joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005de0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process filename
Get process heap flags

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x48]
sub rsp, 0x120
xor ebx, ebx
mov dword [rsp + 0x78], 0x30
xorps xmm0, xmm0
mov qword [rsp + 0x50], rbx
mov r12, r8
mov qword [rsp + 0x58], rbx
mov r13, rdx
mov qword [rsp + 0x70], rbx
xor eax, eax
lea r8d, [rbx + 0x68]
xor edx, edx
mov qword [rbp - 0x60], rax
lea rcx, [rbp - 0x50]
mov r14d, r9d
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
call fcn.140001000
mov ecx, 0x894f0f83
mov dword [rbp - 0x50], 0x70
call fcn.14000565c
lea r9, [rsp + 0x68]
mov qword [rsp + 0x68], rax
lea r8, [rsp + 0x78]
mov edx, 0x80
lea rcx, [rsp + 0x58]
call fcn.1400073a4
test eax, eax
lea r9, [rsp + 0x50]
mov esi, ebx
mov r15d, eax
setns sil
lea eax, [rbx + 1]
add esi, eax
xor r8d, r8d
mov edx, esi
xor ecx, ecx
call qword [0x1402660d8]
mov rcx, qword gs:[0x60]
lea edx, [rbx + 8]
mov r8, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x30]
call qword [0x140266070]
mov rdi, rax
test rax, rax
je 0x140005fac
lea r9, [rsp + 0x50]
xor r8d, r8d
mov edx, esi
mov rcx, rax
call qword [0x1402660d8]
test eax, eax
je 0x140005f94
movabs rax, 0x100000000000
mov qword [rsp + 0x30], rbx
lea esi, [rbx + 8]
mov qword [rsp + 0x28], rbx
lea r9, [rsp + 0x60]
mov qword [rsp + 0x60], rax
xor edx, edx
mov qword [rsp + 0x20], rsi
mov r8d, 0x20007
mov rcx, rdi
call qword [0x1402660e8]
test r15d, r15d
js 0x140005f3d
mov qword [rsp + 0x30], rbx
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rbx
xor edx, edx
mov r8d, 0x20000
mov qword [rsp + 0x20], rsi
mov rcx, rdi
call qword [0x1402660e8]
mov qword [rsp + 0x48], r12
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x40], rcx
neg r14d
mov rcx, qword [rbp + 0x50]
mov rdx, r13
sbb eax, eax
mov qword [rsp + 0x38], rbx
and eax, 4
mov qword [rsp + 0x30], rbx
add eax, 0x8080000
mov qword [rbp + 0x18], rdi
mov dword [rsp + 0x28], eax
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], ebx
call qword [0x1402660c8]
test eax, eax
mov rcx, rdi
mov eax, 1
cmovne ebx, eax
call qword [0x1402660e0]
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [0x140266078]
lea r11, [rsp + 0x120]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret

Function at 0x140006e10
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x9f94d304
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret
Function at 0x140006e54
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xae603828
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret

Function at 0x140006e98
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xd16b02e
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret

Function at 0x140006edc
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xaa7a62c5
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret

Function at 0x140006f64
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x1739f962
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret

Function at 0x140006fa8
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x448ea258
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret

Function at 0x140006fec
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x4a4c8483
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret

Function at 0x140007030
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xe6aef440
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret

Function at 0x1400070b8
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x94559e8b
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret
Function at 0x1400070fc
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x84c2f8cb
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret

Function at 0x140007140
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x7443846b
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret

Function at 0x140007184
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x79a42dfe
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret

Function at 0x1400071c8
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x6f2b783e
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret

Function at 0x14000720c
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xdc6280f4
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret

Function at 0x140007250
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xc0aed9c4
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret

Function at 0x140007294
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xef3c2d36
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret

Function at 0x1400072d8
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xb6954bd3
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret
Function at 0x14000731c
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x4eb24e84
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret

Function at 0x140007360
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x8c0a69a6
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret

Function at 0x1400073a4
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xa872248
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret

Function at 0x1400073e8
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xa3227ec1
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret

Function at 0x14000742c
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x25153b18
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret

Function at 0x140007470
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x8ab7fb11
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret

Function at 0x1400074b4
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x62ff2f39
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret

Function at 0x1400074f8
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xbe736318
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret
Function at 0x14000753c
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xae69e6d2
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret

Function at 0x140007580
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x9c7b048e
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret

Function at 0x1400075c4
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x2ed76231
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret

Function at 0x140007608
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xf97f2755
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret

Function at 0x14000764c
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x3891d11b
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret

Function at 0x140007690
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xf6a8985a
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret

Function at 0x1400076d4
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x1aecfb0a
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret

Function at 0x140007718
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x64885bcc
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret
Function at 0x14000775c
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xaa2525c3
nop
nop
call fcn.140002ad0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
nop
syscall
ret
Function at 0x10004130
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x100355f0]
test rcx, rcx
je 0x100041b2
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x100355f0]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x100355f0]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x100355f0]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x100355f0]
xor edx, edx
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x100355f0]
mov ebx, eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [0x100355f0], 0
mov eax, ebx
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x10004560
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x48
test edx, edx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov rsi, rcx
movsxd rdi, edx
jle 0x100045aa
lea eax, [rdi + 8]
movsxd rcx, eax
call sub.MSVCR80.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
mov rbx, rax
je 0x100045aa
mov r8d, edi
mov rdx, rax
mov rcx, rsi
call fcn.10004db0
cmp eax, edi
je 0x100045c3
mov rcx, rbx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
call fcn.10004130
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
add rsp, 0x48
ret
lea rdx, str.exit
mov rcx, rbx
mov byte [rdi + rbx], 0
call qword [sym.imp.MSVCR80.dll__stricmp]
test eax, eax
je 0x100045a2
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
lea rax, [rcx - 1]
cdqe
cmp byte [rax + rbx - 1], 0xd
je 0x10004607
mov byte [rax + rbx], 0xd
mov byte [rax + rbx + 1], 0xa
mov byte [rax + rbx + 2], 0
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
lea r9, [rsp + 0x30]
mov rdx, rbx
not rcx
mov qword [rsp + 0x20], rax
lea r8, [rcx - 1]
mov rcx, qword [0x100355f0]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10004643
call fcn.10004130
mov rcx, rbx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
add rsp, 0x48
ret

Function at 0x100047c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
movsxd rsi, r8d
mov qword [rsp + 0x48], rdi
mov rdi, rcx
lea eax, [rsi + 1]
mov rbx, rdx
movsxd rcx, eax
call sub.MSVCR80.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
mov rbp, rax
jne 0x100047f9
lea eax, [rbp - 1]
jmp 0x10004843
test esi, esi
mov rdx, rsi
jle 0x10004824
mov rcx, rax
sub rbx, rax
nop
nop
nop
movzx eax, byte [rbx + rcx]
add rcx, 1
xor al, byte [rdi + 0x20]
sub rdx, 1
mov byte [rcx - 1], al
jne 0x10004810
mov rcx, qword [rdi + 0x78]
xor r9d, r9d
mov r8d, esi
mov rdx, rbp
call qword [0x100357d0]
mov rcx, rbp
mov ebx, eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
mov eax, ebx
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x10004fa0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x48
test edx, edx
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
movsxd rdi, edx
mov rsi, rcx
jle 0x1000502a
lea eax, [rdi + 1]
mov qword [rsp + 0x58], rbx
movsxd rcx, eax
call sub.MSVCR80.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
mov rbx, rax
je 0x10005025
mov r8d, edi
mov rdx, rax
mov rcx, rsi
call fcn.10004db0
cmp eax, edi
je 0x10004fee
mov rcx, rbx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
xor ebx, ebx
jmp 0x1000501d
mov byte [rdi + rbx], 0
mov rcx, qword [rsi + 0x40]
test rcx, rcx
je 0x1000501d
lea r9, [rsp + 0x30]
mov r8d, edi
mov rdx, rbx
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
add rsp, 0x48
ret

Function at 0x10005a60
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov r8, rcx
lea rcx, [0x10005210]
xor edx, edx
call qword [sym.imp.MSVCR80.dll__beginthread]
mov ecx, 0x32
mov qword [rbx + 0x70], rax
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_Sleep]

Function at 0x100062f0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x28
test edx, edx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
movsxd rdi, edx
mov rsi, rcx
jle 0x100051a2
lea eax, [rdi + 1]
mov qword [rsp + 0x38], rbx
movsxd rcx, eax
call sub.MSVCR80.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
mov rbx, rax
je 0x1000518e
mov r8d, edi
mov rdx, rax
mov rcx, rsi
call fcn.10004db0
cmp eax, edi
je 0x1000516e
mov rcx, rbx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
xor ebx, ebx
jmp 0x10005186
mov byte [rdi + rbx], 0
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x10005186
mov r8d, edi
mov rdx, rbx
call fcn.10005fb0
mov rcx, rbx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
mov rbx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
add rsp, 0x28
ret
test edx, edx
jne 0x10005193
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x10005193
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
add rsp, 0x28
jmp 0x100062f0
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x20], 0
mov rbx, rcx
jne 0x10006344
call fcn.10006270
xor r11d, r11d
mov rcx, rbx
mov dword [rbx + 4], r11d
mov dword [rbx + 0x18], r11d
call fcn.10006040
test rax, rax
mov qword [rbx + 0x20], rax
jne 0x1000632e
mov dword [rbx + 0x18], 1
add rsp, 0x20
pop rbx
ret
lea rcx, [0x100060f0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.MSVCR80.dll__beginthread]
mov qword [rbx + 8], rax
add rsp, 0x20
pop rbx
ret
Function at 0x10006a00
Capabilities:
Create thread

Disassembly:
sub rsp, 0x28
test edx, edx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x48], rdi
mov edi, edx
mov rbp, rcx
jle 0x10006a9e
lea eax, [rdx + 1]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rsi
movsxd rbx, eax
mov rcx, rbx
call sub.MSVCR80.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov r8, rbx
xor edx, edx
mov rcx, rax
mov rsi, rax
call sub.MSVCR80.dll_memset
mov r8d, edi
mov rdx, rsi
mov rcx, rbp
call fcn.10004db0
mov rbx, qword [rsp + 0x30]
cmp eax, edi
je 0x10006a76
mov rcx, rsi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x38]
add rsp, 0x28
ret
mov ecx, 0x218
call sub.MSVCR80.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
lea rcx, [0x100068c0]
xor edx, edx
mov r8, rax
mov qword [rax], rbp
mov qword [rax + 8], rsi
call qword [sym.imp.MSVCR80.dll__beginthread]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x38]
add rsp, 0x28
ret

Function at 0x10006ab0
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
sub rsp, 0x188
mov rax, qword [0x1001f320]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov qword [r11 + 0x20], rbx
mov qword [r11 - 8], rbp
mov qword [r11 - 0x10], rsi
mov rsi, rcx
mov rbp, rdx
mov qword [r11 - 0x18], rdi
mov qword [r11 - 0x20], r12
lea rcx, [rsp + 0x40]
mov edx, 0x104
mov r12, r8
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor eax, eax
lea rdi, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x30], 0
repne scasb al, byte [rdi]
mov rax, qword [str.kernel32.dll]
lea rcx, [rsp + 0x40]
mov qword [rdi - 1], rax
mov eax, dword [0x10016668]
xor r9d, r9d
mov dword [rdi + 7], eax
movzx eax, word [0x1001666c]
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov word [rdi + 0xb], ax
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r9, r12
mov r8, rbp
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, qword [rsp + 0x168]
mov rsi, qword [rsp + 0x178]
mov rbp, qword [rsp + 0x180]
mov rbx, qword [rsp + 0x1a8]
mov eax, edi
mov rdi, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.10010cd0
add rsp, 0x188
ret