joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005bb10
Capabilities:
Get disk information

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x1400da318]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, r9
mov rbp, r8
movzx ebx, dx
xor edi, edi
call qword [sym.imp.msvcrt.dll_towupper]
nop dword [rax + rax]
movzx ecx, bx
movzx r14d, ax
call qword [sym.imp.msvcrt.dll_towupper]
nop dword [rax + rax]
cmp r14w, ax
jne 0x14005bb75
mov r8, rbp
mov edx, 0x104
mov rcx, rsi
call fcn.14000c1ec
jmp 0x14005bc12
movabs rax, 0x5c003a0020
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
mov r8d, 0x104
mov word [rsp + 0x20], r14w
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumeNameForVolumeMountPointW]
nop dword [rax + rax]
test eax, eax
jne 0x14005bbc9
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jle 0x14005bbc5
movzx edi, ax
or edi, 0x80070000
test edi, edi
js 0x14005bc14
mov edx, 0x7b
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
mov rbx, rax
mov eax, 0x8000ffff
test rbx, rbx
cmove edi, eax
test edi, edi
js 0x14005bc14
mov r8, rbp
mov edx, 0x104
mov rcx, rsi
call fcn.14000c1ec
mov edi, eax
test eax, eax
js 0x14005bc14
mov r8, rbx
mov rcx, rsi
call fcn.14005bc3c
mov edi, eax
mov eax, edi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140029fb0
add rsp, 0x250
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14005dbac
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1400da318]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r9d, 0x20
lea r8, [rsp + 0x20]
mov edi, 0x404
mov ebx, 0xc04
mov ecx, edi
lea edx, [r9 - 0x18]
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoW]
nop dword [rax + rax]
test eax, eax
je 0x14005dc0e
mov r8d, 3
lea rdx, [0x1400b59a0]
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll_wcsncmp
test eax, eax
je 0x14005dc0e
movzx ebx, di
movzx eax, bx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140029fb0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x140bd7842
Capabilities:
Encode data using xor

Disassembly:
pop rbx
mov qword [rsp], rbx
mov ebx, 0x671f310d
not bl
push rdi
dec ebx
movsx edi, bl
neg dil
lea rbx, [0x140bdeec0]
mov edi, 0x92cf12b
and di, di
movzx edi, byte [rcx + rdi - 0x92cf12b]
push 0xffffffffb29d449a
xor edi, r10d
and edi, 0xff
mov edi, dword [rbx + rdi*4]
shr r10d, 8
push 0x7aa2c8b6
xor r10d, edi
inc rcx
xor r10d, 0xa3045e93
dec rdx
lea rsp, [rsp + 0x10]
jne 0x140bd785d
mov ebx, 0x9425cf0a
pop rdi
jmp 0x140ba8575
Function at 0x18000c330
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
movzx ebx, byte [rsp + 0x50]
lea ebp, [rcx + 4]
mov r14, r8
mov rsi, rdx
mov edi, ecx
cmp ecx, ebp
jae 0x18000c376
xor r15d, r15d
nop
mov eax, edi
sub eax, 4
je 0x18000c3d8
sub eax, 4
je 0x18000c3b0
sub eax, 1
je 0x18000c392
cmp eax, 1
jne 0x18000c3eb
movzx eax, bl
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
lea r8, [rsp + 0x50]
mov dword [rsp + 0x50], 1
mov edx, 0xa8
mov rcx, rsi
call fcn.18000af70
mov bl, 1
jmp 0x18000c3eb
mov qword [rsp + 0x28], r15
lea r8, [0x18000a5b0]
mov r9, rsi
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi], rax
test rax, rax
jne 0x18000c3eb
jmp 0x18000c379
mov r9d, 0x2d
mov r8, rsi
xor edx, edx
mov rcx, r14
call fcn.18000df10
inc edi
cmp edi, ebp
jb 0x18000c360
jmp 0x18000c376
Function at 0x180019930
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x1800529c8]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, qword [rsp + 0x30]
lea esi, [r9 - 4]
mov edi, r9d
mov rbp, r8
cmp r9d, esi
jbe 0x180019a12
mov eax, edi
sub eax, 0x26
je 0x1800199d3
sub eax, 2
je 0x180019a12
sub eax, 1
je 0x1800199bb
cmp eax, 1
jne 0x180019a08
mov r9d, StrCmpNCA
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
call fcn.180007390
test rax, rax
je 0x180019a3e
lea r8, [rsp + 0x40]
mov edx, 0x11b
mov rcx, rax
call fcn.180011a10
jmp 0x180019a08
xor r9d, r9d
lea rcx, [rsp + 0x40]
xor edx, edx
lea r8d, [r9 + 0x2a]
call fcn.180004590
mov rbx, rax
jmp 0x180019a08
xor r8d, r8d
xor edx, edx
mov ecx, 0xc0
call fcn.180023340
xor r9d, r9d
mov dword [rsp + 0x20], 0x4f
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.18001ec00
mov r8, rax
mov edx, 0x21
xor ecx, ecx
call fcn.180038470
dec edi
cmp edi, esi
ja 0x180019971
mov rax, rbx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18003bee0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.CreateDynamicTypeManagerProxy_failed:__1
call fcn.18003b800
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x18001f820
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
lea esi, [rdx - 4]
mov edi, edx
mov rbx, rcx
cmp edx, esi
jbe 0x18001f8bc
mov rbp, qword [rsp + 0x50]
mov eax, edi
sub eax, 0x2e
je 0x18001f8bc
sub eax, 1
je 0x18001f890
sub eax, 3
je 0x18001f8ce
cmp eax, 1
jne 0x18001f8b6
lea r8d, [rax + 0x5b]
mov dword [rsp + 0x48], 0x18
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x50], 6
lea rcx, [rsp + 0x50]
call fcn.180015230
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov qword [rbp + 0x10], rax
jmp 0x18001f8b6
movsx ecx, byte [rbx]
mov eax, 0x1505
test ecx, ecx
je 0x18001f8af
nop dword [rax]
imul eax, eax, 0x21
inc rbx
add eax, ecx
movsx ecx, byte [rbx]
test ecx, ecx
jne 0x18001f8a0
inc rbx
mov dword [rsp + 0x58], eax
dec edi
cmp edi, esi
ja 0x18001f841
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov rbx, qword [rsp + 0x40]
mov rax, rbp
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800250f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
lea r15d, [r9 + 0x546]
mov edi, r9d
mov r13, r8
mov rbx, rcx
cmp r9d, r15d
jae 0x18002518d
mov r12d, dword [rsp + 0x88]
lea rcx, [0x1800333b0]
mov esi, dword [rsp + 0x88]
mov ebp, dword [rsp + 0x88]
mov r14d, dword [rsp + 0x88]
nop word [rax + rax]
cmp edi, 0x145
ja 0x1800252d4
je 0x180025280
mov eax, edi
sub eax, 0x13
je 0x18002524c
sub eax, 0x24
je 0x180025243
sub eax, 0x69
je 0x180025211
sub eax, 0x1e
je 0x1800251b4
cmp eax, 0x69
jne 0x180025381
mov eax, dword [rsp + 0x88]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r12d, dword [rbx + 0x3c]
lea r9, [0x180044940]
mov r8d, GetAcceptLanguagesA
mov rdx, rbx
xor ecx, ecx
call fcn.180034e40
test eax, eax
jne 0x1800251e1
mov edi, 0x2da
mov dword [rbx + 0xc], r14d
jmp 0x18002537a
mov eax, dword [rbx + 0x28]
lea r9, [rsp + 0x30]
mov dword [rsp + 0x38], eax
lea r8, [rsp + 0x38]
mov eax, dword [rbx + 0x24]
mov edx, 0x3e
mov rcx, rbx
mov dword [rsp + 0x30], eax
call fcn.180017190
mov eax, dword [rbx + 0xc]
mov dword [rbx + 0x24], eax
jmp 0x18002537a
mov r8, rbx
mov edx, 0x9c
xor ecx, ecx
call fcn.180025c90
mov dword [rsp + 0x88], eax
movss xmm0, dword [rsp + 0x88]
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movss dword [rsp + 0x88], xmm0
jmp 0x18002537a
mov r14d, dword [rbx + 0xc]
jmp 0x180025381
xor r9d, r9d
mov qword [rsp + 0x20], 0
mov rdx, r13
xor ecx, ecx
lea r8d, [r9 + 0x1d]
call fcn.18002fbd0
mov r8, rax
mov edx, 0x21
xor ecx, ecx
call fcn.180038470
jmp 0x18002537a
mov ecx, 0x112
cmp ecx, 0x114
jae 0x1800252ca
mov eax, ecx
sub eax, 0x112
je 0x18002529f
cmp eax, 1
je 0x1800252bb
inc ecx
jmp 0x180025285
mov esi, dword [rbx + 0xc]
mov r9d, 0x112
mov ebp, dword [rbx + 0x3c]
mov r8, rbx
xor edx, edx
xor ecx, ecx
call fcn.18003b5e0
test eax, eax
jne 0x180025280
mov ecx, 0x113
mov dword [rbx + 0xc], esi
inc ecx
mov dword [rbx + 0x3c], ebp
jmp 0x180025285
mov edi, 0x145
jmp 0x18002537a
cmp edi, 0x1cc
je 0x18002534f
cmp edi, 0x253
je 0x180025307
cmp edi, 0x2da
je 0x18002518d
cmp edi, 0x361
jne 0x180025381
mov dword [rbx + 0x3c], r12d
xor eax, eax
jmp 0x180025194
mov eax, dword [rbx + 0x28]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x88], eax
mov r9, rbx
mov eax, dword [rbx + 0x24]
mov r8d, 0xe2
mov dword [rsp + 0x38], eax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call fcn.180031dc0
mov dword [rsp + 0x88], 1
jmp 0x18002537a
mov eax, dword [rbx + 0x28]
lea r9, [rsp + 0x38]
mov dword [rsp + 0x30], eax
lea r8, [rsp + 0x30]
mov eax, dword [rbx + 0x24]
mov edx, 0x3e
mov rcx, rbx
mov dword [rsp + 0x38], eax
call fcn.180017190
mov eax, dword [rbx + 0xc]
mov dword [rbx + 0x28], eax
lea rcx, [0x1800333b0]
add edi, 0x87
cmp edi, r15d
jb 0x180025150
jmp 0x18002518d
Function at 0x180028980
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1800529c8]
xor rax, rsp
mov qword [rsp + 0x80], rax
imul r12d, edx, 0x395
mov r15d, edx
mov rsi, rcx
mov edi, edx
cmp edx, r12d
ja 0x1800289ff
mov ebp, dword [rsp + 0x20]
xor ebx, ebx
mov r14d, dword [rsp + 0x20]
nop word [rax + rax]
cmp edi, 0x1385
ja 0x180028abc
je 0x180028a66
cmp edi, 0x13
je 0x180028a30
cmp edi, 0xce
je 0x180028aa1
cmp edi, 0x9cc
jne 0x180028b62
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18003bee0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov ebp, dword [rsi + 0xc]
lea rdx, str._bind_trace_pprofiling__YAXPAVIReader_12_PAXPAVEventWaitHandle_OpenExisting_2_v1_post_win_12__Z
mov r14d, dword [rsi + 0x3c]
mov r8, rsi
mov ecx, 0x70
call fcn.1800041b0
test eax, eax
jne 0x180028a59
mov edi, 0x9cc
jmp 0x180028b62
mov dword [rsp + 0x40], 1
jmp 0x180028b62
mov ecx, 0xa4
nop dword [rax + rax]
mov eax, ecx
sub eax, 0xa4
je 0x180028a8f
sub eax, 0xc
je 0x180028a89
cmp eax, 0xc
je 0x1800289ff
jmp 0x180028a96
mov dword [rsp + 0x40], ebx
jmp 0x180028a96
mov dword [rsi + 0xc], ebp
mov dword [rsi + 0x3c], r14d
add ecx, 0xc
cmp ecx, 0xc8
jb 0x180028a70
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x24], 0x3f800000
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x38], rax
jmp 0x180028b62
cmp edi, 0x6a38
je 0x180028b2e
cmp edi, 0xd3a2
je 0x180028b00
cmp edi, 0x13d0c
jne 0x180028b62
lea r8, [rsp + 0x50]
mov ecx, 0xa6
lea rdx, [rsp + 0x38]
call fcn.18002dbb0
test eax, eax
jne 0x180028b79
lea rax, str.e:_amigo_browser_38_amigo_3.0_src_storage_browser_blob_view_blob_internals_job.cc
jmp 0x180028a04
mov r9d, 0xf8
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x58]
xor ecx, ecx
call fcn.18002d320
mov r8d, 0x106
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x38]
call fcn.18001e230
jmp 0x180028b62
mov dword [rsp + 0x28], 0xbdcccccd
mov dword [rsp + 0x2c], 0xbdcccccd
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x30], 0xbdcccccd
mov dword [rsp + 0x34], 0x3f666666
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
imul eax, r15d, 0x83
add edi, eax
cmp edi, r12d
jbe 0x1800289d0
jmp 0x1800289ff
mov rax, rbx
jmp 0x180028a04
Function at 0x180028b90
Capabilities:
Terminate process

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x1800529c8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, qword [rsp + 0x20]
mov r15, r9
imul ebp, ecx, 0x307
mov r14, r8
mov r12, rdx
mov esi, ecx
mov edi, ecx
cmp ecx, ebp
ja 0x180028bfb
mov eax, edi
sub eax, 0xad
je 0x180028c49
sub eax, 0x28
je 0x180028c24
sub eax, 0x6897
je 0x180028c20
sub eax, 0x1860
je 0x180028cb3
cmp eax, 0x505f
jne 0x180028c9e
mov rax, rbx
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.18003bee0
add rsp, 0xc0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
xor ebx, ebx
jmp 0x180028c9e
xor r8d, r8d
mov rdx, r14
mov ecx, 0x105
call fcn.18002d690
xor r9d, r9d
xor edx, edx
mov r8d, StrCmpNCA
mov rcx, r15
call fcn.18002c210
jmp 0x180028c9e
lea r8, [rsp + 0x30]
mov edx, 0x4f
xor ecx, ecx
call fcn.180023f90
xor r9d, r9d
lea rdx, [rsp + 0x70]
xor r8d, r8d
lea ecx, [r9 + 0x11]
call fcn.180030710
lea r8, [rsp + 0x30]
mov edx, 0xed
lea rcx, [rsp + 0x30]
call fcn.180025c90
test eax, eax
je 0x180028cca
lea r8, [rsp + 0x30]
mov edx, 0xed
lea rcx, [rsp + 0x70]
call fcn.180025c90
test eax, eax
jne 0x180028cbe
imul eax, esi, 0x9b
add edi, eax
cmp edi, ebp
jbe 0x180028bd0
jmp 0x180028bfb
mov ecx, dword [r12]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rax, str.V:_I_WinRTDeviceMonitor::OnDeviceAdded_name_s_path_s_panel_d
jmp 0x180028bfe
lea rax, str.ms._Expected_timestamp_is_based_on_decoded_frames_and_frame_rate.
jmp 0x180028bfe
Function at 0x1800328b0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, r9
lea r15, [0x180000000]
mov rsi, rdx
mov ebp, ecx
mov edi, ecx
xor ebx, ebx
nop dword [rax + rax]
lea eax, [rbp - 5]
cmp edi, eax
jbe 0x180032998
mov eax, edi
sub eax, 0x1c
je 0x18003297d
sub eax, 1
je 0x18003292c
sub eax, 4
je 0x180032998
sub eax, 1
je 0x18003291f
cmp eax, 5
jne 0x18003291b
mov r8, r14
lea edx, [rax + 0x2f]
xor ecx, ecx
call fcn.18001e860
dec edi
jmp 0x1800328e0
cmp qword [rsi], 0xffffffffffffffff
setne byte [rsp + 0x40]
dec edi
jmp 0x1800328e0
test rsi, rsi
je case.0x180032950.8
mov edi, dword [rsi]
lea eax, [rdi - 1]
cmp eax, 0x10
ja case.0x180032950.2
cdqe
mov ecx, dword [r15 + rax*4 + 0x32ac4]
add rcx, r15
jmp rcx
mov eax, pe_nt_image_headers64
cmp eax, 0x108
je 0x1800329b5
add eax, 0xbc
cmp eax, 0x1c4
jb 0x180032957
mov eax, 0x11c
mov dword [rsp + 0x40], ebx
mov edi, 0x1c
add eax, 0x2a
jmp 0x180032982
mov eax, 0x11c
cmp eax, 0x170
jae 0x18003291b
mov ecx, eax
sub ecx, 0x11c
je 0x18003296a
cmp ecx, 0x2a
jne 0x180032978
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov eax, dword [rsi + 0x2c]
test al, 2
je 0x1800329de
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, qword [rsi + 0x10]
lea rdx, str.Configuration_file___1__.200s___is_not_locked.
mov rcx, rax
call fcn.18003b800
mov eax, ebx
jmp 0x18003299c
mov rdx, qword [rsi + 0x20]
xor r9d, r9d
or eax, 2
xor r8d, r8d
mov dword [rsi + 0x2c], eax
lea ecx, [r9 + 0x1d]
call fcn.1800328b0
and dword [rsi + 0x2c], 0xfffffffd
mov ebx, eax
mov eax, ebx
jmp 0x18003299c
mov rdx, qword [rsi + 0x10]
xor r9d, r9d
xor r8d, r8d
lea ecx, [r9 + 0x1d]
call fcn.1800328b0
jmp 0x18003299c
mov rcx, qword [rsi + 0x10]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], bl
jne 0x180032a21
test rax, rax
setne bl
mov eax, ebx
jmp 0x18003299c
mov rdi, qword [rsi + 0x10]
test rdi, rdi
je case.0x180032950.4
nop
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
lea ecx, [r9 + 0x1d]
call fcn.1800328b0
test eax, eax
je case.0x180032950.8
mov rdi, qword [rdi + 8]
test rdi, rdi
jne 0x180032a40
mov eax, 1
jmp 0x18003299c
mov rdi, qword [rsi + 0x10]
test rdi, rdi
je case.0x180032950.8
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
lea ecx, [r9 + 0x1d]
call fcn.1800328b0
test eax, eax
jne case.0x180032950.4
mov rdi, qword [rdi + 8]
test rdi, rdi
jne 0x180032a72
mov eax, ebx
jmp 0x18003299c
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, edi
lea rdx, str.Check_failed:__enqueue_times_.empty__
mov rcx, rax
call fcn.18003b800
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x14007048d
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
jmp 0x140077eb0
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1c8
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x2a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1e8]
mov rax, qword [0x1401901d8]
xor rax, rbp
mov qword [rbp + 0x158], rax
lea rcx, [0x1401a21de]
call fcn.1400730e3
mov r8d, dword [rbp + 0x190]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x140077f28
xor eax, eax
jmp 0x140078064
mov eax, dword [rbp + 0x188]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, eax
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x140077f67
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140078064
mov eax, dword [rbp + 0x188]
mov qword [rsp + 0x20], 0
mov r9d, eax
mov r8, qword [rbp + 0x180]
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140077fa3
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140078064
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x140077fcc
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140078064
lea rdx, str.ZwCreateThreadEx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x140077ff6
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140078064
mov qword [rbp + 0x88], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 8]
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rbp + 0x88]
call qword [rbp + 0x68]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x60]
lea rdx, [0x14015bdc0]
call fcn.14007284b
mov rax, rdi
mov rcx, qword [rbp + 0x158]
xor rcx, rbp
call fcn.1400717a7
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret
Function at 0x1400715ef
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140107f20
mov rax, rcx
neg rcx
test rax, 7
je 0x140107f3d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x140107f98
test al, 7
jne 0x140107f30
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x140107f51
mov rdx, qword [rax - 8]
test dl, dl
je 0x140107fc2
test dh, dh
je 0x140107fbc
shr rdx, 0x10
test dl, dl
je 0x140107fb6
test dh, dh
je 0x140107fb0
shr rdx, 0x10
test dl, dl
je 0x140107faa
test dh, dh
je 0x140107fa4
shr edx, 0x10
test dl, dl
je 0x140107f9e
test dh, dh
jne 0x140107f51
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x14007191e
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140093ca0
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140093620
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140093cdf
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1401a3020]
jmp 0x140093ce9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x140071a81
Capabilities:
Query environment variable

Disassembly:
jmp 0x14011ab70
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14011a9a0
lea rcx, [rsp + 0x40]
call fcn.14011ab20
movzx eax, al
test eax, eax
jne 0x14011abb8
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.14011a9d0
mov rax, qword [rsp + 0x70]
jmp 0x14011ad89
lea rcx, [rsp + 0x40]
call fcn.14011aaf0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.14011aa90
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.14011aaf0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.14007249f
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x14011ac5e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.14011a9d0
mov rax, qword [rsp + 0x80]
jmp 0x14011ad89
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.14007181a
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400716f3
lea rcx, [rsp + 0x48]
call fcn.1400713c4
movzx eax, al
test eax, eax
jne 0x14011acc5
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.14007077b
lea rcx, [rsp + 0x40]
call fcn.14011a9d0
mov rax, qword [rsp + 0x88]
jmp 0x14011ad89
lea rcx, [rsp + 0x48]
call fcn.140071d3d
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.14011aaf0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.14007249f
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x14011ad5b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.14007077b
lea rcx, [rsp + 0x40]
call fcn.14011a9d0
mov rax, qword [rsp + 0xa0]
jmp 0x14011ad89
lea rcx, [rsp + 0x48]
call fcn.1400716d0
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.14007077b
lea rcx, [rsp + 0x40]
call fcn.14011a9d0
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret

Function at 0x140071a8b
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x140093bd0
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1400935a0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140093c11
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1401a3020]
jmp 0x140093c17
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret
Function at 0x140071b0d
Capabilities:
Get geographical location

Disassembly:
jmp 0x140128280
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.1401271b0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1401282e7
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x1401a3030]
jmp 0x140128309
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.14007136f
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x140071b1c
Capabilities:
Terminate process

Disassembly:
jmp 0x1400799e0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret