joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400051c4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
lea rax, [r11 + 0x18]
mov ebx, 0x20019
mov qword [r11 - 0x18], rax
mov r9d, ebx
lea rdx, str.SOFTWAREPoliciesAdobeAcrobat_ReaderDCFeatureLockDowncDefaultFindAttachmentPerms
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov edi, 0x80004005
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140005233
lea rax, [rsp + 0x50]
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREPoliciesAdobeAdobe_AcrobatDCFeatureLockDowncDefaultFindAttachmentPerms
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400052e7
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
and dword [rsp + 0x48], 0
lea rdx, str.tSearchAttachmentsWhiteList
mov qword [rsp + 0x28], rax
xor r9d, r9d
and qword [rsp + 0x20], 0
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 0xea
je 0x14000526b
test eax, eax
jne 0x1400052dc
mov eax, dword [rsp + 0x48]
inc eax
mov ecx, eax
mov dword [rsp + 0x48], eax
call fcn.140006ad4
mov rbx, rax
test rax, rax
je 0x1400052dc
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rdx, str.tSearchAttachmentsWhiteList
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400052d4
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbslwr]
mov rdx, rbx
mov rcx, rsi
call fcn.140004dd4
mov edi, eax
mov rcx, rbx
call fcn.1400064e4
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140005398
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14000c058]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
xor ebx, ebx
cmp qword [0x14000c010], rbx
jne 0x1400053ce
lea eax, [rbx + 1]
jmp 0x1400054b5
test rdi, rdi
je 0x1400054b3
cmp word [rcx], bx
je 0x1400054b3
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400054b3
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x1400054b3
mov rdx, rdi
lea rcx, [rbp - 0x30]
call fcn.1400054d4
nop
mov rdi, qword [0x14000c010]
cmp qword [rbp - 0x20], rbx
je 0x140005494
lea rcx, [rbp - 0x30]
call fcn.1400057d0
test al, al
jne 0x140005494
cmp qword [rbp - 0x20], rdi
jbe 0x140005494
lea rdx, [section..data]
cmp qword [reloc.OLEAUT32.dll_VariantInit], 8
cmovae rdx, qword [section..data]
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
mov r8, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x140005494
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test rax, rax
je 0x140005494
lea rdx, str..lnk
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
mov edx, 1
test eax, eax
cmovne ebx, edx
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x1400054af
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
call fcn.1400010bc
mov al, bl
jmp 0x1400054b5
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140006ab0
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
Function at 0x1400055f8
Capabilities:
Accept command line arguments
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x198]
sub rsp, 0x270
mov rax, qword [0x14000c058]
xor rax, rsp
mov qword [rbp + 0x160], rax
xor r13d, r13d
mov dil, r13b
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r14, rax
test rax, rax
je 0x14000579d
mov dil, 1
lea rcx, str.__alloweddir
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov r12, rax
mov r15d, r13d
cmp dword [rsp + 0x20], r13d
jle 0x140005794
mov rsi, r14
mov rcx, qword [rsi]
test rcx, rcx
je 0x140005782
mov r8, r12
lea rdx, str.__alloweddir
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x140005782
mov dil, r13b
mov rax, qword [rsi]
lea rbx, [rax + r12*2]
cmp word [rbx], r13w
je 0x140005782
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
cmp rax, 0x104
jae 0x140005782
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140005782
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x140005782
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.1400054d4
nop
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x140005765
cmp rax, 0x104
jae 0x140005765
lea r8, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae r8, qword [rsp + 0x28]
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
test eax, eax
jne 0x140005765
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
test rax, rax
je 0x140005765
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
nop
mov r8, rax
lea rdx, [rsp + 0x50]
lea rcx, [section..data]
call fcn.140003424
mov dil, 1
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x140005782
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
call fcn.1400010bc
inc r15d
add rsi, 8
cmp r15d, dword [rsp + 0x20]
jl 0x14000567e
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov al, dil
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.140006ab0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140005990
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rdi
mov qword [r11 + 0x18], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
lea rax, [rbp - 0x10]
mov edi, 0x20019
mov r14d, 1
mov qword [r11 - 0x38], rax
mov r9d, edi
lea rdx, str.SoftwareAdobeAdobe_AcrobatDCSecurity
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov ebx, r14d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140005a31
and dword [rbp - 0x18], eax
lea r9, [rbp - 0x18]
and dword [rbp - 0x20], eax
lea rdx, [0x140008884]
mov rcx, qword [rbp - 0x10]
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp - 0x20]
mov dword [rbp - 0x1c], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140005a1f
mov eax, dword [rbp - 0x20]
neg eax
sbb ecx, ecx
and ebx, ecx
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x140005b42
lea rax, [rbp - 0x10]
xor ebx, ebx
and qword [rbp - 0x10], rbx
lea rdx, str.SoftwarePoliciesAdobeAdobe_AcrobatDCFeatureLockDown
mov r9d, edi
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140005ab1
mov rcx, qword [rbp - 0x10]
lea rax, [rbp - 0x18]
and dword [rbp - 0x20], ebx
lea r9, [rbp - 0x20]
and dword [rbp - 0x1c], ebx
lea rdx, str.bEnableATL7Compat
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp - 0x1c]
mov dword [rbp - 0x18], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140005aa7
cmp dword [rbp - 0x20], 4
jne 0x140005aa7
cmp dword [rbp - 0x1c], r14d
cmove ebx, r14d
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x1400088e0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140005aee
lea rdx, str.SetProcessDEPPolicy
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005aee
mov ecx, ebx
xor ecx, r14d
lea ecx, [rcx*2 + 1]
call qword [0x1400084b8]
test eax, eax
jne 0x140005b42
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140005b42
lea rdx, str.NtSetInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x140005b42
lea ecx, [rbx*4 + 9]
mov dword [rbp - 0x18], ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 4
lea r8, [rbp - 0x18]
mov rcx, rax
mov rax, rdi
lea edx, [r9 + 0x1e]
call qword [0x1400084b8]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rbx, rax
call fcn.1400055f8
test al, al
jne 0x140005b6c
mov eax, r14d
jmp 0x140005b7c
mov rcx, rbx
call fcn.140005950
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
Function at 0x180002a20
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x480
mov rax, qword [0x1800300a0]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov rax, qword [rcx]
mov rsi, rdx
xor ebx, ebx
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x40], rbx
mov rax, qword [rax + 0x48]
call qword [case.0x18000bb15.0]
mov edi, eax
test eax, eax
jne 0x180002bef
lea r8, str.SYSTEMCurrentControlSetEnum_
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.180003f80
mov r8, qword [rsp + 0x38]
lea rcx, [rsp + 0x50]
mov edx, 0x104
call fcn.180004000
test eax, eax
js 0x180002ad2
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180002ad7
jg 0x180002ac7
mov edi, eax
jmp 0x180002ad7
movzx edi, ax
or edi, 0x80070000
jmp 0x180002ad7
mov edi, 0x6f
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test edi, edi
jne 0x180002bed
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x38], 0x206
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Driver
mov dword [rsp + 0x30], 1
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180002b9a
cmp dword [rsp + 0x30], 1
jne 0x180002bc1
lea r8, str.SYSTEMCurrentControlSetControlClass_
mov word [rsp + 0x256], bx
mov edx, 0x104
lea rcx, [rsp + 0x260]
call fcn.180003f80
lea r8, [rsp + 0x50]
mov edx, 0x104
lea rcx, [rsp + 0x260]
call fcn.180004000
test eax, eax
js 0x180002bad
mov r9d, 0x20019
mov qword [rsp + 0x20], rsi
xor r8d, r8d
lea rdx, [rsp + 0x260]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180002bde
jg 0x180002bd5
mov rcx, qword [rsp + 0x40]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x180002bef
mov rcx, qword [rsp + 0x40]
mov ebx, 0x6f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x180002bef
mov rcx, qword [rsp + 0x40]
mov ebx, 0x8007065d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x180002bef
movzx ebx, ax
or ebx, 0x80070000
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x180002bef
mov eax, edi
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.180001220
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180003380
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor esi, esi
lea rdi, [0x180030060]
mov ebx, esi
nop word [rax + rax]
mov rdx, qword [rbx + rdi + 8]
lea rax, [rsp + 0x40]
mov rcx, qword [rbx + rdi]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800033e6
mov rdx, qword [rbx + rdi + 0x10]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rbx, 0x20
cmp rbx, 0x40
jb 0x1800033a0
mov rbx, qword [rsp + 0x48]
xor eax, eax
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1800037c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
sub rsp, 0x28
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax - 8], rdi
mov qword [rax - 0x10], r12
mov r12, r9
mov qword [rax - 0x18], r13
xor r9d, r9d
mov qword [rax - 0x20], r14
mov r13, rdx
mov rax, rcx
mov qword [rsp], r15
movzx ecx, r8b
mov edx, r9d
shr r8d, 8
test r8d, r8d
jne 0x180003809
mov r8d, 0xffffffff
cmp ecx, 0x24
mov r10b, 1
cmovb edx, ecx
movzx ecx, byte [rax]
cmp cl, 0x2b
jne 0x18000381f
mov r10b, 1
jmp 0x180003828
cmp cl, 0x2d
jne 0x180003831
xor r10b, 1
inc rax
add r8d, 0xffffffff
jne 0x180003812
lea rbx, [0x180000000]
test edx, edx
jne 0x180003886
cmp byte [rax], 0x30
lea edi, [rdx + 0xa]
jne 0x1800038be
cmp r8d, 1
jbe 0x180003871
movzx ecx, byte [rax + 1]
sub cl, 0x58
test cl, 0xdf
jne 0x180003871
movzx ecx, byte [rax + 2]
cmp byte [rcx + rbx + 0xda20], 0x10
jae 0x180003871
add rax, 2
lea edi, [rdx + 0x10]
add r8d, 0xfffffffe
jmp 0x1800038be
movzx ecx, byte [rax + 1]
cmp byte [rcx + rbx + 0xda20], 8
jae 0x1800038be
mov edi, 8
jmp 0x1800038be
mov edi, edx
cmp edx, 0x10
jne 0x1800038be
cmp byte [rax], 0x30
jne 0x1800038be
cmp r8d, 1
jbe 0x1800038be
movzx ecx, byte [rax + 1]
cmp cl, 0x78
je 0x1800038a6
cmp cl, 0x58
jne 0x1800038be
movzx ecx, byte [rax + 2]
mov edi, edx
cmp byte [rcx + rbx + 0xda20], 0x10
jae 0x1800038be
add r8d, 0xfffffffe
add rax, 2
mov r14d, edi
mov r15, rax
movsx ebp, byte [r14 + rbx + 0xdb20]
mov rbx, r9
test r8d, r8d
je 0x180003927
lea r13, [0x180000000]
mov qword [rsp + 0x48], rsi
movzx ecx, byte [rax]
test cl, cl
je 0x18000391d
movzx esi, byte [rcx + r13 + 0xda20]
cmp esi, edi
jae 0x18000391d
mov r11, rbx
imul rbx, r14
add rbx, rsi
cmp r11, rbx
ja 0x18000390e
mov ecx, ebp
shr r11, cl
test r11, r11
je 0x180003914
mov r9d, 0x37
inc rax
add r8d, 0xffffffff
jne 0x1800038e1
mov r13, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
mov r14, qword [rsp + 8]
mov rdi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
test r10b, r10b
jne 0x18000394a
test r9d, r9d
mov ecx, 0x39
cmove r9d, ecx
neg rbx
test r12, r12
je 0x180003953
mov qword [r12], rbx
mov r12, qword [rsp + 0x18]
cmp rax, r15
mov r15, qword [rsp]
mov ecx, 0xffffffc8
mov rbx, qword [rsp + 0x30]
cmove r9d, ecx
test r13, r13
je 0x180003976
mov qword [r13], rax
mov r13, qword [rsp + 0x10]
test r9d, r9d
jne 0x1800039c3
cmp byte [rax], r9b
je 0x1800039c3
test r8d, r8d
je 0x1800039c3
nop word [rax + rax]
movzx ecx, byte [rax]
cmp cl, 0x20
je 0x18000399d
cmp cl, 9
jne 0x1800039b0
inc rax
add r8d, 0xffffffff
jne 0x180003990
mov eax, 0x4d
add rsp, 0x28
ret
test r8d, r8d
je 0x1800039a6
test cl, cl
je 0x1800039a6
mov eax, 0x4c
add rsp, 0x28
ret
mov eax, r9d
add rsp, 0x28
ret
Function at 0x180004390
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0xe0
mov rax, qword [0x1800300a0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rbx, rcx
mov esi, r8d
mov ecx, 0xfffffff4
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ebp, ebp
lea r9, [rsp + 0x40]
mov rcx, rax
mov qword [rsp + 0x20], rbp
mov r8d, edi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r9d, [rbp + 0xa]
mov dword [rsp + 0x30], 0x2010
mov dword [rsp + 0x28], ebp
lea rcx, [rsp + 0x50]
mov r8d, esi
mov dword [rsp + 0x20], ebp
lea edx, [r9 + 0x76]
call fcn.180006270
mov ecx, 0xfffffff4
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov rcx, rax
lea rdx, [rsp + 0x50]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov rcx, rax
lea r8d, [rbp + 2]
lea rdx, [0x18000db58]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.180001220
mov rbx, qword [rsp + 0x118]
add rsp, 0xe0
pop rdi
pop rsi
pop rbp
ret

Function at 0x180004480
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, rdx
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1800044d0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0xe0
mov rax, qword [0x1800300a0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r9d, 0x10
mov dword [rsp + 0x30], 0x4080
mov r8, rcx
mov dword [rsp + 0x28], 0x10
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x20], 0x10
lea edx, [r9 + 0x70]
call fcn.180006340
mov ecx, 0xfffffff4
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, [rsp + 0x50]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.180001220
add rsp, 0xe0
pop rbx
ret
Function at 0x180004560
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xe0
mov rax, qword [0x1800300a0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rdi, rcx
cmp rcx, 0x1000
jb 0x1800045bf
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x1800045bf
xor ebx, ebx
cmp byte [rcx], bl
je 0x1800045a9
inc rbx
cmp byte [rcx + rbx], 0
jne 0x1800045a0
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r8d, ebx
mov rdx, rdi
jmp 0x180004662
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, str._pszString
mov r8d, 0xb
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r9d, 0x10
mov dword [rsp + 0x30], 0x4080
mov dword [rsp + 0x28], 0x10
lea rcx, [rsp + 0x50]
mov r8, rdi
mov dword [rsp + 0x20], 0x10
lea edx, [r9 + 0x70]
call fcn.180006340
mov ecx, 0xfffffff4
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, [rsp + 0x50]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r8d, 1
lea rdx, [0x18000db54]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.180001220
mov rbx, qword [rsp + 0xf8]
add rsp, 0xe0
pop rdi
ret

Function at 0x1800046a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x110
mov rax, qword [0x1800300a0]
xor rax, rsp
mov qword [rsp + 0x100], rax
xor ebp, ebp
mov dword [rsp + 0x30], 0x2000
mov esi, ecx
mov dword [rsp + 0x28], ebp
mov r8d, ecx
mov dword [rsp + 0x20], ebp
mov edi, 0xa8
lea rcx, [rsp + 0x50]
lea r9d, [rbp + 0xa]
mov edx, edi
call fcn.180006270
mov dword [rsp + 0x30], 0x2008
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x28], ebp
lea r9d, [rbp + 0x10]
mov r8d, esi
mov dword [rsp + 0x20], ebp
lea rbx, [rax + 2]
mov word [rsp + rax + 0x50], 0x2820
sub rdi, rbx
add rcx, rbx
mov rdx, rdi
call fcn.180006270
add rax, rbx
mov ecx, 0xfffffff4
mov byte [rsp + rax + 0x50], 0x29
lea ebx, [rax + 1]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov rcx, rax
lea rdx, [rsp + 0x50]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.180001220
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180004790
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0xe0
mov rax, qword [0x1800300a0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r9d, 0x10
mov dword [rsp + 0x30], 0x2008
mov r8d, ecx
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x20], 0
lea edx, [r9 + 0x70]
call fcn.180006270
mov ecx, 0xfffffff4
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, [rsp + 0x50]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.180001220
add rsp, 0xe0
pop rbx
ret

Function at 0x180005d90
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xd0
mov rax, qword [0x180032278]
mov rdi, rdx
mov ebx, ecx
test rax, rax
je 0x180005dc1
mov ecx, 0x17
call qword [case.0x18000bb15.0]
test eax, eax
je 0x180005dc1
mov ecx, ebx
int 0x29
mov rax, qword [0x180032260]
test rax, rax
je 0x180005dd8
call qword [case.0x18000bb15.0]
test eax, eax
je 0x180005dd8
int3
mov rax, qword [0x180032268]
test rax, rax
je 0x180005e83
cmp qword [0x180032270], 0
je 0x180005e83
xor ecx, ecx
call qword [case.0x18000bb15.0]
mov rax, qword [rdi + 0xf8]
lea rcx, [rsp + 0x20]
xorps xmm0, xmm0
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0xc0000409
mov qword [rsp + 0x20], rax
mov rax, qword [0x180032270]
mov dword [rsp + 0x34], 1
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x50], rbx
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x28], rdi
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rsp + 0x88], xmm0
movups xmmword [rsp + 0x98], xmm0
movups xmmword [rsp + 0xa8], xmm0
movups xmmword [rsp + 0xb8], xmm0
call qword [case.0x18000bb15.0]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x180005e83