joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006820
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rbx, r8
mov r15d, edx
mov rsi, rcx
mov rax, qword [0x14003f010]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rdi, [rcx + 0x28]
mov rcx, rdi
call fcn.140006700
xor ebp, ebp
cmp rbx, 0x7fffffff
ja 0x140006868
test al, al
je 0x140006868
cmp qword [rsi + 0x58], 0
je 0x140006884
xor ebp, ebp
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400365a0
mov eax, ebp
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
cmp byte [rsi], 0
je 0x14000690d
mov rcx, rdi
call fcn.140006710
mov r14, rax
mov rbp, qword [0x14003f2b0]
test rbp, rbp
jne 0x1400068cb
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtQuerySection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
mov qword [0x14003f2b0], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
mov rcx, r14
xor edx, edx
mov r9d, 0x18
call rbp
test eax, eax
jne 0x140006866
test dword [rsp + 0x38], 0x1000000
jne 0x140006866
mov r14d, r15d
sar r14d, 0x1f
xor eax, eax
cmp byte [rsi + 0x60], 0
sete al
lea ebp, [rax + rax]
add ebp, 4
mov rcx, rdi
call fcn.140006710
mov qword [rsp + 0x20], rbx
mov rcx, rax
mov edx, ebp
mov r8d, r14d
mov r9d, r15d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 0x58], rax
test rax, rax
jne 0x140006984
xor eax, eax
cmp byte [rsi + 0x60], 0
sete al
lea ebp, [rax + rax]
add ebp, 4
mov rcx, rdi
call fcn.140006710
mov qword [rsp + 0x20], rbx
mov rcx, rax
mov edx, ebp
mov r8d, r14d
mov r9d, r15d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 0x58], rax
test rax, rax
je 0x140006866
mov rbp, rax
lea rdx, [rsp + 0x30]
mov r8d, 0x30
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1400069a4
xor eax, eax
jmp 0x1400069b1
mov rax, qword [rsp + 0x48]
sub rax, rbp
add rax, qword [rsp + 0x38]
mov qword [rsi + 0x50], rax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400066a0
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi + 0x70], xmm0
call fcn.1400069e0
mov bpl, 1
jmp 0x140006868

Function at 0x140006a40
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
cmp qword [rcx], rdx
je 0x140006ab4
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov rcx, rsi
call fcn.140006ad0
lea rax, [rdi + 1]
cmp rax, 2
jb case.default.0x140006aad
mov qword [rsi], rdi
call fcn.140006670
mov rbx, rax
mov r15, qword [rsp + 0x58]
call sym.plugin_container.exe_GetHandleVerifier
mov rbp, qword [rax]
mov qword [rsp + 0x20], rbx
mov rcx, rax
mov rdx, rdi
mov r8, rsi
mov r9, r15
call qword [rbp + 8]
mov ecx, r14d
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
invalid
or byte [rax - 0x5f88ebf3], ch
invalid
Function at 0x40432f
Capabilities:
Write file on windows

Disassembly:
push rdi
push rbx
sub rsp, 0x28
xor r8d, r8d
test rdx, rdx
mov rbx, rcx
mov r10, rdx
je 0x404358
mov rdi, rdx
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasb al, byte [rdi]
mov rdx, rcx
not rdx
lea r8, [rdx - 1]
mov rcx, r10
mov r9, rbx
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rdi
jmp 0x40c7a8
jmp qword [sym.imp.msvcrt.dll_fflush]

Function at 0x406709
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb8
lea r9, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x108], rdx
mov edx, pe_nt_image_headers64
mov rcx, r9
mov r14d, r8d
call fcn.00403ee8
test rbx, rbx
jne 0x406748
xor eax, eax
jmp 0x406893
cmp word [rbx], 0x5a4d
jne 0x406741
movsxd rsi, dword [rbx + 0x3c]
add rsi, rbx
cmp dword [rsi], 0x4550
jne 0x406741
test byte [rsi + 0x17], 0x20
je 0x406741
add rsi, 0x88
mov ecx, 0x20
mov rdi, r9
rep movsd dword [rdi], dword [rsi]
cmp dword [rsp + 0x34], 0
je 0x406741
movsxd rsi, dword [rsp + 0x30]
test esi, esi
je 0x406741
add rsi, rbx
mov rcx, qword [rsp + 0x108]
movsxd r9, dword [rsi + 0x1c]
lea rdx, section..rdata
lea rbp, [r9 + rbx]
call fcn.00403ec7
test al, al
jne 0x4067c0
mov eax, dword [rbp]
xor r12d, r12d
mov r13d, dword [rsi + 0x18]
mov dword [rsp + 0x24], eax
movsxd rax, dword [rsi + 0x20]
mov r15d, dword [rax + rbx]
jmp 0x40682c
movsxd rax, dword [rbp - 4]
jmp 0x406890
lea r8, [0x0040e112]
movsxd r10, r15d
xor edx, edx
add r10, rbx
mov rcx, r10
mov qword [rsp + 0x28], r10
call qword [0x0055c2d0]
mov r10, qword [rsp + 0x28]
test rax, rax
jne 0x406836
add rbp, 4
mov esi, dword [rbp]
test r10, r10
mov ecx, 1
je 0x40680e
or rcx, 0xffffffffffffffff
mov rdi, r10
xor eax, eax
repne scasb al, byte [rdi]
not ecx
add r15d, ecx
mov rcx, qword [rsp + 0x108]
mov rdx, r10
call fcn.00403ec7
test al, al
jne 0x40683f
inc r12d
mov dword [rsp + 0x24], esi
cmp r13d, r12d
jge 0x4067c9
jmp 0x406741
inc r13d
mov esi, dword [rsp + 0x24]
jmp 0x4067f7
lea rcx, [0x005573c0]
mov edx, 0x653ef23b
call fcn.004066bb
mov edx, 0x1d1752e1
lea rcx, [0x00557380]
call fcn.004066bb
mov edx, 0x2cb77833
lea rcx, [0x00557360]
call fcn.004066bb
mov edx, 0x17d23849
lea rcx, [0x00557320]
call fcn.004066bb
test r14d, r14d
movsxd rax, esi
jne 0x406890
movsxd rax, dword [rsp + 0x24]
add rax, rbx
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x4068a7
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rbx, qword [rax + 0x20]
lea rbp, [rax + 0x20]
mov rdi, rcx
mov esi, edx
mov rdx, qword [rbx + 0x50]
mov rcx, rdi
call qword [0x0055aad8]
test eax, eax
je 0x4068e4
mov rbx, qword [rbx]
cmp rbp, rbx
jne 0x4068c9
jmp 0x4068ea
mov rax, qword [rbx + 0x20]
jmp 0x406965
xor eax, eax
test esi, esi
je 0x406965
lea rcx, [0x0040ec20]
call fcn.0040634d
xor edx, edx
mov rcx, rax
call fcn.004068a7
mov r8d, 1
lea rdx, str.LdrLoadDll
mov rcx, rax
call fcn.00406709
test rax, rax
mov rsi, rax
jne 0x406927
xor eax, eax
jmp 0x406965
lea rbx, [rsp + 0x30]
mov edx, 0x10
mov rcx, rbx
call fcn.00403ee8
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x28], 0
call qword [0x0055aab0]
xor edx, edx
xor ecx, ecx
mov r8, rbx
lea r9, [rsp + 0x28]
call rsi
test eax, eax
jne 0x406923
mov rax, qword [rsp + 0x28]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x4069c1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
xor r15d, r15d
mov qword [rsp + 0xb0], rcx
lea rcx, [0x0040ec60]
mov qword [rsp + 0xb8], rdx
mov edx, 0x41ae14dd
mov dword [rsp + 0x5c], 0
call fcn.0040696e
mov edx, 0xbbc1829
mov rcx, rax
call fcn.004066bb
mov rcx, rax
call fcn.00401738
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, rax
mov dword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 3
call qword [0x0055a0d0]
xor edx, edx
mov rcx, rax
mov rsi, rax
call qword [0x0055a0c8]
mov edi, eax
call qword [0x0055a0b8]
movsxd r8, edi
xor edx, edx
mov rcx, rax
call qword [0x0055a0c0]
lea r9, [rsp + 0x5c]
mov r8d, edi
mov rcx, rsi
mov qword [rsp + 0x20], 0
mov rbx, rax
mov rdx, rax
call qword [0x0055a0b0]
movsxd r12, dword [rbx + 0x3c]
add r12, rbx
movzx r13d, word [r12 + 0x14]
lea rbp, [r12 + 0x18]
mov eax, dword [r12 + 0x88]
add r13, rbp
mov dword [rsp + 0x4c], eax
mov r14, r13
cmp word [r12 + 6], r15w
ja 0x406aec
movsxd r8, dword [rsp + 0x4c]
xor edi, edi
xor esi, esi
movsxd rdx, dword [r14 + 0xc]
movsxd rax, dword [r14 + 0x14]
add r8, rbx
sub r8, rdx
lea r15, [r8 + rax]
movsxd r12, dword [r15 + 0x20]
movsxd rbp, dword [r15 + 0x1c]
add r12, rbx
add rbp, rbx
sub r12, rdx
sub rbp, rdx
add r12, rax
add rbp, rax
jmp 0x406bb0
movzx esi, word [r12 + 0x14]
imul eax, r15d, 0x28
mov ecx, 8
movzx eax, ax
add rsi, rbp
add rsi, rax
call fcn.004062b7
mov edx, 0x420ad7e7
mov rdi, rax
mov qword [rax], 8
mov rax, qword [rsi]
lea rcx, [0x0040ec40]
mov qword [rdi + 0x10], rax
call fcn.0040696e
mov edx, 0x221a088b
mov rcx, rax
call fcn.004066bb
mov rcx, rdi
mov rdx, rax
call fcn.00401ec5
test rax, rax
cmovs rsi, r14
inc r15d
mov r14, rsi
jmp 0x406aaa
movsxd rax, edi
mov rdx, qword [rsp + 0xb0]
movsxd rcx, dword [r12 + rax*4]
movsxd rax, dword [r14 + 0xc]
add rcx, rbx
sub rcx, rax
movsxd rax, dword [r14 + 0x14]
add rcx, rax
call fcn.00403ea1
test al, al
lea eax, [rdi + 1]
je 0x406bae
movsxd rdx, eax
mov ecx, 0x17
mov rdi, qword [rsp + 0xb8]
movsxd rsi, dword [rbp + rdx*4]
movsxd rdx, dword [r13 + 0xc]
add rsi, rbx
sub rsi, rdx
movsxd rdx, dword [r13 + 0x14]
add rsi, rdx
rep movsb byte [rdi], byte [rsi]
mov esi, 1
mov edi, eax
cmp dword [r15 + 0x18], edi
jg 0x406b55
mov eax, esi
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x40804b
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, qword [fcn.0040c830]
xor edi, edi
mov r14, rcx
mov r13, rdx
mov rsi, qword [r14 + rdi*8]
lea r15, [0x0040e2a6]
mov ecx, 1
call rbp
mov r12, rax
mov rcx, rsi
call fcn.00401738
lea rdx, [0x0040e2a6]
mov rcx, r12
mov r8, rax
call sub.msvcrt.dll_fprintf
mov ebx, eax
xor edx, edx
test rsi, rsi
movsxd rax, ebx
je 0x4080a8
mov rdx, qword [rsi]
cmp rax, rdx
jge 0x4080de
cmp byte [rsi + rax + 0x10], 0
je 0x4080cc
lea r8, [rsi + rax + 0x10]
mov rdx, r15
mov rcx, r12
call sub.msvcrt.dll_fprintf
test eax, eax
jle 0x4080de
add ebx, eax
jmp 0x40809b
xor ecx, ecx
mov rdx, r12
call sub.msvcrt.dll_fputc
test eax, eax
jne 0x4080de
inc ebx
jmp 0x40809b
inc rdi
cmp r13, rdi
jne 0x40806a
mov ecx, 1
call rbp
mov r8d, 1
mov edx, 1
lea rcx, [0x0040e054]
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 1
call rbp
mov rcx, rax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x40c7a8
Function at 0x40b7b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x0056d024]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x40b938
mov rax, qword [0x0056d028]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x40b7fc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x40b885
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x40b7e0
mov rcx, rbx
call fcn.0040c450
test rax, rax
mov r12, rax
je 0x40b96d
mov rax, qword [0x0056d028]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.0040c580
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x0056d028]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x40b950
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x40b87e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x40b8e0
add dword [0x0056d024], 1
cmp edi, 8
jae 0x40b8b3
test dil, 4
jne 0x40b924
test edi, edi
je 0x40b8a8
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x40b93f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x40b8a8
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x40b8cc
jmp 0x40b8a8
add rsi, qword [0x0056d028]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x40b87e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.0040ca00
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x40b8a8
xor esi, esi
jmp 0x40b807
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x40b8a8
mov rax, qword [0x0056d028]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.0040ca00
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.0040ca00
nop
nop dword [rax]

Function at 0x40c0c0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0056d300]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0056d2e0]
test rbx, rbx
je 0x40c114
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x40c10b
test rsi, rsi
je 0x40c10b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x40c0f0
lea rcx, [0x0056d300]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x40c450
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x005577a0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x40c4bd
mov rcx, r8
call fcn.0040c330
test eax, eax
je 0x40c4bd
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x40c4bd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x40c4b4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x40c4bf
add rax, 0x28
cmp rax, r9
jne 0x40c4a0
xor eax, eax
add rsp, 0x28
ret

Function at 0x40ca00
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x00401540]
jmp 0x401510
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.0040c830
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.0040c830
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x401530
Function at 0x180004620
Capabilities:
Check mutex on windows

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x3e0
mov rax, qword [0x18001c008]
xor rax, rsp
mov qword [rsp + 0x3d0], rax
movdqa xmm0, xmmword [str.F147EC_C7F5_F89_]
lea r8, [r11 - 0x38]
mov edx, 1
mov dword [r11 - 0x28], 0x394a2d41
xor ecx, ecx
mov dword [r11 - 0x24], 0x44353941
movdqu xmmword [r11 - 0x38], xmm0
mov word [r11 - 0x20], 0x7d
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete al
test rbx, rbx
je 0x18000469f
test al, al
je 0x1800046ba
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x3d0]
xor rcx, rsp
call fcn.1800058d0
add rsp, 0x3e0
pop rbx
ret
lea rax, [rsp + 0x30]
mov edx, 7
lea rcx, str.RemoteUpdateManager
nop dword [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x1800046d0
xor eax, eax
lea rdx, [0x18001fef0]
nop dword [rax]
movzx ecx, byte [rsp + rax + 0xf0]
mov byte [rax + rdx], cl
inc rax
test cl, cl
jne 0x180004730
lea r9, [rsp + 0x30]
call fcn.180003bb0
mov al, 1
jmp 0x1800046a1

Function at 0x180004990
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
test rcx, rcx
je 0x180004a1b
cmp qword [0x18001fee0], 0
mov qword [rsp + 0x48], rbx
jne 0x1800049c8
mov ecx, 8
call fcn.1800058f4
lea rdx, vtable.PluginProvider.0
mov qword [0x18001fee0], rax
mov qword [rax], rdx
mov ecx, 8
call fcn.1800058f4
mov rcx, qword [0x18001fee0]
mov rbx, rax
mov qword [rax], rcx
mov ecx, 0x10
call fcn.1800058f4
xor edx, edx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
lea r8, [0x180004980]
xor ecx, ecx
mov dword [rsp + 0x20], edx
mov qword [rax + 8], rdi
mov r9, rax
mov qword [rax], rbx
mov dword [rsp + 0x40], edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x48]
xor al, al
add rsp, 0x30
pop rdi
ret
Function at 0x14000e0e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1401970d0]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
mov rsi, r8
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], 0
mov rbp, rdx
mov rdi, rcx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000e19e
mov ecx, dword [rsp + 0x34]
lea eax, [rcx - 1]
cmp eax, 1
jbe 0x14000e136
cmp ecx, 7
jne 0x14000e19e
mov ecx, dword [rsp + 0x30]
inc ecx
mov qword [rsp + 0x78], rbx
call fcn.14010a9b4
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x34]
mov rbx, rax
mov rdx, rbp
mov rcx, rdi
mov byte [r8 + rax], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete dil
test eax, eax
jne 0x14000e18b
mov rdx, rbx
mov rcx, rsi
call fcn.14000e460
mov rcx, rbx
call fcn.14010a970
mov rbx, qword [rsp + 0x78]
movzx eax, dil
jmp 0x14000e1a0
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14010a950
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000e1c0
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1401970d0]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor esi, esi
mov qword [rcx], rdx
mov qword [r11 - 0x20], rsi
lea rdi, [rcx + 0x10]
mov qword [r11 - 0x28], rsi
mov rbx, rcx
mov qword [r11 - 0x30], rsi
mov rax, rdx
mov qword [r11 - 0x38], rdi
xor r9d, r9d
mov qword [rcx + 8], rsi
xor r8d, r8d
lea rcx, [r11 - 0x18]
mov dword [rdi], esi
mov qword [r11 - 0x40], rcx
xor edx, edx
mov qword [r11 - 0x48], rsi
mov rcx, rax
mov qword [r11 - 0x50], rsi
mov qword [r11 - 0x58], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov ecx, dword [rdi]
inc ecx
mov dword [rdi], ecx
test eax, eax
je 0x14000e244
mov rcx, qword [rbx + 8]
mov dword [rdi], esi
call fcn.14010a970
mov qword [rbx + 8], rsi
jmp 0x14000e24d
call fcn.14010a9b4
mov qword [rbx + 8], rax
mov rax, rbx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14010a950
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400103c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x1401970d0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rdx
mov r14, rcx
xor ebp, ebp
mov qword [rsp + 0x28], rbp
mov rdx, 0xffffffffffffffff
inc rdx
cmp byte [rdi + rdx], bpl
jne 0x1400103f3
mov r8, rdx
lea rcx, [rsp + 0x28]
call fcn.14000f1f0
mov rbx, qword [rsp + 0x28]
mov r8, qword [rbx]
mov rdx, rdi
lea rcx, [rbx + 0x10]
call fcn.14010e4d0
nop
mov r8, qword [rbx]
lea rdx, [rbx + 0x10]
lea rcx, [r14 + 0x38]
call fcn.14000f270
mov rdx, qword [r14 + 0x38]
add rdx, 0x10
mov qword [rsp + 0x20], rbp
lea r8, [0x140161168]
lea rcx, [rsp + 0x20]
call fcn.14011af34
test eax, eax
jne 0x1400105d8
mov rsi, qword [rsp + 0x20]
test rsi, rsi
je 0x1400105d8
mov rcx, r14
call fcn.14000fc30
mov qword [r14 + 8], 0xffffffffffffffff
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rsi
call fcn.14011424c
mov rcx, rsi
call fcn.140113aac
movsxd rbp, eax
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.14011424c
test ebp, ebp
jg 0x1400104eb
cmp byte [r14 + 0x50], 0
jne 0x1400104db
mov byte [r14 + 0x50], 1
mov dword [r14 + 0x54], ntohl
mov rdx, qword [str.Error_document_empty.]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x1400104c0
lea rcx, [r14 + 0x58]
call fcn.14000f270
mov qword [r14 + 0x64], 0xffffffffffffffff
xor dil, dil
mov rcx, rsi
call fcn.140113eac
jmp 0x14001061e
lea rcx, [rbp + 1]
call fcn.14010a9b4
mov rdi, rax
mov byte [rax], 0
mov r9, rsi
mov r8d, 1
mov rdx, rbp
mov rcx, rax
call fcn.14011f8d4
mov rcx, rdi
cmp rax, 1
je 0x14001056b
call fcn.14010a970
cmp byte [r14 + 0x50], 0
jne 0x1400104db
mov byte [r14 + 0x50], 1
mov dword [r14 + 0x54], 2
mov rdx, qword [str.Failed_to_open_file]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x140010540
lea rcx, [r14 + 0x58]
call fcn.14000f270
mov qword [r14 + 0x64], 0xffffffffffffffff
xor dil, dil
mov rcx, rsi
call fcn.140113eac
jmp 0x14001061e
mov rax, rdi
mov byte [rbp + rdi], 0
movzx edx, byte [rdi]
test dl, dl
je 0x1400105a5
nop word [rax + rax]
lea r8, [rcx + 1]
inc rax
cmp dl, 0xd
jne 0x140010599
mov byte [rcx], 0xa
cmp byte [rax], 0xa
jne 0x14001059b
inc rax
jmp 0x14001059b
mov byte [rcx], dl
movzx edx, byte [rax]
mov rcx, r8
test dl, dl
jne 0x140010580
mov byte [rcx], 0
mov rax, qword [r14]
mov r9d, 1
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call qword [rax + select]
mov rcx, rdi
call fcn.14010a970
cmp byte [r14 + 0x50], 0
sete dil
mov rcx, rsi
call fcn.140113eac
jmp 0x14001061e
cmp byte [r14 + 0x50], 0
jne 0x14001061b
mov byte [r14 + 0x50], 1
mov dword [r14 + 0x54], 2
mov rdx, qword [str.Failed_to_open_file]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140010600
lea rcx, [r14 + 0x58]
call fcn.14000f270
mov qword [r14 + 0x64], 0xffffffffffffffff
xor dil, dil
lea rax, [0x1401a51b0]
cmp rbx, rax
je 0x140010632
mov rcx, rbx
call fcn.14010a970
movzx eax, dil
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14010a950
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400154c0
Capabilities:
Allocate thread local storage

Disassembly:
push rdi
sub rsp, 0x40
mov rax, qword [0x1401970d0]
xor rax, rsp
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edi, eax
cmp eax, 0xffffffff
jne 0x14001550e
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], 0
call fcn.14010c950
test ebx, ebx
mov qword [rsp + 0x28], rax
mov rbx, qword [rsp + 0x50]
jne 0x140015523
mov eax, edi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14010a950
add rsp, 0x40
pop rdi
ret
lea rdx, [0x140161a00]
lea rcx, [rsp + 0x20]
call fcn.1400152f0
int3