joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003f6e0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov eax, 0xffffffff
cmp r8, rax
mov ebx, 0xffffffff
cmovb ebx, r8d
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14003f7ad
mov r15, qword [sym.imp.KERNEL32.dll_GetFileType]
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x14003f775
cmp eax, 0xffffffff
je 0x14003f786
mov esi, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14011fe20
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rdi
call r15
cmp eax, 3
je 0x14003f789
mov eax, dword [rsp + 0x2c]
jmp 0x14003f755
int3
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r12
test eax, eax
jne 0x14003f748
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
setne sil
neg rsi
jmp 0x14003f757

Function at 0x1400403c0
Capabilities:
Set current directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rdi, rcx
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x50], rax
movaps xmm0, xmmword [0x1401efb80]
movaps xmmword [rsi + 0x40], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, [0x1401f7c85]
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x3a1
call fcn.1400ddbb0
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.1400f4d70
cmp byte [rdi + 0x17], 0
jns 0x140040444
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
mov rcx, rsi
call fcn.1400f5540
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14011fe20
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
Function at 0x140040480
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x2d8
mov r14, rcx
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x270]
mov qword [rdi + 0x50], rax
movaps xmm0, xmmword [0x1401efb80]
movaps xmmword [rdi + 0x40], xmm0
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, [0x1401f7c70]
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x60]
mov rcx, rbx
mov r9d, 0x391
call fcn.1400ddbb0
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.1400f4d70
lea rbx, [rsp + 0x60]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.140122050
mov word [rbx], 0
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
add edi, 0xfffffefb
cmp edi, 0xfffffefc
jb 0x140040587
lea rsi, [rsp + 0x20]
mov qword [rsi], rbx
mov rcx, rbx
call fcn.14011dc44
mov qword [rsi + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, rsi
call fcn.14010a450
lea rsi, [rsp + 0x48]
mov rcx, rbx
mov rdx, rsi
call fcn.140023cc0
mov rcx, r14
mov rdx, rsi
call fcn.14010de20
mov rcx, rsi
call fcn.14010a440
mov rcx, rbx
call fcn.14010a440
cmp edi, 0xfffffefc
setae bl
lea rcx, [rsp + 0x270]
call fcn.1400f5540
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.14011fe20
mov eax, ebx
add rsp, 0x2d8
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140044bd0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0x278], rax
lea rdi, [rsp + 0x70]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.140122050
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0x28
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x140044c65
cmp word [rsp + 0x70], 0
je 0x140044c65
lea rbx, [rsp + 0x60]
mov qword [rbx], rdi
mov rcx, rdi
call fcn.14011dc44
mov qword [rbx + 8], rax
mov rcx, rsi
mov rdx, rbx
call fcn.14010a450
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.14011fe20
mov rax, rsi
add rsp, 0x280
pop rbx
pop rdi
pop rsi
ret
xorps xmm0, xmm0
lea rcx, [rsp + 0x40]
movaps xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
call fcn.140023bf0
test al, al
je 0x140044c90
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14011c230
jmp 0x140044caf
lea rax, [0x1401f7c3e]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov qword [rdx + 8], 3
mov rcx, rsi
call fcn.14010a450
lea rcx, [rsp + 0x40]
call fcn.14010a440
jmp 0x140044c47

Function at 0x140044cc0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140227118]
mov ecx, dword [0x140222a94]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140044cfc
movzx ecx, word [0x1402270e8]
cmp cx, 9
jne 0x140044d44
mov eax, 1
add rsp, 0x28
ret
lea rcx, [0x140227118]
call fcn.14011d638
cmp dword [0x140227118], 0xffffffff
jne 0x140044ce5
xorps xmm0, xmm0
movups xmmword [0x140227108], xmm0
movups xmmword [0x1402270f8], xmm0
movups xmmword [0x1402270e8], xmm0
lea rcx, [0x1402270e8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x140227118]
call fcn.14011d5d8
jmp 0x140044ce5
xor eax, eax
test cx, cx
je 0x140044cf7
cmp cx, 6
jne 0x140044d58
mov eax, 2
jmp 0x140044cf7
cmp cx, 0xc
jne 0x140044d65
mov eax, 3
jmp 0x140044cf7
mov eax, 4
jmp 0x140044cf7

Function at 0x140045820
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov edi, 0xffffffff
cmp r8, rdi
mov eax, 0xffffffff
cmovae r8d, eax
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140045885
mov esi, dword [rsp + 0x2c]
cmp rsi, rdi
je 0x14004588e
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14011fe20
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
mov rsi, 0xffffffffffffffff
jmp 0x14004586e
int3
Function at 0x1400468b0
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0x48], rax
test rcx, rcx
je 0x140046989
mov rsi, rdx
mov rdi, rcx
lea r14, [rsp + 0x40]
mov qword [r14], 0
mov rbp, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rbp
mov rbx, rax
call rbp
xor ecx, ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x30], 2
mov rcx, rax
mov rdx, rdi
mov r8, rbx
mov r9, r14
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov edi, eax
test eax, eax
je 0x14004698d
mov rbx, qword [rsp + 0x40]
cmp qword [rsi], rbx
je 0x140046954
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140046973
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14004694c
mov qword [rsi], rbx
call fcn.1400d3890
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
setne bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14011fe20
mov eax, ebx
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.1400d3890
mov rcx, qword [rsi]
call fcn.140101910
mov qword [rsi], 0
jmp 0x14004693a
mov bl, 1
jmp 0x140046959
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
jmp 0x14004694c

Function at 0x1400478d0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.14003d360
test al, al
je 0x1400478fe
mov rcx, qword [rsi]
mov edx, 0x32
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsi + 0x38]
mov qword [rsi + 0x38], 0
test rdi, rdi
je 0x14004791f
mov rcx, rdi
call fcn.140047ab0
mov rcx, rdi
call fcn.14011d780
lea rcx, [rsi + 0x58]
call fcn.140029d70
mov rcx, qword [rsi + 0x50]
mov qword [rsi + 0x50], 0
test rcx, rcx
je 0x14004793e
call fcn.140102950
mov rcx, qword [rsi + 0x40]
movabs rax, 0xfffffffe00000000
and rax, rcx
cmp rax, qword [0x14021af08]
je 0x1400479c9
mov rdi, qword [rsi + 0x38]
xorps xmm0, xmm0
movups xmmword [rsi + 0x38], xmm0
test rdi, rdi
jne 0x1400479d0
mov rax, qword [rsi + 0x28]
inc rax
cmp rax, 2
jb 0x14004798b
call fcn.1400d3890
mov rcx, qword [rsi + 0x28]
call fcn.140101910
mov qword [rsi + 0x28], 0
mov rax, qword [rsi + 0x20]
inc rax
cmp rax, 2
jae 0x1400479e2
mov rax, qword [rsi + 0x18]
inc rax
cmp rax, 2
jb 0x1400479bb
call fcn.1400d3890
mov rcx, qword [rsi + 0x18]
call fcn.140101910
mov qword [rsi + 0x18], 0
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140047a00
call fcn.1400f23b0
jmp 0x140047958
mov rcx, rdi
call fcn.140047ab0
mov rcx, rdi
call fcn.14011d780
jmp 0x140047968
call fcn.1400d3890
mov rcx, qword [rsi + 0x20]
call fcn.140101910
mov qword [rsi + 0x20], 0
jmp 0x140047998

Function at 0x140049990
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14021aed0]
cmp ecx, 0xffffffff
je 0x1400499b5
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
add rsp, 0x28
ret
xor eax, eax
jmp 0x1400499b0
Function at 0x1400499c0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
mov eax, dword [0x14022b7f0]
mov ecx, dword [0x140222a94]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140049a2d
mov ecx, dword [0x14021aed0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, 0xffffffff
and rax, 0xfffffffffffffffc
je 0x140049a21
movsxd rdx, dword [0x14022b7e8]
shl rdx, 4
mov esi, dword [rax + rdx + 8]
cmp esi, dword [0x14022b7ec]
jne 0x140049a21
mov rax, qword [rax + rdx]
test rax, rax
jne 0x140049a69
mov dword [rdi], ecx
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14022b7f0]
call fcn.14011d638
cmp dword [0x14022b7f0], 0xffffffff
jne 0x1400499ea
mov qword [0x14022b7e8], 0
lea rcx, [0x14022b7e8]
xor edx, edx
call fcn.140012fc0
lea rcx, [0x14022b7f0]
call fcn.14011d5d8
jmp 0x1400499ea
mov ecx, dword [rax]
jmp 0x140049a21

Function at 0x14004c030
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rdx
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov edx, dword [rcx + 0x1c]
cmp edx, 5
je 0x14004c124
lea rax, [rsp + 0x38]
mov qword [rax], 0
mov rbp, qword [rcx + 0x28]
mov r9d, dword [rcx + 0x20]
mov qword [rsp + 0x20], rbp
mov rcx, rax
xor r8d, r8d
call fcn.14004c1f0
test eax, eax
jne 0x14004c148
lea rcx, [rsp + 0x38]
lea rdi, [rsp + 0x30]
mov rdx, rdi
call fcn.14004c190
mov rbx, qword [rdi]
mov qword [rdi], 0
lea rdi, [rbx + 1]
cmp rdi, 2
jb 0x14004c0ad
call fcn.1400d3890
cmp qword [rsi], rbx
je 0x14004c0dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14004c10e
cmp rdi, 2
jb 0x14004c0d4
mov qword [rsi], rbx
call fcn.1400d3890
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x30]
inc rax
cmp rax, 2
jae 0x14004c14f
xor edi, edi
lea rcx, [rsp + 0x38]
call fcn.14004c160
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14011fe20
mov eax, edi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
call fcn.1400d3890
mov rcx, qword [rsi]
call fcn.140101910
mov qword [rsi], 0
jmp 0x14004c0c6
mov rax, qword [rsi]
xor edi, edi
inc rax
cmp rax, 2
jb 0x14004c0f6
call fcn.1400d3890
mov rcx, qword [rsi]
call fcn.140101910
mov qword [rsi], 0
jmp 0x14004c0f6
mov edi, 0x2f
jmp 0x14004c0ec
call fcn.1400d3890
mov rcx, qword [rsp + 0x30]
call fcn.140101910
jmp 0x14004c0ea
Function at 0x14004c1f0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov r15, qword [rsp + 0x120]
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rax, qword [rcx]
inc rax
cmp rax, 1
ja 0x14004c3a0
mov r14d, r9d
mov edi, edx
mov rsi, rcx
xor ecx, ecx
mov rdx, r8
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov rbx, rax
cmp qword [rsi], rax
je 0x14004c27b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14004c37d
mov rax, rbx
inc rax
cmp rax, 2
jb 0x14004c270
mov qword [rsi], rbx
call fcn.1400d3890
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsi]
lea rax, [rbx + 1]
cmp rax, 1
jbe 0x14004c3a7
xor ebp, ebp
lea rcx, [rsp + 0x30]
mov r8d, 0x90
xor edx, edx
call fcn.140122050
test edi, edi
jne 0x14004c35d
mov dword [rsp + 0x40], 0x400
mov ebp, 0x400
mov ecx, 0x27
mov eax, ecx
or eax, 0x10
mov dword [rsp + 0x28], eax
or ebp, 8
mov dword [rsp + 0x58], 1
or ecx, 0xd8
mov edx, ecx
mov eax, ebp
mov ebp, edx
test r15, r15
je 0x14004c2e9
or eax, 0x100
mov qword [rsp + 0xa0], r15
or eax, 0x2000
lea r8, [rsp + 0x30]
mov dword [r8 + 0x10], eax
mov rcx, rbx
mov edx, 9
mov r9d, 0x90
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
test eax, eax
je 0x14004c396
not r14d
and ebp, r14d
lea r8, [rsp + 0x28]
mov dword [r8], ebp
mov rcx, qword [rsi]
mov edx, 4
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
xor esi, esi
test eax, eax
je 0x14004c396
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14011fe20
mov eax, esi
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
dec edi
cmp edi, 3
ja case.default.0x14004c37b
mov edx, 0xc8
lea rax, [0x14004c3d8]
movsxd rdi, dword [rax + rdi*4]
add rdi, rax
xor ecx, ecx
xor eax, eax
jmp rdi
call fcn.1400d3890
mov rcx, qword [rsi]
call fcn.140101910
mov qword [rsi], 0
jmp 0x14004c25c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14004c33b
mov esi, 0x4df
jmp 0x14004c33b
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14011fe20
nop
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0xa0
jmp 0x14004c33b

Function at 0x14004c8c0
Capabilities:
Create thread

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400ba9e0]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 8], rax
test rax, rax
je 0x14004c919
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14011fe20
nop
add rsp, 0x40
pop rsi
ret
lea rdx, [0x140205bf2]
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x1b
call fcn.1401a8ec0
mov rcx, rsi
call fcn.1401a8df0
lea rdx, [0x140202d40]
mov r8d, 0xc
mov rcx, rax
call fcn.140152d20
mov rcx, rsi
call fcn.1401a8e00
jmp 0x14004c905
Function at 0x14004cc00
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, r9
mov r12, r8
mov r13, rdx
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx], xmm0
mov rdi, qword [r8]
mov qword [r8], 0
lea rbx, [rdi + 1]
cmp rbx, 2
jb 0x14004cc3f
call fcn.1400d3890
cmp qword [rsi + 0x18], rdi
je 0x14004cc75
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi + 0x18]
inc rax
cmp rax, 2
jae 0x14004cd41
cmp rbx, 2
jb 0x14004cc6d
mov qword [rsi + 0x18], rdi
call fcn.1400d3890
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov qword [rsi + 0x20], rax
mov rdi, qword [r13]
mov qword [r13], rax
lea rbx, [rdi + 1]
cmp rbx, 2
jb 0x14004cc92
call fcn.1400d3890
mov r15, qword [rsp + 0x90]
cmp qword [rsi + 0x20], rdi
je 0x14004ccd0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi + 0x20]
inc rax
cmp rax, 2
jae 0x14004cd5c
cmp rbx, 2
jb 0x14004ccc8
mov qword [rsi + 0x20], rdi
call fcn.1400d3890
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rsp + 0x98]
xor eax, eax
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], r14
mov qword [rsi + 0x38], rax
movabs rax, 0xfffffffe00000000
and rax, r15
cmp rax, qword [0x14021af08]
je 0x14004cd77
mov qword [rsi + 0x40], r15
lea rcx, [rsi + 0x58]
xorps xmm0, xmm0
movups xmmword [rsi + 0x48], xmm0
mov rdx, rbp
call fcn.14004cdc0
mov rax, qword [r13]
inc rax
cmp rax, 2
jae 0x14004cd84
mov rax, qword [r12]
inc rax
cmp rax, 2
jae 0x14004cd9c
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400d3890
mov rcx, qword [rsi + 0x18]
