joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019480
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov rax, qword [0x1400b3668]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rax, [0x1400526d0]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x48]
mov rdx, qword [rsp + 0x38]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x1400194c9
xor al, al
jmp 0x140019545
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, str.type
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140019538
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x140052740]
lea rcx, [0x1400b5020]
call fcn.140007000
mov qword [rsp + 0x40], rax
lea rdx, [0x14000c0b0]
mov rcx, qword [rsp + 0x40]
call fcn.14000efd0
xor al, al
jmp 0x140019545
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140027d50
add rsp, 0x68
ret

Function at 0x140019560
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x1400b3668]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rax, [0x140052768]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x58]
mov rdx, qword [rsp + 0x38]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x1400195d6
lea rdx, [0x140052798]
lea rcx, [0x1400b5020]
call fcn.140007000
mov qword [rsp + 0x40], rax
lea rdx, [0x14000c0b0]
mov rcx, qword [rsp + 0x40]
call fcn.14000efd0
xor al, al
jmp 0x140019670
mov rcx, qword [rsp + 0x80]
call fcn.14002ea90
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.test
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140019663
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.____Cant_create_test_registry_value
lea rcx, [0x1400b5020]
call fcn.140007000
mov qword [rsp + 0x50], rax
lea rdx, [0x14000c0b0]
mov rcx, qword [rsp + 0x50]
call fcn.14000efd0
xor al, al
jmp 0x140019670
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140027d50
add rsp, 0x78
ret
Function at 0x140019690
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x1400b3668]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rax, [0x1400527e8]
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x58]
mov rdx, qword [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x1400196e2
xor al, al
jmp 0x1400197b7
mov rcx, qword [rsp + 0x80]
call fcn.14002ea90
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.user
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140019746
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x1400197b7
mov rcx, qword [rsp + 0x88]
call fcn.14002ea90
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.password
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x1400197aa
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x1400197b7
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140027d50
add rsp, 0x78
ret
Function at 0x140019b20
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x1f8
mov rax, qword [0x1400b3668]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
lea rdx, str.SYSTEMCurrentControlSetServicesBinDriver.sys
lea rcx, [rsp + 0xa8]
call fcn.14000cd80
nop
lea rdx, str.tongxin
lea rcx, [rsp + 0x88]
call fcn.14000cd80
nop
mov dword [rsp + 0x84], 1
mov dword [rsp + 0x80], 0x104
lea rcx, [rsp + 0xa8]
call fcn.140014040
lea r8, [rsp + 0x78]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea rcx, [rsp + 0x88]
call fcn.140014040
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x84]
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140019bf2
jmp 0x140019c38
lea rdx, str.RegQueryValueExA_GetLastError___
lea rcx, [0x1400b5150]
call fcn.14001a0a0
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x44], eax
mov edx, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x58]
call fcn.14001ae10
mov qword [rsp + 0x60], rax
lea rdx, [0x14001a8c0]
mov rcx, qword [rsp + 0x60]
call fcn.14000efd0
lea rdx, [rsp + 0xd0]
lea rcx, [0x1400b5150]
call fcn.14001a0a0
mov qword [rsp + 0x68], rax
lea rdx, [0x14001a8c0]
mov rcx, qword [rsp + 0x68]
call fcn.14000efd0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0xffffffffffffffff
jne 0x140019cca
mov byte [rsp + 0x40], 0
lea rcx, [rsp + 0x88]
call fcn.14000e740
nop
lea rcx, [rsp + 0xa8]
call fcn.14000e740
movzx eax, byte [rsp + 0x40]
jmp 0x140019d0c
mov byte [rsp + 0x41], 1
lea rcx, [rsp + 0x88]
call fcn.14000e740
nop
lea rcx, [rsp + 0xa8]
call fcn.14000e740
movzx eax, byte [rsp + 0x41]
jmp 0x140019d0c
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.140027d50
add rsp, 0x1f8
ret

Function at 0x14001fbd0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
mov rax, qword [rsp]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001fbf4
xor eax, eax
jmp 0x14001fc22
mov rax, qword [rsp]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
cmp dword [rax], 0x4550
je 0x14001fc1d
xor eax, eax
jmp 0x14001fc22
mov rax, qword [rsp + 8]
add rsp, 0x18
ret
Function at 0x140022bc0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xd8
mov rax, qword [0x1400b3668]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea rcx, [0x140053240]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140022bff
xor al, al
jmp 0x140022dfb
mov r8, qword [rsp + 0xe0]
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
lea rcx, [rsp + 0x90]
call fcn.140022e20
nop
lea rcx, [rsp + 0x90]
call fcn.140014060
mov rdx, rax
lea rcx, [rsp + 0xb0]
call sub.ntdll.dll_RtlInitUnicodeString
mov r8, qword [rsp + 0xe0]
lea rdx, str.SYSTEMCurrentControlSetServices_
lea rcx, [rsp + 0x70]
call fcn.140022e20
nop
lea rcx, [rsp + 0x70]
call fcn.140014060
lea r8, [rsp + 0x68]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x140022cd2
cmp dword [rsp + 0x24], 2
jne 0x140022cab
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x70]
call fcn.14000e770
nop
lea rcx, [rsp + 0x90]
call fcn.14000e770
movzx eax, byte [rsp + 0x20]
jmp 0x140022dfb
mov byte [rsp + 0x21], 0
lea rcx, [rsp + 0x70]
call fcn.14000e770
nop
lea rcx, [rsp + 0x90]
call fcn.14000e770
movzx eax, byte [rsp + 0x21]
jmp 0x140022dfb
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.NtUnloadDriver
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0xb0]
call qword [rsp + 0x40]
mov dword [rsp + 0x28], eax
lea rdx, str.___NtUnloadDriver_Status_0x
lea rcx, [0x1400b5020]
call fcn.140007000
mov qword [rsp + 0x48], rax
lea rdx, [0x140016310]
mov rcx, qword [rsp + 0x48]
call fcn.14000f000
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call fcn.14001f420
mov qword [rsp + 0x58], rax
lea rdx, [0x14000c0b0]
mov rcx, qword [rsp + 0x58]
call fcn.14000efd0
cmp dword [rsp + 0x28], 0
je 0x140022d90
lea rdx, str.____Driver_Unload_Failed__
lea rcx, [0x1400b5020]
call fcn.140007000
mov qword [rsp + 0x60], rax
lea rdx, [0x14000c0b0]
mov rcx, qword [rsp + 0x60]
call fcn.14000efd0
lea rcx, [rsp + 0x70]
call fcn.140014060
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x140022dd9
mov byte [rsp + 0x22], 0
lea rcx, [rsp + 0x70]
call fcn.14000e770
nop
lea rcx, [rsp + 0x90]
call fcn.14000e770
movzx eax, byte [rsp + 0x22]
jmp 0x140022dfb
mov byte [rsp + 0x23], 1
lea rcx, [rsp + 0x70]
call fcn.14000e770
nop
lea rcx, [rsp + 0x90]
call fcn.14000e770
movzx eax, byte [rsp + 0x23]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140027d50
add rsp, 0xd8
ret
Function at 0x140022ef0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x260
mov rax, qword [0x1400b3668]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rdx, [rsp + 0x40]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x140022f4d
cmp dword [rsp + 0x24], 0x105
jbe 0x140022f9f
lea rdx, str.____Failed_to_get_temp_path
lea rcx, [0x1400b5020]
call fcn.140007530
mov qword [rsp + 0x30], rax
lea rdx, [0x14000c0b0]
mov rcx, qword [rsp + 0x30]
call fcn.14000efd0
lea rdx, [0x140053390]
mov rcx, qword [rsp + 0x270]
call fcn.14000cfa0
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x270]
jmp 0x14002300a
lea rcx, [rsp + 0x40]
call fcn.14002e144
movzx eax, word [rsp + rax*2 + 0x3e]
cmp eax, 0x5c
jne 0x140022fe5
lea rcx, [rsp + 0x40]
call fcn.14002e144
lea rax, [rax + rax - 2]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0x20a
jae 0x140022fd4
jmp 0x140022fd9
call fcn.140027ea4
xor eax, eax
mov rcx, qword [rsp + 0x28]
mov word [rsp + rcx + 0x40], ax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x270]
call fcn.14000cfa0
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140027d50
add rsp, 0x260
pop rdi
ret
Function at 0x1400232b0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x1400b3668]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x60], 0
lea r9, [rsp + 0x60]
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x28]
mov ecx, 0xb
call sub.ntdll.dll_NtQuerySystemInformation
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xc0000004
jne 0x140023357
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rsp + 0x60]
mov r9d, 4
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x28]
mov ecx, 0xb
call sub.ntdll.dll_NtQuerySystemInformation
mov dword [rsp + 0x30], eax
jmp 0x1400232fc
cmp dword [rsp + 0x30], 0
jge 0x140023380
cmp qword [rsp + 0x28], 0
je 0x140023379
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x14002349a
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140023399
xor eax, eax
jmp 0x14002349a
mov dword [rsp + 0x20], 0
jmp 0x1400233ad
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
cmp dword [rsp + 0x20], eax
jae 0x140023485
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 8]
mov ecx, dword [rsp + 0x20]
imul rcx, rcx, 0x128
mov rdx, qword [rsp + 0x38]
movzx ecx, word [rdx + rcx + 0x2e]
lea rax, [rax + rcx + 0x28]
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.14000cd80
mov rcx, qword [rsp + 0xa0]
call fcn.140014040
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x68]
call fcn.140014040
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
call fcn.14002e9ac
test eax, eax
jne 0x140023476
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax + 0x18]
mov qword [rsp + 0x50], rax
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x68]
call fcn.14000e740
mov rax, qword [rsp + 0x58]
jmp 0x14002349a
lea rcx, [rsp + 0x68]
call fcn.14000e740
jmp 0x1400233a3
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140027d50
add rsp, 0x98
ret
Function at 0x140023600
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rcx, qword [rsp + 0x60]
call fcn.14002ea90
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x68]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x68]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x20], 0
jmp 0x140023667
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x20], eax
jae 0x140023701
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x60]
mov rcx, rax
call fcn.14002a120
test eax, eax
jne 0x1400236fc
mov rax, qword [rsp + 0x28]
mov rcx, rax
call fcn.14002ea90
cmp qword [rsp + 0x38], rax
jne 0x1400236fc
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0xc], 0
jne 0x1400236d0
xor eax, eax
jmp 0x140023703
cmp qword [rsp + 0x70], 0
je 0x1400236e7
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 8]
mov dword [rax], ecx
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x68]
add rcx, rax
mov rax, rcx
jmp 0x140023703
jmp 0x14002365d
xor eax, eax
add rsp, 0x58
ret
Function at 0x140026a54
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x1400b3668]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov edi, 0xffff
xor r14d, r14d
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x140026a98
movzx eax, r14w
jmp 0x140026bce
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x140026ad4
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x140026ad4
lea ecx, [r9 - 1]
mov dword [rax], ecx
movzx eax, si
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x140026bce
cmp qword [rcx + 0x80], r14
je 0x140026bcb
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140026b12
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140026b3b
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.140033718
cmp ax, di
je 0x140026bcb
movzx edi, si
jmp 0x140026bcb
lea r8, [rbp + 0xf]
mov word [rbp + 7], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp + 9]
lea r8, [rbp + 0x3f]
mov qword [rsp + 0x30], r8
lea r8, [rbp + 0x1f]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0x17]
mov qword [rsp + 0x20], r8
lea r8, [rbp + 7]
call qword [0x14004e428]
test eax, eax
je 0x140026b90
sub eax, 1
je 0x140026b90
cmp eax, 2
jne 0x140026bcb
movzx ecx, word [rbp + 7]
jmp 0x140026b1e
mov r14, qword [rbp + 0xf]
lea rax, [rbp + 0x1f]
sub r14, rax
je 0x140026bba
mov r9, qword [rbx + 0x80]
lea rcx, [rbp + 0x1f]
mov r8, r14
mov edx, 1
call fcn.14002fdb0
cmp r14, rax
jne 0x140026bcb
lea rax, [rbp + 7]
mov byte [rbx + 0x72], 1
cmp qword [rbp + 0x17], rax
movzx eax, si
jne 0x140026bce
movzx eax, di
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140027d50
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x14002ee90
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14002eeb0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14003323c
or eax, 0xffffffff
jmp 0x14002eeb2
xor eax, eax
add rsp, 0x28
ret

Function at 0x14003751c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140037348
Function at 0x14003d494
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x14003d1ba
call fcn.1400332ac
mov dword [rax], 0x16
call fcn.14002df5c
jmp 0x14003d305
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14003d305
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14003d305
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x14003d1e9
lock or dword [rcx + 0x14], 0x10
jmp 0x14003d305
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14003d1fd
call fcn.14003eafc
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x14003d20d
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x14003d210
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.14003c290
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.14003e2a0
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x14003d2f3
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x14003d2a1
mov rcx, rbx
call fcn.14003c290
cmp eax, 0xffffffff
je 0x14003d28c
mov rcx, rbx
call fcn.14003c290
cmp eax, 0xfffffffe
je 0x14003d28c
mov rcx, rbx
call fcn.14003c290
movsxd rdi, eax
lea r14, [0x1400b6180]
mov rcx, rbx
sar rdi, 6
call fcn.14003c290
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x14003d293
lea rdx, [0x1400b3a20]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14003d2a1
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x14003d2c5
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x14003d2c5
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x14003d2c5
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x14003d2e3
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x14003d2ee
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x14003d30a
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x14003d184
Function at 0x416b20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416cab
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004352a0
xorps xmm15, xmm15
mov r14, qword [0x006726c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x416b85
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x416b94
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x416bb3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x416bc3
cmp rbx, 0x1000
jae 0x416b8b
jmp 0x416c2d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x416bd5
xor edx, edx
jmp 0x416c24
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004352a0
xorps xmm15, xmm15
mov r14, qword [0x006726c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x416bb9
jmp 0x416ba8
call fcn.0046a660
xorps xmm15, xmm15
mov r14, qword [0x006726c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004396e0
lea rax, [0x004fb8fa]
mov ebx, 0x18
nop dword [rax]
call fcn.00439f60
mov rax, qword [rsp + 0x38]
call fcn.00439ca0
lea rax, [0x004fbdb4]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00439f60
mov rax, qword [rsp + 0x30]
call fcn.00439ca0
call fcn.00439920
call fcn.00439740
lea rax, [0x004fe3c1]
mov ebx, 0x21
call fcn.00437c40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00466f20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00416b20