joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006d20
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
xor eax, eax
lea r8, [0x14003a6b5]
mov dword [rsp + 0x2c], eax
lea r11, [0x14003a920]
mov qword [rsp + 0x48], rax
mov r10d, 0xffffffff
lea rax, str.Window
mov rbx, rcx
mov qword [rsp + 0x20], rax
mov edx, r10d
mov r9b, 0x57
nop
cmp r9b, 0x23
jne 0x140006d73
cmp byte [r8], r9b
jne 0x140006d73
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x140006d60
mov ecx, dword [rbx + 0x2f0c]
lea rax, [0x140013100]
mov edi, dword [rbx + 0x2f08]
not edx
mov qword [rsp + 0x30], rax
lea rax, [0x1400131d0]
mov qword [rsp + 0x38], rax
lea rax, [0x1400132b0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x28], edx
cmp edi, ecx
jne 0x140006e75
inc edi
test ecx, ecx
je 0x140006ddf
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x140006de4
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x140006e75
mov rax, qword [0x140045930]
mov qword [rsp + 0x60], rsi
test rax, rax
je 0x140006e08
inc dword [rax + 0x3bc]
movsxd rax, edi
lea rcx, [rax + rax*2]
shl rcx, 4
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdx, qword [rbx + 0x2f10]
mov rsi, rax
test rdx, rdx
je 0x140006e63
movsxd rcx, dword [rbx + 0x2f08]
lea r8, [rcx + rcx*2]
mov rcx, rax
shl r8, 4
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbx + 0x2f10]
test rcx, rcx
je 0x140006e5d
mov rax, qword [0x140045930]
test rax, rax
je 0x140006e5d
dec dword [rax + 0x3bc]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x2f10], rsi
mov rsi, qword [rsp + 0x60]
mov dword [rbx + 0x2f0c], edi
movsxd rax, dword [rbx + 0x2f08]
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x2f10]
add rcx, rcx
movups xmmword [rax + rcx*8], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + rcx*8 + 0x10], xmm1
movups xmmword [rax + rcx*8 + 0x20], xmm0
inc dword [rbx + 0x2f08]
mov byte [rbx], 1
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x140008710
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x140008760
lea r11, [0x14003a920]
nop dword [rax]
cmp r9b, 0x23
jne 0x140008743
cmp byte [r8], r9b
jne 0x140008743
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140008730
mov rcx, qword [0x140045930]
not eax
movsxd rdx, dword [rcx + 0x1a00]
mov r9, qword [rcx + 0x1a08]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x1400087c1
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x1400087b9
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x1400087bc
mov rdx, r8
test rdx, rdx
jne 0x140008790
cmp r9, r10
je 0x1400087d0
cmp dword [r9], eax
jne 0x1400087d0
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret
Function at 0x14000dad0
Capabilities:
Hash data with crc32

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [0x140045930]
lea rdx, [0x14003a920]
mov r8, rcx
mov rsi, qword [rax + 0x1a18]
lea rbx, [rsi + 0xc0]
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
mov r8d, dword [rsi + 0xc4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 9]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xa]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xb]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xc]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xd]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xe]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xf]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [rdx + rcx*4]
not edi
cmp r9d, r8d
jne 0x14000dbd8
lea ecx, [r9 + 1]
test r8d, r8d
je 0x14000dbc4
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x14000dbc9
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.1400143a0
movsxd rcx, dword [rbx]
