joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003b70
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140003ba4
cmp word [rcx], 0x5a4d
jne 0x140003ba4
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140003ba4
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003ba4
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140003ab0
test eax, eax
jne 0x140003bc0
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140003b20
test rax, rax
je 0x140003bb5
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.140004378
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x140004270
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140004210
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1400046e4
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x14055f598]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x14055f594]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x140004732
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14000472a
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140004819
inc ebx
add rax, 0x28
jmp 0x14000470a
mov rcx, r12
call fcn.140004f11
mov rbp, rax
test rax, rax
jne 0x140004751
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140004680
movsxd rbx, ebx
mov rax, qword [0x14055f598]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.140004fbf
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14055f598]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1400047b3
mov rax, qword [0x14055f598]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140004680
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140004813
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140004813
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14055f598]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140004813
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140004680
inc dword [0x14055f594]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140004c40
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x14055f600]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14055f5e0]
test rbx, rbx
je 0x140004c8c
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140004c86
test eax, eax
jne 0x140004c86
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x140004c5e
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140004e40
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140004e63
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140004e63
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140004e64
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x140004e9e
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x140004e95
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140004ea0
inc r8d
add rax, 0x28
jmp 0x140004e7c
xor eax, eax
ret

Function at 0x140004f11
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x14055b670]
mov r8, rcx
mov rcx, r9
call fcn.140004e40
test eax, eax
je 0x140004f3d
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140004e64
xor eax, eax
add rsp, 0x28
ret
Function at 0x100011b78
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xb0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rbx, rdx
mov rsi, rcx
cmp qword [rdx + 0x18], 0
je 0x100011d8c
cmp qword [rdx + 0x20], 8
jb 0x100011bb5
lea rdi, [rdx + 8]
mov rcx, qword [rdi]
jmp 0x100011bbc
lea rdi, [rdx + 8]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100011d8c
mov rcx, rbx
call fcn.10002c820
test al, al
jne 0x100011d8c
cmp byte [rsi], al
je 0x100011c41
mov rdx, qword [rsi + 8]
lea rcx, [0x100002990]
call fcn.1000250f8
mov qword [rsp + 0x50], 0xf
and qword [rsp + 0x48], 0
mov byte [rsp + 0x38], 0
mov r8d, 0x11
lea rdx, [0x100002a08]
lea rcx, [rsp + 0x30]
call fcn.100015edc
nop
mov r8d, 0x8000ffff
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.1000178c4
lea rdx, [0x100079938]
lea rcx, [rsp + 0x68]
call sub.msvcrt.dll__CxxThrowException
nop
lea rcx, [rsp + 0x30]
call fcn.100032b90
nop
cmp qword [rax + 0x20], 8
jb 0x100011c59
mov rdx, qword [rax + 8]
jmp 0x100011c5d
lea rdx, [rax + 8]
cmp qword [rbx + 0x20], 8
jb 0x100011c67
mov rdi, qword [rdi]
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
lea r8, [rsp + 0xc8]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rdx
mov r9, rdi
xor r8d, r8d
xor edx, edx
call qword [rax + 0x28]
mov ebx, eax
cmp qword [rsp + 0x50], 8
jb 0x100011c9f
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_free
test ebx, ebx
jns 0x100011cf3
mov qword [rsp + 0x50], 0xf
and qword [rsp + 0x48], 0
mov byte [rsp + 0x38], 0
mov r8d, 0x1a
lea rdx, [0x100002a20]
lea rcx, [rsp + 0x30]
call fcn.100015edc
nop
mov r8d, ebx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.1000178c4
lea rdx, [0x100079938]
lea rcx, [rsp + 0x68]
call sub.msvcrt.dll__CxxThrowException
nop
mov rcx, qword [rsp + 0xc8]
mov rax, qword [rcx]
lea r8, [rsp + 0x58]
lea rdx, [0x1000035a0]
call qword [rax]
mov ebx, eax
mov rcx, qword [rsp + 0xc8]
test rcx, rcx
je 0x100011d21
mov rdx, qword [rcx]
call qword [rdx + 0x10]
and qword [rsp + 0xc8], 0
test ebx, ebx
js 0x100011d3c
mov rax, qword [rsp + 0x58]
test rax, rax
jne 0x100011ddf
mov qword [rsp + 0x50], 0xf
and qword [rsp + 0x48], 0
mov byte [rsp + 0x38], 0
mov r8d, 0x18
lea rdx, [0x100002a40]
lea rcx, [rsp + 0x30]
call fcn.100015edc
nop
mov r8d, ebx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.1000178c4
lea rdx, [0x100079938]
lea rcx, [rsp + 0x68]
call sub.msvcrt.dll__CxxThrowException
nop
mov qword [rsp + 0x50], 0xf
and qword [rsp + 0x48], 0
mov byte [rsp + 0x38], 0
mov r8d, 8
lea rdx, [0x100002980]
lea rcx, [rsp + 0x30]
call fcn.100015edc
nop
mov r8d, 0x80070057
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.1000178c4
lea rdx, [0x100079938]
lea rcx, [rsp + 0x68]
call sub.msvcrt.dll__CxxThrowException
nop
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x100013960
Capabilities:
Terminate thread

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x80
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rbx, rcx
add rcx, 0x20
call fcn.10001c9ac
cmp qword [rbx + 0xd0], 0
je 0x1000139f9
and qword [rsp + 0x60], 0
mov dword [rsp + 0x30], 6
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.100013e00
mov rcx, qword [rbx + 0xd0]
test rcx, rcx
je 0x1000139df
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0xd0]
test rcx, rcx
je 0x1000139d7
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
and qword [rbx + 0xd0], 0
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x1000139f9
mov rcx, rdi
call fcn.100018e58
mov rcx, rdi
call sub.msvcrt.dll_free
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
je 0x100013a11
cmp rcx, 0xffffffffffffffff
je 0x100013a11
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rbx + 0xd8], 0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
Function at 0x100017d1c
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0xc0
mov qword [rsp + 0xb0], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov r12d, r8d
mov rbx, rdx
mov rbp, rcx
xor r13d, r13d
mov dword [rsp + 0xe8], r13d
cmp qword [rdx + 0x20], 8
jb 0x100017d67
lea rdi, [rdx + 8]
mov rcx, qword [rdi]
jmp 0x100017d6e
lea rdi, [rdx + 8]
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
cmp eax, r13d
jg 0x100017dcd
mov edi, 0xf
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r13
mov byte [rsp + 0x28], r13b
lea r8d, [rdi + 0x16]
lea rdx, [0x100003858]
lea rcx, [rsp + 0x20]
call fcn.100015edc
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x48]
call fcn.100017ca8
lea rdx, [0x100079b00]
lea rcx, [rsp + 0x48]
call sub.msvcrt.dll__CxxThrowException
nop
inc eax
mov word [rsp + 0xe8], r13w
movsxd rdx, eax
lea r8, [rsp + 0xe8]
lea rcx, [rsp + 0x20]
call fcn.100020218
nop
mov rsi, qword [rsp + 0x28]
cmp rsi, r13
jne 0x100017dfd
mov rax, r13
jmp 0x100017e08
mov rax, qword [rsp + 0x38]
sub rax, rsi
sar rax, 1
cmp qword [rbx + 0x20], 8
jb 0x100017e12
mov rdi, qword [rdi]
mov r9d, eax
mov r8, rsi
mov edx, r12d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
cmp eax, r13d
jg 0x100017eb8
mov edi, 0xf
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xa0], r13
mov byte [rsp + 0x90], r13b
lea r8d, [rdi + 0x19]
lea rdx, [0x100003880]
lea rcx, [rsp + 0x88]
call fcn.100015edc
nop
lea rcx, [rsp + 0x48]
call fcn.1000685aa
nop
lea rax, [0x100003578]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x78], r13
mov byte [rsp + 0x68], r13b
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x60]
call fcn.100015bcc
nop
lea rdx, [0x100079a98]
lea rcx, [rsp + 0x48]
call sub.msvcrt.dll__CxxThrowException
nop
mov qword [rbp + 0x20], 7
mov qword [rbp + 0x18], r13
mov word [rbp + 8], r13w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rsi
mov rcx, rbp
call fcn.100017078
nop
cmp rsi, r13
je 0x100017ef5
mov rcx, rsi
call sub.msvcrt.dll_free
mov rax, rbp
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1000190c8
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rbx, rdx
mov rdi, rcx
cmp qword [rdx + 0x18], 0
je 0x10001915e
cmp qword [rdx + 0x20], 8
jb 0x1000190fa
mov rcx, qword [rdx + 8]
jmp 0x1000190fe
lea rcx, [rdx + 8]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10001915e
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.10002c8b4
mov eax, dword [rax + 0x20]
shr eax, 0x14
shl eax, 2
mov qword [rdi + 0x168], rax
lea rcx, [rdi + 0x1a0]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
call fcn.100017224
nop
mov rcx, rdi
call fcn.10001a710
neg al
sbb eax, eax
not eax
and eax, 0x80004005
jmp 0x100019163
mov eax, 0x80070057
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x1000195a4
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov dword [rax + 0x10], edx
push rbp
push rsi
push rdi
sub rsp, 0x50
xor ebp, ebp
mov rbx, rcx
mov esi, ebp
mov edi, ebp
mov qword [rax + 0x20], rbp
mov qword [rax + 0x18], rbp
cmp qword [rcx + 0x18], rbp
jne 0x1000195da
lea ecx, [rbp + 0x32]
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x100019796
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x88]
lea rdx, [0x100003e38]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp eax, ebp
jne 0x1000197a9
cmp qword [rbx + 0x20], 8
jb 0x10001962e
mov rdx, qword [rbx + 8]
jmp 0x100019632
lea rdx, [rbx + 8]
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x88]
mov edi, eax
cmp rcx, rbp
je 0x10001967e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x88], rbp
cmp edi, ebp
je 0x100019697
mov qword [rsp + 0x80], rbp
jmp 0x1000197a9
mov rax, qword [rbx + 0x168]
mov ecx, 0xffffffff
cmp rax, rcx
jbe 0x1000196b2
mov edi, 0x57
jmp 0x1000197a9
mov rcx, qword [rsp + 0x80]
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x78]
mov r9d, 4
lea rdx, [0x100003f10]
xor r8d, r8d
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
cmp eax, ebp
jne 0x100019796
mov rax, qword [rbx + 0x40]
cmp rax, rbp
je 0x100019738
cmp qword [rbx + 0x48], 8
jb 0x100019703
mov rcx, qword [rbx + 0x30]
jmp 0x100019707
lea rcx, [rbx + 0x30]
lea eax, [rax + rax + 2]
lea rdx, [0x100003f80]
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x80]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
cmp eax, ebp
jne 0x100019796
mov rax, qword [rbx + 0x1b8]
cmp rax, rbp
je 0x10001978f
cmp qword [rbx + 0x1c0], 8
jb 0x100019757
mov rbx, qword [rbx + 0x1a8]
jmp 0x10001975e
add rbx, 0x1a8
mov rcx, qword [rsp + 0x80]
lea eax, [rax + rax + 2]
lea rdx, [0x100003f98]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
cmp eax, ebp
jne 0x100019796
mov edi, ebp
mov esi, 1
mov rcx, qword [rsp + 0x88]
cmp rcx, rbp
je 0x1000197a9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x88], rbp
cmp rcx, rbp
je 0x1000197c4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x80], rbp
cmp esi, ebp
jne 0x1000197dc
cmp edi, ebp
je 0x1000197dc
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x10002509c
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov r11, rcx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
mov r10, rdx
repne scasw ax, word [rdi]
mov eax, 2
not rcx
dec rcx
mul rcx
test rdx, rdx
jne 0x1000250eb
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x1000250eb
and qword [rsp + 0x20], rdx
mov rcx, qword [r11 + 8]
lea r9, [rsp + 0x50]
mov r8d, eax
mov rdx, r10
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rsp, 0x30
pop rdi
ret

Function at 0x100025790
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x2b0
mov rax, qword [0x10007d1c0]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rdi, rcx
lea rcx, [rsp + 0x92]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x90], bx
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x90]
lea rcx, [0x100005570]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebx
je 0x100025878
lea r8d, [rbx + 0x6c]
lea rcx, [rsp + 0x24]
xor edx, edx
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x90]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0x70
mov dword [rsp + 0x50], 5
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, ebx
je 0x10002584c
lea r8d, [rbx + 5]
xor r9d, r9d
mov edx, 0x471
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov ebx, 1
jmp 0x100025878
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1000055b0]
mov edx, eax
call fcn.1000250f8
mov edx, 1
mov ecx, 0x837
mov r9d, edx
mov r8d, 0xffff
call fcn.100027abc
mov eax, ebx
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.100068440
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x2b0
pop rdi
ret
Function at 0x10002b1f0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x10007d1c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov edi, edx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rbx, rax
mov eax, dword [0x100006258]
lea rcx, [rsp + 0x20]
mov dword [rcx], eax
movzx eax, word [0x10000625c]
xor ebp, ebp
mov word [rcx + 4], ax
cmp rbx, rbp
je 0x10002b2f5
cmp word [rbx], bp
je 0x10002b2f5
lea rax, [rsp + 0x20]
movzx ecx, word [rax]
cmp cx, bp
je 0x10002b271
cmp word [rbx], cx
je 0x10002b2e7
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextW]
cmp rax, rbp
jne 0x10002b252
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharNextW]
mov rbx, rax
cmp rax, rbp
jmp 0x10002b23e
lea rdx, [0x100006260]
mov rcx, rbx
call fcn.10002c224
cmp eax, ebp
je 0x10002b3b2
lea rdx, [0x100006278]
mov rcx, rbx
call fcn.10002c224
cmp eax, ebp
je 0x10002b329
cmp rbx, rbp
je 0x10002b2f5
cmp word [rbx], bp
je 0x10002b2f5
lea rax, [rsp + 0x20]
movzx ecx, word [rax]
cmp cx, bp
je 0x10002b2d6
cmp word [rbx], cx
je 0x10002b2e7
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextW]
cmp rax, rbp
jne 0x10002b2bb
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharNextW]
mov rbx, rax
cmp rax, rbp
jmp 0x10002b2af
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharNextW]
mov rbx, rax
jmp 0x10002b2f8
mov rbx, rbp
cmp rbx, rbp
jne 0x10002b282
mov edx, edi
mov rcx, rsi
call fcn.10002b3f0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.100068440
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [0x10007d4d0]
mov rdx, qword [0x10007d4d8]
mov eax, ebp
cmp rbx, rdx
jae 0x10002b37e
mov rdi, qword [rbx]
cmp rdi, rbp
je 0x10002b371
mov ecx, 1
call qword [rdi + 8]
cmp eax, ebp
jl 0x10002b307
call qword [rdi + 0x38]
mov rcx, qword [rdi]
mov r8d, 1
mov rdx, rax
call fcn.10002b95c
cmp eax, ebp
jl 0x10002b307
mov rdx, qword [0x10007d4d8]
add rbx, 8
cmp rbx, rdx
jb 0x10002b33e
cmp eax, ebp
jl 0x10002b307
mov rcx, qword [0x10007d4c8]
xor edx, edx
call fcn.10002c078
cmp eax, ebp
jl 0x10002b307
mov rdx, qword [0x100081780]
cmp rdx, rbp
je 0x10002b307
mov rcx, qword [0x10007d518]
call rdx
jmp 0x10002b307
mov rax, qword [0x100081788]
cmp rax, rbp
je 0x10002b3c8
call rax
cmp eax, ebp
jl 0x10002b307
xor r8d, r8d
lea rcx, [0x10007d4c0]
lea edx, [r8 + 1]
call fcn.10002b794
cmp eax, ebp
jl 0x10002b307
mov eax, ebp
jmp 0x10002b307
Function at 0x10002c820
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0xa8
mov qword [rsp + 0x48], 0xfffffffffffffffe
cmp qword [rcx + 0x20], 8
jb 0x10002c83d
mov rcx, qword [rcx + 8]
jmp 0x10002c841
add rcx, 8
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10002c899
mov qword [rsp + 0x40], 0xf
and qword [rsp + 0x38], 0
mov byte [rsp + 0x28], 0
mov r8d, 0x18
lea rdx, [0x100006518]
lea rcx, [rsp + 0x20]
call fcn.100015edc
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.1000178e8
lea rdx, [0x100079938]
lea rcx, [rsp + 0x50]
call sub.msvcrt.dll__CxxThrowException
nop
shr eax, 4
and eax, 1
jmp 0x10002c8a3
add rsp, 0xa8
ret

Function at 0x10002d5c0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
lea rcx, [rsp + 0x20]
xor edi, edi
mov dword [rsp + 0x68], edi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx r11d, word [rsp + 0x20]
cmp r11d, edi
je 0x10002d611
cmp r11d, 6
je 0x10002d602
cmp r11d, 9
jne 0x10002d611
lea r8d, [rdi + 5]
lea rdx, [0x1000065d8]
jmp 0x10002d61e
mov r8d, 4
lea rdx, [0x1000065c8]
jmp 0x10002d61e
mov r8d, 3
lea rdx, [0x1000065e8]
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], rdi
mov rcx, rbx
mov word [rbx + 8], di
call fcn.100017078
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x10002d64c
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rcx, [0x1000816f8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11, qword [0x100081688]
xor edi, edi
cmp r11, rdi
je 0x10002d6a7
mov rcx, qword [r11 + 0x10]
cmp rcx, rdi
je 0x10002d6a7
lea r8, [0x100006650]
lea rdx, [0x100006670]
call fcn.100034218
mov rbx, rax
cmp rax, rdi
je 0x10002d6a7
lea rcx, [0x1000816f8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, rbx
jmp 0x10002d6f3
lea rcx, [0x1000816f8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp word [0x1000818c0], di
jne 0x10002d6ec
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov r9d, 0x55
lea r8, [0x1000818c0]
lea edx, [r9 + 7]
movzx ecx, ax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, edi
jne 0x10002d6ec
mov word [0x1000818c0], di
xor eax, eax
jmp 0x10002d6f3
lea rax, [0x1000818c0]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x10002d9bc
Capabilities:
Get token membership

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x80
mov rax, qword [0x10007d1c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor ebx, ebx
lea rax, [r11 - 0x20]
lea rcx, [r11 - 0x18]
mov qword [r11 - 0x38], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
lea r8d, [rbx + 0x20]
mov r9d, 0x220
mov dl, 2
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x60], ebx
mov byte [rsp + 0x70], bl
mov byte [rsp + 0x71], bl
mov dword [rsp + 0x20], ebx
mov byte [rsp + 0x72], bl
mov byte [rsp + 0x73], bl
mov byte [rsp + 0x74], bl
mov byte [rsp + 0x75], 5
mov qword [r11 - 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rsp + 0x60], eax
cmp eax, ebx
je 0x10002da69
mov rdx, qword [rsp + 0x68]
cmp rdx, rbx
je 0x10002da69
lea r8, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
neg eax
sbb ecx, ecx
and ecx, dword [rsp + 0x60]
mov dword [rsp + 0x60], ecx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.100068440
add rsp, 0x80
pop rbx
ret
Function at 0x10002e074
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x480
mov rax, qword [0x10007d1c0]
xor rax, rsp
mov qword [rsp + 0x470], rax
xor edi, edi
lea rbx, [rcx + 0x18]
mov dword [rsp + 0x40], 0x104
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x44], edi
cmp word [rbx], di
je 0x10002e0b7
mov rax, rbx
jmp 0x10002e154
lea rcx, [rsp + 0x260]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, edi
je 0x10002e152
lea r9, [0x100004d50]
lea r8, [rsp + 0x260]
lea rcx, [rsp + 0x50]
mov edx, 0x104
mov dword [rsp + 0x20], edi
call fcn.1000155bc
cmp eax, edi
jl 0x10002e152
jmp 0x10002e110
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, edi
jne 0x10002e0af
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x40], 0x104
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x44]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetFileMUIPath]
mov rcx, rbx
cmp eax, edi
jne 0x10002e0fa
xor edx, edx
mov r8d, 0x208
call sub.msvcrt.dll_memset
xor eax, eax
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.100068440
mov rbx, qword [rsp + 0x498]
add rsp, 0x480
pop rdi
ret