joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001340
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
xor esi, esi
movsxd rbp, ecx
mov qword [rsp + 0x40], rsi
mov r14, rdx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 2
lea r9, [rsp + 0x48]
mov rcx, rax
mov dword [rsp + 0x28], esi
mov r8, rdi
mov dword [rsp + 0x20], esi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov r9, qword [rsp + 0x48]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea r8, [0x140001300]
xor edx, edx
mov dword [rsp + 0x20], esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140001070
test al, al
je 0x14000154f
mov rcx, qword [0x140006078]
lea rdx, str.NvEncodeAPIGetMaxSupportedVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000154f
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x80], esi
call rax
test eax, eax
jne 0x14000154f
cmp dword [rsp + 0x80], 0xb1
jb 0x14000154f
mov rcx, qword [0x140006078]
lea rdx, str.NvEncodeAPICreateInstance
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000154f
lea rcx, [0x140005090]
call rax
test eax, eax
jne 0x14000154f
lea eax, [rbp - 1]
mov rdi, rbp
mov dword [0x140006070], eax
cmp rbp, 1
jle 0x14000149d
lea rax, [0x140006080]
sub rax, r14
lea rbx, [r14 + 8]
dec rdi
lea r14, [rax - 8]
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rbx]
xor edx, edx
lea r8d, [rdx + 0x10]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoull]
mov qword [r14 + rbx], rax
lea rbx, [rbx + 8]
sub rdi, 1
jne 0x140001480
lea rdx, [rsp + 0x40]
lea rcx, [0x1400032b0]
call qword [sym.imp.dxgi.dll_CreateDXGIFactory1]
test eax, eax
js 0x14000154f
mov ebx, esi
nop dword [rax]
mov rcx, qword [rsp + 0x40]
mov edx, ebx
call fcn.1400010a0
inc ebx
test al, al
jne 0x1400014c0
test ebx, ebx
je 0x140001544
lea r14, [0x1400060d0]
lea rbp, str.true
nop dword [rax]
nop dword [rax + rax]
movzx edi, word [r14]
lea rcx, str.__u__n
mov edx, esi
call fcn.140001010
test dil, dil
lea rdx, str.false
lea rcx, str.is_nvidia_s_n
cmovne rdx, rbp
call fcn.140001010
shr di, 8
lea rdx, str.false
test dil, dil
lea rcx, str.supports_av1_s_n
cmovne rdx, rbp
call fcn.140001010
inc esi
lea r14, [r14 + 2]
cmp esi, ebx
jb 0x1400014f0
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rbx, qword [rsp + 0x70]
xor eax, eax
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret

Function at 0x140001e40
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001e8a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001e8a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001e8a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001e8a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001e8a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001e8c
xor al, al
add rsp, 0x28
ret
Function at 0x1800141b0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
mov qword [rsp + 8], 0
jmp 0x1800141df
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 8
jae 0x180014223
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp]
xor rcx, rax
mov rax, rcx
mov qword [rsp], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp]
imul rcx, rax
mov rax, rcx
mov qword [rsp], rax
jmp 0x1800141d2
mov rax, qword [rsp]
add rsp, 0x18
ret
Function at 0x180078a50
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x18012a2e0]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x180078ade
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x180078a82
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret

Function at 0x180078af0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x18012a2e0]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x180078bf4
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x180078bef
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x180078bc4
cmp qword [rsp + 0x38], 2
jb 0x180078bc4
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x180078bc4
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x180078bc4
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x180078b37
jmp 0x180078c86
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x180078c86
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x180078c5c
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x180078c5c
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x180078c5c
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x180078bf4
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x1800b0b90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
movss xmm0, dword [rsp + 0x78]
movss dword [rsp + 0x30], xmm0
movss xmm0, dword [rsp + 0x7c]
movss dword [rsp + 0x34], xmm0
movss xmm0, dword [rsp + 0x80]
movss dword [rsp + 0x38], xmm0
movss xmm0, dword [rsp + 0x84]
movss dword [rsp + 0x3c], xmm0
movzx eax, byte [rsp + 0x88]
test eax, eax
je 0x1800b0c6b
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
mov rdi, rax
lea rsi, [rcx + 0x88]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
movss xmm0, dword [rsp + 0x40]
comiss xmm0, dword [rsp + 0x30]
jbe 0x1800b0c20
movss xmm0, dword [rsp + 0x40]
movss dword [rsp + 0x30], xmm0
movss xmm0, dword [rsp + 0x44]
comiss xmm0, dword [rsp + 0x34]
jbe 0x1800b0c39
movss xmm0, dword [rsp + 0x44]
movss dword [rsp + 0x34], xmm0
movss xmm0, dword [rsp + 0x38]
comiss xmm0, dword [rsp + 0x48]
jbe 0x1800b0c52
movss xmm0, dword [rsp + 0x48]
movss dword [rsp + 0x38], xmm0
movss xmm0, dword [rsp + 0x3c]
comiss xmm0, dword [rsp + 0x4c]
jbe 0x1800b0c6b
movss xmm0, dword [rsp + 0x4c]
movss dword [rsp + 0x3c], xmm0
movss xmm0, dword [rsp + 0x30]
comiss xmm0, dword [rsp + 0x38]
jb 0x1800b0c86
movss xmm0, dword [rsp + 0x30]
movss dword [rsp + 0x20], xmm0
jmp 0x1800b0c92
movss xmm0, dword [rsp + 0x38]
movss dword [rsp + 0x20], xmm0
movss xmm0, dword [rsp + 0x20]
movss dword [rsp + 0x38], xmm0
movss xmm0, dword [rsp + 0x34]
comiss xmm0, dword [rsp + 0x3c]
jb 0x1800b0cb9
movss xmm0, dword [rsp + 0x34]
movss dword [rsp + 0x24], xmm0
jmp 0x1800b0cc5
movss xmm0, dword [rsp + 0x3c]
movss dword [rsp + 0x24], xmm0
movss xmm0, dword [rsp + 0x24]
movss dword [rsp + 0x3c], xmm0
mov rax, qword [rsp + 0x70]
add rax, 0x58
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call fcn.1800be800
mov rax, qword [rsp + 0x70]
lea rcx, [rsp + 0x30]
lea rdi, [rax + 0x88]
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0x70]
call fcn.1800ba7c0
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x18012368c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1801236bc
xor eax, eax
jmp 0x18012377f
mov rbp, rbx
cmp word [rax], si
je 0x1801236e1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1801236c8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1801236c4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1801235ac
movsxd r14, eax
test eax, eax
jne 0x18012371f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1801236b5
mov rcx, r14
call fcn.180120f74
mov rdi, rax
test rax, rax
jne 0x180123738
xor ecx, ecx
call fcn.18011f900
jmp 0x180123714
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1801235ac
test eax, eax
jne 0x180123769
mov rcx, rdi
call fcn.18011f900
jmp 0x180123773
xor ecx, ecx
call fcn.18011f900
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1801267c0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1801267e8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1801267e8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140028da0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x2b0
mov rax, qword [0x1400776e8]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov r10, rcx
mov dword [rsp + 0x20], 0x70
movzx ecx, byte [rsp + 0x2e8]
lea rax, str.open
test cl, cl
mov dword [rsp + 0x24], 0x40
mov rbx, r8
mov qword [rsp + 0x38], r10
lea r8, str.runas
mov qword [rsp + 0x40], rdx
cmovne rax, r8
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], rax
movzx edi, r9b
movzx eax, byte [rsp + 0x2e0]
xor eax, 1
mov dword [rsp + 0x50], eax
test rbx, rbx
jne 0x140028e3e
test r10, r10
je 0x140028e3e
lea rdx, [rsp + 0x90]
mov rcx, r10
lea rbx, [rsp + 0x90]
call fcn.140028950
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne bl
test dil, dil
je 0x140028e74
test bl, bl
je 0x140028e74
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x140028e74
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
movzx eax, bl
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.14002a090
mov rbx, qword [rsp + 0x2d8]
add rsp, 0x2b0
pop rdi
ret
Function at 0x140029030
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1400776e8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov dword [rsp + 0x30], r8d
mov rsi, rdx
mov r8, rcx
mov edx, 0x100
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov edx, 0x5c
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_wcschr
mov edx, 0x5c
lea rcx, [rsp + 0x50]
mov rdi, rax
call sub.VCRUNTIME140.dll_wcsrchr
xor ecx, ecx
lea r8, [rsp + 0x50]
mov word [rdi], cx
lea r9, str.HKCR
mov rbx, rax
mov edx, ecx
mov word [rax], cx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
inc rdx
cmp ax, word [r9 + rdx*2 - 2]
jne 0x1400290d2
cmp rdx, 5
jne 0x1400290b0
mov rcx, 0xffffffff80000000
jmp 0x1400291ec
mov rdx, rcx
lea r8, [rsp + 0x50]
lea r9, str.HKCU
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
inc rdx
cmp ax, word [r9 + rdx*2 - 2]
jne 0x140029112
cmp rdx, 5
jne 0x1400290f0
mov rcx, 0xffffffff80000001
jmp 0x1400291ec
mov rdx, rcx
lea r8, [rsp + 0x50]
lea r9, str.HKLM
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
inc rdx
cmp ax, word [r9 + rdx*2 - 2]
jne 0x140029152
cmp rdx, 5
jne 0x140029130
mov rcx, 0xffffffff80000002
jmp 0x1400291ec
mov rdx, rcx
lea r8, [rsp + 0x50]
lea r9, [0x140056608]
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
inc rdx
cmp ax, word [r9 + rdx*2 - 2]
jne 0x14002918f
cmp rdx, 4
jne 0x140029170
mov rcx, 0xffffffff80000003
jmp 0x1400291ec
mov rdx, rcx
lea r8, [rsp + 0x50]
lea r9, str.HKCC
nop
movzx eax, word [r8 + rdx*2]
inc rdx
cmp ax, word [r9 + rdx*2 - 2]
jne 0x1400291bf
cmp rdx, 5
jne 0x1400291a0
mov rcx, 0xffffffff80000005
jmp 0x1400291ec
lea rdx, [rsp + 0x50]
lea r8, str.HKDD
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x140029242
cmp rcx, 5
jne 0x1400291d0
mov rcx, 0xffffffff80000006
lea rax, [rsp + 0x38]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 2]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140029242
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
lea rdx, [rbx + 2]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x14002925f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14002a090
add rsp, 0x260
pop rdi
pop rsi
pop rbx
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x30]
jmp 0x140029244
Function at 0x14002b420
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x50], rax
mov rdi, rax
test rax, rax
jne 0x14002b45d
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x40]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x98], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x60], r14
cmovo rax, r15
mov rcx, rax
call fcn.14002a11c
mov r14, rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x14002b55c
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0xa0], r12
mov r12, r14
mov qword [rsp + 0x68], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
nop word [rax + rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.14002a11c
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x40]
inc r14d
cmp r14d, eax
jne 0x14002b4d0
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x90]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x40]
mov rdx, r14
call fcn.140001500
mov esi, eax
cmp dword [rsp + 0x40], ebx
je 0x14002b59b
mov rdi, r14
mov rcx, qword [rdi]
test rcx, rcx
je 0x14002b59b
call fcn.140029f88
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x40]
jne 0x14002b582
mov rcx, r14
call fcn.140029f88
mov r14, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x98]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
Function at 0x140001d40
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call fcn.140002290
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call fcn.140002290
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
int3

Function at 0x1400023b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x140008008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x14000241c
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000241c
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x14000241c
movzx edx, word [rax + 6]
test edx, edx
je 0x14000241c
sub rcx, qword [0x140008008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x140002408
add rax, 0x28
dec edx
je 0x14000241c
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x140002400
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x140002400
jmp 0x14000241e
xor eax, eax
ret

Function at 0x140002420
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x140008008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x140002455
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x140002455
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x140002455
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x1400024d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140008008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1400024fc
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400024fc
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x1400024fe
xor eax, eax
ret

Function at 0x180024200
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180024228
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180024228
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x18002a830
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
test edx, edx
je 0x18002a84d
mov eax, 1
cmp edx, eax
jne 0x18002a8a2
mov qword [0x180075668], rcx
add rsp, 0x28
ret
cmp qword [0x180060a70], 0
je 0x18002a89d
cmp qword [0x180060a78], 8
mov qword [rsp + 0x20], rbx
lea rbx, [0x180060a60]
mov rcx, rbx
cmovae rcx, qword [0x180060a60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp qword [0x180060a78], 8
cmovae rbx, qword [0x180060a60]
xor eax, eax
mov qword [0x180060a70], rax
mov word [rbx], ax
mov rbx, qword [rsp + 0x20]
mov eax, 1
add rsp, 0x28
ret
Function at 0x140004884
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.140012b50
mov r15, qword [0x140020504]
cmp r15, 1
jne 0x140004953
push qword [0x1400205f4]
pop rcx
call fcn.14000dd04
mov r15, rax
and r15, r15
jle 0x1400048e9
mov rcx, qword [0x1400205f4]
call fcn.14000dd0c
mov rcx, qword [0x1400205f4]
call fcn.14000dd20
or rax, rax
je 0x1400048e9
mov rbp, qword [0x1400205fc]
push qword [rbp + 0x10]
pop rcx
call fcn.14000e1bc
jmp 0x1400048c6
push qword [0x1400205e4]
pop rcx
call fcn.14000dd04
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x140004953
push 5
push 0
push 1
push qword [0x1400205e4]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140009060
mov rcx, qword [0x1400205e4]
call fcn.14000dd0c
mov rcx, qword [0x1400205e4]
call fcn.14000dd20
or rax, rax
je 0x140004953
mov rbp, qword [0x1400205ec]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
jmp 0x140004930
mov rax, 1
jmp 0x14000495f
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140006b38
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f180]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021200]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020630]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020630]
call fcn.1400123b8
lea rcx, [0x140021200]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
invalid
inc qword [r14 - 0x7900b6f8]
or byte [rcx - 1], cl
xchg dword [rcx], ecx
inc qword [rsi - 0x7b00b7f7]
invalid
inc dword [r13 + r8 + 0x785ff45]
inc dword [r8 + r9 + 0x986ff4c]
inc qword [r13 - 0x7b00b1f7]
test byte [0x1448cf5fa], al
test byte [0x1448cf5fa], al
inc qword [rdi - 0x7800b3fb]
add eax, 0x786ff4b
inc qword [r13 - 0x7e00b7fa]
or dword [rdi - 1], eax
jge 0x14003f6d1
invalid
push qword [rsp + r8 + 0x39]
push qword [rbx + 5]
add eax, 0x142ff36
inc dword ss:[rdx + 1]
invalid
add qword [rbx], r12
call qword [rcx + 2]
call qword es:[rdx + rax + 0x29]
sub edi, edi
push rsi
add ch, byte [rdx]
call qword [rdi + 2]
sub al, 0xff
push rsi
add ch, byte [rdx]
call qword [rdi + 2]
sub al, 0xff
pop rdx
add dword [0x16d045302], ebp
call [rbp]
sub eax, 0x2e015dff
call [rsi + 2]
invalid