joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000ba40
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push r14
xor r14d, r14d
push r13
push r12
push rbp
push rdi
push rsi
push rbx
mov rbx, rcx
mov rdx, rbx
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov ecx, dword [rcx + rax + 0x88]
call 0x140012630
mov rdx, rbx
mov esi, eax
add rsi, rbx
mov ecx, dword [rsi + 0x20]
call 0x140012630
mov ecx, dword [rsi + 0x24]
mov rdx, rbx
mov r12d, eax
call 0x140012630
mov r13d, dword [rsi + 0x18]
add r12, rbx
mov edi, eax
cmp r13, r14
je 0x14000baff
mov ecx, dword [r12 + r14*4]
mov rdx, rbx
call 0x140012630
mov ebp, eax
add rbp, rbx
mov rcx, rbp
call fcn.14000bfd0
cmp eax, 0xa6caa1c5
jne 0x14000bae4
mov ecx, dword [rsi + 0x1c]
mov rdx, rbx
add rdi, rbx
call 0x140012630
movzx edx, word [rdi + r14*2]
mov eax, eax
add rax, rbx
mov ecx, dword [rax + rdx*4]
add rsp, 0x20
mov rdx, rbx
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp 0x140012630
mov rcx, rbp
call fcn.14000bfd0
mov edx, eax
lea rax, [r14 + 1]
cmp edx, 0xffe885ef
je 0x14000bab3
mov r14, rax
jmp 0x14000ba8e
add rsp, 0x20
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov eax, ecx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
cmp eax, dword [rdx + 0x14]
jb 0x14001267a
mov r9w, word [rcx + 6]
xor ecx, ecx
cmp r9w, cx
je 0x140012678
mov r8d, dword [rdx + 0xc]
cmp eax, r8d
jb 0x140012670
mov r10d, dword [rdx + 0x10]
add r10d, r8d
cmp eax, r10d
jae 0x140012670
add eax, dword [rdx + 0x14]
sub eax, r8d
ret
inc ecx
add rdx, 0x28
jmp 0x14001264e
xor eax, eax
ret

Function at 0x14000bb60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [0x140019150]
push r12
xor edx, edx
push rbp
push rdi
push rsi
push rbx
mov rbx, qword [rax]
mov rax, qword [rbx + 0x84a]
test rax, rax
je 0x14000bc11
mov edx, dword [rbx + 0x800]
test edx, edx
jne 0x14000bc11
movsxd rcx, dword [rax + 0x3c]
xor r8d, r8d
mov ecx, dword [rax + rcx + 0x88]
add rcx, rax
mov edi, dword [rcx + 0x20]
mov r10d, dword [rcx + 0x1c]
mov esi, dword [rcx + 0x24]
mov ebp, dword [rcx + 0x18]
xor ecx, ecx
add r10, rax
add rdi, rax
add rsi, rax
cmp r8d, ebp
jae 0x14000bc0b
mov r9d, dword [rdi + r8*4]
cmp word [rax + r9], 0x775a
jne 0x14000bc06
test rcx, rcx
movzx r9d, word [rsi + r8*2]
jne 0x14000bbde
mov ecx, dword [r10 + r9*4]
add rcx, rax
jmp 0x14000bc06
mov r9d, dword [r10 + r9*4]
mov r11, rcx
add r9, rax
mov r12, r9
sub r11, r9
sub r12, rcx
cmp r9, rcx
mov r9d, r12d
cmovb r9d, r11d
lea r11d, [rdx - 1]
cmp r11d, r9d
cmovae edx, r9d
inc r8
jmp 0x14000bbb9
mov dword [rbx + 0x800], edx
pop rbx
mov eax, edx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x14000bf80
Capabilities:
Hash data using djb2

Disassembly:
xor eax, eax
test rcx, rcx
je 0x14000bfcd
mov r10, rcx
mov eax, 0x1505
mov r9b, byte [r10]
test edx, edx
jne 0x14000bf9c
test r9b, r9b
jne 0x14000bfaf
ret
mov r11, r10
sub r11, rcx
cmp r11d, edx
jae 0x14000bfcd
cmp r9b, 1
adc r10, 0
cmp r9b, 0x60
jbe 0x14000bfbe
test r8d, r8d
je 0x14000bfbe
sub r9d, 0x20
imul eax, eax, 0x21
movzx r9d, r9b
inc r10
add eax, r9d
jmp 0x14000bf8f
ret
Function at 0x14000bfd0
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0x1505
movsx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14000bfe6
imul eax, eax, 0x21
add eax, edx
jmp 0x14000bfd5
ret

Function at 0x14000d9c0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rsi
xor eax, eax
push rbx
mov r8b, byte [rdx + rax]
mov byte [rcx + rax], r8b
mov r8b, byte [rdx + rax + 1]
mov byte [rcx + rax + 1], r8b
mov r8b, byte [rdx + rax + 2]
mov byte [rcx + rax + 2], r8b
mov r8b, byte [rdx + rax + 3]
mov byte [rcx + rax + 3], r8b
add rax, 4
cmp rax, 0x20
jne 0x14000d9c4
mov r11d, 8
lea r10, str.cw
lea rbx, [0x1400191a0]
mov esi, r11d
movzx r9d, byte [rcx + 0x1c]
movzx r8d, byte [rcx + 0x1d]
movzx edx, byte [rcx + 0x1e]
movzx eax, byte [rcx + 0x1f]
and esi, 7
jne 0x14000da42
mov sil, byte [r10 + r8]
mov r8b, byte [r10 + rdx]
mov dl, byte [r10 + rax]
mov al, byte [r10 + r9]
mov r9d, r11d
shr r9d, 3
xor sil, byte [rbx + r9]
mov r9d, esi
jmp 0x14000da57
cmp esi, 4
jne 0x14000da57
mov r9b, byte [r10 + r9]
mov r8b, byte [r10 + r8]
mov dl, byte [r10 + rdx]
mov al, byte [r10 + rax]
xor r9b, byte [rcx]
xor r8b, byte [rcx + 1]
inc r11d
add rcx, 4
xor dl, byte [rcx - 2]
xor al, byte [rcx - 1]
mov byte [rcx + 0x1c], r9b
mov byte [rcx + 0x1d], r8b
mov byte [rcx + 0x1e], dl
mov byte [rcx + 0x1f], al
cmp r11d, 0x3c
jne 0x14000da08
pop rbx
pop rsi
ret

Function at 0x140012630
Capabilities:
Enumerate pe sections

Disassembly:
push r14
xor r14d, r14d
push r13
push r12
push rbp
push rdi
push rsi
push rbx
mov rbx, rcx
mov rdx, rbx
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov ecx, dword [rcx + rax + 0x88]
call 0x140012630
mov rdx, rbx
mov esi, eax
add rsi, rbx
mov ecx, dword [rsi + 0x20]
call 0x140012630
mov ecx, dword [rsi + 0x24]
mov rdx, rbx
mov r12d, eax
call 0x140012630
mov r13d, dword [rsi + 0x18]
add r12, rbx
mov edi, eax
cmp r13, r14
je 0x14000baff
mov ecx, dword [r12 + r14*4]
mov rdx, rbx
call 0x140012630
mov ebp, eax
add rbp, rbx
mov rcx, rbp
call fcn.14000bfd0
cmp eax, 0xa6caa1c5
jne 0x14000bae4
mov ecx, dword [rsi + 0x1c]
mov rdx, rbx
add rdi, rbx
call 0x140012630
movzx edx, word [rdi + r14*2]
mov eax, eax
add rax, rbx
mov ecx, dword [rax + rdx*4]
add rsp, 0x20
mov rdx, rbx
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp 0x140012630
mov rcx, rbp
call fcn.14000bfd0
mov edx, eax
lea rax, [r14 + 1]
cmp edx, 0xffe885ef
je 0x14000bab3
mov r14, rax
jmp 0x14000ba8e
add rsp, 0x20
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov eax, ecx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
cmp eax, dword [rdx + 0x14]
jb 0x14001267a
mov r9w, word [rcx + 6]
xor ecx, ecx
cmp r9w, cx
je 0x140012678
mov r8d, dword [rdx + 0xc]
cmp eax, r8d
jb 0x140012670
mov r10d, dword [rdx + 0x10]
add r10d, r8d
cmp eax, r10d
jae 0x140012670
add eax, dword [rdx + 0x14]
sub eax, r8d
ret
inc ecx
add rdx, 0x28
jmp 0x14001264e
xor eax, eax
ret
Function at 0x14000d000
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x770
mov rax, qword [0x14001b010]
xor rax, rsp
mov qword [rsp + 0x760], rax
xor eax, eax
mov esi, ecx
lea rcx, str.kernel32.dll
xor dil, dil
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.GetNativeSystemInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x30]
test rax, rax
je 0x14000d074
call rax
jmp 0x14000d07a
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [rsp + 0x30], 9
mov eax, 1
movzx ebx, dil
cmove ebx, eax
lea rdx, [rsp + 0x210]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rsp + 0x540]
lea r9, [rsp + 0x650]
mov qword [rsp + 0x20], rdx
lea r8, [rsp + 0x320]
lea rcx, [rsp + 0x210]
lea rdx, [rsp + 0x430]
call fcn.14000dd18
xor edx, edx
nop word [rax + rax]
movzx eax, byte [rsp + rdx + 0x430]
inc rdx
mov byte [rsp + rdx + 0xff], al
test al, al
jne 0x14000d0e0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x100]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x320]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000d110
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x94
call fcn.140011020
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x100]
lea r9, [rsp + 0x100]
repne scasb al, byte [rdi]
cmp dword [rsp + 0x64], 6
mov ecx, esi
jb 0x14000d191
mov eax, dword [str.NT60]
mov dword [rdi - 1], eax
movzx eax, byte [0x140018f4c]
mov byte [rdi + 3], al
test bl, bl
je 0x14000d188
mov r8b, 1
lea rdx, str.FaxPrinterInstall_amd64_vista
jmp 0x14000d1be
lea rdx, str.FaxPrinterInstall_x86_vista
jmp 0x14000d1bb
mov eax, dword [str.NT50]
mov dword [rdi - 1], eax
movzx eax, byte [0x140018f90]
mov byte [rdi + 3], al
test bl, bl
je 0x14000d1b4
mov r8b, 1
lea rdx, str.FaxPrinterInstall_amd64
jmp 0x14000d1be
lea rdx, str.FaxPrinterInstall_x86
xor r8d, r8d
call fcn.14000d720
xor eax, eax
mov rcx, qword [rsp + 0x760]
xor rcx, rsp
call fcn.14000da50
lea r11, [rsp + 0x770]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
sub rsp, 0x28
mov rcx, r8
call fcn.14000df68
mov ecx, eax
add rsp, 0x28
jmp 0x14000d000
Function at 0x14000da20
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x770
mov rax, qword [0x14001b010]
xor rax, rsp
mov qword [rsp + 0x760], rax
xor eax, eax
mov esi, ecx
lea rcx, str.kernel32.dll
xor dil, dil
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.GetNativeSystemInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x30]
test rax, rax
je 0x14000d074
call rax
jmp 0x14000d07a
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [rsp + 0x30], 9
mov eax, 1
movzx ebx, dil
cmove ebx, eax
lea rdx, [rsp + 0x210]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rsp + 0x540]
lea r9, [rsp + 0x650]
mov qword [rsp + 0x20], rdx
lea r8, [rsp + 0x320]
lea rcx, [rsp + 0x210]
lea rdx, [rsp + 0x430]
call fcn.14000dd18
xor edx, edx
nop word [rax + rax]
movzx eax, byte [rsp + rdx + 0x430]
inc rdx
mov byte [rsp + rdx + 0xff], al
test al, al
jne 0x14000d0e0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x100]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x320]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000d110
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x94
call fcn.140011020
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x100]
lea r9, [rsp + 0x100]
repne scasb al, byte [rdi]
cmp dword [rsp + 0x64], 6
mov ecx, esi
jb 0x14000d191
mov eax, dword [str.NT60]
mov dword [rdi - 1], eax
movzx eax, byte [0x140018f4c]
mov byte [rdi + 3], al
test bl, bl
je 0x14000d188
mov r8b, 1
lea rdx, str.FaxPrinterInstall_amd64_vista
jmp 0x14000d1be
lea rdx, str.FaxPrinterInstall_x86_vista
jmp 0x14000d1bb
mov eax, dword [str.NT50]
mov dword [rdi - 1], eax
movzx eax, byte [0x140018f90]
mov byte [rdi + 3], al
test bl, bl
je 0x14000d1b4
mov r8b, 1
lea rdx, str.FaxPrinterInstall_amd64
jmp 0x14000d1be
lea rdx, str.FaxPrinterInstall_x86
xor r8d, r8d
call fcn.14000d720
xor eax, eax
mov rcx, qword [rsp + 0x760]
xor rcx, rsp
call fcn.14000da50
lea r11, [rsp + 0x770]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
sub rsp, 0x28
mov rcx, r8
call fcn.14000df68
mov ecx, eax
add rsp, 0x28
jmp 0x14000d000
Function at 0x14000e20b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14001b010]
jne 0x14000da6a
rol rcx, 0x10
test cx, 0xffff
jne 0x14000da66
repz ret
ror rcx, 0x10
jmp 0x14000e164
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14001c4e0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x14001c5d8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14000e1e9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14001c4e0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14000e20b
mov rax, qword [rsp + 0x88]
mov qword [0x14001c5d8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14001c578], rax
mov rax, qword [0x14001c5d8]
mov qword [0x14001c450], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14001c560], rax
mov dword [0x14001c440], 0xc0000409
mov dword [0x14001c444], 1
mov rax, qword [0x14001b010]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14001b018]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14001c4d8], eax
mov ecx, 1
call fcn.140010ffc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400173a0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14001c4d8], 0
jne 0x14000e292
mov ecx, 1
call fcn.140010ffc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14000fb94
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140013600
nop
cmp dword [0x14001ca18], 1
je 0x14000fb40
mov dword [0x14001ca14], 1
mov byte [0x14001ca10], r12b
test ebx, ebx
jne 0x14000fb2c
mov rcx, qword [0x14001e5d8]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000fb19
mov rcx, qword [0x14001e5d0]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x14000fab8
call fcn.140010ba8
cmp qword [rdi], rax
jne 0x14000fab8
jmp 0x14000fa9e
cmp rdi, rsi
jb 0x14000fb19
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.140010ba8
mov qword [rdi], rax
call rbx
mov rcx, qword [0x14001e5d8]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x14001e5d0]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x14000faf7
cmp r13, rax
je 0x14000fb17
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x14000fa9e
lea rdx, [0x140017350]
lea rcx, [0x140017338]
call fcn.14000f8e8
lea rdx, [0x140017360]
lea rcx, [0x140017358]
call fcn.14000f8e8
nop
test r12d, r12d
je 0x14000fb4f
mov ecx, 8
call fcn.140013500
test r12d, r12d
jne 0x14000fb7a
mov dword [0x14001ca18], 1
lea ecx, [r12 + 8]
call fcn.140013500
mov ecx, r15d
call fcn.14000f87c
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x14000fa08

Function at 0x14000fba0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x14000fa08
Function at 0x140013d80
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.140010ba8
xor ebx, ebx
mov rdi, rax
cmp qword [0x14001d1a8], rbx
jne 0x140013e86
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140013f5b
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140013f5b
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14001d1a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14001d1b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x14001d1b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x14001d1c8], rax
test rax, rax
je 0x140013e7d
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x14001d1c0], rax
jmp 0x140013e8d
mov rax, qword [0x14001d1c0]
jmp 0x140013e94
mov rax, qword [0x14001d1c0]
mov r11, qword [0x14001d1c8]
cmp rax, rdi
je 0x140013efc
cmp r11, rdi
je 0x140013efc
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x14001d1c8]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x140013efc
test rax, rax
je 0x140013efc
call rsi
test rax, rax
je 0x140013ef6
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140013ef6
test byte [rsp + 0x38], 1
jne 0x140013efc
bts ebp, 0x15
jmp 0x140013f3a
mov rcx, qword [0x14001d1b0]
cmp rcx, rdi
je 0x140013f3a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140013f3a
call rax
mov rbx, rax
test rax, rax
je 0x140013f3a
mov rcx, qword [0x14001d1b8]
cmp rcx, rdi
je 0x140013f3a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140013f3a
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14001d1a8]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140013f5b
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140013f5d
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14000720c
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.14000719c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021170]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400205b8]
jmp 0x140007248
cmp qword [rbx + 0x18], rdi
je 0x14000724f
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000723f
jmp 0x140007269
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x1400205b8]
call fcn.140011c68
lea rcx, [0x140021170]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140007284
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov r9, rdx
mov r8, rcx
mov qword [r11 - 0x10], rax
xor edi, edi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x14000734a
lea rcx, [0x140021170]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400205b8]
jmp 0x14000730e
lea rsi, [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14000730b
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx]
lea rcx, [0x1400205b8]
mov rdx, rsi
call fcn.140011c68
jmp 0x14000730e
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400072db
mov rdx, qword [0x14001f120]
lea rcx, [0x1400205b8]
mov rdi, rdx
inc rdx
mov qword [0x14001f120], rdx
lea edx, [rbx + 0x20]
call fcn.140011cb0
lea rcx, [0x140021170]
mov qword [rax], rbp
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop rdi
ret
Function at 0x1400074e0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r12
push r13
push r15
sub rsp, 0x28
xor r15d, r15d
mov r13d, r9d
mov r12d, edx
mov ebp, r15d
cmp edx, 1
jl 0x140007644
mov qword [rsp + 0x50], rbx
test rcx, rcx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x20], r14
lea r14, [0x14001963c]
mov rbx, r14
mov edi, r15d
cmovne rbx, rcx
test r8, r8
cmovne r14, r8
mov rsi, rbx
movzx ecx, word [r14]
test cx, cx
je 0x140007610
cmp word [r14 + 2], di
je 0x140007610
or rax, 0xffffffffffffffff
nop
inc rax
cmp word [r14 + rax*2], di
jne 0x140007550
movsxd r15, eax
nop dword [rax]
mov r8, r15
mov rdx, r14
mov rcx, rbx
call sub.msvcrt.dll_wcsncmp
test eax, eax
je 0x14000757d
cmp word [rbx], bp
je 0x14000757d
add rbx, 2
jmp 0x140007560
inc edi
cmp edi, r12d
je 0x140007592
cmp word [rbx], bp
je 0x14000759b
lea rbx, [rbx + r15*2]
mov rsi, rbx
jmp 0x140007560
mov rbp, rbx
sub rbp, rsi
sar rbp, 1
xor r15d, r15d
mov rcx, rbx
call fcn.140012630
mov r14, qword [rsp + 0x20]
mov edi, eax
test eax, eax
je 0x1400075ca
mov ecx, r13d
call fcn.1400126a0
movsxd r8, ebp
mov rdx, rsi
mov rcx, rax
add r8, r8
call sub.msvcrt.dll_memmove
mov edx, r13d
mov ecx, ebp
call fcn.1400126d0
test edi, edi
mov rdi, qword [rsp + 0x60]
mov rbx, rax
jne 0x1400075ee
movsxd r8, ebp
mov rdx, rsi
mov rcx, rax
call sub.msvcrt.dll_wcsncpy
mov rsi, qword [rsp + 0x58]
movsxd rcx, ebp
mov word [rbx + rcx*2], r15w
mov rbx, qword [rsp + 0x50]
add rsp, 0x28
pop r15
pop r13
pop r12
pop rbp
ret
movzx eax, word [rbx]
cmp ax, cx
je 0x14000761d
test ax, ax
jne 0x140007630
inc edi
cmp edi, edx
je 0x140007636
test ax, ax
je 0x14000759e
lea rsi, [rbx + 2]
add rbx, 2
jmp 0x140007610
mov rbp, rbx
sub rbp, rsi
sar rbp, 1
jmp 0x14000759e
mov ecx, r9d
add rsp, 0x28
pop r15
pop r13
pop r12
pop rbp
jmp fcn.140012810

Function at 0x140008110
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov esi, 0x40
mov ecx, esi
call fcn.1400126d0
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call fcn.14001671c
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rdi + rdx*2], 0
jne 0x140008140
sub esi, edx
mov ecx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140012900
Function at 0x14000d9c4
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov edx, ecx
mov ebx, 0x104
mov ecx, ebx
call fcn.1400126d0
mov ecx, ebx
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, str.Kernel32.DLL
mov esi, eax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor r14d, r14d
mov rbp, rax
test rax, rax
je 0x14000da3e
lea rdx, str.GetLongPathNameW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000da35
mov r8d, ebx
mov rdx, rdi
mov rcx, rdi
call rax
mov esi, eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
sub ebx, esi
mov ecx, ebx
call fcn.140012900
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
movsxd rax, esi
mov rsi, qword [rsp + 0x40]
mov word [rdi + rax*2], r14w
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14000da74
Capabilities:
Delete file
Set file attributes

Disassembly:
xor edx, edx
jmp 0x14000da74
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14000da9f
test dl, 2
je 0x14000da92
mov edx, pe_nt_image_headers64
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cdqe
jmp 0x14000daa1
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14000daa8
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edx, ecx
mov esi, 0x104
mov ecx, esi
call fcn.1400126d0
mov ecx, esi
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor ebp, ebp
movsxd rbx, eax
test eax, eax
je 0x14000daf1
lea ecx, [rbp + 0x5c]
cmp word [rdi + rbx*2 - 2], cx
je 0x14000daf1
mov word [rdi + rbx*2], cx
inc ebx
sub esi, ebx
mov ecx, esi
call fcn.140012900
mov rsi, qword [rsp + 0x40]
movsxd rax, ebx
mov rbx, qword [rsp + 0x30]
mov word [rdi + rax*2], bp
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000dc88
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x14000dc9b
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cdqe
jmp 0x14000dc9d
xor eax, eax
add rsp, 0x28
ret