joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140182780
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x1a0
mov rax, qword [0x14034e740]
xor rax, rsp
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x40
rep stosb byte [rdi], al
lea rax, [rsp + 0x80]
mov rdi, rax
xor eax, eax
mov ecx, 0x108
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, 0x40
mov rdx, qword [rsp + 0x1b8]
mov rcx, qword [rsp + 0x30]
call fcn.1401a2f90
test eax, eax
jne 0x140182865
movzx eax, word [rsp + 0x40]
cmp eax, 0x5a4d
jne 0x140182865
mov rax, qword [rsp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rsp + 0x38], rax
movsxd rax, dword [rsp + 0x7c]
mov rcx, qword [rsp + 0x1b8]
add rcx, rax
mov rax, rcx
mov byte [rsp + 0x20], 0
lea r9, [rsp + 0x80]
mov r8d, 0x108
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call fcn.1401a2f90
test eax, eax
jne 0x140182865
cmp dword [rsp + 0x80], 0x4550
jne 0x140182865
mov al, 1
jmp 0x140182867
xor al, al
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14023b7f0
add rsp, 0x1a0
pop rdi
ret

Function at 0x140184990
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x68
mov rax, qword [0x14034e740]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rax, [0x1403a66f8]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
cmp qword [rax + 0x10], 0
jne 0x1401849f5
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rsp + 0x2c]
call fcn.1401837d0
mov eax, eax
mov rcx, qword [rsp + 0x20]
mov qword [rcx], rax
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14023b7f0
add rsp, 0x68
ret

Function at 0x1401866f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rcx, qword [rsp + 0x40]
call fcn.1400dc800
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14018671b
mov dword [rsp + 0x20], 1
jmp 0x140186723
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x14018c6c0
Capabilities:
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x4b0
mov rax, qword [0x14034e740]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
lea rax, [rsp + 0xa0]
mov rdi, rax
xor eax, eax
mov ecx, 0x200
rep stosb byte [rdi], al
mov dword [rsp + 0x98], 0
lea rax, [rsp + 0x58]
mov rdi, rax
xor eax, eax
mov ecx, gethostname
rep stosb byte [rdi], al
mov dword [rsp + 0x58], gethostname
mov rax, qword [rsp + 0x4c0]
add rax, 0x50
mov r8, rax
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0x4c0]
call fcn.14018bb70
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x14018c754
xor eax, eax
jmp 0x14018c98f
cmp qword [rsp + 0x4c8], 0
jne 0x14018c8e0
lea rax, [rsp + 0x2a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x200
rep stosb byte [rdi], al
lea rdx, [rsp + 0x2a0]
mov ecx, 0x100
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
nop
lea r9, [rsp + 0xa0]
xor r8d, r8d
lea rdx, str.ImageManifest
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x14018c7b9
mov eax, 0xc0150002
jmp 0x14018c98f
mov edx, 8
lea rcx, [rsp + 0x90]
call fcn.140177f80
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x120116
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.140173150
nop
lea rcx, [rsp + 0x90]
call fcn.140175110
movzx eax, al
test eax, eax
je 0x14018c8b1
mov dword [rsp + 0x9c], 0
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x90]
call fcn.140175100
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x9c]
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0x90]
call fcn.14018db40
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x4c0]
add rax, 0x118
lea rdx, [rsp + 0xa0]
mov rcx, rax
call fcn.14015fc50
nop
jmp 0x14018c8d0
call fcn.140165740
mov dword [rsp + 0x44], eax
lea rcx, [rsp + 0x90]
call fcn.1401749e0
mov eax, dword [rsp + 0x44]
jmp 0x14018c98f
lea rcx, [rsp + 0x90]
call fcn.1401749e0
nop
jmp 0x14018c92c
mov dword [rsp + 0x5c], 8
mov rax, qword [rsp + 0x4c0]
movzx eax, word [rax + 0x50]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x4c8]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x4c0]
add rax, 0xf8
mov rcx, qword [rsp + 0x4c0]
add rcx, 0x118
mov rdx, rax
call fcn.14015fbb0
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CreateActCtxW]
mov rcx, qword [rsp + 0x4c0]
add rcx, 0x48
mov rdx, rax
call fcn.14018af50
nop
mov rax, qword [rsp + 0x4c0]
add rax, 0x48
mov rcx, rax
call fcn.14018b010
movzx eax, al
test eax, eax
je 0x14018c96b
xor eax, eax
jmp 0x14018c98f
call fcn.140165740
cmp eax, 0xc0000022
jne 0x14018c98a
mov rax, qword [rsp + 0x4c0]
mov dword [rax + 0x50], 0
xor eax, eax
jmp 0x14018c98f
call fcn.140165740
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.14023b7f0
add rsp, 0x4b0
pop rdi
ret
Function at 0x14018c9b0
Capabilities:
Delete file

Disassembly:
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
add rax, 0x10
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, qword [rsp + 0x20]
call fcn.14018dba0
mov rax, qword [rsp + 0x50]
add rax, 8
mov qword [rsp + 0x28], rax
xor edx, edx
mov rcx, qword [rsp + 0x28]
call fcn.14018db40
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
xor edx, edx
mov rcx, qword [rsp + 0x30]
call fcn.14018db40
mov rax, qword [rsp + 0x50]
add rax, 0x48
mov qword [rsp + 0x38], rax
xor edx, edx
mov rcx, qword [rsp + 0x38]
call fcn.14018dc00
mov rax, qword [rsp + 0x50]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x50]
mov qword [rax + 0x28], 0
movzx eax, byte [rsp + 0x58]
test eax, eax
jne 0x14018ca96
mov rax, qword [rsp + 0x50]
add rax, 0xf8
mov rcx, rax
call fcn.14018d830
nop
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0x1c]
test eax, eax
je 0x14018ca82
mov rax, qword [rsp + 0x50]
add rax, 0x118
mov rcx, rax
call fcn.1400dc800
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov rax, qword [rsp + 0x50]
add rax, 0x118
mov rcx, rax
call fcn.14018d830
nop
add rsp, 0x48
ret
Function at 0x1401a0e70
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x2b0
mov rax, qword [0x14034e740]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov edx, 8
lea rcx, [rsp + 0x80]
call fcn.1401a2550
xor edx, edx
lea rcx, [rsp + 0x80]
call fcn.14019f1f0
mov edx, 8
lea rcx, [rsp + 0x78]
call fcn.1401a2550
xor edx, edx
lea rcx, [rsp + 0x78]
call fcn.14019f1f0
mov dword [rsp + 0x88], 1
mov dword [rsp + 0x30], 0
lea rax, [rsp + 0x90]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x2d0]
call fcn.1400dc800
mov r9, rax
lea r8, str.___s
mov edx, 0x104
lea rcx, [rsp + 0x90]
call fcn.1401a2900
lea rcx, [rsp + 0x80]
call fcn.14019f7c0
mov r8, rax
lea rdx, str.systemCurrentControlSetServices
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x1401a0f7c
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x78]
call fcn.14019f5b0
lea rcx, [rsp + 0x80]
call fcn.14019f5b0
mov eax, dword [rsp + 0x40]
jmp 0x1401a10f2
lea rcx, [rsp + 0x78]
call fcn.14019f7c0
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x2c8]
call fcn.1400dc800
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x80]
call fcn.14019f7b0
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x1401a0ff7
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x44], eax
lea rcx, [rsp + 0x78]
call fcn.14019f5b0
lea rcx, [rsp + 0x80]
call fcn.14019f5b0
mov eax, dword [rsp + 0x44]
jmp 0x1401a10f2
lea rax, [rsp + 0x90]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x38], 0xffffffffffffffff
inc qword [rsp + 0x38]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x38]
cmp word [rax + rcx*2], 0
jne 0x1401a100d
mov rax, qword [rsp + 0x38]
lea rax, [rax + rax + 2]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x78]
call fcn.14019f7b0
mov rcx, qword [rsp + 0x70]
mov dword [rsp + 0x28], ecx
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x1401a109b
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x78]
call fcn.14019f5b0
lea rcx, [rsp + 0x80]
call fcn.14019f5b0
mov eax, dword [rsp + 0x48]
jmp 0x1401a10f2
lea rcx, [rsp + 0x78]
call fcn.14019f7b0
mov dword [rsp + 0x28], 4
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x20], rcx
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x4c], eax
lea rcx, [rsp + 0x78]
call fcn.14019f5b0
lea rcx, [rsp + 0x80]
call fcn.14019f5b0
mov eax, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.14023b7f0
add rsp, 0x2b0
pop rdi
ret
Function at 0x1401a18b0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xf0
mov rax, qword [0x14034e740]
xor rax, rsp
mov qword [rsp + 0xe8], rax
lea rax, [rsp + 0xb8]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WS2_32.dll_recv
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x108]
lea rdx, str._registrymachineSYSTEMCurrentControlSetServices_
lea rcx, [rsp + 0xc8]
call fcn.14019dac0
nop
call fcn.140176820
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0xc8]
call fcn.1400dc800
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x30], rax
lea rdx, [0x1402e4980]
lea rcx, [rsp + 0x58]
call fcn.1400d4c50
nop
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
call fcn.140199650
nop
lea rcx, [rsp + 0x58]
call fcn.1400d4b60
nop
call fcn.140176820
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x40], rax
lea rdx, [0x1402e4998]
lea rcx, [rsp + 0x78]
call fcn.1400d4c50
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
call fcn.14019f120
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x78]
call fcn.1400d4b60
nop
mov r8, qword [rsp + 0x108]
lea rdx, str.SYSTEMCurrentControlSetServices_
lea rcx, [rsp + 0x98]
call fcn.14019dac0
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.1400dc800
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rcx, [rsp + 0x98]
call fcn.1400dc870
nop
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0xc8]
call fcn.1400dc870
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0xe8]
xor rcx, rsp
call fcn.14023b7f0
add rsp, 0xf0
pop rdi
ret
Function at 0x1401b6af0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xf0
mov rax, qword [0x14034e740]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov dword [rsp + 0xb0], 0
lea rax, [rsp + 0xb4]
mov rdi, rax
xor eax, eax
mov ecx, Ordinal_46
rep stosb byte [rdi], al
lea rcx, [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
nop
movzx eax, word [rsp + 0xb0]
test eax, eax
jne 0x1401b6b8c
mov rax, qword [rsp + 0x100]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1401b65f0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x100]
add rax, 0x10
mov rdx, qword [rsp + 0x38]
mov rcx, rax
call fcn.1401b6260
lea rcx, [rsp + 0x40]
call fcn.1401b6830
nop
jmp 0x1401b6c37
mov dword [rsp + 0xa0], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0xa0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
nop
cmp dword [rsp + 0xa0], 1
jne 0x1401b6bf9
mov rax, qword [rsp + 0x100]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1401b6550
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x100]
add rax, 0x10
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.1401b6200
lea rcx, [rsp + 0x50]
call fcn.1401b67e0
nop
jmp 0x1401b6c37
mov rax, qword [rsp + 0x100]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1401b64b0
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x100]
add rax, 0x10
mov rdx, qword [rsp + 0x58]
mov rcx, rax
call fcn.1401b61b0
lea rcx, [rsp + 0x60]
call fcn.1401b6790
nop
mov rax, qword [rsp + 0x100]
add rax, 0x10
mov rcx, rax
call fcn.140160140
mov rcx, rax
call fcn.140165230
movzx eax, byte [rax + 5]
test eax, eax
jne 0x1401b6c6c
mov rax, qword [rsp + 0x100]
mov byte [rax + 0x18], 1
jmp 0x1401b6d2f
mov dword [rsp + 0xa4], 0
mov dword [rsp + 0xa8], 0
call fcn.140176820
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0xa4]
mov qword [rsp + 0x70], rax
lea rdx, [0x1402e5f38]
lea rcx, [rsp + 0x80]
call fcn.1400d4c50
nop
mov rax, qword [rsp + 0x100]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x70]
mov r8, rax
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
call fcn.1401b6690
mov dword [rsp + 0x34], eax
lea rcx, [rsp + 0x80]
call fcn.1400d4b60
cmp dword [rsp + 0x34], 0
je 0x1401b6d2f
mov eax, dword [rsp + 0xa4]
and eax, 1
test eax, eax
je 0x1401b6d17
mov dword [rsp + 0x30], 1
jmp 0x1401b6d1f
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x100]
movzx ecx, byte [rsp + 0x30]
mov byte [rax + 0x18], cl
xor eax, eax
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.14023b7f0
add rsp, 0xf0
pop rdi
ret
Function at 0x1401b9c20
Capabilities:
Connect pipe
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rax, qword [0x14034e740]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x60]
add rax, 0x38
mov rcx, rax
call fcn.140175100
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov rax, qword [rsp + 0x60]
mov byte [rax + 0x60], 1
mov rax, qword [rsp + 0x60]
movzx eax, byte [rax + 0x60]
test eax, eax
je 0x1401b9d16
lea rax, [rsp + 0x38]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WS2_32.dll_recv
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x60]
add rax, 0x38
mov rcx, rax
call fcn.140175100
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1401b9cd7
mov rax, qword [rsp + 0x60]
mov byte [rax + 0x60], 0
mov rax, qword [rsp + 0x60]
mov qword [rax + 0x48], 0
jmp 0x1401b9d16
cmp dword [rsp + 0x44], 0
je 0x1401b9ce5
cmp dword [rsp + 0x44], 2
jne 0x1401b9cfc
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.1401b9d50
nop
jmp 0x1401b9d11
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.1401bab40
nop
jmp 0x1401b9c66
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14023b7f0
add rsp, 0x50
pop rdi
ret
Function at 0x1401b9d50
Capabilities:
Create pipe

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x100
mov rax, qword [0x14034e740]
xor rax, rsp
mov qword [rsp + 0xf8], rax
lea rax, [rsp + 0xd8]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WLDAP32.dll_Ordinal_32
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x110]
add rax, 0x38
mov rcx, rax
call fcn.140175110
movzx eax, al
test eax, eax
jne 0x1401b9e3b
mov rax, qword [rsp + 0x110]
add rax, 0x18
mov r8, rax
lea rdx, [0x1402e60e8]
lea rcx, [rsp + 0x90]
call fcn.14019dac0
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.1400dc800
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 1
mov r8d, 4
mov edx, 3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rcx, qword [rsp + 0x110]
add rcx, 0x38
mov rdx, rax
call fcn.14018aea0
lea rcx, [rsp + 0x90]
call fcn.1400dc870
nop
call fcn.140162900
mov qword [rsp + 0x58], rax
lea rdx, [0x1402e60fc]
lea rcx, [rsp + 0x70]
call fcn.1400dc960
nop
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
call fcn.14019fbe0
nop
lea rcx, [rsp + 0x70]
call fcn.1400dc870
nop
call fcn.140162900
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x110]
mov rcx, qword [rax]
call fcn.14016d710
mov dword [rsp + 0x44], eax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x120]
mov r8, qword [rsp + 0x118]
mov edx, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x60]
call fcn.1401a0960
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jl 0x1401b9f66
lea rax, [rsp + 0xb0]
mov rdi, rax
xor eax, eax
mov ecx, Ordinal_27
rep stosb byte [rdi], al
lea rcx, [rsp + 0xc8]
call fcn.1401b8280
nop
call fcn.140162900
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x110]
mov rcx, qword [rax]
call fcn.14016d710
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x110]
add rax, 0x18
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8, rax
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x68]
call fcn.1401a0690
test eax, eax
jl 0x1401b9f58
mov rax, qword [rsp + 0x110]
add rax, 8
lea rdx, [rsp + 0xc8]
mov rcx, rax
call fcn.1401b7c40
nop
lea rcx, [rsp + 0xb0]
call fcn.1401b85c0
nop
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.14023b7f0
add rsp, 0x100
pop rdi
ret
Function at 0x1401bb850
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
mov byte [rax + 0x60], 0
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x48], 0
je 0x1401bb88c
xor edx, edx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x48]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x48], 0
mov rax, qword [rsp + 0x40]
add rax, 0x38
mov qword [rsp + 0x28], rax
xor edx, edx
mov rcx, qword [rsp + 0x28]
call fcn.14018db40
nop
mov dword [rsp + 0x20], 0
jmp 0x1401bb8bb
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 4
jge 0x1401bb8d3
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call fcn.1401ba1a0
nop
jmp 0x1401bb8b1
mov rax, qword [rsp + 0x40]
add rax, 8
mov rcx, rax
call fcn.1401bb770
movzx eax, al
test eax, eax
jne 0x1401bb931
mov rcx, qword [rsp + 0x40]
call fcn.1401baac0
test eax, eax
jge 0x1401bb931
mov rax, qword [rsp + 0x40]
add rax, 8
mov rcx, rax
call fcn.1401bb600
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x50], 0
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x58], 0
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x40], 0
add rsp, 0x38
ret
Function at 0x1401bd8b0
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
mov rax, qword [0x14034e740]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x20], 1
mov edx, Ordinal_27
mov rcx, qword [rsp + 0x98]
call fcn.1401bd4c0
mov rcx, qword [rsp + 0x98]
call fcn.1401bcbb0
nop
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov edx, 8
lea rcx, [rsp + 0x50]
call fcn.140177f80
xor edx, edx
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140173150
nop
lea rcx, [rsp + 0x50]
call fcn.140175110
movzx eax, al
test eax, eax
jne 0x1401bd97c
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x50]
call fcn.1401749e0
nop
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x1401bd96f
and dword [rsp + 0x20], 0xfffffffe
mov rcx, qword [rsp + 0x98]
call fcn.1401bcc80
nop
mov rax, qword [rsp + 0x98]
jmp 0x1401bda7b
lea rax, [rsp + 0x58]
mov rdi, rax
xor eax, eax
mov ecx, Ordinal_32
rep stosb byte [rdi], al
mov dword [rsp + 0x58], Ordinal_32
lea rcx, [rsp + 0x50]
call fcn.140175100
lea rdx, [rsp + 0x58]
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
mov dword [rsp + 0x24], eax
jmp 0x1401bd9cd
lea rcx, [rsp + 0x50]
call fcn.140175100
lea rdx, [rsp + 0x58]
mov rcx, rax
call sub.KERNEL32.dll_Thread32Next
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x1401bda42
mov rax, qword [rsp + 0x90]
mov rcx, qword [rax]
call fcn.14016d730
cmp dword [rsp + 0x64], eax
je 0x1401bd9ec
jmp 0x1401bd9b2
mov rax, qword [rsp + 0x90]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.1401bc760
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x98]
call fcn.1401bc670
nop
lea rcx, [rsp + 0x40]
call fcn.14015f590
nop
jmp 0x1401bd9b2
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x50]
call fcn.1401749e0
nop
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x1401bda73
and dword [rsp + 0x20], 0xfffffffe
mov rcx, qword [rsp + 0x98]
call fcn.1401bcc80
nop
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14023b7f0
add rsp, 0x80
pop rdi
ret
Function at 0x1401c2080
Capabilities:
Check for debugger via api
Create thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x14034e740]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x38], 0
je 0x1401c20c8
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 8]
call fcn.14016d730
mov rcx, qword [rsp + 0x50]
cmp dword [rcx + 0x38], eax
je 0x1401c20c8
mov rcx, qword [rsp + 0x50]
call fcn.1401c2020
nop
jmp 0x1401c20e7
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 8]
call fcn.14016d730
mov rcx, qword [rsp + 0x50]
cmp dword [rcx + 0x38], eax
jne 0x1401c20e7
xor eax, eax
jmp 0x1401c21a5
mov dword [rsp + 0x34], 0
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 8]
call fcn.140183420
mov rcx, rax
call fcn.140165230
cmp dword [rax], 2
jne 0x1401c2114
mov eax, 0xc0000024
jmp 0x1401c21a5
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 8]
call fcn.1401786e0
lea rdx, [rsp + 0x34]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
nop
cmp dword [rsp + 0x34], 1
jne 0x1401c213f
mov eax, 0xc0000718
jmp 0x1401c21a5
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x40], 0
je 0x1401c2152
mov eax, 0xc0000129
jmp 0x1401c21a5
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x50]
lea r8, [0x1401c25a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x40], rax
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x40], 0
je 0x1401c2198
mov dword [rsp + 0x30], 0
jmp 0x1401c21a1
call fcn.140165740
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14023b7f0
add rsp, 0x48
ret