joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140162260
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x550
mov rax, qword [0x14029e8b8]
xor rax, rsp
mov qword [rsp + 0x540], rax
mov ebx, edx
mov rdi, rcx
test rcx, rcx
je 0x140162420
cmp ebx, 0x20
jb 0x140162420
xor edx, edx
mov dword [rsp + 0x34], 1
mov r8d, 0x400
mov dword [rsp + 0x30], 0x400
lea rcx, [rsp + 0x140]
call fcn.1401afc90
lea rax, [rsp + 0x30]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x140]
lea r8, str.mid64
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareWow6432NodeComMaster
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x140162420
lea rcx, [rsp + 0x140]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140162310
cmp rax, 0x40
jne 0x140162420
mov edx, 0x80
lea r9, [rsp + 0x140]
lea rax, [rsp + 0x40]
mov r8d, edx
sub r9, rax
lea rcx, [rsp + 0x40]
lea rax, [r8 - 0x60]
test rax, rax
je 0x14016235d
movzx eax, byte [r9 + rcx]
test al, al
je 0x14016235d
mov byte [rcx], al
inc rcx
sub r8, 1
jne 0x140162340
test r8, r8
lea rax, [rcx - 1]
lea r9, [rsp + 0x160]
cmovne rax, rcx
lea rcx, [rsp + 0xc0]
mov byte [rax], 0
lea rax, [rsp + 0xc0]
sub r9, rax
nop word [rax + rax]
lea rax, [rdx + 0x7fffff7e]
test rax, rax
je 0x1401623b0
movzx eax, byte [r9 + rcx]
test al, al
je 0x1401623b0
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x140162390
test rdx, rdx
lea rax, [rcx - 1]
mov r8d, 0x400
cmovne rax, rcx
xor edx, edx
lea rcx, [rsp + 0x140]
mov byte [rax], 0
call fcn.1401afc90
mov r8d, 0x400
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x40]
call fcn.140162450
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x140162420
mov rdx, rbx
lea r8, [rsp + 0x40]
mov rcx, rdi
call fcn.140163400
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
jmp 0x140162422
xor eax, eax
mov rcx, qword [rsp + 0x540]
xor rcx, rsp
call fcn.140160a40
mov rbx, qword [rsp + 0x570]
add rsp, 0x550
pop rdi
ret
Function at 0x140162e60
Capabilities:
Get storage device properties

Disassembly:
push rbp
push r14
mov eax, 0x2c88
call fcn.140160af0
sub rsp, rax
mov rax, qword [0x14029e8b8]
xor rax, rsp
mov qword [rsp + 0x2c60], rax
mov r14d, edx
mov rbp, rcx
test rcx, rcx
je 0x140163089
test edx, edx
je 0x140163089
mov qword [rsp + 0x2ca8], rbx
mov qword [rsp + 0x2cb0], rsi
mov qword [rsp + 0x2cb8], rdi
mov qword [rsp + 0x2c80], r12
mov qword [rsp + 0x2c78], r13
mov r13d, 0x80070057
mov qword [rsp + 0x2c70], r15
xor r15d, r15d
mov ebx, r15d
mov edi, r15d
lea r12d, [r15 + 1]
nop dword [rax]
mov r9d, edi
lea r8, [0x140232e40]
mov edx, 0x100
lea rcx, [rsp + 0x60]
call fcn.1400b48e0
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
lea rcx, [rsp + 0x60]
xor edx, edx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14016304a
xor eax, eax
mov dword [rsp + 0x40], r15d
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x550]
xor edx, edx
mov qword [rsp + 0x4c], rax
mov r8d, 0x2710
mov dword [rsp + 0x48], r15d
call fcn.1401afc90
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x48]
lea rax, [rsp + 0x550]
mov dword [rsp + 0x28], 0x2710
mov r9d, SafeArrayDestroy
mov qword [rsp + 0x20], rax
mov edx, 0x2d1400
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x14016303d
xor edx, edx
lea rcx, [rsp + 0x160]
mov r8d, 0x3e8
call fcn.1401afc90
mov edx, dword [rsp + 0x568]
lea r9, [rsp + 0x160]
mov r8d, r12d
lea rcx, [rsp + 0x550]
call fcn.140163ec0
lea rax, [r14 - 1]
mov ecx, r15d
cmp rax, 0x7ffffffe
mov rdx, r14
cmova ecx, r13d
test ecx, ecx
js 0x140163039
mov rax, rbp
test r14d, r14d
je 0x140163020
mov r8d, 0x7ffffffe
lea r9, [rsp + 0x160]
sub r8, rdx
sub r9, rbp
lea rcx, [r8 + rdx]
test rcx, rcx
je 0x140163020
movzx ecx, byte [r9 + rax]
test cl, cl
je 0x140163020
mov byte [rax], cl
inc rax
sub rdx, r12
jne 0x140163004
test rdx, rdx
lea rcx, [rax - 1]
cmovne rcx, rax
mov byte [rcx], r15b
mov ecx, 0x8007007a
cmovne ecx, r15d
test ecx, ecx
cmove ebx, r12d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x140163055
inc edi
cmp edi, 0x10
jl 0x140162ee0
mov r15, qword [rsp + 0x2c70]
mov eax, ebx
mov rbx, qword [rsp + 0x2ca8]
mov r13, qword [rsp + 0x2c78]
mov r12, qword [rsp + 0x2c80]
mov rdi, qword [rsp + 0x2cb8]
mov rsi, qword [rsp + 0x2cb0]
jmp 0x14016308b
xor eax, eax
mov rcx, qword [rsp + 0x2c60]
xor rcx, rsp
call fcn.140160a40
add rsp, 0x2c88
pop r14
pop rbp
ret
Function at 0x1401630b0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x14029e8b8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
test rcx, rcx
je 0x14016317e
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.1401afc90
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x14016317e
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp word [rbx + rdx*2], 0
jne 0x140163110
mov ecx, 0x103
mov eax, eax
sub rcx, rdx
cmp rax, rcx
jae 0x14016317e
lea rcx, [rsp + 0x20]
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140163132
mov eax, dword [0x140232e30]
mov dword [rcx], eax
lea rcx, [rsp + 0x20]
sub rcx, 2
nop
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140163150
xor edx, edx
nop dword [rax]
movzx eax, word [rbx + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x140163160
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x140163180
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140160a40
add rsp, 0x240
pop rbx
ret
Function at 0x1401631a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x2e0
mov rax, qword [0x14029e8b8]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x80
call fcn.1401afc90
mov r8d, 0x80
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140162450
mov edx, 0x104
lea rax, [rsp + 0xc0]
mov r9, rdi
lea rcx, [rsp + 0xc0]
mov r8d, edx
sub r9, rax
nop word [rax + rax]
lea rax, [r8 + 0x7ffffefa]
test rax, rax
je 0x140163230
movzx eax, byte [r9 + rcx]
test al, al
je 0x140163230
mov byte [rcx], al
inc rcx
sub r8, 1
jne 0x140163210
lea rax, [rcx - 1]
test r8, r8
cmovne rax, rcx
mov rcx, rdx
mov byte [rax], 0
lea rax, [rsp + 0xc0]
nop dword [rax]
cmp byte [rax], 0
je 0x14016325e
inc rax
sub rcx, 1
jne 0x140163250
xor r8d, r8d
mov rax, rdx
sub rax, rcx
test rcx, rcx
cmovne r8, rax
je 0x1401632bf
lea rcx, [rsp + 0xc0]
lea rcx, [rcx + r8]
sub rdx, r8
je 0x1401632b1
lea rax, [r8 + 0x7ffffefb]
add rax, rdx
lea r9, [rsp + 0x40]
sub r9, rcx
test rax, rax
je 0x1401632b1
movzx r8d, byte [r9 + rcx]
test r8b, r8b
je 0x1401632b1
mov byte [rcx], r8b
dec rax
inc rcx
sub rdx, 1
jne 0x140163293
test rdx, rdx
lea rax, [rcx - 1]
cmovne rax, rcx
mov byte [rax], 0
xor edx, edx
mov dword [rsp + 0x34], 1
mov r8d, 0x100
lea rcx, [rsp + 0x1d0]
call fcn.1401afc90
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x100
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x1d0]
mov rcx, 0xffffffff80000002
lea r8, str.mid64
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareWow6432NodeComMaster
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov rbx, 0xffffffffffffffff
test eax, eax
jne 0x14016338d
lea rax, [rsp + 0x1d0]
sub rdi, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + rdi]
sub edx, ecx
jne 0x140163343
inc rax
test ecx, ecx
jne 0x140163331
test edx, edx
je 0x14016338d
lea rcx, [rsp + 0x1d0]
mov rax, rbx
inc rax
cmp byte [rcx + rax], 0
jne 0x140163352
mov dword [rsp + 0x28], eax
lea r8, str.mid64_old
lea rax, [rsp + 0x1d0]
mov r9d, 1
lea rdx, str.SoftwareWow6432NodeComMaster
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea rax, [rsp + 0xc0]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140163395
lea rax, [rsp + 0xc0]
mov dword [rsp + 0x28], ebx
mov r9d, 1
mov qword [rsp + 0x20], rax
lea r8, str.mid64
mov rcx, 0xffffffff80000002
lea rdx, str.SoftwareWow6432NodeComMaster
call qword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.140160a40
mov rbx, qword [rsp + 0x2f8]
add rsp, 0x2e0
pop rdi
ret
Function at 0x140164aa0
Capabilities:
Encode data using xor

Disassembly:
xor al, al
mov r9, rcx
test edx, edx
je 0x140164b84
mov r10d, edx
movzx edx, byte [r9]
lea r9, [r9 + 1]
xor dl, al
movzx eax, dl
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
movzx r8d, al
and dl, 1
cmove r8d, ecx
movzx eax, r8b
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
movzx edx, al
and r8b, 1
cmove edx, ecx
movzx eax, dl
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
movzx r8d, al
and dl, 1
cmove r8d, ecx
movzx eax, r8b
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
movzx edx, al
and r8b, 1
cmove edx, ecx
movzx eax, dl
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
movzx r8d, al
and dl, 1
cmove r8d, ecx
movzx eax, r8b
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
movzx edx, al
and r8b, 1
cmove edx, ecx
movzx eax, dl
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
movzx r8d, al
and dl, 1
cmove r8d, ecx
movzx eax, r8b
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
and r8b, 1
movzx eax, al
cmove eax, ecx
sub r10, 1
jne 0x140164ab0
ret
Function at 0x1401664c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov qword [rbp - 0x59], 0xfffffffffffffffe
mov qword [rsp + 0x130], rbx
mov rax, qword [0x14029e8b8]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r14, rdx
mov r15, rcx
xor esi, esi
mov dword [rdx], esi
mov qword [rbp - 0x71], rsi
mov dword [rbp - 0x69], esi
mov qword [rbp - 0x61], rsi
mov r9d, 0x201
mov r8, qword [0x14029e920]
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x71]
call fcn.14002ab60
test eax, eax
jne 0x140166682
xor edx, edx
lea r8d, [rsi + 0x64]
lea rcx, [rbp - 0x49]
call fcn.1401afc90
mov dword [rsp + 0x30], 0x64
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x49]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, [0x1402349d4]
mov rcx, qword [rbp - 0x71]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140166682
mov eax, dword [rsp + 0x38]
dec eax
cmp eax, 1
ja 0x140166682
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x1401665a8
test cl, 1
jne 0x140166682
mov eax, ecx
shr rax, 1
cmp word [rbp + rax*2 - 0x4b], si
je 0x1401665ac
jmp 0x140166682
mov word [rbp - 0x49], si
shr ecx, 1
cmp ecx, 0x2d
jne 0x140166682
call fcn.14000a6a0
mov rcx, rax
test rax, rax
je 0x1401666b6
mov rax, qword [rax]
call qword [rax + ILCombine]
add rax, 0x18
mov qword [rbp - 0x79], rax
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x79]
call fcn.140164670
mov dword [rsp + 0x34], esi
lea r8, [rsp + 0x34]
lea rdx, [0x1402349dc]
lea rcx, [rbp + 0xb]
call fcn.140166750
mov edx, 0x2a
mov rbx, qword [rbp - 0x79]
mov rcx, rbx
call fcn.140164aa0
movzx ecx, al
cmp dword [rsp + 0x34], ecx
jne 0x140166663
lea rcx, [rbp - 0x49]
mov rdi, 0xffffffffffffffff
mov rax, rdi
inc rax
cmp word [rcx + rax*2], 0
jne 0x140166624
mov r8d, eax
lea rdx, [rbp - 0x49]
mov rcx, r15
call fcn.14000cfe0
mov r8d, dword [reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [str.ffffffff]
lea rcx, [rbp - 0x49]
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
mov esi, 1
test eax, eax
jne 0x140166661
mov dword [r14], esi
jmp 0x14016666a
mov rdi, 0xffffffffffffffff
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140166682
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x71]
test rcx, rcx
je 0x140166691
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140160a40
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.14000ca90
int3
Function at 0x14016b630
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14029e8b8]
xor rax, rsp
mov qword [rsp + 0x50], rax
add rdx, 0xffffffffffff0000
mov rdi, rcx
movzx eax, dx
mov rbx, rdx
sub rbx, rax
test rax, rax
cmove rbx, rdx
cmp rbx, rcx
jbe 0x14016b722
nop dword [rax]
lea rax, [rbx - 0x50000000]
cmp rax, 0x30000000
ja 0x14016b689
mov ebx, 0x4fff0000
jmp 0x14016b719
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
lea r8d, [rax + 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14016b722
cmp dword [rsp + 0x40], 0x10000
jne 0x14016b6fd
cmp qword [rsp + 0x38], 0x10000
jb 0x14016b6fd
mov edx, 0x10000
mov r9d, SHGetSetSettings
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x14016b724
sub rbx, 0x10000
jmp 0x14016b719
mov rcx, qword [rsp + 0x28]
add rcx, 0xffffffffffff0000
movzx eax, cx
mov rbx, rcx
sub rbx, rax
test rax, rax
cmove rbx, rcx
cmp rbx, rdi
ja 0x14016b670
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140160a40
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret

Function at 0x14016b740
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14029e8b8]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx eax, cx
mov rdi, rdx
mov rbx, rcx
test rax, rax
je 0x14016b771
sub rbx, rax
add rbx, 0x10000
mov qword [rsp + 0x78], rsi
cmp rbx, rdi
jae 0x14016b842
mov esi, 0x80010000
nop dword [rax]
nop dword [rax + rax]
lea rax, [rbx - 0x50000000]
cmp rax, 0x30000000
ja 0x14016b7a7
mov rbx, rsi
jmp 0x14016b839
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
lea r8d, [rax + 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14016b842
cmp dword [rsp + 0x40], 0x10000
mov rcx, qword [rsp + 0x38]
jne 0x14016b81e
cmp rcx, 0x10000
jb 0x14016b81e
mov edx, 0x10000
mov r9d, SHGetSetSettings
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x14016b844
add rbx, 0x10000
jmp 0x14016b839
mov rbx, qword [rsp + 0x20]
add rbx, rcx
movzx ecx, bx
test rcx, rcx
je 0x14016b839
mov eax, 0x10000
sub rax, rcx
add rbx, rax
cmp rbx, rdi
jb 0x14016b790
xor eax, eax
mov rsi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140160a40
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x14016b870
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
lea rdi, [rcx - 0x7ff80000]
mov rbx, rcx
cmp rcx, 0x7ff80000
ja 0x14016b892
mov edi, 0x10000
mov qword [rsp + 0x38], rsi
lea rsi, [rcx + 0x7ff80000]
cmp rbx, 0xffffffff80000000
jb 0x14016b8ae
mov rsi, 0xfffffffffff80000
mov rax, qword [0x1402bb6f8]
mov rcx, qword [0x1402bb6f0]
mov qword [rsp + 0x30], rbp
test rax, rax
jne 0x14016b8d5
test rcx, rcx
je 0x14016b8ec
mov rax, rcx
mov qword [0x1402bb6f8], rcx
mov rdx, qword [rax + 0x10]
test rdx, rdx
je 0x14016b8ec
cmp rdx, rdi
jb 0x14016b8ec
cmp rdx, rsi
jbe 0x14016ba19
mov qword [0x1402bb6f8], rcx
mov rax, rcx
test rcx, rcx
je 0x14016b927
test rcx, rcx
je 0x14016b917
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14016b917
cmp rcx, rdi
jb 0x14016b917
cmp rcx, rsi
jbe 0x14016ba19
mov rax, qword [rax + 8]
mov qword [0x1402bb6f8], rax
test rax, rax
jne 0x14016b900
movzx eax, bx
sub rbx, rax
cmp rbx, 0x40000000
jbe 0x14016b94a
lea rdx, [rbx - 0x40000000]
mov rcx, rdi
call fcn.14016b630
test rax, rax
jne 0x14016b9c7
movabs rbp, 0xffffffff40000000
cmp rbx, rbp
jae 0x14016b96d
lea rcx, [rbx + 0x40000000]
mov rdx, rsi
call fcn.14016b740
test rax, rax
jne 0x14016b9c7
cmp rbx, 0x40000000
jbe 0x14016b98a
lea rcx, [rbx - 0x40000000]
mov rdx, rbx
call fcn.14016b740
test rax, rax
jne 0x14016b9c7
cmp rbx, rbp
jae 0x14016b9a3
lea rdx, [rbx + 0x40000000]
mov rcx, rbx
call fcn.14016b630
test rax, rax
jne 0x14016b9c7
mov rdx, rbx
mov rcx, rdi
call fcn.14016b630
test rax, rax
jne 0x14016b9c7
mov rdx, rsi
mov rcx, rbx
call fcn.14016b740
test rax, rax
je 0x14016ba45
mov dword [rax], 0x52727464
lea rdx, [rax + 0xffa8]
xor r8d, r8d
mov qword [0x1402bb6f8], rax
mov qword [rax + 0x10], r8
mov r9d, 0x2a7
mov rcx, qword [0x1402bb6f0]
mov qword [rax + 8], rcx
lea rcx, [rax + 0xff60]
mov qword [0x1402bb6f0], rax
mov qword [rdx], r8
lea rdx, [rdx - 0x60]
mov r8, rcx
sub rcx, 0x60
sub r9, 1
jne 0x14016ba01
mov qword [rax + 0x10], r8
mov rbx, qword [rax + 0x10]
cmp rbx, rdi
jb 0x14016ba45
cmp rbx, rsi
ja 0x14016ba45
mov rcx, qword [rbx + 0x48]
mov edx, 0xcc
mov qword [rax + 0x10], rcx
mov rcx, rbx
lea r8d, [rdx - 0x6c]
call fcn.1401afc90
mov rax, rbx
jmp 0x14016ba47
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14016ba60
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14029e8b8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov eax, 0x5a4d
mov rcx, qword [rsp + 0x28]
cmp word [rcx], ax
je 0x14016ba9d
xor al, al
jmp 0x14016badb
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rdx + rcx], 0x4550
je 0x14016baae
xor al, al
jmp 0x14016badb
mov r8d, dword [rdx + rcx + 0xe8]
lea rax, [r8 + rcx]
cmp rbx, rax
jb 0x14016bad5
mov eax, dword [rdx + rcx + 0xec]
add rax, r8
add rax, rcx
cmp rbx, rax
jae 0x14016bad5
mov al, 1
jmp 0x14016badb
xor al, al
jmp 0x14016badb
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140160a40
add rsp, 0x60
pop rbx
ret
Function at 0x14016bfb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push r14
sub rsp, 0x48
mov rax, qword [0x14029e8b8]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rdi, rdx
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1402bb708], eax
je 0x14016bfe5
mov eax, 0x10dd
jmp 0x14016c19d
mov eax, dword [0x1402bb70c]
test eax, eax
jne 0x14016c19d
test r14, r14
je 0x14016c00f
cmp qword [r14], 0
jne 0x14016c019
mov dword [0x1402bb70c], 6
mov qword [0x1402bb710], r14
mov eax, 6
jmp 0x14016c19d
mov qword [rsp + 0x70], rbx
mov ecx, 0x30
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rsi
call fcn.1401606ac
mov rsi, rax
test rax, rax
jne 0x14016c042
lea ebx, [rax + 8]
jmp 0x14016c16d
mov rbx, qword [r14]
mov qword [rsp + 0x30], r15
test rbx, rbx
je 0x14016c097
cmp byte [rbx], 0xff
jne 0x14016c076
cmp byte [rbx + 1], 0x25
jne 0x14016c076
movsxd r15, dword [rbx + 2]
lea rdx, [rbx + 6]
add rdx, r15
mov rcx, rbx
call fcn.14016ba60
test al, al
je 0x14016c076
mov rbx, qword [r15 + rbx + 6]
cmp byte [rbx], 0xeb
jne 0x14016c097
movsx rax, byte [rbx + 1]
add rbx, 2
add rbx, rax
cmp byte [rbx], 0xe9
jne 0x14016c097
movsxd rax, dword [rbx + 1]
add rbx, 5
add rbx, rax
test rdi, rdi
je 0x14016c0e4
cmp byte [rdi], 0xff
jne 0x14016c0c3
cmp byte [rdi + 1], 0x25
jne 0x14016c0c3
movsxd r15, dword [rdi + 2]
lea rdx, [rdi + 6]
add rdx, r15
mov rcx, rdi
call fcn.14016ba60
test al, al
je 0x14016c0c3
mov rdi, qword [r15 + rdi + 6]
cmp byte [rdi], 0xeb
jne 0x14016c0e4
movsx rax, byte [rdi + 1]
add rdi, 2
add rdi, rax
cmp byte [rdi], 0xe9
jne 0x14016c0e4
movsxd rax, dword [rdi + 1]
add rdi, 5
add rdi, rax
movzx eax, byte [rbx + 0x3e]
mov rbp, qword [rbx + 0x48]
mov r15, qword [rsp + 0x30]
sub rbp, rax
test al, al
je 0x14016c15f
mov edx, eax
cmp rax, 0x1e
ja 0x14016c15f
cmp qword [rbx + 0x50], rdi
jne 0x14016c15f
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0
mov r8d, SHGetSetSettings
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14016c130
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x14016c16d
mov dword [rsi + 8], 1
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x20], rbx
mov qword [rsi + 0x18], rbp
mov eax, dword [rsp + 0x20]
mov dword [rsi + 0x28], eax
mov rax, qword [0x1402bb720]
mov qword [rsi], rax
xor eax, eax
mov qword [0x1402bb720], rsi
jmp 0x14016c18e
cmp dword [0x1402bb700], 0
mov ebx, 9
jne 0x14016c173
mov dword [0x1402bb70c], ebx
test rsi, rsi
je 0x14016c185
mov edx, 0x30
mov rcx, rsi
call fcn.1401606e8
mov qword [0x1402bb710], r14
mov eax, ebx
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140160a40
add rsp, 0x48
pop r14
pop rdi
ret
Function at 0x14016c1c0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14029e8b8]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp dword [0x1402bb708], 0
jne 0x14016c25b
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
xor eax, eax
lock cmpxchg dword [0x1402bb708], ecx
jne 0x14016c25b
xor eax, eax
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1402bb6f0]
mov qword [0x1402bb720], rax
mov qword [0x1402bb718], rax
mov dword [0x1402bb70c], eax
mov qword [0x1402bb710], rax
test rbx, rbx
je 0x14016c242
nop
lea r9, [rsp + 0x20]
mov edx, 0x10000
mov r8d, SHGetSetSettings
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x14016c220
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140160a40
add rsp, 0x38
ret
mov eax, 0x10dd
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140160a40
add rsp, 0x38
ret
Function at 0x14016c800
Capabilities:
Suspend thread

Disassembly:
push rdi
sub rsp, 0x20
mov eax, dword [0x1402bb70c]
mov rdi, rcx
test eax, eax
jne 0x14016c8a3
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp rdi, rax
jne 0x14016c82a
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov ecx, ILClone
mov qword [rsp + 0x30], rbx
call fcn.1401606ac
mov rbx, rax
test rax, rax
jne 0x14016c846
lea edi, [rax + 8]
jmp 0x14016c869
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x14016c887
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov edx, ILClone
mov rcx, rbx
call fcn.1401606e8
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov dword [0x1402bb70c], edi
mov qword [0x1402bb710], 0
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x1402bb718]
mov qword [rbx], rax
xor eax, eax
mov qword [rbx + 8], rdi
mov qword [0x1402bb718], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14016f664
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14016f677
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.14016fc84
lea rdx, [0x1402998c8]
lea rcx, [rsp + 0x20]
call fcn.1401afed8
int3

Function at 0x140179ee8
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1402bb7e0]
xor edx, edx
jmp fcn.14016f664

Function at 0x14017a874
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1402bb7e0]
jmp fcn.14016f664

Function at 0x140186444
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x140186500]
mov r9, qword [r9 + 8]
jmp fcn.1401778a0

Function at 0x1401864d8
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x140186510]
mov r9, qword [r9 + 8]
jmp fcn.1401778a0
Function at 0x1401cb0c8
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1401cb0c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1401b3320
or eax, 0xffffffff
jmp 0x1401cb0c2
xor eax, eax
add rsp, 0x28
ret
jmp 0x1401cb0a0