joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002e808
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov rdi, rcx
xor r14d, r14d
mov ebx, r14d
mov dword [r11 + 0x18], r14d
mov qword [r11 - 0x28], rcx
test rdx, rdx
je 0x14002e85d
cmp word [rdx], r14w
je 0x14002e85d
lea rax, [r11 - 0x28]
mov qword [r11 - 0x38], rax
lea r9d, [r14 + 1]
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x14002e85d
mov ecx, eax
jmp 0x14002e905
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x78]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
cmp eax, 2
jne 0x14002e8a2
lea rcx, [0x140037c38]
call fcn.14000fcb0
mov rbx, rax
mov qword [rsp + 0x38], rax
jmp 0x14002e912
test eax, eax
jne 0x14002e856
mov ecx, dword [rsp + 0x70]
call fcn.140011100
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14002e900
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x78]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
je 0x14002e912
mov rcx, rbx
call fcn.140014240
mov rbx, r14
mov qword [rsp + 0x38], rbx
mov ecx, esi
jmp 0x14002e905
mov ecx, 8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
nop
mov rcx, qword [rsp + 0x30]
cmp rdi, rcx
je 0x14002e928
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x14002e9a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
mov edi, r8d
mov ebx, 1
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
nop dword [rax + rax]
test eax, eax
je 0x14002e9d3
cmp edi, dword [rsp + 0x58]
je 0x14002e9d5
xor ebx, ebx
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14002eb04
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rdi, r8
mov rsi, rdx
mov r14, rcx
xor r15d, r15d
test r8, r8
je 0x14002ec07
cmp word [r8], r15w
je 0x14002ec07
mov qword [r11 - 0x38], r15
lea rax, [r11 + 0x20]
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x48], r15
mov dword [rsp + 0x28], 2
mov dword [r11 - 0x58], r15d
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x90], eax
test eax, eax
jne 0x14002ebcc
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], r15w
jne 0x14002eb76
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x90], eax
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test ebx, ebx
jne 0x14002ebe7
mov r8, rdi
mov rdx, rsi
lea rcx, str._s_s_r_n
call fcn.14000dc90
jmp 0x14002ecb4
xor edx, edx
mov ecx, ebx
call fcn.140002bfc
mov r8, rsi
mov edx, 1
mov ecx, 0x235d
call fcn.140002bfc
jmp 0x14002ecb4
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteKeyExW]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x90], eax
test eax, eax
je 0x14002ecb4
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 0x2000000
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x90], eax
test eax, eax
je 0x14002ec6f
cmp eax, 2
je 0x14002ecb4
xor edx, edx
mov ecx, eax
call fcn.140002bfc
jmp 0x14002ecb4
lea rdx, [0x140037c38]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x90], eax
test eax, eax
je 0x14002eca0
xor edx, edx
mov ecx, eax
call fcn.140002bfc
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test ebx, ebx
jne 0x14002ece3
call fcn.140020bec
test al, al
je 0x14002ecda
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x8000000
call qword [sym.imp.ext_ms_win_cmd_util_l1_1_0.dll_DoSHChangeNotify]
nop dword [rax + rax]
jmp 0x14002ece3
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140031260
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push r14
push r15
sub rsp, 0x30
mov rsi, rcx
mov r14d, r8d
mov ecx, dword [rcx]
mov r15, r9
mov rbp, rdx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__get_osfhandle]
nop dword [rax + rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FlushFileBuffers]
nop dword [rax + rax]
mov ecx, dword [rsi]
call fcn.140014604
xor edx, edx
mov rcx, rbp
call fcn.14000a9dc
mov dword [rsi], eax
cmp eax, 0xffffffff
je 0x14003131f
mov ebx, r14d
mov ecx, eax
neg ebx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__get_osfhandle]
nop dword [rax + rax]
mov r9d, 2
xor r8d, r8d
mov rcx, rax
mov edx, ebx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop dword [rax + rax]
mov ecx, dword [rsi]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__get_osfhandle]
nop dword [rax + rax]
mov rdx, qword [rsp + 0x70]
lea r9, [rsp + 0x50]
and qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, r14d
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
nop dword [rax + rax]
test eax, eax
jne 0x14003134b
mov ecx, dword [rsi]
call fcn.140014604
or dword [rsi], 0xffffffff
mov r8, rbp
mov edx, 1
mov ecx, 0x4000271f
call fcn.140002bfc
mov eax, 1
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rsi
ret
cmp dword [rsp + 0x50], r14d
jne 0x140031315
mov rdx, qword [rsp + 0x70]
mov r8, r14
mov rcx, r15
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
mov ecx, dword [rsi]
test eax, eax
jne 0x140031317
call fcn.140014604
mov edx, 1
mov rcx, rbp
call fcn.14000a9dc
mov dword [rsi], eax
cmp eax, 0xffffffff
je 0x14003131f
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__get_osfhandle]
nop dword [rax + rax]
mov r9d, 2
xor r8d, r8d
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop dword [rax + rax]
xor eax, eax
jmp 0x140031336
Function at 0x140031dac
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
mov r14, rdx
and dword [rax - 0x24], r15d
mov r12d, r9d
mov rbp, r8
lea edx, [r15 + 2]
call fcn.14000a9dc
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140031dfc
lea ecx, [rax + 0x6f]
call fcn.140032bb8
lea edx, [rbx + 2]
xor ecx, ecx
call fcn.1400313b4
int3
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__get_osfhandle]
nop dword [rax + rax]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov rcx, rax
mov r8d, r12d
mov rdx, rbp
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
nop dword [rax + rax]
test eax, eax
je 0x140031ee5
mov eax, dword [r14 + 0x38]
mov edi, dword [rsp + 0x30]
mov esi, edi
test eax, 0xc000
jne 0x140031e61
cmp edi, 2
jbe 0x140031e59
mov ecx, 0xfeff
cmp word [rbp], cx
jne 0x140031e59
bts eax, 0xe
jmp 0x140031e5d
bts eax, 0xf
mov dword [r14 + 0x38], eax
test esi, esi
je 0x140031e8d
xor ecx, ecx
lea r9, [rsp + 0x34]
and eax, 0x8002
lea r8, [rsp + 0x30]
cmp eax, 0x8002
mov rdx, rbp
sete cl
call fcn.14002fd90
mov edi, dword [rsp + 0x30]
mov r15d, eax
cmp edi, r12d
je 0x140031dfc
test r15d, r15d
jne 0x140031ec3
mov ecx, ebx
sub edi, esi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__get_osfhandle]
nop dword [rax + rax]
lea r9d, [r15 + 1]
xor r8d, r8d
mov rcx, rax
mov edx, edi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop dword [rax + rax]
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, ebx
mov dword [0x14004cc50], eax
call fcn.140014604
mov ecx, dword [0x14004cc50]
xor edx, edx
call fcn.140002bfc
mov edx, 1
xor ecx, ecx
call fcn.1400313b4
int3
Function at 0x1400321e4
Capabilities:
Delete file
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov r14, r9
mov ebp, r8d
mov rbx, rdx
mov esi, ecx
xor edi, edi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__get_osfhandle]
nop dword [rax + rax]
and qword [rsp + 0x20], rdi
lea r9, [rsp + 0x30]
mov rcx, rax
mov r8d, ebp
mov rdx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
nop dword [rax + rax]
test eax, eax
je 0x14003224b
cmp ebp, dword [rsp + 0x30]
jne 0x14003224b
cmp dword [0x1400449b4], edi
je 0x1400322ce
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x70]
mov dword [0x14004cc50], eax
call fcn.140014604
mov ecx, esi
call fcn.140014604
mov ecx, esi
call fcn.14001447c
test eax, eax
je 0x14003227f
mov edi, 0x1d
jmp 0x14003228e
mov rcx, r14
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
mov ecx, dword [0x14004cc50]
mov eax, 0x70
and dword [0x14004cc40], 0
test ecx, ecx
cmove ecx, eax
cmp dword [0x1400449b4], 0
mov dword [0x14004cc50], ecx
je 0x1400322b8
xor edi, edi
jmp 0x1400322c1
test edi, edi
jne 0x1400322c1
call fcn.140032bb8
mov edx, 1
mov ecx, edi
call fcn.1400313b4
int3
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400325f0
Capabilities:
Set current directory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x158]
sub rsp, 0x250
mov rax, qword [0x1400400b0]
xor rax, rsp
mov qword [rbp + 0x148], rax
mov esi, 0x104
mov byte [rbp + 0x130], 1
mov ebx, ecx
mov qword [rbp + 0x138], rsi
xor r14d, r14d
lea rcx, [rsp + 0x20]
mov r8d, esi
mov qword [rbp + 0x128], r14
xor edx, edx
mov edi, r14d
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov al, byte [rbp + 0x130]
lea rcx, [rsp + 0x20]
neg al
sbb rdx, rdx
and edx, 0x7ee3
add rdx, rsi
call fcn.140010e10
test eax, eax
js 0x1400327d3
lea eax, [r14 + 0x3d]
mov dword [rbp + 0x144], 0x3a
add bx, 0x40
mov word [rbp + 0x140], ax
lea rcx, [rbp + 0x140]
mov word [rbp + 0x142], bx
call fcn.1400149d8
mov rbx, rax
test rax, rax
je 0x1400326d7
mov rcx, rax
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetCurrentDirectoryW]
nop dword [rax + rax]
test al, al
jne 0x1400327b0
lea ecx, [r14 + 1]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetErrorMode]
nop dword [rax + rax]
mov edi, eax
mov rcx, qword [rbp + 0x128]
lea rdx, [rsp + 0x20]
test rcx, rcx
cmovne rdx, rcx
movzx ecx, word [rbp + 0x142]
mov word [rdx], cx
lea rdx, [rsp + 0x20]
mov rcx, qword [rbp + 0x128]
movzx eax, word [rbp + 0x144]
test rcx, rcx
cmovne rdx, rcx
lea rcx, [rsp + 0x20]
mov word [rdx + 2], ax
lea rdx, [rsp + 0x20]
mov rax, qword [rbp + 0x128]
test rax, rax
cmovne rcx, rax
mov eax, 0x5c
mov word [rcx + 4], ax
lea rcx, [rsp + 0x20]
mov rax, qword [rbp + 0x128]
test rax, rax
cmovne rcx, rax
mov word [rcx + 6], r14w
lea rcx, [rbp + 0x140]
mov rax, qword [rbp + 0x128]
test rax, rax
cmovne rdx, rax
call fcn.14001a328
mov rax, qword [rbp + 0x128]
lea rcx, [rsp + 0x20]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetCurrentDirectoryW]
nop dword [rax + rax]
test eax, eax
jne 0x14003279d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
xor edx, edx
call fcn.140002bfc
test rbx, rbx
je 0x1400327b0
mov ecx, edi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetErrorMode]
nop dword [rax + rax]
mov rax, qword [0x14005b848]
lea rcx, [0x14005b640]
mov edx, dword [0x14005b858]
test rax, rax
cmovne rcx, rax
xor r8d, r8d
call fcn.14001a478
mov rcx, qword [rbp + 0x128]
mov qword [rbp + 0x128], r14
test rcx, rcx
je 0x1400327eb
call fcn.14001fe90
mov rcx, qword [rbp + 0x148]
xor rcx, rsp
call fcn.14001f920
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x140032820
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov edx, 1
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
nop dword [rax + rax]
test eax, eax
jne 0x14003284b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov dword [0x14004cc50], eax
xor eax, eax
add rsp, 0x28
ret
Function at 0x140033580
Capabilities:
Get disk size

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1400400b0]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r14d, r9d
mov esi, r8d
mov rbx, rdx
mov rdi, rcx
call fcn.1400057f0
mov r12d, 0x104
mov byte [rbp + 0x160], 1
xor r15d, r15d
mov qword [rbp + 0x168], r12
mov r8d, r12d
mov qword [rbp + 0x158], r15
xor edx, edx
lea rcx, [rsp + 0x50]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov cl, byte [rbp + 0x160]
neg cl
lea rcx, [rsp + 0x50]
sbb rdx, rdx
and edx, 0x7ee3
add rdx, r12
call fcn.140010e10
lea rcx, [rsp + 0x50]
test eax, eax
jns 0x14003361e
call fcn.14001e0bc
lea eax, [r15 + 1]
jmp 0x140033734
mov rdx, rbx
call fcn.140016cc0
mov rdx, qword [rbp + 0x158]
lea rax, [rsp + 0x50]
test rdx, rdx
cmovne rax, rdx
cmp word [rax], r15w
je 0x140033665
cmp word [rax + 2], 0x3a
jne 0x140033665
cmp word [rax + 4], r15w
jne 0x140033665
lea rdx, [0x140037cbc]
lea rcx, [rsp + 0x50]
call fcn.14001b7dc
mov rdx, qword [rbp + 0x158]
test rdx, rdx
mov qword [rsp + 0x30], r15
lea rcx, [rsp + 0x50]
cmovne rcx, rdx
lea r9, [rsp + 0x38]
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDiskFreeSpaceExW]
nop dword [rax + rax]
mov edx, 6
mov rcx, rdi
call fcn.14003049c
mov rax, qword [rbp + 0x158]
lea r9, [rsp + 0x50]
test rax, rax
lea rdx, [rsp + 0x30]
mov r8d, 0xe
mov ecx, esi
cmovne r9, rax
mov eax, dword [rbp + 0x168]
mov dword [rsp + 0x20], eax
call fcn.140034314
mov rax, qword [rbp + 0x158]
lea rbx, [rsp + 0x50]
test rax, rax
lea r8, str._5lu
mov r9, r14
lea rcx, [0x14005b430]
mov rdx, r12
cmovne rbx, rax
call fcn.14000daf0
lea r9, [0x14005b430]
mov qword [rsp + 0x20], rbx
mov edx, 0x2379
mov r8d, 2
mov rcx, rdi
call fcn.140030778
mov rcx, qword [rbp + 0x158]
mov ebx, eax
mov qword [rbp + 0x158], r15
test rcx, rcx
je 0x140033732
call fcn.14001fe90
mov eax, ebx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14001f920
add rsp, 0x280
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14003540c
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x1400400b0]
xor rax, rsp
mov qword [rbp + 0x140], rax
and qword [rbp + 0x128], 0
mov edi, 0x104
mov rbx, rcx
mov byte [rbp + 0x130], 1
mov r8d, edi
mov qword [rbp + 0x138], rdi
xor edx, edx
lea rcx, [rsp + 0x20]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov cl, byte [rbp + 0x130]
neg cl
lea rcx, [rsp + 0x20]
sbb rdx, rdx
and edx, 0x7ee3
add rdx, rdi
call fcn.140010e10
test eax, eax
jns 0x140035497
lea rcx, [rsp + 0x20]
call fcn.14001e0bc
mov eax, 1
jmp 0x1400354f6
mov rax, qword [rbp + 0x128]
lea rdx, [rsp + 0x20]
mov r8d, dword [rbp + 0x138]
test rax, rax
mov rcx, rbx
cmovne rdx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetVolumePathNameW]
nop dword [rax + rax]
test eax, eax
je 0x1400354ea
mov rax, qword [rbp + 0x128]
lea rcx, [rsp + 0x20]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
nop dword [rax + rax]
test eax, 0xfffffffb
jne 0x140035486
lea rcx, [rsp + 0x20]
call fcn.14001e0bc
xor eax, eax
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.14001f920
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140003130
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000317a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000317a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000317a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000317a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000317a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000317c
xor al, al
add rsp, 0x28
ret
Function at 0x180001340
Capabilities:
Enumerate processes

Disassembly:
push rsi
sub rsp, 0x160
mov rax, qword [0x18000b040]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rsi, rdx
test rdx, rdx
jne 0x18000136a
xor eax, eax
jmp 0x18000140c
mov qword [rsp + 0x170], rbx
xor edx, edx
mov qword [rsp + 0x180], rbp
mov ecx, 2
mov qword [rsp + 0x188], rdi
xor edi, edi
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x1800013f2
nop
mov rdx, rsi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
jne 0x1800013e0
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x1800013e0
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1800013c0
mov rbp, qword [rsp + 0x180]
mov eax, edi
mov rdi, qword [rsp + 0x188]
mov rbx, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180005660
add rsp, 0x160
pop rsi
ret
Function at 0x1800034f0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x68
mov rax, qword [0x18000b040]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp edx, 1
jne 0x180003572
mov ecx, 8
call fcn.180005688
lea rcx, [0x1800032e0]
mov qword [rax], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1800054c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180003595
cmp dword [rsp + 0x38], 0
je 0x180003589
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x180003589
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180005660
add rsp, 0x68
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1800040b0
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push rsi
sub rsp, 0x48
mov rsi, r8
mov rbp, rdx
cmp rdx, r8
je 0x1800041b4
mov rdx, qword [0x18000ba88]
movabs r8, 0x100000001b3
mov qword [rsp + 0x60], rbx
movabs rax, 0xcbf29ce484222325
mov qword [rsp + 0x68], rdi
mov rbx, rbp
mov qword [rsp + 0x70], r12
mov r12, qword [rbp + 8]
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r14
movzx r14d, byte [rbp + 0x10]
xor r14, rax
mov qword [rsp + 0x30], r15
movzx eax, byte [rbp + 0x11]
mov r15, qword [0x18000ba78]
imul r14, r8
mov qword [rsp + 0x28], rdx
xor r14, rax
movzx eax, byte [rbp + 0x12]
imul r14, r8
xor r14, rax
movzx eax, byte [rbp + 0x13]
imul r14, r8
xor r14, rax
imul r14, r8
and r14, qword [0x18000baa0]
shl r14, 4
add r14, rdx
mov rax, qword [r14]
mov r13, qword [r14 + 8]
mov qword [rsp + 0x20], rax
nop dword [rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.180005680
dec qword [0x18000ba80]
cmp rdi, r13
je 0x1800041be
cmp rbx, rsi
jne 0x180004160
cmp qword [rsp + 0x20], rbp
jne 0x18000418e
mov qword [r14], rbx
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x68]
mov r15, qword [rsp + 0x30]
mov qword [r12], rbx
mov qword [rbx + 8], r12
mov r12, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
mov rax, rsi
add rsp, 0x48
pop rsi
pop rbp
ret
cmp qword [rsp + 0x20], rbp
jne 0x1800041cd
mov qword [r14], r15
mov rax, r15
jmp 0x1800041d0
mov rax, r12
mov qword [r14 + 8], rax
cmp rbx, rsi
je 0x18000418e
mov r13, qword [rsp + 0x28]
nop
movzx r14d, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r14, rax
movzx eax, byte [rbx + 0x11]
imul r14, rdx
xor r14, rax
movzx eax, byte [rbx + 0x12]
imul r14, rdx
xor r14, rax
movzx eax, byte [rbx + 0x13]
imul r14, rdx
xor r14, rax
imul r14, rdx
and r14, qword [0x18000baa0]
shl r14, 4
add r14, r13
mov rbp, qword [r14 + 8]
nop dword [rax]
nop word [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.180005680
dec qword [0x18000ba80]
cmp rdi, rbp
je 0x180004269
cmp rbx, rsi
jne 0x180004240
jmp 0x18000418b
mov qword [r14], r15
mov qword [r14 + 8], r15
cmp rbx, rsi
jne 0x1800041e0
jmp 0x18000418e
Function at 0x1400011d0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
xor edx, edx
mov ecx, 2
xor esi, esi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400012b2
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400012a9
lea rcx, [rsp + 0x4c]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], si
jne 0x140001240
cmp qword [rbx + 0x18], 7
mov r9, rbx
jbe 0x140001256
mov r9, qword [rbx]
mov r10, qword [rbx + 0x10]
lea rdx, [rsp + 0x4c]
cmp rax, r10
mov r8, r10
cmovb r8, rax
test r8, r8
je 0x14000128a
lea rcx, [rsp + 0x4c]
sub r9, rcx
movzx ecx, word [rdx]
cmp word [r9 + rdx], cx
jne 0x140001291
add rdx, 2
sub r8, 1
jne 0x140001276
cmp r10, rax
jb 0x140001291
jbe 0x1400012a5
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001231
jmp 0x1400012a9
mov esi, dword [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140003c00
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret