joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140029bb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov eax, dword [rcx + 0x220]
cmp eax, 0xffffffff
jne 0x140029d3d
xor r14d, r14d
mov dword [rbp + 0x20], r14d
mov dword [rbp - 0x30], 4
test r9, r9
je 0x140029bff
cmp word [r9], r14w
jne 0x140029c06
lea r9, str.MaxLogSize
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x1400739d0]
movdqu xmmword [rbp - 0x10], xmm1
mov word [rbp - 0x20], r14w
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [r9 + r8*2], r14w
jne 0x140029c30
mov rdx, r9
lea rcx, [rbp - 0x20]
call fcn.14000fea0
nop
test rsi, rsi
je 0x140029c93
mov dword [rbp - 0x2c], r14d
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x2c]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140029c93
mov eax, dword [rbp + 0x20]
test eax, eax
je 0x140029c93
mov dword [rbx + 0x220], eax
jmp 0x140029ce9
test rdi, rdi
je 0x140029cdf
mov dword [rbp - 0x2c], r14d
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x2c]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140029cdf
mov eax, dword [rbp + 0x20]
test eax, eax
je 0x140029cdf
mov dword [rbx + 0x220], eax
jmp 0x140029ce9
mov dword [rbx + 0x220], 0x800
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x140029d25
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029d20
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140029d52
call fcn.140025d80
movdqa xmm0, xmmword [0x1400739d0]
movdqu xmmword [rbp - 0x10], xmm0
mov word [rbp - 0x20], r14w
mov eax, dword [rbx + 0x220]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.14004e3b0
int3
Function at 0x140029eb0
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x98], rbx
mov r14, rdx
mov rdi, rcx
xor r15d, r15d
mov dword [rbp - 0x40], r15d
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], 7
mov word [rcx], r15w
mov dword [rbp - 0x40], 1
lea rdx, [rbp + 0x48]
mov rcx, r14
call sub.api_ms_win_core_version_l1_1_1.dll_GetFileVersionInfoSizeW
mov esi, eax
test eax, eax
je 0x14002a0b4
mov ecx, esi
call fcn.140026650
mov rbx, rax
mov qword [rbp - 0x28], rax
test rax, rax
je 0x14002a0a7
mov r9, rax
mov r8d, esi
mov edx, dword [rbp + 0x48]
mov rcx, r14
call sub.api_ms_win_core_version_l1_1_1.dll_GetFileVersionInfoW
test eax, eax
je 0x14002a0a7
mov qword [rbp - 0x38], r15
mov dword [rbp + 0x40], r15d
lea r9, [rbp + 0x40]
lea r8, [rbp - 0x38]
lea rdx, str.StringFileInfo040904E4ProductName
mov rcx, rbx
call sub.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW
test eax, eax
je 0x140029fef
mov eax, dword [rbp + 0x40]
test eax, eax
je 0x140029fef
mov r8d, eax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x1400739d0]
movdqu xmmword [rbp - 0x10], xmm1
mov word [rbp - 0x20], r15w
mov rdx, qword [rbp - 0x38]
lea rcx, [rbp - 0x20]
call fcn.14000fea0
nop
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.140014780
nop
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x14002a095
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a090
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a0d1
jmp 0x14002a090
mov qword [rbp - 0x38], r15
mov dword [rbp + 0x40], r15d
lea r9, [rbp + 0x40]
lea r8, [rbp - 0x38]
lea rdx, str.StringFileInfo040904B0ProductName
mov rcx, rbx
call sub.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW
test eax, eax
je 0x14002a0a7
mov eax, dword [rbp + 0x40]
test eax, eax
je 0x14002a0a7
mov r8d, eax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x1400739d0]
movdqu xmmword [rbp - 0x10], xmm1
mov word [rbp - 0x20], r15w
mov rdx, qword [rbp - 0x38]
lea rcx, [rbp - 0x20]
call fcn.14000fea0
nop
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.140014780
nop
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x14002a095
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a090
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a0cb
call fcn.140025d80
movdqa xmm0, xmmword [0x1400739d0]
mov word [rbp - 0x20], r15w
movdqu xmmword [rbp - 0x10], xmm0
test rbx, rbx
je 0x14002a0b4
mov rcx, rbx
call fcn.140025d80
mov rax, rdi
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.14004e3b0
int3
call fcn.14004e3b0
int3
Function at 0x14002b8e0
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rsi
mov rdi, rdx
mov rsi, qword [rdx + 0x18]
mov rax, qword [rdx + 0x38]
add rax, 0xa
add rsi, rax
mov eax, 2
mul rsi
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140026650
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14002b970
lea rax, [rdi + 0x28]
cmp qword [rax + 0x18], 8
jb 0x14002b941
mov rax, qword [rax]
lea r9, [rdi + 8]
cmp qword [r9 + 0x18], 0x10
jb 0x14002b94f
mov r9, qword [r9]
mov qword [rsp + 0x20], rax
lea r8, str._S_:__s_r_n
mov rdx, rsi
mov rcx, rbx
call fcn.14002c0b0
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
nop
test rbx, rbx
je 0x14002b97d
mov rcx, rbx
call fcn.140025d80
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14002b990
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov eax, dword [rdx + 0x48]
mov rbx, rdx
mov rdi, rcx
cmp eax, dword [rcx + 8]
jl 0x14002ba2c
cmp eax, 5
jg 0x14002ba2c
mov rcx, rdx
call fcn.140029780
cmp qword [rax + 0x18], 8
jb 0x14002b9c3
mov rax, qword [rax]
mov r9d, dword [rbx + 0x48]
mov r10d, 1
mov qword [rsp + 0x60], rax
cmp r9d, 2
jl 0x14002b9f7
cmp r9d, 3
jle 0x14002b9f7
cmp r9d, 4
je 0x14002b9f0
cmp r9d, 5
jne 0x14002b9f7
movzx eax, r10w
jmp 0x14002b9fc
mov eax, 2
jmp 0x14002b9fc
mov eax, 4
xor edx, edx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x40], rdx
xor r8d, r8d
mov qword [rsp + 0x38], rcx
mov rcx, qword [rdi + 0x18]
mov dword [rsp + 0x30], edx
mov word [rsp + 0x28], r10w
mov qword [rsp + 0x20], rdx
movzx edx, ax
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x14002ba40
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
sub rsp, 0x38
cmp word [rcx + 0x18], 0
mov rsi, rdx
mov rdi, rcx
je 0x14002bb3b
mov qword [rsp + 0x58], rbx
mov rbx, qword [rcx + 0x248]
test rbx, rbx
je 0x14002bb42
cmp byte [rcx + 0x228], 0
je 0x14002bb42
mov qword [rsp + 0x60], rbp
lea rcx, [rbx + 0x28]
mov qword [rsp + 0x30], r14
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
mov rax, qword [rbx]
mov r9, rsi
mov rcx, rbx
mov rdi, qword [rax]
mov rdx, rdi
mov r14, qword [rdi + 8]
mov r8, r14
call fcn.140027340
mov rdx, rax
movabs rcx, 0x1745d1745d1745c
mov rax, qword [rbx + 8]
sub rcx, rax
cmp rcx, 1
jb 0x14002bb69
inc rax
mov qword [rbx + 8], rax
mov qword [rdi + 8], rdx
mov qword [r14], rdx
cmp byte [rbx + 0x18], 0
jne 0x14002bb22
mov rcx, qword [rbx + 0x20]
xor edi, edi
test rcx, rcx
je 0x14002baf0
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [rbx + 0x20], rdi
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x28], rax
lea r8, [0x14002c4e0]
mov r9, rbx
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call fcn.14005a2e0
test rax, rax
mov qword [rbx + 0x20], rax
setne al
mov byte [rbx + 0x18], al
lea rcx, [rbx + 0x28]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov rbp, qword [rsp + 0x60]
mov r14, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x58]
add rsp, 0x38
pop rdi
pop rsi
ret
call fcn.14002b7e0
test eax, eax
je 0x14002bb36
mov rdx, rsi
mov rcx, rdi
call fcn.14002c9b0
mov rcx, rdi
mov rbx, qword [rsp + 0x58]
add rsp, 0x38
pop rdi
pop rsi
jmp fcn.140029000
lea rcx, str.list_T__too_long
call fcn.140022d30
int3

Function at 0x14002c180
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x230
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14002c238
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x200
call fcn.14004b830
lea rax, [rsp + 0x258]
mov dword [rsp + 0x258], 0x100
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x240]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x240], 0
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14002c238
cmp dword [rsp + 0x240], 1
jne 0x14002c238
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14002c214
test r8, r8
je 0x14002c238
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14000fea0
mov eax, 1
jmp 0x14002c23a
xor eax, eax
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14002c9b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x230], 0
mov rbx, rdx
mov rdi, rcx
je 0x14002ca84
mov r9d, dword [rcx + 0x224]
mov eax, dword [rcx + 0x220]
mov qword [rsp + 0x30], rsi
lea r8d, [rax + rax*4]
add r8d, r8d
lea eax, [r9 + 1]
mov dword [rcx + 0x224], eax
cmp r9d, r8d
jle 0x14002ca1e
xor edx, edx
call fcn.14002a0e0
test al, al
je 0x14002ca0d
mov dword [rdi + 0x224], 0
jmp 0x14002ca1e
mov eax, dword [rdi + 0x224]
cdq
sub eax, edx
sar eax, 1
mov dword [rdi + 0x224], eax
mov rcx, rbx
call fcn.140029780
mov rcx, rbx
mov rsi, qword [rax + 0x10]
call fcn.140029780
cmp qword [rax + 0x18], 8
jb 0x14002ca3c
mov rax, qword [rax]
mov r9, qword [rdi + 0x230]
mov r8, rsi
mov edx, 2
mov rcx, rax
call fcn.140051be0
mov r9, qword [rdi + 0x230]
mov edx, 2
mov rcx, qword [str.t._b_]
mov rbx, rax
lea r8d, [rdx - 1]
call fcn.140051be0
mov rsi, qword [rsp + 0x30]
add eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x14002d620
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x208]
sub rsp, 0x2f0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rdi, r8
mov rbx, rdx
xor r14d, r14d
test r8, r8
jne 0x14002d65e
mov eax, 0x80004003
jmp 0x14002d79c
test rbx, rbx
je 0x14002d794
cmp r14w, word [rdx]
je 0x14002d794
mov dword [r8], r14d
mov qword [rbp + 0x220], r14
mov qword [rsp + 0x58], r14
lea rax, vtable.std::_Func_impl_no_alloc_class__lambda_07a4580a2d41a7635afdf5f0258b0c87___void___.0
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x220]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov qword [rbp + 0x228], rax
mov qword [rbp - 0x58], r14
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14002d6fb
lea rax, [rsp + 0x20]
cmp rcx, rax
jne 0x14002d6f2
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rbp - 0x58], rax
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14002d6fb
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x14002d6f6
mov qword [rbp - 0x58], rcx
mov qword [rsp + 0x58], r14
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14002d71b
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rsp + 0x58], r14
xor edx, edx
lea ecx, [rdx + 2]
call sub.api_ms_win_core_toolhelp_l1_1_0.dll_CreateToolhelp32Snapshot
mov rsi, rax
mov qword [rbp + 0x220], rax
cmp rax, 0xffffffffffffffff
je 0x14002d785
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp - 0x4c]
call fcn.14004b830
mov dword [rbp - 0x50], 0x238
lea rdx, [rbp - 0x50]
mov rcx, rsi
call sub.api_ms_win_core_toolhelp_l1_1_0.dll_Process32FirstW
test eax, eax
je 0x14002d785
mov rdx, rbx
lea rcx, [rbp - 0x24]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
test eax, eax
je 0x14002d780
lea rdx, [rbp - 0x50]
mov rcx, qword [rbp + 0x220]
call sub.api_ms_win_core_toolhelp_l1_1_0.dll_Process32NextW
jmp 0x14002d759
mov ecx, dword [rbp - 0x48]
mov dword [rdi], ecx
lea rcx, [rsp + 0x70]
call fcn.14002d550
mov eax, r14d
jmp 0x14002d79c
mov dword [r8], r14d
mov eax, 0x80070057
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14002d7c0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x208]
sub rsp, 0x2f0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov rdi, rdx
test rdx, rdx
je 0x14002d949
xor ebx, ebx
mov esi, ebx
cmp bx, word [rdx]
je 0x14002d91a
mov qword [rbp + 0x218], rbx
mov qword [rsp + 0x58], rbx
lea rax, vtable.std::_Func_impl_no_alloc_class__lambda_07a4580a2d41a7635afdf5f0258b0c87___void___.0
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x218]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov qword [rbp + 0x220], rax
mov qword [rbp - 0x58], rbx
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14002d886
lea rax, [rsp + 0x20]
cmp rcx, rax
jne 0x14002d87d
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rbp - 0x58], rax
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14002d886
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x14002d881
mov qword [rbp - 0x58], rcx
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14002d8a6
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rsp + 0x58], rbx
xor edx, edx
lea ecx, [rdx + 2]
call sub.api_ms_win_core_toolhelp_l1_1_0.dll_CreateToolhelp32Snapshot
mov r14, rax
mov qword [rbp + 0x218], rax
cmp rax, 0xffffffffffffffff
je 0x14002d90e
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp - 0x4c]
call fcn.14004b830
mov dword [rbp - 0x50], 0x238
lea rdx, [rbp - 0x50]
mov rcx, r14
call sub.api_ms_win_core_toolhelp_l1_1_0.dll_Process32FirstW
test eax, eax
je 0x14002d90e
mov rdx, rdi
lea rcx, [rbp - 0x24]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
test eax, eax
je 0x14002d90b
lea rdx, [rbp - 0x50]
mov rcx, qword [rbp + 0x218]
call sub.api_ms_win_core_toolhelp_l1_1_0.dll_Process32NextW
jmp 0x14002d8e4
mov esi, dword [rbp - 0x48]
lea rcx, [rsp + 0x70]
call fcn.14002d550
jmp 0x14002d91f
mov ebx, 0x80070057
test ebx, ebx
jne 0x14002d945
test esi, esi
je 0x14002d945
mov r8d, esi
xor edx, edx
lea ecx, [rbx + 1]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_OpenProcess]
test rax, rax
je 0x14002d945
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
mov eax, ebx
jmp 0x14002d94e
mov eax, 0x80004005
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x14002ebcc
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
test eax, eax
je 0x14002ebdf
add rsp, 0x48
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.14002f204
lea rdx, [0x1400a2538]
lea rcx, [rsp + 0x20]
call fcn.14004ace0
int3
Function at 0x14003ab5c
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1400a9df8]
xor edx, edx
jmp fcn.14002ebcc

Function at 0x14003b518
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1400a9df8]
jmp fcn.14002ebcc

Function at 0x1400473d4
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x140047490]
mov r9, qword [r9 + 8]
jmp fcn.140036f34

Function at 0x140047468
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x1400474a0]
mov r9, qword [r9 + 8]
jmp fcn.140036f34

Function at 0x140053924
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1400537b7
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test rax, rax
je 0x1400537b7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400537b7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400537b7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400537b7
cmp dword [rcx + 0x84], 0xe
jbe 0x1400537b7
cmp dword [rcx + 0xf8], 0
je 0x1400537b7
mov ecx, ebx
call fcn.140053858
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140053648
cmp dword [rbp + 0x20], 0
je 0x140053804
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14005380c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140053750
Function at 0x423ed0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x423edd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x423eed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x423ed5
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x423f05
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x423ef2
sub eax, 3
jb 0x423f1f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x423f56
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x423f46
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x423f44
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x423f33
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.00423e92
jmp 0x423edd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2000
mov dl, 2
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x423fa2
cmp rsi, rcx
jae 0x423faa
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x423f89
cmp al, 0x8f
ja 0x423f89
cmp byte [rsi - 2], 0xf
je 0x423f8f
sub al, 0xe8
cmp al, 1
ja 0x423f73
cmp rsi, rcx
jae 0x423faa
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x423f79
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x423faa
lodsb al, byte [rsi]
jmp 0x423f89
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x21000]
mov eax, dword [rdi]
or eax, eax
je 0x424007
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x24000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x423fb7
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x424001
mov qword [rbx], rax
add rbx, 8
jmp 0x423fd7
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.0042408a], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.0042408a
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x42407a
sub rsp, 0xffffffffffffff80
jmp 0x401500
Function at 0x140620cc0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140620ccd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140620cdd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140620cc5
lea eax, [rcx + 1]
jmp 0x140620ceb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140620cfe
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140620ce4
sub eax, 3
jb 0x140620d1e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140620d6d
sar eax, 1
movsxd rbp, eax
jb 0x140620d54
jmp 0x140620d2c
add ebx, ebx
jne 0x140620d2a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140620d54
inc ecx
add ebx, ebx
jne 0x140620d3a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140620d54
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140620d4d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140620d3c
add ecx, 2
jmp 0x140620d59
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140620c82
jmp 0x140620ccd
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x1d2a00
mov dl, 0x36
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140620dbd
cmp rsi, rcx
jae 0x140620dc5
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140620da4
cmp al, 0x8f
ja 0x140620da4
cmp byte [rsi - 2], 0xf
je 0x140620daa
sub al, 0xe8
cmp al, 1
ja 0x140620d8e
cmp rsi, rcx
jae 0x140620dc5
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140620d94
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140620dc5
lodsb al, byte [rsi]
jmp 0x140620da4
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x60a000]
mov eax, dword [rdi]
or eax, eax
je 0x140620e2e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x6211e4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140620dd2
jns 0x140620e07
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140620e11
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140620e28
mov qword [rbx], rax
add rbx, 8
jmp 0x140620df2
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140620e72
cmp al, 0xef
ja 0x140620e5a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140620e3a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x140620e49
mov eax, dword [rdi]
add rdi, 4
jmp 0x140620e49
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x25f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140620ec6
sub rsp, 0xffffffffffffff80
jmp 0x140092920