joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140049b74
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x14004989a
call fcn.14003f030
mov dword [rax], 0x16
call fcn.1400387f0
jmp 0x1400499e5
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1400499e5
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x1400499e5
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x1400498c9
lock or dword [rcx + 0x14], 0x10
jmp 0x1400499e5
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1400498dd
call fcn.14004a25c
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x1400498ed
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x1400498f0
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.140048124
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.14004a830
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x1400499d3
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x140049981
mov rcx, rbx
call fcn.140048124
cmp eax, 0xffffffff
je 0x14004996c
mov rcx, rbx
call fcn.140048124
cmp eax, 0xfffffffe
je 0x14004996c
mov rcx, rbx
call fcn.140048124
movsxd rdi, eax
lea r14, [0x140088930]
mov rcx, rbx
sar rdi, 6
call fcn.140048124
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x140049973
lea rdx, [0x140083440]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140049981
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x1400499a5
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x1400499a5
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x1400499a5
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x1400499c3
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x1400499ce
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x1400499ea
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x140049864

Function at 0x140058660
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140058688
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140058688
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14002ca2c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rcx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
xor ebx, ebx
mov qword [rbp - 0x10], rbx
mov edx, 0x104
lea rcx, [rbp - 0x20]
call fcn.140038ed0
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
sub rdx, rcx
sar rdx, 1
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
mov r8d, eax
test eax, eax
je 0x14002cae5
mov rcx, qword [rbp - 0x18]
mov rax, rcx
mov rdx, qword [rbp - 0x20]
sub rax, rdx
sar rax, 1
cmp r8, rax
jbe 0x14002cac5
mov edx, r8d
lea rcx, [rbp - 0x20]
call fcn.140038ed0
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
sub rdx, rcx
sar rdx, 1
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
mov r8d, eax
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x20]
test r8d, r8d
je 0x14002cae5
sub rcx, rdx
sar rcx, 1
mov eax, r8d
cmp rax, rcx
ja 0x14002cae5
mov rcx, rdi
call fcn.140004374
nop
mov bl, 1
jmp 0x14002cae5
lea rcx, [rbp - 0x20]
call fcn.140020b54
mov al, bl
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x140011109
Capabilities:
Decode data using base64 via winapi

Disassembly:
jmp 0x1400160a0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
mov rax, qword [0x140026040]
xor rax, rbp
mov qword [rbp + 0x168], rax
mov dword [rbp + 0x144], 0
lea rcx, [0x14002c0f8]
call fcn.1400116cc
nop
mov dword [rbp + 4], 0
mov rcx, qword [rbp + 0x198]
call fcn.140011523
mov qword [rbp + 0x158], rax
mov rcx, qword [rbp + 0x198]
call fcn.1400110b4
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rcx, [rbp + 4]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, 1
mov rcx, qword [rbp + 0x158]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
nop
mov edx, 0x20
mov rcx, qword [rbp + 0x190]
call fcn.14001107d
lea rcx, [rbp + 0x124]
call fcn.140011348
mov ecx, dword [rbp + 4]
mov r8, rax
mov edx, ecx
mov rcx, qword [rbp + 0x190]
call fcn.14001141a
mov qword [rbp + 0x158], rax
mov eax, dword [rbp + 0x144]
or eax, 1
mov dword [rbp + 0x144], eax
mov rcx, qword [rbp + 0x190]
call fcn.140011749
mov qword [rbp + 0x158], rax
mov rcx, qword [rbp + 0x198]
call fcn.140011523
mov qword [rbp + 0x160], rax
mov rcx, qword [rbp + 0x198]
call fcn.1400110b4
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rcx, [rbp + 4]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0x158]
mov r9, rcx
mov r8d, 1
mov rcx, qword [rbp + 0x160]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
nop
mov rax, qword [rbp + 0x190]
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x140020e50]
call fcn.1400115d7
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.140011370
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x1400113f2
Capabilities:
Terminate process

Disassembly:
jmp 0x140018b00
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x140011410
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140016740
push rbp
push rdi
sub rsp, 0x468
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xb2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140026040]
xor rax, rbp
mov qword [rbp + 0x438], rax
lea rcx, [0x14002c0f8]
call fcn.1400116cc
nop
mov dword [rbp + 0x284], 0
xor edx, edx
mov ecx, 2
call fcn.140011357
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x1400167ba
lea rdx, str.Failed_to_take_process_snapshot._n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400110d2
nop
xor eax, eax
jmp 0x140016852
mov dword [rbp + 0x30], 0x238
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.140011456
test eax, eax
jne 0x1400167f5
lea rdx, str.Failed_to_retrieve_process_information._n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400110d2
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor eax, eax
jmp 0x140016852
mov r8d, dword [rbp + 0x38]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x2a8], rax
cmp qword [rbp + 0x2a8], 0
je 0x140016830
mov eax, dword [rbp + 0x38]
mov dword [rbp + 0x284], eax
mov rcx, qword [rbp + 0x2a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x140016841
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.14001161d
test eax, eax
jne 0x1400167f5
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 0x284]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140021040]
call fcn.1400115d7
mov rax, rdi
mov rcx, qword [rbp + 0x438]
xor rcx, rbp
call fcn.140011370
lea rsp, [rbp + 0x448]
pop rdi
pop rbp
ret
Function at 0x1400114f1
Capabilities:
Parse pe header

Disassembly:
jmp 0x140019e50
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140019e70
xor al, al
jmp 0x140019ef1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140019e83
xor al, al
jmp 0x140019ef1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140019ead
xor al, al
jmp 0x140019ef1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140019ec1
xor al, al
jmp 0x140019ef1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140019ed3
xor al, al
jmp 0x140019ef1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140019eef
xor al, al
jmp 0x140019ef1
mov al, 1
add rsp, 0x38
ret
Function at 0x140017c50
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400116fe
movzx eax, al
test eax, eax
jne 0x140017c70
mov ecx, 7
call fcn.1400115e1
nop
mov byte [rsp + 0x20], 0
call fcn.140011618
mov byte [rsp + 0x21], al
cmp dword [0x140026b78], 1
jne 0x140017c94
mov ecx, 7
call fcn.1400115e1
nop
jmp 0x140017cec
cmp dword [0x140026b78], 0
jne 0x140017ce7
mov dword [0x140026b78], 1
lea rdx, [0x140020660]
lea rcx, [0x140020330]
call fcn.140011352
test eax, eax
je 0x140017cc8
mov eax, 0xff
jmp 0x140017df1
lea rdx, [0x140020220]
lea rcx, [section..rdata]
call fcn.140011604
mov dword [0x140026b78], 2
jmp 0x140017cec
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.1400115cd
call fcn.140011519
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140017d49
mov rcx, qword [rsp + 0x30]
call fcn.1400112a8
movzx eax, al
test eax, eax
je 0x140017d49
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x14002d020]
nop
call fcn.140011573
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140017d7d
mov rcx, qword [rsp + 0x38]
call fcn.1400112a8
movzx eax, al
test eax, eax
je 0x140017d7d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14001169f
nop
call fcn.140017ea0
mov dword [rsp + 0x28], eax
call fcn.1400114f1
movzx eax, al
test eax, eax
jne 0x140017d9c
mov ecx, dword [rsp + 0x28]
call fcn.140011091
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140017dab
call fcn.1400116b3
nop
xor edx, edx
mov cl, 1
call fcn.14001126c
mov eax, dword [rsp + 0x28]
jmp 0x140017df1
add rsp, 0x68
ret
Function at 0x140010070
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x290
mov rax, qword [0x1403660c0]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, rcx
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400100cb
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x1400100d2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400101ba
mov qword [rsp + 0x2a0], rdi
xor edi, edi
nop dword [rax]
xorps xmm0, xmm0
mov qword [rsp + 0x30], rdi
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x6c]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], di
jne case.0x1400d8b4e.34
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call fcn.14001d160
cmp qword [rbx + 0x18], 7
mov rax, rbx
jbe 0x140010126
mov rax, qword [rbx]
mov r10, qword [rsp + 0x38]
lea r8, [rsp + 0x20]
mov r9, qword [rsp + 0x20]
cmp r10, 7
mov rdx, qword [rsp + 0x30]
cmova r8, r9
cmp rdx, qword [rbx + 0x10]
jne 0x1400101db
test rdx, rdx
je 0x140010168
sub r8, rax
movzx ecx, word [r8 + rax]
cmp cx, word [rax]
jne 0x1400101db
add rax, 2
sub rdx, 1
jne 0x140010154
mov edi, dword [rsp + 0x48]
cmp r10, 7
jbe 0x1400101a7
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x14001019f
mov r9, qword [r9 - 8]
add rdx, 0x27
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001022d
mov rcx, r9
call fcn.1401237e0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rdi, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1401237c0
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x290
pop rsi
ret
cmp r10, 7
jbe 0x140010212
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x14001020a
mov r9, qword [r9 - 8]
add rdx, 0x27
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001022d
mov rcx, r9
call fcn.1401237e0
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400100e0
jmp 0x1400101a7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140010630
Capabilities:
Create process on windows
Self delete
Terminate process

Disassembly:
sub rsp, 0x618
mov rax, qword [0x1403660c0]
xor rax, rsp
mov qword [rsp + 0x600], rax
mov r8d, 0x104
lea rdx, [rsp + 0xe0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x140010741
lea r9, str.C:Program_FilesGoogleChromeApplicationchrome.dll
lea r8, [rsp + 0xe0]
lea rdx, str.cmd.exe__c_start__b_cmd.exe__c__ping_localhost__n_3__nul__del__f__q___s___del__f__q___s__
lea rcx, [rsp + 0x1f0]
call fcn.14000b300
xorps xmm0, xmm0
mov dword [rsp + 0x70], WSAGetLastError
xor ecx, ecx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x1f0]
movups xmmword [rsp + 0xa8], xmm0
lea rax, [rsp + 0x70]
mov dword [rsp + 0xac], 1
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rcx
xor r8d, r8d
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
movups xmmword [rsp + 0x78], xmm0
mov word [rsp + 0xb0], cx
movups xmmword [rsp + 0x88], xmm0
movups xmmword [rsp + 0x98], xmm0
movups xmmword [rsp + 0xb8], xmm0
movups xmmword [rsp + 0xc8], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140010741
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [rsp + 0x600]
xor rcx, rsp
call fcn.1401237c0
add rsp, 0x618
ret

Function at 0x140010f70
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1403660c0]
xor rax, rsp
mov qword [rsp + 0x40], rax
cmp qword [0x140cc4d70], 0xf
lea rax, [rsp + 0x30]
lea rdx, [0x140cc4d58]
mov dword [rsp + 0x38], 0
cmova rdx, qword [0x140cc4d58]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14001100e
cmp qword [0x140cc4df8], 0xf
lea rax, [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
lea rdx, [0x140cc4de0]
cmova rdx, qword [0x140cc4de0]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401237c0
add rsp, 0x58
ret
Function at 0x140011020
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x188
mov rax, qword [0x1403660c0]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 8
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x60]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140011070
mov qword [rsp + 0x38], rax
call fcn.140122bc4
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.14000cfc0
nop
lea rcx, [rsp + 0x40]
call fcn.140010d60
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x1400110f0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400110eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400110eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401237e0
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1401237c0
add rsp, 0x188
ret

Function at 0x140011110
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x78
mov rax, qword [0x1403660c0]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor eax, eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], 4
lea rdx, [0x140cc4d58]
cmp qword [0x140cc4d70], 0xf
cmova rdx, qword [0x140cc4d58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140011266
lea rdx, [0x140cc4de0]
cmp qword [0x140cc4df8], 0xf
cmova rdx, qword [0x140cc4de0]
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x60], 0
setne al
test al, al
je 0x140011266
lea rax, [0x140cc4d18]
cmp qword [0x140cc4d30], 0xf
cmova rax, qword [0x140cc4d18]
mov qword [rsp + 0x50], rax
mov rax, qword [0x140cc4d28]
mov qword [rsp + 0x58], rax
call fcn.140122bc4
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r8, [rsp + 0x50]
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.14000cfc0
nop
lea rcx, [rsp + 0x30]
call fcn.140010d60
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140011261
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001125c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001125c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401237e0
call fcn.140010f70
call fcn.140011020
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1401237c0
add rsp, 0x78
ret
Function at 0x140011ae0
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
sub rsp, 0xf8
mov rax, qword [0x1403660c0]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov dword [rsp + 0x70], WSAGetLastError
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xor edx, edx
cmp qword [rcx + 0x18], 0xf
movups xmmword [r11 - 0x50], xmm0
mov dword [r11 - 0x4c], 1
mov word [r11 - 0x48], dx
movups xmmword [r11 - 0x70], xmm0
movups xmmword [r11 - 0x60], xmm0
movups xmmword [r11 - 0x40], xmm0
movups xmmword [r11 - 0x30], xmm0
jbe 0x140011b3e
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], edx
mov rdx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1401237c0
add rsp, 0xf8
ret
Function at 0x140019d70
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140019d91
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140019dbe
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140019dc0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140019e19
test ecx, ecx
jle 0x140019df9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140019e19
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140019e19
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
adc dword [rdi - 0x70e4a368], r8d
leave
sar byte [rdi - 0x765ee245], 0xb6
invalid
push rbx
wait
movsb byte [rdi], byte [rsi]
movabs eax, dword [0x6c69ba9fd6031e1c]
imul ebp, dword [rbp + rbx*2 + 0x68], 0x473815cf
and dword [rbx - 0xe], 0x4d
or rax, 0x18e2076b
idiv bl
out dx, al
and ecx, dword [rdx - 0x40]
add esi, dword [rsi + 0x79b689da]
mov eax, 0xa40d916c
mov byte [0x1a31c3292], ah
not byte [rsi - 0x68]
div byte [r11 + rbx*4 - 0x5f]
jb 0x14048ed96
test dword [rdi], ecx
jrcxz 0x14048edca
rol dword [rcx], 0xe7
fdivr dword [rax + 0x60]
cmpsd dword [rsi], dword [rdi]
cld
adc byte [rax - 0x58bd842c], al
fcom dword [rbx]
xor dh, byte [rbp + 0x3102b43c]
sbb edx, edx
cmp eax, 0x61ce5c6a
mov cl, 0xe5
mov dh, 0x9c
sbb edx, ebx
invalid
Function at 0x140019e40
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140019e62
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140019e71
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140019e94
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140019e96
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140019ed2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140019f6e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140019f0d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140019f4e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140019f6e
cmp rbx, rax
ja 0x140019f20
test rbx, rbx
je 0x140019f6e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
or al, 0x47
xor al, 0xf0
push rsi
pop rdi