joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000a2d0
Capabilities:
Check if file exists
Self delete using alternate data streams

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x4f8
mov rbx, rcx
lea rdi, [rsp + 0x448]
xor eax, eax
mov ecx, 0x98
rep stosb byte [rdi], al
mov dword [rsp + 0x448], 0x98
lea rdi, [rsp + 0x240]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x240]
mov qword [rsp + 0x478], rax
mov dword [rsp + 0x480], 0xffff
mov dword [rsp + 0x4a8], 0x10080008
lea rcx, [rsp + 0x448]
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
test eax, eax
je 0x14000a540
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
lea rcx, [rsp + 0x240]
mov edx, 0x10000
xor r8d, r8d
xor r9, r9
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
test r12, r12
je 0x14000a540
xorps xmm0, xmm0
movups xmmword [rsp + 0x4e0], xmm0
mov qword [rsp + 0x4f0], 0
mov dword [rsp + 0x4f0], 8
lea rdi, [rsp + 0x4f4]
lea rsi, str.:wtfbbq
mov ecx, 8
rep movsb byte [rdi], byte [rsi]
mov rcx, r12
mov edx, 3
lea r8, [rsp + 0x4e0]
mov r9d, 0x20
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
test eax, eax
je 0x14000a4ad
test r12, r12
je 0x14000a3f0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
lea rcx, [rsp + 0x240]
mov edx, 0x10000
xor r8d, r8d
xor r9, r9
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
test r12, r12
je 0x14000a540
mov byte [rsp + 0x238], 0
mov byte [rsp + 0x238], 1
mov rcx, r12
mov edx, 4
lea r8, [rsp + 0x238]
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
test eax, eax
je 0x14000a540
test r12, r12
je 0x14000a470
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x240]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14000a540
mov rcx, rbx
lea rdx, str.The_operation_successfully_completed.
lea r8, [0x140019950]
mov r9d, 0x40
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
jmp 0x14000a542
lea rdi, [rsp + 0x38]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rcx, [rsp + 0x38]
mov edx, 0x104
lea r8, str._ls_del
lea r9, [rsp + 0x240]
call fcn.14000e950
lea rcx, [rsp + 0x240]
lea rdx, [rsp + 0x38]
call fcn.14000f7d0
test eax, eax
je 0x14000a523
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x14000a519
mov rcx, rbx
lea rdx, str.Required_run_as_Administrator.
lea r8, str.Error
mov r9d, 0x10
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x14000a540
mov rcx, rbx
call fcn.140002e10
jmp 0x14000a540
mov rcx, rbx
lea rdx, str.The_file_has_been_renamed._nAfter_restarting_the_PC__this_file_can_be_deleted.
lea r8, str.Notification
mov r9d, 0x30
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
add rsp, 0x4f8
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000b160
Capabilities:
Enumerate processes

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x260
mov rbx, rcx
lea rdi, [rsp + 0x20]
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
mov dword [rsp + 0x20], 0x238
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
mov rcx, rsi
lea rdx, [rsp + 0x20]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14000b1f6
nop dword [rax]
nop word [rax + rax]
lea rax, [rsp + 0x4c]
mov r9, rax
mov rcx, rbx
mov edx, 0x180
xor r8, r8
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [0x1400222e0]
movsxd rdx, dword [0x1400232e0]
mov ecx, dword [rsp + 0x28]
mov dword [rax + rdx*4], ecx
add dword [0x1400232e0], 1
mov rcx, rsi
lea rdx, [rsp + 0x20]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14000b1b0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x260
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000ce00
Capabilities:
Enumerate services

Disassembly:
push rbx
push rsi
push rdi
push r12
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rbx, rcx
xor ecx, ecx
xor edx, edx
mov r8d, 4
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rsi, rsi
je 0x14000cf0a
mov dword [rbp - 4], 0
mov dword [rbp - 8], 0
mov dword [rbp - 0xc], 0
call fcn.140002fe0
mov edx, 0x3ff
mov ecx, 0x13f
cmp eax, 0x2800
cmovae edi, edx
cmovb edi, ecx
mov qword [rsp + 0x38], 0
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 4]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov rcx, rsi
mov edx, edi
mov r8d, 3
xor r9, r9
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
test eax, eax
jne 0x14000cea3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x14000cf0e
mov edx, dword [rbp - 4]
mov eax, edx
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.14000f5f0
sub rsp, rax
lea rax, [rsp + 0x40]
mov r12, rax
lea rax, [rbp - 0xc]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 4]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edx
mov rcx, rsi
mov edx, edi
mov r8d, 3
mov r9, r12
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
test eax, eax
je 0x14000cf0e
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [rbp - 8], 0
jbe 0x14000cf47
xor edi, edi
jmp 0x14000cf20
xor eax, eax
jmp 0x14000cf4c
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14000cf0a
mov eax, edi
lea rax, [rax + rax*2]
shl rax, 4
mov r9, qword [r12 + rax]
mov rcx, rbx
mov edx, 0x180
xor r8, r8
call qword [sym.imp.USER32.dll_SendMessageW]
add edi, 1
cmp edi, dword [rbp - 8]
jb 0x14000cf20
mov eax, 1
mov rsp, rbp
pop rbp
pop r12
pop rdi
pop rsi
pop rbx
ret

Function at 0x14000d0c0
Capabilities:
Modify service

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
mov esi, edx
xor ecx, ecx
xor edx, edx
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rdi, rdi
je 0x14000d132
mov rcx, rdi
mov rdx, rbx
mov r8d, 2
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x20], esi
mov rcx, rbx
mov edx, 0xc
lea r8, [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x14000d136
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x14000d144
xor eax, eax
jmp 0x14000d144
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000e060
Capabilities:
Query service status
Start service
Stop service

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
xor ecx, ecx
xor edx, edx
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rsi, rsi
je 0x14000e12f
mov rcx, rsi
lea rdx, [0x140022060]
mov r8d, 0x34
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x14000e0b5
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14000e127
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov rcx, rdi
lea rdx, [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov eax, dword [rsp + 0x24]
cmp eax, 1
je 0x14000e10c
cmp eax, 4
jne 0x14000e133
mov rcx, rdi
mov edx, 1
lea r8, [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x14000e133
jmp 0x14000e11e
mov rcx, rdi
xor edx, edx
xor r8, r8
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x14000e133
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call fcn.140002e10
xor eax, eax
jmp 0x14000e141
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x14000e150
Capabilities:
Continue service
Pause service
Query service status

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
xor ecx, ecx
xor edx, edx
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rsi, rsi
je 0x14000e224
mov rcx, rsi
lea rdx, [0x140022060]
mov r8d, 0x44
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x14000e1a5
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14000e21c
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov rcx, rdi
lea rdx, [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov eax, dword [rsp + 0x24]
cmp eax, 4
je 0x14000e1fc
cmp eax, 7
jne 0x14000e228
mov rcx, rdi
mov edx, 3
lea r8, [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x14000e228
jmp 0x14000e213
mov rcx, rdi
mov edx, 2
lea r8, [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x14000e228
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call fcn.140002e10
xor eax, eax
jmp 0x14000e236
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000e240
Capabilities:
Modify service

Disassembly:
push rbx
push rsi
push rdi
push rbp
mov rbp, rsp
sub rsp, 0x68
mov rbx, rcx
xor ecx, ecx
xor edx, edx
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rsi, rsi
je 0x14000e298
mov rcx, rsi
lea rdx, [0x140022060]
mov r8d, 3
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x14000e29f
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14000e37a
xor eax, eax
jmp 0x14000e3f2
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [rbp - 4], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
lea r9, [rbp - 4]
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x14000e2db
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14000e2db
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14000e298
mov r8d, dword [rbp - 4]
mov eax, r8d
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.14000f5f0
sub rsp, rax
lea rax, [rsp + 0x60]
mov rsi, rax
mov rcx, rdi
mov rdx, rsi
lea r9, [rbp - 4]
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x14000e2d0
cmp dword [rsi + 4], 4
jne 0x14000e387
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 0xffffffff
mov r8d, 3
mov r9d, 0xffffffff
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x14000e3e4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call fcn.140002e10
jmp 0x14000e298
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 0xffffffff
mov r8d, 4
mov r9d, 0xffffffff
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
je 0x14000e371
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov rsp, rbp
pop rbp
pop rdi
pop rsi
pop rbx
ret

Function at 0x14000f6b0
Capabilities:
Create thread
Resume thread

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x38
mov rbx, rcx
mov esi, edx
mov rdi, r8
mov ecx, 0x138
call fcn.14000f130
mov r12, rax
test r12, r12
je 0x14000f72e
mov rcx, r12
call fcn.140010700
mov qword [r12 + 0x10], rbx
mov qword [r12 + 0x18], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
mov edx, esi
xor ecx, ecx
lea r8, [0x14000f640]
mov r9, r12
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rbx, rbx
je 0x14000f732
mov qword [r12], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x14000f756
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14000f73a
xor esi, esi
jmp 0x14000f73a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, r12
call fcn.14000f580
test esi, esi
je 0x14000f74d
mov ecx, esi
call fcn.1400103c0
mov rax, 0xffffffffffffffff
jmp 0x14000f759
mov rax, rbx
add rsp, 0x38
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000f7d0
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x14000f7f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400103c0
mov eax, 0xffffffff
jmp 0x14000f7fa
xor eax, eax
add rsp, 0x28
ret

