joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001b94c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r13, rdx
mov r12, rcx
call fcn.14002c598
mov rbx, qword [rax + 0x18]
mov r8d, 0xf1
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor r14d, r14d
cmp rax, r14
jne 0x14001b992
xor eax, eax
jmp 0x14001ba6b
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
cmp rax, r14
je 0x14001b98b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
cmp rax, r14
je 0x14001b98b
movzx ecx, word [rax + 6]
mov eax, 4
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400062ec
mov r9d, r14d
mov rbp, rax
cmp r14w, word [rbx + 6]
jae 0x14001ba04
mov rdx, rax
lea r8, [rbx + 8]
movzx ecx, word [r8]
inc r9d
add r8, 2
mov dword [rdx], ecx
movzx eax, word [rbx + 6]
add rdx, 4
cmp r9d, eax
jl 0x14001b9ea
movzx r8d, word [rbx + 6]
mov rdx, rbp
mov rcx, r12
call fcn.14001a0b0
mov rcx, rbp
mov esi, eax
call fcn.140006330
cmp esi, r14d
je 0x14001ba60
movzx ecx, word [rbx + 4]
movzx eax, word [rbx + 2]
mov dword [rsp + 0x60], eax
add eax, 7
mov dword [rsp + 0x64], ecx
mov r8, qword [rsp + 0x60]
mov dword [rsp + 0x68], eax
lea eax, [rcx + 7]
mov dword [rsp + 0x6c], eax
mov rdx, qword [rsp + 0x68]
mov rcx, r12
call fcn.14001a8e0
mov rdx, r13
mov rcx, r12
call fcn.14001a9b4
mov esi, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14003fa20
Capabilities:
Move file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x14003fa43
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rbx
mov ecx, eax
call fcn.140048d28
add rsp, 0x20
pop rbx
ret

Function at 0x14003fa4c
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14003fa6f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rbx
mov ecx, eax
call fcn.140048d28
add rsp, 0x20
pop rbx
ret

Function at 0x14004fc50
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rdi, r9
mov rsi, r8
mov rbx, rcx
lea rcx, [rsp + 0x40]
call fcn.14000ae40
nop
cmp rbx, 0xffffffff80000000
jne 0x14004fcdc
call fcn.14002bb50
cmp eax, 1
jne 0x14004fcdc
lea r8, [rsp + 0x40]
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x20]
call fcn.14000bb1c
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000a204
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14004fcd5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, 0xffffffff80000001
mov r9, rdi
mov r8, rsi
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14004fd13
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14004fd28
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rdi, r9
mov esi, r8d
mov rbx, rcx
lea rcx, [rsp + 0x50]
call fcn.14000ae40
nop
cmp rbx, 0xffffffff80000000
jne 0x14004fdb4
call fcn.14002bb50
cmp eax, 1
jne 0x14004fdb4
lea r8, [rsp + 0x50]
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x30]
call fcn.14000bb1c
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14000a204
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14004fdad
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, 0xffffffff80000001
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
mov r9, rdi
mov r8d, esi
mov rdx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ebx, eax
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14004fdf3
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140056770
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.14005d92c
nop
cmp dword [0x14009db38], 1
je 0x14005671c
mov dword [0x14009db34], 1
mov byte [0x14009db30], r12b
test ebx, ebx
jne 0x140056708
mov rcx, qword [0x14009feb0]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400566f5
mov rcx, qword [0x14009fea8]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x140056694
call fcn.140059524
cmp qword [rdi], rax
jne 0x140056694
jmp 0x14005667a
cmp rdi, rsi
jb 0x1400566f5
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.140059524
mov qword [rdi], rax
call rbx
mov rcx, qword [0x14009feb0]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x14009fea8]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x1400566d3
cmp r13, rax
je 0x1400566f3
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x14005667a
lea rdx, [0x14006f070]
lea rcx, [0x14006f058]
call fcn.1400564c4
lea rdx, [0x14006f080]
lea rcx, [0x14006f078]
call fcn.1400564c4
nop
test r12d, r12d
je 0x14005672b
mov ecx, 8
call fcn.14005d82c
test r12d, r12d
jne 0x140056756
mov dword [0x14009db38], 1
lea ecx, [r12 + 8]
call fcn.14005d82c
mov ecx, r15d
call fcn.140056458
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400565e4

Function at 0x14005677c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1400565e4
Function at 0x140059a1f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140098550]
jne 0x140054d8a
rol rcx, 0x10
test cx, 0xffff
jne 0x140054d86
repz ret
ror rcx, 0x10
jmp 0x140059978
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14009e120]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x14009e218]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400599fd
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14009e120]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140059a1f
mov rax, qword [rsp + 0x88]
mov qword [0x14009e218], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14009e1b8], rax
mov rax, qword [0x14009e218]
mov qword [0x14009e090], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14009e1a0], rax
mov dword [0x14009e080], 0xc0000409
mov dword [0x14009e084], 1
mov rax, qword [0x140098550]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140098558]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14009e118], eax
mov ecx, 1
call fcn.140059d30
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14007e770]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14009e118], 0
jne 0x140059aa6
mov ecx, 1
call fcn.140059d30
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14006148c
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.140059524
xor ebx, ebx
mov rdi, rax
cmp qword [0x14009e9b0], rbx
jne 0x140061592
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140061667
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140061667
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x14007e9b8]
mov rcx, rsi
mov qword [0x14009e9b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x14007e9a0]
mov rcx, rsi
mov qword [0x14009e9b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x14009e9c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x14009e9d0], rax
test rax, rax
je 0x140061589
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x14009e9c8], rax
jmp 0x140061599
mov rax, qword [0x14009e9c8]
jmp 0x1400615a0
mov rax, qword [0x14009e9c8]
mov r11, qword [0x14009e9d0]
cmp rax, rdi
je 0x140061608
cmp r11, rdi
je 0x140061608
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x14009e9d0]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x140061608
test rax, rax
je 0x140061608
call rsi
test rax, rax
je 0x140061602
lea rcx, [rsp + 0x88]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140061602
test byte [rsp + 0x38], 1
jne 0x140061608
bts ebp, 0x15
jmp 0x140061646
mov rcx, qword [0x14009e9b8]
cmp rcx, rdi
je 0x140061646
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140061646
call rax
mov rbx, rax
test rax, rax
je 0x140061646
mov rcx, qword [0x14009e9c0]
cmp rcx, rdi
je 0x140061646
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140061646
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14009e9b0]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140061667
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140061669
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140a4e058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140a4e1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140a4e089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a4e06f
add dl, dl
jne 0x140a4e096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a4e0f6
xor eax, eax
add dl, dl
jne 0x140a4e0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a4e1ad
add dl, dl
jne 0x140a4e0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a4e0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a4e0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a4e0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140a4e0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140a4e07e
mov eax, 1
add dl, dl
jne 0x140a4e106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a4e113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a4e0fb
sub eax, ebx
mov ebx, 1
jne 0x140a4e14c
mov ecx, 1
add dl, dl
jne 0x140a4e12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140a4e13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a4e123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a4e07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140a4e168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140a4e175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a4e15d
cmp eax, 0x7d00
jae 0x140a4e19b
cmp eax, 0x500
jb 0x140a4e196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a4e07e
cmp eax, 0x7f
ja 0x140a4e19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a4e07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140a4e1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140a4e07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x13f3e32e0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x290
movdqa xmmword [rsp + 0x2f0], xmm6
movdqa xmmword [rsp + 0x300], xmm7
movdqa xmmword [rsp + 0x310], xmm8
movdqa xmmword [rsp + 0x320], xmm9
movdqa xmmword [rsp + 0x330], xmm10
movdqa xmmword [rsp + 0x340], xmm11
movdqa xmmword [rsp + 0x350], xmm12
movdqa xmmword [rsp + 0x360], xmm13
movdqa xmmword [rsp + 0x370], xmm14
movdqa xmmword [rsp + 0x380], xmm15
mov eax, dword [0x13f52557c]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x290]
mov qword [rdx + 8], r8
call fcn.13f473730
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x13f52557c]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x13f3e3470
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x13f3e348c
cmp rcx, r8
jl 0x13f3e347f
mov qword [rdx + 0x80], rcx
test dword [0x13f51d0b0], 1
je 0x13f3e34bb
cmp byte [rsp + 0xd0], 0
je 0x13f3e34bb
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x13f3e2fe0
mov rsp, r8
jmp rax
Function at 0x13f3e34c0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xc8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x118], rdx
mov eax, dword [0x13f52557c]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [rdx + 0x18]
mov rbx, qword [rax]
mov rax, qword [rdx + 0x20]
mov rbp, qword [rax]
mov rax, qword [rdx + 0x28]
mov rsi, qword [rax]
mov rax, qword [rdx + 0x30]
mov rdi, qword [rax]
mov rax, qword [rdx + 0x58]
mov r12, qword [rax]
mov rax, qword [rdx + 0x60]
mov r13, qword [rax]
mov rax, qword [rdx + 0x68]
mov r14, qword [rax]
mov rax, qword [rdx + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [rdx + 0x90]
movdqa xmm7, xmmword [rdx + 0xa0]
movdqa xmm8, xmmword [rdx + 0xb0]
movdqa xmm9, xmmword [rdx + 0xc0]
movdqa xmm10, xmmword [rdx + 0xd0]
movdqa xmm11, xmmword [rdx + 0xe0]
movdqa xmm12, xmmword [rdx + 0xf0]
movdqa xmm13, xmmword [rdx + 0x100]
movdqa xmm14, xmmword [rdx + 0x110]
movdqa xmm15, xmmword [rdx + 0x120]
mov rcx, qword [rdx + 0x78]
call qword [rsp + 0x110]
mov rdx, qword [rsp + 0x118]
mov rax, qword [rdx + 0x18]
mov qword [rax], rbx
mov rax, qword [rdx + 0x20]
mov qword [rax], rbp
mov rax, qword [rdx + 0x28]
mov qword [rax], rsi
mov rax, qword [rdx + 0x30]
mov qword [rax], rdi
mov rax, qword [rdx + 0x58]
mov qword [rax], r12
mov rax, qword [rdx + 0x60]
mov qword [rax], r13
mov rax, qword [rdx + 0x68]
mov qword [rax], r14
mov rax, qword [rdx + 0x70]
mov qword [rax], r15
movdqa xmmword [rdx + 0x90], xmm6
movdqa xmmword [rdx + 0xa0], xmm7
movdqa xmmword [rdx + 0xb0], xmm8
movdqa xmmword [rdx + 0xc0], xmm9
movdqa xmmword [rdx + 0xd0], xmm10
movdqa xmmword [rdx + 0xe0], xmm11
movdqa xmmword [rdx + 0xf0], xmm12
movdqa xmmword [rdx + 0x100], xmm13
movdqa xmmword [rdx + 0x110], xmm14
movdqa xmmword [rdx + 0x120], xmm15
mov rax, qword [rsp + 0xc0]
lock or dword [rax + 0x38], 0x10
movdqa xmm6, xmmword [rsp + 0x20]
movdqa xmm7, xmmword [rsp + 0x30]
movdqa xmm8, xmmword [rsp + 0x40]
movdqa xmm9, xmmword [rsp + 0x50]
movdqa xmm10, xmmword [rsp + 0x60]
movdqa xmm11, xmmword [rsp + 0x70]
movdqa xmm12, xmmword [rsp + 0x80]
movdqa xmm13, xmmword [rsp + 0x90]
movdqa xmm14, xmmword [rsp + 0xa0]
movdqa xmm15, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbp
pop rdi
pop rsi
pop rbx
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x13f3eb4a0
Capabilities:
Resume thread
Suspend thread

Disassembly:
cmp qword [rcx + 0x60], 0xffffffffffffffff
je 0x13f3e4c67
mov eax, dword [rcx + 0x38]
shr eax, 5
test al, 1
jne 0x13f3e4c67
mov eax, dword [rcx + 0x38]
shr eax, 7
test al, 1
jne 0x13f3e4c67
mov rdx, rcx
mov rcx, qword [rcx + 0x60]
jmp 0x13f3eb4a0
ret
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x500
mov rax, qword [0x13f51a040]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov rax, qword [0x13f519658]
mov rbx, rdx
mov rdi, rcx
cmp rax, 0xffffffffffffffff
jne 0x13f3eb4fe
xor edx, edx
lea rcx, str.kernel32
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
lea rdx, str.QueueUserAPC2
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x13f519658], rax
test rax, rax
je 0x13f3eb55a
mov rcx, rbx
call fcn.13f3e4f60
test al, al
jne 0x13f3eb5a8
mov dl, 1
mov rcx, rbx
call fcn.13f3e4fe0
mov r9d, 0x10001
lea rcx, [0x13f3eb110]
mov r8, rbx
mov rdx, rdi
call qword [0x13f519658]
test eax, eax
jne 0x13f3eb5a8
xor edx, edx
mov rcx, rbx
call fcn.13f3e4fe0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x13f3eb5a8
mov qword [0x13f519658], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x13f3eb5a8
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x50], 0x40100003
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x13f3eb59f
mov eax, dword [rsp + 0x50]
test eax, eax
jns 0x13f3eb59f
test eax, 0x18000000
jne 0x13f3eb59f
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [str.pL__]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.13f43fd00
mov rbx, qword [rsp + 0x520]
add rsp, 0x500
pop rdi
ret

Function at 0x13f3eb730
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rcx + rbx], 0
jne 0x13f3eb744
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x13f3eb7f0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
mov r9, rdx
mov r8, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x13f3eb819
add rsp, 0x38
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x38
ret

Function at 0x13f3eb830
Capabilities:
Create thread
Resume thread

Disassembly:
push rbx
sub rsp, 0x30
mov r9, rdx
mov qword [rsp + 0x28], 0
mov r8, rcx
mov dword [rsp + 0x20], 4
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
jne 0x13f3eb865
add rsp, 0x30
pop rbx
ret
mov edx, 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x30
pop rbx
ret
Function at 0x13f3ecd00
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xe0
mov rax, qword [0x13f51a040]
xor rax, rsp
mov qword [rsp + 0xd0], rax
movzx ebx, r8b
mov rdi, rdx
mov r8d, 0x40
lea rdx, [rsp + 0x50]
call fcn.13f3ec930
mov r8d, 0x11
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov r11d, eax
lea ecx, [rax - 1]
cmp ecx, 0xf
ja 0x13f3ecdc8
xor ecx, ecx
mov r9d, ecx
test eax, eax
je 0x13f3ecdc1
lea r10, [rsp + 0x20]
movzx r8d, word [r10]
lea eax, [r8 - 0x30]
test bl, bl
je 0x13f3ecd84
cmp ax, 9
ja 0x13f3ecdc8
lea rcx, [rcx + rcx*4]
lea rcx, [rcx - 0x18]
lea rcx, [r8 + rcx*2]
jmp 0x13f3ecdb5
shl rcx, 4
cmp ax, 9
ja 0x13f3ecd94
add rcx, 0xffffffffffffffd0
jmp 0x13f3ecdb2
lea eax, [r8 - 0x61]
cmp ax, 5
ja 0x13f3ecda4
add rcx, 0xffffffffffffffa9
jmp 0x13f3ecdb2
lea eax, [r8 - 0x41]
cmp ax, 5
ja 0x13f3ecdc8
add rcx, 0xffffffffffffffc9
add rcx, r8
inc r9d
add r10, 2
cmp r9d, r11d
jb 0x13f3ecd64
mov qword [rdi], rcx
mov al, 1
jmp 0x13f3ecdca
xor al, al
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.13f43fd00
mov rbx, qword [rsp + 0x100]
add rsp, 0xe0
pop rdi
ret