a
mov eax, dword [rsi + 0x14]
mov rcx, qword [rsi + 8]
xor r9d, r9d
lea edx, [r14 + rax]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x140003da4
mov dword [rsi + 0x24], r14d
cmp byte [rsi], 0
mov ebp, r12d
mov r13d, r12d
je 0x140003de1
mov rcx, qword [rsi + 8]
lea r9, [rsp + 0x90]
mov r8d, ebp
mov rdx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140003dd8
mov byte [rsi + 0x10], 1
mov eax, dword [rsp + 0x90]
jmp 0x140003e15
mov ecx, dword [rsi + 0x24]
mov edx, dword [rsi + 0x20]
lea eax, [rcx + r12]
cmp eax, edx
jbe 0x140003df5
mov r13d, edx
sub r13d, ecx
mov rdx, rcx
mov r8d, r13d
mov rcx, rdi
add rdx, qword [rsi + 0x18]
call fcn.14000ec20
add dword [rsi + 0x24], r13d
mov ebx, dword [rsp + 0x98]
mov eax, r13d
xor edx, edx
div rbp
cmp rax, 1
jne 0x140003e82
lea ecx, [r12 - 3]
movsxd rax, ecx
test ecx, ecx
jle 0x140003e55
nop dword [rax]
dec rax
dec ecx
cmp byte [rax + rdi], 0x50
jne 0x140003e50
cmp byte [rax + rdi + 1], 0x4b
jne 0x140003e50
cmp byte [rax + rdi + 2], 5
jne 0x140003e50
cmp byte [rax + rdi + 3], 6
je 0x140003e6f
test rax, rax
jg 0x140003e30
mov r13d, dword [rsp + 0x80]
mov ebp, dword [rsp + 0x88]
cmp r15d, ebx
jb 0x140003d50
jmp 0x140003e8a
lea r13d, [rcx + r14]
mov dword [rsp + 0x80], r13d
test r13d, r13d
jne 0x140003e8a
jmp 0x140003e5d
mov r13d, dword [rsp + 0x80]
mov r12, qword [rsp + 0x50]
mov r14, qword [rsp + 0x40]
mov rcx, rdi
call fcn.1400078d0
mov r15, qword [rsp + 0x38]
mov eax, r13d
mov r13, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x58]
add rsp, 0x70
pop rsi
ret
Function at 0x140004de0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x20
cmp qword [rcx], 0
mov esi, r8d
mov rbp, rdx
mov rbx, rcx
jne 0x140004e77
cmp dword [rcx + 8], 0xffffffff
jne 0x140004e77
mov qword [rsp + 0x38], rdi
lea rdi, [rcx + 0x13c]
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov eax, dword [0x14001efe0]
mov dword [rdi - 2], eax
xor edi, edi
lea ecx, [rdi + 0x28]
mov qword [rsp + 0x30], rdi
call fcn.140007efc
mov rcx, rax
mov word [rax], 0x100
mov qword [rax + 0x18], rbp
mov dword [rax + 0x20], esi
mov dword [rax + 0x24], edi
mov dword [rax + 0x14], edi
call fcn.140003ec0
mov rdi, qword [rsp + 0x38]
mov qword [rbx], rax
mov eax, dword [0x14003aa70]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov eax, 0x1000000
add rsp, 0x20
pop rsi
ret

Function at 0x140005990
Capabilities:
Acquire debug privileges

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140022050]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rcx, str.FPUIw99PlU19poPvv
mov qword [rsp + 0x30], 0
call fcn.1400011b0
call rax
lea rcx, str.bXPl19poPvvCpRPl
mov rbx, rax
call fcn.1400011b0
lea r8, [rsp + 0x30]
mov edx, 0x20
mov rcx, rbx
call rax
test eax, eax
je 0x140005a3d
lea rcx, str.MppRwX19T2THPdPk_HwPO
call fcn.1400011b0
lea r8, [rsp + 0x3c]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call rax
test eax, eax
je 0x140005a3d
lea rcx, str.cnewvUCpRPl19T2THPdPv
mov dword [rsp + 0x44], 2
mov dword [rsp + 0x38], 1
call fcn.1400011b0
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rax
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x140005a60
cmp rax, 0xffffffffffffffff
je 0x140005a60
lea rcx, str.IHpvPE_lnHP
call fcn.1400011b0
mov rcx, qword [rsp + 0x30]
call rax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400076b0
add rsp, 0x50
pop rbx
ret
Function at 0x140006a10
Capabilities:
Create process on windows

Disassembly:
push rdi
sub rsp, 0xc70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xc80], rsi
mov rax, qword [0x140022050]
xor rax, rsp
mov qword [rsp + 0xc60], rax
mov byte [rsp + 0x860], 0
xor edx, edx
mov r8d, 0x3ff
lea rcx, [rsp + 0x861]
call fcn.14000a4a0
mov byte [rsp + 0x460], 0
xor edx, edx
mov r8d, 0x3ff
lea rcx, [rsp + 0x461]
call fcn.14000a4a0
lea rcx, str.SvnUo2U9P.j_U
call fcn.140007910
mov r9, rax
lea rsi, str.zcgXlSWkj314CwaYLvyh0U_odZH8OReKiNIr_JM2G7QAxpnmEVbqP5TuB9Ds6fFt
test rax, rax
je 0x140006acd
cmp byte [rax], 0
je 0x140006acd
mov rdx, rax
nop dword [rax]
xor eax, eax
movzx edi, byte [rdx]
mov rcx, rsi
cmp dil, byte [rcx]
je 0x140006ab9
inc eax
inc rcx
cmp eax, 0x40
jb 0x140006aa8
jmp 0x140006ac5
add eax, 0xffffffea
and eax, 0x3f
movzx eax, byte [rax + rsi]
mov byte [rdx], al
inc rdx
cmp byte [rdx], 0
jne 0x140006aa0
mov qword [rsp + 0x250], r9
mov edx, 0x104
lea rcx, [rsp + 0x258]
test r9, r9
je 0x140006af5
lea r8, [0x14001d52c]
call fcn.140001350
jmp 0x140006b02
lea r8, [0x14001d534]
call fcn.140001350
nop
lea rcx, str.:Mi_r_nnPH__0___v__r_nTh_PgTvU___v__dpUp_Mi_r_nnPH__0___v__r_n
call fcn.140007910
mov r9, rax
test rax, rax
je 0x140006b4d
cmp byte [rax], 0
je 0x140006b4d
mov rdx, rax
nop
xor eax, eax
movzx edi, byte [rdx]
mov rcx, rsi
cmp dil, byte [rcx]
je 0x140006b39
inc eax
inc rcx
cmp eax, 0x40
jb 0x140006b28
jmp 0x140006b45
add eax, 0xffffffea
and eax, 0x3f
movzx eax, byte [rax + rsi]
mov byte [rdx], al
inc rdx
cmp byte [rdx], 0
jne 0x140006b20
mov qword [rsp + 0x40], r9
mov edx, 0x104
lea rcx, [rsp + 0x48]
test r9, r9
je 0x140006b6f
lea r8, [0x14001d52c]
call fcn.140001350
jmp 0x140006b7c
lea r8, [0x14001d534]
call fcn.140001350
nop
lea rcx, str.FPU6pnwHP0THPu_SPc
call fcn.1400011b0
mov r8d, 0x400
lea rdx, [rsp + 0x860]
xor ecx, ecx
call rax
lea rcx, str.FPUCPSX1_U7c
call fcn.1400011b0
lea rdx, [rsp + 0x460]
mov ecx, 0x400
call rax
lea rsi, [0x14001d528]
mov rdx, rsi
mov rax, qword [rsp + 0x250]
test rax, rax
cmovne rdx, rax
lea rdi, [rsp + 0x460]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x140006be0
lea rdx, [0x14001f138]
lea rcx, [rsp + 0x460]
call fcn.1400084d4
mov rdi, rax
test rax, rax
je 0x140006c73
mov rcx, qword [rsp + 0x40]
test rcx, rcx
cmovne rsi, rcx
lea rax, [rsp + 0x460]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x860]
lea r8, [rsp + 0x860]
mov rdx, rsi
mov rcx, rdi
call fcn.1400084e0
mov rcx, rdi
call fcn.140008ab8
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x460]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140006c82
call fcn.1400078d0
mov qword [rsp + 0x40], 0
mov rcx, qword [rsp + 0x250]
test rcx, rcx
je 0x140006c9d
call fcn.1400078d0
mov rcx, qword [rsp + 0xc60]
xor rcx, rsp
call fcn.1400076b0
mov rsi, qword [rsp + 0xc80]
add rsp, 0xc70
pop rdi
ret

Function at 0x1400089b4
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140008824
Function at 0x140008d77
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140022050]
jne 0x1400076ca
rol rcx, 0x10
test cx, 0xffff
jne 0x1400076c6
repz ret
ror rcx, 0x10
jmp 0x140008cd0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400399d0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140039ac8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140008d55
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400399d0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140008d77
mov rax, qword [rsp + 0x88]
mov qword [0x140039ac8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140039a68], rax
mov rax, qword [0x140039ac8]
mov qword [0x140039940], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140039a50], rax
mov dword [0x140039930], 0xc0000409
mov dword [0x140039934], 1
mov rax, qword [0x140022050]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140022058]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1400399c8], eax
mov ecx, 1
call fcn.14000e63c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140019330]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400399c8], 0
jne 0x140008dfe
mov ecx, 1
call fcn.14000e63c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1400106b0
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140022050]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.1400099e0
xor ebx, ebx
cmp qword [0x14003a9c0], rbx
mov rdi, rax
jne 0x1400107c3
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14001089a
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001089a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14003a9c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14003a9c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14003a9d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14003a9e0], rax
test rax, rax
je 0x1400107ba
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14003a9d8], rax
jmp 0x1400107ca
mov rax, qword [0x14003a9d8]
jmp 0x1400107d1
mov rax, qword [0x14003a9d8]
mov r11, qword [0x14003a9e0]
cmp rax, rdi
je 0x140010838
cmp r11, rdi
je 0x140010838
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14003a9e0]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140010838
test rax, rax
je 0x140010838
call rsi
test rax, rax
je 0x140010832
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140010832
test byte [rsp + 0x40], 1
jne 0x140010838
bts ebp, 0x15
jmp 0x140010878
mov rcx, qword [0x14003a9c8]
cmp rcx, rdi
je 0x140010878
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140010878
call rax
mov rbx, rax
test rax, rax
je 0x140010878
mov rcx, qword [0x14003a9d0]
cmp rcx, rdi
je 0x140010878
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140010878
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14003a9c0]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14001089a
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x14001089c
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400076b0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800019b4
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x168]
sub rsp, 0x240
xor r12d, r12d
mov r15d, r8d
xor eax, eax
mov rbx, rdx
mov rsi, rcx
lock cmpxchg qword [rcx], r12
je 0x180001a1b
or rdi, 0xffffffffffffffff
cmp rax, rdi
jne 0x1800019fa
xor eax, eax
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
or rdi, 0xffffffffffffffff
mov qword [rbp + 0x188], r12
test r15b, 1
je 0x180001a3a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
jmp 0x180001b7f
bt qword [0x180004278], 0
lea rdx, str.LoadLibraryExW
lea rcx, [0x180006058]
call fcn.1800018e8
mov r14, rax
test rax, rax
je 0x1800019f8
mov r13d, 2
test r13b, r15b
je 0x180001a71
mov r8d, r13d
jmp 0x180001b77
test r15b, 4
je 0x180001a7f
xor r8d, r8d
jmp 0x180001b77
bt qword [0x180004260], 0
lea rdx, str.AddDllDirectory
lea rcx, [0x180006040]
call fcn.1800018e8
test rax, rax
jne 0x180001b71
bt qword [0x180004258], 0
lea rdx, str.LdrLoadDll
lea rcx, [0x180006038]
call fcn.1800018e8
mov r15, rax
test rax, rax
je 0x1800019f8
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call sub.msvcrt.dll_memset
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x102
ja 0x180001a77
mov rdx, rdi
mov rax, rbx
mov rcx, r12
test rbx, rbx
je 0x180001b17
cmp word [rax], r12w
je 0x180001b17
inc rcx
add rax, r13
sub rdx, 1
jne 0x180001b05
add rcx, rcx
mov qword [rsp + 0x28], rbx
movzx eax, cx
lea r9, [rbp + 0x188]
mov edx, 0xffff
lea r8, [rsp + 0x20]
cmp rcx, rdx
cmova ax, dx
mov word [rsp + 0x20], ax
lea rax, [rcx + 2]
add cx, r13w
cmp rax, rdx
cmova cx, dx
xor edx, edx
mov word [rsp + 0x22], cx
lea rcx, [rsp + 0x30]
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
call r15
mov rax, qword [rbp + 0x188]
jmp 0x180001b86
mov r8d, 0x800
xor edx, edx
mov rcx, rbx
call r14
mov qword [rbp + 0x188], rax
test rax, rax
jne 0x180001b93
xchg qword [rsi], rdi
jmp 0x1800019f8
xchg qword [rsi], rax
test rax, rax
je 0x180001ba8
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [rbp + 0x188]
jmp 0x1800019fa
Function at 0x14006c5a0
Capabilities:
Terminate process

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x40
cmp qword [0x1401b9960], 0
jne 0x14006c5cc
mov eax, 0x970004
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x68
call fcn.140126628
mov rbx, rax
mov qword [rsp + 0x20], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rax, vtable.std::_Ref_count_obj2_class_ns_aom::AOMTask_.0
mov qword [rbx], rax
lea rdi, [rbx + 0x10]
mov qword [rsp + 0x28], rdi
lea rax, vtable.ns_aom::AOMTask.0
mov qword [rdi], rax
lea rsi, [rdi + 8]
mov qword [rsp + 0x30], rsi
mov qword [rsi + 0x38], 0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x38]
test rcx, rcx
je 0x14006c641
mov rax, qword [rcx]
mov rdx, rsi
mov rax, qword [rax]
call qword [case.0x14008f836.32]
mov qword [rsi + 0x38], rax
lea rax, vtable.ns_aom::AOMSimpleEvent.0
mov qword [rdi + 0x48], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rdi + 0x50], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rbx
mov r8d, dword [rsp + 0x70]
lea rdx, [rsp + 0x30]
call fcn.140076740
mov esi, eax
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x14006c6c6
mov edi, 0xffffffff
mov ecx, edi
lock xadd dword [rdx + 8], ecx
cmp ecx, 1
jne 0x14006c6c6
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rcx, rbx
call qword [case.0x14008f836.32]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x14006c6c6
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14008f836.32]
cmp si, 0x1b
jne 0x14006c6fa
lea rdx, str.ERRTimeOut
mov ecx, dword [rsp + 0x68]
call fcn.1400685f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, 0x9d0008
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
mov eax, esi
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x140074750
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [0x1401b2190]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x50]
mov ecx, 1
mov r9d, dword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
mov r10, qword [rdx]
cmp r9d, ecx
jl 0x140074917
test r10, r10
setne al
mov byte [r8], al
inc r8
test r10, r10
je 0x1400747d1
lea eax, [r9 - 1]
cmp eax, 0xd
jl 0x140074917
mov rcx, qword [rdx]
mov eax, dword [rcx + 8]
mov dword [r8], eax
movzx eax, byte [rcx + 0x20]
mov byte [r8 + 4], al
mov rax, qword [rcx + 0x28]
mov ecx, 0xe
mov qword [r8 + 5], rax
add r8, 0xd
lea r11d, [rcx + 0x98]
cmp r9d, r11d
jl 0x140074917
mov eax, dword [rdx + 8]
mov dword [r8], eax
test r10, r10
je 0x140074861
mov rcx, qword [rdx + 0x10]
movabs r9, 0x8000000000000000
test rcx, rcx
je 0x14007480b
mov rax, qword [rdx]
sub rcx, qword [rax]
mov qword [rsp], rcx
jmp 0x14007480f
mov qword [rsp], r9
mov rcx, qword [rdx + 0x18]
test rcx, rcx
je 0x140074820
mov rax, qword [rdx]
sub rcx, qword [rax]
jmp 0x140074823
mov rcx, r9
mov qword [rsp + 8], rcx
mov rcx, qword [rdx + 0x20]
test rcx, rcx
je 0x140074839
mov rax, qword [rdx]
sub rcx, qword [rax]
jmp 0x14007483c
mov rcx, r9
mov qword [rsp + 0x10], rcx
mov rcx, qword [rdx + 0x28]
test rcx, rcx
je 0x140074857
mov rax, qword [rdx]
sub rcx, qword [rax]
mov qword [rsp + 0x18], rcx
jmp 0x140074884
mov rcx, r9
mov qword [rsp + 0x18], rcx
jmp 0x140074884
mov rax, qword [rdx + 0x10]
mov qword [rsp], rax
mov rax, qword [rdx + 0x18]
mov qword [rsp + 8], rax
mov rax, qword [rdx + 0x20]
mov qword [rsp + 0x10], rax
mov rax, qword [rdx + 0x28]
mov qword [rsp + 0x18], rax
movups xmm0, xmmword [rsp]
movups xmm1, xmmword [rsp + 0x10]
movups xmmword [r8 + 4], xmm0
movups xmmword [r8 + 0x14], xmm1
movups xmm0, xmmword [rdx + 0x30]
movups xmmword [r8 + 0x24], xmm0
mov eax, dword [rdx + 0x40]
mov dword [r8 + 0x34], eax
mov eax, dword [rdx + 0x44]
mov dword [r8 + 0x38], eax
mov eax, dword [rdx + 0x48]
mov dword [r8 + 0x3c], eax
mov eax, dword [rdx + 0x4c]
mov dword [r8 + 0x40], eax
mov eax, dword [rdx + 0x50]
mov dword [r8 + 0x44], eax
mov eax, dword [rdx + 0x54]
mov dword [r8 + 0x48], eax
mov eax, dword [rdx + 0x58]
mov dword [r8 + 0x4c], eax
mov eax, dword [rdx + 0x5c]
mov dword [r8 + 0x50], eax
mov eax, dword [rdx + 0x60]
mov dword [r8 + 0x54], eax
mov eax, r11d
mov ecx, dword [rdx + 0x64]
mov dword [r8 + 0x58], ecx
movups xmm0, xmmword [rdx + 0x68]
movups xmmword [r8 + 0x5c], xmm0
movups xmm0, xmmword [rdx + 0x78]
movups xmmword [r8 + 0x6c], xmm0
mov ecx, dword [rdx + 0x88]
mov dword [r8 + 0x7c], ecx
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.140126360
add rsp, 0x38
ret
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.140126360
add rsp, 0x38
ret