joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000ed90
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov r11, rsp
push r12
push r13
push r14
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov rax, qword [0x1400410e0]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor sil, sil
mov eax, 2
mov r13d, 0x400
mul r13
mov rdi, rax
mov r14, 0xffffffffffffffff
cmovo rdi, r14
xor r12d, r12d
mov dword [r11 - 0x68], r12d
mov rax, qword [0x140044d08]
test rax, rax
jne 0x14000ee0c
call fcn.1400185b0
mov qword [0x140044d08], rax
test rax, rax
je 0x14000ef15
mov r8, qword [rsp + 0x88]
lea r9, [rsp + 0x20]
mov ebp, 1
mov edx, ebp
mov rcx, rdi
call rax
mov rbx, rax
test rax, rax
je 0x14000ef15
mov edx, r13d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r12
mov word [rsp + 0x38], r12w
xor eax, eax
mov rcx, r14
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.14000b2e0
nop
lea r8d, [rbp + 0xb]
lea rdx, str.pnputil.exe
lea rcx, [rsp + 0x38]
call fcn.14000b180
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
movzx edi, sil
cmp eax, 0xffffffff
cmovne edi, ebp
mov qword [rsp + 0x20], rbx
mov rax, qword [0x140044d10]
test rax, rax
jne 0x14000eec9
call fcn.140018630
mov qword [0x140044d10], rax
test rax, rax
je 0x14000eed9
mov edx, ebp
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x140044d10]
cmp qword [rsp + 0x50], 8
jb 0x14000ef0f
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x28], rcx
test rcx, rcx
je 0x14000ef0f
test rax, rax
jne 0x14000ef06
call fcn.140018630
mov qword [0x140044d10], rax
test rax, rax
je 0x14000ef0f
xor edx, edx
lea rcx, [rsp + 0x28]
call rax
movzx eax, dil
jmp 0x14000ef19
movzx eax, sil
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14001a510
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret

Function at 0x140012a90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140012ac3
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140012b06
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x140012b01
cmp rbx, r11
jae 0x140012b06
dec edi
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x140012af0
cmp rbx, r11
jb 0x140012b0a
xor eax, eax
jmp 0x140012b16
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140012d30
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x140044d08]
xor ebx, ebx
mov rdi, rcx
mov dword [rsp + 0x30], ebx
test rax, rax
jne 0x140012d60
call fcn.1400185b0
mov qword [0x140044d08], rax
test rax, rax
je 0x140012d79
mov r8, qword [rsp + 0x28]
lea r9, [rsp + 0x30]
mov edx, 1
mov ecx, 0x208
call rax
mov rbx, rax
mov qword [rdi + 8], rbx
test rbx, rbx
je 0x140012da9
xor edx, edx
mov r8d, 0x104
mov rcx, rbx
call fcn.14001c640
mov rdx, qword [rdi + 8]
lea rcx, str._WinDir_Inf
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140014280
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov qword [rbp - 9], 0xfffffffffffffffe
mov qword [rsp + 0x108], rbx
mov rax, qword [0x1400410e0]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov qword [rbp + 0x17], 7
xor ebx, ebx
mov qword [rbp + 0xf], rbx
mov word [rbp - 1], bx
lea rdx, [rbp - 1]
call fcn.1400144a0
mov qword [rbp - 0x21], rbx
call fcn.140013c40
test al, al
je 0x140014434
mov qword [rbp + 0x3f], 7
mov qword [rbp + 0x37], rbx
mov word [rbp + 0x27], bx
lea r8d, [rbx + 0x38]
lea rdx, str.SoftwareHewlett_PackardHP_Print_SettingsUPDProperties
lea rcx, [rbp + 0x27]
call fcn.14000b2e0
mov qword [rbp - 0x49], rbx
mov dword [rbp - 0x41], 2
mov byte [rbp - 0x39], bl
lea rdx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae rdx, qword [rbp + 0x27]
lea rax, [rbp - 0x2d]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x49]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rbp - 0x3d], eax
test eax, eax
jne 0x140014365
cmp dword [rbp - 0x2d], 1
jne 0x140014369
mov byte [rbp - 0x39], 1
jmp 0x140014369
mov qword [rbp - 0x49], rbx
cmp qword [rbp + 0x3f], 8
jb 0x1400143a2
mov rax, qword [rbp + 0x27]
mov qword [rbp - 0x19], rax
test rax, rax
je 0x1400143a2
mov rax, qword [0x140044d10]
test rax, rax
jne 0x14001439a
call fcn.140018630
mov qword [0x140044d10], rax
test rax, rax
je 0x1400143a9
xor edx, edx
lea rcx, [rbp - 0x19]
call rax
mov rax, qword [0x140044d10]
mov qword [rbp + 0x3f], 7
mov qword [rbp + 0x37], rbx
mov word [rbp + 0x27], bx
lea rdx, [rbp - 1]
mov r8, qword [rbp - 1]
cmp qword [rbp + 0x17], 8
cmovae rdx, r8
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x14001443f
mov dword [rbp - 0x29], 8
mov dword [rbp - 0x31], 0xb
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x21]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x31]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp - 0x3d], eax
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x140014434
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 8
cmovae rdx, qword [rbp - 1]
call fcn.1400161e0
mov dword [rbp - 0x3d], eax
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x140014434
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp - 0x3d], eax
mov rax, qword [0x140044d10]
mov r8, qword [rbp - 1]
mov rbx, qword [rbp - 0x21]
cmp qword [rbp + 0x17], 8
jb 0x140014471
mov qword [rbp - 0x11], r8
test r8, r8
je 0x140014471
test rax, rax
jne 0x140014469
call fcn.140018630
mov qword [0x140044d10], rax
test rax, rax
je 0x140014471
xor edx, edx
lea rcx, [rbp - 0x11]
call rax
mov rax, rbx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.14001a510
mov rbx, qword [rsp + 0x108]
add rsp, 0xf0
pop rbp
ret
Function at 0x1400161e0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x1400410e0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x140016252
test rdx, rdx
je 0x140016252
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 0x100
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140016244
cmp eax, 0xea
jne 0x140016257
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x140016257
mov eax, 0xd
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14001a510
mov rbx, qword [rsp + 0x170]
add rsp, 0x150
pop rdi
ret
Function at 0x1400164a0
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov qword [rsp + 0x110], rbx
mov rax, qword [0x1400410e0]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rsi, rdx
mov rbx, rcx
mov qword [rbp + 0x1f], 7
xor r12d, r12d
mov qword [rbp + 0x17], r12
mov word [rbp + 7], r12w
lea r8d, [r12 + 0x15]
lea rdx, [0x140035250]
lea rcx, [rbp + 7]
call fcn.14000b2e0
nop
mov qword [rbp - 9], 7
mov qword [rbp - 0x11], r12
mov word [rbp - 0x21], r12w
lea r8d, [r12 + 0x1d]
lea rdx, str.SOFTWAREHewlett_PackardSNMP
lea rcx, [rbp - 0x21]
call fcn.14000b2e0
nop
add rbx, 8
mov r13b, 1
mov qword [rbp - 0x41], r12
mov dword [rbp - 0x49], r12d
cmp qword [rsi + 0x18], 8
jb 0x140016542
mov rsi, qword [rsi]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rsi
mov rcx, rbx
call fcn.14000b2e0
lea rdx, [rbp - 0x21]
cmp qword [rbp - 9], 8
cmovae rdx, qword [rbp - 0x21]
lea rax, [rbp - 0x49]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x41]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1400165ae
xor dil, dil
jmp 0x1400165ff
mov rax, qword [rbx + 0x10]
lea ecx, [rax + rax + 2]
cmp qword [rbx + 0x18], 8
jb 0x1400165c0
mov rbx, qword [rbx]
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae rdx, qword [rbp + 7]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx edi, r13b
test eax, eax
cmovne edi, r12d
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp qword [rbp - 9], 8
jb 0x140016638
mov rax, qword [rbp - 0x21]
mov qword [rbp - 0x31], rax
test rax, rax
je 0x140016638
mov rax, qword [0x140044d10]
test rax, rax
jne 0x140016630
call fcn.140018630
mov qword [0x140044d10], rax
test rax, rax
je 0x14001663f
xor edx, edx
lea rcx, [rbp - 0x31]
call rax
mov rax, qword [0x140044d10]
mov qword [rbp - 9], 7
mov qword [rbp - 0x11], r12
mov word [rbp - 0x21], r12w
cmp qword [rbp + 0x1f], 8
jb 0x140016682
mov rcx, qword [rbp + 7]
mov qword [rbp - 0x39], rcx
test rcx, rcx
je 0x140016682
test rax, rax
jne 0x14001667a
call fcn.140018630
mov qword [0x140044d10], rax
test rax, rax
je 0x140016682
xor edx, edx
lea rcx, [rbp - 0x39]
call rax
movzx eax, dil
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14001a510
mov rbx, qword [rsp + 0x110]
add rsp, 0xd0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400166b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov qword [rbp - 0x59], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400410e0]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
mov qword [rbp - 0x11], 7
xor esi, esi
mov qword [rbp - 0x19], rsi
mov word [rbp - 0x29], si
lea r8d, [rsi + 0x15]
lea rdx, [0x140035250]
lea rcx, [rbp - 0x29]
call fcn.14000b2e0
nop
mov qword [rbp - 0x39], 7
mov qword [rbp - 0x41], rsi
mov word [rbp - 0x51], si
lea r8d, [rsi + 0x1d]
lea rdx, str.SOFTWAREHewlett_PackardSNMP
lea rcx, [rbp - 0x51]
call fcn.14000b2e0
nop
mov dword [rbp - 0x79], 1
lea rdx, [rbp - 0x51]
cmp qword [rbp - 0x39], 8
cmovae rdx, qword [rbp - 0x51]
lea rax, [rbp - 0x71]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400167f4
mov dword [rbp - 0x75], 0x20
xor eax, eax
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x1f], rax
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x2f], rax
mov qword [rbp + 0x37], rax
mov qword [rbp + 0x3f], rax
lea rdx, [rbp - 0x29]
cmp qword [rbp - 0x11], 8
cmovae rdx, qword [rbp - 0x29]
lea rax, [rbp - 0x75]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 7]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x79]
xor r8d, r8d
mov rcx, qword [rbp - 0x71]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400167e9
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 7]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbx + 8]
lea rdx, [rbp + 7]
call fcn.14000b2e0
mov rcx, qword [rbp - 0x71]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp qword [rbp - 0x39], 8
jb 0x140016830
mov rax, qword [rbp - 0x51]
mov qword [rbp - 0x61], rax
test rax, rax
je 0x140016830
mov rdi, qword [0x140044d10]
test rdi, rdi
jne 0x140016828
call fcn.140018630
mov rdi, rax
mov qword [0x140044d10], rax
test rax, rax
je 0x140016837
xor edx, edx
lea rcx, [rbp - 0x61]
call rdi
mov rdi, qword [0x140044d10]
mov qword [rbp - 0x39], 7
mov qword [rbp - 0x41], rsi
mov word [rbp - 0x51], si
cmp qword [rbp - 0x11], 8
jb 0x14001687c
mov rax, qword [rbp - 0x29]
mov qword [rbp - 0x69], rax
test rax, rax
je 0x14001687c
test rdi, rdi
jne 0x140016874
call fcn.140018630
mov rdi, rax
mov qword [0x140044d10], rax
test rax, rax
je 0x14001687c
xor edx, edx
lea rcx, [rbp - 0x69]
call rdi
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14001a510
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140017ed0
Capabilities:
Write file on windows

Disassembly:
test rcx, rcx
je 0x140017fc9
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0x30]
mov esi, edx
mov qword [rsp + 0x48], rbx
call fcn.1400187a0
mov rcx, rax
mov rbx, rax
call fcn.140018880
test al, al
je 0x140017fba
mov rcx, qword [0x140044d40]
mov qword [rsp + 0x50], rbp
xor ebp, ebp
test rcx, rcx
je 0x140017f3f
cmp rcx, 0xffffffffffffffff
je 0x140017f3f
lea r9, [rsp + 0x40]
mov r8d, 0x1f8
mov rdx, rdi
mov dword [rsp + 0x40], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call fcn.140018de0
mov r10, qword [0x140044d48]
mov rbx, rax
test r10, r10
je 0x140017f8e
cmp r10, 0xffffffffffffffff
je 0x140017f8e
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
lea r9, [rsp + 0x40]
mov rdx, rbx
not rcx
mov dword [rsp + 0x40], ebp
mov qword [rsp + 0x20], rbp
lea r8, [rcx - 1]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbp, qword [rsp + 0x50]
test rbx, rbx
je 0x140017fba
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
mov rcx, rbx
call fcn.140018d50
mov rcx, rbx
call fcn.14001be3c
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
repz ret
Function at 0x140018510
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x50]
lea rdx, str.SOFTWAREHewlett_PackardHPProfiler
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
xor bl, bl
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001859f
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14001859f
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x48]
lea rdx, str.AppendCSLSymbolServerPath
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140018594
cmp dword [rsp + 0x40], eax
seta bl
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
add rsp, 0x30
pop rbx
ret
Function at 0x140018d50
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x20
mov esi, edx
mov rbp, rcx
lea edx, [rsi + 1]
lea eax, [rdx - 1]
cmp eax, 0x7ffdeeff
ja 0x140018dcf
mov qword [rsp + 0x30], rbx
mov ecx, edx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], r12
mov r12d, edx
call fcn.14001be7c
mov r8d, r12d
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.14001c640
mov rbx, qword [rsp + 0x30]
test rdi, rdi
je 0x140018dc5
mov r9d, esi
mov r8, rbp
mov edx, r12d
mov rcx, rdi
call fcn.14001b49c
test eax, eax
jne 0x140018dbd
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rdi
call fcn.14001be3c
mov rdi, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
Function at 0x1400192a0
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
push rbx
push rbp
sub rsp, 0x148
mov rax, qword [0x1400410e0]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov qword [r11 - 0x18], r13
mov qword [r11 - 0x20], r14
call qword [sym.imp.KERNEL32.dll_DebugBreak]
cmp byte [0x140044d30], 0
jne 0x1400192e9
lea rcx, [0x140044cd0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [0x140044d30], 1
lea rcx, [0x140044cd0]
mov qword [rsp + 0x160], rsi
mov qword [rsp + 0x168], rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140044d18]
xor r13d, r13d
mov r14d, r13d
test rbx, rbx
je 0x1400193ed
mov rcx, qword [rbx + 0x30]
call fcn.1400187a0
mov qword [rsp + 0x170], r12
mov qword [rsp + 0x130], r15
mov qword [rsp + 0x30], rax
nop word [rax + rax]
add r13, qword [rbx + 0x20]
mov r8d, 2
mov rdx, rbx
mov rcx, rax
inc r14
call fcn.140018de0
mov rsi, rax
test rax, rax
je 0x1400193cb
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
mov eax, ecx
lea r12, [rcx - 1]
dec ecx
cmp ecx, 0x7ffdeeff
ja 0x1400193c3
mov ecx, eax
mov r15d, eax
call fcn.14001be7c
mov r8d, r15d
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.14001c640
test rdi, rdi
je 0x1400193c3
mov r9d, r12d
mov r8, rsi
mov edx, r15d
mov rcx, rdi
call fcn.14001b49c
test eax, eax
jne 0x1400193bb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rdi
call fcn.14001be3c
mov rcx, rsi
call fcn.14001be3c
mov rbx, qword [rbx + 0x10]
mov rax, qword [rsp + 0x30]
test rbx, rbx
jne 0x140019340
mov r15, qword [rsp + 0x130]
mov r12, qword [rsp + 0x170]
mov rax, qword [str._llu_allocations_active__consuming__llu_bytes_r_n]
lea rcx, [rsp + 0x71]
xor edx, edx
mov qword [rsp + 0x38], rax
mov rax, qword [0x140038b08]
mov r8d, 0xaf
mov qword [rsp + 0x40], rax
mov rax, qword [0x140038b10]
mov byte [rsp + 0x70], 0
mov qword [rsp + 0x48], rax
mov rax, qword [0x140038b18]
mov qword [rsp + 0x50], rax
mov rax, qword [0x140038b20]
mov qword [rsp + 0x58], rax
mov rax, qword [0x140038b28]
mov qword [rsp + 0x60], rax
call fcn.14001c640
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x70]
mov r9, r14
mov edx, 0xb0
mov qword [rsp + 0x20], r13
call fcn.14001be18
mov r14, qword [rsp + 0x138]
mov r13, qword [rsp + 0x140]
mov ebp, eax
lea eax, [rbp + 1]
lea ecx, [rax - 1]
cmp ecx, 0x7ffdeeff
ja 0x1400194d0
mov ecx, eax
mov esi, eax
call fcn.14001be7c
mov r8d, esi
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.14001c640
mov rbx, rdi
test rdi, rdi
je 0x1400194d0
lea r8, [rsp + 0x70]
mov r9d, ebp
mov edx, esi
mov rcx, rbx
call fcn.14001b49c
test eax, eax
jne 0x1400194c8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rbx
call fcn.14001be3c
lea rcx, [0x140044cd0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rdi, qword [rsp + 0x168]
mov rsi, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.14001a510
add rsp, 0x148
pop rbp
pop rbx
ret
Function at 0x140019ab0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x1400410e0]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp qword [0x140044d88], 0
jne 0x140019b8f
call qword [sym.imp.dbghelp.dll_SymGetOptions]
or eax, 0x80000006
mov ecx, eax
call qword [sym.imp.dbghelp.dll_SymSetOptions]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x11c
call fcn.14001c640
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 6
jae 0x140019b23
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 0x1000
jmp 0x140019b2e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 0x400
mov r8d, eax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140044d88], rax
test rax, rax
je 0x140019b8f
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 1]
call qword [sym.imp.dbghelp.dll_SymInitialize]
test eax, eax
je 0x140019b72
mov al, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14001a510
add rsp, 0x158
ret
mov rcx, qword [0x140044d88]
test rcx, rcx
je 0x140019b8f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140044d88], 0
xor al, al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14001a510
add rsp, 0x158
ret
Function at 0x14001c85b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400410e0]
jne 0x14001a52a
rol rcx, 0x10
test cx, 0xffff
jne 0x14001a526
repz ret
ror rcx, 0x10
jmp 0x14001c7b4
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140043c20]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140043d18]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14001c839
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140043c20]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14001c85b
mov rax, qword [rsp + 0x88]
mov qword [0x140043d18], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140043cb8], rax
mov rax, qword [0x140043d18]
mov qword [0x140043b90], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140043ca0], rax
mov dword [0x140043b80], 0xc0000409
mov dword [0x140043b84], 1
mov rax, qword [0x1400410e0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400410e8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140043c18], eax
mov ecx, 1
call fcn.140022d68
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140032c00]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140043c18], 0
jne 0x14001c8e2
mov ecx, 1
call fcn.140022d68
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x14001d404
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14001d274