joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140029a0c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001d0d4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001d0d4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140029b5c
cmp rax, 0xffffffffffffffff
je 0x140029b5c
xor edi, edi
test rbp, rbp
jle 0x140029b07
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001fa00
mov rbx, rax
test rax, rax
jne 0x140029a94
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140029afd
mov edx, 0x8000
mov ecx, r14d
call fcn.14001aa08
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001ddb0
cmp eax, 0xffffffff
je 0x140029add
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140029aa4
mov edx, r15d
mov ecx, r14d
call fcn.14001aa08
jmp 0x140029afd
cmp byte [rsi + 0x38], dil
je 0x140029af4
cmp dword [rsi + 0x34], 5
jne 0x140029af4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140029afd
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b79c
jmp 0x140029b70
jns 0x140029b70
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001d0d4
cmp rax, 0xffffffffffffffff
jne 0x140029b28
cmp byte [rsi + 0x30], dil
je 0x140029b70
mov edi, dword [rsi + 0x2c]
jmp 0x140029b70
mov ecx, r14d
call fcn.140018ec4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140029b70
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029b70
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029b69
mov eax, dword [rsi + 0x2c]
jmp 0x140029b6e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001d0d4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14002ac60
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002ac88
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002ac88
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140006878
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x140008090]
test rax, rax
je 0x1400068c2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400068c2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400068c2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400068c2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400068c2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400068c4
xor al, al
add rsp, 0x28
ret
Function at 0x180068c30
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x180068b07
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180068b07
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x180068b07
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x180068b07
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x180068b07
cmp dword [rcx + 0x84], 0xe
jbe 0x180068b07
cmp dword [rcx + 0xf8], 0
je 0x180068b07
mov ecx, ebx
call fcn.180068ba8
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.180068998
cmp dword [rbp + 0x20], 0
je 0x180068b54
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.180068b5c
int3
xor r8d, r8d
xor edx, edx
jmp 0x180068aa0
Function at 0x140003520
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
cmp rcx, 0xffffffffffffffff
jne 0x140003546
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
dec rcx
call fcn.140003520
movzx edx, word [rdi + rbx*2]
mov ecx, eax
mov rbx, qword [rsp + 0x30]
xor rdx, rcx
movzx ecx, dl
lea rdx, [0x14002c780]
shr eax, 8
xor eax, dword [rdx + rcx*4]
add rsp, 0x20
pop rdi
ret

Function at 0x140003580
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
cmp rcx, 0xffffffffffffffff
jne 0x1400035a6
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
dec rcx
call fcn.140003580
movsx edx, byte [rbx + rdi]
xor r8d, r8d
mov rbx, qword [rsp + 0x30]
mov r9d, 0x20
lea ecx, [rdx - 0x41]
cmp cl, 0x19
mov ecx, edx
lea rdx, [0x14002c780]
cmovbe r8d, r9d
or r8, rcx
xor r8, rax
shr eax, 8
movzx ecx, r8b
xor eax, dword [rdx + rcx*4]
add rsp, 0x20
pop rdi
ret

Function at 0x1400035f0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
cmp rcx, 0xffffffffffffffff
jne 0x140003616
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
dec rcx
call fcn.1400035f0
movzx edx, word [rdi + rbx*2]
xor r8d, r8d
mov rbx, qword [rsp + 0x30]
mov r9d, 0x20
lea ecx, [rdx - 0x41]
cmp cx, 0x19
lea rcx, [0x14002c780]
cmovbe r8d, r9d
or r8, rdx
movzx edx, al
movzx r9d, r8b
xor r9, rdx
shr eax, 8
xor eax, dword [rcx + r9*4]
add rsp, 0x20
pop rdi
ret

Function at 0x140003660
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x28
mov r11, rcx
mov r10, 0xffffffffffffffff
nop
inc r10
cmp word [rcx + r10*2], 0
jne 0x140003670
dec r10
cmp r10, 0xffffffffffffffff
jne 0x14000368e
mov eax, 0
add rsp, 0x28
ret
lea rcx, [r10 - 1]
mov rdx, r11
call fcn.1400035f0
movzx edx, word [r11 + r10*2]
xor r8d, r8d
mov r9d, 0x20
lea ecx, [rdx - 0x41]
cmp cx, 0x19
lea rcx, [0x14002c780]
cmovbe r8d, r9d
or r8, rdx
movzx edx, al
shr eax, 8
movzx r9d, r8b
xor r9, rdx
xor eax, dword [rcx + r9*4]
not eax
add rsp, 0x28
ret
Function at 0x140006650
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x140031010]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xor esi, esi
lea r8, [rbp + 0x37]
mov rbx, 0xffffffffffffffff
mov qword [rbp + 0x37], rsi
mov rcx, rbx
mov qword [rbp + 0x43], rsi
lea edx, [rsi + 0x28]
call fcn.1400087d0
test eax, eax
jne 0x1400067fc
mov eax, 0xeb05
mov qword [rsp + 0xe0], rdi
lea r9d, [rsi + 0x12]
mov word [rbp - 0x29], ax
lea r8d, [rsi + 0x4c]
mov dword [rbp + 0x3f], 1
lea rdx, [rbp - 0x49]
mov dword [rbp + 0x4b], 2
lea rcx, [rbp + 0xf]
mov dword [rbp - 0x49], 0x28f4fa19
mov dword [rbp - 0x45], 0x7bd8857f
mov dword [rbp - 0x41], 0xdd65e8b
mov dword [rbp - 0x3d], 0xd3d79db6
mov dword [rbp - 0x39], 0xf4200439
mov dword [rbp - 0x35], 0xa2e71fa
mov dword [rbp - 0x31], 0x16069b6c
mov dword [rbp - 0x2d], 0x44190bc8
mov word [rsp + 0x20], 0xf
call fcn.140006330
lea rax, [rbp + 0xf]
mov dword [rbp - 0x21], 0x16499e8a
mov qword [rbp + 7], rax
lea r9d, [rsi + 9]
mov eax, 0x6961
mov dword [rbp - 0x1d], 0x977a5900
lea r8d, [rsi + 0x4d]
mov word [rbp - 9], ax
lea rdx, [rbp - 0x21]
mov dword [rbp - 0x19], 0x6cee313f
lea rcx, [rbp - 0x49]
mov dword [rbp - 0x15], 0x3c56548a
mov dword [rbp - 0x11], 0x403fda26
mov dword [rbp - 0xd], 0x4869d1fa
mov word [rsp + 0x20], 0x2c
call fcn.140005520
lea rax, [rbp - 0x49]
mov qword [rbp - 1], rax
mov rdi, qword [rbp - 1]
inc rbx
cmp word [rdi + rbx*2], si
jne 0x140006773
dec rbx
cmp rbx, 0xffffffffffffffff
jne 0x14000678c
mov eax, 0xffffffff
jmp 0x1400067b3
lea rcx, [rbx - 1]
mov rdx, rdi
call fcn.140003520
movzx edx, word [rdi + rbx*2]
mov ecx, eax
xor rdx, rcx
shr eax, 8
movzx r8d, dl
lea rcx, [0x14002c780]
xor eax, dword [rcx + r8*4]
not eax
mov ecx, eax
call fcn.1400071e0
test rax, rax
jne 0x1400067c9
mov rcx, rdi
call fcn.140006d60
mov edx, 0xd9c348b
mov rcx, rax
call fcn.1400073c0
mov rdi, qword [rsp + 0xe0]
test rax, rax
je 0x1400067fc
mov rdx, qword [rbp + 7]
lea r8, [rbp + 0x43]
xor ecx, ecx
call rax
mov rcx, qword [rbp + 0x37]
test eax, eax
jne 0x14000681f
call fcn.1400085e6
xor eax, eax
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140008800
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
mov qword [rsp + 0x28], rsi
lea r8, [rbp + 0x3f]
mov r9d, 0x10
mov qword [rsp + 0x20], rsi
xor edx, edx
call fcn.1400085cc
mov rcx, qword [rbp + 0x37]
mov ebx, eax
call fcn.1400085e6
test ebx, ebx
sete sil
mov eax, esi
jmp 0x1400067fe
Function at 0x140006f90
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x470
mov rax, qword [0x140031010]
xor rax, rsp
mov qword [rsp + 0x460], rax
xor esi, esi
mov rbx, rcx
mov ebp, 0x103
test rcx, rcx
jne 0x140006fc8
mov r8d, esi
jmp 0x140006fd3
mov rdx, rbp
call fcn.140012610
mov r8, rax
inc r8w
cmp r8w, bp
jae 0x1400070bf
cmp si, r8w
jae 0x140007043
mov rcx, rbx
movzx r9d, r8w
lea rdx, [rsp + 0x40]
nop dword [rax]
nop word [rax + rax]
movsx eax, byte [rcx]
lea rcx, [rcx + 1]
mov word [rdx], ax
lea rdx, [rdx + 2]
sub r9, 1
jne 0x140007000
cmp r8w, 5
jbe 0x140007043
movzx eax, r8w
cmp word [rsp + rax*2 + 0x36], 0x2e
je 0x140007043
mov r9d, 5
lea r8, str..dll
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.140012a90
lea rax, [rsp + 0x40]
mov r10, 0xffffffffffffffff
nop
inc r10
cmp word [rax + r10*2], si
jne 0x140007050
dec r10
cmp r10, 0xffffffffffffffff
jne 0x14000706a
mov eax, 0xffffffff
jmp 0x1400070ad
lea rcx, [r10 - 1]
lea rdx, [rsp + 0x40]
call fcn.1400035f0
movzx edx, word [rsp + r10*2 + 0x40]
mov r9d, 0x20
mov r8, rsi
lea ecx, [rdx - 0x41]
cmp cx, 0x19
lea rcx, [0x14002c780]
cmovbe r8, r9
or r8, rdx
movzx edx, al
movzx r9d, r8b
xor r9, rdx
shr eax, 8
xor eax, dword [rcx + r9*4]
not eax
mov ecx, eax
call fcn.1400071e0
test rax, rax
jne 0x1400071af
mov qword [rsp + 0x488], rdi
test rbx, rbx
jne 0x1400070d1
mov rdi, rsi
jmp 0x1400070df
mov rdx, rbp
mov rcx, rbx
call fcn.140012610
mov rdi, rax
inc di
cmp di, bp
jae 0x1400071a4
cmp si, di
jae 0x140007145
lea rcx, [rsp + 0x250]
movzx r10d, di
nop dword [rax]
movsx eax, byte [rbx]
lea rbx, [rbx + 1]
mov word [rcx], ax
lea rcx, [rcx + 2]
sub r10, 1
jne 0x140007100
cmp di, 5
jbe 0x140007145
movzx eax, di
cmp word [rsp + rax*2 + 0x246], 0x2e
je 0x140007145
lea r9d, [r10 + 5]
mov edx, 0x104
lea r8, str..dll
lea rcx, [rsp + 0x250]
call fcn.140012a90
add di, di
lea rax, [rsp + 0x250]
mov word [rsp + 0x2a], di
sub di, 2
mov qword [rsp + 0x30], rax
mov rax, qword [0x1400c1e78]
mov word [rsp + 0x28], di
test rax, rax
jne 0x14000718a
mov edx, 0xa09b055e
mov ecx, 0x84c05e40
call fcn.140007780
mov qword [0x1400c1e78], rax
test rax, rax
je 0x1400071a4
lea r9, [rsp + 0x20]
mov qword [rsp + 0x20], rsi
lea r8, [rsp + 0x28]
xor edx, edx
xor ecx, ecx
call rax
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x488]
mov rax, rsi
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.140008800
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rsi
ret
Function at 0x140007780
Capabilities:
Hash data with crc32
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
call fcn.1400071e0
mov edx, ebx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp fcn.1400073c0
Function at 0x140007fc0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x140031010]
xor rax, rsp
mov qword [rsp + 0x88], rax
xor r15d, r15d
mov ebp, edx
mov r14, r8
mov dword [r8], r15d
mov rsi, rcx
mov qword [rsp + 0x78], r15
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x13155466
lea r9d, [r15 + 0xd]
mov dword [rsp + 0x44], 0x5675e61e
lea r8d, [r15 + 0x11]
mov dword [rsp + 0x48], 0x6515476f
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x4c], 0x634d2abe
mov dword [rsp + 0x50], 0x6fe4dcd9
mov dword [rsp + 0x54], 0x18dcd2d5
mov word [rsp + 0x20], 0x16
call fcn.140005e00
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x58], rax
mov rbx, qword [rsp + 0x58]
nop dword [rax]
inc r8
cmp word [rbx + r8*2], r15w
jne 0x140008060
dec r8
cmp r8, 0xffffffffffffffff
jne 0x14000807a
mov eax, 0xffffffff
jmp 0x1400080a0
lea rcx, [r8 - 1]
mov rdx, rbx
call fcn.140003520
movzx edx, word [rbx + r8*2]
mov ecx, eax
xor rdx, rcx
shr eax, 8
movzx ecx, dl
lea rdx, [0x14002c780]
xor eax, dword [rdx + rcx*4]
not eax
mov ecx, eax
call fcn.1400071e0
test rax, rax
jne 0x1400080b6
mov rcx, rbx
call fcn.140006d60
mov edx, 0xc651d8aa
mov rcx, rax
call fcn.1400073c0
mov rdi, rax
test rax, rax
je 0x14000816d
test rsi, rsi
jne 0x1400080d9
mov ebx, r15d
jmp 0x1400080e7
mov rdx, rbp
mov rcx, rsi
call fcn.140012610
mov rbx, rax
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov edx, ebx
mov rcx, rsi
mov qword [rsp + 0x20], r14
lea r8d, [r9 + 6]
call rdi
test eax, eax
je 0x14000816d
mov eax, dword [r14]
lea r9, [rsp + 0x80]
xor r8d, r8d
mov dword [rsp + 0x28], 4
inc rax
mov dword [rsp + 0x20], 0x3000
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x80], rax
lea rcx, [r8 - 1]
call fcn.1400085f3
test eax, eax
jne 0x14000816d
mov r9, qword [rsp + 0x78]
lea r8d, [rax + 6]
mov qword [rsp + 0x30], r15
mov edx, ebx
mov qword [rsp + 0x28], r15
mov rcx, rsi
mov qword [rsp + 0x20], r14
call rdi
test eax, eax
je 0x14000816d
mov rax, qword [rsp + 0x78]
jmp 0x14000816f
xor eax, eax
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140008800
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x140008520
Capabilities:
Check os version
Execute syscall

Disassembly:
xor al, 0x5a
mov r10, qword gs:[0x60]
cmp word [r10 + 0x118], 0xa
je 0x140008570
cmp word [r10 + 0x118], 6
jne 0x140008597
cmp word [r10 + 0x11c], 3
je 0x140008572
cmp word [r10 + 0x11c], 2
je 0x140008574
cmp word [r10 + 0x11c], 1
jne 0x140008597
cmp word [r10 + 0x120], 0x1db1
je 0x140008576
jmp 0x140008597
inc eax
inc eax
inc eax
cmp qword [0x1400c1d40], 0
jne 0x14000858c
cmp eax, 0xc390050f
pop r10
mov r10, rcx
jne 0x140008581
syscall
nop
ret
pop r10
mov r10, rcx
jmp qword [0x1400c1d40]
ret
Function at 0x140009400
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000944a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000944a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000944a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000944a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000944a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000944c
xor al, al
add rsp, 0x28
ret
Function at 0x140013898
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140013688
Function at 0x140018b10
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140018b40
xor eax, eax
jmp 0x140018c03
mov rbp, rbx
cmp word [rax], si
je 0x140018b65
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140018b4c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140018b48
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140018a60
movsxd r14, eax
test eax, eax
jne 0x140018ba3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140018b39
mov rcx, r14
call fcn.140016940
mov rdi, rax
test rax, rax
jne 0x140018bbc
xor ecx, ecx
call fcn.140016904
jmp 0x140018b98
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140018a60
test eax, eax
jne 0x140018bed
mov rcx, rdi
call fcn.140016904
jmp 0x140018bf7
xor ecx, ecx
call fcn.140016904
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14001d230
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001d258
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001d258
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180646058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1806461df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180646089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18064606f
add dl, dl
jne 0x180646096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1806460f6
xor eax, eax
add dl, dl
jne 0x1806460a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1806461ad
add dl, dl
jne 0x1806460b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806460c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806460d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806460dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1806460ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18064607e
mov eax, 1
add dl, dl
jne 0x180646106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180646113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1806460fb
sub eax, ebx
mov ebx, 1
jne 0x18064614c
mov ecx, 1
add dl, dl
jne 0x18064612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18064613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180646123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18064607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180646168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180646175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18064615d
cmp eax, 0x7d00
jae 0x18064619b
cmp eax, 0x500
jb 0x180646196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18064607e
cmp eax, 0x7f
ja 0x18064619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18064607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1806461d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18064607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140003348
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x168]
sub rsp, 0x250
mov rax, qword [0x14003c4b8]
xor rax, rsp
mov qword [rbp + 0x140], rax
xor r15d, r15d
lea rax, [rsp + 0x30]
mov qword [r8], r15
lea rdx, [rsp + 0x30]
sub rcx, rax
mov r14, r8
mov r9d, 0x104
lea rax, [r9 + 0x7ffffefa]
test rax, rax
je 0x1400033b9
movzx eax, word [rcx + rdx]
test ax, ax
je 0x1400033b9
mov word [rdx], ax
add rdx, 2
sub r9, 1
jne 0x140003397
test r9, r9
lea rax, [rdx - 2]
lea r8, [0x14002e200]
cmovne rax, rdx
lea rcx, [rsp + 0x30]
mov word [rax], r15w
call fcn.1400017c8
mov ebx, 0x1f0003
lea r8, [rsp + 0x30]
mov ecx, ebx
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
mov rdi, rax
test rax, rax
jne 0x140003423
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
je 0x1400034f0
mov edx, 0xc0
mov rcx, qword [rbp + 0x168]
lea r8, [0x14002e14c]
call fcn.140002e48
mov esi, eax
jmp 0x1400034f3
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], r15d
mov rcx, rdi
mov dword [rsp + 0x20], r15d
call fcn.1400031f4
mov esi, eax
test eax, eax
jns 0x140003460
mov rcx, qword [rbp + 0x168]
lea r8, [0x14002e14c]
mov r9d, eax
mov edx, 0xc6
call fcn.140002e14
jmp 0x1400034f3
lea r8, [0x14002e208]
lea rcx, [rsp + 0x30]
call fcn.1400017c8
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
mov rbx, rax
test rax, rax
jne 0x140003492
mov edx, 0xcc
jmp 0x140003409
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400031f4
mov esi, eax
test eax, eax
jns 0x1400034cf
mov rcx, qword [rbp + 0x168]
lea r8, [0x14002e14c]
mov r9d, eax
mov edx, 0xce
call fcn.140002e14
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test eax, eax
je 0x140003545
jmp 0x1400034f3
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test eax, eax
je 0x140003557
movsxd rcx, dword [rsp + 0x20]
movsxd rax, dword [rsp + 0x24]
shl rcx, 0x1f
or rax, rcx
mov qword [r14], rax
mov esi, r15d
test rdi, rdi
je 0x140003505
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test eax, eax
je 0x140003533
mov eax, esi
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.1400281d0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov rcx, qword [rbp + 0x168]
mov edx, 0x8f0
call fcn.140002e68
int3
mov rcx, qword [rbp + 0x168]
mov edx, 0x8f0
call fcn.140002e68
int3
mov rcx, qword [rbp + 0x168]
mov edx, 0x8f0
call fcn.140002e68
int3
Function at 0x140011268
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
mov rax, qword [0x14003c4b8]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor ebx, ebx
mov dword [rbp - 0x29], 0x1001001
lea rax, [rbp - 0x39]
mov dword [rbp - 0x25], 0x5b04b14
mov qword [rsp + 0x40], rax
lea rdx, str.SYSTEMCurrentControlSetControlWMISecurity
lea rax, [rbp - 0x31]
mov dword [rbp - 0x21], 0x50
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], 1
mov dword [rbp - 0x1d], 0x5000000
mov dword [rbp - 0x19], 0xc05c
mov dword [rbp - 0x15], 0x1000000
mov dword [rbp - 0x11], 0x4014
mov dword [rbp - 0xd], 0x3000000
mov qword [rbp - 9], 0x4034
mov dword [rbp - 1], 0x2002002
mov dword [rbp + 3], 0x20
mov dword [rbp + 7], 0x1001
mov dword [rbp + 0xb], 0x1000000
mov dword [rbp + 0xf], 0x1004014
mov dword [rbp + 0x13], 0x8018
mov dword [rbp + 0x17], 0xd00d
mov dword [rbp + 0x1b], 0x2002
mov qword [rbp + 0x1f], 0x20021001
mov dword [rbp + 0x27], ebx
mov dword [rbp + 0x2b], 0x30130100
mov qword [rbp + 0x2f], 0x40040000
mov qword [rbp + 0x37], 0x200200
mov dword [rbp - 0x39], ebx
mov qword [rbp - 0x31], rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
test eax, eax
je 0x140011381
mov dword [rsp + 0x20], 0x178
lea rdx, str._dropAccessPermissionsToTraceProvider:_Failed_to_create_key
jmp 0x1400113bf
mov rcx, qword [rbp - 0x31]
lea rax, [rbp - 0x29]
mov dword [rsp + 0x28], 0x68
lea rdx, str.c688cf83_9945_5ff6_0e1e_1ff1f8a2ec9a
mov r9d, 3
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
je 0x1400113df
mov dword [rsp + 0x20], 0x186
lea rdx, str._dropAccessPermissionsToTraceProvider:_Failed_to_set_value
movzx ecx, ax
lea r9, str.OctBrokerSvc::_dropAccessPermissionsToTraceProvider
or ecx, 0x80070000
mov r8d, 1
test eax, eax
cmovle ecx, eax
call fcn.140011ef8
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x1400113ee
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400281d0
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe0
pop rbp
ret