joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140070d20
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp dword [0x1415db138], 0xffffffff
jne 0x140070d92
mov eax, dword [0x1415ddd70]
lea rbx, [0x1415ddd68]
test al, 1
jne 0x140070d69
or eax, 1
mov dword [0x1415ddd70], eax
xor edx, edx
mov rcx, rbx
call fcn.140069a20
lea rcx, [0x1400da3f0]
call fcn.1400ae40c
nop
mov rcx, rbx
call fcn.140069b60
or rbx, 1
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1415db138], eax
test bl, 1
je 0x140070d92
and rbx, 0xfffffffffffffffe
mov rcx, rbx
call fcn.140069af0
add rsp, 0x30
pop rbx
ret

Function at 0x140070ed0
Capabilities:
Terminate thread

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rsi, rcx
mov rdi, qword [rcx + 8]
lea rbx, [rdi + 0x90]
test rbx, rbx
je 0x140070f08
mov rcx, rbx
call fcn.140069b60
or rbx, 1
mov qword [rsp + 0x40], rbx
cmp byte [rdi + 0x98], 0
jne 0x140070f18
jmp 0x140070f4b
cmp byte [rdi + 0xb8], 0
jne 0x140070f2a
mov byte [rdi + 0xb9], 1
jmp 0x140070f4b
xor edx, edx
mov rcx, qword [rdi + 0xa8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov byte [rdi + 0x9a], 1
xor edx, edx
mov rcx, rsi
call fcn.140070de0
nop
test bl, 1
je 0x140070f5c
and rbx, 0xfffffffffffffffe
mov rcx, rbx
call fcn.140069af0
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140071430
Capabilities:
Create thread
Resume thread

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
movsxd rbp, edx
mov r12, rcx
mov rsi, qword [rcx + 8]
lea rbx, [rsi + 0x90]
xor edi, edi
test rbx, rbx
je 0x140071472
mov rcx, rbx
call fcn.140069b60
or rbx, 1
jmp 0x140071475
mov rbx, rdi
mov qword [rsp + 0x60], rbx
cmp byte [rsi + 0x98], 0
je 0x140071488
jmp 0x140071580
mov qword [rsi + 0x98], 1
lea rax, [rsi + 0xb0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
mov r9, r12
lea r8, [0x140071340]
mov edx, dword [rsi + 0xa0]
xor ecx, ecx
call fcn.1400b6100
mov qword [rsi + 0xa8], rax
test rax, rax
jne 0x1400714eb
call fcn.1400b2ba0
lea rdx, [0x1415910c8]
mov ecx, dword [rax]
call fcn.14001b420
mov word [rsi + 0x98], pe_nt_image_headers64
jmp 0x140071580
mov dword [rsi + 0xa4], ebp
cmp ebp, 6
ja case.default.0x140071507
lea rdx, [0x140000000]
mov ecx, dword [rdx + rbp*4 + 0x715a4]
add rcx, rdx
jmp rcx
mov edi, 0xfffffff1
jmp case.0x140071507.3
mov edi, 0xfffffffe
jmp case.0x140071507.3
or edi, 0xffffffff
jmp case.0x140071507.3
mov edi, 1
jmp case.0x140071507.3
mov edi, 2
jmp case.0x140071507.3
mov edi, 0xf
jmp case.0x140071507.3
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov edi, eax
mov edx, edi
mov rcx, qword [rsi + 0xa8]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x140071561
lea rcx, [0x141591098]
call fcn.14001b320
mov rcx, qword [rsi + 0xa8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x140071580
lea rcx, [0x141591068]
call fcn.14001b320
nop
test bl, 1
je 0x140071591
and rbx, 0xfffffffffffffffe
mov rcx, rbx
call fcn.140069af0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x140071bf0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
call fcn.140070d20
mov ecx, dword [0x1415db138]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
jne 0x140071d79
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x70]
lea ecx, [rax + 2]
call fcn.14001b9d0
test al, al
je 0x140071c9b
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
mov rsi, qword [rcx + 0xc0]
mov rdx, rsi
mov ecx, dword [0x1415db138]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov r11, qword [rsp + 0x70]
mov rax, qword [r11 + 8]
mov byte [rax + 0x98], 1
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
mov byte [rcx + 0x99], 0
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rbx + 0xa8], rax
mov rbx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbx + 0xb0], eax
jmp 0x140071d07
mov ecx, 0x60
call fcn.1400ae128
mov qword [rsp + 0x78], rax
test rax, rax
je 0x140071cc1
mov edx, 1
mov rcx, rax
call fcn.1400544b0
mov rsi, rax
jmp 0x140071cc3
xor esi, esi
mov qword [rsp + 0x78], rsi
mov rdx, rsi
mov ecx, dword [0x1415db138]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov ecx, 0x10
call fcn.1400ae128
mov qword [rsp + 0x80], rax
test rax, rax
je 0x140071cfb
mov rdx, rsi
mov rcx, rax
call fcn.140054830
nop
mov qword [rsi + 8], rax
mov rcx, rsi
call fcn.140054800
cmp qword [0x1415dda28], 0
jne 0x140071d1e
mov rax, qword [rsi + 8]
mov qword [0x1415dda28], rax
jmp 0x140071d79
mov qword [rsp + 0x78], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov r8, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rdx, qword [rsi + 8]
mov rcx, qword [rsp + 0x78]
call fcn.140071970
mov rax, rsi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14007dca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, dword [rcx + 0x44]
mov rdi, rcx
mov qword [rsp + 0x30], rbp
nop word [rax + rax]
mov edx, dword [rdi + 0x94]
mov esi, dword [rdi + 0x58]
mov eax, dword [rdi + 0x44]
sub esi, dword [rdi + 0x9c]
lea ecx, [rbx + rax - 0x106]
sub esi, edx
cmp edx, ecx
jb 0x14007dd4f
mov rcx, qword [rdi + 0x50]
mov r8, rbx
lea rdx, [rcx + rbx]
call fcn.1400ae630
mov r8d, dword [rdi + 0x74]
mov rax, qword [rdi + 0x68]
sub dword [rdi + 0x98], ebx
sub dword [rdi + 0x94], ebx
sub dword [rdi + 0x84], ebx
lea rdx, [rax + r8*2]
nop dword [rax]
movzx eax, word [rdx - 2]
sub rdx, 2
cmp eax, ebx
jb 0x14007dd20
sub eax, ebx
jmp 0x14007dd22
xor eax, eax
dec r8d
mov word [rdx], ax
jne 0x14007dd10
mov rax, qword [rdi + 0x60]
mov edx, ebx
lea rcx, [rax + rbx*2]
movzx eax, word [rcx - 2]
sub rcx, 2
cmp eax, ebx
jb 0x14007dd44
sub eax, ebx
jmp 0x14007dd46
xor eax, eax
dec edx
mov word [rcx], ax
jne 0x14007dd34
add esi, ebx
mov rcx, qword [rdi]
cmp dword [rcx + 8], 0
je 0x14007ddc9
mov edx, dword [rdi + 0x9c]
mov eax, dword [rdi + 0x94]
mov r8d, esi
add rdx, rax
add rdx, qword [rdi + 0x50]
call fcn.14007d970
add dword [rdi + 0x9c], eax
mov r9d, dword [rdi + 0x9c]
cmp r9d, 3
jb 0x14007ddb3
mov eax, dword [rdi + 0x94]
mov rdx, qword [rdi + 0x50]
mov ecx, dword [rdi + 0x80]
movzx r8d, byte [rax + rdx]
mov dword [rdi + 0x70], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rdi + 0x7c]
mov dword [rdi + 0x70], r8d
cmp r9d, 0x106
jae 0x14007ddc9
mov rax, qword [rdi]
cmp dword [rax + 8], 0
jne 0x14007dcc0
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14008dca0
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x250
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rbx, rcx
xor eax, eax
mov dword [r11 + 0x18], eax
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x104
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, eax
cmp eax, 0x104
jbe 0x14008dd2e
mov dword [rsp + 0x268], eax
lea rcx, [rsp + 0x30]
lea rax, [rsp + 0x268]
cmp edi, dword [rsp + 0x30]
cmovge rcx, rax
mov r8d, dword [rcx]
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140054b20
mov edx, edi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, eax
mov r8d, edi
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call fcn.140016c40
mov dword [rsp + 0x270], 1
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
cmp rcx, rax
je 0x14008dd5d
call fcn.14000c4e0
mov rax, rbx
mov rbx, qword [rsp + 0x278]
add rsp, 0x250
pop rdi
ret
Function at 0x14008ec80
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xb0], rbx
mov rdi, rcx
xor eax, eax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rax + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp - 0x10], rax
nop dword [rax]
lea rcx, [rdi + 0x20]
call fcn.140069b60
mov r11, qword [rdi + 0x10]
cmp dword [r11 + 8], 0
jne 0x14008ed11
movzx eax, byte [rdi + 0x30]
test al, al
jne 0x14008ed11
lea rcx, [rdi + 0x18]
call fcn.14008e0f0
or r8d, 0xffffffff
lea rdx, [rdi + 0x20]
lea rcx, [rdi + 0x18]
call fcn.14008e600
mov r11, qword [rdi + 0x10]
cmp dword [r11 + 8], 0
je 0x14008ece4
movzx eax, byte [rdi + 0x30]
test al, al
jne 0x14008ee85
mov rax, qword [rdi + 0x10]
mov qword [rbp + 0x48], rax
lock inc dword [rax]
lea rcx, [rdi + 0x20]
call fcn.140069af0
mov r11, qword [rbp + 0x48]
mov ecx, dword [r11]
mov rax, qword [rbp + 0x48]
cmp ecx, 1
jne 0x14008ed4b
lea rcx, [rax + 0x18]
cmp qword [rax + 0x10], rcx
je 0x14008ed5b
mov edx, dword [rax + 8]
lea rcx, [rbp + 0x48]
call fcn.14000cc90
mov rax, qword [rbp + 0x48]
mov r14, qword [rax + 0x10]
movsxd r12, dword [rax + 8]
xor ecx, ecx
mov ebx, ecx
mov qword [rbp - 0x18], rcx
movzx eax, byte [rdi + 0x30]
test al, al
jne 0x14008ee2a
cmp rbx, r12
jge 0x14008ee2a
mov dword [rbp + 0x40], ecx
mov r8d, r12d
sub r8d, ebx
lea rdx, [rbx + r14]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x40]
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14008edee
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
jne 0x14008edc1
mov ecx, WSAAsyncSelect
call sub.KERNEL32.dll_Sleep
jmp 0x14008ee19
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x14008ee78
mov r9d, 1
lea r8, [rbp + 0x40]
lea rdx, [rbp - 0x28]
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x14008ee59
mov eax, dword [rbp + 0x40]
add rbx, rax
lea rcx, [rdi + 0x20]
call fcn.140069b60
mov r8d, dword [rbp + 0x40]
xor edx, edx
lea rcx, [rdi + 0x10]
call fcn.14000e000
mov byte [rdi + 0x31], 1
lea rcx, [rdi + 0x20]
call fcn.140069af0
movzx eax, byte [rdi + 0x30]
test al, al
mov ecx, 0
je 0x14008ed77
mov rdx, rbx
mov rcx, rdi
call fcn.1400abff0
mov rcx, rdi
call fcn.1400abfd0
nop
mov rax, qword [rbp + 0x48]
lock dec dword [rax]
jne 0x14008ecd0
mov rcx, qword [rbp + 0x48]
call fcn.14000c4e0
jmp 0x14008ecd0
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rbp + 0x48]
lock dec dword [rax]
jne 0x14008ee9c
mov rcx, qword [rbp + 0x48]
call fcn.14000c4e0
jmp 0x14008ee9c
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x14008ee64
lea rcx, [rdi + 0x20]
call fcn.140069af0
mov byte [rdi + 0x30], 0
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0xb0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400a03b0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x48
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov r12, rcx
lea rax, vtable.QWinSettingsPrivate.0
mov qword [rcx], rax
xor r13d, r13d
cmp byte [rcx + 0xd8], r13b
je 0x1400a057a
mov rbx, qword [rcx + 0xd0]
cmp dword [rbx + 8], r13d
je 0x1400a057a
lea rcx, [rbx + 0x10]
call fcn.14009ce20
test rax, rax
je 0x1400a057a
cmp byte [rbx + 0x28], r13b
jne 0x1400a057a
lea rcx, [rbx + 0x10]
call fcn.14009ce20
test rax, rax
je 0x1400a057a
lea rax, [0x1415d9378]
mov qword [rsp + 0x88], rax
lock inc dword [0x1415d9378]
mov rbx, qword [r12 + 0xd0]
cmp dword [rbx + 8], r13d
je 0x1400a046c
lea rcx, [rbx + 0x10]
call fcn.14009ce20
test rax, rax
je 0x1400a046c
cmp byte [rbx + 0x28], r13b
jne 0x1400a046c
lea rcx, [rbx + 0x10]
call fcn.14009ce20
mov rbx, rax
jmp 0x1400a046f
mov rbx, r13
lea rcx, [rsp + 0x88]
call fcn.140012e50
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x1400a0560
mov edx, eax
lea rcx, [rsp + 0x28]
call fcn.14009cf30
nop
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.140012020
mov rbx, rax
mov rcx, qword [r12 + 0xd0]
add rcx, 0x10
lea rdx, [rsp + 0x98]
call fcn.14009cfc0
nop
lea rdx, [rsp + 0x90]
mov rcx, rax
call fcn.140012020
mov rdi, rax
mov rcx, rbx
call fcn.140001050
mov rbx, rax
mov rcx, rdi
call fcn.140001050
mov rdx, rax
mov r8, rbx
lea rcx, [0x1415a6e68]
call fcn.14001b2c0
nop
mov rax, qword [rsp + 0x90]
lock dec dword [rax]
jne 0x1400a051b
mov rcx, qword [rsp + 0x90]
call fcn.14000c4e0
nop
mov rax, qword [rsp + 0x98]
lock dec dword [rax]
jne 0x1400a0536
mov rcx, qword [rsp + 0x98]
call fcn.140012a00
nop
mov rax, qword [rsp + 0x20]
lock dec dword [rax]
jne 0x1400a054b
mov rcx, qword [rsp + 0x20]
call fcn.14000c4e0
nop
mov rax, qword [rsp + 0x28]
lock dec dword [rax]
jne 0x1400a0560
mov rcx, qword [rsp + 0x28]
call fcn.140012a00
nop
mov rax, qword [rsp + 0x88]
lock dec dword [rax]
jne 0x1400a057a
mov rcx, qword [rsp + 0x88]
call fcn.140012a00
mov esi, r13d
mov rax, qword [r12 + 0xd0]
cmp dword [rax + 8], r13d
jle 0x1400a05eb
mov rdi, r13
nop
mov rax, qword [r12 + 0xd0]
mov ecx, dword [rax]
cmp ecx, 1
je 0x1400a05bb
mov rax, qword [r12 + 0xd0]
mov r8d, dword [rax + 4]
mov edx, dword [rax + 8]
lea rcx, [r12 + 0xd0]
call fcn.14009d570
mov rbp, qword [r12 + 0xd0]
mov rcx, qword [rdi + rbp + 0x18]
test rcx, rcx
je 0x1400a05d3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rdi + rbp + 0x18], r13
inc esi
add rdi, 0x20
mov rax, qword [r12 + 0xd0]
cmp esi, dword [rax + 8]
jl 0x1400a0590
mov rcx, qword [r12 + 0xd0]
test rcx, rcx
je 0x1400a0649
lock dec dword [rcx]
jne 0x1400a0649
mov rsi, qword [r12 + 0xd0]
lea rdi, [rsi + 0x10]
movsxd rbx, dword [rsi + 8]
shl rbx, 5
add rbx, rdi
cmp rbx, rdi
je 0x1400a063b
nop dword [rax]
sub rbx, 0x20
mov rdx, qword [rbx + 0x10]
lock dec dword [rdx]
jne 0x1400a0636
mov rcx, qword [rbx + 0x10]
call fcn.140012a00
cmp rbx, rdi
jne 0x1400a0620
mov edx, 8
mov rcx, rsi
call fcn.1400464d0
nop
mov rcx, r12
add rsp, 0x48
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
jmp fcn.140085e50
Function at 0x1400b0934
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400b07a4

Function at 0x1400b2ff8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
test rcx, rcx
jne 0x1400b3022
call fcn.1400b2bc0
and dword [rax], 0
call fcn.1400b2ba0
mov ebx, 0x16
mov dword [rax], ebx
call fcn.1400ba664
mov eax, ebx
jmp 0x1400b3072
test edx, 0xfffffff9
jne 0x1400b3005
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400b304b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400b2be0
call fcn.1400b2ba0
mov eax, dword [rax]
jmp 0x1400b3072
test al, 0x10
jne 0x1400b3070
test al, 1
je 0x1400b3070
test bl, 2
je 0x1400b3070
call fcn.1400b2bc0
mov dword [rax], 5
call fcn.1400b2ba0
mov dword [rax], 0xd
jmp 0x1400b3042
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400b308c
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
test rcx, rcx
jne 0x1400b30bc
call fcn.1400b2bc0
and dword [rax], ebx
call fcn.1400b2ba0
mov dword [rax], 0x16
call fcn.1400ba664
or eax, 0xffffffff
jmp 0x1400b30f4
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400b30d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400b2be0
jmp 0x1400b30b7
test dil, dil
jns 0x1400b30e0
and eax, 0xfffffffe
jmp 0x1400b30e3
or eax, 1
mov edx, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1400b30c7
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400b5744
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1400b575c
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400b575e
xor eax, eax
test eax, eax
je 0x1400b576e
mov ecx, eax
call fcn.1400b2be0
or eax, 0xffffffff
jmp 0x1400b5770
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400bad1b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1415dbbb0]
jne 0x1400af4aa
rol rcx, 0x10
test cx, 0xffff
jne 0x1400af4a6
repz ret
ror rcx, 0x10
jmp 0x1400bac74
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1415de610]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1415de708]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400bacf9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1415de610]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400bad1b
mov rax, qword [rsp + 0x88]
mov qword [0x1415de708], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1415de6a8], rax
mov rax, qword [0x1415de708]
mov qword [0x1415de580], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1415de690], rax
mov dword [0x1415de570], 0xc0000409
mov dword [0x1415de574], 1
mov rax, qword [0x1415dbbb0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1415dbbb8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1415de608], eax
mov ecx, 1
call fcn.1400c3674
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1415ad170]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1415de608], 0
jne 0x1400bada2
mov ecx, 1
call fcn.1400c3674
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1400c3c6c
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1415dbbb0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.1400b9838
xor ebx, ebx
cmp qword [0x1415df300], rbx
mov rdi, rax
jne 0x1400c3d7f
lea rcx, [0x1415af9e8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1400c3e56
lea rdx, [0x1415af9d8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400c3e56
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x1415af9c8]
mov rcx, rsi
mov qword [0x1415df300], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x1415af9b0]
mov rcx, rsi
mov qword [0x1415df308], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x1415af990]
mov rcx, rsi
mov qword [0x1415df310], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1415df320], rax
test rax, rax
je 0x1400c3d76
lea rdx, [0x1415af978]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1415df318], rax
jmp 0x1400c3d86
mov rax, qword [0x1415df318]
jmp 0x1400c3d8d
mov rax, qword [0x1415df318]
mov r11, qword [0x1415df320]
cmp rax, rdi
je 0x1400c3df4
cmp r11, rdi
je 0x1400c3df4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1415df320]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x1400c3df4
test rax, rax
je 0x1400c3df4
call rsi
test rax, rax
je 0x1400c3dee
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400c3dee
test byte [rsp + 0x40], 1
jne 0x1400c3df4
bts ebp, 0x15
jmp 0x1400c3e34
mov rcx, qword [0x1415df308]
cmp rcx, rdi
je 0x1400c3e34
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400c3e34
call rax
mov rbx, rax
test rax, rax
je 0x1400c3e34
mov rcx, qword [0x1415df310]
cmp rcx, rdi
je 0x1400c3e34
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400c3e34
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1415df300]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400c3e56
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x1400c3e58
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400af490
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400111ef
Capabilities:
Terminate process

Disassembly:
jmp 0x1400151d0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x14001126c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x1400117a0
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x20]
lea rcx, [0x1400210a0]
call fcn.14001136b
nop
lea r8, [0x140019bb0]
mov edx, 0x65
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x1400117dd
jmp 0x140011857
mov rdx, qword [rbp + 8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
jne 0x1400117f4
jmp 0x140011857
mov rdx, qword [rbp + 8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x14001180d
jmp 0x140011857
mov eax, dword [rbp + 0x24]
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [0x14001c200], rax
cmp qword [0x14001c200], 0
jne 0x14001182b
jmp 0x140011857
mov eax, dword [rbp + 0x24]
mov r8d, eax
mov rdx, qword [rbp + 0x48]
mov rcx, qword [0x14001c200]
call fcn.1400111b3
nop
call qword [0x14001c200]
nop
mov rcx, qword [0x14001c200]
call qword [sym.imp.ucrtbased.dll_free]
nop
xor eax, eax
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret

Function at 0x140011276
Capabilities:
Parse pe header

Disassembly:
jmp 0x140012d00
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140012d20
xor al, al
jmp 0x140012da1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140012d33
xor al, al
jmp 0x140012da1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140012d5d
xor al, al
jmp 0x140012da1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140012d71
xor al, al
jmp 0x140012da1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140012d83
xor al, al
jmp 0x140012da1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140012d9f
xor al, al
jmp 0x140012da1
mov al, 1
add rsp, 0x38
ret