joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400178a0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov r9d, dword [0x14005a078]
xor eax, eax
xor bl, bl
mov rdi, rdx
mov rsi, rcx
mov dword [rsp + 0x58], edx
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x50], eax
test r9d, r9d
jne 0x140017910
mov dword [0x14005a078], 0x20019
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x140017909
cmp dword [rsp + 0x50], 0
je 0x140017909
mov r9d, dword [0x14005a078]
bts r9d, 8
mov dword [0x14005a078], r9d
jmp 0x140017910
mov r9d, dword [0x14005a078]
test rsi, rsi
je 0x1400179e5
test rdi, rdi
je 0x1400179e5
lea rax, [rsp + 0x60]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallNVIDIA_nView_Desktop_Manager
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140017982
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
lea rdx, str.InstallLocation
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x60]
test eax, eax
sete bl
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x1400179e5
mov r9d, dword [0x14005a078]
lea rax, [rsp + 0x60]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallB2FE1952_0186_46C3_BAEC_A80AA35AC5B8_Display.NView
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400179e5
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
lea rdx, str.InstallLocation
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x60]
test eax, eax
sete bl
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x14001b3e7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140058188]
jne 0x140017cba
rol rcx, 0x10
test cx, 0xffff
jne 0x140017cb6
repz ret
ror rcx, 0x10
jmp 0x14001b340
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14005a170]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x14005a268]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14001b3c5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14005a170]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14001b3e7
mov rax, qword [rsp + 0x88]
mov qword [0x14005a268], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14005a208], rax
mov rax, qword [0x14005a268]
mov qword [0x14005a0e0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14005a1f0], rax
mov dword [0x14005a0d0], 0xc0000409
mov dword [0x14005a0d4], 1
mov rax, qword [0x140058188]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140058190]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14005a168], eax
mov ecx, 1
call fcn.140024b28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14004e0a0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14005a168], 0
jne 0x14001b46e
mov ecx, 1
call fcn.140024b28
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x14001f85c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x14001f6c4
Function at 0x14002ceb4
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.14001be68
xor ebx, ebx
mov rdi, rax
cmp qword [0x14005ae58], rbx
jne 0x14002cfba
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14002d08f
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002d08f
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14005ae58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14005ae60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x14005ae68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x14005ae78], rax
test rax, rax
je 0x14002cfb1
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x14005ae70], rax
jmp 0x14002cfc1
mov rax, qword [0x14005ae70]
jmp 0x14002cfc8
mov rax, qword [0x14005ae70]
mov r11, qword [0x14005ae78]
cmp rax, rdi
je 0x14002d030
cmp r11, rdi
je 0x14002d030
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x14005ae78]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x14002d030
test rax, rax
je 0x14002d030
call rsi
test rax, rax
je 0x14002d02a
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14002d02a
test byte [rsp + 0x38], 1
jne 0x14002d030
bts ebp, 0x15
jmp 0x14002d06e
mov rcx, qword [0x14005ae60]
cmp rcx, rdi
je 0x14002d06e
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14002d06e
call rax
mov rbx, rax
test rax, rax
je 0x14002d06e
mov rcx, qword [0x14005ae68]
cmp rcx, rdi
je 0x14002d06e
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14002d06e
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14005ae58]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14002d08f
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x14002d091
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140194136
Capabilities:
Execute anti-debugging instructions

Disassembly:
not r8w
lea r11, [r14 + r13]
mov dx, 0x1ebc
bt r12d, r14d
mov ebx, 0x22875a50
jmp 0x1401943b0
xchg qword [rsp], rdi
mov rcx, 0x645b0ce7
bsr r12d, r8d
mov rbx, qword [rsp]
mov dx, word [rsp]
call fcn.140194331
mov r9, qword [rsp]
cpuid
mov r11d, dword [rsp]
mov r12w, di
sub rsp, 0x11
jmp 0x1401943ff
jg 0x140194415
sbb r9b, 0x6e
lea rbx, [r11 + r11]
jmp 0x14019447e
sbb r9b, 0x6e
lea rbx, [r11 + r11]
lea rsp, [rsp + 1]
rol r15b, 0
jo 0x140194442
bswap r8d
cmp rbx, 0x29b38a42
not r9b
lea r13, [rsi + r8]
xchg r11d, eax
jmp 0x14019453c
bswap r8d
call 0x14019444b
in al, 0xf9
xchg r13w, ax
bsf rcx, rcx
stc
setg r12b
jmp 0x140194485
lea rsp, [rsp + 1]
jmp 0x140194422
xchg qword [rsp], rax
sub rsp, 0x1b
xchg dword [rsp + 0x14], r12d
mov rcx, 0x6936f25b
lea rsp, [rsp + 0xf]
ror dil, cl
jmp 0x14019458b
xchg rdx, rax
mov bl, byte [rsp]
push qword [rsp + 8]
ret 0x10
push ax
lea rsp, [rsp + 2]
xchg qword [rsp + 8], rax
clc
mov r11w, 0xb1d5
adc dl, r13b
jmp 0x1401944b7
jo 0x140194500
setge al
rdtsc
jmp 0x140194505
setge al
rdtsc
jmp 0x14019451b
rol r15b, 0
mov rbx, rbp
mov r8d, dword [rsp]
bswap rax
mov r11w, r13w
jmp 0x140194558
rdtsc
ror ecx, cl
jmp 0x1401944e5
mov r8w, r14w
bsf r12w, bx
jmp 0x1401945d7
mov r11b, byte [rsp]
stc
jbe 0x140194542
mov r8w, r14w
jmp 0x140194569
bsf r12w, bx
call 0x1401945bd
setae cl
cpuid
mov r9b, byte [rsp]
call fcn.140194666
or cl, byte [rdx + 0x3c8a7f18]
stosd dword [rdi], eax
ret 0x4c7d
lea rsp, [rsp + 4]
lea rax, [rax + riz + 0x17]
ror r9w, 0xb
mov r12, rbx
xchg di, cx
bswap ebx
jmp 0x1401944cd
lea rsp, [rsp + 0x10]
add r15b, 0xc7
push r11w
jmp 0x140194636
mov r9b, byte [rsp]
jmp 0x14019457c
ja 0x140194573
setae cl
cpuid
jmp 0x140194620
Function at 0x140350d9f
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rcx, [rdi + r8]
mov r14b, 0x15
cpuid
mov word [rsp + 0xa], bx
mov dword [rsp + 0xb], r15d
mov esi, dword [rsp + 4]
jmp 0x140350dd9
mov dl, 0x5a
mov r11, rdi
mov rcx, qword [rsp]
rdtsc
xchg dword [rsp + 6], r13d
jmp 0x140350d7c
xchg r15b, cl
mov ebx, esi
cpuid
bsf bp, r8w
inc bl
bsf edx, r12d
jmp 0x140350e03
mov r15b, byte [rsp + 1]
mov dil, dl
pop word [rsp + 0xa]
cld
std
xchg bpl, r13b
jmp 0x140350db1
pop word [rsp + 0x13]
bswap r9
mov r9, rsp
bsf r12, rdi
jmp 0x140350f75
push word [rsp + 5]
mov dword [rsp + 5], r11d
neg ecx
rdtsc
rdtsc
push qword [rsp]
jmp 0x140350ded
add rsp, 0x10
sub rsp, 0x1f
stc
mov r15b, r10b
mov cl, byte [rsp + 0x12]
call fcn.140350e2e
mov r14w, 0xb089
xchg dword [rsp + 7], edx
lea r10, [rsi + riz - 0x3e618e8b]
lea r9, [rbx + rbx]
setge sil
mov r14w, 0x3b5c
jmp 0x140350e48
mov dword [rsp + 0x11], r15d
pop r11w
mov sil, byte [rsp + 4]
push word [rsp + 0xa]
xchg byte [rsp + 5], r14b
push qword [rsp + 0xd]
jmp 0x140350eb5

Function at 0x140350f97
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [rsp + 0x2d], dl
xor cl, 0x6f
lea r9, [rbx + rbx]
mov r14b, byte [rsp + 0x29]
jmp 0x140350fcd
lea r15, [rax*8]
pop word [rsp + 0x11]
lea r13, [r8 + riz - 0xc037]
lea r12, [rdx + riz]
mov byte [rsp + 0x4b], cl
xchg byte [rsp + 0x30], dl
jmp 0x140350fb7

Function at 0x140351006
Capabilities:
Execute anti-debugging instructions

Disassembly:
not r15b
or r12b, r13b
neg r12d
pop rdx
lea rsp, [rsp + 0x13]
jmp 0x140351013
pop qword [rsp + 0x17]
rdtsc
lea r15, [rax + rdi]
jmp 0x140350ff0
mov ecx, dword [rsp + 4]
pop ax
mov r10, rbp
mov r13w, word [rsp]
pop r15w
setno bl
jmp 0x140351044
Function at 0x1403519d6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cl, byte [rsp + 0x1d]
lea r12, [rcx + riz + 0x5831]
mov r11d, r14d
jmp 0x140351a22
add rsp, 0x12
clc
lea rbp, [rdi + r12]
cmc
push word [rsp]
jmp 0x140351a37
pop r13
cpuid
mov r15, 0xffffffffba351252
push ax
pop rdx
lea r15, [r9 + r13]
jmp 0x140351a0c
mov r14, 0x6159b07c
push word [rsp + 2]
mov r11w, ax
jmp 0x140351a90
neg r14d
mov byte [rsp + 3], sil
mov dl, byte [rsp + 4]
bswap r10
mov r15, rsi
lea rsp, [rsp + 3]
jmp 0x140351a6b

Function at 0x140351b8c
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
pop qword [rsp]
mov byte [rsp + 3], bl
xchg qword [rsp], rdi
jmp 0x140351bcf
cmc
mov qword [rsp], r13
sub rsp, 0x1e
xchg dword [rsp + 0x1c], r15d
bswap edx
mov r13, 0xffffffffe4c166c5
jmp 0x140351be7
or eax, r9d
xchg edx, r12d
bsr r15w, cx
rdtsc
setge sil
mov r13, qword [rsp + 4]
jmp 0x140351baf
mov r11b, 0xec
clc
xchg word [rsp + 0x16], r15w
sub rsp, 3
xchg qword [rsp + 6], rbx
mov dword [rsp], ebp
jmp 0x140351c9b
mov word [rsp + 0x2a], bx
mov esi, 0x6ac06057
mov byte [rsp], r10b
mov r12w, word [rsp]
mov rdx, r13
mov r9, qword [rsp + 0x1a]
jmp 0x140351c76
mov r10b, byte [rsp + 0x29]
mov di, 0x12e4
cpuid
mov dword [rsp + 0x13], r11d
mov rbx, qword [rsp + 0x11]
push word [rsp + 0xf]
jmp 0x140351c1f
mov ebp, dword [rsp + 5]
pop word [rsp]
mov rcx, r15
mov rax, rsp
jmp 0x140351d7f
lea rsi, [rdx + riz + 0x9d]
clc
pop qword [rsp + 0x17]
lea rsp, [rsp + 0x21]
add rsp, 0
mov r10w, word [rsp + 1]
jmp 0x140351c60
clc
push word [rsp + 0x22]
setle r12b
xchg qword [rsp + 0x1c], r11
xchg dil, r13b
mov r12w, word [rsp + 2]
jmp 0x140351c44
neg r9
clc
lea rsp, [rsp]
mov byte [rsp], al
mov rbp, r15
jmp 0x140351ceb
mov rdi, r14
xchg r15w, r14w
lea rbp, [r14*8]
rcl r12d, 7
lea r10, [r11*8]
bswap r11d
jmp 0x140351cb5
dec sil
mov cx, di
mov edx, dword [rsp]
add rsp, 0
xchg r15d, edx
rcr dl, 7
jmp 0x140351d49
mov r12b, spl
bsf rdi, rax
add rsp, 3
mov dil, 0x5a
bt r13d, ebx
mov r10, 0xffffffff885027db
jmp 0x140351ccb
mov r10b, bpl
dec rcx
mov r11, r12
call 0x140351d30
mov dword [rax - 0x49], reloc.ADVAPI32.dll_CryptReleaseContext
and al, 7
mov sil, byte [rsp + 2]
jmp 0x140351d60
cpuid
mov bpl, al
not r9w
mov r9, rbx
mov r14d, dword [rsp]
mov r10w, 0xcd26
jmp 0x140351d21
bsr r14, r12
mov dx, 0x4177
mov dword [rsp + 7], ecx
mov dx, word [rsp + 3]
neg ax
mov rbp, qword [rsp + 0xd]
jmp 0x140351dbd
mov dword [rsp], ebp
mov dword [rsp], eax
add ecx, 0x7ea8589b
mov dword [rsp], r13d
cpuid
mov rcx, qword [rsp]
jmp 0x140351d06
mov rbx, qword [rsp + 8]
lea r13, [0x4d7b264]
xchg si, r13w
bswap rcx
mov bp, 0x9ec2
jmp 0x140351de7
bswap r15
bswap r9d
neg rsi
xchg ecx, ebp
mov ebp, r9d
pop qword [rsp]
jmp 0x140351d9a
btc bx, cx
mov dword [rsp], r12d
seto dil
cld
mov r14d, ebx
jmp 0x140351e07
lea rsi, [r14*4]
mov byte [rsp + 5], r9b
add rsp, 2
cpuid
not r11d
lea r10, [rax*4]
jmp 0x140351dd1
bswap ecx
mov dword [rsp], esi
xchg dword [rsp], ebx
lea rsp, [rsp + 5]
xchg r9, r13
mov r12, rdx
jmp 0x140351e51
setle r13b
neg r12w
pop r11w
bswap r13
bswap edi
cmc
jmp 0x140351e3b
Function at 0x140351d30
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
pop qword [rsp]
mov byte [rsp + 3], bl
xchg qword [rsp], rdi
jmp 0x140351bcf
cmc
mov qword [rsp], r13
sub rsp, 0x1e
xchg dword [rsp + 0x1c], r15d
bswap edx
mov r13, 0xffffffffe4c166c5
jmp 0x140351be7
or eax, r9d
xchg edx, r12d
bsr r15w, cx
rdtsc
setge sil
mov r13, qword [rsp + 4]
jmp 0x140351baf
mov r11b, 0xec
clc
xchg word [rsp + 0x16], r15w
sub rsp, 3
xchg qword [rsp + 6], rbx
mov dword [rsp], ebp
jmp 0x140351c9b
mov word [rsp + 0x2a], bx
mov esi, 0x6ac06057
mov byte [rsp], r10b
mov r12w, word [rsp]
mov rdx, r13
mov r9, qword [rsp + 0x1a]
jmp 0x140351c76
mov r10b, byte [rsp + 0x29]
mov di, 0x12e4
cpuid
mov dword [rsp + 0x13], r11d
mov rbx, qword [rsp + 0x11]
push word [rsp + 0xf]
jmp 0x140351c1f
mov ebp, dword [rsp + 5]
pop word [rsp]
mov rcx, r15
mov rax, rsp
jmp 0x140351d7f
lea rsi, [rdx + riz + 0x9d]
clc
pop qword [rsp + 0x17]
lea rsp, [rsp + 0x21]
add rsp, 0
mov r10w, word [rsp + 1]
jmp 0x140351c60
clc
push word [rsp + 0x22]
setle r12b
xchg qword [rsp + 0x1c], r11
xchg dil, r13b
mov r12w, word [rsp + 2]
jmp 0x140351c44
neg r9
clc
lea rsp, [rsp]
mov byte [rsp], al
mov rbp, r15
jmp 0x140351ceb
mov rdi, r14
xchg r15w, r14w
lea rbp, [r14*8]
rcl r12d, 7
lea r10, [r11*8]
bswap r11d
jmp 0x140351cb5
dec sil
mov cx, di
mov edx, dword [rsp]
add rsp, 0
xchg r15d, edx
rcr dl, 7
jmp 0x140351d49
mov r12b, spl
bsf rdi, rax
add rsp, 3
mov dil, 0x5a
bt r13d, ebx
mov r10, 0xffffffff885027db
jmp 0x140351ccb
mov r10b, bpl
dec rcx
mov r11, r12
call 0x140351d30
mov dword [rax - 0x49], reloc.ADVAPI32.dll_CryptReleaseContext
and al, 7
mov sil, byte [rsp + 2]
jmp 0x140351d60
cpuid
mov bpl, al
not r9w
mov r9, rbx
mov r14d, dword [rsp]
mov r10w, 0xcd26
jmp 0x140351d21
bsr r14, r12
mov dx, 0x4177
mov dword [rsp + 7], ecx
mov dx, word [rsp + 3]
neg ax
mov rbp, qword [rsp + 0xd]
jmp 0x140351dbd
mov dword [rsp], ebp
mov dword [rsp], eax
add ecx, 0x7ea8589b
mov dword [rsp], r13d
cpuid
mov rcx, qword [rsp]
jmp 0x140351d06
mov rbx, qword [rsp + 8]
lea r13, [0x4d7b264]
xchg si, r13w
bswap rcx
mov bp, 0x9ec2
jmp 0x140351de7
bswap r15
bswap r9d
neg rsi
xchg ecx, ebp
mov ebp, r9d
pop qword [rsp]
jmp 0x140351d9a
btc bx, cx
mov dword [rsp], r12d
seto dil
cld
mov r14d, ebx
jmp 0x140351e07
lea rsi, [r14*4]
mov byte [rsp + 5], r9b
add rsp, 2
cpuid
not r11d
lea r10, [rax*4]
jmp 0x140351dd1
bswap ecx
mov dword [rsp], esi
xchg dword [rsp], ebx
lea rsp, [rsp + 5]
xchg r9, r13
mov r12, rdx
jmp 0x140351e51
setle r13b
neg r12w
pop r11w
bswap r13
bswap edi
cmc
jmp 0x140351e3b
Function at 0x1800010c0
Capabilities:
Create thread

Disassembly:
mov r11, rsp
sub rsp, 0x68
mov rax, qword [0x18001b020]
xor rax, rsp
mov qword [rsp + 0x40], rax
cmp edx, 1
jne 0x18000125f
mov qword [r11 + 8], rbx
lea r8, [0x180001050]
mov qword [r11 + 0x10], rbp
xor eax, eax
mov qword [r11 + 0x18], rsi
xor r9d, r9d
mov qword [r11 - 8], rdi
xor edx, edx
mov qword [r11 - 0x40], rax
xor ecx, ecx
movaps xmmword [rsp + 0x50], xmm6
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.180001294
mov rbx, rax
call fcn.180001278
cmp rbx, 0x989680
jne 0x180001137
imul rax, rax, 0x64
jmp 0x180001155
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7fffffff4d2fa1ff
cmp rax, rcx
jge 0x18000116e
mov edi, 0xb2d05e00
add rdi, rax
jmp 0x180001178
movabs rdi, 0x7fffffffffffffff
movsd xmm6, qword [0x180017990]
movabs rsi, 0x311cdad160000
movabs rbp, 0x112e0be826d694b3
call fcn.180001294
mov rbx, rax
call fcn.180001278
cmp rbx, 0x989680
jne 0x1800011b0
imul rbx, rax, 0x64
jmp 0x1800011d1
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rbx, rax
imul rax, rcx, 0x3b9aca00
add rbx, rax
cmp rbx, rdi
jge 0x180001243
call fcn.1800013c8
imul rdx, rax, 0x64
xorps xmm0, xmm0
mov rax, rdi
sub rax, rbx
lea rcx, [rdx + rsi]
cvtsi2sd xmm0, rax
comisd xmm0, xmm6
seta r8b
test r8b, r8b
jne 0x180001202
lea rcx, [rax + rdx]
add rax, rdx
add rdx, rsi
test r8b, r8b
cmove rdx, rax
mov rax, rbp
imul rdx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3b9aca00
mov qword [rsp + 0x30], rdx
sub ecx, eax
mov dword [rsp + 0x38], ecx
lea rcx, [rsp + 0x30]
call fcn.1800013f8
jmp 0x180001194
movaps xmm6, xmmword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov eax, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180001670
add rsp, 0x68
ret
Function at 0x18000a55c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18000a58c
xor eax, eax
jmp 0x18000a64f
mov rbp, rbx
cmp word [rax], si
je 0x18000a5b1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18000a598
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18000a594
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18000a47c
movsxd r14, eax
test eax, eax
jne 0x18000a5ef
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18000a585
mov rcx, r14
call fcn.18000a854
mov rdi, rax
test rax, rax
jne 0x18000a608
xor ecx, ecx
call fcn.1800072cc
jmp 0x18000a5e4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18000a47c
test eax, eax
jne 0x18000a639
mov rcx, rdi
call fcn.1800072cc
jmp 0x18000a643
xor ecx, ecx
call fcn.1800072cc
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x180003d20
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x70
lea rbx, [rcx + 0x40]
xor r8d, r8d
lea rcx, [0x1800a65f0]
xor edx, edx
lea r9, [rsp + 0x88]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x180003e34
mov rcx, qword [rsp + 0x88]
mov rax, 0xffffffffffffffff
mov qword [rsp + 0x20], rcx
inc rax
cmp word [rcx + rax*2], 0
jne 0x180003d60
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
call fcn.180014310
lea rax, [rsp + 0x30]
cmp rbx, rax
je 0x180003de4
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x180003dc7
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x180003dc2
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180003eb6
mov rcx, r8
call fcn.180077b0c
movups xmm0, xmmword [rsp + 0x30]
xor ecx, ecx
movups xmm1, xmmword [rsp + 0x40]
mov word [rsp + 0x30], cx
movups xmmword [rbx], xmm0
lea eax, [rcx + 7]
movups xmmword [rbx + 0x10], xmm1
jmp 0x180003de9
mov rax, qword [rsp + 0x48]
cmp rax, 8
jb 0x180003e26
mov rcx, qword [rsp + 0x30]
lea rdx, [rax*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003e21
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003eb6
call fcn.180077b0c
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
call fcn.1800762c0
lea rcx, str.Sakura
mov qword [rsp + 0x28], 6
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x50]
mov edx, eax
call fcn.1800036b0
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1800038f0
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x180003eaa
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003ea5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003eb0
call fcn.180077b0c
add rsp, 0x70
pop rbx
ret
call fcn.1800877cc
int3
call fcn.1800877cc
int3

Function at 0x180019c70
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x180019ccd
lea rbx, [0x1800b2890]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180019cb4
cmp r10, 2
jb 0x180019cb4
cmp byte [r9], r8b
jne 0x180019cb4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180019c90
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x180019d0f
lea rbx, [0x1800b2890]
cmp r8b, 0x23
jne 0x180019cf3
cmp byte [r9], r8b
jne 0x180019cf3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180019ce0
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x180019e50
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x180019e6a
mov qword [r8], 0
lea rdx, [0x1800ddb90]
call fcn.180019d20
mov rbx, rax
test rax, rax
jne 0x180019e8a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call fcn.180087e6c
mov esi, eax
cmp eax, 0xffffffff
je 0x180019f58
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.18008738c
test eax, eax
jne 0x180019f58
mov rcx, rbx
call fcn.180087e6c
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x180019f58
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.18008738c
test eax, eax
jne 0x180019f58
cmp rdi, 0xffffffffffffffff
je 0x180019f58
mov rax, qword [0x1800f6b70]
test rax, rax
je 0x180019efa
inc dword [rax + 0xf0]
mov rcx, rdi
call fcn.18008ad38
mov rsi, rax
test rax, rax
je 0x180019f58
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.180086fbc
mov rcx, rbx
cmp rax, rdi
je 0x180019f46
call fcn.1800823b8
mov rax, qword [0x1800f6b70]
test rax, rax
je 0x180019f3c
dec dword [rax + 0xf0]
mov rcx, rsi
call fcn.180086b98
jmp 0x180019f60
call fcn.1800823b8
test r14, r14
je 0x180019f53
mov qword [r14], rdi
mov rax, rsi
jmp 0x180019f62
mov rcx, rbx
call fcn.1800823b8
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret