joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001000
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push r14
push r15
mov eax, 0x13e8
call fcn.140003930
sub rsp, rax
mov rax, qword [0x1400281a0]
xor rax, rsp
mov qword [rsp + 0x13d0], rax
mov r15d, edx
lea rax, [rsp + 0x38]
mov rbp, r8
lea rdx, str.SYSTEMCurrentControlSetControlGroupOrderList
xor r14d, r14d
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
lea ebx, [r14 + 1]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400010b6
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x30], 0xfa0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400010ab
mov ebx, dword [rsp + 0x30]
shr ebx, 2
cmp dword [rsp + 0x30], 4
jb 0x1400010ab
mov eax, dword [rsp + 0x40]
inc eax
cmp eax, ebx
cmovb ebx, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
inc ebx
mov dword [rsp + rax*4 + 0x40], 0xdeadbeef
cmp ebx, 1
jbe 0x140001210
mov qword [rsp + 0x1410], rsi
mov qword [rsp + 0x1418], rdi
mov qword [rsp + 0x1428], r12
mov qword [rsp + 0x13e0], r13
lea r12, [rsp + 0x44]
lea rax, [0x14002ab00]
lea r13d, [rbx - 1]
nop dword [rax + rax]
cmp rax, qword [section..data]
mov esi, dword [r12]
jae 0x1400011e3
lea rbx, [0x14002ab18]
nop dword [rax + rax]
cmp dword [rbx + 8], r15d
jne 0x1400011c7
test rbp, rbp
je 0x14000114f
mov rcx, qword [rbx]
mov rdx, rbp
call fcn.140003378
test eax, eax
jne 0x1400011c7
cmp esi, 0xdeadbeef
je 0x14000114f
cmp dword [rbx + 0xc], esi
jne 0x1400011c7
cmp dword [rbx + 0x10], 0
jne 0x1400011c7
mov r9, qword [rbx - 0x10]
lea rdi, [rbx - 0x18]
test r9, r9
je 0x14000117b
mov r8, qword [rdi]
lea rdx, str._s____s__
lea rcx, [rsp + 0xfe0]
call fcn.140003560
jmp 0x1400011a0
mov rax, qword [rdi]
lea r8, [rsp + 0xfe0]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
lea rax, [rax + 1]
mov byte [r8 + rax - 1], dl
test dl, dl
jne 0x140001190
xor r8d, r8d
cmp esi, 0xdeadbeef
mov rcx, rdi
setne r8b
xor edx, edx
test rbp, rbp
setne dl
call fcn.1400015f0
mov dword [rbx + 0x10], 1
inc r14d
add rbx, 0x30
lea rcx, [rbx - 0x18]
cmp rcx, qword [section..data]
jb 0x140001120
lea rax, [0x14002ab00]
add r12, 4
dec r13
jne 0x140001100
mov r13, qword [rsp + 0x13e0]
mov r12, qword [rsp + 0x1428]
mov rdi, qword [rsp + 0x1418]
mov rsi, qword [rsp + 0x1410]
mov eax, r14d
mov rcx, qword [rsp + 0x13d0]
xor rcx, rsp
call fcn.140003990
add rsp, 0x13e8
pop r15
pop r14
pop rbp
pop rbx
ret
Function at 0x140001240
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
call fcn.1400012c0
lea rax, str.Image_path
mov qword [rsp + 0x30], rax
lea rax, str.Display_Name
lea r9, [0x140018438]
mov qword [rsp + 0x28], rax
lea rax, str.Service_Devide
lea r8, str.Group_name
lea rdx, str.Start_Value
lea rcx, str.__12s___25s___10s___30s___50s___40s_n
mov qword [rsp + 0x20], rax
call fcn.140003538
xor edx, edx
mov rcx, rbx
call fcn.140001730
mov edx, 1
mov rcx, rbx
call fcn.140001730
mov edx, 2
mov rcx, rbx
add rsp, 0x40
pop rbx
jmp fcn.140001730
Function at 0x140001c20
Capabilities:
Get file version info

Disassembly:
test ecx, ecx
jne 0x140001da7
mov r11, rsp
sub rsp, 0x178
mov rax, qword [0x1400281a0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
lea rdx, [rsp + 0x50]
mov r8d, 0x104
xor ecx, ecx
mov qword [r11 - 8], r14
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ecx, eax
mov ebx, eax
call fcn.1400044d4
lea rcx, [rsp + 0x50]
mov r8d, ebx
mov r9, rax
xor edx, edx
mov rdi, rax
call sub.VERSION.dll_GetFileVersionInfoA
lea rdx, [0x140018680]
mov rcx, rdi
call fcn.140003050
lea rdx, [0x140018690]
mov rcx, rdi
mov rbx, rax
call fcn.140003050
lea rdx, [0x1400186a0]
mov rcx, rdi
mov rsi, rax
call fcn.140003050
lea rdx, [0x1400186b0]
mov rcx, rdi
mov rbp, rax
call fcn.140003050
lea rdx, [0x1400186c0]
mov rcx, rdi
mov r14, rax
call fcn.140003050
mov rdi, rax
call fcn.140002490
test eax, eax
je 0x140001d30
call fcn.140003cb4
mov qword [rsp + 0x30], rdi
lea rdx, str._n_s_v_s____s_n_s_n_s_n_n
lea rcx, [rax + 0x30]
mov r9, rsi
mov r8, rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rbp
call fcn.14000403c
call fcn.140003cb4
lea rcx, [rax + 0x30]
jmp 0x140001d63
call fcn.140003cb4
mov qword [rsp + 0x30], rdi
lea rdx, str._n_s_v_s____s_n_s_n_s_n_n
lea rcx, [rax + 0x60]
mov r9, rsi
mov r8, rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rbp
call fcn.14000403c
call fcn.140003cb4
lea rcx, [rax + 0x60]
call fcn.140003e9c
mov rdi, qword [rsp + 0x198]
mov rsi, qword [rsp + 0x190]
mov rbp, qword [rsp + 0x188]
mov rbx, qword [rsp + 0x180]
mov r14, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140003990
add rsp, 0x178
ret
Function at 0x140001c28
Capabilities:
Get file version info

Disassembly:
test ecx, ecx
jne 0x140001da7
mov r11, rsp
sub rsp, 0x178
mov rax, qword [0x1400281a0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
lea rdx, [rsp + 0x50]
mov r8d, 0x104
xor ecx, ecx
mov qword [r11 - 8], r14
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ecx, eax
mov ebx, eax
call fcn.1400044d4
lea rcx, [rsp + 0x50]
mov r8d, ebx
mov r9, rax
xor edx, edx
mov rdi, rax
call sub.VERSION.dll_GetFileVersionInfoA
lea rdx, [0x140018680]
mov rcx, rdi
call fcn.140003050
lea rdx, [0x140018690]
mov rcx, rdi
mov rbx, rax
call fcn.140003050
lea rdx, [0x1400186a0]
mov rcx, rdi
mov rsi, rax
call fcn.140003050
lea rdx, [0x1400186b0]
mov rcx, rdi
mov rbp, rax
call fcn.140003050
lea rdx, [0x1400186c0]
mov rcx, rdi
mov r14, rax
call fcn.140003050
mov rdi, rax
call fcn.140002490
test eax, eax
je 0x140001d30
call fcn.140003cb4
mov qword [rsp + 0x30], rdi
lea rdx, str._n_s_v_s____s_n_s_n_s_n_n
lea rcx, [rax + 0x30]
mov r9, rsi
mov r8, rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rbp
call fcn.14000403c
call fcn.140003cb4
lea rcx, [rax + 0x30]
jmp 0x140001d63
call fcn.140003cb4
mov qword [rsp + 0x30], rdi
lea rdx, str._n_s_v_s____s_n_s_n_s_n_n
lea rcx, [rax + 0x60]
mov r9, rsi
mov r8, rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rbp
call fcn.14000403c
call fcn.140003cb4
lea rcx, [rax + 0x60]
call fcn.140003e9c
mov rdi, qword [rsp + 0x198]
mov rsi, qword [rsp + 0x190]
mov rbp, qword [rsp + 0x188]
mov rbx, qword [rsp + 0x180]
mov r14, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140003990
add rsp, 0x178
ret
Function at 0x140001db0
Capabilities:
Get file version info

Disassembly:
test ecx, ecx
jne 0x140001f37
mov r11, rsp
sub rsp, 0x278
mov rax, qword [0x1400281a0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
lea rdx, [rsp + 0x50]
mov r8d, 0x208
xor ecx, ecx
mov qword [r11 - 8], r14
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ecx, eax
mov ebx, eax
call fcn.1400044d4
lea rcx, [rsp + 0x50]
mov r8d, ebx
mov r9, rax
xor edx, edx
mov rdi, rax
call sub.VERSION.dll_GetFileVersionInfoW
lea rdx, [0x1400185c0]
mov rcx, rdi
call fcn.1400030b0
lea rdx, [0x1400185e0]
mov rcx, rdi
mov rbx, rax
call fcn.1400030b0
lea rdx, [0x1400185f8]
mov rcx, rdi
mov rsi, rax
call fcn.1400030b0
lea rdx, [0x140018618]
mov rcx, rdi
mov rbp, rax
call fcn.1400030b0
lea rdx, [0x140018638]
mov rcx, rdi
mov r14, rax
call fcn.1400030b0
mov rdi, rax
call fcn.140002490
test eax, eax
je 0x140001ec0
call fcn.140003cb4
mov qword [rsp + 0x30], rdi
lea rdx, [0x140018650]
lea rcx, [rax + 0x30]
mov r9, rsi
mov r8, rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rbp
call fcn.1400040f4
call fcn.140003cb4
lea rcx, [rax + 0x30]
jmp 0x140001ef3
call fcn.140003cb4
mov qword [rsp + 0x30], rdi
lea rdx, [0x140018650]
lea rcx, [rax + 0x60]
mov r9, rsi
mov r8, rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rbp
call fcn.1400040f4
call fcn.140003cb4
lea rcx, [rax + 0x60]
call fcn.140003e9c
mov rdi, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x290]
mov rbp, qword [rsp + 0x288]
mov rbx, qword [rsp + 0x280]
mov r14, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140003990
add rsp, 0x278
ret
Function at 0x140001db8
Capabilities:
Get file version info

Disassembly:
test ecx, ecx
jne 0x140001f37
mov r11, rsp
sub rsp, 0x278
mov rax, qword [0x1400281a0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
lea rdx, [rsp + 0x50]
mov r8d, 0x208
xor ecx, ecx
mov qword [r11 - 8], r14
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ecx, eax
mov ebx, eax
call fcn.1400044d4
lea rcx, [rsp + 0x50]
mov r8d, ebx
mov r9, rax
xor edx, edx
mov rdi, rax
call sub.VERSION.dll_GetFileVersionInfoW
lea rdx, [0x1400185c0]
mov rcx, rdi
call fcn.1400030b0
lea rdx, [0x1400185e0]
mov rcx, rdi
mov rbx, rax
call fcn.1400030b0
lea rdx, [0x1400185f8]
mov rcx, rdi
mov rsi, rax
call fcn.1400030b0
lea rdx, [0x140018618]
mov rcx, rdi
mov rbp, rax
call fcn.1400030b0
lea rdx, [0x140018638]
mov rcx, rdi
mov r14, rax
call fcn.1400030b0
mov rdi, rax
call fcn.140002490
test eax, eax
je 0x140001ec0
call fcn.140003cb4
mov qword [rsp + 0x30], rdi
lea rdx, [0x140018650]
lea rcx, [rax + 0x30]
mov r9, rsi
mov r8, rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rbp
call fcn.1400040f4
call fcn.140003cb4
lea rcx, [rax + 0x30]
jmp 0x140001ef3
call fcn.140003cb4
mov qword [rsp + 0x30], rdi
lea rdx, [0x140018650]
lea rcx, [rax + 0x60]
mov r9, rsi
mov r8, rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rbp
call fcn.1400040f4
call fcn.140003cb4
lea rcx, [rax + 0x60]
call fcn.140003e9c
mov rdi, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x290]
mov rbp, qword [rsp + 0x288]
mov rbx, qword [rsp + 0x280]
mov r14, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140003990
add rsp, 0x278
ret

Function at 0x1400021e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x168
mov rax, qword [0x1400281a0]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor eax, eax
mov r8, rcx
lea rdx, str.SoftwareSysinternals_s
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], eax
call fcn.140003560
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x140002267
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea rdx, str.EulaAccepted
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x34], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140003990
add rsp, 0x168
ret
Function at 0x140002330
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x1400281a0]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor ebx, ebx
lea r8, [rsp + 0x38]
lea rdx, str.SoftwareMicrosoftwindows_ntcurrentversion
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x40], 0x208
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1400023d3
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, [0x14001e960]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400023c8
lea rdx, [rsp + 0x50]
lea rcx, str.iotuap
call fcn.14000458c
mov ecx, 1
test eax, eax
cmove ebx, ecx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140003990
add rsp, 0x270
pop rbx
ret

Function at 0x1400023f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
lea r8, [rsp + 0x58]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionServerServerLevels
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x14000247a
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
lea rdx, str.NanoServer
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000246f
cmp dword [rsp + 0x40], 4
jne 0x14000246f
mov eax, 1
cmp dword [rsp + 0x48], eax
cmove ebx, eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x140002780
Capabilities:
Accept command line arguments

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0x20
xor ebp, ebp
mov r14, r8
mov rdi, rdx
mov r12, rcx
mov r15d, ebp
test rdx, rdx
je 0x14000286e
test r8, r8
je 0x14000286e
mov qword [rsp + 0x50], rbx
mov ebx, ebp
mov qword [rsp + 0x60], r13
lea r13d, [rbp + 1]
cmp dword [rdx], ebx
jle 0x14000283d
mov qword [rsp + 0x58], rsi
mov esi, ebp
nop dword [rax + rax]
mov rcx, qword [r14 + rsi*8]
lea rdx, [0x14001e910]
call fcn.140003378
test eax, eax
je 0x140002803
mov rcx, qword [r14 + rsi*8]
lea rdx, str._accepteula
call fcn.140003378
test eax, eax
je 0x140002803
inc ebx
inc rsi
cmp ebx, dword [rdi]
jl 0x1400027d0
jmp 0x140002838
mov eax, dword [rdi]
mov r15d, r13d
dec eax
cmp ebx, eax
jge 0x140002836
lea rdx, [r14 + rsi*8]
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rdx + 8]
inc ebx
lea rdx, [rdx + 8]
mov qword [rdx - 8], rax
mov eax, dword [rdi]
dec eax
cmp ebx, eax
jl 0x140002820
dec dword [rdi]
mov rsi, qword [rsp + 0x58]
mov edx, r15d
mov rcx, r12
call fcn.140002950
mov rbx, qword [rsp + 0x50]
test eax, eax
cmovne r15d, r13d
mov r13, qword [rsp + 0x60]
test r15d, r15d
setne bpl
mov eax, ebp
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
xor r8d, r8d
xor edx, edx
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rbp
jmp 0x140002db0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor ebp, ebp
mov r14, r8
mov rdi, rdx
mov r12, rcx
lea r13d, [rbp + 1]
mov r15d, ebp
test rdx, rdx
je 0x140002de3
test r8, r8
jne 0x140002e24
lea rcx, str.Shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.CommandLineToArgvW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140002ead
lea rdi, [0x140029880]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rdi
mov rcx, rax
call rbx
mov r14, rax
mov ebx, ebp
cmp dword [rdi], ebx
jle 0x140002ead
mov qword [rsp + 0x50], rsi
mov rsi, rbp
nop word [rax + rax]
mov rcx, qword [r14 + rsi*8]
lea rdx, [0x14001e8e0]
call fcn.14000458c
test eax, eax
je 0x140002e73
mov rcx, qword [r14 + rsi*8]
lea rdx, [0x14001e8f8]
call fcn.14000458c
test eax, eax
je 0x140002e73
inc ebx
inc rsi
cmp ebx, dword [rdi]
jl 0x140002e40
jmp 0x140002ea8
mov eax, dword [rdi]
mov r15d, r13d
dec eax
cmp ebx, eax
jge 0x140002ea6
lea rdx, [r14 + rsi*8]
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rdx + 8]
inc ebx
lea rdx, [rdx + 8]
mov qword [rdx - 8], rax
mov eax, dword [rdi]
dec eax
cmp ebx, eax
jl 0x140002e90
dec dword [rdi]
mov rsi, qword [rsp + 0x50]
mov edx, r15d
mov rcx, r12
call fcn.140002950
mov rbx, qword [rsp + 0x58]
test eax, eax
cmovne r15d, r13d
test r15d, r15d
setne bpl
mov eax, ebp
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140002db0
Capabilities:
Accept command line arguments

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0x20
xor ebp, ebp
mov r14, r8
mov rdi, rdx
mov r12, rcx
mov r15d, ebp
test rdx, rdx
je 0x14000286e
test r8, r8
je 0x14000286e
mov qword [rsp + 0x50], rbx
mov ebx, ebp
mov qword [rsp + 0x60], r13
lea r13d, [rbp + 1]
cmp dword [rdx], ebx
jle 0x14000283d
mov qword [rsp + 0x58], rsi
mov esi, ebp
nop dword [rax + rax]
mov rcx, qword [r14 + rsi*8]
lea rdx, [0x14001e910]
call fcn.140003378
test eax, eax
je 0x140002803
mov rcx, qword [r14 + rsi*8]
lea rdx, str._accepteula
call fcn.140003378
test eax, eax
je 0x140002803
inc ebx
inc rsi
cmp ebx, dword [rdi]
jl 0x1400027d0
jmp 0x140002838
mov eax, dword [rdi]
mov r15d, r13d
dec eax
cmp ebx, eax
jge 0x140002836
lea rdx, [r14 + rsi*8]
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rdx + 8]
inc ebx
lea rdx, [rdx + 8]
mov qword [rdx - 8], rax
mov eax, dword [rdi]
dec eax
cmp ebx, eax
jl 0x140002820
dec dword [rdi]
mov rsi, qword [rsp + 0x58]
mov edx, r15d
mov rcx, r12
call fcn.140002950
mov rbx, qword [rsp + 0x50]
test eax, eax
cmovne r15d, r13d
mov r13, qword [rsp + 0x60]
test r15d, r15d
setne bpl
mov eax, ebp
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
xor r8d, r8d
xor edx, edx
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rbp
jmp 0x140002db0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor ebp, ebp
mov r14, r8
mov rdi, rdx
mov r12, rcx
lea r13d, [rbp + 1]
mov r15d, ebp
test rdx, rdx
je 0x140002de3
test r8, r8
jne 0x140002e24
lea rcx, str.Shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.CommandLineToArgvW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140002ead
lea rdi, [0x140029880]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rdi
mov rcx, rax
call rbx
mov r14, rax
mov ebx, ebp
cmp dword [rdi], ebx
jle 0x140002ead
mov qword [rsp + 0x50], rsi
mov rsi, rbp
nop word [rax + rax]
mov rcx, qword [r14 + rsi*8]
lea rdx, [0x14001e8e0]
call fcn.14000458c
test eax, eax
je 0x140002e73
mov rcx, qword [r14 + rsi*8]
lea rdx, [0x14001e8f8]
call fcn.14000458c
test eax, eax
je 0x140002e73
inc ebx
inc rsi
cmp ebx, dword [rdi]
jl 0x140002e40
jmp 0x140002ea8
mov eax, dword [rdi]
mov r15d, r13d
dec eax
cmp ebx, eax
jge 0x140002ea6
lea rdx, [r14 + rsi*8]
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rdx + 8]
inc ebx
lea rdx, [rdx + 8]
mov qword [rdx - 8], rax
mov eax, dword [rdi]
dec eax
cmp ebx, eax
jl 0x140002e90
dec dword [rdi]
mov rsi, qword [rsp + 0x50]
mov edx, r15d
mov rcx, r12
call fcn.140002950
mov rbx, qword [rsp + 0x58]
test eax, eax
cmovne r15d, r13d
test r15d, r15d
setne bpl
mov eax, ebp
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x140004ae0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140004948
Function at 0x14003c920
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov dword [rsp + 8], 0xffffffff
mov dword [rsp + 0xc], 0
jmp 0x14003c952
mov eax, dword [rsp + 0xc]
inc eax
mov dword [rsp + 0xc], eax
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0xc], eax
jae 0x14003c9fa
mov eax, dword [rsp + 0xc]
mov rcx, qword [rsp]
movzx eax, byte [rcx + rax]
movzx ecx, byte [rsp + 8]
xor eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 8]
shr eax, 8
mov dword [rsp + 8], eax
mov dword [rsp + 0x14], 0
jmp 0x14003c996
mov eax, dword [rsp + 0x14]
inc eax
mov dword [rsp + 0x14], eax
cmp dword [rsp + 0x14], 8
jge 0x14003c9e5
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x14003c9b2
mov dword [rsp + 0x1c], 1
jmp 0x14003c9ba
mov dword [rsp + 0x1c], 0
movzx eax, byte [rsp + 0x1c]
mov byte [rsp + 0x18], al
mov eax, dword [rsp + 0x10]
shr eax, 1
mov dword [rsp + 0x10], eax
movzx eax, byte [rsp + 0x18]
test eax, eax
je 0x14003c9e3
mov eax, dword [rsp + 0x10]
xor eax, 0xedb88320
mov dword [rsp + 0x10], eax
jmp 0x14003c98c
mov eax, dword [rsp + 0x10]
mov ecx, dword [rsp + 8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 8], eax
jmp 0x14003c948
mov eax, dword [rsp + 8]
not eax
add rsp, 0x28
ret

Function at 0x14003cff0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process filename

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x40], 0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x50], rax
mov eax, 0x6b
mov word [rsp + 0x20], ax
mov eax, 0x65
mov word [rsp + 0x22], ax
mov eax, 0x72
mov word [rsp + 0x24], ax
mov eax, 0x6e
mov word [rsp + 0x26], ax
mov eax, 0x65
mov word [rsp + 0x28], ax
mov eax, 0x6c
mov word [rsp + 0x2a], ax
mov eax, 0x33
mov word [rsp + 0x2c], ax
mov eax, 0x32
mov word [rsp + 0x2e], ax
mov eax, 0x2e
mov word [rsp + 0x30], ax
mov eax, 0x64
mov word [rsp + 0x32], ax
mov eax, 0x6c
mov word [rsp + 0x34], ax
mov eax, 0x6c
mov word [rsp + 0x36], ax
xor eax, eax
mov word [rsp + 0x38], ax
lea rdx, [rsp + 0x20]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x60]
call fcn.14003ca10
test eax, eax
jne 0x14003d0c3
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x40], rax
jmp 0x14003d0ec
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x30], 0
je 0x14003d0ec
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x10]
cmp qword [rsp + 0x50], rax
jne 0x14003d09c
mov rax, qword [rsp + 0x40]
add rsp, 0x68
ret
Function at 0x1408ba0f0
Capabilities:
Terminate process

Disassembly:
and al, 0x21
leave
in al, dx
retf
cld
pop r11
jmp 0x1408ba0fd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1408ba10d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1408ba0f5
lea eax, [rcx + 1]
jmp 0x1408ba11b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1408ba12e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1408ba114
sub eax, 3
jb 0x1408ba14e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1408ba19d
sar eax, 1
movsxd rbp, eax
jb 0x1408ba184
jmp 0x1408ba15c
add ebx, ebx
jne 0x1408ba15a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1408ba184
inc ecx
add ebx, ebx
jne 0x1408ba16a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1408ba184
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1408ba17d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1408ba16c
add ecx, 2
jmp 0x1408ba189
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1408ba0b2
jmp 0x1408ba0fd
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0x8b7000]
mov eax, dword [rdi]
or eax, eax
je 0x1408ba209
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x8ba1e4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1408ba1ad
jns 0x1408ba1e2
movzx rdx, word [rdi]
add rdi, 2
jmp 0x1408ba1ec
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1408ba203
mov qword [rbx], rax
add rbx, 8
jmp 0x1408ba1cd
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1408ba24d
cmp al, 0xef
ja 0x1408ba235
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1408ba215
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x1408ba224
mov eax, dword [rdi]
add rdi, 4
jmp 0x1408ba224
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x24f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1408ba2a1
sub rsp, 0xffffffffffffff80
jmp 0x140894378