joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401573d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x1401ba028]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x1401573fa
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140157419
mov edi, eax
bt eax, 0xa
jae 0x140157411
test bl, bl
je 0x140157427
and edi, 0x10
shr edi, 4
jmp 0x140157429
mov ecx, 2
call fcn.1400b5710
test al, al
jne 0x140157446
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1400de300
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x80
mov r9d, 2
call fcn.1401318e0
lea rcx, [rsp + 0x38]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1401151c0
mov rcx, rax
mov rdx, rsi
call fcn.140132690
mov rcx, rdi
call fcn.140131960
jmp 0x140157427

Function at 0x1401574a0
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov ebx, r8d
mov rsi, rcx
mov rax, qword [0x1401ba028]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x1401574cb
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x1401574ff
test bl, bl
je 0x1401574ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140157571
mov ecx, 2
call fcn.1400b5710
test al, al
jne 0x14015751c
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1400de300
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x61
mov r9d, 2
call fcn.1401318e0
lea rcx, [rsp + 0x38]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.1401151c0
mov rcx, rax
mov rdx, rsi
call fcn.140132690
mov rcx, rdi
call fcn.140131960
jmp 0x1401574fd
mov dil, 1
mov rcx, rsi
mov dl, 1
call fcn.1401573d0
test al, al
jne 0x1401574ff
mov ecx, 2
call fcn.1400b5710
test al, al
je 0x1401574fd
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x5c
mov r9d, 2
call fcn.140048390
lea rcx, [rsp + 0x38]
mov rdx, rsi
call fcn.140132690
lea rdx, str._not_a_directory
mov r8d, 0x10
mov rcx, rax
call fcn.1401151c0
mov rcx, rdi
call fcn.1400489e0
jmp 0x1401574fd
Function at 0x1401575f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rsi, rcx
mov rax, qword [0x1401ba028]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp byte [rcx + 0x17], 0
jns 0x140157617
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140157647
test eax, 0x410
sete sil
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400de300
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400b5710
test al, al
jne 0x140157659
xor esi, esi
jmp 0x14015762b
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x73
mov r9d, 2
call fcn.1401318e0
lea rcx, [rsp + 0x40]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1401151c0
mov rcx, rax
mov rdx, rsi
call fcn.140132690
mov rcx, rdi
call fcn.140131960
jmp 0x140157655

Function at 0x1401576b0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rsi, rcx
mov rax, qword [0x1401ba028]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp byte [rcx + 0x17], 0
jns 0x1401576d7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401576ee
and eax, 0x410
cmp eax, 0x410
je 0x140157733
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x1401576fa
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x140157717
mov ecx, 2
call fcn.1400b5710
test al, al
jne 0x140157754
xor edi, edi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400de300
mov eax, edi
add rsp, 0x178
pop rdi
pop rsi
ret
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400de300
mov rcx, rsi
add rsp, 0x178
pop rdi
pop rsi
jmp fcn.1401577b0
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x93
mov r9d, 2
call fcn.1401318e0
lea rcx, [rsp + 0x40]
lea rdx, str.DeleteFile
mov r8d, 0xb
call fcn.1401151c0
mov rcx, rax
mov rdx, rsi
call fcn.140132690
mov rcx, rdi
call fcn.140131960
jmp 0x140157715

Function at 0x1401577b0
Capabilities:
Delete directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x1401ba028]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x1401577d8
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, eax
test eax, eax
jne 0x1401577f2
mov ecx, 2
call fcn.1400b5710
test al, al
jne 0x140157814
test edi, edi
setne bl
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1400de300
mov eax, ebx
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov r8d, 0x2f
mov r9d, 2
call fcn.1401318e0
lea rcx, [rsp + 0x38]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.1401151c0
mov rcx, rax
mov rdx, rsi
call fcn.140132690
mov rcx, rbx
call fcn.140131960
jmp 0x1401577f2
Function at 0x1401666c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, r8
mov rax, qword [0x1401ba028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, 0xaaaaaaaa
lea rdi, [rsp + 0x44]
mov dword [rdi], eax
lea r8, [rsp + 0x40]
mov dword [r8], eax
lea rax, [rsp + 0x3c]
mov dword [rax], 4
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rdi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x140166720
mov eax, dword [rsp + 0x40]
mov dword [rsi], eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400de300
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret

Function at 0x1401667e0
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x1a0
mov rax, qword [0x1401ba028]
xor rax, rsp
mov qword [rsp + 0x198], rax
movaps xmm0, xmmword [0x1401879f0]
lea rsi, [rsp + 0x160]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsi + 0x20], 0x100
jb 0x140166834
mov ecx, 1
call fcn.1400b5710
test al, al
jne 0x140166863
mov eax, dword [rsp + 0x180]
cmp eax, 0x100
mov esi, 0xff
cmovb esi, eax
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1400de300
mov eax, esi
add rsp, 0x1a0
pop rsi
ret
lea rdx, str....._third_partycrashpadcrashpad_snapshotwin_system_snapshot_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x117
mov r9d, 1
call fcn.140048390
lea rcx, [rsp + 0x38]
lea rdx, str.dwNumberOfProcessors_exceeds_uint8_t_storage
mov r8d, 0x2c
call fcn.1401151c0
mov rcx, rsi
call fcn.1400489e0
jmp 0x140166834
Function at 0x1401728f0
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1401ba028]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x1401879f0]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.1401149f0
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.140177870
test al, al
je 0x140172a42
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x1401729bd
mov rcx, r14
call fcn.1401149f0
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0x108
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.140177870
test al, al
je 0x140172a06
cmp dword [rbx], 0x4550
jne 0x140172a73
mov sil, 1
test rdi, rdi
je 0x140172a52
mov qword [rdi], r14
jmp 0x140172a52
mov ecx, 1
call fcn.1400b5710
test al, al
je 0x140172a50
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.140048390
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x140172ab5
mov ecx, 1
call fcn.1400b5710
test al, al
je 0x140172a50
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.140048390
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x140172aaf
mov ecx, 1
call fcn.1400b5710
test al, al
jne 0x140172a83
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.1400de300
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.1400b5710
test al, al
je 0x140172a50
jmp 0x140172ae9
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.140048390
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.1401151c0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x140172aca
and r8d, 0x7f
jmp 0x140172ad1
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.1401151c0
mov rcx, rdi
call fcn.1400489e0
jmp 0x140172a50
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.140048390
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x140172ab5
Function at 0x140172b20
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1401ba028]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x1401879f0]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.1401149f0
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.140177870
test al, al
je 0x140172c72
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x140172bed
mov rcx, r14
call fcn.1401149f0
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0xf8
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.140177870
test al, al
je 0x140172c36
cmp dword [rbx], 0x4550
jne 0x140172ca3
mov sil, 1
test rdi, rdi
je 0x140172c82
mov qword [rdi], r14
jmp 0x140172c82
mov ecx, 1
call fcn.1400b5710
test al, al
je 0x140172c80
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.140048390
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x140172ce5
mov ecx, 1
call fcn.1400b5710
test al, al
je 0x140172c80
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.140048390
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x140172cdf
mov ecx, 1
call fcn.1400b5710
test al, al
jne 0x140172cb3
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.1400de300
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.1400b5710
test al, al
je 0x140172c80
jmp 0x140172d19
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.140048390
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.1401151c0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x140172cfa
and r8d, 0x7f
jmp 0x140172d01
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.1401151c0
mov rcx, rdi
call fcn.1400489e0
jmp 0x140172c80
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.140048390
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x140172ce5
Function at 0x180001010
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rax, rdx
xor edi, edi
mov rbx, rcx
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [rdi + 3]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18000118f
xor edx, edx
mov qword [rsp + 0x80], rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp eax, 0xffffffff
jne 0x18000108e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180001187
mov rcx, rbp
mov qword [rsp + 0x88], r14
call fcn.180004c20
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rdi
mov r8d, ebp
mov rdx, rax
mov rcx, rsi
mov r14, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18000116e
cmp dword [rsp + 0x40], ebp
jne 0x18000116e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rbx]
mov ecx, 1
test edx, edx
je 0x1800010fa
mov rax, qword [rbx + 8]
cmp byte [rax], 0xd
jne 0x1800010f1
cmp byte [rax + 1], 0xa
jne 0x1800010f1
inc ecx
inc rax
sub rdx, 1
jne 0x1800010e4
mov dword [rbx + 0x10], ecx
mov eax, 4
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.180004c20
mov qword [rbx + 0x18], rax
mov edx, edi
mov dword [rax], edi
cmp dword [rbx], edx
jbe 0x18000115c
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx + 8]
mov eax, edx
cmp byte [rax + r8], 0xd
jne 0x180001156
lea r9d, [rdx + 2]
lea eax, [r9 - 1]
cmp byte [rax + r8], 0xa
jne 0x180001156
mov rax, qword [rbx + 0x18]
inc edi
mov dword [rax + rdi*4], r9d
inc edx
cmp edx, dword [rbx]
jb 0x180001130
mov rcx, rbx
call fcn.180001260
mov rcx, r14
call fcn.180004c28
jmp 0x18000117f
mov rcx, r14
call fcn.180004c28
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
mov rax, rbx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180004c00
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x180001e00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov rbx, rcx
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov dword [rsp + 0x20], 4
lea rcx, str._rdpwrap.txt
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180001e9f
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], 0
jne 0x180001e72
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180004c00
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x180004b40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
mov rbx, rdx
lea rcx, [0x1800201b0]
call fcn.180001e00
cmp byte [0x180024ea0], 0
jne 0x180004b69
call fcn.180002b10
mov rax, qword [0x180024eb0]
test rax, rax
je 0x180004b7c
mov rdx, rbx
mov ecx, edi
call rax
lea rcx, str.____ServiceMain_r_n
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.180001e00

Function at 0x180004ba0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x1800201e0]
call fcn.180001e00
cmp byte [0x180024ea0], 0
jne 0x180004bc3
call fcn.180002b10
mov rax, qword [0x180024ea8]
test rax, rax
je 0x180004bd4
mov rcx, rbx
call rax
lea rcx, str.____SvchostPushServiceGlobals_r_n
add rsp, 0x20
pop rbx
jmp fcn.180001e00
Function at 0x180010c0c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180010c3c
xor eax, eax
jmp 0x180010cff
mov rbp, rbx
cmp word [rax], si
je 0x180010c61
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180010c48
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180010c44
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18000ecd0
movsxd r14, eax
test eax, eax
jne 0x180010c9f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180010c35
mov rcx, r14
call fcn.18000f234
mov rdi, rax
test rax, rax
jne 0x180010cb8
xor ecx, ecx
call fcn.18000f294
jmp 0x180010c94
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18000ecd0
test eax, eax
jne 0x180010ce9
mov rcx, rdi
call fcn.18000f294
jmp 0x180010cf3
xor ecx, ecx
call fcn.18000f294
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x180015de0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180015e08
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180015e08
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1403e5202
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsf r14, r13
mov dword [rsp + 2], ebp
rdtsc
xchg qword [rsp], r10
push word [rsp + 4]
jmp 0x1403e51ec

Function at 0x1403e55ee
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov rbx, r11
xchg byte [rsp + 3], bpl
xchg qword [rsp], rdi
jmp 0x1403e5611

Function at 0x1403e5a68
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r14d, dword [rsp + 0x25]
mov r9b, 0xe9
sub rsp, 0x1b
jmp 0x1403e5a9d
bsf r15w, dx
bsf r15, rdx
mov rbx, qword [rsp + 0x24]
push word [rsp + 0x35]
mov r9b, spl
jmp 0x1403e5a87

Function at 0x1403e5ebb
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r8, r10
mov word [rsp + 5], r9w
mov rdx, rsi
jmp 0x1403e5f44
xchg byte [rsp], r13b
xchg word [rsp], ax
lea r8, [rsp + r9]
jmp 0x1403e5f2a
mov r15w, 0xc46d
lea rax, [r8 + riz + 6]
mov r9w, word [rsp + 1]
cpuid
inc r11w
stc
jmp 0x1403e5efb
and ecx, 0x72db678e
mov rbp, rsp
mov r9w, 0xdcc0
xchg byte [rsp], sil
jmp 0x1403e5f59
lea rsp, [rsp + 4]
cmc
add bpl, spl
bswap ecx
pop r9w
bsr rdi, r14
jmp 0x1403e5f11
mov byte [rsp], al
pushfq
mov r11, qword [rsp + 9]
pop si
xchg dword [rsp + 3], r11d
mov r15d, 0xccb59b9
jmp 0x1403e5fad
lea rsi, [r11 + riz]
bswap r15d
cmc
mov bx, 0xf0a0
xchg dword [rsp + 5], ecx
jmp 0x1403e5fde
sub rsp, 0x14
add rsp, 0xd
mov r15, rsi
mov r8w, word [rsp + 0xd]
push word [rsp + 9]
mov sil, 0xbd
jmp 0x1403e5f97
not rsi
lea rsp, [rsp + 0x13]
push word [rsp]
cpuid
jmp 0x1403e5ff9
xchg dword [rsp + 9], r9d
pushfq
lea r9, [0xffffffff9cb98af1]
mov edx, r15d
pop word [rsp + 0xb]
xchg edi, r10d
jmp 0x1403e5fc8
pop r13w
cpuid
mov r14d, dword [rsp + 2]
pop word [rsp]
shl r13, cl
jmp 0x1403e6048
bt r11, rdx
shl rdi, cl
xchg dl, r10b
mov r11b, byte [rsp]
jmp 0x1403e61c5
xchg byte [rsp], dil
xchg byte [rsp], dl
pop r14w
rdtsc
mov r11, rdi
cld
jmp 0x1403e6032
lea r9, [rbp + riz - 0xe0]
dec r8w
setp dl
call fcn.1403e60ae
push rdx
int 0x66
push rsp
push sp
xchg r10w, r15w
lea rsi, [r9 + r10]
neg r8b
bswap rdi
not cl
jmp 0x1403e6083
mov cx, di
mov r15d, edi
cpuid
mov edi, edx
rdtsc
bswap r8d
jmp 0x1403e6099
bswap r9
mov cx, word [rsp]
bts r9d, edi
setbe bl
mov bx, word [rsp]
mov rbp, qword [rsp]
jmp 0x1403e60c5

Function at 0x1403e6142
Capabilities:
Execute anti-debugging instructions

Disassembly:
adc r13, r12
push di
shr r15w, cl
mov r9w, r14w
jmp 0x1403e6123
inc r9d
lea r13, [rbp*4]
bswap eax
xchg r10, r13
mov bx, r15w
pop word [rsp]
jmp 0x1403e60d6
lea rdx, [rax + rax]
mov r10, r15
rcl bp, cl
mov r14d, dword [rsp + 3]
neg bl
mov r11b, byte [rsp + 4]
jmp 0x1403e60ec
mov r9d, esi
mov ebx, dword [rsp + 4]
xchg r10, rcx
bswap r9d
sete bpl
xchg r11, r14
jmp 0x1403e615c
mov rbx, 0xffffffffd134134e
xchg qword [rsp], r13
lea rsp, [rsp + 6]
xchg r11b, dl
bsr r13w, bx
jmp 0x1403e610b
mov r13d, 0x263b3e5b
lea r10, [r14 + r14]
stc
mov di, r15w
sub rsp, 0x13
clc
jmp 0x1403e61a6
cpuid
xchg rbx, r15
xchg rbp, r9
sub rsp, 1
cld
push r10w
jmp 0x1403e6190
Function at 0x1403e640c
Capabilities:
Execute anti-debugging instructions

Disassembly:
add r10w, bp
mov bpl, cl
jmp 0x1403e6449
lea rcx, [rdx + riz - 0x5a91]
pop word [rsp + 0xd]
mov r11w, word [rsp + 0x13]
mov bp, bx
bsf rsi, rcx
mov byte [rsp + 0xe], al
jmp 0x1403e6433
Function at 0x140002952
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
test rdx, rdx
mov rsi, rcx
mov rbx, rdx
je 0x140002971
mov rcx, rdx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov r8, rax
mov rcx, rbx
mov r9, rsi
mov edx, 1
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.14001a4e8

Function at 0x1400055bb
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov qword [rsp + 0x28], rdx
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, qword [rsp + 0x28]
mov rcx, rsi
mov edx, 1
mov rbx, rax
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, rbx
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.14001a4e8

Function at 0x1400055fa
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
cmp qword [0x1402ca0f0], 0
jne 0x140005612
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.1400055bb
lea rsi, [rsp + 0x20]
mov rdx, rcx
mov rcx, rsi
call fcn.140005534
mov rbx, qword [rsp + 0x28]
mov rcx, rsi
call qword [0x1402ca0f0]
test rbx, rbx
je 0x140005643
test byte [rbx + 7], 0x40
jne 0x140005643
mov rcx, rbx
call fcn.1400039df
lea rcx, [0x140020320]
call fcn.140015130
cmp byte [rax], 0
je 0x14000567b
lea rcx, [0x140020220]
mov byte [rax], 0
call fcn.140015130
xor r8d, r8d
mov rcx, rax
mov rax, qword [rax]
mov rdx, qword [rax + 0x38]
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.140003f44
add rsp, 0x38
pop rbx
pop rsi
ret

Function at 0x140005cf2
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
lea r12, [0x1402ca0c0]
xor ebx, ebx
lea r14, [0x140020320]
lea r13, [rsp + 0x20]
mov rsi, rcx
mov rdi, rdx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbp, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
cmp rbx, rdi
mov ecx, 1
jl 0x140005d78
call rbp
mov r8d, 1
mov edx, 1
lea rcx, [0x14002139b]
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ecx, 1
call rbp
mov rcx, rax
call fcn.14001a4e8
mov rcx, r12
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rbp
xor r8d, r8d
mov rdx, r13
mov rcx, rax
mov rax, rbx
shl rax, 4
movups xmm0, xmmword [rsi + rax]
movaps xmmword [rsp + 0x20], xmm0
call fcn.140005bcb
mov rcx, r14
call fcn.140015130
cmp byte [rax], 0
jne 0x140005daa
inc rbx
jmp 0x140005d2b
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret