joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005560
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x140285f90]
test rax, rax
jne 0x14000562a
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140005607
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140005607
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x7971fc23
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140005602
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1400055e0
cmp r8d, 0x9712e354
je 0x14000560c
test r9d, r9d
jne 0x1400055c0
mov rax, qword [rax]
jmp 0x140005590
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x140285f90], rax
mov ecx, 0xfffffff5
call rax
mov r8, qword [0x140285f38]
mov rsi, rax
test r8, r8
jne 0x1400056fb
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop word [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400056d7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400056d7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x7860b16f
lea rax, [rdi + r9*4]
mov edx, dword [rax + r10]
add rdx, r10
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x1400056d2
nop
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x1400056b0
cmp r8d, 0x2b8dd2eb
je 0x1400056dc
test r9d, r9d
jne 0x140005690
mov rcx, qword [rcx]
jmp 0x140005660
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov r8d, dword [rcx + rdx*4]
add r8, r10
mov qword [0x140285f38], r8
mov edx, 1
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp r8
Function at 0x140005720
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x140285f50]
test rax, rax
jne 0x1400057ea
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400057c7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400057c7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x77414cfa
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400057c2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1400057a0
cmp r8d, 0x3770e1a1
je 0x1400057cc
test r9d, r9d
jne 0x140005780
mov rax, qword [rax]
jmp 0x140005750
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x140285f50], rax
mov ecx, 0xfffffff5
call rax
mov r8, qword [0x140285f40]
mov rsi, rax
test r8, r8
jne 0x1400058bb
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop word [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140005897
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140005897
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xe848baa2
lea rax, [rdi + r9*4]
mov edx, dword [rax + r10]
add rdx, r10
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x140005892
nop
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x140005870
cmp r8d, 0x64a2697c
je 0x14000589c
test r9d, r9d
jne 0x140005850
mov rcx, qword [rcx]
jmp 0x140005820
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov r8d, dword [rcx + rdx*4]
add r8, r10
mov qword [0x140285f40], r8
mov edx, 7
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp r8
Function at 0x140005eb0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14012df00]
xor rax, rsp
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov r8, qword [0x140285f80]
mov rsi, rax
test r8, r8
jne 0x140005f9b
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov ebx, dword [rax + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140005f77
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140005f77
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x9b7cf45f
lea rax, [rdi + r9*4]
mov edx, dword [rax + r10]
add rdx, r10
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x140005f72
nop
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x140005f50
cmp r8d, 0x8ad3176b
je 0x140005f7c
test r9d, r9d
jne 0x140005f30
mov rcx, qword [rcx]
jmp 0x140005f00
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov r8d, dword [rcx + rdx*4]
add r8, r10
mov qword [0x140285f80], r8
lea rdx, [rsp + 0x30]
mov rcx, rsi
call r8
mov rax, qword [0x140285f48]
test rax, rax
jne 0x14000606a
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140006047
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140006047
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xb0293fdb
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140006042
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140006020
cmp r8d, 0xbb578a8e
je 0x14000604c
test r9d, r9d
jne 0x140006000
mov rax, qword [rax]
jmp 0x140005fd0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x140285f48], rax
mov r8d, dword [rsp + 0x34]
mov r9d, 0x1c2
mov edx, dword [rsp + 0x30]
mov rcx, rsi
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x12c
call rax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400b5ad0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140011580
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x14012df00]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r12, rcx
mov qword [rsp + 0x58], rcx
xor edi, edi
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.1400e71a0
mov dword [rsp + 0x58], 0x104
call fcn.140010980
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov r8d, 0x1a
lea rdx, str.QueryFullProcessImageNameW
lea rcx, [rsp + 0x20]
call fcn.140003bf0
nop
call fcn.14002b950
lea rcx, [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x20]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x38]
cmp rsi, 0xf
cmova rdx, rbx
movabs r9, 0xcbf29ce484222325
mov ecx, edi
mov r8, qword [rsp + 0x30]
test r8, r8
je 0x140011663
movabs r10, 0x100000001b3
nop
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x140011650
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x48]
mov rcx, r15
call fcn.140011160
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140011688
cmp rdx, qword [r15 + 8]
je 0x140011688
mov rdi, qword [rdx + 0x30]
lea rcx, [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
cmp rsi, 0xf
jbe 0x1400116ca
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400116c2
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400117bb
mov rcx, rbx
call fcn.1400b5af0
test rdi, rdi
je 0x1400116e8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x60]
xor edx, edx
call rdi
jmp 0x1400116fa
mov r8d, dword [rsp + 0x58]
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140011720
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.14000f4b0
nop
lea rdx, [rsp + 0x20]
mov rcx, r12
call fcn.140011470
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x140011787
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011782
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400117b5
call fcn.1400b5af0
mov rax, r12
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1400b5ad0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1400c4e44
int3
call fcn.1400c4e44
int3
Function at 0x140014580
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x1a0
mov rax, qword [0x14012df00]
xor rax, rsp
mov qword [rsp + 0x190], rax
xorps xmm0, xmm0
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x80]
mov r8d, 0x108
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
call fcn.1400e71a0
mov rax, qword [rdi + 8]
mov qword [rsp + 0x30], 0
test rbx, rbx
je 0x14001466e
mov rax, qword [rax + 0x70]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
lea r8, [rsp + 0x40]
mov r9d, 0x40
mov rdx, rbx
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jne 0x14001466e
mov eax, 0x5a4d
cmp word [rsp + 0x40], ax
jne 0x14001466e
movsxd rdx, dword [rsp + 0x7c]
mov rax, qword [rdi + 8]
mov qword [rsp + 0x30], 0
add rdx, rbx
je 0x14001466e
mov rax, qword [rax + 0x70]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
mov r9d, 0x108
lea r8, [rsp + 0x80]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jne 0x14001466e
cmp dword [rsp + 0x80], 0x4550
sete al
jmp 0x140014670
xor al, al
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400b5ad0
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x1a0
pop rdi
ret
Function at 0x140014b20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push rdi
push r15
sub rsp, 0xd0
mov rax, qword [0x14012df00]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov rbp, rcx
movsxd r15, r8d
lea rcx, [rsp + 0x60]
call fcn.140011360
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400119f0
xor edi, edi
mov dword [rsp + 0xa0], r15d
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rsp + 0x58]
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x30], xmm1
movups xmmword [rsp + 0x90], xmm1
cmp rdx, 7
jbe 0x140014be1
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014bd2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140014dd4
call fcn.1400b5af0
movups xmm1, xmmword [rsp + 0x30]
movups xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x100], rbx
lea r8, [rsp + 0x80]
mov qword [rsp + 0xc8], rsi
movq rax, xmm1
mov qword [rsp + 0xc0], r12
movabs rbx, 0xcbf29ce484222325
mov qword [rsp + 0xb8], r13
mov rcx, rbx
mov qword [rsp + 0xb0], r14
mov rdx, rdi
movq r14, xmm0
lea rsi, [rax + rax]
movdqa xmm0, xmm1
movabs r13, 0x100000001b3
psrldq xmm0, 8
movq r12, xmm0
cmp r12, 7
cmova r8, r14
test rsi, rsi
je 0x140014c74
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r8 + rdx]
inc rdx
xor rcx, rax
imul rcx, r13
cmp rdx, rsi
jb 0x140014c60
mov r9, r15
lea r8, [rsp + 0x80]
xor r9, rcx
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x18]
call fcn.140015e60
cmp qword [rax + 8], rdi
je 0x140014d53
cmp r12, 7
lea rcx, [rsp + 0x80]
cmova rcx, r14
test rsi, rsi
je 0x140014cc3
nop
movzx eax, byte [rdi + rcx]
inc rdi
xor rbx, rax
imul rbx, r13
cmp rdi, rsi
jb 0x140014cb0
xor r15, rbx
lea r8, [rsp + 0x80]
mov r9, r15
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x18]
call fcn.140015e60
mov rbx, qword [rax + 8]
test rbx, rbx
je 0x140014d53
mov rdx, qword [rbp + 0x48]
and rdx, r15
shl rdx, 4
add rdx, qword [rbp + 0x30]
mov rax, qword [rdx]
cmp qword [rdx + 8], rbx
jne 0x140014d1c
cmp rax, rbx
jne 0x140014d12
mov rax, qword [rbp + 0x20]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x140014d27
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
jmp 0x140014d27
cmp rax, rbx
jne 0x140014d27
mov rax, qword [rbx]
mov qword [rdx], rax
mov rdx, qword [rbx]
lea rcx, [rbx + 0x10]
dec qword [rbp + 0x28]
mov rax, qword [rbx + 8]
mov qword [rax], rdx
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
call fcn.140015f40
mov edx, 0x48
mov rcx, rbx
call fcn.1400b5af0
mov r13, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0x100]
cmp r12, 7
jbe 0x140014da2
lea rdx, [r12*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x140014d9a
mov r14, qword [r14 - 8]
add rdx, 0x27
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140014dce
mov rcx, r14
call fcn.1400b5af0
mov r12, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1400b5ad0
add rsp, 0xd0
pop r15
pop rdi
pop rbp
ret
call fcn.1400c4e44
int3
call fcn.1400c4e44
int3
Function at 0x1400178e0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
xor esi, esi
mov rcx, qword [rcx + 0x10]
movzx edi, dl
test rcx, rcx
je 0x14001790c
jle 0x140017908
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rbx + 0x10], rsi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140017921
jle 0x14001791d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], rsi
mov rcx, qword [rbx]
test rcx, rcx
je 0x140017934
jle 0x140017931
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rsi
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x140017949
jle 0x140017945
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
mov qword [rbx + 0x48], rsi
mov qword [rbx + 0x20], rsi
mov qword [rbx + 0x28], rsi
test dil, dil
jne 0x1400179a8
lea rax, [rbx + 0xf8]
mov qword [rax + 0x10], rsi
cmp qword [rax + 0x18], 7
jbe 0x14001796b
mov rax, qword [rax]
mov word [rax], si
cmp byte [rbx + 0x1c], sil
je 0x140017990
add rbx, 0x118
mov rcx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140017988
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140017997
add rbx, 0x118
mov qword [rbx + 0x10], rsi
cmp qword [rbx + 0x18], 7
jbe 0x1400179a5
mov rbx, qword [rbx]
mov word [rbx], si
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140018830
Capabilities:
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
mov rax, qword [0x14012df00]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov rdi, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp - 0x70]
call fcn.1400e71a0
xor ebx, ebx
mov dword [rsp + 0x78], ebx
mov qword [rsp + 0x40], gethostname
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
lea r8, [rsi + 0x50]
lea rdx, [rsp + 0x78]
mov rcx, rsi
call fcn.140018a90
mov r14, rax
test rax, rax
je 0x140018a4f
test rdi, rdi
jne 0x1400189e0
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x190]
call fcn.1400e71a0
lea rdx, [rbp + 0x190]
mov ecx, 0x100
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rbp - 0x70]
xor r8d, r8d
lea rdx, str.ImageManifest
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x14001890e
mov eax, 0xc0150002
jmp 0x140018a51
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x120116
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
test rax, rax
jle 0x1400189cf
mov dword [rbp - 0x80], ebx
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x80]
mov r8d, dword [rsp + 0x78]
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x78], rbx
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rax
lea rcx, [rsi + 0x118]
lea rax, [rbp - 0x70]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140018986
mov rax, qword [rcx + 0x18]
cmp rdx, rax
ja 0x1400189c3
mov r14, rcx
cmp rax, 7
jbe 0x1400189a5
mov r14, qword [rcx]
mov qword [rcx + 0x10], rdx
lea rdi, [rdx + rdx]
mov r8, rdi
lea rdx, [rbp - 0x70]
mov rcx, r14
call fcn.1400e6b00
mov word [rdi + r14], bx
jmp 0x1400189cd
lea r9, [rbp - 0x70]
call fcn.14000f670
nop
jmp 0x140018a09
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x1250]
jmp 0x140018a51
mov dword [rsp + 0x44], 8
movzx eax, word [rsi + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], rdi
lea rdx, [rsi + 0xf8]
lea rcx, [rsi + 0x118]
call fcn.14000e9d0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateActCtxW]
mov rdi, rax
mov rcx, qword [rsi + 0x48]
cmp rax, rcx
je 0x140018a32
test rcx, rcx
jle 0x140018a2b
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
mov qword [rsi + 0x48], rdi
mov rcx, rdi
test rcx, rcx
jg 0x140018a4f
mov rax, qword gs:[0x30]
cmp dword [rax + 0x1250], 0xc0000022
jne 0x140018a77
mov dword [rsi + 0x50], ebx
xor eax, eax
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.1400b5ad0
mov rbx, qword [rsp + 0x4e0]
add rsp, 0x4a0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x1250]
jmp 0x140018a51
Function at 0x140020850
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x60
mov rax, qword [0x14012df00]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, rcx
lea r9, [rsp + 0x50]
xor ebp, ebp
add rcx, 0x78
mov edx, 0x18
mov qword [rsp + 0x50], rbp
mov r8d, 8
call fcn.14001df00
cmp qword [rsp + 0x50], rbp
je 0x140020951
mov qword [rsp + 0x48], rbp
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, qword [rdi]
lea r9, [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov r8, rax
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], ebp
mov rcx, qword [rcx]
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400208e0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x78]
mov qword [rsp + 0x40], rbp
test rdx, rdx
je 0x140020917
mov rax, qword [rdx + 0x18]
lea r8, [rsp + 0x40]
mov rdx, qword [rdx]
mov r9d, 8
add rdx, 0x18
mov qword [rsp + 0x20], rbp
mov rcx, qword [rax + 0x70]
mov rcx, qword [rcx + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rdx, qword [rdi + 0x88]
mov qword [rsp + 0x40], rbp
test rdx, rdx
je 0x140020951
mov rax, qword [rdx + 0x18]
lea r8, [rsp + 0x40]
mov rdx, qword [rdx]
mov r9d, 8
add rdx, 0x18
mov qword [rsp + 0x20], rbp
mov rcx, qword [rax + 0x70]
mov rcx, qword [rcx + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, qword [rdi + 0x40]
test rcx, rcx
je 0x140020964
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x40], rbp
mov rbx, qword [rdi + 0x20]
test rbx, rbx
je 0x140020a4d
mov qword [rsp + 0x78], rsi
mov rsi, qword [rbx + 0x10]
test rsi, rsi
jg 0x140020999
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rsi, rax
je 0x140020999
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp rsi, rax
jne 0x140020a48
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x48], 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0x48], 0x103
jne 0x140020a48
mov rcx, qword [rdi + 0x20]
xor edx, edx
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rdi + 0x20]
mov edx, 0xffffffff
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rbx, qword [rdi + 0x20]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400209fa
jle 0x1400209f6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], rbp
mov dword [rbx + 8], ebp
mov rbx, qword [rdi + 0x28]
mov qword [rdi + 0x20], rbp
mov qword [rdi + 0x28], rbp
test rbx, rbx
je 0x140020a3a
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140020a3a
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x140020a3a
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x48]
test rcx, rcx
je 0x140020a48
call fcn.14001ddc0
mov rsi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400b5ad0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret