joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14013b470
Capabilities:
Create process on windows
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x1402a6808]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov eax, dword [rcx + 0x58]
mov rbx, rcx
test eax, eax
je 0x14013b4b5
mov rcx, qword [rcx + 0x50]
test rcx, rcx
jne 0x14013b4a2
mov rcx, qword [rbx + 0x10]
mov r8, rax
xor r9d, r9d
mov edx, 0x111
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14013b52b
mov eax, dword [rcx + 0x6c]
xor r8d, r8d
mov dword [rcx + 0x68], eax
xor edx, edx
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.USER32.dll_UpdateWindow]
cmp qword [rbx + 0x30], 0
lea r8, [rbx + 0x20]
mov rax, qword [rbx + 0x38]
je 0x14013b4ee
cmp rax, 8
jb 0x14013b508
mov r8, qword [r8]
jmp 0x14013b508
mov rcx, qword [rbx + 0x18]
lea rdx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea r8, [rsp + 0x30]
mov dword [rsp + 0x28], 1
lea rdx, str.open
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14017f700
add rsp, 0x250
pop rbx
ret
Function at 0x14013ba40
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x60
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rdi, r9
mov rsi, rdx
mov r11, rcx
movabs r9, 0xcbf29ce484222325
mov qword [rax - 0x48], r9
xor r10d, r10d
movabs rcx, 0x100000001b3
mov qword [rsp + 0x28], r10
cmp r10, 4
jae 0x14013baaa
movzx eax, byte [r10 + r8]
xor r9, rax
mov qword [rsp + 0x20], r9
imul r9, rcx
mov qword [rsp + 0x20], r9
inc r10
jmp 0x14013ba84
mov r10, qword [r11 + 0x30]
and r10, r9
mov qword [rsp + 0x40], r10
mov rbx, qword [r11 + 8]
shl r10, 4
mov rcx, qword [r11 + 0x18]
cmp qword [rcx + r10], rbx
je 0x14013bad5
mov rbx, qword [rcx + r10 + 8]
mov rbx, qword [rbx]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x30], rbx
nop word [rax + rax]
cmp rbx, qword [rcx + r10]
je 0x14013bb37
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x30], rbx
mov eax, dword [rbx + 0x10]
cmp dword [r8], eax
jne 0x14013bb35
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rax], rcx
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rax + 8], rcx
dec qword [r11 + 0x10]
mov qword [rsp + 0x50], 0x18
mov edx, 0x18
mov rcx, rdi
call fcn.14017f5e4
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x14013bbc9
jmp 0x14013bae0
mov rax, qword [rdi]
cmp rbx, rax
je 0x14013bb6c
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r11 + 0x18]
add rdx, r10
mov rax, qword [rdx]
cmp rax, qword [r11 + 8]
jne 0x14013bb8a
mov qword [rdx], rdi
mov rax, qword [r11 + 0x18]
mov qword [r10 + rax + 8], rdi
jmp 0x14013bbb6
cmp rax, rbx
jne 0x14013bb94
mov qword [rdx], rdi
jmp 0x14013bbb6
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x14013bbb6
mov rdx, qword [r11 + 0x18]
mov rax, qword [rdx + r10 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r10 + 8], rcx
mov rcx, r11
call fcn.14013fd60
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x14013bbe0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx r9d, byte [r8 + 0x10]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov rdi, rdx
movzx eax, byte [r8 + 0x11]
mov rdx, qword [r10 + 0x30]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x12]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x13]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [r10 + 0x18]
and rdx, r9
shl rdx, 4
add rcx, rdx
mov rax, qword [rcx]
cmp qword [rcx + 8], r8
jne 0x14013bc74
cmp rax, r8
jne 0x14013bc6a
mov rax, qword [r10 + 8]
mov qword [rcx], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x14013bc7f
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
jmp 0x14013bc7f
cmp rax, r8
jne 0x14013bc7f
mov rax, qword [r8]
mov qword [rcx], rax
mov rax, qword [r8 + 8]
mov edx, 0x18
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r10 + 0x10]
call fcn.14017f5e4
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14013fa20
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push rsi
sub rsp, 0x48
movzx r8d, byte [rdx]
mov rbp, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov r9, rdx
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
mov rdx, qword [rbp + 8]
imul r8, rcx
xor r8, rax
imul r8, rcx
mov rcx, qword [rbp + 0x30]
and rcx, r8
mov r8, qword [rbp + 0x18]
mov rax, rcx
add rax, rax
add rcx, rcx
mov rax, qword [r8 + rax*8]
mov r10, qword [r8 + rcx*8]
lea r11, [r8 + rcx*8]
cmp r10, rdx
jne 0x14013fa9b
mov rcx, rdx
jmp 0x14013faa2
mov rcx, qword [r11 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14013fab4
mov ecx, dword [r9]
cmp dword [rax + 0x10], ecx
je 0x14013fab7
mov rax, qword [rax]
jmp 0x14013fa91
mov rax, rdx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x40], rdi
cmp rax, rdx
jne 0x14013fb41
mov rbx, qword [rdx]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rcx, [rbp + 8]
mov qword [rsp + 0x70], r9
lea rax, [rsp + 0x70]
lea r9, [0x140232356]
mov qword [rsp + 0x20], rax
mov rdi, qword [rbx + 8]
mov rdx, rbx
mov r8, rdi
call fcn.14010a370
mov rdx, rax
movabs rcx, 0x492492492492491
mov rax, qword [rbp + 0x10]
sub rcx, rax
cmp rcx, 1
jb 0x14013fb56
inc rax
mov rcx, rbp
mov qword [rbp + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [rdi], rdx
lea rdx, [rsp + 0x30]
mov r9, qword [rbp + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.14010a6b0
mov rax, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
add rax, 0x18
mov rbx, qword [rsp + 0x68]
add rsp, 0x48
pop rsi
pop rbp
ret
lea rcx, str.list_T__too_long
call fcn.14015d0f8
int3
Function at 0x1401462d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x20060
call fcn.140180000
sub rsp, rax
mov rax, qword [0x1402a6808]
xor rax, rsp
mov qword [rsp + 0x20050], rax
mov r9, qword [rcx + 8]
mov rdi, r8
mov rbx, rdx
mov r15, rcx
test r9, r9
je 0x140146439
xor esi, esi
cmp byte [rcx + 0x20], sil
je 0x140146350
movsxd rcx, dword [rcx]
cmp ecx, 1
je 0x14014632e
lea eax, [rcx - 2]
cmp eax, 1
ja 0x14014634c
lea edx, [rsi + 2]
jmp 0x140146333
mov edx, 3
lea rax, [0x140233e70]
mov r8d, 1
lea rcx, [rcx + rcx*2]
add rcx, rax
call fcn.1401b0144
mov byte [r15 + 0x20], sil
movsxd r10, dword [r15]
cmp r10d, 7
ja case.default.0x14014636f
lea rcx, [0x140000000]
mov r9d, dword [rcx + r10*4 + 0x146464]
add r9, rcx
jmp r9
mov r9, qword [r15 + 8]
mov r8d, 1
mov rdx, rdi
mov rcx, rbx
call fcn.1401b0144
mov rsi, rax
jmp 0x14014643b
lea rax, [rdi + rbx]
mov dword [rsp + 0x24], esi
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov word [rsp + 0x28], si
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x20], r10d
call fcn.140145bc0
mov rax, qword [rsp + 0x40]
mov ebx, esi
cmp qword [rsp + 0x38], rax
ja 0x14014642f
mov rdi, rsi
nop dword [rax + rax]
cmp dword [rsp + 0x24], esi
jne 0x1401463e5
movzx eax, word [rsp + 0x28]
inc ebx
mov word [rsp + rdi*2 + 0x50], ax
inc rdi
lea rcx, [rsp + 0x20]
call fcn.140145bc0
mov rbp, qword [rsp + 0x40]
mov r14, qword [rsp + 0x38]
cmp ebx, 0x10000
je 0x140146406
cmp r14, rbp
jbe 0x1401463d0
mov r9, qword [r15 + 8]
lea rcx, [rsp + 0x50]
movsxd rdx, ebx
mov r8d, 1
add rdx, rdx
call fcn.1401b0144
test rax, rax
je 0x140146439
mov ebx, esi
mov rdi, rsi
cmp r14, rbp
jbe 0x1401463d0
mov esi, 1
mov rax, rsi
jmp 0x14014643b
xor eax, eax
mov rcx, qword [rsp + 0x20050]
xor rcx, rsp
call fcn.14017f700
mov rbx, qword [rsp + 0x200a8]
add rsp, 0x20060
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14014d380
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x788]
sub rsp, 0x880
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x1402a6808]
xor rax, rsp
mov qword [rbp + 0x770], rax
mov rbx, rcx
call fcn.140148350
mov r9d, 0x40
lea r8, str.Recovery_initiating
lea rdx, str.Notepad_will_attempt_to_save_any_unsaved_data._However__dataloss_is_very_likely.
mov rcx, qword [0x1402bc140]
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rdx, [rsp + 0x70]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x1401e3030]
movdqu xmmword [rsp + 0x38], xmm1
xor edi, edi
mov word [rsp + 0x28], di
lea rax, [rsp + 0x70]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], di
jne 0x14014d420
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x28]
call fcn.140006d60
nop
mov r8d, 9
lea rdx, str.NRECOV
lea rcx, [rsp + 0x28]
call fcn.140006a90
lea rcx, [rbx + 0x20]
lea rdx, [rsp + 0x28]
call fcn.140089720
test al, al
je 0x14014d53e
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
movdqa xmm1, xmmword [0x1401e3030]
movdqu xmmword [rsp + 0x58], xmm1
mov word [rsp + 0x48], di
mov r8d, 0x8a
lea rdx, str.Notepad_was_able_to_successfully_recover_some_unsaved_documents__or_nothing_to_be_saved_could_be_found._r_nYou_can_find_the_results_at_:_r_n
lea rcx, [rsp + 0x48]
call fcn.140006d60
nop
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140006a90
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
mov r9d, 0x40
lea r8, str.Recovery_success
mov rcx, qword [0x1402bc140]
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14014d529
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14014d524
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14014d5db
call fcn.14017f5e4
movdqa xmm0, xmmword [0x1401e3030]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], di
jmp 0x14014d560
mov r9d, InitCommonControls
lea r8, str.Recovery_failure
lea rdx, str.Unfortunatly__Notepad_was_not_able_to_save_your_work._We_are_sorry_for_any_lost_data.
mov rcx, qword [0x1402bc140]
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x14014d59e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14014d599
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14014d5d5
call fcn.14017f5e4
movdqa xmm0, xmmword [0x1401e3030]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], di
mov rcx, qword [rbp + 0x770]
xor rcx, rsp
call fcn.14017f700
lea r11, [rsp + 0x880]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.1401a10ac
nop
call fcn.1401a10ac
nop
int3
Function at 0x140150d30
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
call fcn.140129490
call fcn.14000c980
cmp qword [rax + 0x32e58], 0
je 0x140150e17
mov rcx, qword [rbx + 0x18]
mov edx, 0x8ff
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x18]
mov edx, 0x8fe
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
mov edx, 0x8fe
mov qword [rsp + 0x20], 0xc80014
mov r8d, 0x406
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov rcx, qword [rbx + 0x18]
mov edx, 0x8fe
mov r9d, 1
mov qword [rsp + 0x20], 0x96
mov r8d, 0x405
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
mov edx, 0x8fe
mov qword [rsp + 0x20], 0
mov r8d, 0xf0
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
cmp rax, 1
je 0x140150e17
mov rcx, qword [rbx + 0x18]
mov edx, 0x8fe
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
add rsp, 0x30
pop rbx
jmp qword [sym.imp.USER32.dll_EnableWindow]
add rsp, 0x30
pop rbx
ret
Function at 0x140159010
Capabilities:
Check if file exists

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
mov rax, qword [0x1402a6808]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, rcx
xor r9d, r9d
mov edx, 0x110a
lea r8d, [r9 + 9]
mov rcx, qword [rcx + 0xa8]
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x14015914a
mov r8, rax
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.140157890
mov rdi, rax
lea rbx, [rsi + 0x140]
xor ebp, ebp
cmp rbx, rax
je 0x1401590a8
mov rcx, rbx
call fcn.1400068c0
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov word [rdi], bp
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x1401590ea
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401590e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14015916c
call fcn.14017f5e4
movdqa xmm0, xmmword [0x1401e3030]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], bp
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14015910a
mov rcx, qword [rbx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14015914a
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140159121
mov rcx, qword [rbx]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x14015914a
cmp qword [rbx + 0x18], 8
jb 0x140159135
mov rbx, qword [rbx]
mov r9, rbx
xor r8d, r8d
mov edx, 0x835
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14017f700
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
call fcn.1401a10ac
int3
Function at 0x14015bfc0
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov esi, r9d
mov ebp, r8d
mov r14, rdx
mov rbx, rcx
xor edi, edi
cmp qword [rcx + 8], rdi
jne 0x14015c014
lea rax, [rcx + 0x10]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
mov r9, qword [rcx]
lea r8, [0x14015c450]
xor edx, edx
xor ecx, ecx
call fcn.1401b3564
mov qword [rbx + 8], rax
mov ecx, 0x88
call fcn.14017f5a8
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14015c04b
mov ecx, dword [rsp + 0x80]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], esi
mov r9d, ebp
mov r8, r14
mov rdx, qword [rbx]
mov rcx, rax
call fcn.14015c620
mov rdi, rax
mov r8, rdi
mov rdx, qword [rbx + 8]
lea rcx, [0x14015c080]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_QueueUserAPC]

Function at 0x140181dd0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140181de3
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.1401823f0
lea rdx, [0x14029d038]
lea rcx, [rsp + 0x20]
call fcn.14019d50c
int3

Function at 0x14018db40
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1402be878]
xor edx, edx
jmp fcn.140181dd0

Function at 0x14018e4d0
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1402be878]
jmp fcn.140181dd0

Function at 0x14019a118
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x14019a1d4]
mov r9, qword [r9 + 8]
jmp fcn.14018a014

Function at 0x14019a1ac
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x14019a1e4]
mov r9, qword [r9 + 8]
jmp fcn.14018a014

Function at 0x1401b1134
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1401b0f60
Function at 0x1401bcf24
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1401bcc4a
call fcn.1401aafc0
mov dword [rax], 0x16
call fcn.1401a108c
jmp 0x1401bcd95
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1401bcd95
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x1401bcd95
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x1401bcc79
lock or dword [rcx + 0x14], 0x10
jmp 0x1401bcd95
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1401bcc8d
call fcn.1401c0b0c
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x1401bcc9d
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x1401bcca0
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.1401bb290
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.1401bc6a0
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x1401bcd83
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x1401bcd31
mov rcx, rbx
call fcn.1401bb290
cmp eax, 0xffffffff
je 0x1401bcd1c
mov rcx, rbx
call fcn.1401bb290
cmp eax, 0xfffffffe
je 0x1401bcd1c
mov rcx, rbx
call fcn.1401bb290
movsxd rdi, eax
lea r14, [0x1402bf050]
mov rcx, rbx
sar rdi, 6
call fcn.1401bb290
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x1401bcd23
lea rdx, [0x1402a6cf0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1401bcd31
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x1401bcd55
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x1401bcd55
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x1401bcd55
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x1401bcd73
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x1401bcd7e
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x1401bcd9a
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x1401bcc14
Function at 0x1400081b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1401ff978]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rsi, rcx
mov rcx, qword [rcx + 0x260]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
mov rdi, qword [rsi + 0x278]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x10]
mov rcx, rbx
call qword [fcn.140007f30]
mov rcx, rdi
call rbx
lea rax, [rsp + 0x30]
mov r9, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x1400081a0]
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400f84a0
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140016ad0
Capabilities:
Query service status
Stop service

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rbx, rcx
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov ecx, 0x254
mov eax, dword [rcx + rdx]
mov r8d, 0x250
test al, 1
jne 0x140016b17
or eax, 1
mov dword [rcx + rdx], eax
mov ecx, r8d
add rcx, rdx
call fcn.14000cb50
nop
cmp byte [r8 + rdx + 1], 0
je 0x140016b5d
lea rdx, str.unsigned_long___cdecl_MinifilterStopCommand::Execute_int_wchar_t____
lea rdi, [0x14020f300]
mov rcx, rdi
call fcn.14000de20
mov rax, qword [0x14020f300]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call fcn.14000daf0
movzx edx, al
mov rcx, rdi
call fcn.14000d9a0
mov rcx, rdi
call fcn.14000d8a0
mov rcx, qword [rbx + 8]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.14001ddf0
Function at 0x140016cc0
Capabilities:
Start service

Disassembly:
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov rsi, rcx
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov r14d, 0x254
mov eax, dword [r14 + rdi]
mov edx, 0x250
test al, 1
jne 0x140016d17
or eax, 1
mov dword [r14 + rdi], eax
mov ecx, edx
add rcx, rdi
call fcn.14000cb50
nop
mov ebx, edx
add rbx, rdi
lea rbp, [0x14020f300]
cmp byte [rbx + 1], 0
je 0x140016d60
lea rdx, str.unsigned_long___cdecl_MinifilterStartCommand::Execute_int_wchar_t____
mov rcx, rbp
call fcn.14000de20
mov rax, qword [0x14020f300]
movsxd rcx, dword [rax + 4]
add rcx, rbp
mov dl, 0xa
call fcn.14000daf0
movzx edx, al
mov rcx, rbp
call fcn.14000d9a0
mov rcx, rbp
call fcn.14000d8a0
mov eax, dword [r14 + rdi]
test al, 1
jne 0x140016d78
or eax, 1
mov dword [r14 + rdi], eax
mov rcx, rbx
call fcn.14000cb50
nop
cmp byte [rbx + 1], 0
je 0x140016db5
lea rdx, str.Start_Minifilter
mov rcx, rbp
call fcn.14000de20
mov rax, qword [0x14020f300]
movsxd rcx, dword [rax + 4]
add rcx, rbp
mov dl, 0xa
call fcn.14000daf0
movzx edx, al
mov rcx, rbp
call fcn.14000d9a0
mov rcx, rbp
call fcn.14000d8a0
mov rcx, qword [rsi + 8]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
jmp 0x14001dc70
push rbx
sub rsp, 0x150
mov qword [rsp + 0x20], 0xfffffffffffffffe
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x14001dd6d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
lea rcx, [rsp + 0x30]
cmp eax, 0x420
jne 0x14001dcee
call fcn.14000f0b0
xor eax, eax
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x140], 7
mov word [rsp + 0x128], ax
lea rdx, str.Cannot_start_service._ERROR_SERVICE_ALREADY_RUNNING
lea rcx, [rsp + 0x40]
call fcn.140015a20
lea rcx, [rsp + 0x40]
call fcn.14000f980
nop
jmp 0x14001dd5c
call fcn.14000f0b0
xor eax, eax
mov qword [rsp + 0x140], 7
mov qword [rsp + 0x138], rax
mov word [rsp + 0x128], ax
cmp ebx, 2
jne 0x14001dd34
lea rdx, str.Cannot_start_service._ERROR_FILE_NOT_FOUND
lea rcx, [rsp + 0x40]
call fcn.140015a20
lea rcx, [rsp + 0x40]
call fcn.14000f980
nop
jmp 0x14001dd5c
lea rdx, str.Cannot_start_service._Error
lea rcx, [rsp + 0x40]
call fcn.140015a20
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.140019f70
lea rcx, [rsp + 0x40]
call fcn.14000f980
nop
lea rcx, [rsp + 0x30]
call fcn.14000eac0
mov eax, 0x6e
jmp 0x14001dde5
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov ecx, 0x254
mov eax, dword [rcx + rdx]
mov r8d, 0x250
test al, 1
jne 0x14001dd9d
or eax, 1
mov dword [rcx + rdx], eax
mov ecx, r8d
add rcx, rdx
call fcn.14000cb50
nop
cmp byte [r8 + rdx + 1], 0
je 0x14001dde3
lea rdx, str.Service_started_successfully.
lea rbx, [0x14020f300]
mov rcx, rbx
call fcn.14000de20
mov rax, qword [0x14020f300]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call fcn.14000daf0
movzx edx, al
mov rcx, rbx
call fcn.14000d9a0
mov rcx, rbx
call fcn.14000d8a0
xor eax, eax
add rsp, 0x150
pop rbx
ret