call fcn.140101910
mov qword [rsi + 0x18], 0
jmp 0x14004cc5e
call fcn.1400d3890
mov rcx, qword [rsi + 0x20]
call fcn.140101910
mov qword [rsi + 0x20], 0
jmp 0x14004ccb9
mov rcx, r15
call fcn.1400f2260
jmp 0x14004ccfc
call fcn.1400d3890
mov rcx, qword [r13]
call fcn.140101910
mov qword [r13], 0
jmp 0x14004cd20
call fcn.1400d3890
mov rcx, qword [r12]
call fcn.140101910
mov qword [r12], 0
jmp 0x14004cd2d
Function at 0x14004d050
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r12, rcx
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rdi, 0xaaaaaaaaaaaaaaaa
mov rax, qword [rcx + 0x4c8]
mov rax, qword [rcx + 0x3e8]
lea rsi, [rcx + 0x3f0]
xor ebp, ebp
cmp rax, rsi
je 0x14004d171
lea r14, [rsp + 0x28]
mov r15, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x14004d0d2
mov r13, qword [rax + 0x10]
cmp qword [r13], rax
je 0x14004d0dd
lea rcx, [rax + 0x10]
mov rdx, qword [rcx]
lea rcx, [rdx + 0x10]
mov r13, qword [rdx + 0x10]
cmp qword [r13], rdx
je 0x14004d0dd
jmp 0x14004d0bf
mov r13, rcx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x14004d0d2
mov rbx, qword [rax + 0x20]
test bpl, bpl
je 0x14004d118
mov rcx, rbx
mov rdx, rdi
call fcn.14004d2f0
mov rcx, qword [rbx + 0xb0]
test rcx, rcx
je 0x14004d10e
call fcn.1400d9b80
mov rcx, qword [rbx + 0xb8]
call fcn.1400d9b80
mov rax, r13
cmp r13, rsi
jne 0x14004d0a8
jmp 0x14004d171
mov rax, qword [fcn.1401122d0]
lea rcx, [0x14011c810]
cmp rax, rcx
jne 0x14004d274
mov qword [rsp + 0x28], 0
mov rcx, r14
call r15
mov rax, qword [rsp + 0x28]
movabs rcx, 0x8637bd05af7
cmp rax, rcx
jge 0x14004d29a
imul rax, rax, 0xf4240
cqo
idiv qword [0x140227198]
mov rdi, rax
mov bpl, 1
jmp 0x14004d0e6
mov rax, qword [r12 + 0x400]
add r12, 0x408
cmp rax, r12
je 0x14004d255
lea r15, [0x14011c810]
lea r14, [rsp + 0x28]
mov r13, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x14004d1c4
mov rsi, qword [rax + 0x10]
cmp qword [rsi], rax
je 0x14004d1cf
lea rcx, [rax + 0x10]
mov rdx, qword [rcx]
lea rcx, [rdx + 0x10]
mov rsi, qword [rdx + 0x10]
cmp qword [rsi], rdx
je 0x14004d1cf
jmp 0x14004d1b2
mov rsi, rcx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x14004d1c4
mov rbx, qword [rax + 0x20]
test bpl, bpl
je 0x14004d20a
mov rcx, rbx
mov rdx, rdi
call fcn.14004d2f0
mov rcx, qword [rbx + 0xb0]
test rcx, rcx
je 0x14004d200
call fcn.1400d9b80
mov rcx, qword [rbx + 0xb8]
call fcn.1400d9b80
mov rax, rsi
cmp rsi, r12
jne 0x14004d19c
jmp 0x14004d255
mov rax, qword [fcn.1401122d0]
cmp rax, r15
jne 0x14004d28a
mov qword [rsp + 0x28], 0
mov rcx, r14
call r13
mov rax, qword [rsp + 0x28]
movabs rcx, 0x8637bd05af7
cmp rax, rcx
jge 0x14004d2c4
imul rax, rax, 0xf4240
cqo
idiv qword [0x140227198]
mov rdi, rax
mov bpl, 1
jmp 0x14004d1d8
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14011fe20
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rdi, [rsp + 0x28]
mov rcx, rdi
call qword [0x14023a010]
mov rdi, qword [rdi]
jmp 0x14004d169
mov rcx, r14
call qword [0x14023a010]
mov rdi, qword [rsp + 0x28]
jmp 0x14004d250
mov rcx, qword [0x140227198]
cqo
idiv rcx
imul rbp, rax, 0xf4240
imul rax, rdx, 0xf4240
cqo
idiv rcx
mov rdi, rax
add rdi, rbp
jmp 0x14004d169
mov rcx, qword [0x140227198]
cqo
idiv rcx
imul rbp, rax, 0xf4240
imul rax, rdx, 0xf4240
cqo
idiv rcx
mov rdi, rax
add rdi, rbp
jmp 0x14004d250
Function at 0x140053020
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor edx, edx
call fcn.140114340
lea rdi, [rsi + 0x10]
lea rdx, str.ExitCodeWatcherThread
lea rbx, [rsp + 0x20]
mov rcx, rbx
call fcn.140153570
mov rcx, rdi
mov rdx, rbx
call fcn.140053120
cmp byte [rbx + 0x17], 0
js 0x140053109
mov dword [rsi + 0x98], 0x103
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0xa0], 0
test rax, rax
je 0x1400530d3
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0xa0]
inc rax
cmp rax, 2
jae 0x1400530eb
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400530cb
mov qword [rsi + 0xa0], rdi
call fcn.1400d3890
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14011fe20
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
call fcn.1400d3890
mov rcx, qword [rsi + 0xa0]
call fcn.140101910
mov qword [rsi + 0xa0], 0
jmp 0x1400530b5
mov rcx, qword [rsp + 0x20]
call fcn.14011d780
jmp 0x14005306d
Function at 0x1400554d0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov esi, ecx
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0x30], rax
movsxd rbx, edx
movsxd rax, ecx
sub rbx, rax
inc rbx
movabs r14, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x28]
mov qword [rsp + 0x28], r14
mov rcx, rdi
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14005555b
mov rax, 0xffffffffffffffff
xor edx, edx
div rbx
mov rcx, 0xfffffffffffffffe
sub rcx, rdx
mov rax, qword [rsp + 0x28]
cmp rax, rcx
ja 0x140055505
xor edx, edx
div rbx
add esi, edx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14011fe20
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
int3
Function at 0x140058c40
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov r15, rdx
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rdx, rsi
call fcn.140059600
mov rax, qword [rsi]
test rax, rax
je 0x140058cb7
mov rbx, qword [rax + 0x50]
mov rdi, qword [rax + 0x58]
xor esi, esi
cmp rbx, rdi
jne 0x140058cbe
lea rcx, [rsp + 0x28]
call fcn.140058d20
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14011fe20
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 3
jmp 0x140058c90
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 0
je 0x140058cd6
add rbx, 0x70
cmp rbx, rdi
je 0x140058c90
jmp 0x140058cc5
cmp byte [rbx + 0x27], 0
jns 0x140058ce2
mov rcx, qword [rbx + 0x10]
jmp 0x140058ce6
lea rcx, [rbx + 0x10]
call r12
test al, 0x10
jne 0x140058ccb
mov r14, qword [r15 + 8]
cmp r14, qword [r15 + 0x10]
je 0x140058d0c
mov rcx, r14
mov rdx, rbx
call fcn.1400a90a0
add r14, 0x68
mov qword [r15 + 8], r14
jmp 0x140058ccb
mov rcx, r15
mov rdx, rbx
call fcn.14018d290
jmp 0x140058ccb
Function at 0x14005a6f7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
xor ebx, ebx
movsxd rax, dword [rcx + 0x3c]
mov eax, dword [rcx + rax + 0x88]
add rax, rcx
mov r9d, dword [rax + 0x20]
mov edi, dword [rax + 0x1c]
mov ebp, dword [rax + 0x24]
lea rsi, [rcx + r9]
mov r10d, dword [rsi + rbx*4]
add r10, rcx
movsx ax, byte [r10]
test al, al
je 0x14005a793
xor r9d, r9d
jmp 0x14005a73a
mov r9d, r12d
lea r12d, [r9 + 1]
cmp byte [r10 + r12], 0
mov r11, r12
jne 0x14005a737
test r11d, r11d
je 0x14005a793
lea r11, [r10 + r9]
xor r9d, r9d
jmp 0x14005a761
movsx ax, byte [r10 + 1]
add r10, 1
mov r12d, dword [r8 + 0x128]
movzx eax, ax
imul r9d, r12d
add r9d, eax
cmp r11, r10
jne 0x14005a757
lea rax, [rbx + 1]
cmp edx, r9d
je 0x14005a79f
mov rbx, rax
mov r10d, dword [rsi + rbx*4]
add r10, rcx
movsx ax, byte [r10]
test al, al
jne 0x14005a72b
lea rax, [rbx + 1]
xor r9d, r9d
cmp edx, r9d
jne 0x14005a780
lea rax, [rcx + rbx*2]
movzx eax, word [rax + rbp]
lea rax, [rcx + rax*4]
mov eax, dword [rax + rdi]
add rax, rcx
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret