joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008fd8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [0x14003a010]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, rdx
mov rsi, rcx
xor edx, edx
lea rcx, [rbp - 0x39]
lea r8d, [rdx + 0x61]
call fcn.14000f4f0
mov rcx, qword [rsi]
lea rax, [rbp - 0x51]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x49]
lea rax, [rbp - 0x4d]
mov qword [rsp + 0x20], rax
call fcn.140008dfc
test eax, eax
jne 0x1400090ae
xor edi, edi
cmp dword [rbp - 0x51], edi
jbe 0x1400090ae
lea r15d, [rax + 1]
mov r9, qword [rsi]
lea rcx, [rbp - 0x59]
mov r8, r15
mov edx, 4
call fcn.140011814
cmp rax, r15
jne 0x1400090ae
mov ecx, dword [rbp - 0x59]
call qword [sym.imp.WSOCK32.dll_ntohl]
mov r9, qword [rsi]
lea rcx, [rbp - 0x55]
sub eax, 8
mov r8, r15
mov edx, 4
mov dword [rbp - 0x59], eax
call fcn.140011814
cmp rax, r15
jne 0x1400090ae
mov ecx, dword [rbp - 0x55]
call qword [sym.imp.WSOCK32.dll_ntohl]
mov dword [rbp - 0x55], eax
cmp eax, r15d
je 0x1400090d5
mov edx, dword [rbp - 0x59]
mov r8d, r15d
mov rcx, qword [rsi]
call fcn.1400170d4
test eax, eax
jne 0x1400090ae
add edi, r15d
cmp edi, dword [rbp - 0x51]
jb 0x140009042
or eax, 0xffffffff
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14000d4c0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret
cmp dword [rbp - 0x59], 0x60
ja 0x1400090ae
mov edx, dword [rbp - 0x59]
lea rcx, [rbp - 0x39]
mov r9, qword [rsi]
mov r8, r15
call fcn.140011814
cmp rax, r15
jne 0x1400090ae
lea rax, [rbp - 0x39]
or rdx, 0xffffffffffffffff
inc rdx
cmp byte [rax + rdx], 0
jne 0x1400090fa
lea rax, [rbp - 0x39]
mov qword [rbx], rax
lea r8, [rbp - 0x39]
lea eax, [rdx + 1]
movsxd rcx, eax
add r8, rcx
cmp edx, 0x40
jl 0x140009122
and qword [rbx], 0
jmp 0x1400090ae
or rax, 0xffffffffffffffff
inc rax
cmp byte [r8 + rax], 0
jne 0x140009126
mov qword [rbx + 8], r8
cmp eax, 0x20
jl 0x140009147
and qword [rbx], 0
and qword [rbx + 8], 0
jmp 0x1400090ae
lea rcx, [rbp - 0x39]
call fcn.14001a994
mov rcx, qword [rbx + 8]
mov qword [rbx], rax
call fcn.14001a994
mov qword [rbx + 8], rax
xor eax, eax
jmp 0x1400090b1

Function at 0x1400091c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, dword [rdx + 0xc]
mov rsi, r9
mov rdi, rcx
cmp r8d, ebx
jne 0x1400091e1
xor eax, eax
jmp 0x14000921a
jle 0x1400091e8
or eax, 0xffffffff
jmp 0x14000921a
mov edx, dword [rdx + 8]
sub ebx, r8d
cmp ebx, dword [rsp + 0x50]
mov rcx, qword [rcx]
cmovg ebx, dword [rsp + 0x50]
add edx, r8d
xor r8d, r8d
call fcn.1400170d4
test eax, eax
jne 0x1400091e3
mov r9, qword [rdi]
lea edx, [rax + 1]
movsxd r8, ebx
mov rcx, rsi
call fcn.140011814
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000976c
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
and qword [rbp - 0x10], 0
mov rdi, r9
and qword [rbp - 0x18], 0
mov r14, r8
mov ebx, edx
mov dword [rax - 0x38], 0xf0000000
mov rsi, rcx
mov r9d, 1
xor r8d, r8d
lea rcx, [rbp - 0x10]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1400097f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
je 0x1400097d0
xor eax, eax
jmp 0x1400098b1
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000008
xor r8d, r8d
lea rcx, [rbp - 0x10]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1400097c9
mov rcx, qword [rbp - 0x10]
lea rax, [rbp - 0x18]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8003
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400097c9
mov rcx, qword [rbp - 0x18]
xor r9d, r9d
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400097c9
mov rcx, qword [rbp - 0x18]
lea r9, [rbp - 0x20]
and dword [rsp + 0x20], 0
mov edx, 4
mov r8, rdi
mov dword [rbp - 0x20], edx
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x1400097c9
mov ecx, dword [rdi]
call fcn.14000daac
mov r8d, dword [rdi]
xor edx, edx
mov rcx, rax
mov qword [r14], rax
mov rbx, rax
call fcn.14000f4f0
mov rcx, qword [rbp - 0x18]
mov r9, rdi
and dword [rsp + 0x20], 0
mov r8, rbx
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x1400097c9
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14000989b
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400098ac
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x14000a098
Capabilities:
Delete file
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x14000a0e0
call fcn.140010f38
and qword [rbx], 0
lea rdi, [rbx + 0x210]
mov rcx, rdi
xor edx, edx
call fcn.140012210
lea rcx, [rbx + 8]
test eax, eax
jne 0x14000a0d7
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x14000a0e0
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000a5b8
Capabilities:
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd rbx, ecx
mov rdi, rdx
mov rcx, 0xffffffffffffffff
mov eax, 8
lea r8, [rbx + 2]
mul r8
lea r15d, [rbx + 2]
cmovo rax, rcx
mov rcx, rax
call fcn.14000daac
lea rsi, str.MozillaMaintenance
mov r14, rax
mov rdx, rbx
mov qword [rax], rsi
lea rax, str.software_update
mov qword [r14 + 8], rax
test ebx, ebx
jle 0x14000a630
mov rcx, r14
sub rcx, rdi
mov rax, qword [rdi]
mov qword [rcx + rdi + 0x10], rax
lea rdi, [rdi + 8]
sub rdx, 1
jne 0x14000a61e
mov ebx, 5
mov edx, ebx
call fcn.14000a734
cmp eax, 1
je 0x14000a64c
lea ebx, [rax + 0x4e20]
jmp 0x14000a6db
mov r8d, ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
jne 0x14000a668
mov ebx, 0x4269
jmp 0x14000a6db
mov r8d, 0x10
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbp, rax
test rax, rax
jne 0x14000a692
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, 0x426a
jmp 0x14000a6db
xor esi, esi
mov r8, r14
mov edx, r15d
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x14000a6c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x64
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
add esi, 0x64
cmp esi, 0x1388
jb 0x14000a694
jmp 0x14000a6c9
xor ebx, ebx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r14
call fcn.14000dda4
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x14000a944
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x14003a010]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rsi, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20a
call fcn.14000f4f0
or rax, 0xffffffffffffffff
xor ebx, ebx
inc rax
cmp word [rdi + rax*2], bx
jne 0x14000a986
mov r8d, 0x104
cmp rax, r8
jbe 0x14000a99e
xor eax, eax
jmp 0x14000a9ce
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400121c8
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathStripToRootW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
mov eax, 1
sete bl
mov dword [rsi], ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14000d4c0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000a9f4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 0x10]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000ab2d
mov rcx, qword [rbp - 0x10]
lea rax, [rbp - 0x20]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x28]
lea edx, [r9 + 0xe]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov edi, 1
test eax, eax
je 0x14000aa5b
cmp dword [rbp + 0x28], 3
jne 0x14000aa5b
mov bl, dil
jmp 0x14000aa5d
xor bl, bl
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x14000ab2d
lea rax, [rbp - 0x18]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000ab2d
mov rcx, qword [rbp - 0x18]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea rdx, str.ConsentPromptBehaviorAdmin
lea rax, [rbp + 0x30]
mov dword [rbp + 0x28], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000ab09
mov rcx, qword [rbp - 0x18]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea rdx, str.PromptOnSecureDesktop
lea rax, [rbp + 0x38]
mov dword [rbp + 0x28], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000ab09
mov ebx, edi
jmp 0x14000ab0b
xor ebx, ebx
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x14000ab29
cmp dword [rbp + 0x30], 0
jne 0x14000ab25
cmp dword [rbp + 0x38], 0
je 0x14000ab27
xor edi, edi
mov dword [rsi], edi
mov eax, ebx
jmp 0x14000ab2f
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000ab3c
Capabilities:
Encode data using xor

Disassembly:
mov r9d, r8d
not r9d
test rdx, rdx
je 0x14000ab6e
movzx eax, byte [rcx]
lea r10, [0x14003e0e0]
movzx r8d, r9b
inc rcx
xor r8, rax
mov eax, r9d
shr eax, 8
mov r9d, dword [r10 + r8*4]
xor r9d, eax
sub rdx, 1
jne 0x14000ab47
not r9d
mov eax, r9d
ret
Function at 0x14000ab78
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
mov r9d, dword [rcx + 0x10]
or rdi, 0xffffffffffffffff
mov rbx, r8
mov r11, rdx
mov r14, rcx
cmp r8, 4
ja 0x14000abad
xor eax, eax
jmp 0x14000acf0
mov r12d, 0
mov r8d, r12d
sub rbx, 4
je 0x14000acd2
lea rdx, [0x140000000]
mov al, byte [r8 + r11]
and al, 0xfe
cmp al, 0xe8
jne 0x14000acc6
mov rax, r8
sub rax, rdi
cmp rax, 3
jbe 0x14000ac81
mov r9d, r12d
mov al, byte [r8 + r11 + 4]
mov rdi, r8
inc al
test al, 0xfe
jne 0x14000acbf
movzx eax, byte [r8 + r11 + 3]
movzx r10d, byte [r8 + r11 + 4]
shl r10d, 8
or r10d, eax
movzx eax, byte [r8 + r11 + 2]
shl r10d, 8
or r10d, eax
movzx eax, byte [r8 + r11 + 1]
shl r10d, 8
or r10d, eax
sub r10d, r8d
sub r10d, dword [r14 + 0xc]
sub r10d, 5
test r9d, r9d
je 0x14000ad10
mov eax, r9d
mov ebp, 0x18
movzx esi, byte [rax + rdx + 0x35920]
shl esi, 3
sub ebp, esi
mov eax, r10d
mov ecx, ebp
shr eax, cl
inc al
test al, 0xfe
jne 0x14000ad09
mov ecx, 0x20
mov edx, 1
sub ecx, esi
shl edx, cl
dec edx
xor r10d, edx
sub r10d, r8d
sub r10d, dword [r14 + 0xc]
sub r10d, 5
jmp 0x14000ac50
lea ecx, [rax + 0xff]
shl r9d, cl
and r9d, 7
je 0x14000abe8
cmp byte [r9 + rdx + 0x35918], r12b
je 0x14000acbc
movzx eax, byte [r9 + rdx + 0x35920]
mov rcx, r8
sub rcx, rax
mov al, byte [rcx + r11 + 4]
inc al
test al, 0xfe
jne 0x14000abe8
mov rdi, r8
add r9d, r9d
or r9d, 1
inc r8
cmp r8, rbx
jb 0x14000abc7
mov rdx, r8
mov rax, r8
sub rdx, rdi
lea ecx, [rdx + 0xff]
shl r9d, cl
cmp rdx, 3
cmova r9d, r12d
mov dword [r14 + 0x10], r9d
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r14
pop r12
ret
lea rdx, [0x140000000]
and r10d, 0x1ffffff
mov eax, r10d
and eax, 0x1000000
neg eax
or r10d, eax
mov eax, r10d
mov byte [r8 + r11 + 1], r10b
shr eax, 8
mov byte [r8 + r11 + 2], al
mov eax, r10d
shr eax, 0x10
shr r10d, 0x18
mov byte [r8 + r11 + 3], al
mov byte [r8 + r11 + 4], r10b
add r8, 4
jmp 0x14000acc6
Function at 0x14000bfac
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov rax, qword [rdx + 8]
mov rbx, rcx
mov qword [rcx + 0x10], rax
mov rdi, rdx
mov rax, qword [rdx + 0x20]
mov qword [rcx + 0x18], rax
cmp byte [rbx + 0x4d0], 0
mov rcx, qword [rcx + 0x4c0]
je 0x14000bfff
mov r8, rdx
mov rdx, rcx
mov rcx, qword [rbx + 0x4c8]
call fcn.14000adcc
jmp 0x14000c004
call fcn.14000bb44
mov rdx, qword [rbx + 0x58]
mov r14d, eax
mov rax, qword [rdi + 8]
sub rax, qword [rbx + 0x10]
add qword [rbx + 0x50], rax
mov r8, qword [rbx + 0x18]
mov r15, qword [rbx + 0x38]
sub rdx, r8
add rdx, qword [rdi + 0x20]
mov qword [rbx + 0x58], rdx
cmp qword [rbx + 0x50], r15
ja 0x14000c123
mov rbp, qword [rbx + 0x40]
cmp rdx, rbp
ja 0x14000c123
cmp dword [rbx + 0x28], 1
jne 0x14000c067
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
sub rdx, r8
add rcx, r8
mov r8d, dword [rbx + 0x20]
call fcn.14000ab3c
mov r11d, eax
mov qword [rbx + 0x20], r11
jmp 0x14000c0b3
cmp dword [rbx + 0x28], 4
jne 0x14000c0b3
mov r10, qword [rdi + 0x18]
mov r9, qword [rdi + 0x20]
add r10, r8
mov rdx, qword [rbx + 0x20]
not rdx
sub r9, r8
je 0x14000c0ac
movzx eax, byte [r10]
lea r8, [0x14003d8e0]
movzx ecx, dl
inc r10
xor rcx, rax
mov rax, rdx
shr rax, 8
mov rdx, qword [r8 + rcx*8]
xor rdx, rax
sub r9, 1
jne 0x14000c084
not rdx
mov qword [rbx + 0x20], rdx
cmp r14d, 1
jne 0x14000c11e
cmp r15, 0xffffffffffffffff
je 0x14000c0c5
cmp r15, qword [rbx + 0x50]
jne 0x14000c123
cmp rbp, 0xffffffffffffffff
je 0x14000c0d1
cmp rbp, qword [rbx + 0x58]
jne 0x14000c123
mov ecx, dword [rbx + 0x48]
lea r9, [rbx + 0x68]
add rcx, qword [r9]
mov rax, qword [rbx + 0x50]
add rax, rcx
cmp dword [rbx + 0x28], 1
mov qword [r9], rax
jne 0x14000c0f1
add rax, 4
jmp 0x14000c0fb
cmp dword [rbx + 0x28], 4
jne 0x14000c0fe
add rax, 8
mov qword [r9], rax
mov rax, qword [rbx + 0x58]
mov edx, 0x18
mov r8d, dword [rbx + 0x78]
mov rcx, r9
add qword [rbx + 0x70], rax
call fcn.14000ab3c
inc qword [rbx + 0x60]
mov dword [rbx + 0x78], eax
mov eax, r14d
jmp 0x14000c128
mov eax, 7
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret

Function at 0x14000cd68
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
movsxd r8, dword [0x14000003c]
lea rdi, [0x140000000]
add r8, rdi
mov r11, rdx
mov rbx, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x14000cddb
mov r9d, dword [r8 + 0xf0]
xor edx, edx
test r9d, r9d
je 0x14000cddb
movzx eax, word [r8 + 0x14]
lea rcx, [r8 + 0x18]
movzx r10d, word [r8 + 6]
add rcx, rax
mov r9d, dword [r9 + rdi + 0xc]
test r10d, r10d
je 0x14000cddb
mov eax, dword [rcx + 0xc]
cmp r9d, eax
jb 0x14000cdd0
mov r8d, dword [rcx + 8]
add eax, r8d
cmp r9d, eax
jb 0x14000cde8
inc edx
add rcx, 0x28
cmp edx, r10d
jb 0x14000cdbc
xor eax, eax
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
mov dword [rbx], r8d
mov eax, dword [rcx + 0x24]
mov dword [r11], eax
mov eax, dword [rcx + 0xc]
add rax, rdi
jmp 0x14000cddd
Function at 0x14000f27c
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, str.FlsAlloc
xor ecx, ecx
lea r8, [0x140029a48]
lea rdx, str.FlsAlloc
call fcn.14000f0a4
mov rbx, rax
test rax, rax
je 0x14000f2bc
mov rcx, rax
call fcn.14000e158
mov rcx, rdi
call rbx
jmp 0x14000f2c2
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000f324
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, str.FlsSetValue
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 3
lea r8, [0x140029a80]
call fcn.14000f0a4
mov rsi, rax
test rax, rax
je 0x14000f370
mov rcx, rax
call fcn.14000e158
mov rdx, rbx
mov ecx, edi
call rsi
jmp 0x14000f37b
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400129a8
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400129c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400172b4
or eax, 0xffffffff
jmp 0x1400129ca
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400129d0
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1400129f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400172b4
or eax, 0xffffffff
jmp 0x1400129f2
xor eax, eax
add rsp, 0x28
ret
Function at 0x140017ca4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.1400289e0
sub rsp, rax
mov rax, qword [0x14003a010]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r14, rdx
mov rbx, rcx
call fcn.14001aa0c
xor esi, esi
movsxd r12, eax
cmp dword [rbx + 0x10], esi
jne 0x140017cf8
mov rax, r14
jmp 0x140017e12
mov rax, qword [rbx]
mov rdi, r12
sub rax, qword [rbx + 8]
xor r8d, r8d
cqo
sar rdi, 6
sub rax, rdx
mov rbx, r12
sar rax, 1
and ebx, 0x3f
mov r15, rax
shl rbx, 6
lea rax, [0x140000000]
mov ecx, r12d
mov rdx, qword [rax + rdi*8 + 0x3b810]
mov rbp, r12
mov rdx, qword [rbx + rdx + 0x30]
call fcn.140020f68
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rdi*8 + 0x3b810]
cmp r13, qword [rbx + rcx + 0x30]
je 0x140017d5f
or rax, 0xffffffffffffffff
jmp 0x140017e12
mov rcx, rbp
mov qword [rsp + 0x20], rsi
sar rcx, 6
lea r9, [rsp + 0x30]
and ebp, 0x3f
lea rdx, [rsp + 0x40]
shl rbp, 6
mov r8d, 0x1000
mov rcx, qword [rax + rcx*8 + 0x3b810]
mov rcx, qword [rcx + rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140017d56
xor r8d, r8d
mov rdx, r14
mov ecx, r12d
call fcn.140020f68
test rax, rax
js 0x140017d56
mov eax, dword [rsp + 0x30]
cmp r15, rax
jg 0x140017d56
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test r15, r15
je 0x140017e06
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x140017e06
cmp byte [rcx], 0xd
jne 0x140017dec
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x140017dfb
cmp byte [rcx + 1], 0xa
jne 0x140017dfb
inc rcx
jmp 0x140017dfb
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x3a2e0]
add rcx, rax
inc rsi
inc rcx
cmp rsi, r15
jne 0x140017dce
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14000d4c0
lea r11, [rsp + 0x1050]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x140019340
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140019164
Function at 0x14001cedc
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r10, [0x14003b810]
mov r14, rdx
mov rax, r15
sar rax, 6
mov rdx, r15
and edx, 0x3f
mov rdi, r15
shl rdx, 6
mov r9, qword [r10 + rax*8]
mov r12, qword [r9 + rdx + 0x28]
test r8, r8
je 0x14001cf41
cmp byte [r14], 0xa
jne 0x14001cf41
mov rcx, r15
mov rax, r15
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r10 + rax*8]
or byte [rax + rcx + 0x38], 4
jmp 0x14001cf62
mov dl, byte [r9 + rdx + 0x38]
mov rcx, rdi
and dl, 0xfb
mov rax, rdi
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r10 + rax*8]
mov byte [rax + rcx + 0x38], dl
lea rbp, [r14 + r8]
mov rsi, r14
mov rbx, r14
cmp r14, rbp
jae 0x14001d0bc
mov r13d, 1
mov al, byte [rsi]
cmp al, 0x1a
je 0x14001d07c
cmp al, 0xd
je 0x14001cf96
mov byte [rbx], al
add rbx, r13
add rsi, r13
jmp 0x14001d071
lea rax, [rsi + 1]
cmp rax, rbp
jae 0x14001cfbc
cmp byte [rax], 0xa
jne 0x14001cfae
mov byte [rbx], 0xa
mov eax, 2
jmp 0x14001cfb4
mov byte [rbx], 0xd
mov rax, r13
add rsi, rax
jmp 0x14001d06e
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov r8d, r13d
lea rdx, [rsp + 0x70]
mov rcx, r12
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001d064
cmp dword [rsp + 0x78], 0
je 0x14001d064
mov rcx, rdi
lea r10, [0x14003b810]
and ecx, 0x3f
mov rax, rdi
sar rax, 6
shl rcx, 6
mov rax, qword [r10 + rax*8]
test byte [rax + rcx + 0x38], 0x48
je 0x14001d034
mov dl, byte [rsp + 0x70]
cmp dl, 0xa
je 0x14001d040
mov rcx, rdi
mov byte [rbx], 0xd
mov rax, rdi
and ecx, 0x3f
sar rax, 6
shl rcx, 6
mov rax, qword [r10 + rax*8]
mov byte [rax + rcx + 0x3a], dl
jmp 0x14001d06e
cmp byte [rsp + 0x70], 0xa
jne 0x14001d045
cmp rbx, r14
jne 0x14001d045
mov byte [rbx], 0xa
jmp 0x14001d06e
mov r8d, r13d
or rdx, 0xffffffffffffffff
mov ecx, r15d
call fcn.140020f70
cmp byte [rsp + 0x70], 0xa
lea r10, [0x14003b810]
je 0x14001d071
jmp 0x14001d06b
lea r10, [0x14003b810]
mov byte [rbx], 0xd
add rbx, r13
cmp rsi, rbp
jb 0x14001cf7b
jmp 0x14001d0bc
mov rcx, rdi
mov rax, rdi
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r10 + rax*8]
mov dl, byte [rax + rcx + 0x38]
test dl, 0x40
jne 0x14001d0b5
mov rax, rdi
or dl, 2
sar rax, 6
and edi, 0x3f
shl rdi, 6
mov rax, qword [r10 + rax*8]
mov byte [rax + rdi + 0x38], dl
jmp 0x14001d0bc
mov cl, byte [rsi]
mov byte [rbx], cl
add rbx, r13
sub rbx, r14
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret