joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400714b0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [str.L8_v_]
mov rdi, rax
test rax, rax
jne 0x1400714f2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x140071539
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + 8]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + 0x10]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x140071592
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + 8]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + 8]
sub rbp, 1
jne 0x140071550
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400715d3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400eb7da]
mov r8d, 1
call qword [rbx + 8]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400eb7db]
mov r8d, 1
call qword [rbx + 8]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400715a0
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x140071b20
Capabilities:
Compress data via zlib inflate or deflate
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov r14d, edx
mov r12, rcx
test rcx, rcx
je case.0x140071c1b.16211
cmp qword [rcx + 0x30], 0
je case.0x140071c1b.16211
cmp qword [rcx + 0x38], 0
je case.0x140071c1b.16211
mov r13, qword [rcx + 0x28]
test r13, r13
je case.0x140071c1b.16211
cmp qword [r13], rcx
jne case.0x140071c1b.16211
mov edx, dword [r13 + 8]
lea eax, [rdx - 0x3f34]
cmp eax, 0x1f
ja case.0x140071c1b.16211
mov r9, qword [rcx + 0x10]
mov qword [rsp + 0x40], r9
test r9, r9
je case.0x140071c1b.16211
mov rsi, qword [rcx]
test rsi, rsi
jne 0x140071ba6
cmp dword [rcx + 8], esi
jne case.0x140071c1b.16211
cmp edx, 0x3f3f
jne 0x140071bc7
mov dword [r13 + 8], 0x3f40
mov edx, 0x3f40
mov r9, qword [rcx + 0x10]
mov rsi, qword [rcx]
mov qword [rsp + 0x40], r9
mov r10d, dword [rcx + 0x18]
lea eax, [rdx - 0x3f34]
mov edi, dword [rcx + 8]
xor r15d, r15d
mov ebp, dword [r13 + 0x48]
mov r8d, r10d
mov ebx, dword [r13 + 0x4c]
mov dword [rsp + 0xb8], r10d
mov dword [rsp + 0x38], edi
mov dword [rsp + 0xa0], r10d
mov dword [rsp + 0xb0], r15d
cmp eax, 0x1f
ja case.0x140071c1b.16211
Function at 0x1400b1a8c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400b18b8

Function at 0x1401fb028
Capabilities:
Encode data using xor

Disassembly:
sbb byte [rdi + 0xc], 0x86
push rdi
invalid
setne byte [rsp + 0x40]
mov qword [rsp + 0x48], 0x79245790
xor qword [rsp + 0x48], 0x745f3392
and al, 0x48
xchg edx, eax
xor ebx, dword [rdi + 0x74]
sub byte [rsp + 0x40], 0x3d
mov dword [rsp + 0x48], 0x68ac077b
push qword [rsp + 0x58]
popfq
lea rsp, [rsp + 0x60]
call fcn.1404fec56
jl 0x1401faff5
jp 0x1401fb039
stosd dword [rdi], eax
jrcxz 0x1401fb036
push rdx
sbb eax, 0x46fd5151
push 0xffffffff961b1396
push qword [rbx + 0x4cdef93b]
fcom st(5)
sub eax, 0x7a16cbff
push rbx
leave
call 0x16ddb1fe0
cmp eax, 0x9fdbf987
jno 0x1401fb09d
invalid
invalid

Function at 0x1402c0fa7
Capabilities:
Encode data using xor

Disassembly:
lea rsp, [rsp + 0x18]
call fcn.1404af8e2

Function at 0x1403a9785
Capabilities:
Encode data using xor

Disassembly:
lea rsp, [rsp + 8]
call fcn.1404a85c4
popfq
xor eax, 0x9d000fee
pop rcx
jle 0x1403a978b
push rax
movsd dword [rdi], dword [rsi]
ror dh, 0xbf
cmpsd dword [rsi], dword [rdi]
mov bl, 0xdd
sar byte [rdi + 0x1466ec95], 1
test dword [0x1137ad577], ebx
jb 0x1403a97cb
invalid
invalid
jg 0x1403a9796
mov edi, 0xd6624f5f
mov edi, 0x12d9982d
leave
mov ecx, 0xb403b70
invalid
Function at 0x140001010
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbp
push rdi
sub rsp, 0x188
mov rax, qword [0x140018008]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rdi, rdx
mov rbp, rcx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x140001070
lea rax, [rsp + 0x48]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rdi
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000108d
cmp eax, 2
jne 0x14000107a
lea rcx, str.Key_not_found._n
call fcn.1400050f0
mov eax, 1
jmp 0x14000118c
lea rcx, str.Error_opening_key._n
call fcn.1400050f0
xor eax, eax
jmp 0x14000118c
mov rcx, rdi
mov qword [rsp + 0x1b0], rbx
mov qword [rsp + 0x180], rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rbx, eax
add rbx, rdi
cmp byte [rbx - 1], 0x5c
je 0x1400010bc
mov byte [rbx], 0x5c
add rbx, 1
mov byte [rbx], 0
mov rcx, qword [rsp + 0x48]
xor esi, esi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x140001159
nop
nop
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rdx, rdi
mov rcx, rbp
call fcn.140001010
test eax, eax
je 0x140001159
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
lea r8, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x40], 0x104
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x140001100
mov byte [rbx - 1], sil
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rbx, qword [rsp + 0x1b0]
test eax, eax
sete sil
mov eax, esi
mov rsi, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140005210
add rsp, 0x188
pop rdi
pop rbp
ret
Function at 0x1400011b0
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0xe0
mov rax, qword [0x140018008]
xor rax, rsp
mov qword [rsp + 0xd0], rax
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x9c
call fcn.140005240
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
xor ebx, ebx
test eax, eax
jne 0x140001214
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [rsp + 0x20]
test eax, eax
cmove ecx, ebx
jmp 0x140001218
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x1400012a5
sub eax, 1
je 0x140001278
cmp eax, 1
jne 0x1400012a7
mov eax, dword [rsp + 0x34]
cmp eax, 4
ja 0x14000123e
mov ecx, 4
jmp 0x1400012a7
cmp eax, 5
jne 0x14000125c
mov eax, dword [rsp + 0x38]
test eax, eax
jne 0x140001250
lea ecx, [rax + 5]
jmp 0x1400012a7
cmp eax, 1
jb 0x1400012a7
mov ecx, 6
jmp 0x1400012a7
cmp eax, 6
jne 0x1400012a5
mov eax, dword [rsp + 0x38]
test eax, eax
jne 0x14000126e
lea ecx, [rax + 7]
jmp 0x1400012a7
cmp eax, 1
jne 0x1400012a7
lea ecx, [rax + 7]
jmp 0x1400012a7
mov eax, dword [rsp + 0x34]
cmp eax, 4
ja 0x14000129e
jne 0x140001297
mov eax, dword [rsp + 0x38]
cmp eax, 0xa
ja 0x14000129e
test eax, eax
je 0x140001297
mov ecx, 2
jmp 0x1400012a7
mov ecx, 1
jmp 0x1400012a7
mov ecx, 3
jmp 0x1400012a7
mov ecx, ebx
mov eax, ecx
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140005210
add rsp, 0xe0
pop rbx
ret
Function at 0x140003910
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x570
mov rax, qword [0x140018008]
xor rax, rsp
mov qword [rsp + 0x560], rax
mov rsi, rcx
mov ecx, 0xff
mov rbx, rdx
or edi, 0xffffffff
mov dword [rsp + 0x30], 0
call fcn.140005bd0
cmp byte [rsi], 0
jne 0x140003968
lea rcx, str.Debug_1_n
call fcn.1400050f0
lea eax, [rdi + 4]
jmp 0x140003ad1
cmp byte [rbx], 0
jne 0x140003983
lea rcx, str.Debug_2_n
call fcn.1400050f0
mov eax, 3
jmp 0x140003ad1
cmp byte [0x140019fc1], 0
je 0x140003a13
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx r11d, word [rsp + 0x44]
movzx r9d, word [rsp + 0x42]
movzx r8d, word [rsp + 0x40]
lea rax, str.UpdateDeviceDriver...__
lea rdx, str.__02i:_02i:_02i_______s_____n
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x160]
mov dword [rsp + 0x20], r11d
call fcn.140005aa0
lea rdx, [0x140013438]
lea rcx, [0x140019e90]
call fcn.140005a90
test rax, rax
mov rbx, rax
je 0x140003a13
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call fcn.140005850
lea rcx, [rsp + 0x160]
mov rdx, rbx
call fcn.140005590
mov rcx, rbx
call fcn.1400054f0
lea r8, [rsp + 0x50]
xor r9d, r9d
mov edx, 0x104
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
cmp eax, 0x104
jae 0x140003ac2
test eax, eax
je 0x140003ac2
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x140003a55
lea rcx, str.Debug_4_n
jmp 0x140003ac9
lea rcx, str.newdev.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbx, rax
je 0x140003abe
lea rdx, str.UpdateDriverForPlugAndPlayDevicesA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140003aa9
lea rcx, [rsp + 0x30]
lea r8, [rsp + 0x50]
lea rdx, [0x140019a90]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
mov r9d, 1
call rax
xor edi, edi
cmp dword [rsp + 0x30], edi
setne dil
lea rcx, [0x140013af8]
call fcn.1400050f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
jmp 0x140003ad1
lea rcx, str.Debug_3_n
call fcn.1400050f0
or eax, 0xffffffff
mov rcx, qword [rsp + 0x560]
xor rcx, rsp
call fcn.140005210
lea r11, [rsp + 0x570]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140004330
Capabilities:
Delete file
Get common file path
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x140018008]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x150]
lea rcx, [0x140019c90]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea rcx, str.vwifimp
mov dl, 2
call fcn.140003f50
lea rdx, str.Microsoft_Virtual_WiFi_Miniport_Adapter
lea rcx, str.vwifimp
call fcn.140003be0
lea rcx, [fcn.140001000]
xor edx, edx
call qword [sym.imp.DIFXAPI.dll_DIFXAPISetLogCallbackA]
lea r9, [0x140019fb8]
lea rcx, [rsp + 0x150]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.DIFXAPI.dll_DriverPackageUninstallA]
cmp byte [0x140019fbf], 0
lea rcx, [0x140019680]
mov dword [0x140019a84], eax
je 0x1400043d7
mov dl, 2
call fcn.140003f50
jmp 0x1400043dc
call fcn.1400012d0
call fcn.1400011b0
lea rcx, [rsp + 0x40]
mov edx, 0x104
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov rdx, qword [str.Drivers_]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
or rcx, 0xffffffffffffffff
mov qword [rdi - 1], rdx
movzx edx, word [0x140013c18]
mov word [rdi + 7], dx
lea rdi, [rsp + 0x40]
lea rdx, [0x140019880]
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x140004430
lea rcx, [rsp + 0x40]
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp ebx, 8
jne 0x140004474
mov eax, dword [0x140019a88]
test eax, eax
je 0x140004482
cmp eax, 3
je 0x140004482
cmp eax, 7
jmp 0x140004480
cmp ebx, 7
jne 0x1400044be
cmp dword [0x140019a88], 0
jne 0x1400044be
lea rdx, [rsp + 0x28]
xor ecx, ecx
call qword [sym.imp.SETUPAPI.dll_CM_Connect_MachineA]
test eax, eax
jne 0x1400044be
mov r9, qword [rsp + 0x28]
lea rcx, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.SETUPAPI.dll_CM_Locate_DevNode_ExA]
test eax, eax
jne 0x1400044be
mov r8, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x20]
lea edx, [rax + 1]
call qword [sym.imp.SETUPAPI.dll_CM_Reenumerate_DevNode_Ex]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140005210
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
Function at 0x1400066a0
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8d, 0x94
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x1400066fe
cmp dword [0x14001a000], 2
je 0x1400066e0
call fcn.1400ab000
mov ecx, 0x12
call fcn.140008870
mov ecx, 0xff
call fcn.140008470
mov eax, 0xff
jmp 0x140006906
mov dword [rax], 0x94
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x14000672f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0xff
jmp 0x140006906
mov r13d, dword [rbx + 0x10]
mov esi, dword [rbx + 4]
mov r12d, dword [rbx + 8]
mov edi, dword [rbx + 0xc]
and edi, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r13d, 2
je 0x140006761
bts edi, 0xf
mov eax, esi
shl eax, 8
add eax, r12d
mov dword [0x14001a594], r13d
mov dword [0x14001a59c], eax
mov dword [0x14001a5a0], esi
mov dword [0x14001a5a4], r12d
mov dword [0x14001a598], edi
cmp word [0x140000000], 0x5a4d
jne 0x1400067e7
movsxd rax, dword [0x14000003c]
lea rcx, [0x140000000]
add rax, rcx
cmp dword [rax], 0x4550
je 0x1400067b5
xor ebx, ebx
mov dword [rsp + 0x50], ebx
jmp 0x1400067ed
cmp word [rax + 0x18], 0x20b
je 0x1400067c5
xor ebx, ebx
mov dword [rsp + 0x50], ebx
jmp 0x1400067ed
cmp dword [rax + 0x84], 0xe
ja 0x1400067d6
xor ebx, ebx
mov dword [rsp + 0x50], ebx
jmp 0x1400067ed
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0x50], ebx
jmp 0x1400067ed
xor ebx, ebx
mov dword [rsp + 0x50], ebx
mov ecx, 1
call fcn.140008ba0
test eax, eax
jne 0x14000681d
cmp dword [0x14001a000], 2
je 0x140006809
call fcn.140008ab0
mov ecx, 0x1c
call fcn.140008870
mov ecx, 0xff
call fcn.140008470
call fcn.14000bb90
test eax, eax
jne 0x140006848
cmp dword [0x14001a000], 2
je 0x140006834
call fcn.140008ab0
mov ecx, 0x10
call fcn.140008870
mov ecx, 0xff
call fcn.140008470
call fcn.14000d0c0
nop
call fcn.140009330
test eax, eax
jns 0x140006861
mov ecx, 0x1b
call fcn.140008440
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [0x14001c0f0], rax
call fcn.14000cef0
mov qword [0x140019ff0], rax
call fcn.14000cde0
test eax, eax
jns 0x14000688d
mov ecx, 8
call fcn.140008440
call fcn.14000ca50
test eax, eax
jns 0x1400068a0
mov ecx, 9
call fcn.140008440
mov ecx, 1
call fcn.1400085b0
test eax, eax
je 0x1400068b5
mov ecx, eax
call fcn.140008440
mov r8, qword [0x14001a5c0]
mov qword [0x14001a5c8], r8
mov rdx, qword [0x14001a5b0]
mov ecx, dword [0x14001a5a8]
call fcn.140004de0
mov edi, eax
mov dword [rsp + 0x20], eax
test ebx, ebx
jne 0x1400068e6
mov ecx, eax
call fcn.1400087c0
call fcn.1400087e0
jmp 0x140006904
mov eax, edi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
sub rsp, 0x28
call fcn.14000d140
add rsp, 0x28
jmp 0x1400066a0
Function at 0x1400080a0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x5b0
mov rbp, rcx
mov rcx, qword [0x14001a018]
mov ebx, r9d
mov rdi, r8
mov rsi, rdx
call fcn.14000b690
test rax, rax
je 0x1400080f4
mov r10, qword [rsp + 0x5e0]
mov r9d, ebx
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], r10
call rax
jmp 0x140008189
mov ecx, 2
call fcn.14000dbc0
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x98
call fcn.140005240
mov rax, qword [rsp + 0x5b8]
mov dword [rsp + 0x40], 0xc000000d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x140008175
test ebx, ebx
jne 0x140008175
lea ecx, [rax + 2]
call fcn.14000dbc0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc000000d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140008397
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140018008]
jne 0x14000522a
rol rcx, 0x10
test cx, 0xffff
jne 0x140005226
repz ret
ror rcx, 0x10
jmp 0x1400082f0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14001a0c0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14001a1b8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140008375
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14001a0c0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140008397
mov rax, qword [rsp + 0x88]
mov qword [0x14001a1b8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14001a158], rax
mov rax, qword [0x14001a1b8]
mov qword [0x14001a030], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14001a140], rax
mov dword [0x14001a020], 0xc0000409
mov dword [0x14001a024], 1
mov rax, qword [0x140018008]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140018010]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14001a0b8], eax
mov ecx, 1
call fcn.14000dbc0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140013d40]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14001a0b8], 0
jne 0x14000841e
mov ecx, 1
call fcn.14000dbc0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140008870
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
sub rsp, 0x30
lea r12, [0x1400185e0]
xor esi, esi
mov edi, ecx
mov rax, r12
mov ebx, esi
nop
cmp ecx, dword [rax]
je 0x1400088ae
add ebx, 1
add rax, 0x10
cmp ebx, 0x17
jb 0x140008890
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
cmp ebx, 0x17
jae 0x140008a95
mov ecx, 3
call fcn.14000e4b0
cmp eax, 1
je 0x140008a4c
mov ecx, 3
call fcn.14000e4b0
test eax, eax
jne 0x1400088e5
cmp dword [0x140018080], 1
je 0x140008a4c
cmp edi, 0xfc
je 0x140008a95
mov qword [rsp + 0x50], rbp
lea rbp, [0x14001a600]
lea r8, str.Runtime_Error__n_nProgram:
mov rcx, rbp
mov edx, 0x314
call fcn.14000bcb0
test eax, eax
je 0x140008929
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140008000
lea rdx, [0x14001a619]
mov r8d, 0x104
xor ecx, ecx
mov byte [0x14001a71d], sil
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x140008979
lea r8, str._program_name_unknown_
lea rcx, [0x14001a619]
mov edx, 0x2fb
call fcn.14000bcb0
test eax, eax
je 0x140008979
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140008000
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x14001a619]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 0x3c
jbe 0x1400089c8
lea rcx, [rcx + rbp - 0x23]
lea rdx, [0x14001a914]
lea r9d, [rax + 3]
lea r8, [0x140014324]
sub rdx, rcx
call fcn.14000e390
test eax, eax
je 0x1400089c8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140008000
lea r8, [0x140014320]
mov edx, 0x314
mov rcx, rbp
call fcn.14000e2d0
test eax, eax
je 0x1400089f4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140008000
movsxd r8, ebx
mov edx, 0x314
mov rcx, rbp
add r8, r8
mov r8, qword [r12 + r8*8 + 8]
call fcn.14000e2d0
test eax, eax
je 0x140008a24
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140008000
lea rdx, str.Microsoft_Visual_C_Runtime_Library
mov r8d, 0x12010
mov rcx, rbp
call fcn.14000e070
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x140008a95
cmp rax, 0xffffffffffffffff
je 0x140008a95
xor eax, eax
movsxd rcx, ebx
lea r9, [rsp + 0x58]
add rcx, rcx
mov qword [rsp + 0x20], rsi
mov rdx, qword [r12 + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x140008ab0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov ecx, 3
call fcn.14000e4b0
cmp eax, 1
je 0x140008ae2
mov ecx, 3
call fcn.14000e4b0
test eax, eax
jne 0x140008b96
cmp dword [0x140018080], 1
jne 0x140008b96
mov qword [rsp + 0x48], rbx
lea rbx, [0x1400185e0]
mov qword [rsp + 0x30], rdi
mov rax, rbx
xor edi, edi
cmp dword [rax], 0xfc
je 0x140008b0e
add edi, 1
add rax, 0x10
cmp edi, 0x17
jb 0x140008af8
jmp 0x140008b82
cmp edi, 0x17
jae 0x140008b82
mov ecx, 3
call fcn.14000e4b0
cmp eax, 1
je 0x140008b39
mov ecx, 3
call fcn.14000e4b0
test eax, eax
jne 0x140008b82
cmp dword [0x140018080], 1
jne 0x140008b82
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x140008b82
cmp rax, 0xffffffffffffffff
je 0x140008b82
movsxd rcx, edi
xor eax, eax
lea r9, [rsp + 0x40]
add rcx, rcx
mov qword [rsp + 0x20], rax
mov rdx, qword [rbx + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xff
call fcn.140008870
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret