joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140084be0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x140162010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov edi, r9d
mov r12, r8
mov r13, rdx
mov rsi, rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
lea rax, [0x140162ce0]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [r8], xmm0
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
cmp qword [rdx + 0x18], 8
jb 0x140084c48
mov rdx, qword [rdx]
xor r9d, r9d
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
lea rdx, [0x140166f50]
test eax, eax
je 0x140084c7f
lea ecx, [rax - 2]
cmp ecx, 1
jbe 0x140084c7b
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x38], rdx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
xor al, al
jmp 0x140084c81
mov al, 1
cmp dword [rsp + 0x30], ebx
je 0x140084dbb
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r12
mov r9d, 0x3001f
mov r8, r13
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.140084aa0
nop
mov rbx, qword [rsp + 0x30]
cmp dword [r12], 0
je 0x140084cc4
xor sil, sil
jmp 0x140084da9
test rbx, rbx
jne 0x140084cd1
mov sil, 1
jmp 0x140084da9
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rax
mov r8, r12
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140084780
mov rbp, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
cmp dword [r12], 0
jne 0x140084d52
mov r14, r15
cmp r15, rbp
je 0x140084de0
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x140084d1a
mov rdx, qword [r14]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
test eax, eax
je 0x140084d2f
lea ecx, [rax - 2]
cmp ecx, 1
ja 0x140084d38
add r14, 0x20
cmp r14, rbp
jmp 0x140084d07
mov dword [rsp + 0x30], eax
lea rax, [0x140166f50]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [r12], xmm0
xor sil, sil
test r15, r15
je 0x140084da9
mov rdi, r15
cmp r15, rbp
je 0x140084d73
mov rcx, rdi
call fcn.14000b7d0
add rdi, 0x20
cmp rdi, rbp
jne 0x140084d62
mov rdx, qword [rsp + 0x50]
sub rdx, r15
and rdx, 0xffffffffffffffe0
mov rax, r15
cmp rdx, 0x1000
jb 0x140084da0
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140084df9
mov rcx, r15
call fcn.1400ada10
nop
test rbx, rbx
je 0x140084db7
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, sil
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400ad9f0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rsi
call fcn.140084b60
mov sil, 1
jmp 0x140084d55
call fcn.1400e39e0
int3
Function at 0x140085110
Capabilities:
Query environment variable

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140162010]
xor rax, rsp
mov qword [rbp - 8], rax
mov r15, r8
mov r14, rdx
mov rsi, rcx
mov qword [rbp - 0x38], rcx
xor r12d, r12d
mov dword [rbp - 0x38], r12d
lea rax, [0x140162ce0]
mov qword [rbp - 0x30], rax
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [r8], xmm0
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r12w
movzx ebx, byte [rbp - 0x40]
mov rcx, qword [rbp - 0x18]
inc rcx
call fcn.140079730
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov r8d, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edx, eax
test eax, eax
je 0x14008525a
lea edi, [rdx - 1]
mov r8, qword [rbp - 0x18]
lea rcx, [r8 + 1]
cmp rdx, rcx
jbe 0x140085237
cmp rdi, r8
ja 0x1400851d2
lea rax, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rax, qword [rbp - 0x28]
mov qword [rbp - 0x18], rdi
mov word [rax + rdi*2], r12w
jmp 0x140085170
mov rdx, rdi
sub rdx, r8
mov rcx, qword [rbp - 0x10]
mov rax, rcx
sub rax, r8
cmp rdx, rax
ja 0x140085219
mov qword [rbp - 0x18], rdi
lea r9, [rbp - 0x28]
cmp rcx, 8
cmovae r9, qword [rbp - 0x28]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x14008520b
movzx eax, r12w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], r12w
jmp 0x140085170
lfence
mov word [rsp + 0x20], r12w
mov r9, rdx
movzx r8d, bl
lea rcx, [rbp - 0x28]
call fcn.140012ea0
jmp 0x140085170
lfence
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp - 0x28]
call fcn.140012930
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rbp - 0x18]
movups xmmword [rsi + 0x10], xmm1
jmp 0x1400852c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x38], eax
lea rax, [0x140166f50]
mov qword [rbp - 0x30], rax
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [r15], xmm0
mov qword [rsi], r12
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], 7
mov word [rsi], r12w
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x1400852c5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400852c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400852e3
call fcn.1400ada10
mov rax, rsi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400ad9f0
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400e39e0
int3
Function at 0x1400852f0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, qword [rsp + 0x80]
lea rax, [0x140162ce0]
mov qword [rsp + 0x38], rax
mov r11d, r8d
mov dword [rsp + 0x30], 0
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
mov r10, qword [r9]
mov r8, qword [r9 + 8]
sub r8, r10
mov eax, r8d
cmp rax, r8
jne 0x140085371
cmp qword [rdx + 0x18], 8
jb 0x140085339
mov rdx, qword [rdx]
mov dword [rsp + 0x28], r8d
mov r9d, r11d
xor r8d, r8d
mov qword [rsp + 0x20], r10
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14008536b
mov dword [rsp + 0x30], eax
lea rax, [0x140166f50]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
add rsp, 0x50
pop rbx
ret
xorps xmm0, xmm0
lea rcx, [rsp + 0x30]
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
call fcn.140079930
lea rdx, [0x1401602a0]
lea rcx, [rsp + 0x30]
call fcn.1400d4390
int3

Function at 0x1400855c0
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140162010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, r9
mov rdi, rdx
mov rbx, rcx
movzx eax, byte [r8 + 0x20]
cmp al, 1
jne 0x1400855f6
mov r8d, dword [r8]
call fcn.140085be0
jmp 0x14008572a
cmp al, 2
jne 0x140085604
call fcn.140085ce0
jmp 0x14008572a
cmp al, 3
jne 0x140085686
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
mov rdx, r8
lea rcx, [rsp + 0x30]
call fcn.1400854a0
nop
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x30]
mov r8d, 7
mov rdx, rdi
mov rcx, rbx
call fcn.1400852f0
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14008572a
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008567c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008573f
call fcn.1400ada10
jmp 0x14008572a
cmp al, 4
jne 0x1400856a2
mov qword [rsp + 0x20], rsi
mov r9, r8
mov r8d, 3
call fcn.1400852f0
jmp 0x14008572a
cmp al, 5
jne 0x1400856b0
mov r8, qword [r8]
call fcn.140085c60
jmp 0x14008572a
cmp al, 6
jne 0x1400856bb
call fcn.140085dc0
jmp 0x14008572a
test al, al
jne 0x14008571d
xor ecx, ecx
mov dword [rsp + 0x30], ecx
lea rax, [0x140162ce0]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [r9], xmm0
cmp qword [rdx + 0x18], 8
jb 0x1400856e4
mov rdi, qword [rdx]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14008572a
mov dword [rsp + 0x30], eax
lea rax, [0x140166f50]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
jmp 0x14008572a
mov edx, 2
mov rcx, rsi
call fcn.1400868f0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400ad9f0
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
call fcn.1400e39e0
int3
Function at 0x140085be0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x50
lea rax, [0x140162ce0]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], rax
mov rbx, r9
movups xmm0, xmmword [rsp + 0x30]
mov dword [rsp + 0x40], r8d
movups xmmword [r9], xmm0
cmp qword [rdx + 0x18], 8
jb 0x140085c15
mov rdx, qword [rdx]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140085c52
mov dword [rsp + 0x30], eax
lea rax, [0x140166f50]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
add rsp, 0x50
pop rbx
ret

Function at 0x140085c60
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x50
lea rax, [0x140162ce0]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], rax
mov rbx, r9
movups xmm0, xmmword [rsp + 0x30]
mov qword [rsp + 0x40], r8
movups xmmword [r9], xmm0
cmp qword [rdx + 0x18], 8
jb 0x140085c95
mov rdx, qword [rdx]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 8
mov r9d, 0xb
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140085cd2
mov dword [rsp + 0x30], eax
lea rax, [0x140166f50]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
add rsp, 0x50
pop rbx
ret

Function at 0x140085ce0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x50
lea rax, [0x140162ce0]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], rax
mov rbx, r9
movups xmm0, xmmword [rsp + 0x30]
mov r10, rdx
mov rdx, r8
movups xmmword [r9], xmm0
mov r9, qword [r8 + 0x18]
cmp r9, 8
jb 0x140085d19
mov rdx, qword [r8]
mov rax, 0xffffffffffffffff
cmp word [rdx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140085d20
lea rdx, [rax*2 + 2]
mov eax, edx
cmp rax, rdx
jne 0x140085d8b
cmp r9, 8
jb 0x140085d44
mov r8, qword [r8]
cmp qword [r10 + 0x18], 8
jb 0x140085d4e
mov r10, qword [r10]
mov dword [rsp + 0x28], edx
mov r9d, 1
mov qword [rsp + 0x20], r8
mov rdx, r10
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140085d85
mov dword [rsp + 0x30], eax
lea rax, [0x140166f50]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
add rsp, 0x50
pop rbx
ret
xorps xmm0, xmm0
lea rcx, [rsp + 0x30]
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
call fcn.140079930
lea rdx, [0x1401602a0]
lea rcx, [rsp + 0x30]
call fcn.1400d4390
int3
Function at 0x140085dc0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x50
lea rax, [0x140162ce0]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], rax
mov rbx, r9
movups xmm0, xmmword [rsp + 0x30]
mov r10, rdx
mov rdx, r8
movups xmmword [r9], xmm0
mov r9, qword [r8 + 0x18]
cmp r9, 8
jb 0x140085df9
mov rdx, qword [r8]
mov rax, 0xffffffffffffffff
cmp word [rdx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140085e00
lea rdx, [rax*2 + 2]
mov eax, edx
cmp rax, rdx
jne 0x140085e6b
cmp r9, 8
jb 0x140085e24
mov r8, qword [r8]
cmp qword [r10 + 0x18], 8
jb 0x140085e2e
mov r10, qword [r10]
mov dword [rsp + 0x28], edx
mov r9d, 2
mov qword [rsp + 0x20], r8
mov rdx, r10
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140085e65
mov dword [rsp + 0x30], eax
lea rax, [0x140166f50]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
add rsp, 0x50
pop rbx
ret
xorps xmm0, xmm0
lea rcx, [rsp + 0x30]
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
call fcn.140079930
lea rdx, [0x1401602a0]
lea rcx, [rsp + 0x30]
call fcn.1400d4390
int3
Function at 0x140086160
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140162010]
xor rax, rsp
mov qword [rbp - 8], rax
mov r13, r9
mov r12, rdx
mov rbx, rcx
xor r14d, r14d
mov dword [rbp - 0x3c], r14d
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
mov qword [rbp - 0x10], r14
mov dword [rbp - 0x3c], 1
mov r15, qword [r8 + 8]
mov rsi, qword [r8]
mov rax, qword [rbp - 0x18]
cmp rsi, r15
je 0x140086237
nop dword [rax + rax]
mov rdi, rsi
cmp qword [rsi + 0x18], 8
jb 0x1400861cd
mov rdi, qword [rsi]
mov rdx, rsi
jb 0x1400861d5
mov rdx, qword [rsi]
mov rcx, 0xffffffffffffffff
nop dword [rax]
lea rcx, [rcx + 1]
cmp word [rdx + rcx*2], 0
jne 0x1400861e0
lea r14, [rcx + 1]
lea r14, [rdi + r14*2]
cmp rdi, r14
je 0x14008622b
cmp rax, qword [rbp - 0x10]
je 0x140086210
movzx ecx, byte [rdi]
mov byte [rax], cl
mov rax, qword [rbp - 0x18]
inc rax
mov qword [rbp - 0x18], rax
jmp 0x140086223
mov r8, rdi
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.140086b50
mov rax, qword [rbp - 0x18]
inc rdi
cmp rdi, r14
jne 0x1400861f8
add rsi, 0x20
cmp rsi, r15
jne 0x1400861c0
xor r14d, r14d
mov edi, 2
nop dword [rax]
mov byte [rbp - 0x40], 0
cmp rax, qword [rbp - 0x10]
je 0x14008625a
mov byte [rax], 0
mov rax, qword [rbp - 0x18]
inc rax
mov qword [rbp - 0x18], rax
jmp 0x14008626e
lea r8, [rbp - 0x40]
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.140086b50
mov rax, qword [rbp - 0x18]
sub rdi, 1
jne 0x140086240
mov dword [rbp - 0x38], r14d
lea rcx, [0x140162ce0]
mov qword [rbp - 0x30], rcx
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [r13], xmm0
mov r8, qword [rbp - 0x20]
sub rax, r8
mov ecx, eax
cmp rcx, rax
jne 0x140086343
cmp qword [r12 + 0x18], 8
jb 0x1400862aa
mov r12, qword [r12]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r8
mov r9d, 7
xor r8d, r8d
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400862e3
mov dword [rbp - 0x38], eax
lea rax, [0x140166f50]
mov qword [rbp - 0x30], rax
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [r13], xmm0
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140086319
mov rdx, qword [rbp - 0x10]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140086314
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008633d
call fcn.1400ada10
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400ad9f0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400e39e0
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], rax
lea rcx, [rbp - 0x38]
call fcn.140079930
lea rdx, [0x1401602a0]
lea rcx, [rbp - 0x38]
call fcn.1400d4390
int3
Function at 0x140087030
Capabilities:
Create pipe

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x140162010]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov r14d, r9d
mov esi, r8d
mov rbx, rdx
mov rdi, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x14008706b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], 0
mov rcx, qword [rbx]
test rcx, rcx
je 0x140087080
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], 0
mov r9d, r14d
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x14008710e
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x20]
call fcn.1400d41f0
call fcn.140089150
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 1
lea rcx, [rsp + 0x30]
call fcn.140018320
nop
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140032886.0]
cmp dword [rsp + 0x28], eax
setl byte [rbp + 0x28]
jl 0x1400870fd
lea rdx, str.StdoutRd_CreatePipe
lea rcx, [rsp + 0x20]
call fcn.140019260
mov byte [rbp + 0x28], 1
lea rcx, [rsp + 0x20]
call fcn.140014330
xor al, al
jmp 0x140087216
mov edx, 1
mov r8d, edx
test esi, esi
jne 0x140087199
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x140087214
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x20]
call fcn.1400d41f0
call fcn.140089150
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 1
lea rcx, [rsp + 0x30]
call fcn.140018320
nop
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140032886.0]
cmp dword [rsp + 0x28], eax
setl byte [rbp + 0x28]
jl 0x14008718b
lea rdx, str.Stdout_SetHandleInformation
lea rcx, [rsp + 0x20]
call fcn.14002d240
mov byte [rbp + 0x28], 1
lea rcx, [rsp + 0x20]
call fcn.140014330
xor al, al
jmp 0x140087216
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x140087214
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x20]
call fcn.1400d41f0
call fcn.140089150
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 1
lea rcx, [rsp + 0x30]
call fcn.140018320
nop
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140032886.0]
cmp dword [rsp + 0x28], eax
setl byte [rbp + 0x28]
jl 0x140087206
lea rdx, str.Stdout_SetHandleInformation
lea rcx, [rsp + 0x20]
call fcn.14002d240
mov byte [rbp + 0x28], 1
lea rcx, [rsp + 0x20]
call fcn.140014330
xor al, al
jmp 0x140087216
mov al, 1
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.1400ad9f0
add rsp, 0x140
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140087230
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x140162010]
xor rax, rsp
mov qword [rbp + 0x40], rax
mov rdi, rcx
mov rdx, qword [rcx]
mov rcx, qword [rcx + 8]
sub rcx, rdx
sar rcx, 3
mov r9d, 0x3e8
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
je 0x1400873dc
sub eax, 1
je 0x14008730e
cmp eax, 0x101
je 0x1400873ff
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x30]
call fcn.1400d41f0
call fcn.140089150
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], 2
lea rcx, [rsp + 0x40]
call fcn.140018320
nop
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140032886.0]
cmp dword [rsp + 0x38], eax
setl byte [rbp + 0x38]
jl 0x140087304
lea rcx, [rsp + 0x30]
call fcn.140088a10
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14002cee0
mov byte [rbp + 0x38], 1
lea rcx, [rsp + 0x30]
call fcn.140014330
mov rcx, qword [rdi]
mov edx, 1
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x1400873dc
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x30]
call fcn.1400d41f0
mov rax, qword gs:[0x58]
mov rbx, qword [rax]
mov ecx, 0x13c8
mov eax, dword [rcx + rbx]
mov edi, 0x13c0
test al, 1
jne 0x14008736b
or eax, 1
mov dword [rcx + rbx], eax
xor eax, eax
mov qword [rbx + rdi], rax
call fcn.1400890d0
mov qword [rbx + rdi], rax
mov rax, qword [rbx + rdi]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], 2
lea rcx, [rsp + 0x40]
call fcn.140018320
nop
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140032886.0]
cmp dword [rsp + 0x38], eax
setl byte [rbp + 0x38]
jl 0x1400873d2
lea rdx, str.TerminateProcess:
lea rcx, [rsp + 0x30]
call fcn.140018e40
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14002cee0
mov byte [rbp + 0x38], 1
lea rcx, [rsp + 0x30]
call fcn.140014330
mov al, 1
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.1400ad9f0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
xor al, al
jmp 0x1400873de
Function at 0x14008a9f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x140162010]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rcx
cmp qword [rcx + 8], 0xffffffffffffffff
je 0x14008ab52
cmp byte [rdx + 4], 0
je 0x14008aa2e
mov eax, dword [rcx]
cmp dword [rdx], eax
jl 0x14008ab52
mov r9, r8
mov r8, rdx
lea rdx, str._H:_M:_S
lea rcx, [rbp + 0xf]
call fcn.14008a4b0
nop
mov dword [rbp + 7], 0
cmp byte [rbx + 0x10], 0
je 0x14008aaf1
lea rax, [rbp + 0xf]
cmp qword [rbp + 0x27], 0x10
cmovae rax, qword [rbp + 0xf]
mov qword [rbp - 9], rax
mov rax, qword [rbp + 0x1f]
mov qword [rbp - 1], rax
movaps xmm0, xmmword [rbp - 9]
movdqa xmmword [rbp - 9], xmm0
lea rdx, [rbp - 9]
lea rcx, [rbp + 0x2f]
call fcn.14008c160
lea rdx, [rbp + 0x2f]
cmp qword [rbp + 0x47], 8
cmovae rdx, qword [rbp + 0x2f]
mov qword [rsp + 0x20], 0
lea r9, [rbp + 7]
mov r8d, dword [rbp + 0x3f]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov rdx, qword [rbp + 0x47]
cmp rdx, 8
jb 0x14008ab1b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008aaea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008ab75
call fcn.1400ada10
jmp 0x14008ab1b
lea rdx, [rbp + 0xf]
cmp qword [rbp + 0x27], 0x10
cmovae rdx, qword [rbp + 0xf]
mov qword [rsp + 0x20], 0
lea r9, [rbp + 7]
mov r8d, dword [rbp + 0x1f]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x14008ab52
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008ab4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008ab6f
call fcn.1400ada10
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400ad9f0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rbp
ret
call fcn.1400e39e0
nop
call fcn.1400e39e0
nop
int3
Function at 0x14008b3a0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140162010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rdi, qword [r8]
mov r14, r9
mov rbp, qword [rsp + 0xe0]
mov rsi, rdx
mov r15, qword [rsp + 0xe8]
mov rbx, rcx
mov r12, qword [rsp + 0xf0]
test rdi, rdi
je 0x14008b4a6
cmp qword [rdi + 8], 0xffffffffffffffff
je 0x14008b4a6
cmp byte [rcx + 4], 0
je 0x14008b409
mov eax, dword [rdi]
cmp dword [rcx], eax
jl 0x14008b4a6
mov r9, rsi
lea rdx, [0x14013a3d0]
mov r8, rbx
lea rcx, [rsp + 0x38]
call fcn.14008a4b0
mov r8d, dword [rsp + 0x48]
lea rdx, [rsp + 0x38]
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x30]
xor eax, eax
mov qword [rsp + 0x68], 0xffffffffffffffff
cmp qword [rsp + 0x50], 0x10
mov dword [rsp + 0x30], eax
cmovae rdx, qword [rsp + 0x38]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x14008b4a6
mov rcx, qword [rsp + 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008b4a1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008b4ee
call fcn.1400ada10
mov rcx, qword [r14]
test rcx, rcx
je 0x14008b4b9
mov r8, rsi
mov rdx, rbx
call fcn.14008a770
mov r9, r15
mov qword [rsp + 0x20], r12
mov r8, rbp
mov rdx, rsi
mov rcx, rbx
call fcn.14008b570
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400ad9f0
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1400e39e0
int3