joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008b180
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, r8
mov rax, qword [0x14021f030]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x4c], ntohl
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x3c], 8
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x14008b1ff
mov eax, dword [rsp + 0x4c]
and eax, 0xfffffff7
mov edi, 0x3f4
cmp eax, 3
jne 0x14008b1ff
cmp dword [rsp + 0x3c], 8
jne 0x14008b1ff
mov rax, qword [rsp + 0x40]
mov qword [rsi], rax
xor edi, edi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14019eb90
mov eax, edi
add rsp, 0x58
pop rdi
pop rsi
ret

Function at 0x14008b220
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1048
call fcn.14019eb30
sub rsp, rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14021f030]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea r14, [rsp + 0x840]
mov r8d, 0x800
mov rcx, r14
mov dl, 0xaa
call fcn.1401a0cc0
mov dword [rsp + 0x3c], 1
mov dword [rsp + 0x38], 0x800
mov rcx, qword [rbx + 8]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x3c]
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x14008b30c
mov eax, dword [rsp + 0x3c]
cmp eax, 2
je 0x14008b2bc
mov edi, 0x3f4
cmp eax, 1
jne 0x14008b30c
lea rdx, [rsp + 0x840]
jmp 0x14008b302
lea rdi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rdi
mov dl, 0xaa
call fcn.1401a0cc0
lea rcx, [rsp + 0x840]
mov rdx, rdi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
add eax, 0xfffffbff
mov edi, 0xea
cmp eax, 0xfffffc00
jb 0x14008b30c
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140071028
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14019eb90
mov eax, edi
add rsp, 0x1048
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14008b330
Capabilities:
Set registry value

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x14021f030]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x34], r8d
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14019eb90
mov eax, esi
add rsp, 0x40
pop rsi
ret

Function at 0x14008b390
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov eax, dword [rsp + 0x60]
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9d, eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x38
ret
Function at 0x14008b3c0
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rcx, r8
call fcn.1401c2da4
lea eax, [rax*2 + 2]
mov rcx, qword [rbx + 8]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x14008b810
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x14021f030]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp qword [rcx], 0
je 0x14008b94a
cmp dword [rsi + 8], 0xffffffff
je 0x14008b94a
lea rdi, [rsi + 0x10]
mov ebx, 0xa
cmp byte [rsi + 0x27], 0
jns 0x14008b857
mov ebx, dword [rsi + 0x20]
dec ebx
mov dword [rsp + 0x4c], ebx
mov eax, dword [rsi + 0x30]
mov r12, qword [rsi + 0x28]
sub eax, r12d
and eax, 0xfffffffe
add eax, 0xfffffffe
lea r14, [rsi + 0x40]
mov dword [rsi + 0x40], eax
lea r15, [rsi + 0x44]
mov edx, ebx
mov rcx, rdi
call fcn.14008d880
mov edx, dword [rsi + 8]
mov rcx, qword [rsi]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x4c]
mov r8, rax
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0xea
jne 0x14008b946
mov edx, dword [rsi + 0x40]
inc rdx
shr rdx, 1
mov r12, qword [rsi + 0x28]
mov rax, qword [rsi + 0x30]
sub rax, r12
mov rcx, rax
sar rcx, 1
sub rdx, rcx
jb 0x14008b8f9
lea rcx, [rsi + 0x28]
mov word [rsp + 0x4a], 0
inc rdx
lea r8, [rsp + 0x4a]
call fcn.14008bde0
mov r12, qword [rsi + 0x28]
mov rax, qword [rsi + 0x30]
sub rax, r12
and eax, 0xfffffffe
add eax, 0xfffffffe
mov dword [rsi + 0x40], eax
cmp dword [rsp + 0x4c], ebx
mov edx, 0x4000
cmovne edx, ebx
mov dword [rsp + 0x4c], edx
mov rcx, rdi
call fcn.14008d880
mov edx, dword [rsi + 8]
mov rcx, qword [rsi]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x4c]
mov r8, rax
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x14008b991
lea rax, [rsi + 0x10]
cmp byte [rsi + 0x27], 0
jns 0x14008b957
mov rax, qword [rax]
mov word [rax], 0
mov rax, qword [rsi + 0x28]
cmp qword [rsi + 0x30], rax
je 0x14008b9b8
mov word [rax], 0
mov dword [rsi + 0x40], 0
xor esi, esi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14019eb90
mov eax, esi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov eax, dword [rsi + 0x40]
inc rax
shr rax, 1
mov rcx, qword [rsi + 0x28]
mov rdx, qword [rsi + 0x30]
sub rdx, rcx
sar rdx, 1
cmp rdx, rax
jbe 0x14008b9b8
mov word [rcx + rax*2], 0
mov sil, 1
jmp 0x14008b974
lea rax, str.vector___index_out_of_bounds
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude_vector
lea r9, str.__n___size__
mov r8d, 0x5b7
call fcn.14003a2a8
int3

Function at 0x14008bae0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [rcx + 8]
cmp eax, 0xffffffff
je fcn.14008b810
dec eax
mov dword [rcx + 8], eax
jmp fcn.14008b810
Function at 0x14008bb20
Capabilities:
Query or enumerate registry key

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rcx
mov rax, qword [0x14021f030]
xor rax, rsp
mov qword [rsp + 0x70], rax
or r9d, 0x20019
mov qword [rsp + 0x20], rcx
mov rcx, rdx
mov rdx, r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008bba2
mov dword [rsp + 0x64], 0
mov rcx, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x28], xmm0
lea rdi, [rsp + 0x64]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x58], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x14008bbc4
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsi], 0
mov word [rsi + 0xc], 0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14019eb90
nop
add rsp, 0x78
pop rdi
pop rsi
ret
mov edx, dword [rsp + 0x64]
sub edx, 1
setb al
mov dword [rsi + 8], edx
mov rcx, qword [rsi]
test rcx, rcx
je 0x14008bba9
test al, al
jne 0x14008bba9
lea r8, [rsi + 0xc]
mov dword [rsp + 0x6c], 0x104
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x38], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
lea r9, [rsp + 0x6c]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14008bba9
jmp 0x14008bbaf

Function at 0x14008bcd0
Capabilities:
Query or enumerate registry key

Disassembly:
push rsi
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [0x14021f030]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov edx, dword [rcx + 8]
cmp edx, 0xffffffff
je 0x14008bd49
sub edx, 1
setb al
mov dword [rsi + 8], edx
mov rcx, qword [rsi]
test rcx, rcx
je 0x14008bd49
test al, al
jne 0x14008bd49
lea r8, [rsi + 0xc]
mov dword [rsp + 0x54], 0x104
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x4c], rax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
lea r9, [rsp + 0x54]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14008bd4f
mov word [rsi + 0xc], 0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14019eb90
nop
add rsp, 0x60
pop rsi
ret
Function at 0x14008c680
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rax, qword [0x14021f030]
xor rax, rsp
mov qword [rsp + 0x28], rax
movsd xmm6, qword [0x140234910]
xorpd xmm0, xmm0
ucomisd xmm6, xmm0
jne 0x14008c7d4
jp 0x14008c7d4
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov esi, eax
call rdi
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x140234920]
mov ecx, dword [0x14022f5ac]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14008c7f4
mov eax, dword [0x140234930]
mov ecx, dword [0x14022f5ac]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14008c82e
rdtsc
mov rdi, rax
mov rbx, rdx
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r14, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, esi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub r14, qword [0x140234928]
xorps xmm0, xmm0
cvtsi2sd xmm0, r14
cvtsi2sd xmm1, qword [rsp + 0x20]
divsd xmm0, xmm1
xorpd xmm6, xmm6
movsd xmm1, qword [0x1401f82c8]
ucomisd xmm1, xmm0
ja 0x14008c7d4
shl rbx, 0x20
or rdi, rbx
sub rdi, qword [0x140234918]
movq xmm1, rdi
punpckldq xmm1, xmmword [0x1401f82a0]
subpd xmm1, xmmword [0x1401f82b0]
movapd xmm6, xmm1
unpckhpd xmm6, xmm1
addsd xmm6, xmm1
divsd xmm6, xmm0
movsd qword [0x140234910], xmm6
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14019eb90
movapd xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x140234920]
call fcn.14019d470
cmp dword [0x140234920], 0xffffffff
jne 0x14008c702
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x140234918], rdx
lea rcx, [0x140234920]
call fcn.14019d508
jmp 0x14008c702
lea rcx, [0x140234930]
call fcn.14019d470
cmp dword [0x140234930], 0xffffffff
jne 0x14008c727
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
mov qword [0x140234928], rax
lea rcx, [0x140234930]
call fcn.14019d508
jmp 0x14008c727

Function at 0x14008f690
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
movzx eax, byte [0x140234970]
test al, 1
jne 0x14008f6ec
test rsi, rsi
je 0x14008f6e2
mov r14d, 0xffffffff
nop word cs:[rax + rax]
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14008f705
add rdi, rbx
sub rsi, rbx
jne 0x14008f6c0
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400eef90
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x1400f0ad0
int3
sub rsp, 0x28
lea r8, [0x140202a60]
call fcn.1400f0af0
mov eax, 1
add rsp, 0x28
ret
Function at 0x14008f710
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x14008f76b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jb 0x14008f751
call fcn.1400afa60
mov rcx, qword [rsi]
call fcn.14008a660
mov qword [rsi], 0
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14008f763
mov qword [rsi], rdi
call fcn.1400afa60
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x14008f785
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
int3

Function at 0x14008f910
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov edi, edx
mov rsi, rcx
mov rax, qword [0x14021f030]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x14008f93f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14008f942
mov rcx, qword [rsi]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x14008f966
mov dil, 1
test bl, bl
je 0x14008f9cd
cmp byte [rsi + 8], 0
je 0x14008f9ac
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14008f9af
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rsi + 8], 0
je 0x14008f97d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14008f980
mov rcx, qword [rsi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14008f993
xor edi, edi
jmp 0x14008f9cd
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rsi + 8], 0
je 0x14008f9bc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14008f9bf
mov rcx, qword [rsi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x14008f9cd
mov rcx, qword [rsi]
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dil, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14019eb90
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x14008fba0
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x14021f030]
xor rax, rsp
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x20], 0
test rdx, rdx
je 0x14008fc6a
mov rdi, rdx
mov qword [rsp + 0x38], 0xffffffffffffffff
mov r14, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call r14
mov rbx, rax
call r14
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x38]
mov rcx, rax
mov rdx, rdi
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rbx, qword [rsp + 0x38]
cmp qword [rsi], rbx
je 0x14008fc6a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jb 0x14008fc50
call fcn.1400afa60
mov rcx, qword [rsi]
call fcn.14008a660
mov qword [rsi], 0
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14008fc62
mov qword [rsi], rbx
call fcn.1400afa60
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14019eb90
mov rax, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14008ff90
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x188
movaps xmmword [rsp + 0x170], xmm6
mov ebp, r9d
mov r15d, r8d
mov r12, rdx
mov rsi, rcx
mov rax, qword [0x14021f030]
xor rax, rsp
mov qword [rsp + 0x168], rax
movabs rdi, 0xaaaaaaaaaaaaaaaa
movzx r14d, byte [0x1402212b0]
test r14b, 0x19
jne 0x14009023e
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x110], rdi
movaps xmm6, xmmword [0x1401e7440]
movaps xmmword [rsp + 0x100], xmm6
lea rbx, [rsp + 0x70]
mov rcx, r12
mov rdx, rbx
call fcn.1400b4b00
lea r13, [rsp + 0x100]
mov rcx, r13
mov rdx, rbx
call fcn.14008db70
mov rcx, rbx
call fcn.1400b0280
mov qword [rsp + 0xf0], rdi
movaps xmmword [rsp + 0xe0], xmm6
lea rbx, [rsp + 0xe0]
mov rcx, r12
mov rdx, rbx
call fcn.1400b6c30
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xa0], xmm0
movabs rax, 0x4000000070
mov qword [rsp + 0x70], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x78], rax
lea rax, str.runas
mov qword [rsp + 0x80], rax
cmp byte [rsp + 0x117], 0
jns 0x1400900b9
mov r13, qword [rsp + 0x100]
mov qword [rsp + 0x88], r13
cmp byte [rsp + 0xf7], 0
jns 0x1400900d3
mov rbx, qword [rsp + 0xe0]
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], 0
xor r15b, 1
movzx eax, r15b
mov dword [rsp + 0xa0], eax
mov qword [rsp + 0xa8], 0
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1400901ac
test bpl, bpl
je 0x1400901a2
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x160], rax
movaps xmmword [rsp + 0x150], xmm6
movaps xmmword [rsp + 0x140], xmm6
movaps xmmword [rsp + 0x130], xmm6
movaps xmmword [rsp + 0x120], xmm6
lea rdx, str.LaunchElevatedProcess
lea r8, str....._baseprocesslaunch_win.cc
lea rbx, [rsp + 0x50]
mov rcx, rbx
mov r9d, 0x9e
call fcn.1400afa40
lea r15, [rsp + 0x120]
mov rcx, r15
mov rdx, rbx
xor r8d, r8d
call fcn.14009d6e0
mov rcx, qword [rsp + 0xd8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, r15
call fcn.14009d740
mov rdx, qword [rsp + 0xd8]
jmp 0x1400901ae
xor edx, edx
mov rcx, rsi
call fcn.14008f710
cmp byte [rsp + 0xf7], 0
js 0x140090218
cmp byte [rsp + 0x117], 0
js 0x14009022f
test r14b, 0x19
mov rcx, qword [rsp + 0x48]
je 0x1400901e9
cmp byte [rcx], 0
je 0x1400901e9
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
call fcn.140086130
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14019eb90
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x170]
add rsp, 0x188
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0xe0]
call fcn.14019d34c
cmp byte [rsp + 0x117], 0
jns 0x1400901ca
mov rcx, qword [rsp + 0x100]
call fcn.14019d34c
jmp 0x1400901ca
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rdx, [0x1402212b0]
lea r8, str.LaunchElevatedProcess
mov cl, 0x58
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], r8
xor r9d, r9d
call fcn.14004e270
mov qword [rsp + 0x38], rax
jmp 0x14008fff6
Function at 0x140091a70
Capabilities:
Check if file exists
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [0x14021f030]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x90], rax
movaps xmm0, xmmword [0x1401e7440]
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
lea rdx, str.MapImageToMemory
lea r8, str....._base_filesmemory_mapped_file_win.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0x1b
call fcn.1400afa40
lea rcx, [rsp + 0x50]
xor edi, edi
mov rdx, rbx
xor r8d, r8d
call fcn.14009d6e0
mov rcx, rsi
call fcn.140091fd0
test al, al
je 0x140091c19
mov rcx, rsi
call fcn.140035dc0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 0x11000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rdi, rax
cmp qword [rsi + 0x40], rax
je 0x140091b84
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0x40]
inc rax
cmp rax, 2
jb 0x140091b63
call fcn.1400afa60
mov rcx, qword [rsi + 0x40]
call fcn.14008a660
mov qword [rsi + 0x40], 0
mov rax, rdi
inc rax
cmp rax, 2
jb 0x140091b78
mov qword [rsi + 0x40], rdi
call fcn.1400afa60
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [rsi + 0x40]
lea rax, [rdi + 1]
cmp rax, 2
jae 0x140091b95
xor edi, edi
jmp 0x140091c19
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
mov rcx, qword [rsi + 0x30]
movabs rbx, 0xfffffffc00000000
mov rax, rcx
and rax, rbx
cmp rax, qword [0x14022e988]
jne 0x140091bd7
call fcn.14003a3c8
and rbx, rdi
cmp rbx, qword [0x14022e988]
jne 0x140091beb
mov rcx, rdi
call fcn.14003a2ac
mov qword [rsi + 0x30], rdi
test rdi, rdi
je 0x140091b8e
lea rax, fcn.140033860
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rdi
lea rcx, [rsp + 0x30]
call fcn.1400ecb30
mov eax, dword [rax + 0x50]
mov qword [rsi + 0x38], rax
mov dil, 1
lea rcx, [rsp + 0x50]
call fcn.14009d740
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14019eb90
mov eax, edi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
Function at 0x140092240
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb0
mov esi, r9d
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x14021f030]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0xa0], r12
movaps xmm0, xmmword [0x1401e7440]
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
lea rdx, str.Read
lea r8, str....._base_files_file_win.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x42
call fcn.1400afa40
lea rcx, [rsp + 0x60]
mov rdx, r15
xor r8d, r8d
call fcn.14009d6e0
mov ebp, 0xffffffff
test r14, r14
js 0x140092376
test esi, esi
js 0x140092376
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], 0
call fcn.1400f33c0
test al, al
je 0x140092317
mov r9d, esi
lea rdx, str.File::Read
lea rcx, [rsp + 0x30]
mov r8, rbx
call fcn.1400f34b0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x2c]
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14009235b
mov ebp, dword [rsp + 0x2c]
test ebp, ebp
jns 0x14009236c
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebp, ebp
cmp eax, 0x26
setne bpl
neg ebp
lea rcx, [rsp + 0x30]
call fcn.1400f3450
lea rcx, [rsp + 0x60]
call fcn.14009d740
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.14019eb90
mov eax, ebp
add rsp, 0xb0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1400923b0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14021f030]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs r15, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x90], r15
movaps xmm0, xmmword [0x1401e7440]
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
lea rdx, str.ReadAtCurrentPos
lea r8, str....._base_files_file_win.cc
lea r14, [rsp + 0x30]
mov rcx, r14
mov r9d, 0x5f
call fcn.1400afa40
lea rcx, [rsp + 0x50]
mov rdx, r14
xor r8d, r8d
call fcn.14009d6e0
test esi, esi
js 0x1400924a2
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], 0
call fcn.1400f33c0
test al, al
je 0x14009246c
mov r9d, esi
lea rdx, str.File::ReadAtCurrentPos
lea rcx, [rsp + 0x30]
mov r8, rbx
call fcn.1400f34b0
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x2c]
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400924a9
mov esi, dword [rsp + 0x2c]
test esi, esi
jns 0x1400924ba
int3
mov esi, 0xffffffff
jmp 0x1400924c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x26
setne sil
neg esi
lea rcx, [rsp + 0x30]
call fcn.1400f3450
lea rcx, [rsp + 0x50]
call fcn.14009d740
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14019eb90
mov eax, esi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret