joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140020ff0
Capabilities:
Read data from internet
Receive data

Disassembly:
sub rsp, 0x4c8
mov qword [rsp + 0x48], rcx
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x4a8], rcx
mov qword [rsp + 0x4a0], rdx
mov qword [rsp + 0x498], r8
mov rax, qword [rsp + 0x4a0]
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x497], 0
call fcn.1400c9920
mov rax, qword [rsp + 0x58]
cmp qword [rax], 0
je 0x140021206
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x498]
call fcn.140034230
mov rcx, qword [rsp + 0x40]
mov rdx, rax
xor eax, eax
mov r8d, eax
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
mov qword [rsp + 0x28], 0
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rcx, rax
mov rax, qword [rsp + 0x58]
mov qword [rax + 8], rcx
cmp qword [rax + 8], 0
je 0x140021201
jmp 0x1400210a2
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
lea rdx, [rsp + 0x90]
mov r8d, 0x400
lea r9, [rsp + 0x8c]
call qword [sym.imp.WININET.dll_InternetReadFile]
mov ecx, eax
xor eax, eax
cmp ecx, 0
mov byte [rsp + 0x3f], al
je 0x1400210e7
cmp dword [rsp + 0x8c], 0
seta al
mov byte [rsp + 0x3f], al
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x1400210f8
jmp 0x1400211fc
lea r8, [rsp + 0x90]
mov r9d, dword [rsp + 0x8c]
mov ecx, 0xfde9
xor edx, edx
xor eax, eax
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x88], eax
cmp dword [rsp + 0x88], 0
jle 0x1400211f7
movsxd rdx, dword [rsp + 0x88]
lea rax, [rsp + 0x67]
mov qword [rsp + 0x4b0], rax
mov rax, qword [rsp + 0x4b0]
mov qword [rsp + 0x4c0], rax
lea rcx, [rsp + 0x68]
xor r8d, r8d
lea r9, [rsp + 0x67]
call fcn.1400ca9b0
lea rax, [rsp + 0x67]
mov qword [rsp + 0x4b8], rax
mov rcx, qword [rsp + 0x4b8]
call fcn.1400aea10
lea rax, [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x8c]
mov dword [rsp + 0x38], eax
lea rcx, [rsp + 0x68]
xor eax, eax
mov edx, eax
call fcn.1400cabf0
mov r8, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x38]
mov r10, rax
mov eax, dword [rsp + 0x88]
mov ecx, 0xfde9
xor edx, edx
mov qword [rsp + 0x20], r10
mov dword [rsp + 0x28], eax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x68]
call fcn.1400cacd0
lea rcx, [rsp + 0x68]
call fcn.1400caa10
jmp 0x1400210a2
jmp 0x140021201
jmp 0x140021206
mov byte [rsp + 0x497], 1
test byte [rsp + 0x497], 1
jne 0x140021226
mov rcx, qword [rsp + 0x48]
call fcn.1400caa10
mov rax, qword [rsp + 0x50]
add rsp, 0x4c8
ret

Function at 0x140021240
Capabilities:
Create http request

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rax], 0
mov qword [rax + 8], 0
lea rcx, str.WinINet_Example
mov edx, 1
xor eax, eax
mov r9d, eax
xor eax, eax
mov r8, r9
mov dword [rsp + 0x20], 0
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rcx, rax
mov rax, qword [rsp + 0x28]
mov qword [rax], rcx
add rsp, 0x38
ret
Function at 0x140091d50
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, qword [sym.imp.msvcrt.dll__read]
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, rdi
call fcn.140091b60
mov r8d, ebx
mov rdx, rsi
mov ecx, eax
call rbp
movsxd r13, eax
cmp eax, 0xffffffff
je 0x140091da0
mov rax, r13
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call r12
cmp dword [rax], 4
je 0x140091d73
mov rax, r13
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x1400ecb00
Capabilities:
Encode data using xor

Disassembly:
mov r11, rdx
mov rax, rcx
mov r10, rdx
and r11, 0xfffffffffffffff8
add r11, rcx
movabs rcx, 0xc6a4a7935bd1e995
imul r10, rcx
xor r10, r8
cmp rax, r11
je 0x1400ecb58
nop word cs:[rax + rax]
mov r9, qword [rax]
add rax, 8
imul r9, rcx
mov r8, r9
shr r8, 0x2f
xor r8, r9
imul r8, rcx
xor r8, r10
mov r10, r8
imul r10, rcx
cmp r11, rax
jne 0x1400ecb30
and edx, 7
je 0x1400ecb8d
sub edx, 1
movsxd rax, edx
xor edx, edx
nop dword [rax]
movzx ecx, byte [r11 + rax]
shl rdx, 8
sub rax, 1
add rdx, rcx
test eax, eax
jns 0x1400ecb68
xor rdx, r10
movabs r10, 0xc6a4a7935bd1e995
imul r10, rdx
movabs rax, 0xc6a4a7935bd1e995
mov rdx, r10
shr rdx, 0x2f
xor rdx, r10
imul rdx, rax
mov rax, rdx
shr rax, 0x2f
xor rax, rdx
ret
Function at 0x140002884
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140067010]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rdx
mov rsi, rcx
lea rdx, str..NET_Runtime
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov r14, rax
xor r15d, r15d
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r15w
lea r8d, [r15 + 0x28]
lea rdx, str.Description:_A_.NET_application_failed._n
lea rcx, [rbp - 0x28]
call fcn.140004888
lea r8d, [r15 + 0xd]
lea rdx, str.Application:
lea rcx, [rbp - 0x28]
call fcn.140004888
or rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rdi + r8*2], r15w
jne 0x140002903
mov rdx, rdi
mov rcx, rax
call fcn.140004888
mov edi, 1
mov r8d, edi
lea rdx, [0x14004faf8]
mov rcx, rax
call fcn.140004888
lea r8d, [rdi + 5]
lea rdx, str.Path:
lea rcx, [rbp - 0x28]
call fcn.140004888
inc rbx
cmp word [rsi + rbx*2], r15w
jne 0x140002943
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.140004888
mov r8, rdi
lea rdx, [0x14004faf8]
mov rcx, rax
call fcn.140004888
mov r8d, 9
lea rdx, str.Message:
lea rcx, [rbp - 0x28]
call fcn.140004888
lea rdx, [0x140067540]
cmp qword [0x140067558], 8
cmovae rdx, qword [0x140067540]
mov r8, qword [0x140067550]
mov rcx, rax
call fcn.140004888
mov r8, rdi
lea rdx, [0x14004faf8]
mov rcx, rax
call fcn.140004888
lea rax, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rax, qword [rbp - 0x28]
mov qword [rbp - 0x30], rax
xor r8d, r8d
mov edx, edi
mov qword [rsp + 0x40], r15
lea rax, [rbp - 0x30]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r15d
mov word [rsp + 0x28], di
mov qword [rsp + 0x20], r15
mov r9d, 0x3ff
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x140002a4b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a46
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002a46
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400419f0
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140041990
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140005b30
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x58
lea r12, [0x140069358]
mov qword [rax - 0x58], r12
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdi, [rsp + 0x98]
call fcn.1400056ac
mov r14, rax
mov rcx, qword [rax]
or rcx, 1
mov qword [rsp + 0x28], rdi
and qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x90]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
or ecx, 0xffffffff
test eax, eax
cmovs eax, ecx
inc eax
movsxd rbx, eax
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140005e60
nop
mov rcx, qword [r14]
or rcx, 1
mov qword [rsp + 0x28], rdi
and qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x90]
mov r8, rbx
mov rbx, qword [rsp + 0x38]
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
mov r13d, 0x10
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
mov rax, qword [rsi + r13]
mov edi, 2
test rax, rax
jne 0x140005c2a
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputws]
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rdx, rax
lea ecx, [rdi + 8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
jmp 0x140005c33
mov rcx, rbx
call qword [0x14004c5b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [0x140069388], 0
je 0x140005c93
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rdi, qword [0x140069380]
cmp rdi, rax
jne 0x140005c60
cmp qword [rsi + r13], 0
je 0x140005c93
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rsp + 0x90]
mov rdx, rdi
mov rcx, qword [r14]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vfwprintf]
mov ecx, 0xa
mov rdx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
nop
test rbx, rbx
je 0x140005caf
mov rdx, qword [rsp + 0x48]
sub rdx, rbx
sar rdx, 1
add rdx, rdx
mov rcx, rbx
call fcn.140001a74
nop
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add rsp, 0x58
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000c580
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
cmp qword [rcx + 0x18], 8
mov r15d, r9d
mov ebp, r8d
mov r14, rdx
mov rbx, rcx
jb 0x14000c5ae
mov rcx, qword [rcx]
xor edi, edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000c609
cmp qword [rbx + 0x18], 8
jb 0x14000c5ea
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rbx
lea rcx, str.Failed_to_map_file._CreateFileW__s__failed_with_error__d
mov r8d, eax
call fcn.140005b30
xor eax, eax
jmp 0x14000c6f4
test r14, r14
je 0x14000c655
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x14000c64d
cmp qword [rbx + 0x18], 8
jb 0x14000c62a
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rbx
lea rcx, str.Failed_to_map_file._GetFileSizeEx__s__failed_with_error__d
mov r8d, eax
call fcn.140005b30
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000c602
mov rax, qword [rsp + 0x60]
mov qword [r14], rax
mov qword [rsp + 0x28], rdi
xor r9d, r9d
mov r8d, ebp
mov dword [rsp + 0x20], edi
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbp, rax
test rax, rax
jne 0x14000c69b
cmp qword [rbx + 0x18], 8
jb 0x14000c681
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rbx
lea rcx, str.Failed_to_map_file._CreateFileMappingW__s__failed_with_error__d
mov r8d, eax
call fcn.140005b30
jmp 0x14000c6e8
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov edx, r15d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
test rax, rax
jne 0x14000c6dc
cmp qword [rbx + 0x18], 8
jb 0x14000c6c4
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rbx
lea rcx, str.Failed_to_map_file._MapViewOfFile__s__failed_with_error__d
mov r8d, eax
call fcn.140005b30
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x14000db08
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rbx, rdx
mov qword [rdx + 0x10], r14
mov rdi, rcx
cmp qword [rdx + 0x18], 8
mov rax, rdx
jb 0x14000db3b
mov rax, qword [rdx]
xor r8d, r8d
mov word [rax], r14w
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebp, eax
test eax, eax
jne 0x14000db87
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x14000db83
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r8d, ax
mov rdx, rdi
or r8d, 0x80070000
lea rcx, str.Failed_to_read_environment_variable___s___HRESULT:_0x_X
test eax, eax
cmovle r8d, eax
call fcn.140005b30
xor al, al
jmp 0x14000dbcd
mov rcx, 0xffffffffffffffff
mov eax, 2
mul rbp
cmovo rax, rcx
mov rcx, rax
call fcn.140041c7c
mov r8d, ebp
mov rdx, rax
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14000db5d
mov rdx, rsi
mov rcx, rbx
call fcn.14000480c
mov rcx, rsi
call fcn.1400419f0
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14000dbe8
Capabilities:
Create directory
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x140067010]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x14000dc88
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14000480c
xor edx, edx
mov rcx, rbx
call fcn.14000de80
test al, al
je 0x14000dc88
lea rdx, str..net
mov rcx, rbx
call fcn.1400062e4
xor edx, edx
mov rcx, rbx
call fcn.14000de80
test al, al
je 0x14000dc56
mov al, 1
jmp 0x14000dc8a
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x14000dc63
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000dc7c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000dc88
xor edx, edx
mov rcx, rbx
call fcn.14000de80
jmp 0x14000dc8a
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140041990
add rsp, 0x240
pop rbx
ret
Function at 0x140023c44
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rbx, rdx
mov r14, rcx
lea rcx, str.____Begin_breadcrumb_write
call fcn.140005a38
mov ecx, 0x90
call fcn.1400419b4
mov qword [rbp + 0x30], rax
mov rdx, rbx
mov rcx, rax
call fcn.14002412c
mov rbx, rax
lea rdi, [rax + 0x10]
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rax
cmp qword [rdi + 0x20], 0
jne 0x140023d02
lea rcx, str.Breadcrumb_store_was_not_obtained..._skipping_write.
call fcn.140005a38
and qword [r14], 0
and qword [r14 + 8], 0
test rbx, rbx
je 0x140023cec
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
add eax, edi
jne 0x140023cec
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [0x14004c5b0]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
add eax, edi
jne 0x140023cec
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [0x14004c5b0]
mov rax, r14
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rbp
ret
test rbx, rbx
je 0x140023d0f
lock inc dword [rax + 8]
mov rdi, qword [rbp - 0x10]
mov qword [rdi], rdi
mov rsi, qword [rdi + 8]
mov qword [rdi + 8], rbx
test rsi, rsi
je 0x140023d5b
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rsi + 8], eax
add eax, edi
jne 0x140023d57
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax]
call qword [0x14004c5b0]
mov eax, edi
lock xadd dword [rsi + 0xc], eax
add eax, edi
jne 0x140023d57
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 8]
call qword [0x14004c5b0]
mov rdi, qword [rbp - 0x10]
mov ecx, 0x10
call fcn.1400419b4
mov qword [rax], rdi
lea rcx, [0x140023fe0]
mov qword [rax + 8], rcx
mov qword [rbp + 0x30], rax
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x28], rcx
and dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140024320]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x20], rax
test rax, rax
je 0x140023dde
cmp dword [rdi + 0x38], 0
jne 0x140023dd7
xorps xmm0, xmm0
movaps xmm1, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x20], xmm0
movdqu xmmword [rdi + 0x30], xmm1
cmp dword [rbp - 0x18], 0
jne 0x140023dd7
lea rcx, str.Breadcrumbs_will_be_written_using_a_background_thread
call fcn.140005a38
mov qword [r14], rdi
mov qword [r14 + 8], rbx
jmp 0x140023cec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
and dword [rbp - 0x18], 0
mov ecx, 6
call fcn.1400477e4
int3

Function at 0x14002b374
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
mov rdx, rcx
lea rcx, str.Duplicate_runtime_property_found:__s
call fcn.140005b30
lea rcx, str.It_is_invalid_to_specify_values_for_properties_populated_by_the_hosting_layer_in_the_the_applications_.runtimeconfig.json
add rsp, 0x28
jmp fcn.140005b30
Function at 0x140030ec4
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140067010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
cmp qword [rcx + 0x10], 0
je 0x140030f51
call fcn.14000e41c
test al, al
jne 0x140030f51
mov rcx, rbx
call fcn.140030e74
test al, al
je 0x140030f2c
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.1400067cc
nop
mov rcx, rax
call fcn.140030ec4
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x140030f2c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
call fcn.140001a74
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140030f39
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140030f51
mov rcx, rbx
call fcn.14000e41c
test al, al
je 0x140030f64
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140041990
add rsp, 0x50
pop rbx
ret
lea rcx, str.Failure_processing_application_bundle.
call fcn.140005b30
mov rcx, rbx
call fcn.140004368
mov rdx, rax
lea rcx, str.Failed_to_create_directory___s__for_extracting_bundled_files.
call fcn.140005b30
mov dword [rsp + 0x20], 0x800080a0
lea rdx, [0x140064f20]
lea rcx, [rsp + 0x20]
call fcn.14004366c
int3
Function at 0x140031248
Capabilities:
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, r8
mov rbx, rdx
mov rdi, rcx
xor ebp, ebp
cmp qword [rbx + 0x18], 8
mov rdx, rbx
jb 0x140031279
mov rdx, qword [rbx]
cmp qword [rdi + 0x18], 8
mov rcx, rdi
jb 0x140031286
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wrename]
test eax, eax
je 0x1400312ee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, rbx
mov esi, dword [rax]
call fcn.14000e41c
test al, al
jne 0x1400312e6
cmp esi, 0xd
jne 0x1400312ea
cmp qword [rbx + 0x18], 8
mov r8, rbx
jb 0x1400312b6
mov r8, qword [rbx]
cmp qword [rdi + 0x18], 8
mov rdx, rdi
jb 0x1400312c3
mov rdx, qword [rdi]
lea rcx, str.Retrying_Rename___s__to___s__due_to_EACCES_error
call fcn.140005ab4
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebp
cmp ebp, 0x1f4
jl 0x14003126c
jmp 0x1400312ea
mov byte [r14], 1
xor al, al
jmp 0x1400312f0
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1400318c0
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140067010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, r8
mov rsi, rdx
mov rbx, rcx
and qword [r11 - 0x30], 0
and qword [r11 - 0x28], 0
add rdx, 0x18
lea rcx, [r11 - 0x40]
call fcn.140008044
nop
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.140031700
mov rdi, rax
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x140031953
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003194e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003194e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400419f0
mov rdx, qword [rsi]
mov rcx, rbp
call fcn.140041634
mov rbx, qword [rsi + 8]
mov r9, rdi
mov r8, rbx
mov edx, 1
mov rcx, qword [rbp + 8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, rbx
jne 0x1400319a2
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140041990
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.Failure_extracting_contents_of_the_application_bundle.
call fcn.140005b30
lea rcx, str.I_O_failure_when_writing_extracted_files.
call fcn.140005b30
mov dword [rsp + 0x20], 0x800080a0
lea rdx, [0x140064f20]
lea rcx, [rsp + 0x20]
call fcn.14004366c
int3
Function at 0x140042f7e
Capabilities:
Access peb ldr_data
Get process filename

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x20]
sub rax, 0x10
jmp 0x140045565
mov rax, qword [rsp + 0x48]
add rsp, 0x68
ret
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
lea rax, [rcx + rax*2 + 2]
mov qword [rsp + 0x38], rax
jmp 0x140043f1b
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
test eax, eax
je 0x1400454ff
jmp 0x14004584f
xor r9d, r9d
mov r8d, eax
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call fcn.140045268
jmp 0x140044ab8
test eax, eax
jne 0x140047e38
jmp 0x140045255
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x48], rax
and al, 0x48
jmp 0x140043bbf
mov rcx, qword [rsp + 0x70]
call fcn.1400441c8
jmp 0x1400449d9
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], 0
jmp 0x1400466de
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
cmp eax, 0x5c
jne 0x14004872d
jmp 0x140043c53
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
test eax, eax
je 0x1400454ff
jmp 0x14004584f
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140046def
jmp 0x140047e38
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0
jmp 0x14004614d
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x10]
sub rax, 0x10
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x30], rax
jne 0x1400466de
jmp 0x140043bbf
jmp 0x140043f1b

Function at 0x140043169
Capabilities:
Enumerate pe sections
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xe8
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x58], 0
jmp 0x140046a2e
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x30], rax
mov edx, 0x40
mov rcx, qword [rsp + 0x108]
or byte [rcx], al
add byte [rax], al

Function at 0x1400463a2
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x140045b0c
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88]
mov rcx, qword [rcx]
movzx ecx, word [rcx + 0x14]
lea rax, [rax + rcx + 0x18]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x24], 0
jmp 0x140042381
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x24], eax
jge fcn.140043290
jmp 0x140046454
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x88]
jmp 0x140044073