mov rax, qword [rsi + 0xc8]
mov rsi, qword [rsp + 0x40]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140012d50
Capabilities:
Hash data with crc32

Disassembly:
push r13
push r14
sub rsp, 0x38
mov r13, qword [0x140045930]
mov qword [rsp + 0x50], rbx
mov rbx, rdx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x30], rdi
mov rdi, rcx
mov qword [rsp + 0x28], r12
test rdx, rdx
jne 0x140012d99
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp byte [rcx + rbx], 0
jne 0x140012d90
test r13, r13
je 0x140012da5
inc dword [r13 + 0x3bc]
lea rcx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov qword [rsp + 0x58], rax
mov r14, rax
lea r12, [rax + rbx]
call sub.VCRUNTIME140.dll_memcpy
xor ebp, ebp
mov byte [r12], 0
xor esi, esi
mov rdi, r14
cmp r14, r12
jae 0x140012f6a
mov qword [rsp + 0x20], r15
movzx eax, byte [rdi]
cmp al, 0xa
je 0x140012fb4
cmp al, 0xd
je 0x140012fb4
mov rbx, rdi
cmp rdi, r12
jae 0x140012e13
nop
movzx eax, byte [rbx]
cmp al, 0xa
je 0x140012e13
cmp al, 0xd
je 0x140012e13
inc rbx
cmp rbx, r12
jb 0x140012e00
mov byte [rbx], 0
movzx eax, byte [rdi]
cmp al, 0x3b
je 0x140012f53
cmp al, 0x5b
jne 0x140012f3a
cmp rbx, rdi
jbe 0x140012f3a
cmp byte [rbx - 1], 0x5d
lea r14, [rbx - 1]
jne 0x140012f3a
lea rsi, [rdi + 1]
mov byte [r14], 0
mov r8, r14
mov rcx, rsi
sub r8, rsi
mov edx, 0x5d
call sub.VCRUNTIME140.dll_memchr
mov r15, rax
test rax, rax
je 0x140012e82
lea rcx, [rax + 1]
mov edx, 0x5b
sub r14, rcx
mov r8, r14
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140012e82
mov byte [r15], 0
jmp 0x140012e8c
lea rsi, str.Window
mov rax, rdi
movzx r9d, byte [rsi]
lea r11, [rax + 1]
mov r10, qword [0x140045930]
mov r14d, 0xffffffff
lea r8, [rsi + 1]
mov eax, r14d
test r9b, r9b
je 0x140012ee6
nop dword [rax]
cmp r9b, 0x23
jne 0x140012ec3
cmp byte [r8], r9b
jne 0x140012ec3
cmp byte [r8 + 1], r9b
cmove eax, r14d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
lea rcx, [0x14003a920]
inc r8
xor eax, dword [rcx + rdx*4]
test r9b, r9b
jne 0x140012eb0
mov r8d, dword [r10 + 0x2f08]
xor ecx, ecx
not eax
test r8d, r8d
jle 0x140012f10
mov r9, qword [r10 + 0x2f10]
lea rdx, [r9 + 8]
cmp dword [rdx], eax
je 0x140012f16
inc ecx
add rdx, 0x30
cmp ecx, r8d
jl 0x140012f01
xor esi, esi
xor ebp, ebp
jmp 0x140012f53
movsxd rax, ecx
lea rsi, [rax + rax*2]
shl rsi, 4
add rsi, r9
je 0x140012f12
mov rax, qword [rsi + 0x10]
mov r8, r11
mov rdx, rsi
mov rcx, r13
call rax
mov rbp, rax
jmp 0x140012f53
test rsi, rsi
je 0x140012f53
test rbp, rbp
je 0x140012f53
mov r9, rdi
mov r8, rbp
mov rdx, rsi
mov rcx, r13
call qword [rsi + 0x18]
lea rdi, [rbx + 1]
cmp rdi, r12
jb 0x140012de3
mov r14, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
test r14, r14
je 0x140012f9a
mov rax, qword [0x140045930]
test rax, rax
je 0x140012f9a
dec dword [rax + 0x3bc]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [r13 + 0x2eec], 1
add rsp, 0x38
pop r14
pop r13
ret
inc rdi
jmp 0x140012de3
Function at 0x140012fc0
Capabilities:
Write file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x20
mov rbx, qword [0x140045930]
xor r15d, r15d
mov r14, rcx
mov dword [rbx + 0x2ef0], r15d
test rcx, rcx
je 0x1400130eb
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
lea rdi, [rbx + 0x2ef8]
mov dword [rbx + 0x2ef0], r15d
mov ecx, dword [rdi + 4]
test ecx, ecx
jns 0x140013024
mov eax, ecx
cdq
sub eax, edx
mov edx, r15d
sar eax, 1
add eax, ecx
mov rcx, rdi
test eax, eax
cmovg edx, eax
call fcn.1400141e0
mov dword [rdi], r15d
cmp dword [rdi + 4], r15d
jne 0x14001303a
mov edx, 8
mov rcx, rdi
call fcn.1400141e0
movsxd rcx, dword [rdi]
mov ebp, r15d
mov rax, qword [rdi + 8]
mov byte [rcx + rax], r15b
inc dword [rdi]
cmp dword [rbx + 0x2f08], r15d
jle 0x140013085
mov rsi, r15
nop word [rax + rax]
mov r9, qword [rbx + 0x2f10]
mov r8, rdi
add r9, rsi
mov rcx, rbx
mov rdx, r9
call qword [r9 + 0x20]
inc ebp
add rsi, 0x30
cmp ebp, dword [rbx + 0x2f08]
jl 0x140013060
mov eax, dword [rdi]
lea rdx, [0x14003a774]
test eax, eax
lea rdi, [0x140045928]
lea ecx, [rax - 1]
mov rax, qword [rbx + 0x2f00]
cmove ecx, r15d
test rax, rax
movsxd rsi, ecx
mov rcx, r14
cmovne rdi, rax
call fcn.1400027a0
mov rbp, qword [rsp + 0x40]
mov rbx, rax
test rax, rax
je 0x1400130e1
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rbx
ret
Function at 0x14001ef70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x14001f101
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov edi, r9d
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x14001efe0
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.14001e990
mov r8d, dword [rbx + 0x80]
mov r9d, edi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.14001dff0
mov dword [rbx + 0x80], 0
jmp 0x14001f0ed
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.14001ceb0
movzx edx, word [rbx + 0x4c]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rsi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rsi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], edi
movsd xmm0, qword [rsi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], edi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x4c], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140037e90
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
lea ecx, [rbx + 8]
call fcn.140038a98
lea rcx, [0x1400358e0]
mov qword [rax], rcx
mov qword [rbp - 0x50], rax
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x140038440]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x20], rax
test rax, rax
je 0x140038027
lea ecx, [rbx + 8]
call fcn.140038a98
lea rcx, [0x140037c00]
mov qword [rax], rcx
mov qword [rbp - 0x50], rax
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x140038440]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x30], rax
test rax, rax
je 0x140038018
lea ecx, [rbx + 8]
call fcn.140038a98
lea rcx, [0x140037d70]
mov qword [rax], rcx
mov qword [rbp - 0x50], rax
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x140038440]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x40], rax
test rax, rax
je 0x140038009
cmp dword [rbp - 0x18], ebx
je 0x140037ffd
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x50], xmm0
lea rcx, [rbp - 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140037ffd
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x20], xmm0
cmp dword [rbp - 0x28], eax
je 0x140037ffd
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x50], xmm0
lea rcx, [rbp - 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140037ffd
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
cmp dword [rbp - 0x38], eax
je 0x140037ffd
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x50], xmm0
lea rcx, [rbp - 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140037ffd
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x40], xmm0
nop dword [rax + rax]
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140037ff0
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x28], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x18], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x140039094
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400390de
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400390de
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400390de
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400390de
cmp dword [rcx + 0x84], 0xe
jbe 0x1400390de
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400390e0
xor al, al
add rsp, 0x28
ret
Function at 0x14000df10
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x28]
call sub.KERNEL32.dll_GetNativeSystemInfo
mov eax, dword [rsp + 0x2c]
add eax, dword [0x1402c3440]
mov dword [rsp + 0x24], eax
setb al
test al, 1
jne 0x14000df35
jmp 0x14000df3a
call fcn.140001800
mov eax, dword [rsp + 0x24]
mov dword [0x1402c3448], eax
add rsp, 0x58
ret
Function at 0x14009d6e0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rcx
mov byte [rsp + 0x43], dl
mov rcx, qword [rsp + 0x38]
call fcn.1400404c0
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call sub.KERNEL32.dll_GetFileAttributesW
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x4c]
cmp eax, dword [0x1402c3424]
jne 0x14009d731
mov rdx, qword [rsp + 0x38]
lea rcx, [0x1401b1ef0]
call fcn.14009ca20
mov al, byte [rsp + 0x43]
test al, 1
jne 0x14009d74a
jmp 0x14009d768
mov byte [rsp + 0x4b], 0
mov ecx, dword [rsp + 0x4c]
mov edx, 1
call fcn.140014760
test al, 1
jne 0x14009d76f
jmp 0x14009d7a2
mov r8, qword [rsp + 0x38]
lea rcx, [0x1401b1ef0]
mov edx, 2
call fcn.14009de30
mov rcx, rax
call fcn.140001ea0
xor eax, eax
add rsp, 0x58
ret
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x2c], eax
mov ecx, 1
call fcn.14001a5a0
mov edx, dword [rsp + 0x2c]
mov rcx, qword [rsp + 0x30]
and edx, eax
call sub.KERNEL32.dll_SetFileAttributesW
cmp eax, 0
jne 0x14009d7a4
jmp 0x14009d7ab
jmp 0x14009d7af
mov byte [rsp + 0x4b], 1
jmp 0x14009d7ad
jmp 0x14009d7ad
jmp 0x14009d7af
mov ecx, dword [rsp + 0x4c]
mov edx, 0x400
call fcn.140014760
mov cl, al
and cl, 1
mov byte [rsp + 0x4a], cl
test al, 1
jne 0x14009d7cc
jmp 0x14009d7e0
mov ecx, dword [rsp + 0x4c]
mov edx, 0x10
call fcn.140014760
mov byte [rsp + 0x2b], al
jmp 0x14009d7e8
mov al, byte [rsp + 0x4a]
mov byte [rsp + 0x2b], al
mov al, byte [rsp + 0x2b]
and al, 1
mov byte [rsp + 0x49], al
test byte [rsp + 0x49], 1
jne 0x14009d7fb
jmp 0x14009d80b
mov rcx, qword [rsp + 0x50]
call fcn.1401609e0
mov dword [rsp + 0x24], eax
jmp 0x14009d819
mov rcx, qword [rsp + 0x50]
call fcn.140160a30
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14009d82f
mov al, 1
add rsp, 0x58
ret
test byte [rsp + 0x4b], 1
jne 0x14009d838
jmp 0x14009d848
mov rcx, qword [rsp + 0x50]
mov edx, dword [rsp + 0x4c]
call sub.KERNEL32.dll_SetFileAttributesW
jmp 0x14009d84a
jmp 0x14009d84a
mov rdx, qword [rsp + 0x38]
lea rcx, [0x1401b1ef0]
call fcn.14009e250
mov rcx, rax
call fcn.140001ea0
int3
Function at 0x1400b5200
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x78
lea rcx, [0x1401b2590]
call fcn.14001f360
mov rdx, rax
mov qword [rsp + 0x38], rdx
mov ecx, 1
xor eax, eax
cmp rdx, 0
cmove ecx, eax
mov dword [rsp + 0x44], ecx
xor eax, eax
cmp eax, ecx
je 0x1400b5268
jmp 0x1400b5271
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x30], rax
jmp 0x1400b52a3
call fcn.140007270
mov rcx, rax
xor edx, edx
xor eax, eax
mov r8d, eax
lea r9, [rsp + 0x68]
call sub.SHELL32.dll_SHGetKnownFolderPath
cmp eax, 0
sete al
and al, 1
test al, 1
jne 0x1400b52ad
jmp 0x1400b52f5
xor eax, eax
mov qword [rsp + 0x28], rax
jmp 0x1400b5280
mov ecx, dword [rsp + 0x44]
mov eax, 1
cmp eax, ecx
je 0x1400b5292
jmp 0x1400b52a3
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x70], rax
cmp rax, 0
jne 0x1400b5232
jmp 0x1400b523e
mov rcx, qword [rsp + 0x38]
call fcn.1400300a0
mov qword [rsp + 0x28], rax
jmp 0x1400b5280
mov rax, qword [rsp + 0x30]
add rsp, 0x78
ret
mov rcx, qword [rsp + 0x68]
call fcn.1400302e0
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x68]
call sub.ole32.dll_CoTaskMemFree
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
jmp 0x1400b5309
lea rcx, [0x1401b25b0]
call fcn.140083600
mov rcx, rax
call fcn.140001df0
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
jmp 0x1400b52a3
Function at 0x1400bcd10
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], r8
mov byte [rsp + 0x33], dl
mov dword [rsp + 0x34], ecx
mov al, byte [rsp + 0x33]
mov rcx, qword [rsp + 0x28]
mov edx, dword [rsp + 0x34]
mov dword [rsp + 0x38], edx
mov qword [rsp + 0x40], rcx
and al, 1
mov byte [rsp + 0x3c], al
mov rcx, qword [rsp + 0x40]
mov edx, dword [rsp + 0x38]
call sub.ADVAPI32.dll_SystemFunction036
movzx eax, al
cmp eax, 0
sete al
and al, 1
test al, 1
jne 0x1400bcd5c
jmp 0x1400bcd70
lea rcx, [0x1401b28a0]
call fcn.140083600
mov rcx, rax
call fcn.140001df0
nop
add rsp, 0x48
ret
Function at 0x1400bf560
Capabilities:
Create pipe

Disassembly:
sub rsp, 0xc8
mov byte [rsp + 0x5e], dl
mov byte [rsp + 0x5f], cl
lea rcx, [0x1401b2af0]
lea rdx, [0x1401b2b10]
call fcn.1400925d0
mov rcx, rax
call fcn.1400a8640
mov byte [rsp + 0x88], dl
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x80]
call fcn.1400a55e0
mov rcx, rax
mov al, byte [rsp + 0x5e]
mov byte [rsp + 0x78], dl
mov qword [rsp + 0x70], rcx
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0xc0], rcx
mov dword [rsp + 0xbc], 0
mov dword [rsp + 0xb8], 0x80002
test al, 1
jne 0x1400bf5df
jmp 0x1400bf5e1
jmp 0x1400bf5f4
mov eax, dword [rsp + 0xb8]
or eax, 0x40000000
mov dword [rsp + 0xb8], eax
mov rcx, qword [rsp + 0xc0]
call fcn.1400201c0
mov rcx, rax
mov edx, dword [rsp + 0xb8]
mov r8d, dword [rsp + 0xbc]
mov r9d, 1
xor eax, eax
xor eax, eax
mov dword [rsp + 0x20], 0x2000
mov dword [rsp + 0x28], 0x2000
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.KERNEL32.dll_CreateNamedPipeA
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x50], rax
call fcn.140001f40
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rax]
call fcn.1400a01e0
test al, 1
jne 0x1400bf670
jmp 0x1400bf684
lea rcx, [0x1401b2b30]
call fcn.1400c0a70
mov rcx, rax
call fcn.140011610
mov al, byte [rsp + 0x5e]
test al, 1
jne 0x1400bf68e
jmp 0x1400bf690
jmp 0x1400bf6a5
call fcn.1400c0fb0
mov rcx, rax
mov rdx, qword [rsp + 0xb0]
call fcn.1400c2b90
mov al, byte [rsp + 0x5f]
mov dword [rsp + 0xac], 0x20000000
test al, 1
jne 0x1400bf6ba
jmp 0x1400bf6bc
jmp 0x1400bf6cf
mov eax, dword [rsp + 0xac]
or eax, 0x40000000
mov dword [rsp + 0xac], eax
mov rcx, qword [rsp + 0xc0]
call fcn.1400404c0
mov rcx, rax
mov eax, dword [rsp + 0xac]
mov edx, 0x80000100
xor r8d, r8d
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x30], 0
call sub.KERNEL32.dll_CreateFileW
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x48], rax
call fcn.140001f40
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rax]
call fcn.1400a01e0
test al, 1
jne 0x1400bf738
jmp 0x1400bf74c
lea rcx, [0x1401b2b50]
call fcn.1400c0a70
mov rcx, rax
call fcn.140011610
mov al, byte [rsp + 0x5f]
test al, 1
jne 0x1400bf756
jmp 0x1400bf758
jmp 0x1400bf76d
call fcn.1400c0fb0
mov rcx, rax
mov rdx, qword [rsp + 0xa0]
call fcn.1400c2b90
mov rcx, qword [rsp + 0xa0]
xor edx, edx
mov dword [rsp + 0x44], edx
call fcn.140160664
mov dl, byte [rsp + 0x5f]
mov ecx, eax
call fcn.1400beb00
mov edx, dword [rsp + 0x44]
mov qword [rsp + 0x98], rax
mov rcx, qword [rsp + 0xb0]
call fcn.140160664
mov dl, byte [rsp + 0x5e]
mov ecx, eax
call fcn.1400beb00
mov qword [rsp + 0x90], rax
mov rcx, qword [rsp + 0x90]
mov dl, 1
call fcn.1400bde10
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
add rsp, 0xc8
ret