Function at 0x14000f800
Capabilities:
Terminate process

Disassembly:
push rbx
push rsi
sub rsp, 0x88
mov ecx, 0x2000000
call fcn.140012b90
mov qword [0x140023740], rax
call fcn.140010140
test al, al
je 0x14000f907
call fcn.140010630
test al, al
je 0x14000f913
call fcn.140010ca0
call fcn.140010dc0
call fcn.140010e80
call fcn.1400112e0
call fcn.1400113b0
lea rbx, [0x14001e5c0]
lea rax, [0x14001e5c0]
cmp rbx, rax
jae 0x14000f872
call qword [rbx]
add rbx, 8
lea rax, [0x14001e5c0]
cmp rbx, rax
jb 0x14000f860
mov dword [rsp + 0x5c], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
call fcn.1400114b0
movzx edx, word [rsp + 0x60]
mov ecx, 0xa
test dword [rsp + 0x5c], 1
cmovne r9d, edx
cmove r9d, ecx
mov rcx, rbx
xor edx, edx
mov r8, rax
call fcn.14000e8c0
mov ebx, eax
lea rsi, [0x14001e5c0]
lea rax, [0x14001e5c0]
cmp rsi, rax
jae 0x14000f8f2
nop word [rax + rax]
nop word [rax + rax]
call qword [rsi]
add rsi, 8
lea rax, [0x14001e5c0]
cmp rsi, rax
jb 0x14000f8e0
mov ecx, ebx
jmp 0x140011500
mov ecx, 0xfffffffe
call fcn.14000fdf0
jmp 0x14000f91d
mov ecx, 0xfffffffd
call fcn.14000fdf0
add rsp, 0x88
pop rsi
pop rbx
ret
push rbx
sub rsp, 0x20
mov ebx, ecx
mov ecx, 2
call fcn.140010030
cmp qword [0x14001f9e0], 0x50
jb 0x140011550
cmp qword [0x140023d80], 0
je 0x140011580
nop
nop word [rax + rax]
mov rax, qword [0x140023d80]
sub rax, 1
mov qword [0x140023d80], rax
lea rdx, [0x140023da0]
call qword [rdx + rax*8]
jmp 0x140011576
mov rax, qword [0x14001f9e0]
lea rdx, [rax + 1]
mov qword [0x14001f9e0], rdx
lea rdx, [0x140023da0]
call qword [rdx + rax*8]
cmp qword [0x14001f9e0], 0x50
jb 0x140011550
cmp qword [0x140023d80], 0
jne 0x140011530
mov rdx, rsp
xor ecx, ecx
call fcn.1400115a0
mov ecx, ebx
jmp fcn.140012090

Function at 0x14000fdf0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
lea eax, [ecx + 0x13]
cmp eax, 0x11
ja 0x14000fec1
lea rax, [0x14001c940]
lea edx, [ecx + 0x13]
movsxd rdx, edx
jmp qword [rax + rdx*8]
lea rbx, str.CRT:_unexpected_error
cmp ecx, 0xffffffee
je 0x14000ff07
lea rcx, [0x14001fb90]
call fcn.1400100e0
mov rcx, rbx
lea rdx, [0x14001fb90]
call fcn.140012000
lea rcx, str.____terminating_n
lea rdx, [0x14001fb90]
call fcn.140012000
lea rcx, [0x14001fb90]
call fcn.140010110
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14000ff28
int3
mov ecx, 0xff
jmp fcn.140012090

Function at 0x1400100e0
Capabilities:
Terminate process

Disassembly:
test rcx, rcx
je 0x140010103
mov eax, dword [rcx + 0x7c]
cmp eax, 0xff
ja 0x1400100f9
add eax, 0xd
mov ecx, eax
jmp fcn.140010030
mov ecx, 0xfffffffa
jmp fcn.14000fdf0
ret
Function at 0x140010110
Capabilities:
Terminate process

Disassembly:
test rcx, rcx
je 0x140010130
mov eax, dword [rcx + 0x7c]
cmp eax, 0xff
ja 0x140010126
add eax, 0xd
mov ecx, eax
jmp fcn.1400100c0
mov ecx, 0xfffffffa
jmp fcn.14000fdf0
ret

Function at 0x140010630
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
call fcn.14000ff40
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x14001f9b0], eax
cmp eax, 0xffffffff
je 0x140010683
mov ecx, 0x138
call fcn.14000f130
mov rbx, rax
test rbx, rbx
je 0x140010683
mov ecx, dword [0x14001f9b0]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140010683
mov rcx, rbx
call fcn.140010700
mov qword [rbx], 0xffffffffffffffff
mov al, 1
jmp 0x140010685
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x140010790
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
push rsi
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x14001f9b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rsi, rsi
jne 0x1400107e6
mov ecx, 0x138
call fcn.14000f130
mov rsi, rax
test rsi, rsi
je 0x1400107f3
mov ecx, dword [0x14001f9b0]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1400107f3
mov rcx, rsi
call fcn.140010700
mov qword [rsi], 0xffffffffffffffff
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
jmp 0x1400107fd
mov ecx, 0xfffffffb
call fcn.14000fdf0
add rsp, 0x28
pop rsi
pop rbx
ret

Function at 0x140010810
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
push rsi
sub rsp, 0x28
mov rbx, rcx
mov esi, dword [0x14001f9b0]
cmp esi, 0xffffffff
je 0x14001090b
test rbx, rbx
je 0x1400108e9
cmp qword [rbx + 8], 0
je 0x140010841
mov rcx, qword [rbx + 8]
call fcn.140010c40
lea rax, [0x1400237e0]
cmp qword [rbx + 0x20], rax
je 0x140010857
mov rcx, qword [rbx + 0x20]
call fcn.14000f580
mov rcx, qword [rbx + 0x28]
call fcn.14000f580
lea rax, [0x140020460]
cmp qword [rbx + 0x30], rax
je 0x140010876
mov rcx, qword [rbx + 0x30]
call fcn.14000f580
mov rcx, qword [rbx + 0x68]
call fcn.14000f580
mov rcx, qword [rbx + 0x88]
call fcn.14000f580
mov rcx, qword [rbx + 0x90]
call fcn.14000f580
mov rcx, qword [rbx + 0xa8]
call fcn.14000f580
mov rcx, qword [rbx + 0xb0]
call fcn.14000f580
mov rcx, qword [rbx + 0xb8]
call fcn.14000f580
mov rcx, qword [rbx + 0x100]
call fcn.14000f580
mov rcx, qword [rbx + 0x118]
call fcn.14000f580
mov rcx, qword [rbx + 0x120]
call fcn.14000f580
mov rcx, rbx
call fcn.14000f580
jmp 0x1400108fd
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
jne 0x140010831
mov ecx, dword [0x14001f9b0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x28
pop rsi
pop rbx
ret
Function at 0x1400112e0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x240
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rbx, rax
cmp word [rbx], 0
jne 0x140011311
xor ecx, ecx
lea rdx, [rsp + 0x28]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rbx, [rsp + 0x28]
lea rax, [rsp + 0x230]
mov qword [rsp + 0x20], rax
mov rcx, rbx
xor edx, edx
xor r8, r8
lea r9, [rsp + 0x238]
call fcn.1400110e0
mov rsi, qword [rsp + 0x238]
mov rax, rsi
shl rax, 3
mov rdx, qword [rsp + 0x230]
lea rcx, [rax + rdx*2]
call fcn.14000f130
mov rdi, rax
test rdi, rdi
je 0x14001139a
lea rax, [rsp + 0x230]
mov qword [rsp + 0x20], rax
lea r8, [rdi + rsi*8]
mov rcx, rbx
mov rdx, rdi
lea r9, [rsp + 0x238]
call fcn.1400110e0
mov rax, qword [rsp + 0x238]
sub rax, 1
mov dword [0x140023780], eax
mov qword [0x1400237a0], rdi
jmp 0x1400113a4
mov ecx, 0xfffffffc
call fcn.14000fdf0
add rsp, 0x240
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400113b0
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rbx, rax
test rbx, rbx
je 0x140011481
mov rax, rbx
xor edx, edx
cmp word [rax], 0
je 0x140011402
mov rcx, 0xffffffffffffffff
nop dword [rax]
add rcx, 1
cmp word [rax + rcx*2], 0
jne 0x1400113e0
add rcx, 1
cmp word [rax], 0x3d
je 0x1400113f8
add rdx, rcx
lea rax, [rax + rcx*2]
cmp word [rax], 0
jne 0x1400113d2
lea rcx, [rdx + rdx + 2]
call fcn.14000f130
mov qword [0x1400237c0], rax
test rax, rax
je 0x140011499
mov rdx, rax
mov r8, rbx
cmp word [r8], 0
je 0x140011471
mov rax, 0xffffffffffffffff
add rax, 1
cmp word [r8 + rax*2], 0
jne 0x140011430
lea r9, [rax + 1]
cmp word [r8], 0x3d
je 0x140011466
xor ecx, ecx
nop dword [rax]
mov ax, word [r8 + rcx]
mov word [rdx + rcx], ax
add rcx, 2
test ax, ax
jne 0x140011450
lea rdx, [rdx + r9*2]
lea r8, [r8 + r9*2]
cmp word [r8], 0
jne 0x140011429
mov word [rdx], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400114a3
mov ecx, 1
mov edx, 2
call fcn.1400127a0
mov qword [0x1400237c0], rax
jmp 0x1400114a3
mov ecx, 0xfffffffc
call fcn.14000fdf0
add rsp, 0x20
pop rbx
ret

Function at 0x1400114b0
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp word [rax], 0x22
jne 0x1400114de
add rax, 2
mov dx, word [rax]
cmp dx, 0x22
je 0x1400114d2
test dx, dx
jne 0x1400114c0
cmp word [rax], 0x22
jne 0x1400114ea
add rax, 2
jmp 0x1400114ea
cmp word [rax], 0x20
jbe 0x1400114ea
add rax, 2
jmp 0x1400114de
cmp word [rax], 0
je 0x1400114f6
cmp word [rax], 0x20
jbe 0x1400114d8
add rsp, 0x28
ret
Function at 0x140011500
Capabilities:
Terminate process

Disassembly:
push rbx
push rsi
sub rsp, 0x88
mov ecx, 0x2000000
call fcn.140012b90
mov qword [0x140023740], rax
call fcn.140010140
test al, al
je 0x14000f907
call fcn.140010630
test al, al
je 0x14000f913
call fcn.140010ca0
call fcn.140010dc0
call fcn.140010e80
call fcn.1400112e0
call fcn.1400113b0
lea rbx, [0x14001e5c0]
lea rax, [0x14001e5c0]
cmp rbx, rax
jae 0x14000f872
call qword [rbx]
add rbx, 8
lea rax, [0x14001e5c0]
cmp rbx, rax
jb 0x14000f860
mov dword [rsp + 0x5c], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
call fcn.1400114b0
movzx edx, word [rsp + 0x60]
mov ecx, 0xa
test dword [rsp + 0x5c], 1
cmovne r9d, edx
cmove r9d, ecx
mov rcx, rbx
xor edx, edx
mov r8, rax
call fcn.14000e8c0
mov ebx, eax
lea rsi, [0x14001e5c0]
lea rax, [0x14001e5c0]
cmp rsi, rax
jae 0x14000f8f2
nop word [rax + rax]
nop word [rax + rax]
call qword [rsi]
add rsi, 8
lea rax, [0x14001e5c0]
cmp rsi, rax
jb 0x14000f8e0
mov ecx, ebx
jmp 0x140011500
mov ecx, 0xfffffffe
call fcn.14000fdf0
jmp 0x14000f91d
mov ecx, 0xfffffffd
call fcn.14000fdf0
add rsp, 0x88
pop rsi
pop rbx
ret
push rbx
sub rsp, 0x20
mov ebx, ecx
mov ecx, 2
call fcn.140010030
cmp qword [0x14001f9e0], 0x50
jb 0x140011550
cmp qword [0x140023d80], 0
je 0x140011580
nop
nop word [rax + rax]
mov rax, qword [0x140023d80]
sub rax, 1
mov qword [0x140023d80], rax
lea rdx, [0x140023da0]
call qword [rdx + rax*8]
jmp 0x140011576
mov rax, qword [0x14001f9e0]
lea rdx, [rax + 1]
mov qword [0x14001f9e0], rdx
lea rdx, [0x140023da0]
call qword [rdx + rax*8]
cmp qword [0x14001f9e0], 0x50
jb 0x140011550
cmp qword [0x140023d80], 0
jne 0x140011530
mov rdx, rsp
xor ecx, ecx
call fcn.1400115a0
mov ecx, ebx
jmp fcn.140012090

Function at 0x1400142a0
Capabilities:
Get thread local storage value

Disassembly:
mov ecx, dword [rcx + 0x18]
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1400142b0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
sete al
movzx eax, al
add rsp, 0x28
ret