joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140055e90
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140055eca
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140055ecf
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140055f18
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400aab60]
cmp byte [rcx + rax], 0
je 0x140055f18
dec r8
sub rdx, 1
jne 0x140055efe
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140059b50
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov qword [rcx], rdx
lea rbx, [rcx + 8]
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov rdi, rcx
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rax
and qword [rbx + 0x18], rax
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], 1
mov dword [rbx + 0x20], eax
mov dword [rbx + 0x24], eax
test dword [0x1400d036c], 0x80000000
je 0x140059ba5
mov ecx, dword [0x1400d7078]
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
jne 0x140059baa
call fcn.140060e04
mov qword [rbx], rax
mov r8b, 1
mov rcx, qword [rdi]
mov rdx, rbx
call fcn.140059d9c
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x140059c00
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov edi, edx
mov rbx, rcx
call fcn.14005d498
mov r8d, dword [rbx + 0x10]
mov ecx, eax
shr r8d, 2
test r8b, 1
jne 0x140059ca2
mov r8d, dword [rbx + 0x10]
shr r8d, 1
test r8b, 1
je 0x140059c3e
mov eax, dword [rbx + 0x10]
shr eax, 3
shr edi, 3
sub eax, edi
jmp 0x140059c43
mov eax, 1
lea r8d, [rcx + 2]
cmp eax, r8d
ja 0x140059ca2
dec eax
mov qword [rsp + 0x20], 0
imul eax, dword [0x1400d0358]
lea rcx, [0x14005b050]
xor edx, edx
mov qword [rsp + 0x30], rcx
div r8d
add eax, dword [0x1400d0358]
jne 0x140059c81
mov dword [rsp + 0x28], 4
jmp 0x140059c8d
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 1
mov eax, dword [rbx + 0x10]
test al, 1
je 0x140059ca2
lea rcx, [rsp + 0x20]
call fcn.14005a190
test al, al
jne 0x140059c8d
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp fcn.14005b248
Function at 0x14005a5d4
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x60
and qword [rbp - 0x10], 0
mov r14d, 1
test dword [0x1400d036c], 0x80000000
mov rbx, rcx
mov qword [rbp - 0x20], 0
mov dword [rbp - 0x18], r14d
mov dword [rbp - 8], 0
mov dword [rbp - 4], 0
je 0x14005a62f
mov ecx, dword [0x1400d7078]
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
jne 0x14005a634
call fcn.140060e04
mov qword [rbp - 0x28], rax
cmp rax, qword [rbx]
je 0x14005a73d
lea rdi, [rbp - 0x28]
xchg qword [rbx + 0x28], rdi
test rdi, rdi
jne 0x14005a6bf
prefetchw byte [rbx + 0x40]
mov eax, dword [rbx + 0x40]
lea edx, [rdi + 4]
mov ecx, eax
or ecx, edx
lock cmpxchg dword [rbx + 0x40], ecx
jne 0x14005a658
test al, 3
jne 0x14005a6ef
lock xadd dword [rbx + 0x40], edx
and dl, 3
cmp dl, r14b
jne 0x14005a67d
lock or dword [rbx + 0x40], 2
xor ecx, ecx
lea rax, [rbp - 0x28]
xchg qword [rbx + 0x28], rcx
cmp rcx, rax
jne 0x14005a69a
mov eax, dword [rcx + 0x10]
and eax, 0xfffffffe
mov dword [rcx + 0x10], eax
jmp 0x14005a727
xor eax, eax
lock cmpxchg dword [rcx + 0x20], r14d
jne 0x14005a6ef
mov eax, dword [rcx + 0x10]
and eax, 0xfffffffe
mov dword [rcx + 0x10], eax
mov rcx, qword [rcx]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x1400611e2.0]
jmp 0x14005a6ef
mov eax, dword [rdi + 0x10]
test r14b, al
je 0x14005a6ef
mov eax, dword [rdi + 0x10]
shr eax, 2
test r14b, al
jne 0x14005a6e6
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400611e2.0]
test al, al
je 0x14005a6ef
mov eax, dword [rbp - 0x18]
or eax, 4
mov dword [rbp - 0x18], eax
xor edx, edx
lea rcx, [rbp - 0x28]
call fcn.140059c00
test rdi, rdi
je 0x14005a727
lock add dword [rbx + 0x40], 8
xor eax, eax
lock cmpxchg dword [rdi + 0x20], r14d
jne 0x14005a727
mov eax, dword [rdi + 0x10]
mov rcx, qword [rdi]
and eax, 0xfffffffe
mov dword [rdi + 0x10], eax
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x1400611e2.0]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
lea rdx, str.Lock_already_taken_as_a_writer
lea rcx, [rbp - 0x40]
call fcn.14005b0b0
lea rdx, [0x1400cd6d0]
lea rcx, [rbp - 0x40]
call fcn.1400760c4
int3

Function at 0x14005abe8
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14005abfb
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.14005b218
lea rdx, [0x1400cd730]
lea rcx, [rsp + 0x20]
call fcn.1400760c4
int3
Function at 0x181d8b580
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.181d8b707
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x181d8b5b1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x181d8b597
add dl, dl
jne 0x181d8b5be
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x181d8b61e
xor eax, eax
add dl, dl
jne 0x181d8b5cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x181d8b6d5
add dl, dl
jne 0x181d8b5de
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x181d8b5eb
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x181d8b5f8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x181d8b605
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x181d8b612
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x181d8b5a6
mov eax, 1
add dl, dl
jne 0x181d8b62e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x181d8b63b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x181d8b623
sub eax, ebx
mov ebx, 1
jne 0x181d8b674
mov ecx, 1
add dl, dl
jne 0x181d8b656
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x181d8b663
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x181d8b64b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x181d8b5a6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x181d8b690
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x181d8b69d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x181d8b685
cmp eax, 0x7d00
jae 0x181d8b6c3
cmp eax, 0x500
jb 0x181d8b6be
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x181d8b5a6
cmp eax, 0x7f
ja 0x181d8b6c6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x181d8b5a6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x181d8b6fa
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x181d8b5a6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14002934c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001c944
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001c944
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002949c
cmp rax, 0xffffffffffffffff
je 0x14002949c
xor edi, edi
test rbp, rbp
jle 0x140029447
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f258
mov rbx, rax
test rax, rax
jne 0x1400293d4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002943d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a278
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d620
cmp eax, 0xffffffff
je 0x14002941d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400293e4
mov edx, r15d
mov ecx, r14d
call fcn.14001a278
jmp 0x14002943d
cmp byte [rsi + 0x38], dil
je 0x140029434
cmp dword [rsi + 0x34], 5
jne 0x140029434
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002943d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b00c
jmp 0x1400294b0
jns 0x1400294b0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001c944
cmp rax, 0xffffffffffffffff
jne 0x140029468
cmp byte [rsi + 0x30], dil
je 0x1400294b0
mov edi, dword [rsi + 0x2c]
jmp 0x1400294b0
mov ecx, r14d
call fcn.140018730
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400294b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400294b0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400294a9
mov eax, dword [rsi + 0x2c]
jmp 0x1400294ae
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001c944
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Enumerate process modules
Execute shellcode via indirect call

Disassembly:
mov eax, 0x2888
call fcn.140001de0
sub rsp, rax
mov rax, qword [0x140004008]
xor rax, rsp
mov qword [rsp + 0x2870], rax
lea r8, [rsp + 0x868]
mov dword [rsp + 0x868], 0
mov edx, 0x2000
lea rcx, [rsp + 0x870]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x1400010ac
mov eax, dword [rsp + 0x868]
and eax, 0xfffffffc
cmp eax, 0xc8
jb 0x1400010ac
lea rcx, [rsp + 0x20]
mov r8d, 0x831
lea rdx, [0x140002240]
call sub.VCRUNTIME140.dll_memcpy
mov edx, 0x831
mov r9d, 0x40
mov r8d, 0x3000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x1400010ac
mov rcx, rax
lea rdx, [rsp + 0x20]
mov r8d, 0x831
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x860]
call rax
xor eax, eax
mov rcx, qword [rsp + 0x2870]
xor rcx, rsp
call fcn.1400010e0
add rsp, 0x2888
ret
Function at 0x140002530
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x14000a728], rbx
je 0x140002597
cmp rax, rbx
jne 0x14000258a
mov edi, 1
mov esi, edi
jmp 0x14000259c
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000256f
mov edi, 1
mov eax, dword [0x14000a730]
cmp eax, edi
jne 0x1400025b4
mov ebx, 0x1f
mov ecx, ebx
call sub.msvcrt.dll__amsg_exit
jmp 0x14000262a
mov eax, dword [0x14000a730]
test eax, eax
jne 0x14000261f
mov dword [0x14000a730], edi
lea r15, [0x140007548]
lea rbx, [0x140007530]
mov qword [rsp + 0x30], rbx
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rbx, r15
jae 0x140002611
test eax, eax
jne 0x140002615
cmp qword [rbx], r14
je 0x140002606
movabs r10, 0xd30527475e523070
mov rax, qword [rbx]
mov rcx, qword [0x1400074e0]
call rcx
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x1400025de
test eax, eax
je 0x140002625
mov eax, 0xff
jmp 0x14000278b
mov dword [0x14000a164], edi
mov ebx, 0x1f
mov eax, dword [0x14000a730]
cmp eax, edi
jne 0x140002651
lea rdx, [0x140007528]
lea rcx, [0x1400074f8]
call sub.msvcrt.dll__initterm
mov dword [0x14000a730], 2
test esi, esi
jne 0x14000265f
mov rax, r14
xchg qword [0x14000a728], rax
cmp qword [0x14000a748], r14
je 0x14000269c
lea rcx, [0x14000a748]
call fcn.140002c30
test eax, eax
je 0x14000269c
movabs r10, 0x99012e4578d92870
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14000a748]
mov r9, qword [0x1400074e0]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x1400026b5
mov eax, 0xff
jmp 0x14000278b
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14000273c
test ax, ax
je 0x1400026d0
test edx, edx
jne 0x14000273c
sub ax, di
cmp ax, bx
ja 0x1400026e6
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x1400026d0
test byte [rsp + 0x7c], dil
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400016a0
mov dword [0x14000a160], eax
cmp dword [0x14000a180], r14d
jne 0x140002725
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000a164], r14d
jne 0x14000273a
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000a160]
jmp 0x14000278b
cmp ax, 0x22
jne 0x140002750
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400026be
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.140159000
add rsp, 0x28
jmp 0x140002530
Function at 0x140011050
Capabilities:
Resolve path using msvcrt

Disassembly:
jmp 0x140014b30
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0xf8], rax
lea rcx, [0x1400ef071]
call fcn.14001164f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__wgetcwd]
mov qword [0x14003b800], rax
cmp qword [0x14003b800], 0
jne 0x140014b99
mov edx, 0xa
lea rcx, str._nCant_get_the_current_folder_name_n
call fcn.140011343
lea rcx, [rbp + 8]
call qword [sym.imp.ucrtbased.dll__get_pgmptr]
test eax, eax
je 0x140014bb8
mov edx, 0xb
lea rcx, str._nCant_get_RTEmsg_application_start_folder_name_n
call fcn.140011343
mov edx, 0x5c
mov rcx, qword [rbp + 8]
call fcn.1400116f9
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x140014bd8
mov rax, qword [rbp + 0x28]
mov byte [rax], 0
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll__chdir]
test eax, eax
je 0x140014bf7
mov edx, 0xc
lea rcx, str._nCant_change_to_the_RTEmsg_application_folder_n
call fcn.140011343
lea rcx, [rbp - 0x20]
lea rdx, [0x140033610]
call fcn.140011578
mov rcx, qword [rbp + 0xf8]
xor rcx, rbp
call fcn.14001131b
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x14001125d
Capabilities:
Delete file

Disassembly:
jmp 0x140029950
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x468
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xae
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x488]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x428], rax
lea rcx, [0x1400ef683]
call fcn.14001164f
mov rcx, qword [rbp + 0x450]
call fcn.1400112cb
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x1400299ba
cmp qword [rbp + 8], 0x104
jb 0x1400299c4
mov eax, 0xffffffff
jmp 0x140029a64
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 8]
mov r8, qword [rbp + 0x450]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rbp + 0x254], eax
movsxd rax, dword [rbp + 0x254]
shl rax, 1
mov qword [rbp + 0x418], rax
cmp qword [rbp + 0x418], 0x208
jae 0x140029a13
jmp 0x140029a18
call fcn.1400114c4
xor eax, eax
mov rcx, qword [rbp + 0x418]
mov word [rbp + rcx + 0x30], ax
mov dword [rbp + 0x274], 0xffffffff
cmp dword [rbp + 0x254], 0
jne 0x140029a4e
mov rcx, qword [rbp + 0x450]
call qword [sym.imp.ucrtbased.dll_remove]
mov dword [rbp + 0x274], eax
jmp 0x140029a5e
lea rcx, [rbp + 0x30]
call qword [sym.imp.ucrtbased.dll__wremove]
mov dword [rbp + 0x274], eax
mov eax, dword [rbp + 0x274]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140035d30]
call fcn.140011578
mov rax, rdi
mov rcx, qword [rbp + 0x428]
xor rcx, rbp
call fcn.14001131b
lea rsp, [rbp + 0x438]
pop rdi
pop rbp
ret
Function at 0x140011343
Capabilities:
Terminate process

Disassembly:
jmp 0x140013560
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x218
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x4e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x238]
lea rcx, [0x1400ef045]
call fcn.14001164f
mov r9d, dword [rbp + 0x218]
lea r8, str._nRTEmsg_ERR__03u:
mov edx, 0x104
lea rcx, [rbp + 0x10]
call fcn.140011479
xor edx, edx
lea rcx, [rbp + 0x10]
call fcn.1400115a5
xor edx, edx
mov rcx, qword [rbp + 0x210]
call fcn.1400115a5
call qword [sym.imp.ucrtbased.dll__errno]
cmp dword [rax], 0
je 0x1400135f9
call qword [sym.imp.ucrtbased.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.ucrtbased.dll__wcserror]
mov rdx, rax
lea rcx, [0x1400333f0]
call fcn.140011294
lea rcx, [0x140033400]
call fcn.14001103c
call qword [sym.imp.ucrtbased.dll__fcloseall]
mov ecx, dword [rbp + 0x218]
call qword [sym.imp.ucrtbased.dll_exit]
lea rcx, [rbp - 0x20]
lea rdx, [0x140033330]
call fcn.140011578
lea rsp, [rbp + 0x1f8]
pop rdi
pop rbp
ret
Function at 0x140011375
Capabilities:
Terminate process

Disassembly:
jmp 0x140013800
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x268
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x5e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x288]
lea rcx, [0x1400ef045]
call fcn.14001164f
cmp dword [rbp + 0x250], 0x12d
jbe 0x140013856
mov dword [rbp + 0x250], 0x12d
cmp qword [rbp + 0x258], 0
jne 0x14001386e
lea rax, [0x140032fd7]
mov qword [rbp + 0x258], rax
mov ecx, dword [rbp + 0x250]
call fcn.14001165e
mov qword [rbp + 8], rax
cmp qword [0x14003b818], 0
je 0x1400138a1
mov r8d, dword [rbp + 0x250]
lea rdx, str.ERR__03u:
mov rcx, qword [0x14003b818]
call fcn.1400115be
mov r9d, dword [rbp + 0x250]
lea r8, str._nRTEmsg_ERR__03u:
mov edx, 0x104
lea rcx, [rbp + 0x30]
call fcn.140011479
xor edx, edx
lea rcx, [rbp + 0x30]
call fcn.1400115a5
mov edx, 0x25
mov rcx, qword [rbp + 8]
call fcn.140011069
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x158], 0
jne 0x140013923
cmp qword [0x14003b818], 0
je 0x140013901
mov rdx, qword [rbp + 8]
mov rcx, qword [0x14003b818]
call fcn.1400115be
mov r8, qword [rbp + 8]
mov edx, 0x104
lea rcx, [rbp + 0x30]
call fcn.140011479
xor edx, edx
lea rcx, [rbp + 0x30]
call fcn.1400115a5
jmp 0x1400139d0
cmp qword [0x14003b818], 0
je 0x14001394b
mov r9, qword [rbp + 0x260]
mov r8, qword [rbp + 0x258]
mov rdx, qword [rbp + 8]
mov rcx, qword [0x14003b818]
call fcn.1400115be
mov rax, qword [rbp + 0x260]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x258]
mov r8, qword [rbp + 8]
mov edx, 0x104
lea rcx, [rbp + 0x30]
call fcn.140011479
xor edx, edx
lea rcx, [rbp + 0x30]
call fcn.1400115a5
cmp qword [rbp + 0x260], 0xfffffffffffffffe
jne 0x1400139d0
cmp qword [0x14003b818], 0
je 0x1400139b3
call qword [sym.imp.ucrtbased.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.ucrtbased.dll_strerror]
mov r8, rax
lea rdx, [0x140033538]
mov rcx, qword [0x14003b818]
call fcn.1400115be
call qword [sym.imp.ucrtbased.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.ucrtbased.dll__wcserror]
mov rdx, rax
lea rcx, str.:__s
call fcn.140011294
lea rcx, [0x14003354c]
call fcn.14001103c
call qword [sym.imp.ucrtbased.dll__fcloseall]
mov ecx, dword [rbp + 0x250]
call qword [sym.imp.ucrtbased.dll_exit]
lea rcx, [rbp - 0x30]
lea rdx, [0x1400332b0]
call fcn.140011578
lea rsp, [rbp + 0x238]
pop rdi
pop rbp
ret

Function at 0x140011384
Capabilities:
Terminate process

Disassembly:
jmp 0x14002a3d0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140011401
Capabilities:
Move file

Disassembly:
jmp 0x140029af0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x7b8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x152
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x7d8]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x778], rax
lea rcx, [0x1400ef683]
call fcn.14001164f
mov rcx, qword [rbp + 0x7a0]
call fcn.1400112cb
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x7a8]
call fcn.1400112cb
mov qword [rbp + 0x28], rax
cmp qword [rbp + 8], 0
je 0x140029b80
cmp qword [rbp + 0x28], 0
je 0x140029b80
cmp qword [rbp + 8], 0x104
jae 0x140029b80
cmp qword [rbp + 0x28], 0x104
jb 0x140029b8a
mov eax, 0xffffffff
jmp 0x140029ca9
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0x280]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x28]
mov r8, qword [rbp + 0x7a8]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rbp + 0x4a4], eax
movsxd rax, dword [rbp + 0x4a4]
shl rax, 1
mov qword [rbp + 0x748], rax
cmp qword [rbp + 0x748], 0x208
jae 0x140029bdc
jmp 0x140029be1
call fcn.1400114c4
xor eax, eax
mov rcx, qword [rbp + 0x748]
mov word [rbp + rcx + 0x280], ax
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 8]
mov r8, qword [rbp + 0x7a0]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rbp + 0x4c4], eax
movsxd rax, dword [rbp + 0x4c4]
shl rax, 1
mov qword [rbp + 0x768], rax
cmp qword [rbp + 0x768], 0x208
jae 0x140029c41
jmp 0x140029c46
call fcn.1400114c4
xor eax, eax
mov rcx, qword [rbp + 0x768]
mov word [rbp + rcx + 0x50], ax
mov dword [rbp + 0x4e4], 0xffffffff
cmp dword [rbp + 0x4c4], 0
je 0x140029c70
cmp dword [rbp + 0x4a4], 0
jne 0x140029c8c
mov rdx, qword [rbp + 0x7a8]
mov rcx, qword [rbp + 0x7a0]
call qword [sym.imp.ucrtbased.dll_rename]
mov dword [rbp + 0x4e4], eax
jmp 0x140029ca3
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x50]
call qword [sym.imp.ucrtbased.dll__wrename]
mov dword [rbp + 0x4e4], eax
mov eax, dword [rbp + 0x4e4]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140035e00]
call fcn.140011578
mov rax, rdi
mov rcx, qword [rbp + 0x778]
xor rcx, rbp
call fcn.14001131b
lea rsp, [rbp + 0x788]
pop rdi
pop rbp
ret
Function at 0x14001146f
Capabilities:
Parse pe header

Disassembly:
jmp 0x14002c760
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14002c780
xor al, al
jmp 0x14002c801
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14002c793
xor al, al
jmp 0x14002c801
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14002c7bd
xor al, al
jmp 0x14002c801
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14002c7d1
xor al, al
jmp 0x14002c801
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14002c7e3
xor al, al
jmp 0x14002c801
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14002c7ff
xor al, al
jmp 0x14002c801
mov al, 1
add rsp, 0x38
ret