joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140092ee0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x140092f28
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x140092f31
lea rax, [rsi + 1]
cmp rax, 2
jb 0x140092f18
mov qword [rdi], rsi
call fcn.1400a0a00
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.1400a0a00
mov rcx, qword [rdi]
call fcn.140097c30
mov qword [rdi], 0
jmp 0x140092f06

Function at 0x140097ac0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x1401bc010]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov eax, dword [0x1401cf0f8]
mov ecx, dword [0x1401cbd4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140097b20
mov rsi, qword [0x1401cf0f0]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400c0d00
mov rax, rsi
add rsp, 0x158
pop rdi
pop rsi
ret
lea rcx, [0x1401cf0f8]
call fcn.1400bfb10
cmp dword [0x1401cf0f8], 0xffffffff
jne 0x140097afc
lea rsi, [rsp + 0x38]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.1400c2be0
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x34]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x30]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.1400bf928
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x1401cf140]
mov ecx, dword [0x1401cbd4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140097be0
lea r8, [0x1401cf110]
lea rdx, [rsp + 0x34]
mov rcx, rsi
mov r9d, edi
call fcn.14004b570
mov qword [0x1401cf0f0], rsi
lea rcx, [0x1401cf0f8]
call fcn.1400bfba8
jmp 0x140097afc
lea rcx, [0x1401cf140]
call fcn.1400bfb10
cmp dword [0x1401cf140], 0xffffffff
jne 0x140097bb1
xorps xmm0, xmm0
movups xmmword [0x1401cf130], xmm0
movups xmmword [0x1401cf120], xmm0
movups xmmword [0x1401cf110], xmm0
lea rcx, [0x1401cf110]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x1401cf140]
call fcn.1400bfba8
jmp 0x140097bb1
Function at 0x14012ef40
Capabilities:
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
cmp dword [r8], 0
jle 0x14012ef5b
xor eax, eax
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
call fcn.14006ab80
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000080
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x14012f009
mov r14, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x14012f009
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 8], rax
test rax, rax
je 0x14012f034
mov qword [rdi + 0x28], rbx
mov al, 1
jmp 0x14012ef51
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
cmp ecx, 0x8007000e
jne 0x14012ef4f
mov dword [rsi], 7
jmp 0x14012ef4f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14012ef4f
Function at 0x140007620
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x30]
call fcn.140008b5c
nop
lea rax, [0x14000702c]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x30]
call fcn.14000701c
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x1400076a5
lea rcx, [rsp + 0x30]
call fcn.14000d130
jmp 0x1400076bc
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
lea rcx, [rsp + 0x30]
call fcn.140009944
add rsp, 0x58
ret

Function at 0x140008298
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x28]
call fcn.1400097e8
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x38]
call fcn.1400096ec
lea rcx, [rsp + 0x38]
call fcn.140009ecc
movzx eax, al
test eax, eax
je 0x140008320
lea rcx, [rsp + 0x38]
call fcn.14000d350
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x140008320
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.14000cb3c
mov rcx, rax
call fcn.140008aec
cmp eax, 0xfaba0065
jne 0x14000831e
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.14000b044
jmp 0x140008337
jmp 0x1400082d8
lea rcx, [rsp + 0x28]
call fcn.14000cb70
movzx eax, al
test eax, eax
jne 0x1400082a6
xor eax, eax
add rsp, 0x58
ret

Function at 0x140008670
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x28]
call fcn.1400097e8
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x38]
call fcn.1400096ec
lea rcx, [rsp + 0x38]
call fcn.140009ecc
movzx eax, al
test eax, eax
je 0x1400086f8
lea rcx, [rsp + 0x38]
call fcn.14000d350
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x1400086f8
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.14000cb3c
mov rcx, rax
call fcn.140008aec
cmp eax, 0xf8f45725
jne 0x1400086f6
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.14000b044
jmp 0x14000870f
jmp 0x1400086b0
lea rcx, [rsp + 0x28]
call fcn.14000cb70
movzx eax, al
test eax, eax
jne 0x14000867e
xor eax, eax
add rsp, 0x58
ret
Function at 0x140008714
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x28]
call fcn.1400097e8
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x38]
call fcn.1400096ec
lea rcx, [rsp + 0x38]
call fcn.140009ecc
movzx eax, al
test eax, eax
je 0x14000879c
lea rcx, [rsp + 0x38]
call fcn.14000d350
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x14000879c
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.14000cb3c
mov rcx, rax
call fcn.140008aec
cmp eax, 0x53b2070f
jne 0x14000879a
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.14000b044
jmp 0x1400087b3
jmp 0x140008754
lea rcx, [rsp + 0x28]
call fcn.14000cb70
movzx eax, al
test eax, eax
jne 0x140008722
xor eax, eax
add rsp, 0x58
ret

Function at 0x140009480
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.14000943c
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x14000a1dc
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jne 0x14000a1fe
mov rcx, qword [rsp + 0x40]
call fcn.14000ab7c
jmp 0x14000a215
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4e0
jb 0x14000a215
mov rcx, qword [rsp + 0x40]
call fcn.14000a988
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xb
mov rcx, qword [rsp + 0x40]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x14000a3ac
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x38
lea rcx, [0x1400157a8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x140015798]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14000a435
lea rcx, [0x1400157c0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtUserSendInput
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14000a435
lea rcx, [0x1400157d4]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.SendInput
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14000a435
xor al, al
jmp 0x14000a4e7
lea rcx, str.win32u
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x1400157e0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14000a4b7
lea rcx, [0x140015818]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtUserGetAsyncKeyState
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14000a4b7
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.GetAsyncKeyState
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14000a4b7
xor al, al
jmp 0x14000a4e7
mov r8d, 0x1e
mov rdx, qword [rsp + 0x20]
lea rcx, [0x14001b9e0]
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0x1e
mov rdx, qword [rsp + 0x28]
lea rcx, [0x14001ba00]
call sub.VCRUNTIME140.dll_memcpy
mov al, 1
add rsp, 0x38
ret
Function at 0x14000a988
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0x26f
mov qword [rsp + 0x30], 0xe3
mov qword [rsp], 0
jmp 0x14000a9b8
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xe3
jae 0x14000aa3a
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x14000aa06
mov dword [rsp + 0x14], 0x9908b0df
jmp 0x14000aa0e
mov dword [rsp + 0x14], 0
mov eax, dword [rsp + 0x10]
shr eax, 1
xor eax, dword [rsp + 0x14]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14000a9ad
mov qword [rsp + 8], 0xe3
jmp 0x14000aa52
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x26f
jae 0x14000aad9
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x18], eax
mov eax, dword [rsp + 0x18]
and eax, 1
test eax, eax
je 0x14000aaa3
mov dword [rsp + 0x1c], 0x9908b0df
jmp 0x14000aaab
mov dword [rsp + 0x1c], 0
mov eax, dword [rsp + 0x18]
shr eax, 1
xor eax, dword [rsp + 0x1c]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14000aa45
mov qword [rsp + 0x38], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x14000ab2d
mov dword [rsp + 0x24], 0x9908b0df
jmp 0x14000ab35
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x20]
shr eax, 1
xor eax, dword [rsp + 0x24]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x50]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rsp + 0x50]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rsp + 0x50]
mov dword [rax], 0
add rsp, 0x48
ret
Function at 0x14000ab7c
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp + 8], 0x270
jmp 0x14000ab9d
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x4e0
jae 0x14000ac21
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 - 0x9bc]
and eax, 0x80000000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 - 0x9b8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x14000abec
mov dword [rsp + 4], 0x9908b0df
jmp 0x14000abf4
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14000ab90
add rsp, 0x18
ret

Function at 0x14000b0cc
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x28
mov rax, qword gs:[0x60]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
mov rax, qword [rax + 0x18]
mov ecx, 8
imul rcx, rcx, 1
mov rax, qword [rax + rcx + 8]
mov qword [rsp + 0x10], rax
xor eax, eax
mov ecx, 8
imul rcx, rcx, 0
add rax, rcx
mov rcx, qword [rsp + 0x10]
sub rcx, rax
mov rax, rcx
mov qword [rsp], rax
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp]
lea rax, [rcx + rax + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp]
mov rax, qword [rax + 0x30]
add rax, 0x100000
mov rcx, qword [rsp + 0x18]
mov dword [rcx], eax
xor eax, eax
add rsp, 0x28
ret
Function at 0x14000d320
Capabilities:
Hash data using fnv

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
movsx eax, byte [rsp + 0x10]
mov ecx, dword [rsp + 8]
xor ecx, eax
mov eax, ecx
mov eax, eax
imul rax, rax, 0x1000193
ret
Function at 0x14000f198
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000f1e2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000f1e2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000f1e2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000f1e2
cmp dword [rcx + 0x84], 0xe
jbe 0x14000f1e2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000f1e4
xor al, al
add rsp, 0x28
ret
Function at 0x140009038
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov r9, rcx
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
mov rsi, rdx
movzx eax, byte [rbx + rcx + 0x10]
movabs rdx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdx
cmp rcx, 4
jb 0x14000905c
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, r8
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rbx
jne 0x1400090b3
cmp qword [rcx + rdx*8], rbx
jne 0x1400090a8
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400090ac
mov rax, qword [rbx + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400090c0
cmp qword [rcx + rdx*8], rbx
jne 0x1400090c0
mov rax, qword [rbx]
mov qword [rcx + rdx*8], rax
mov rax, qword [rbx + 8]
mov rdi, qword [rbx]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov rdx, qword [rbx + 0x30]
cmp rdx, 8
jb 0x1400090f5
mov rcx, qword [rbx + 0x18]
inc rdx
mov r8d, 2
call fcn.1400020a4
mov edx, 1
mov rcx, rbx
lea r8d, [rdx + 0x37]
call fcn.1400020a4
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b51c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_1.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400148a0], eax
call fcn.14000b2a4
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_UnhandledExceptionFilter]
cmp dword [0x1400148a0], 0
jne case.default.0x14000b572
mov ecx, 1
call fcn.14000b2a4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TerminateProcess]
test byte [rbx], ch
in eax, dx
jg 0x140020a05
mov bh, 0xec
invalid
sub ch, cl
loope 0x140020a27
fcompi st(7)
loopne 0x140020a6d
clc
xor eax, 0xc0a1eb37
test al, 4
in al, dx
invalid
jp 0x140020a67
mov ecx, eax
jne 0x140020aa2
invalid
cli
cmc
or al, byte [rcx - 0x53790699]
idiv byte [rdi - 0x18]
add eax, 0x602f6c47
jno 0x140020a75
xchg byte [rsi + rsi*8 + 0x4705e87f], ch
insb byte [rdi], dx
invalid
and al, 0x75
xor cl, byte [rdx]
leave
push rdi
mov edx, 0x97a8f7db
pop rdi
ret 0x3e83
adc byte [rdi], bl
in eax, 9
cld
je 0x140020aaa
sbb al, 0xdf
mov al, 0xc4
pop rdx
cmc
or edi, dword [rcx + 0x65]
fbstp tbyte [rax + 0xbf55ac4]
jns 0x140020b17
fcmovu st(0), st(4)
call qword [rdi - 0x1f244193]
xchg edi, eax
pop rcx
invalid
out dx, eax
xor dword [rbx - 0x57df0ad8], edx
jle 0x140020b51
outsd dx, dword [rsi]
insb byte [rdi], dx
mov bh, dl
invalid
pop rbp
or esi, ecx
mov ebp, 0x8fb52be
pop rsp
adc al, 0xf
jge 0x140020bd3
fisubr word [rbp - 0x66]
invalid
neg byte [rsi - 0x44c626a3]
invalid
Function at 0x100401390
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x38
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
lea rcx, [0x10040c748]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x10040c770]
xor edi, edi
xor edx, edx
mov r8d, 0x208
mov qword [0x10040c978], rdi
call sub.MSVCR100.dll_memset
xor ecx, ecx
mov qword [rsp + 0x60], rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x100401405
lea rdx, [0x100408640]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x100401405
lea rcx, [rsp + 0x60]
call rax
mov ebx, eax
jmp 0x10040141a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x10040141a
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x1004014fe
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x60]
mov ebx, eax
test eax, eax
js 0x1004014f8
lea rax, [rsp + 0x68]
mov qword [0x10040c980], rcx
lea rdx, str.SOFTWAREMicrosoftMicrosoft_SQL_Server120SSISSetupDtsPath
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x68], rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1004014fe
mov rdi, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [0x10040c074]
lea rdx, str.SqlDumperFlags
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [0x10040c070]
lea r9, [rsp + 0x58]
lea rdx, str.SqlDumperMinidumpFlags
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test rdi, rdi
je 0x1004014fe
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1004014fe
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rcx, [0x100401380]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov eax, ebx
add rsp, 0x38
pop rdi
pop rbx
ret

Function at 0x1004019e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x100401a13
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x100401a59
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x100401a54
cmp rbx, r11
jae 0x100401a59
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
dec edi
jne 0x100401a40
cmp rbx, r11
jb 0x100401a5d
xor eax, eax
jmp 0x100401a69
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x100401a90
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
cmp byte [0x10040c988], 0
mov r14, rdx
mov rsi, rcx
jne 0x100401af9
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ecx, 0x409
cmp ax, cx
jne 0x100401ad7
mov rbx, rsi
mov byte [0x10040c988], 1
mov qword [0x10040c990], rbx
jmp 0x100401b00
mov rcx, rsi
call fcn.100406a80
mov byte [0x10040c988], 1
mov rbx, rax
test rax, rax
cmove rbx, rsi
mov qword [0x10040c990], rbx
jmp 0x100401b00
mov rbx, qword [0x10040c990]
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edx, 0x139
mov r8d, 6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor edi, edi
test rax, rax
je 0x100401b48
mov r8d, 0x1389
mov rdx, rax
mov rcx, rbx
call fcn.1004019e0
test rax, rax
je 0x100401b48
movzx edx, word [rax]
lea rcx, [rax + 2]
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
jmp 0x100401b4b
mov rax, rdi
test rax, rax
setne bl
test bl, bl
jne 0x100401bae
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edx, 0x139
mov r8d, 6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x100401b9c
mov r8d, 0x1389
mov rdx, rax
mov rcx, rsi
call fcn.1004019e0
test rax, rax
je 0x100401b9c
movzx edx, word [rax]
lea rcx, [rax + 2]
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
jmp 0x100401b9f
mov rax, rdi
test rax, rax
setne bl
test bl, bl
jne 0x100401bae
mov qword [r14], rdi
jmp 0x100401bb7
mov rcx, rax
mov rax, rdi
mov qword [r14], rcx
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rsi, qword [rsp + 0x38]
test bl, bl
mov rbx, qword [rsp + 0x30]
setne dil
mov eax, edi
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret