joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140018078
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140050040]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rdx
mov byte [rbp - 0x40], 0
mov rbx, rcx
lea rdx, [rbp - 0x40]
lea rcx, [0x1400181a4]
mov rsi, r8
call qword [sym.imp.USER32.dll_EnumWindows]
call fcn.1400014ec
mov rcx, rax
test rax, rax
je 0x140018196
mov rax, qword [rax]
call qword [rax + 0x18]
mov r9, rsi
lea rdx, str._s_s.dmp
add rax, 0x18
lea rcx, [rbp - 0x38]
mov r8, rdi
mov qword [rbp - 0x38], rax
call fcn.14000c418
lea rcx, [rbp - 0x38]
call fcn.14000cc10
mov dl, byte [rbx]
lea r8, [rbp - 0x38]
mov cl, byte [rbp - 0x40]
xor r9d, r9d
call fcn.140018a54
cmp byte [rbx + 1], 0
je 0x14001815c
mov r9, rsi
lea rdx, str._s_s_full.dmp
mov r8, rdi
lea rcx, [rbp - 0x38]
call fcn.14000c418
lea rcx, [rbp - 0x38]
call fcn.14000cc10
mov rcx, qword [rbp - 0x38]
lea r8, [rbp - 0x30]
xorps xmm0, xmm0
xor eax, eax
xor edx, edx
mov dword [rbp - 0x10], eax
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x14001815c
mov dl, byte [rbx]
lea r8, [rbp - 0x38]
mov cl, byte [rbp - 0x40]
xor r9d, r9d
call fcn.140018a54
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001817a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140020030
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.1400013e0
int3
Function at 0x140018690
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rbp, rcx
lea rdx, str.ClientCustomData
lea rcx, [rsp + 0x30]
call fcn.140005590
call fcn.1400014ec
xor edi, edi
mov rcx, rax
test rax, rax
je 0x1400187fb
mov rax, qword [rax]
call qword [rax + 0x18]
mov r8, qword [rsp + 0x30]
lea rdx, str.__s__r_n
add rax, 0x18
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x78], rax
call fcn.14000c460
mov rax, qword [rsi]
mov rbx, qword [rax]
cmp rbx, rax
je 0x140018757
mov r9, qword [rbx + 0x28]
lea rdx, str._s_s_r_n
mov r8, qword [rbx + 0x20]
lea rcx, [rsp + 0x78]
call fcn.14000c460
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], dil
je 0x140018737
mov rax, qword [rbx + 8]
jmp 0x14001872c
cmp rbx, qword [rax + 0x10]
jne 0x140018732
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], dil
je 0x14001871f
mov rbx, rax
jmp 0x140018752
mov rcx, qword [rax]
mov rbx, rax
cmp byte [rcx + 0x19], dil
jne 0x140018752
mov rax, qword [rcx]
mov rbx, rcx
mov rcx, rax
cmp byte [rax + 0x19], dil
je 0x140018743
cmp rbx, qword [rsi]
jne 0x1400186f6
mov rbx, qword [rsp + 0x78]
lea r9, [rsp + 0x70]
mov dword [rsp + 0x70], edi
mov rdx, rbx
mov rcx, rbp
mov qword [rsp + 0x20], rdi
mov r8d, dword [rbx - 0x10]
add r8d, r8d
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400187a8
call fcn.14000cde4
lea rdx, [rbx - 0x18]
mov esi, eax
or ebx, 0xffffffff
mov ecx, ebx
lock xadd dword [rdx + 0x10], ecx
add ecx, ebx
test ecx, ecx
jg 0x1400187c7
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
jmp 0x1400187c7
lea rdx, [rbx - 0x18]
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1400187c5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov esi, edi
mov rdx, qword [rsp + 0x30]
mov ecx, ebx
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ecx
add ecx, ebx
test ecx, ecx
jg 0x1400187e7
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rbx, qword [rsp + 0x60]
test esi, esi
cmovs edi, esi
mov eax, edi
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.1400013e0
int3
Function at 0x14001afe0
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x140050040]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x200
call fcn.140038590
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0x100
lea rdx, [rsp + 0x30]
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
xor ebx, ebx
test eax, eax
je 0x14001b04d
lea rdx, str..brave.com
lea rcx, [rsp + 0x30]
call fcn.140006d54
test al, al
je 0x14001b04d
mov al, 1
jmp 0x14001b093
lea r8, [rsp + 0x28]
mov qword [rsp + 0x28], rbx
mov edx, 0x64
xor ecx, ecx
call qword [sym.imp.NETAPI32.dll_NetWkstaGetInfo]
mov rdi, qword [rsp + 0x28]
test eax, eax
jne 0x14001b088
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14001b088
lea rdx, [0x140048348]
call fcn.140033728
test eax, eax
jne 0x14001b088
mov bl, 1
mov rcx, rdi
call qword [sym.imp.NETAPI32.dll_NetApiBufferFree]
mov al, bl
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140020030
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret
Function at 0x14001c690
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
and qword [rbp - 0x20], 0
mov r14b, cl
xorps xmm0, xmm0
lea rcx, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
call fcn.14001be88
test eax, eax
js 0x14001c830
mov rax, qword [rbp - 0x28]
cmp qword [rbp - 0x30], rax
je 0x14001c830
call fcn.14001a10c
lea rax, str.HKCUSoftwareBraveSoftwareUpdate_
test r14b, r14b
lea rdx, str.HKLMSoftwareBraveSoftwareUpdate_
cmove rdx, rax
lea rcx, [rbp + 0x38]
call fcn.140005590
lea rdx, [0x140049578]
lea rcx, [rbp + 0x40]
call fcn.140005590
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x38]
lea rcx, [rbp + 0x48]
call fcn.140004d74
mov rdx, rax
lea rcx, [rbp + 0x38]
call fcn.140001868
mov rdx, qword [rbp + 0x48]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001c740
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001c75e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rbp + 0x38]
mov rcx, rbx
call fcn.14000b89c
test al, al
jne 0x14001c77f
mov dl, 1
mov cl, r14b
call fcn.14001c854
mov edi, eax
jmp 0x14001c810
and qword [rbp - 0x10], 0
lea rax, [0x140045c28]
mov r8d, 1
mov qword [rbp - 0x18], rax
mov rdx, rbx
mov dword [rbp - 8], 0x200
lea rcx, [rbp - 0x18]
call fcn.14000b130
mov edi, eax
test eax, eax
js 0x14001c7fc
mov rdi, qword [rbp - 0x28]
xor esi, esi
mov r15, qword [rbp - 0x30]
sub rdi, r15
sar rdi, 3
test rdi, rdi
je 0x14001c7f0
and qword [rsp + 0x28], 0
xor r9d, r9d
mov rdx, qword [r15 + rsi*8]
xor r8d, r8d
mov rcx, qword [rbp - 0x10]
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14001c82c
inc rsi
cmp rsi, rdi
jb 0x14001c7c4
xor edx, edx
mov cl, r14b
call fcn.14001c854
mov edi, eax
lea rax, [0x140045c28]
lea rcx, [rbp - 0x18]
mov qword [rbp - 0x18], rax
call fcn.14000aee8
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001c835
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x14001c835
xor edi, edi
jmp 0x14001c7fc
mov edi, 1
lea rcx, [rbp - 0x30]
call fcn.14000673c
mov rbx, qword [rsp + 0x90]
mov eax, edi
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001ce50
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
mov bl, cl
test cl, cl
je 0x14001ce7a
call fcn.14000c85c
test al, al
je 0x14001cf98
and qword [rbp - 0x28], 0
lea rsi, [0x140046c10]
lea rdx, [rbp - 0x30]
mov qword [rbp - 0x30], rsi
mov cl, bl
call fcn.14001c258
mov rax, qword [rbp - 0x30]
lea rcx, [0x14000ad80]
cmp qword [rax + 8], rcx
lea rcx, [rbp - 0x30]
jne 0x14001ceb2
or edx, 0xffffffff
call qword [rax + 0x18]
jmp 0x14001ceb5
call qword [rax + 8]
and qword [rbp - 0x18], 0
lea r14, [0x140045c28]
mov qword [rbp - 0x20], r14
mov dword [rbp - 0x10], 0x200
call fcn.14001a10c
lea rax, str.HKCUSoftwareBraveSoftwareUpdate_
test bl, bl
lea rdx, str.HKLMSoftwareBraveSoftwareUpdate_
mov r8d, 0xf003f
cmove rdx, rax
lea rcx, [rbp - 0x20]
call fcn.14000b130
test eax, eax
js 0x14001cf40
mov rcx, qword [rbp - 0x18]
lea rbx, [0x140049578]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rbp - 0x18]
lea rdx, str.old_uid
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r8, rbx
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 0x20]
call fcn.14000bd24
cmp byte [rbp + 0x1c], 0
jne 0x14001cf40
mov rcx, qword [rbp - 0x18]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rbp - 0x18]
mov qword [rbp - 0x20], r14
test rcx, rcx
je 0x14001cf5f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rbp - 0x18], 0
mov dword [rbp - 0x10], 0x200
mov rax, qword [rbp - 0x30]
mov rdx, qword [rax + 0x10]
lea rax, [0x14000adb0]
cmp rdx, rax
jne 0x14001cf7f
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x14001cf85
lea rcx, [rbp - 0x30]
call rdx
mov rcx, qword [rbp - 0x28]
mov qword [rbp - 0x30], rsi
test rcx, rcx
je 0x14001cf98
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x14001d0c4
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
test dl, dl
je 0x14001d0df
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
jmp 0x14001d0e5
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ecx, 0x409
lea r10, [0x140044560]
movzx edx, ax
mov r8, rdi
mov eax, ecx
cmp dx, ax
je 0x14001d112
inc r8
imul rax, r8, 0x1a
movzx eax, word [rax + r10]
test ax, ax
jne 0x14001d0f9
movzx edx, cx
mov r8d, edi
mov r9, rdi
cmp cx, dx
je 0x14001d13a
inc r9
inc r8d
imul rax, r9, 0x1a
movzx ecx, word [rax + r10]
test cx, cx
jne 0x14001d118
lea rdx, [0x1400428f0]
jmp 0x14001d14b
movsxd rax, r8d
imul rdx, rax, 0x1a
lea rax, [0x140044562]
add rdx, rax
mov rcx, rbx
call fcn.140005590
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14001e520
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rbx, rcx
mov rsi, rdx
lea rcx, [0x140050eb8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r15, qword [rsi + 0x28]
lea rcx, [0x140050eb8]
and qword [rsi + 0x28], 0
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test r15, r15
je 0x14001e631
lea rdi, [rbx + 0x38]
cmp qword [rdi], 0
mov r14, rdi
jne 0x14001e591
mov rdx, qword [rbx + 0x20]
lea r8, str.Counts
mov rcx, rdi
call fcn.14001e2a8
test eax, eax
jne 0x14001e631
lea r14, [rbx + 0x38]
mov rdx, qword [rsi + 8]
lea rcx, [rbp - 0x10]
call fcn.14000734c
mov rbx, qword [rbp - 0x10]
lea rax, [rbp + 0x38]
mov rcx, qword [rdi]
lea r9, [rbp + 0x40]
and qword [rbp + 0x48], 0
mov esi, 8
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp + 0x48]
mov dword [rbp + 0x38], esi
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001e5e3
cmp dword [rbp + 0x40], 3
jne 0x14001e5e3
cmp dword [rbp + 0x38], esi
je 0x14001e5f1
mov r8, rsi
lea rcx, [rbp + 0x48]
xor edx, edx
call fcn.140038590
mov rcx, qword [r14]
lea rax, [rbp + 0x48]
add qword [rbp + 0x48], r15
mov r9d, 3
mov dword [rsp + 0x28], esi
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001e631
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x14001e7e0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rdi, rcx
mov rsi, rdx
lea rcx, [0x140050eb8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [rsi + 0x28]
lea rcx, [0x140050eb8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov qword [rsp + 0x58], rbx
test rbx, rbx
je 0x14001e892
lea rbx, [rdi + 0x68]
cmp qword [rbx], 0
jne 0x14001e83e
mov rdx, qword [rdi + 0x20]
lea r8, str.Integers
mov rcx, rbx
call fcn.14001e2a8
test eax, eax
jne 0x14001e892
mov rdx, qword [rsi + 8]
lea rcx, [rsp + 0x60]
call fcn.14000734c
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rcx
mov r9d, 3
mov rcx, qword [rbx]
xor r8d, r8d
mov rdx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001e892
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x14001e8a4
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rdi, rcx
mov rsi, rdx
lea rcx, [0x140050eb8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [rsi + 0x28]
lea rcx, [0x140050eb8]
or dword [rsi + 0x28], 0xffffffff
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [rsp + 0x58], ebx
cmp ebx, 0xffffffff
je 0x14001e95b
lea rbx, [rdi + 0x80]
cmp qword [rbx], 0
jne 0x14001e907
mov rdx, qword [rdi + 0x20]
lea r8, str.Booleans
mov rcx, rbx
call fcn.14001e2a8
test eax, eax
jne 0x14001e95b
mov rdx, qword [rsi + 8]
lea rcx, [rsp + 0x60]
call fcn.14000734c
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rcx
mov r9d, 3
mov rcx, qword [rbx]
xor r8d, r8d
mov rdx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001e95b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x14001fcac
Capabilities:
Read pipe
Write file on windows
Write pipe

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x38]
sub rsp, 0x130
mov ebx, dword [rcx + 0x38]
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movups xmm0, xmmword [rdi + 0x28]
mov dword [rbp - 0x6c], eax
lea r9, [rsp + 0x40]
lea rax, [rdi + 0x5c]
mov dword [rbp - 0x68], ebx
xor ebx, ebx
mov qword [rbp - 0x60], rax
lea rax, [rdi + 0x60]
mov qword [rsp + 0x30], rbx
mov qword [rbp - 0x58], rax
lea rdx, [rbp - 0x70]
lea rax, [rdi + 0x68]
mov dword [rbp - 0x70], 1
mov qword [rbp - 0x50], rax
lea r8d, [rbx + 0x50]
lea rax, [rbp + 0x40]
mov qword [rbp - 0x38], rbx
movdqu xmmword [rbp - 0x48], xmm0
mov qword [rsp + 0x28], rax
mov rcx, rsi
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x50
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], ebx
movdqa xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
movups xmmword [rsp + 0x68], xmm1
mov qword [rsp + 0x78], rbx
movdqa xmmword [rbp - 0x80], xmm0
mov dword [rbp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
je 0x14001fdfc
cmp dword [rsp + 0x40], 2
jne 0x14001fdfc
cmp dword [rsp + 0x44], ebx
je 0x14001fdfc
cmp qword [rsp + 0x78], rbx
je 0x14001fdfc
cmp qword [rbp - 0x80], rbx
je 0x14001fdfc
cmp qword [rbp - 0x78], rbx
je 0x14001fdfc
xorps xmm0, xmm0
mov qword [rbp - 0x1c], rbx
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x10], xmm0
lea r9, [rbp + 0x40]
movdqa xmmword [rbp + 0x20], xmm0
lea r8d, [rbx + 0x50]
mov qword [rbp], rbx
lea rdx, [rbp - 0x20]
mov qword [rbp + 0x18], rbx
mov rcx, rsi
mov dword [rbp - 0x20], 3
movups xmmword [rbp + 8], xmm1
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14001fdfc
mov rcx, qword [rsp + 0x78]
mov al, 1
mov qword [rdi + 0x40], rcx
mov rcx, qword [rbp - 0x80]
mov qword [rdi + 0x48], rcx
mov rcx, qword [rbp - 0x78]
mov qword [rdi + 0x50], rcx
mov ecx, dword [rsp + 0x44]
mov dword [rdi + 0x58], ecx
jmp 0x14001fdfe
xor al, al
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x140020bd8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140020c22
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140020c22
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140020c22
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140020c22
cmp dword [rcx + 0x84], 0xe
jbe 0x140020c22
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140020c24
xor al, al
add rsp, 0x28
ret
Function at 0x140026160
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400261cf
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400261cf
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400261cf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400261cf
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400261cf
cmp dword [rcx + 0x84], 0xe
jbe 0x1400261cf
cmp dword [rcx + 0xf8], 0
je 0x1400261cf
mov ecx, ebx
call fcn.140026280
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14002605c
nop
cmp dword [rbp + 0x20], 0
je 0x14002621d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140026228
int3
xor r8d, r8d
xor edx, edx
jmp 0x140026160

Function at 0x140026364
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400261cf
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400261cf
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400261cf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400261cf
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400261cf
cmp dword [rcx + 0x84], 0xe
jbe 0x1400261cf
cmp dword [rcx + 0xf8], 0
je 0x1400261cf
mov ecx, ebx
call fcn.140026280
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14002605c
nop
cmp dword [rbp + 0x20], 0
je 0x14002621d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140026228
int3
xor r8d, r8d
xor edx, edx
jmp 0x140026160
Function at 0x14002e7d0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14002e857
mov rsi, rbx
cmp word [rax], bp
je 0x14002e816
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14002e800
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14002e7fc
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140030150
mov rdi, rax
test rax, rax
je 0x14002e844
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140038950
mov rbp, rdi
xor ecx, ecx
call fcn.14002cb0c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14003565c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140035672
mov al, 1
jmp 0x1400356d2
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140035683
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400356d0
mov ecx, dword [rcx + 0x18]
nop
call fcn.14002fe08
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400356d0
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400356d0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400356d0
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400356d2
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1400379d0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400379f8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400379f8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14000c43c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140014c60], rbx
je 0x14000c4a3
cmp rax, rbx
jne 0x14000c496
mov ebx, 1
mov esi, ebx
jmp 0x14000c4a8
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000c47b
mov ebx, 1
mov eax, dword [0x140014c68]
cmp eax, ebx
jne 0x14000c4c0
mov edi, 0x1f
mov ecx, edi
call fcn.140186000
jmp 0x14000c52c
mov eax, dword [0x140014c68]
test eax, eax
jne 0x14000c521
mov dword [0x140014c68], ebx
lea r15, [0x14000eba0]
lea rdi, [0x14000eb88]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14000c513
test eax, eax
jne 0x14000c517
cmp qword [rdi], r14
je 0x14000c508
mov rax, qword [rdi]
mov rcx, qword [0x14000eb40]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000c4ea
test eax, eax
je 0x14000c527
mov eax, 0xff
jmp 0x14000c682
mov dword [0x1400143e4], ebx
mov edi, 0x1f
mov eax, dword [0x140014c68]
cmp eax, ebx
jne 0x14000c553
lea rdx, [0x14000eb80]
lea rcx, [0x14000eb48]
call sub.msvcrt.dll__initterm
mov dword [0x140014c68], 2
test esi, esi
jne 0x14000c561
mov rax, r14
xchg qword [0x140014c60], rax
cmp qword [0x140014c80], r14
je 0x14000c594
lea rcx, [0x140014c80]
call fcn.14000ca70
test eax, eax
je 0x14000c594
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140014c80]
mov r9, qword [0x14000eb40]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000c5ad
mov eax, 0xff
jmp 0x14000c682
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14000c633
test ax, ax
je 0x14000c5c8
test edx, edx
jne 0x14000c633
sub ax, bx
cmp ax, di
ja 0x14000c5de
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14000c5c8
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001878
mov dword [0x1400143e0], eax
cmp dword [0x140014400], r14d
jne 0x14000c61c
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400143e4], r14d
jne 0x14000c631
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400143e0]
jmp 0x14000c682
cmp ax, 0x22
jne 0x14000c647
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000c5b6
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.14000caf0
add rsp, 0x28
jmp 0x14000c43c