joyce8/EMBER2024-capa huggingface dataset:
Function at 0x141e2e070
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x141f1bb40]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rbx, rdx
mov qword [rsp + 0x78], rdx
xor edi, edi
mov dword [rsp + 0x30], edi
mov ecx, 0x10
call qword [sym.imp.KERNEL32.dll_GetUserGeoID]
mov word [rsp + 0x20], di
mov r9d, 3
lea r8, [rsp + 0x80]
mov edx, 4
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetGeoInfoW]
cmp eax, 3
jne 0x141e2e102
mov qword [rsp + 0x40], 3
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.141d80a30
movzx esi, ax
jmp 0x141e2e104
mov esi, edi
lea rcx, [rsp + 0x60]
call fcn.141e2e3b0
nop
mov qword [rbx], rdi
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rdi
mov dword [rsp + 0x30], 1
mov edi, 0xffffffff
test si, si
je 0x141e2e18d
movzx r8d, si
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.141e288b0
mov rdx, rax
mov rcx, qword [rbx]
mov rax, qword [rax]
mov qword [rbx], rax
mov qword [rdx], rcx
mov rcx, qword [rbx + 8]
mov rax, qword [rdx + 8]
mov qword [rbx + 8], rax
mov qword [rdx + 8], rcx
mov rcx, qword [rbx + 0x10]
mov rax, qword [rdx + 0x10]
mov qword [rbx + 0x10], rax
mov qword [rdx + 0x10], rcx
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x141e2e18d
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141e2e18d
mov rcx, qword [rsp + 0x40]
call fcn.141ec82c8
cmp qword [rbx + 0x10], 0
jne 0x141e2e1f2
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.141e28740
mov rdx, rax
mov rcx, qword [rbx]
mov rax, qword [rax]
mov qword [rbx], rax
mov qword [rdx], rcx
mov rcx, qword [rbx + 8]
mov rax, qword [rdx + 8]
mov qword [rbx + 8], rax
mov qword [rdx + 8], rcx
mov rcx, qword [rbx + 0x10]
mov rax, qword [rdx + 0x10]
mov qword [rbx + 0x10], rax
mov qword [rdx + 0x10], rcx
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x141e2e1f2
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141e2e1f2
mov rcx, qword [rsp + 0x40]
call fcn.141ec82c8
nop
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x141e2e20f
lock xadd dword [rax], edi
cmp edi, 1
jne 0x141e2e20f
mov rcx, qword [rsp + 0x60]
call fcn.141ec82c8
mov rax, rbx
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.141ec2250
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x141e43f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x30
mov r14, rdx
mov r13, rcx
mov rdi, qword [rdx]
mov rax, qword [rdx + 8]
movzx ebp, byte [rdi + rax]
mov byte [rdi + rax], 0xff
mov esi, ebp
shl rsi, 5
mov rax, qword [rdi + 0x80]
mov rcx, qword [rsi + rax + 0x18]
test rcx, rcx
je 0x141e43fa6
nop word [rax + rax]
mov rbx, qword [rcx + 8]
mov edx, 0x10
call fcn.141ec2270
mov rcx, rbx
test rbx, rbx
jne 0x141e43f90
mov rcx, qword [rdi + 0x80]
movzx eax, byte [rdi + 0x89]
mov byte [rsi + rcx], al
mov byte [rdi + 0x89], bpl
dec qword [r13 + 8]
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x20], xmm0
movabs rbp, 0xe38e38e38e38e39
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
inc rsi
mov qword [rsp + 0x28], rsi
cmp rsi, 0x80
jne 0x141e4402f
xor esi, esi
mov qword [rsp + 0x28], rsi
add rbx, 0x90
mov rcx, rbx
sub rcx, qword [r13 + 0x20]
mov rax, rbp
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, qword [r13 + 0x10]
shr rax, 7
cmp rdx, rax
cmove rbx, qword [r13 + 0x20]
mov qword [rsp + 0x20], rbx
movzx edx, byte [rsi + rbx]
cmp rdx, 0xff
je 0x141e44188
shl rdx, 5
add rdx, qword [rbx + 0x80]
mov r10, qword [r13 + 0x10]
movsxd rcx, dword [rdx]
shl rcx, 4
movsxd rax, dword [rdx + 4]
add rcx, rax
add rcx, qword [rdx + 8]
xor rcx, qword [r13 + 0x18]
lea rax, [r10 - 1]
and rcx, rax
mov r9, qword [r13 + 0x20]
mov rax, rcx
shr rax, 7
lea r8, [rax + rax*8]
shl r8, 4
add r8, r9
and ecx, 0x7f
cmp r8, rbx
jne 0x141e44093
cmp rcx, rsi
je 0x141e43fe0
cmp r8, qword [r14]
jne 0x141e4409e
cmp rcx, qword [r14 + 8]
je 0x141e440de
inc rcx
cmp rcx, 0x80
jne 0x141e44085
xor ecx, ecx
add r8, 0x90
mov rdx, r8
sub rdx, r9
mov rax, rbp
imul rdx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, r10
shr rax, 7
cmp rdx, rax
jne 0x141e44085
mov r8, r9
jmp 0x141e44085
mov rdi, qword [r14]
cmp rbx, rdi
jne 0x141e44103
mov rcx, qword [r14 + 8]
movzx eax, byte [rdi + rsi]
mov byte [rdi + rcx], al
mov byte [rdi + rsi], 0xff
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [r14], xmm0
jmp 0x141e43fe0
mov r15, qword [r14 + 8]
movzx eax, byte [rdi + 0x88]
cmp byte [rdi + 0x89], al
jne 0x141e4411e
mov rcx, rdi
call fcn.141dcdd90
movzx eax, byte [rdi + 0x89]
mov byte [r15 + rdi], al
movzx r8d, byte [rdi + 0x89]
shl r8, 5
add r8, qword [rdi + 0x80]
movzx eax, byte [r8]
mov byte [rdi + 0x89], al
movzx edx, byte [rsi + rbx]
mov byte [rsi + rbx], 0xff
mov ecx, edx
shl rcx, 5
add rcx, qword [rbx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [r8], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [r8 + 0x10], xmm1
movzx eax, byte [rbx + 0x89]
mov byte [rcx], al
mov byte [rbx + 0x89], dl
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [r14], xmm0
jmp 0x141e43fe0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
ret
Function at 0x141e4b730
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rdi, rcx
lea rax, [0x1400c0948]
mov qword [rcx], rax
xor r15d, r15d
cmp byte [rcx + 0x100], r15b
je 0x141e4b88c
cmp qword [rcx + 0xf8], r15
je 0x141e4b88c
mov rbx, qword [rcx + 0xf0]
mov rcx, rbx
call fcn.141e4d2e0
test rax, rax
je 0x141e4b88c
cmp byte [rbx + 0x28], r15b
jne 0x141e4b88c
mov rcx, rbx
call fcn.141e4d2e0
test rax, rax
je 0x141e4b88c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r15
lea rcx, [rsp + 0x38]
call fcn.141d45210
mov rsi, rax
cmp qword [rdi + 0xf8], r15
je 0x141e4b7ed
mov rbx, qword [rdi + 0xf0]
mov rcx, rbx
call fcn.141e4d2e0
test rax, rax
je 0x141e4b7ed
cmp byte [rbx + 0x28], r15b
jne 0x141e4b7ed
mov rcx, rbx
call fcn.141e4d2e0
jmp 0x141e4b7f0
mov rax, r15
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
test eax, eax
je 0x141e4b86a
mov rdx, qword [rdi + 0xf0]
mov r8, qword [rdx + 0x10]
mov qword [rsp + 0x20], r8
mov rcx, qword [rdx + 0x18]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rdx + 0x20]
mov qword [rsp + 0x30], rcx
test r8, r8
je 0x141e4b82d
lock inc dword [r8]
lea rcx, [rsp + 0x20]
call fcn.141d45210
mov r8, rax
lea rdx, [0x1400c0a70]
mov ecx, ebx
call fcn.141d47a40
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x141e4b86a
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141e4b86a
mov rcx, qword [rsp + 0x20]
call fcn.141ec82c8
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x141e4b88c
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141e4b88c
mov rcx, qword [rsp + 0x38]
call fcn.141ec82c8
mov ebx, r15d
cmp qword [rdi + 0xf8], rbx
jle 0x141e4b8f5
mov r14, r15
nop dword [rax + rax]
mov rax, qword [rdi + 0xe8]
test rax, rax
je 0x141e4b8b3
mov eax, dword [rax]
cmp eax, 1
jle 0x141e4b8c7
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rdi + 0xe8]
call fcn.141e4e570
mov rbp, qword [rdi + 0xf0]
mov rcx, qword [rbp + r14 + 8]
test rcx, rcx
je 0x141e4b8de
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + r14 + 8], r15
inc ebx
add r14, 0x30
movsxd rax, ebx
cmp rax, qword [rdi + 0xf8]
jl 0x141e4b8a0
mov rcx, qword [rdi + 0xe8]
test rcx, rcx
je 0x141e4b965
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141e4b965
mov rbx, qword [rdi + 0xf0]
mov rax, qword [rdi + 0xf8]
lea rsi, [rax + rax*2]
shl rsi, 4
add rsi, rbx
cmp rbx, rsi
je 0x141e4b959
nop dword [rax]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x141e4b950
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141e4b950
mov rcx, qword [rbx + 0x10]
call fcn.141ec82c8
add rbx, 0x30
cmp rbx, rsi
jne 0x141e4b930
mov rcx, qword [rdi + 0xe8]
call fcn.141ec82c8
mov rcx, rdi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
jmp fcn.141de6f40
Function at 0x141e4cdf0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov r15d, edx
mov rbp, rcx
mov r8d, 2
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.141e4bfe0
nop
xor r12d, r12d
mov edi, r12d
cmp qword [rsp + 0x58], rdi
jle 0x141e4cf53
mov r14d, r15d
or r14d, 0x2001f
mov esi, r12d
nop
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rcx + rsi]
mov qword [rsp + 0x30], rdx
mov rax, qword [rcx + rsi + 8]
mov qword [rsp + 0x38], rax
mov rax, qword [rcx + rsi + 0x10]
mov qword [rsp + 0x40], rax
test rdx, rdx
je 0x141e4ce6a
lock inc dword [rdx]
mov qword [rsp + 0xa0], r12
lea rcx, [rsp + 0x30]
call fcn.141d45210
mov rdx, rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, r14d
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x141e4cedc
mov rbx, qword [rsp + 0xa0]
test rbx, rbx
je 0x141e4cedc
mov edx, r15d
mov rcx, rbx
call fcn.141e4cdf0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x30]
call fcn.141d45210
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
test eax, eax
jne 0x141e4cf14
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x141e4cefe
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141e4cefe
mov rcx, qword [rsp + 0x30]
call fcn.141ec82c8
inc edi
add rsi, 0x18
movsxd rax, edi
cmp rax, qword [rsp + 0x58]
jl 0x141e4ce40
jmp 0x141e4cf53
lea rcx, [rsp + 0x30]
call fcn.141d45210
mov r8, rax
lea rdx, [0x1400c0910]
mov ecx, ebx
call fcn.141d47a40
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x141e4cf53
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141e4cf53
mov rcx, qword [rsp + 0x30]
call fcn.141ec82c8
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x141e4cfb3
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141e4cfb3
mov rax, qword [rsp + 0x58]
lea rcx, [rax + rax*2]
mov rbx, qword [rsp + 0x50]
lea rdi, [rbx + rcx*8]
cmp rbx, rdi
je 0x141e4cfa9
mov rcx, qword [rbx]
test rcx, rcx
je 0x141e4cfa0
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141e4cfa0
mov rcx, qword [rbx]
call fcn.141ec82c8
add rbx, 0x18
cmp rbx, rdi
jne 0x141e4cf82
mov rcx, qword [rsp + 0x48]
call fcn.141ec82c8
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x141e52520
Capabilities:
Read file on windows
Read pipe

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor r14d, r14d
lea rax, [rsp + 0x60]
cmp dword [rcx + 0x9c], 1
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov edi, r14d
mov r15d, 0x1000
mov qword [rsp + 0x28], r14
cmove edi, r15d
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x141e52571
mov eax, dword [rsp + 0x60]
jmp 0x141e52580
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x98], eax
mov eax, r14d
cmp eax, edi
cmovb eax, edi
mov edi, eax
test eax, eax
je 0x141e526dc
cmp dword [rbx + 0x98], r14d
jne 0x141e526dc
mov qword [rsp + 0x70], rbp
mov rax, qword [rbx + 0x50]
test rax, rax
je 0x141e525bf
sub rax, qword [rbx + 0x70]
cmp rdi, rax
jle 0x141e525bf
mov rdi, rax
test rax, rax
jle 0x141e526d7
mov rdx, rdi
lea rcx, [rbx + 0x58]
call fcn.141dfb7b0
lea rcx, [rbx + 0x30]
mov r8d, edi
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x60]
mov rcx, qword [rbx + 0x10]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x141e5260d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x141e526bf
test eax, eax
je 0x141e5260d
cmp eax, 0xea
jne 0x141e526a8
mov eax, dword [rsp + 0x60]
lea rcx, [rbx + 0x58]
add qword [rbx + 0x88], rax
mov byte [rbx + 0xa2], 1
mov rdx, qword [rbx + 0x70]
sub rdx, qword [rbx + 0x80]
sub rdx, qword [rbx + 0x88]
call fcn.141dfae20
cmp dword [rbx + 0x9c], 2
je 0x141e526d7
mov rcx, qword [rbx + 0x10]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], r14
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x141e52672
mov eax, dword [rsp + 0x68]
jmp 0x141e52681
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x98], eax
mov eax, r14d
cmp eax, r15d
cmovb eax, r15d
mov edi, eax
cmp dword [rbx + 0x98], r14d
je 0x141e525a1
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov rbp, qword [rsp + 0x70]
mov dword [rbx + 0x98], eax
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov rdx, qword [rbx + 0x18]
xor r8d, r8d
mov rcx, qword [rbx + 0x28]
mov byte [rbx + 0xa0], 1
call qword [sym.imp.KERNEL32.dll_SetThreadpoolWait]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x141e53060
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x141e53159
mov qword [rsp + 0x60], rbp
lea rbp, [rcx + 0x30]
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x30], r14
lea r14, [0x1400479f4]
mov qword [rsp + 0x38], rdi
mov rax, qword [rbx + 0x58]
lea r9, [rsp + 0x50]
mov rcx, r14
mov qword [rsp + 0x20], rbp
mov r8, qword [rax + 0x20]
sub r8, qword [rax + 0x18]
mov rdx, qword [rax + 0x18]
mov rax, qword [rax + 8]
test rax, rax
cmovne rcx, rax
add rdx, rcx
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x141e530e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x3e5
je 0x141e5312d
mov ecx, eax
test eax, eax
jne 0x141e53102
mov edx, dword [rsp + 0x50]
lea rcx, [rbx + 0x50]
add qword [rbx + 0x78], rdx
mov byte [rbx + 0x92], 1
call fcn.141dfb2c0
cmp qword [rbx + 0x68], 0
je 0x141e53145
jmp 0x141e53093
sub ecx, 0xe8
je 0x141e53125
sub ecx, 1
je 0x141e53125
cmp ecx, 0x2fa
je 0x141e53125
lea rdx, [0x1400c1170]
mov ecx, edi
call fcn.141d47a40
mov dword [rbx + 0x88], edi
jmp 0x141e53145
mov rdx, qword [rbx + 0x18]
xor r8d, r8d
mov rcx, qword [rbx + 0x28]
mov byte [rbx + 0x91], 1
call qword [sym.imp.KERNEL32.dll_SetThreadpoolWait]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov r14, qword [rsp + 0x30]
add rsp, 0x40
pop rbx
ret
Function at 0x141e53f40
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov rax, rdx
mov rbx, rcx
xor esi, esi
mov dword [rbp - 0x50], esi
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
mov dword [rbp - 0x50], 1
lea r9, [rbp + 0x30]
xor r8d, r8d
mov edx, 0x4000
mov rcx, rax
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x141e54066
mov rdi, 0xffffffffffffffff
mov r8, rdi
mov rdx, qword [rbp + 0x30]
lea rcx, [rbp - 0x18]
call fcn.141d3e900
nop
mov rcx, qword [rax]
mov qword [rbp - 0x30], rcx
mov rcx, qword [rax + 8]
mov qword [rbp - 0x28], rcx
mov rcx, qword [rax + 0x10]
mov qword [rbp - 0x20], rcx
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov dword [rbp - 0x50], 0x11
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x141e53fec
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141e53fec
mov rcx, qword [rbp - 0x18]
call fcn.141ec82c8
nop
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x48]
call fcn.141d52d30
nop
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x141e54017
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141e54017
mov rcx, qword [rbp - 0x30]
call fcn.141ec82c8
mov rdx, qword [rbx]
mov rax, qword [rbp - 0x48]
mov qword [rbx], rax
mov qword [rbp - 0x48], rdx
mov rcx, qword [rbx + 8]
mov rax, qword [rbp - 0x40]
mov qword [rbx + 8], rax
mov qword [rbp - 0x40], rcx
mov rcx, qword [rbx + 0x10]
mov rax, qword [rbp - 0x38]
mov qword [rbx + 0x10], rax
mov qword [rbp - 0x38], rcx
test rdx, rdx
je 0x141e5405c
lock xadd dword [rdx], edi
cmp edi, 1
jne 0x141e5405c
mov rcx, qword [rbp - 0x48]
call fcn.141ec82c8
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, rbx
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x141e6a370
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rax, qword [0x141f1bb40]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov r14, rcx
mov rdx, rcx
lea rcx, [rbp - 0x21]
call fcn.141daa840
nop
mov dword [rbp - 0x39], 0x18
xor r15d, r15d
mov qword [rbp - 0x31], r15
mov dword [rbp - 0x29], r15d
lea rdx, [rbp - 0x71]
lea rcx, [rbp - 0x21]
call fcn.141dab300
nop
mov rcx, rax
call fcn.141d45210
mov rcx, rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov ebx, 1
mov dword [rsp + 0x20], ebx
lea r9, [rbp - 0x39]
mov r8d, ebx
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
mov edi, 0xffffffff
mov rax, qword [rbp - 0x71]
test rax, rax
je 0x141e6a425
mov ecx, edi
lock xadd dword [rax], ecx
cmp ecx, ebx
jne 0x141e6a425
mov rcx, qword [rbp - 0x71]
call fcn.141ec82c8
cmp rsi, 0xffffffffffffffff
jne 0x141e6a4d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
sub ecx, 5
je 0x141e6a48f
sub ecx, 0x1b
je 0x141e6a54c
sub ecx, 0x30
je 0x141e6a54c
cmp ecx, 0x67
je 0x141e6a54c
mov qword [rbp - 0x71], 2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x69], xmm0
lea rcx, [0x1400f0a68]
mov qword [rbp - 0x59], rcx
mov r8d, eax
lea rdx, [0x1400c1c58]
lea rcx, [rbp - 0x71]
call fcn.141d4a260
mov ebx, 3
jmp 0x141e6a54c
lea rdx, [rbp - 0x71]
lea rcx, [rbp - 0x21]
call fcn.141dab300
nop
mov rcx, rax
call fcn.141d45210
lea r8, [rbp + 0x17]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
neg eax
sbb ebx, ebx
add ebx, 2
mov rcx, qword [rbp - 0x71]
test rcx, rcx
je 0x141e6a54c
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141e6a54c
mov rcx, qword [rbp - 0x71]
jmp 0x141e6a546
mov qword [r14 + 0x18], rsi
lea rdx, [rbp - 0x51]
mov rcx, r14
call fcn.141e50e10
mov dword [rbp - 0x79], r15d
mov ebx, r15d
lea rdx, [0x1400479f4]
mov rax, qword [rbp - 0x49]
test rax, rax
cmovne rdx, rax
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x79]
mov r8d, dword [rbp - 0x41]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x141e6a529
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x141e6a52e
mov ebx, 3
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x141e6a54c
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141e6a54c
mov rcx, qword [rbp - 0x51]
call fcn.141ec82c8
nop
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x141e6a569
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141e6a569
mov rcx, qword [rbp - 9]
call fcn.141ec82c8
mov rax, qword [rbp - 0x21]
test rax, rax
je 0x141e6a584
lock xadd dword [rax], edi
cmp edi, 1
jne 0x141e6a584
mov rcx, qword [rbp - 0x21]
call fcn.141ec82c8
mov eax, ebx
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.141ec2250
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x141e7bd70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov word [rsp + 0x18], r8w
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x98
mov rdi, qword [rsp + 0x100]
mov rsi, r9
mov r13, qword [rsp + 0x108]
xor r9d, r9d
mov rbx, rdx
mov qword [rsp + 0x30], r9
xor edx, edx
mov qword [rsp + 0x40], r9
mov r8, qword [rdi + 0x38]
lea rax, [rsi - 0x50]
mov r11d, dword [r13 + 0xd0]
mov ebp, r9d
mov r12, qword [rdi + 0x30]
mov r14d, r11d
mov qword [rsp + 0x78], rax
mov r15d, r9d
mov rax, r8
shr r14d, 0x13
div rsi
mov dword [r12 + 0x30], r9d
and r14d, 1
mov dword [r12 + 0x6c], r9d
mov dword [r12 + 0x68], 0xffffffff
mov qword [r12 + 0x50], rcx
mov qword [r12 + 0x58], rcx
shr r11d, 0x11
and r11d, 1
mov qword [r12 + 0x60], r9
sub r8, rdx
mov qword [r12 + 0x78], r9
mov qword [rsp + 0x58], r8
mov dword [rsp + 0x108], r9d
mov dword [rsp + 0x38], r14d
lea rax, [r8 + r12]
mov dword [rsp + 0xe0], r11d
mov qword [rsp + 0x60], rax
mov r8d, r9d
mov qword [r12 + 0x70], 0xffffffffffffffff
mov dword [rsp + 0xe8], r9d
mov dword [rsp + 0x50], 0xdc00
nop dword [rax]
nop word [rax + rax]

Function at 0x141eb38e0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x50
mov r14, rdx
test rcx, rcx
je 0x141eb3a65
lea rax, [rdx - 1]
cmp rax, 0xffffffffffffdffe
ja 0x141eb3a65
cmp rcx, rdx
mov rbp, rdx
mov rdx, r8
cmovbe rbp, rcx
mov ecx, 0x20
add rbp, 0x1fff
and rbp, 0xffffffffffffe000
call fcn.141e6f590
mov rbx, rax
test rax, rax
je 0x141eb3a65
add r14, 0x1fff
mov qword [rsp + 0x60], rsi
and r14, 0xffffffffffffe000
mov qword [rsp + 0x68], rdi
cmp rbp, r14
ja 0x141eb3a45
cmp rbp, 1
jb 0x141eb3a45
mov rdx, qword [rax + 0x10]
lea rsi, [rax + 0x10]
mov rax, qword [rax]
mov ecx, 0x20
call qword [case.0x141d6f3c0.0]
mov rdi, rax
test rax, rax
je 0x141eb39e0
mov rax, qword [0x141f205c8]
test rax, rax
jne 0x141eb39ab
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
dec rax
mov qword [0x141f205c8], rax
add r14, rax
mov r9d, 4
not rax
mov r8d, 0x2000
and r14, rax
xor ecx, ecx
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, rdi
test rax, rax
jne 0x141eb39ea
mov rdx, qword [rsi]
mov rax, qword [rbx + 8]
call qword [case.0x141d6f3c0.0]
mov qword [rbx + 0x18], 0
jmp 0x141eb3a51
lea rdx, [rax + r14]
mov qword [rdi + 0x18], rax
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], rdx
sub rdx, rbp
call fcn.141eb9c10
test rax, rax
jne 0x141eb3a1c
mov rdx, rbx
mov rcx, rdi
call fcn.141eb93b0
mov qword [rbx + 0x18], 0
jmp 0x141eb3a51
mov rax, qword [rdi + 8]
mov qword [rdi], rax
mov rax, rbx
mov qword [rbx + 0x18], rdi
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
lea rsi, [rax + 0x10]
mov qword [rax + 0x18], 0
mov rdx, qword [rsi]
mov rcx, rbx
mov rax, qword [rbx + 8]
call qword [case.0x141d6f3c0.0]
xor eax, eax
jmp 0x141eb3a2a
mov rbx, qword [rsp + 0x70]
xor eax, eax
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret