joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006ef0
Capabilities:
Check if file exists
Self delete using alternate data streams

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x2f8
mov rbx, rcx
lea rdi, [rsp + 0x240]
xor eax, eax
mov ecx, 0x98
rep stosb byte [rdi], al
mov dword [rsp + 0x240], 0x98
lea rdi, [rsp + 0x38]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x38]
mov qword [rsp + 0x270], rax
mov dword [rsp + 0x278], 0xffff
mov dword [rsp + 0x2a0], 0x10080008
lea rcx, [rsp + 0x240]
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
test eax, eax
je 0x1400070af
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
lea rcx, [rsp + 0x38]
mov edx, 0x10000
xor r8d, r8d
xor r9, r9
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
test r12, r12
je 0x1400070af
xorps xmm0, xmm0
movups xmmword [rsp + 0x2d8], xmm0
mov qword [rsp + 0x2e8], 0
mov dword [rsp + 0x2e8], 8
lea rdi, [rsp + 0x2ec]
lea rsi, str.:wtfbbq
mov ecx, 8
rep movsb byte [rdi], byte [rsi]
mov rcx, r12
mov edx, 3
lea r8, [rsp + 0x2d8]
mov r9d, 0x20
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
test eax, eax
je 0x1400070af
test r12, r12
je 0x140007007
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
lea rcx, [rsp + 0x38]
mov edx, 0x10000
xor r8d, r8d
xor r9, r9
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
test r12, r12
je 0x1400070af
mov byte [rsp + 0x2f0], 0
mov byte [rsp + 0x2f0], 1
mov rcx, r12
mov edx, 4
lea r8, [rsp + 0x2f0]
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
test eax, eax
je 0x1400070af
test r12, r12
je 0x14000707c
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x38]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400070af
mov rcx, rbx
lea rdx, [0x140015a48]
lea r8, [0x140015a30]
mov r9d, 0x40
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
jmp 0x1400070b1
xor eax, eax
add rsp, 0x2f8
pop r12
pop rdi
pop rsi
pop rbx
ret

Function at 0x140007a60
Capabilities:
Enumerate processes

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x260
mov rbx, rcx
lea rdi, [rsp + 0x20]
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
mov dword [rsp + 0x20], 0x238
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
mov rcx, rsi
lea rdx, [rsp + 0x20]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140007af6
nop dword [rax]
nop word [rax + rax]
lea rax, [rsp + 0x4c]
mov r9, rax
mov rcx, rbx
mov edx, 0x180
xor r8, r8
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [0x14001e2a0]
movsxd rdx, dword [0x14001f500]
mov ecx, dword [rsp + 0x28]
mov dword [rax + rdx*4], ecx
add dword [0x14001f500], 1
mov rcx, rsi
lea rdx, [rsp + 0x20]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140007ab0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x260
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400093d0
Capabilities:
Enumerate services

Disassembly:
push rbx
push rsi
push rdi
push r12
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rbx, rcx
xor ecx, ecx
xor edx, edx
mov r8d, 4
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rsi, rsi
je 0x1400094da
mov dword [rbp - 4], 0
mov dword [rbp - 8], 0
mov dword [rbp - 0xc], 0
call fcn.140001220
mov edx, 0x3ff
mov ecx, 0x13f
cmp eax, 0x2800
cmovae edi, edx
cmovb edi, ecx
mov qword [rsp + 0x38], 0
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 4]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov rcx, rsi
mov edx, edi
mov r8d, 3
xor r9, r9
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
test eax, eax
jne 0x140009473
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x1400094de
mov edx, dword [rbp - 4]
mov eax, edx
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.14000bbc0
sub rsp, rax
lea rax, [rsp + 0x40]
mov r12, rax
lea rax, [rbp - 0xc]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 4]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edx
mov rcx, rsi
mov edx, edi
mov r8d, 3
mov r9, r12
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
test eax, eax
je 0x1400094de
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [rbp - 8], 0
jbe 0x140009517
xor edi, edi
jmp 0x1400094f0
xor eax, eax
jmp 0x14000951c
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400094da
mov eax, edi
lea rax, [rax + rax*2]
shl rax, 4
mov r9, qword [r12 + rax]
mov rcx, rbx
mov edx, 0x180
xor r8, r8
call qword [sym.imp.USER32.dll_SendMessageW]
add edi, 1
cmp edi, dword [rbp - 8]
jb 0x1400094f0
mov eax, 1
mov rsp, rbp
pop rbp
pop r12
pop rdi
pop rsi
pop rbx
ret

Function at 0x140009690
Capabilities:
Modify service

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
mov esi, edx
xor ecx, ecx
xor edx, edx
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rdi, rdi
je 0x140009702
mov rcx, rdi
mov rdx, rbx
mov r8d, 2
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x20], esi
mov rcx, rbx
mov edx, 0xc
lea r8, [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x140009706
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x140009714
xor eax, eax
jmp 0x140009714
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000a620
Capabilities:
Query service status
Start service
Stop service

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
xor ecx, ecx
xor edx, edx
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rsi, rsi
je 0x14000a6ef
mov rcx, rsi
lea rdx, [0x14001e060]
mov r8d, 0x34
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x14000a675
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14000a6e7
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov rcx, rdi
lea rdx, [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov eax, dword [rsp + 0x24]
cmp eax, 1
je 0x14000a6cc
cmp eax, 4
jne 0x14000a6f3
mov rcx, rdi
mov edx, 1
lea r8, [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x14000a6f3
jmp 0x14000a6de
mov rcx, rdi
xor edx, edx
xor r8, r8
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x14000a6f3
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call fcn.140001040
xor eax, eax
jmp 0x14000a701
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x14000a710
Capabilities:
Continue service
Pause service
Query service status

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
xor ecx, ecx
xor edx, edx
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rsi, rsi
je 0x14000a7e4
mov rcx, rsi
lea rdx, [0x14001e060]
mov r8d, 0x44
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x14000a765
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14000a7dc
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov rcx, rdi
lea rdx, [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov eax, dword [rsp + 0x24]
cmp eax, 4
je 0x14000a7bc
cmp eax, 7
jne 0x14000a7e8
mov rcx, rdi
mov edx, 3
lea r8, [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x14000a7e8
jmp 0x14000a7d3
mov rcx, rdi
mov edx, 2
lea r8, [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x14000a7e8
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call fcn.140001040
xor eax, eax
jmp 0x14000a7f6
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000a800
Capabilities:
Modify service

Disassembly:
push rbx
push rsi
push rdi
push rbp
mov rbp, rsp
sub rsp, 0x68
mov rbx, rcx
xor ecx, ecx
xor edx, edx
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rsi, rsi
je 0x14000a858
mov rcx, rsi
lea rdx, [0x14001e060]
mov r8d, 3
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x14000a85f
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14000a93a
xor eax, eax
jmp 0x14000a9b2
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [rbp - 4], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
lea r9, [rbp - 4]
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x14000a89b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14000a89b
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14000a858
mov r8d, dword [rbp - 4]
mov eax, r8d
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.14000bbc0
sub rsp, rax
lea rax, [rsp + 0x60]
mov rsi, rax
mov rcx, rdi
mov rdx, rsi
lea r9, [rbp - 4]
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x14000a890
cmp dword [rsi + 4], 4
jne 0x14000a947
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 0xffffffff
mov r8d, 3
mov r9d, 0xffffffff
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x14000a9a4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call fcn.140001040
jmp 0x14000a858
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 0xffffffff
mov r8d, 4
mov r9d, 0xffffffff
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
je 0x14000a931
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov rsp, rbp
pop rbp
pop rdi
pop rsi
pop rbx
ret

Function at 0x14000bc80
Capabilities:
Create thread
Resume thread

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x38
mov rbx, rcx
mov esi, edx
mov rdi, r8
mov ecx, 0x138
call fcn.14000b700
mov r12, rax
test r12, r12
je 0x14000bcfe
mov rcx, r12
call fcn.14000cca0
mov qword [r12 + 0x10], rbx
mov qword [r12 + 0x18], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
mov edx, esi
xor ecx, ecx
lea r8, [0x14000bc10]
mov r9, r12
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rbx, rbx
je 0x14000bd02
mov qword [r12], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x14000bd26
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14000bd0a
xor esi, esi
jmp 0x14000bd0a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, r12
call fcn.14000bb50
test esi, esi
je 0x14000bd1d
mov ecx, esi
call fcn.14000c960
mov rax, 0xffffffffffffffff
jmp 0x14000bd29
mov rax, rbx
add rsp, 0x38
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000bda0
Capabilities:
Terminate process

Disassembly:
push rbx
push rsi
sub rsp, 0x88
mov ecx, 0x2000000
call fcn.14000f130
mov qword [0x14001f700], rax
call fcn.14000c6e0
test al, al
je 0x14000bea7
call fcn.14000cbd0
test al, al
je 0x14000beb3
call fcn.14000d240
call fcn.14000d360
call fcn.14000d420
call fcn.14000d880
call fcn.14000d950
lea rbx, [0x14001a4e0]
lea rax, [0x14001a4e0]
cmp rbx, rax
jae 0x14000be12
call qword [rbx]
add rbx, 8
lea rax, [0x14001a4e0]
cmp rbx, rax
jb 0x14000be00
mov dword [rsp + 0x5c], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
call fcn.14000da50
movzx edx, word [rsp + 0x60]
mov ecx, 0xa
test dword [rsp + 0x5c], 1
cmovne r9d, edx
cmove r9d, ecx
mov rcx, rbx
xor edx, edx
mov r8, rax
call fcn.14000ae90
mov ebx, eax
lea rsi, [0x14001a4e0]
lea rax, [0x14001a4e0]
cmp rsi, rax
jae 0x14000be92
nop word [rax + rax]
nop word [rax + rax]
call qword [rsi]
add rsi, 8
lea rax, [0x14001a4e0]
cmp rsi, rax
jb 0x14000be80
mov ecx, ebx
jmp 0x14000daa0
mov ecx, 0xfffffffe
call fcn.14000c390
jmp 0x14000bebd
mov ecx, 0xfffffffd
call fcn.14000c390
add rsp, 0x88
pop rsi
pop rbx
ret
push rbx
sub rsp, 0x20
mov ebx, ecx
mov ecx, 2
call fcn.14000c5d0
cmp qword [0x14001ba80], 0x50
jb 0x14000daf0
cmp qword [0x14001fd40], 0
je 0x14000db20
nop
nop word [rax + rax]
mov rax, qword [0x14001fd40]
sub rax, 1
mov qword [0x14001fd40], rax
lea rdx, [0x14001fd60]
call qword [rdx + rax*8]
jmp 0x14000db16
mov rax, qword [0x14001ba80]
lea rdx, [rax + 1]
mov qword [0x14001ba80], rdx
lea rdx, [0x14001fd60]
call qword [rdx + rax*8]
cmp qword [0x14001ba80], 0x50
jb 0x14000daf0
cmp qword [0x14001fd40], 0
jne 0x14000dad0
mov rdx, rsp
xor ecx, ecx
call fcn.14000db40
mov ecx, ebx
jmp fcn.14000e630

Function at 0x14000c390
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
lea eax, [ecx + 0x13]
cmp eax, 0x11
ja 0x14000c461
lea rax, [0x140018860]
lea edx, [ecx + 0x13]
movsxd rdx, edx
jmp qword [rax + rdx*8]
lea rbx, str.CRT:_unexpected_error
cmp ecx, 0xffffffee
je 0x14000c4a7
lea rcx, [0x14001bc30]
call fcn.14000c680
mov rcx, rbx
lea rdx, [0x14001bc30]
call fcn.14000e5a0
lea rcx, str.____terminating_n
lea rdx, [0x14001bc30]
call fcn.14000e5a0
lea rcx, [0x14001bc30]
call fcn.14000c6b0
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14000c4c8
int3
mov ecx, 0xff
jmp fcn.14000e630

Function at 0x14000c680
Capabilities:
Terminate process

Disassembly:
test rcx, rcx
je 0x14000c6a3
mov eax, dword [rcx + 0x7c]
cmp eax, 0xff
ja 0x14000c699
add eax, 0xd
mov ecx, eax
jmp fcn.14000c5d0
mov ecx, 0xfffffffa
jmp fcn.14000c390
ret

Function at 0x14000c6b0
Capabilities:
Terminate process

Disassembly:
test rcx, rcx
je 0x14000c6d0
mov eax, dword [rcx + 0x7c]
cmp eax, 0xff
ja 0x14000c6c6
add eax, 0xd
mov ecx, eax
jmp fcn.14000c660
mov ecx, 0xfffffffa
jmp fcn.14000c390
ret
Function at 0x14000cbd0
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
call fcn.14000c4e0
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x14001ba50], eax
cmp eax, 0xffffffff
je 0x14000cc23
mov ecx, 0x138
call fcn.14000b700
mov rbx, rax
test rbx, rbx
je 0x14000cc23
mov ecx, dword [0x14001ba50]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14000cc23
mov rcx, rbx
call fcn.14000cca0
mov qword [rbx], 0xffffffffffffffff
mov al, 1
jmp 0x14000cc25
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14000cd30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
push rsi
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x14001ba50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rsi, rsi
jne 0x14000cd86
mov ecx, 0x138
call fcn.14000b700
mov rsi, rax
test rsi, rsi
je 0x14000cd93
mov ecx, dword [0x14001ba50]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14000cd93
mov rcx, rsi
call fcn.14000cca0
mov qword [rsi], 0xffffffffffffffff
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
jmp 0x14000cd9d
mov ecx, 0xfffffffb
call fcn.14000c390
add rsp, 0x28
pop rsi
pop rbx
ret

Function at 0x14000cdb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
push rsi
sub rsp, 0x28
mov rbx, rcx
mov esi, dword [0x14001ba50]
cmp esi, 0xffffffff
je 0x14000ceab
test rbx, rbx
je 0x14000ce89
cmp qword [rbx + 8], 0
je 0x14000cde1
mov rcx, qword [rbx + 8]
call fcn.14000d1e0
lea rax, [0x14001f7a0]
cmp qword [rbx + 0x20], rax
je 0x14000cdf7
mov rcx, qword [rbx + 0x20]
call fcn.14000bb50
mov rcx, qword [rbx + 0x28]
call fcn.14000bb50
lea rax, [0x14001c500]
cmp qword [rbx + 0x30], rax
je 0x14000ce16
mov rcx, qword [rbx + 0x30]
call fcn.14000bb50
mov rcx, qword [rbx + 0x68]
call fcn.14000bb50
mov rcx, qword [rbx + 0x88]
call fcn.14000bb50
mov rcx, qword [rbx + 0x90]
call fcn.14000bb50
mov rcx, qword [rbx + 0xa8]
call fcn.14000bb50
mov rcx, qword [rbx + 0xb0]
call fcn.14000bb50
mov rcx, qword [rbx + 0xb8]
call fcn.14000bb50
mov rcx, qword [rbx + 0x100]
call fcn.14000bb50
mov rcx, qword [rbx + 0x118]
call fcn.14000bb50
mov rcx, qword [rbx + 0x120]
call fcn.14000bb50
mov rcx, rbx
call fcn.14000bb50
jmp 0x14000ce9d
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
jne 0x14000cdd1
mov ecx, dword [0x14001ba50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x28
pop rsi
pop rbx
ret
Function at 0x14000d880
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x240
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rbx, rax
cmp word [rbx], 0
jne 0x14000d8b1
xor ecx, ecx
lea rdx, [rsp + 0x28]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rbx, [rsp + 0x28]
lea rax, [rsp + 0x230]
mov qword [rsp + 0x20], rax
mov rcx, rbx
xor edx, edx
xor r8, r8
lea r9, [rsp + 0x238]
call fcn.14000d680
mov rsi, qword [rsp + 0x238]
mov rax, rsi
shl rax, 3
mov rdx, qword [rsp + 0x230]
lea rcx, [rax + rdx*2]
call fcn.14000b700
mov rdi, rax
test rdi, rdi
je 0x14000d93a
lea rax, [rsp + 0x230]
mov qword [rsp + 0x20], rax
lea r8, [rdi + rsi*8]
mov rcx, rbx
mov rdx, rdi
lea r9, [rsp + 0x238]
call fcn.14000d680
mov rax, qword [rsp + 0x238]
sub rax, 1
mov dword [0x14001f740], eax
mov qword [0x14001f760], rdi
jmp 0x14000d944
mov ecx, 0xfffffffc
call fcn.14000c390
add rsp, 0x240
pop rdi
pop rsi
pop rbx
ret

Function at 0x14000d950
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rbx, rax
test rbx, rbx
je 0x14000da21
mov rax, rbx
xor edx, edx
cmp word [rax], 0
je 0x14000d9a2
mov rcx, 0xffffffffffffffff
nop dword [rax]
add rcx, 1
cmp word [rax + rcx*2], 0
jne 0x14000d980
add rcx, 1
cmp word [rax], 0x3d
je 0x14000d998
add rdx, rcx
lea rax, [rax + rcx*2]
cmp word [rax], 0
jne 0x14000d972
lea rcx, [rdx + rdx + 2]
call fcn.14000b700
mov qword [0x14001f780], rax
test rax, rax
je 0x14000da39
mov rdx, rax
mov r8, rbx
cmp word [r8], 0
je 0x14000da11
mov rax, 0xffffffffffffffff
add rax, 1
cmp word [r8 + rax*2], 0
jne 0x14000d9d0
lea r9, [rax + 1]
cmp word [r8], 0x3d
je 0x14000da06
xor ecx, ecx
nop dword [rax]
mov ax, word [r8 + rcx]
mov word [rdx + rcx], ax
add rcx, 2
test ax, ax
jne 0x14000d9f0
lea rdx, [rdx + r9*2]
lea r8, [r8 + r9*2]
cmp word [r8], 0
jne 0x14000d9c9
mov word [rdx], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000da43
mov ecx, 1
mov edx, 2
call fcn.14000ed40
mov qword [0x14001f780], rax
jmp 0x14000da43
mov ecx, 0xfffffffc
call fcn.14000c390
add rsp, 0x20
pop rbx
ret

Function at 0x14000da50
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp word [rax], 0x22
jne 0x14000da7e
add rax, 2
mov dx, word [rax]
cmp dx, 0x22
je 0x14000da72
test dx, dx
jne 0x14000da60
cmp word [rax], 0x22
jne 0x14000da8a
add rax, 2
jmp 0x14000da8a
cmp word [rax], 0x20
jbe 0x14000da8a
add rax, 2
jmp 0x14000da7e
cmp word [rax], 0
je 0x14000da96
cmp word [rax], 0x20
jbe 0x14000da78
add rsp, 0x28
ret
Function at 0x14000daa0
Capabilities:
Terminate process

Disassembly:
push rbx
push rsi
sub rsp, 0x88
mov ecx, 0x2000000
call fcn.14000f130
mov qword [0x14001f700], rax
call fcn.14000c6e0
test al, al
je 0x14000bea7
call fcn.14000cbd0
test al, al
je 0x14000beb3
call fcn.14000d240
call fcn.14000d360
call fcn.14000d420
call fcn.14000d880
call fcn.14000d950
lea rbx, [0x14001a4e0]
lea rax, [0x14001a4e0]
cmp rbx, rax
jae 0x14000be12
call qword [rbx]
add rbx, 8
lea rax, [0x14001a4e0]
cmp rbx, rax
jb 0x14000be00
mov dword [rsp + 0x5c], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
call fcn.14000da50
movzx edx, word [rsp + 0x60]
mov ecx, 0xa
test dword [rsp + 0x5c], 1
cmovne r9d, edx
cmove r9d, ecx
mov rcx, rbx
xor edx, edx
mov r8, rax
call fcn.14000ae90
mov ebx, eax
lea rsi, [0x14001a4e0]
lea rax, [0x14001a4e0]
cmp rsi, rax
jae 0x14000be92
nop word [rax + rax]
nop word [rax + rax]
call qword [rsi]
add rsi, 8
lea rax, [0x14001a4e0]
cmp rsi, rax
jb 0x14000be80
mov ecx, ebx
jmp 0x14000daa0
mov ecx, 0xfffffffe
call fcn.14000c390
jmp 0x14000bebd
mov ecx, 0xfffffffd
call fcn.14000c390
add rsp, 0x88
pop rsi
pop rbx
ret
push rbx
sub rsp, 0x20
mov ebx, ecx
mov ecx, 2
call fcn.14000c5d0
cmp qword [0x14001ba80], 0x50
jb 0x14000daf0
cmp qword [0x14001fd40], 0
je 0x14000db20
nop
nop word [rax + rax]
mov rax, qword [0x14001fd40]
sub rax, 1
mov qword [0x14001fd40], rax
lea rdx, [0x14001fd60]
call qword [rdx + rax*8]
jmp 0x14000db16
mov rax, qword [0x14001ba80]
lea rdx, [rax + 1]
mov qword [0x14001ba80], rdx
lea rdx, [0x14001fd60]
call qword [rdx + rax*8]
cmp qword [0x14001ba80], 0x50
jb 0x14000daf0
cmp qword [0x14001fd40], 0
jne 0x14000dad0
mov rdx, rsp
xor ecx, ecx
call fcn.14000db40
mov ecx, ebx
jmp fcn.14000e630

Function at 0x140010840
Capabilities:
Get thread local storage value

Disassembly:
mov ecx, dword [rcx + 0x18]
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x140010850
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
sete al
movzx eax, al
add rsp, 0x28
ret