joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003da70
Capabilities:
Parse pe header

Disassembly:
movzx eax, word [rcx]
cmp eax, 0x5a4d
jne 0x14003daa2
movsxd rax, dword [rcx + 0x3c]
cmp dword [rcx + rax], 0x4550
jne 0x14003daa2
movzx edx, word [rcx + rax + 0x14]
cmp edx, 0xf0
jne 0x14003daa2
movzx eax, word [rcx + rax + 0x18]
cmp eax, 0x20b
sete al
ret
xor eax, eax
jmp 0x14003daa1

Function at 0x140044f50
Capabilities:
Create pipe

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r14, qword [rsp + 0xc8]
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [r14], 0xffffffffffffffff
mov esi, 5
cmp ecx, 3
jne 0x140045034
mov edi, dword [rsp + 0xc0]
mov r11d, dword [rsp + 0xb8]
mov ecx, dword [rsp + 0xb0]
mov eax, dword [rsp + 0xa8]
mov r10d, dword [rsp + 0xa0]
cmp qword [r8 + 0x18], 8
jb 0x140044fb6
mov r8, qword [r8]
mov rsi, qword [rdx]
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], ecx
mov qword [rsp + 0x38], 0
mov rcx, r8
mov edx, r9d
mov r8d, r10d
mov r9d, eax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp rax, 0xffffffffffffffff
je 0x14004504f
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r15d, r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
mov dword [rsp + 0x30], 3
lea rbx, [rsp + 0x40]
mov rcx, rax
mov rdx, rdi
mov r8, rsi
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp eax, 1
sbb r15, r15
or r15, qword [rbx]
mov qword [r14], r15
xor eax, eax
cmp r15, 0xffffffffffffffff
sete al
lea esi, [rax + rax*4]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14002c610
mov eax, esi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov r15, 0xffffffffffffffff
jmp 0x140045025

Function at 0x140046d40
Capabilities:
Read file via mapping

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov edi, edx
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov dword [rsp + 0x20], edx
mov qword [rsp + 0x28], 0
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8d, 0x8000004
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, rsi
mov rdx, rax
call fcn.140001b90
mov rcx, qword [rsi]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x140046daa
mov eax, edi
mov qword [rsp + 0x20], rax
mov edx, 6
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 8], rax
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x140049b40
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov edi, ecx
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea eax, [rdi - 7]
mov ebp, 5
cmp eax, 0xfffffffe
jae 0x140049b9a
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14002c610
mov eax, ebp
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14, r8
mov r15, rdx
mov r12, qword [rsp + 0x130]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
xor r13d, r13d
mov qword [rsp + 0xb0], r13
mov dword [rsp + 0x50], 0x68
cmp qword [r9 + 0x18], 8
jb 0x140049bef
mov r9, qword [r9]
mov rcx, r9
call qword [sym.imp.mozglue.dll__wcsdup]
mov rsi, rax
mov rax, qword [r12 + 0x10]
cmp qword [r12 + 0x18], 8
jb 0x140049c0c
mov r12, qword [r12]
mov rbx, qword [rsp + 0x138]
test rax, rax
cmove r12, rax
cmp qword [r14 + 0x18], 8
jb 0x140049c25
mov r14, qword [r14]
mov r15, qword [r15]
mov qword [rsp + 0x48], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
mov rcx, r14
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebp, 5
test eax, eax
je 0x140049cfb
cmp edi, 6
mov r12d, 0x1fffff
mov r13d, 0x101c01
cmove r13d, r12d
mov r14, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x20], r13d
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0
mov rcx, rax
mov rdx, r14
mov r8, r15
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x140049d12
cmp edi, 6
mov ebp, 0x100c43
cmove ebp, r12d
mov rdi, qword [rbx + 8]
add rbx, 8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0
mov rcx, rax
mov rdx, rdi
mov r8, r15
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea ebp, [rcx + rcx*4]
test rsi, rsi
je 0x140049b74
mov rcx, rsi
call qword [sym.imp.mozglue.dll_free]
jmp 0x140049b74
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140049cfb
Function at 0x140049d20
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rax, r8
mov r8, rdx
mov rdi, rcx
mov rsi, qword [rsp + 0x88]
mov edx, dword [rsp + 0x80]
xor r14d, r14d
mov qword [rsi], r14
mov rcx, qword [rcx]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], r9
xor edx, edx
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x140049dac
mov rbx, rax
mov rdi, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x30], 3
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea eax, [rcx + rcx*4]
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x1400511c0
Capabilities:
Check for software breakpoints
Get system information on windows
Parse credit card information

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
cmp byte [rcx + 0x1c], 0
jne 0x140023fb6
mov r15, qword [r14 + 0x20]
lea rcx, [0x1400596f0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp byte [r14 + 0x1c], 0
jne 0x140023fb6
xor ecx, ecx
cmp r15, rax
sete cl
bts rcx, 0x20
mov qword [r14 + 0x18], rcx
mov rcx, r14
mov rdx, rbx
mov r8, rdi
mov r9, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.140004150
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x140051226
mov rsi, r9
mov rdi, r8
mov r14, rdx
and rcx, 0xfffffffffffffffc
call fcn.140051240
test al, al
je 0x140051226
mov rcx, qword [rbx + 0x20]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140051226
mov r14, rax
mov rcx, rax
call fcn.140051240
test al, al
je 0x140051226
mov rcx, rbx
mov rdx, r14
mov r8, rdi
mov r9, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x140023f70
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140051840
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov eax, dword [0x140064af4]
mov ecx, dword [0x1400624b8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400518e3
mov r14, qword [rsi + 0x10]
test r14, r14
je 0x1400518bf
mov r15, qword [rsi + 8]
shl r14, 4
add r14, r15
mov edi, dword [0x140064af0]
lea rbx, [rsp + 0x20]
mov r12, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [r15]
mov rcx, qword [r15 + 8]
mov rdx, rdi
mov r9, rbx
call r12
add r15, 0x10
cmp r15, r14
jne 0x1400518a6
mov qword [rsi + 0x10], 0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14002c610
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [0x140064af4]
call fcn.14002b4a4
cmp dword [0x140064af4], 0xffffffff
jne 0x140051880
lea rdi, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 4]
mov dword [0x140064af0], eax
lea rcx, [0x140064af4]
call fcn.14002b444
jmp 0x140051880

Function at 0x140051920
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov r14, qword [rcx + 8]
lea rbx, [r14 + 2]
call fcn.1400159a0
mov r8d, eax
mov rax, r14
xor edx, edx
div r8
mov rcx, rax
mov rax, rbx
xor edx, edx
div r8
cmp rcx, rax
je 0x140051963
mov rcx, rbx
call fcn.140051240
test al, al
je 0x1400519b6
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
add r8, 2
mov qword [rsi], rdx
mov qword [rsi + 8], r8
mov qword [rsi + 0x10], 8
xor eax, eax
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], 0x20
lea rax, [rsi + 0x38]
mov qword [rsi + 0x20], rax
mov byte [rsi + 0x58], 1
add rsi, 0x60
mov r9d, 8
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140007c90
mov rax, qword [rdi]
mov qword [rsi], rax
xor ecx, ecx
mov qword [rsi + 0x28], rcx
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
mov qword [rsi + 0x18], rcx
mov qword [rsi + 0x30], 0x20
lea rdx, [rsi + 0x38]
mov qword [rsi + 0x20], rdx
mov byte [rsi + 0x58], 0
mov qword [rsi + 0x60], rax
mov qword [rsi + 0x70], rcx
mov qword [rsi + 0x78], 2
lea rax, [rsi + 0x80]
mov qword [rsi + 0x68], rax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140011258
Capabilities:
Terminate process

Disassembly:
jmp 0x140013a20
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400112e9
Capabilities:
Execute command

Disassembly:
jmp 0x140012370
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001e008]
xor rax, rbp
mov qword [rbp + 0xf8], rax
lea rcx, [0x140024067]
call fcn.140011401
lea rdx, [0x14001ad04]
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_setlocale]
lea rdx, str.How_many_rounds_did_you_win:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011091
lea rdx, [rbp + 4]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
lea rdx, str.How_many_rounds_did_enemy_win:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011091
lea rdx, [rbp + 0x24]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov eax, dword [rbp + 0x24]
cmp dword [rbp + 4], eax
jle 0x140012431
lea rdx, str.You_win_
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011091
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140012454
lea rdx, [0x14001ad68]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011091
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ac50]
call fcn.14001138e
mov eax, edi
mov rcx, qword [rbp + 0xf8]
xor rcx, rbp
call fcn.140011212
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1400112f3
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014d70
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014d90
xor al, al
jmp 0x140014e11
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014da3
xor al, al
jmp 0x140014e11
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014dcd
xor al, al
jmp 0x140014e11
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014de1
xor al, al
jmp 0x140014e11
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014df3
xor al, al
jmp 0x140014e11
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014e0f
xor al, al
jmp 0x140014e11
mov al, 1
add rsp, 0x38
ret
Function at 0x14000720c
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.14000719c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021170]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400205b8]
jmp 0x140007248
cmp qword [rbx + 0x18], rdi
je 0x14000724f
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000723f
jmp 0x140007269
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x1400205b8]
call fcn.140011c68
lea rcx, [0x140021170]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
invalid
cdq
enter 0x66bf, 0xffffffffffffffe9
outsb dx, byte [rsi]
mov ecx, dword [rbx - 0x6f]
jnp 0x14003f623
fimul word [rdx - 0x25b35bdb]
fsubr dword [rax - 0x16]
xchg esi, eax
stosb byte [rdi], al
cwde
wait
fcmovnb st(0), st(6)
pop rax
invalid
mov ds, word [rcx]
sahf
cwde
mov bh, 0x42
mov ecx, 0x61d6d438
fisttp qword [rcx]
leave
sahf
cwde
jp 0x14003f5fa
or al, 0x32
mov eax, 0x33bee59d
in eax, 0xbe
xor eax, dword [rdi - 0x213e617]
in eax, 0xbe
xor eax, dword [rdi - 0x213e617]
rcr dword [rsi], 1
invalid
jae 0x14003f6a8
cli
push rbx
xchg byte [rsi + 0x7371a796], bh
add dword ds:[rdx], 0x42
movsd dword [rdi], dword [rsi]
movsd dword [rdi], dword [rsi]
movsd dword [rdi], dword [rsi]
test dword [rbx + rsi*4 + 4], 0x479e66c2
push rax
push r8
push rbp
push rsi
adc edi, dword [rax]
xchg ecx, eax
cmp esi, dword [rax]
adc ebp, dword [rbx + 0x6c]
imul ebp, dword [rbp + rsi + 0x7a], 0xffffffb3
cmp byte [rbp + rax*2 - 0xb], ah
add al, 0x2c
mov byte [rcx], bl
sbb dword [rbx + 0x5d9fe4ec], edi
pop rbp
sbb dword [rbx + 0x5d9fe4ec], edi
pop rbp
in al, dx
in al, 0x9f
pop rbp
push 0xffffffffd4ce6573
leave
ret 0xa59f

Function at 0x140007284
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov r9, rdx
mov r8, rcx
mov qword [r11 - 0x10], rax
xor edi, edi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x14000734a
lea rcx, [0x140021170]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400205b8]
jmp 0x14000730e
lea rsi, [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14000730b
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx]
lea rcx, [0x1400205b8]
mov rdx, rsi
call fcn.140011c68
jmp 0x14000730e
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400072db
mov rdx, qword [0x14001f120]
lea rcx, [0x1400205b8]
mov rdi, rdx
inc rdx
mov qword [0x14001f120], rdx
lea edx, [rbx + 0x20]
call fcn.140011cb0
lea rcx, [0x140021170]
mov qword [rax], rbp
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop rdi
ret
Function at 0x1400074e0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r12
push r13
push r15
sub rsp, 0x28
xor r15d, r15d
mov r13d, r9d
mov r12d, edx
mov ebp, r15d
cmp edx, 1
jl 0x140007644
mov qword [rsp + 0x50], rbx
test rcx, rcx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x20], r14
lea r14, [0x14001963c]
mov rbx, r14
mov edi, r15d
cmovne rbx, rcx
test r8, r8
cmovne r14, r8
mov rsi, rbx
movzx ecx, word [r14]
test cx, cx
je 0x140007610
cmp word [r14 + 2], di
je 0x140007610
or rax, 0xffffffffffffffff
nop
inc rax
cmp word [r14 + rax*2], di
jne 0x140007550
movsxd r15, eax
nop dword [rax]
mov r8, r15
mov rdx, r14
mov rcx, rbx
call sub.msvcrt.dll_wcsncmp
test eax, eax
je 0x14000757d
cmp word [rbx], bp
je 0x14000757d
add rbx, 2
jmp 0x140007560
inc edi
cmp edi, r12d
je 0x140007592
cmp word [rbx], bp
je 0x14000759b
lea rbx, [rbx + r15*2]
mov rsi, rbx
jmp 0x140007560
mov rbp, rbx
sub rbp, rsi
sar rbp, 1
xor r15d, r15d
mov rcx, rbx
call fcn.140012630
mov r14, qword [rsp + 0x20]
mov edi, eax
test eax, eax
je 0x1400075ca
mov ecx, r13d
call fcn.1400126a0
movsxd r8, ebp
mov rdx, rsi
mov rcx, rax
add r8, r8
call sub.msvcrt.dll_memmove
mov edx, r13d
mov ecx, ebp
call fcn.1400126d0
test edi, edi
mov rdi, qword [rsp + 0x60]
mov rbx, rax
jne 0x1400075ee
movsxd r8, ebp
mov rdx, rsi
mov rcx, rax
call sub.msvcrt.dll_wcsncpy
mov rsi, qword [rsp + 0x58]
movsxd rcx, ebp
mov word [rbx + rcx*2], r15w
mov rbx, qword [rsp + 0x50]
add rsp, 0x28
pop r15
pop r13
pop r12
pop rbp
ret
movzx eax, word [rbx]
cmp ax, cx
je 0x14000761d
test ax, ax
jne 0x140007630
inc edi
cmp edi, edx
je 0x140007636
test ax, ax
je 0x14000759e
lea rsi, [rbx + 2]
add rbx, 2
jmp 0x140007610
mov rbp, rbx
sub rbp, rsi
sar rbp, 1
jmp 0x14000759e
mov ecx, r9d
add rsp, 0x28
pop r15
pop r13
pop r12
pop rbp
jmp fcn.140012810

Function at 0x140008010
Capabilities:
Get thread local storage value

Disassembly:
mov r10, rcx
test rcx, rcx
je 0x140008041
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140008020
mov ecx, 1
mov r9d, r8d
sub ecx, edx
add eax, ecx
mov rcx, r10
mov r8d, eax
jmp 0x140008050
mov ecx, r8d
jmp fcn.140012810
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov ebp, r8d
test r8d, r8d
mov edi, r9d
mov esi, edx
mov rbx, rcx
cmovs ebp, r15d
call fcn.140012630
mov edx, edi
mov ecx, ebp
mov r14d, eax
call fcn.1400126d0
mov rdi, rax
test r14d, r14d
je 0x1400080a1
mov ecx, r14d
call fcn.140012850
mov rbx, rax
test rbx, rbx
je 0x1400080e7
cmp esi, 1
jle 0x1400080c1
nop dword [rax + rax]
cmp word [rbx], r15w
je 0x1400080e7
dec esi
add rbx, 2
cmp esi, 1
jg 0x1400080b0
movzx eax, word [rbx]
test ax, ax
je 0x1400080e7
sub rbx, rdi
nop dword [rax]
test ebp, ebp
je 0x1400080e7
mov word [rdi], ax
movzx eax, word [rbx + rdi + 2]
add rdi, 2
dec ebp
test ax, ax
jne 0x1400080d0
mov ecx, ebp
call fcn.140012900
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov word [rdi], r15w
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14000d914
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x230
xor ebx, ebx
test rcx, rcx
je 0x14000d99e
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call sub.msvcrt.dll_wcsncpy
lea rcx, [rsp + 0x20]
mov word [rsp + 0x228], bx
call sub.msvcrt.dll_wcslen
lea rcx, [rsp + 0x20]
lea rcx, [rcx + rax*2]
lea rax, [rsp + 0x20]
cmp rcx, rax
jbe 0x14000d98a
lea rdx, [rcx - 2]
movzx eax, word [rdx]
sub ax, 0x20
cmp ax, 0x3c
ja 0x14000d98a
movabs r8, 0x1000000000008001
bt r8, rax
jae 0x14000d98a
lea rax, [rsp + 0x20]
mov rcx, rdx
cmp rdx, rax
ja 0x14000d95c
mov word [rcx], bx
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cdqe
jmp 0x14000d9a0
xor eax, eax
add rsp, 0x230
pop rbx
ret

Function at 0x14000d9ac
Capabilities:
Set file attributes

Disassembly:
sub rsp, 0x28
xor eax, eax
test rcx, rcx
je 0x14000d9bd
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cdqe
add rsp, 0x28
ret

Function at 0x14000d9c4
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov edx, ecx
mov ebx, 0x104
mov ecx, ebx
call fcn.1400126d0
mov ecx, ebx
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, str.Kernel32.DLL
mov esi, eax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor r14d, r14d
mov rbp, rax
test rax, rax
je 0x14000da3e
lea rdx, str.GetLongPathNameW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000da35
mov r8d, ebx
mov rdx, rdi
mov rcx, rdi
call rax
mov esi, eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
sub ebx, esi
mov ecx, ebx
call fcn.140012900
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
movsxd rax, esi
mov rsi, qword [rsp + 0x40]
mov word [rdi + rax*2], r14w
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14000da6c
Capabilities:
Delete file

Disassembly:
xor edx, edx
jmp 0x14000da74
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14000da9f
test dl, 2
je 0x14000da92
mov edx, pe_nt_image_headers64
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cdqe
jmp 0x14000daa1
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14000da74
Capabilities:
Delete file
Set file attributes

Disassembly:
xor edx, edx
jmp 0x14000da74
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14000da9f
test dl, 2
je 0x14000da92
mov edx, pe_nt_image_headers64
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cdqe
jmp 0x14000daa1
xor eax, eax
add rsp, 0x20
pop rbx
ret