joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400906c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x1400907f0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15d, edx
mov rsi, rcx
mov rax, qword [0x1400e5028]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x5e], 0
je 0x14009084e
movzx edi, word [rsi + 0x5c]
test r15b, r15b
je 0x14009082e
mov word [rsi + 0x5c], 0xffff
mov byte [rsi + 0x5e], 0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14005e850
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs r14, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r14
mov eax, dword [rsi + 0x58]
test eax, eax
mov edi, 1
cmovg edi, eax
xor ebp, ebp
mov rcx, qword [rsi + 0x40]
call fcn.140074b44
cmp eax, 0xffffffff
je 0x1400908d0
mov byte [rsp + rbp + 0x58], al
inc rbp
cmp rdi, rbp
jne 0x14009086c
mov word [rsp + 0x56], 0xaaaa
cmp byte [rsi + 0x5f], 0
je 0x1400908d9
movsx eax, byte [rsp + 0x58]
mov word [rsp + 0x56], ax
test r15b, r15b
je 0x1400908ad
movzx edi, word [rsp + 0x56]
mov word [rsi + 0x5c], di
jmp 0x14009082e
mov edi, edi
test edi, edi
jle 0x14009097d
mov rdx, qword [rsi + 0x40]
movsx eax, byte [rsp + rdi + 0x57]
dec rdi
movzx ecx, ax
call fcn.140076594
cmp eax, 0xffffffff
jne 0x1400908af
mov di, 0xffff
jmp 0x14009082e
lea rax, [rsp + 0x48]
mov qword [rax], r14
lea r12, [rsp + 0x40]
mov qword [r12], r14
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r13d, dword [rdx]
movzx ebp, word [rdx + 4]
movzx r14d, word [rdx + 6]
lea r9, [rsp + rdi + 0x58]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x30], rbx
lea rbx, [rsp + 0x56]
mov qword [rsp + 0x28], rbx
lea rbx, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x58]
call qword [rax + 0x18]
cmp eax, 1
jne 0x140090966
mov rax, qword [rsi + 0x50]
mov dword [rax], r13d
mov word [rax + 4], bp
mov word [rax + 6], r14w
cmp edi, 8
je 0x1400908d0
mov rcx, qword [rsi + 0x40]
call fcn.140074b44
cmp eax, 0xffffffff
je 0x1400908d0
mov byte [rsp + rdi + 0x58], al
inc rdi
jmp 0x1400908ea
cmp eax, 2
je 0x1400908d0
cmp eax, 3
je 0x140090893
jmp 0x14009089d
movzx edi, word [rsp + 0x56]
jmp 0x14009082e
Function at 0x1400909d0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x1400e5028]
xor rax, rsp
mov qword [rsp + 0x40], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x40]
mov qword [r14 - 8], r12
lea r13, [rsp + 0x30]
lea r15, [rsp + 0x38]
mov ebp, 0xffffffff
mov qword [rsp + 0x30], r12
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r13
mov r8, r15
mov r9, r14
call qword [rax + 0x20]
mov edi, eax
mov rbx, qword [rsp + 0x30]
sub rbx, r15
mov r9, qword [rsi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.140074768
cmp rax, rbx
jne 0x140090a6c
cmp edi, 1
je 0x140090a14
cmp edi, 2
je 0x140090a6c
mov rcx, qword [rsi + 0x40]
call fcn.140073a58
neg eax
sbb ebp, ebp
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14005e850
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140090a90
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x140090ac5
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140074768
xor ebx, ebx
test rsi, rsi
jle 0x140090aea
movzx edx, byte [r14 + rbx]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp eax, 0xffffffff
je 0x140090aea
inc rbx
cmp rsi, rbx
jne 0x140090acc
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140090b00
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, qword [0x1400e5028]
xor rax, rsp
mov qword [rsp + 0x60], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r12
cmp edx, 0xffffffff
je 0x140090b6a
mov r15d, edx
mov rdi, rcx
mov byte [rsp + 0x57], r15b
cmp byte [rcx + 0x58], 0
je 0x140090b90
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x57]
mov edx, 1
mov r8d, 1
call fcn.140074768
mov esi, 0xffffffff
cmp rax, 1
je 0x140090b6d
jmp 0x140090b70
xor r15d, r15d
mov esi, r15d
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14005e850
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rbx, [rsp + 0x58]
lea r13, [rsp + 0x48]
mov qword [r13], rbx
lea rsi, [rsp + 0x57]
lea r14, [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r13
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rsi
je 0x140090c40
mov ebp, eax
cmp eax, 3
je 0x140090c1f
cmp ebp, 1
ja 0x140090c40
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.140074768
cmp rax, rsi
jne 0x140090c40
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x140090ba8
jmp 0x140090b6d
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.140074768
cmp rax, 1
je 0x140090b6d
mov esi, 0xffffffff
jmp 0x140090b70

Function at 0x140090c90
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x140090cc5
mov r9, qword [rdi + 0x40]
mov edx, 2
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140074768
xor ebx, ebx
test rsi, rsi
jle 0x140090ceb
movzx edx, word [r14 + rbx*2]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp ax, 0xffff
je 0x140090ceb
inc rbx
cmp rsi, rbx
jne 0x140090ccc
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140090d00
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, qword [0x1400e5028]
xor rax, rsp
mov qword [rsp + 0x60], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r12
cmp dx, 0xffff
je 0x140090d6a
mov r15d, edx
mov rdi, rcx
mov word [rsp + 0x56], dx
cmp byte [rcx + 0x58], 0
je 0x140090d90
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x56]
mov edx, 2
mov r8d, 1
call fcn.140074768
mov si, 0xffff
cmp rax, 1
je 0x140090d6d
jmp 0x140090d70
xor r15d, r15d
mov esi, r15d
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14005e850
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rbx, [rsp + 0x58]
lea r13, [rsp + 0x48]
mov qword [r13], rbx
lea rsi, [rsp + 0x56]
lea r14, [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r13
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rsi
je 0x140090e40
mov ebp, eax
cmp eax, 3
je 0x140090e1f
cmp ebp, 1
ja 0x140090e40
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.140074768
cmp rax, rsi
jne 0x140090e40
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x140090da8
jmp 0x140090d6d
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.140074768
cmp rax, 1
je 0x140090d6d
mov si, 0xffff
jmp 0x140090d70

Function at 0x140090e90
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x140090ec7
movabs r9, 0xf000000000000000
shl rax, 4
movsx r10, byte [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
inc rdx
cmp r8, rdx
jne 0x140090ea1
ret

Function at 0x140090f20
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x140090f58
movabs r9, 0xf000000000000000
shl rax, 4
movzx r10d, word [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
add rdx, 2
cmp r8, rdx
jne 0x140090f31
ret
Function at 0x1400aae20
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call fcn.14005dad8
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400aae90]
xor ecx, ecx
xor edx, edx
mov r9, rax
call fcn.140069e30
mov qword [rbx], rax
test rax, rax
je 0x1400aae77
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x1400aca20
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov edi, 2
cmp rdx, 1
jne 0x1400acac7
mov rbx, qword [rsi + 8]
cmp rdi, rbx
ja 0x1400acbb5
jae 0x1400acbad
cmp rbx, 3
jb 0x1400acae8
mov rax, rbx
shr rax, 1
movabs rcx, 0x5555555555555555
and rcx, rax
mov rax, rbx
sub rax, rcx
movabs rcx, 0x3333333333333333
mov rdx, rax
and rdx, rcx
shr rax, 2
and rax, rcx
add rax, rdx
mov rcx, rax
shr rcx, 4
add rcx, rax
movabs rax, 0xf0f0f0f0f0f0f0f
and rax, rcx
movabs rcx, 0x101010101010101
imul rcx, rax
shr rcx, 0x38
cmp ecx, 1
ja 0x1400acae8
mov rax, qword [rsi + 0x18]
test rax, rax
js 0x1400acaf8
cvtsi2ss xmm0, rax
jmp 0x1400acb0d
lea rax, [rdx - 1]
test rdx, rax
jne 0x1400acad8
mov rdi, rdx
jmp 0x1400aca39
mov rcx, rdx
call fcn.14003e9e0
mov rdi, rax
jmp 0x1400aca39
mov rax, qword [rsi + 0x18]
test rax, rax
js 0x1400acb58
cvtsi2ss xmm0, rax
jmp 0x1400acb6d
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rsi + 0x20]
call fcn.140089000
cvttss2si rcx, xmm0
movss xmm1, dword [0x1400cd788]
movaps xmm2, xmm0
subss xmm2, xmm1
cvttss2si rax, xmm2
btc rax, 0x3f
ucomiss xmm0, xmm1
cmovb rax, rcx
cmp rax, 2
jb 0x1400acba1
dec rax
bsr rcx, rax
xor ecx, 0x3f
neg cl
mov eax, 1
shl rax, cl
jmp 0x1400acba1
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rsi + 0x20]
call fcn.140089000
cvttss2si rax, xmm0
movss xmm1, dword [0x1400cd788]
movaps xmm2, xmm0
subss xmm2, xmm1
cvttss2si rcx, xmm2
btc rcx, 0x3f
ucomiss xmm0, xmm1
cmovb rcx, rax
call fcn.14003e9e0
cmp rdi, rax
cmovb rdi, rax
cmp rdi, rbx
jb 0x1400acbb5
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
mov rdx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14008f930
Function at 0x1400ace20
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x1400e5028]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x1400aceb7
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, esi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x1400acebc
test bl, bl
je 0x1400ace7b
cmp byte [rdi + 8], 0
je 0x1400acf35
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [rdi + 8], 0
jne 0x1400acf42
mov rcx, qword [rdi]
call fcn.14002ced0
mov rcx, qword [0x1400ec6a8]
mov dil, 1
test rcx, rcx
jne 0x1400acf50
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14005e850
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rcx, qword [rdi]
jmp 0x1400ace4d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rdi + 8], 0
je 0x1400acee4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400acee9
xor edi, edi
jmp 0x1400acea0
mov rcx, qword [rdi]
jmp 0x1400aced1
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rdi + 8], 0
je 0x1400acf3d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1400acf13
mov esi, dword [rsp + 0x24]
cmp byte [rdi + 8], 0
jne 0x1400acf5f
mov rcx, qword [rdi]
call fcn.14002ced0
mov rcx, qword [0x1400ec6a8]
test rcx, rcx
jne 0x1400acf6a
mov dil, 1
jmp 0x1400acea0
mov rcx, qword [rdi]
jmp 0x1400ace70
mov rcx, qword [rdi]
jmp 0x1400acf00
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x1400ace88
mov edx, eax
mov r8d, esi
call fcn.1400ae9a0
jmp 0x1400acea0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x1400acf1c
mov edx, eax
mov r8d, esi
call fcn.1400ae9a0
jmp 0x1400acf2d
Function at 0x14000113c
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor eax, eax
cpuid
mov eax, 1
cpuid
movabs r9, 0xb2d05e00
cpuid
rdtsc
shl rdx, 0x20
or rax, rdx
mov rcx, rax
fldpi
frndint
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, rcx
cmp rax, r9
jb 0x14000115f
push rbp
mov rbp, rsp
sub rsp, 8
mov r10, 0xa
mov rcx, 0xffffffff9f345678
dec rcx
xor r9, r9
mov rax, rcx
jne 0x14000118a
xor rax, rax
mov rax, rbx
add rax, rdx
nop
nop
nop
dec r10
xor r11, r11
jne 0x140001183
xor rax, rax
mov rax, 0xa
dec rax
nop
nop
add rsp, 8
pop rbp
ret

Function at 0x140003320
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
test rdx, rdx
mov ebx, r8d
mov rsi, rdx
mov dword [rsp + 0x50], ebx
mov rbp, rcx
je 0x1400034b7
cmp byte [rdx], 0
je 0x1400034b7
cmp rcx, 0xffffffffffffffff
je 0x1400034b7
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x140003377
mov eax, 1
jmp 0x1400033b9
mov r9d, ebx
lea rax, [rsp + 0x48]
xor r8d, r8d
mov rdx, rsi
mov rcx, rbp
or r9d, 0xf003f
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x1b8], rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400033d4
xor edi, edi
cmp eax, 2
sete dil
mov eax, edi
mov rdi, qword [rsp + 0x1b8]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140004c00
add rsp, 0x180
pop rsi
pop rbp
pop rbx
ret
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rbx, eax
add rbx, rsi
cmp byte [rbx - 1], 0x5c
je 0x1400033f3
mov byte [rbx], 0x5c
add rbx, 1
mov byte [rbx], 0
mov rcx, qword [rsp + 0x48]
xor edi, edi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x14000348f
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov r8d, dword [rsp + 0x50]
mov rdx, rsi
mov rcx, rbp
call fcn.140003320
test eax, eax
je 0x14000348f
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea r8, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x40], 0x104
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x140003431
mov byte [rbx - 1], dil
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
sete dil
mov eax, edi
jmp 0x1400033b1
xor eax, eax
jmp 0x1400033b9
Function at 0x140003590
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
push rbx
push rbp
push rdi
push r12
push r13
push r14
sub rsp, 0x1c8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
test rcx, rcx
mov rbp, qword [rsp + 0x220]
mov r13, r9
mov r12, r8
mov r14, rdx
mov rbx, rcx
je 0x140003809
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x140003809
test rdx, rdx
je 0x14000380b
test r9, r9
je 0x14000380b
test rbp, rbp
je 0x14000380b
test r8, r8
je 0x14000380b
cmp dword [r8], eax
je 0x14000380b
mov qword [r11 - 0x38], rsi
lea rcx, [r11 - 0x167]
xor edx, edx
mov r8d, 0x103
mov qword [r11 - 0x40], r15
mov byte [rsp + 0x90], al
call fcn.140004c60
xor edx, edx
lea rcx, [rsp + 0x21]
lea r8d, [rdx + 0x63]
mov byte [rsp + 0x20], 0
call fcn.140004c60
lea r8, [0x140011410]
lea rcx, [rsp + 0x90]
mov r9, rbx
mov edx, 0x104
call fcn.140004c20
lea rsi, [rsp + 0x90]
lea r15, [0x140002000]
nop
nop
mov edx, 0x2f
mov rcx, rsi
call fcn.1400046a0
test rax, rax
mov rbx, rax
je 0x1400037f2
lea rsi, [rax + 1]
movsx eax, byte [rax + 1]
add eax, 0xffffffba
cmp eax, 0x2c
ja case.0x1400036c3.73
cdqe
movzx eax, byte [r15 + rax + 0x183c]
mov ecx, dword [r15 + rax*4 + 0x182c]
add rcx, r15
jmp rcx
cmp byte [rsi + 1], 0x20
lea rbx, [rsi + 1]
jne 0x1400036fe
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x90]
repne scasb al, byte [rdi]
not rcx
lea rax, [rsp + rcx + 0x8f]
nop
nop
cmp rbx, rax
ja 0x1400036fe
add rbx, 1
cmp byte [rbx], 0x20
je 0x1400036f0
movzx r8d, byte [rbx]
lea rdx, [rsp + 0x20]
cmp r8b, 0x20
je 0x140003741
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x90]
repne scasb al, byte [rdi]
not rcx
lea rax, [rsp + rcx + 0x8e]
cmp rbx, rax
ja 0x140003741
add rbx, 1
mov byte [rdx], r8b
add rdx, 1
mov r8b, byte [rbx]
cmp r8b, 0x20
jne 0x140003728
or rcx, 0xffffffffffffffff
xor eax, eax
mov byte [rdx], 0
mov edx, dword [r12]
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp rdx, rcx
jb 0x140003796
lea r9, [rsp + 0x20]
lea r8, [0x140011410]
movsxd rdx, edx
mov rcx, r14
call fcn.140004c20
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov dword [r12], ecx
add dword [rbp], 1
jmp 0x1400037c9
mov dword [r12], eax
add dword [rbp], 1
jmp 0x1400037c9
mov dword [r13], 1
add dword [rbp], 1
jmp 0x1400037c9
mov dword [r13], 0
add dword [rbp], 1
jmp 0x1400037c9
lea rcx, str.No_valid_parameter_followed_an____n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test rbx, rbx
je 0x1400037f2
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x90]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rsp + rcx + 0x8e]
cmp rbx, rdx
jne 0x140003680
mov r15, qword [rsp + 0x1b8]
mov rsi, qword [rsp + 0x1c0]
mov eax, 1
jmp 0x14000380b
xor eax, eax
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140004c00
add rsp, 0x1c8
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x140003870
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x260
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rcx
mov ebx, edx
lea rcx, [rsp + 0x141]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x140], 0
call fcn.140004c60
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x30], 0
call fcn.140004c60
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x1400038e6
mov eax, 0xfffffffe
jmp 0x1400039bc
sub ebx, 0xa
je 0x140003977
sub ebx, 1
je 0x14000394a
sub ebx, 1
je 0x140003931
sub ebx, 0x14
je 0x140003914
cmp ebx, 0x43
jne 0x1400038dc
lea rcx, [rsp + 0x30]
mov edx, 0x104
call fcn.140003550
jmp 0x140003987
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1400038dc
lea r8, str._sSysWOW64
jmp 0x140003961
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea r8, str._s_system32drivers
jmp 0x140003961
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea r8, str._s_system32
lea r9, [rsp + 0x30]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call fcn.140004c20
jmp 0x140003987
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea r9, [rsp + 0x30]
lea r8, str._s_s
lea rcx, [rsp + 0x140]
mov edx, 0x104
mov qword [rsp + 0x20], rdi
call fcn.140004c20
lea rcx, [rsp + 0x140]
call fcn.140004d50
mov eax, 1
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140004c00
mov rbx, qword [rsp + 0x278]
add rsp, 0x260
pop rdi
ret
Function at 0x140004d50
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140004d77
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140004d77
mov ecx, eax
call fcn.140006af0
or eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x140006930
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x5b0
mov rbp, rcx
mov rcx, qword [0x1400175d0]
mov ebx, r9d
mov rdi, r8
mov rsi, rdx
call fcn.140006230
test rax, rax
je 0x140006984
mov r10, qword [rsp + 0x5e0]
mov r9d, ebx
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], r10
call rax
jmp 0x140006a19
mov ecx, 2
call fcn.14000bb60
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x98
call fcn.140004c60
mov rax, qword [rsp + 0x5b8]
mov dword [rsp + 0x40], 0xc000000d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x140006a05
test ebx, ebx
jne 0x140006a05
lea ecx, [rax + 2]
call fcn.14000bb60
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc000000d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140008b47
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [section..data]
jne 0x140004c1a
rol rcx, 0x10
test cx, 0xffff
jne 0x140004c16
repz ret
ror rcx, 0x10
jmp 0x140008aa0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140017690]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140017788]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140008b25
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140017690]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140008b47
mov rax, qword [rsp + 0x88]
mov qword [0x140017788], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140017728], rax
mov rax, qword [0x140017788]
mov qword [0x140017600], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140017710], rax
mov dword [0x1400175f0], 0xc0000409
mov dword [0x1400175f4], 1
mov rax, qword [section..data]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140016008]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140017688], eax
mov ecx, 1
call fcn.14000bb60
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140011700]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140017688], 0
jne 0x140008bce
mov ecx, 1
call fcn.14000bb60
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret