joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002660
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14001c260]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140002680
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x140002688
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x1400026a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x14001c260]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1400026c0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x1400026c8
mov eax, r8d
ret
cmp word [rdx + 0x18], 0x20b
jne 0x1400026c0
sub rcx, rax
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x1400026c0
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002704
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002718
add rax, 0x28
cmp r9, rax
jne 0x1400026f0
xor r8d, r8d
mov eax, r8d
ret
mov r8d, dword [rax + 0x24]
not r8d
shr r8d, 0x1f
mov eax, r8d
ret

Function at 0x140002730
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x14001c260]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140002752
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140002760
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002752
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140002752
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x140002752
sub r8d, 1
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop dword [rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x1400027ad
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x1400027c0
add rdx, 0x28
cmp r10, rdx
jne 0x140002798
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x1400027cf
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x1400027df
mov edx, dword [rax + 0xc]
test edx, edx
je 0x1400027b6
test ecx, ecx
jg 0x1400027c8
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret

Function at 0x140003e50
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [0x14001c2e0]
mov rax, qword [rsi]
test rax, rax
je 0x140003ee0
cmp qword [rax + 0x30], 0
jne 0x140003f00
lea rbx, [0x14001a078]
mov qword [rax + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx], eax
mov rax, qword [rsi]
test rax, rax
je 0x140003eb0
cmp qword [rax + 0x30], 0
jne 0x140003ed0
lea rdx, [0x14001a078]
mov qword [rax + 0x30], rdx
mov rax, rdx
cmp dword [rax], 0xffffffff
je sym.pthread_tls_init.cold
add rsp, 0x28
pop rbx
pop rsi
ret
call sym.__shmem3_winpthreads_tdm_init_local_region
mov r8, rax
mov rax, qword [rsi]
cmp qword [r8 + 0x30], 0
je 0x140003e92
test rax, rax
jne 0x140003ed0
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rax, qword [rax + 0x30]
jmp 0x140003ea0
call sym.__shmem3_winpthreads_tdm_init_local_region
cmp qword [rax + 0x30], 0
mov rax, qword [rsi]
je 0x140003e70
test rax, rax
jne 0x140003f00
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rbx, qword [rax + 0x30]
jmp 0x140003e7b
Function at 0x140007ad0
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x14001c2e0]
mov rax, qword [rbx]
mov r12, rcx
mov esi, edx
test rax, rax
je 0x140007ba0
cmp qword [rax + 0x60], 0
jne 0x140007bc0
lea rcx, [0x14001a068]
mov qword [rax + 0x60], rcx
call sym.pthread_mutex_lock
mov rcx, r12
call sym.__pthread_get_pointer
test rax, rax
je 0x140007bd0
cmp qword [rax + 0x1d8], r12
jne 0x140007bd0
test byte [rax + 0x40], 0xc
jne 0x140007bd0
mov edx, dword [rax + 0xbc]
test edx, edx
jne 0x140007bd0
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x140007bd0
mov rax, qword [rbx]
test rax, rax
je 0x140007c30
cmp qword [rax + 0x60], 0
jne 0x140007c50
lea rcx, [0x14001a068]
mov qword [rax + 0x60], rcx
call sym.pthread_mutex_unlock
test esi, esi
je 0x140007c60
lea edx, [rsi - 2]
cmp edx, 0x15
ja 0x140007c68
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
jmp sym.pthread_cancel
call sym.__shmem3_winpthreads_tdm_init_local_region
cmp qword [rax + 0x60], 0
mov rax, qword [rbx]
je 0x140007afb
test rax, rax
jne 0x140007bc0
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rcx, qword [rax + 0x60]
jmp 0x140007b06
mov rax, qword [rbx]
test rax, rax
je 0x140007c00
cmp qword [rax + 0x60], 0
jne 0x140007c20
lea rcx, [0x14001a068]
mov qword [rax + 0x60], rcx
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
call sym.__shmem3_winpthreads_tdm_init_local_region
mov r8, rax
mov rax, qword [rbx]
cmp qword [r8 + 0x60], 0
je 0x140007bdf
test rax, rax
jne 0x140007c20
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rcx, qword [rax + 0x60]
jmp 0x140007bea
call sym.__shmem3_winpthreads_tdm_init_local_region
cmp qword [rax + 0x60], 0
mov rax, qword [rbx]
je 0x140007b6a
test rax, rax
jne 0x140007c50
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rcx, qword [rax + 0x60]
jmp 0x140007b75
xor eax, eax
jmp 0x140007bf4
mov eax, 0x16
jmp 0x140007bf4
Function at 0x140001000
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x14000109b
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x14000109b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x30
lea r8, [rsp + 0x30]
mov rcx, rax
xor edx, edx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call rdi
test eax, eax
js 0x140001077
mov rax, qword [rsp + 0x38]
cmp byte [rax + 2], 0
jne 0x14000109b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140001330
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140001d2c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001d76
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001d76
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001d76
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001d76
cmp dword [rcx + 0x84], 0xe
jbe 0x140001d76
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001d78
xor al, al
add rsp, 0x28
ret
Function at 0x140c95058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140c951df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140c95089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c9506f
add dl, dl
jne 0x140c95096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c950f6
xor eax, eax
add dl, dl
jne 0x140c950a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c951ad
add dl, dl
jne 0x140c950b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c950c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c950d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c950dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140c950ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140c9507e
mov eax, 1
add dl, dl
jne 0x140c95106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c95113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c950fb
sub eax, ebx
mov ebx, 1
jne 0x140c9514c
mov ecx, 1
add dl, dl
jne 0x140c9512e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c9513b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c95123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c9507e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140c95168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c95175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c9515d
cmp eax, 0x7d00
jae 0x140c9519b
cmp eax, 0x500
jb 0x140c95196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c9507e
cmp eax, 0x7f
ja 0x140c9519e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c9507e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140c951d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140c9507e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400062b0
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push r14
sub rsp, 0x30
mov r14, r9
mov rdi, r8
mov rbx, rdx
mov esi, ecx
mov qword [rsp + 0x20], rdx
call fcn.140006bd0
test rax, rax
je 0x14000634b
test rbx, rbx
jne 0x1400062fa
mov ecx, esi
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x14000634b
and rdi, 0xfffffffffffff000
mov rsi, qword [rsp + 0x68]
mov qword [rsi], rdi
xor eax, eax
mov rdi, qword [rsp + 0x60]
mov qword [rdi], rax
mov dword [r14], eax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
nop
mov rdx, r14
mov rcx, qword [rsi]
call fcn.140005b40
sub rax, qword [rsi]
mov qword [rdi], rax
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
test rbx, rbx
jne 0x140006349
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x14000634b
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1400066e0
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push r12
push r14
push r15
sub rsp, 0x30
mov r15d, r9d
mov rbx, r8
mov rsi, rdx
mov eax, ecx
mov rcx, rdx
mov qword [rsp + 0x28], rdx
mov r12d, 0xc0000001
mov edi, r12d
test rdx, rdx
jne 0x14000673c
mov ecx, eax
lea rdx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140006737
xor al, al
jmp 0x140006813
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
nop
mov rcx, rbx
call fcn.140006370
test al, al
je 0x1400067ec
lea rcx, [rbx - 1]
add rcx, r15
call fcn.140006370
test al, al
je 0x1400067ec
cmp dword [0x14001a01c], 0
je 0x140006783
call fcn.140001e30
call fcn.14000ab50
cmp dword [0x14001a01c], 0
jne 0x1400067b0
movabs rax, 0x8000000000000000
cmp rbx, rax
jb 0x1400067b0
lfence
mov r8d, r15d
mov rdx, rbx
mov rcx, qword [rsp + 0x70]
call fcn.140006fd0
xor edi, edi
cmp eax, r15d
cmovne edi, r12d
jmp 0x1400067c2
mov r8, r15
mov rdx, rbx
mov rcx, qword [rsp + 0x70]
call fcn.14000d200
xor edi, edi
mov dword [rsp + 0x20], edi
cmp dword [0x14001a01c], 0
je 0x1400067ec
call fcn.14000ac10
mov rbx, rax
call fcn.14000abb0
call fcn.140001e40
test rbx, rbx
cmovne edi, r12d
mov dword [rsp + 0x20], edi
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
jmp 0x1400067fe
test rsi, rsi
jne 0x14000680e
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test edi, edi
setns al
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x1400068b0
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13d, r9d
mov r14, r8
mov r15, rdx
mov eax, ecx
mov rcx, rdx
mov qword [rsp + 0x28], rdx
mov ebx, 0xc0000001
test rdx, rdx
jne 0x140006906
mov ecx, eax
lea rdx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140006901
xor al, al
jmp 0x140006a4e
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
nop
mov rcx, r14
call fcn.140006370
test al, al
je 0x140006a27
lea rcx, [r14 - 1]
add rcx, r13
call fcn.140006370
test al, al
je 0x140006a27
xor esi, esi
mov edi, esi
mov dword [rsp + 0x24], esi
cmp dword [0x14001a01c], esi
jne 0x140006949
cmp dword [0x140019fdc], esi
je 0x14000697e
call fcn.140001e30
cmp dword [0x14001a01c], esi
je 0x14000695b
call fcn.14000ab50
cmp dword [0x140019fdc], esi
je 0x14000697e
call fcn.1400021f0
btr rax, 0x10
mov rcx, rax
call fcn.1400022a0
mov edi, 1
mov dword [rsp + 0x24], edi
cmp dword [0x14001a01c], esi
jne 0x1400069c1
cmp dword [0x140019fdc], esi
jne 0x14000699d
movabs rax, 0x8000000000000000
cmp r14, rax
jb 0x1400069c1
mov r8d, r13d
mov rdx, qword [rsp + 0x80]
mov rcx, r14
call fcn.140006fd0
mov ebx, esi
cmp eax, r13d
mov r14d, 0xc0000001
cmovne ebx, r14d
jmp 0x1400069dc
mov r8, r13
mov rdx, qword [rsp + 0x80]
mov rcx, r14
call fcn.14000d200
mov ebx, esi
mov r14d, 0xc0000001
mov dword [rsp + 0x20], ebx
cmp dword [0x14001a01c], esi
jne 0x1400069ec
test edi, edi
je 0x140006a27
test edi, edi
je 0x140006a02
call fcn.1400021f0
bts rax, 0x10
mov rcx, rax
call fcn.1400022a0
cmp dword [0x14001a01c], esi
je 0x140006a17
call fcn.14000ac10
mov rsi, rax
call fcn.14000abb0
call fcn.140001e40
test rsi, rsi
cmovne ebx, r14d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
jmp 0x140006a39
test r15, r15
jne 0x140006a49
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test ebx, ebx
setns al
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x140006bd0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x140010030]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rcx, qword [0x1400100f8]
test rcx, rcx
jne 0x140006c9a
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
test eax, eax
je 0x140006c2a
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14000cd00
add rsp, 0x158
ret
cmp dword [rsp + 0x24], 0xa
jb 0x140006c89
cmp dword [rsp + 0x2c], 0x3839
jb 0x140006c89
call fcn.140002210
and rax, 0xfffffffffffff000
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmGetVirtualForPhysical]
mov rcx, rax
movabs rax, 0xffffff8000000000
and rcx, rax
movabs rax, 0x7ffffffff8
add rax, rcx
mov qword [0x14001a000], rax
movabs rax, 0x7b7ffffff8
add rax, rcx
mov qword [0x14001a008], rax
jmp 0x140006c93
movabs rcx, 0xfffff68000000000
mov qword [0x1400100f8], rcx
mov rax, rcx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14000cd00
add rsp, 0x158
ret
Function at 0x140007a80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
xor r12d, r12d
xor dil, dil
mov r15d, r12d
call fcn.140001df0
movsxd rcx, eax
lea r13, [0x14001a060]
mov rbx, qword [r13 + rcx*8]
call fcn.140001df0
cdqe
mov r14d, r12d
mov rax, qword [r13 + rax*8]
mov rcx, qword [rax + 8]
cmp rcx, qword [rbx + 0x18]
setae r14b
jb 0x140007adb
call fcn.14000a960
call fcn.140001df0
movsxd rcx, eax
mov rbx, qword [r13 + rcx*8]
call fcn.140001df0
mov rsi, qword [rbx + 8]
cdqe
mov rax, qword [r13 + rax*8]
sub rsi, qword [rax]
mov rax, cr8
cmp al, 2
jae 0x140007b14
mov cl, 2
mov r15d, 1
call qword [sym.imp.ntoskrnl.exe_KfRaiseIrql]
movzx edi, al
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbp, rax
test rax, rax
je 0x140007ca0
call fcn.140001df0
movsxd rcx, eax
mov r8, rsi
mov rdx, qword [r13 + rcx*8]
mov rcx, rbp
mov rdx, qword [rdx]
call fcn.14000d200
call fcn.140001df0
movsxd rcx, eax
mov rbx, qword [r13 + rcx*8]
call fcn.140001df0
movsxd rcx, eax
mov rax, qword [rbx]
mov rdx, qword [r13 + rcx*8]
mov qword [rdx + 8], rax
test r15d, r15d
je 0x140007b76
movzx ecx, dil
call qword [sym.imp.ntoskrnl.exe_KeLowerIrql]
cmp dword [0x140014148], r12d
je 0x140007bb6
mov rcx, qword [0x140014140]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], r12
xor r9d, r9d
mov qword [rsp + 0x38], r12
xor r8d, r8d
mov dword [rsp + 0x30], esi
xor edx, edx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
jmp 0x140007caa
cmp qword [0x1400140c8], r12
je 0x140007caa
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
lea rcx, [0x140014120]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
test eax, eax
jne 0x140007caa
lea rcx, [0x1400140e0]
call qword [sym.imp.ntoskrnl.exe_ExAcquireFastMutex]
mov rax, qword [0x1400140c8]
test rax, rax
je 0x140007c91
mov edx, dword [0x140010008]
mov ecx, r12d
test edx, edx
jle 0x140007c91
cmp dword [rax], r12d
jne 0x140007c31
inc ecx
add rax, 0x30
cmp ecx, edx
jl 0x140007c13
lea rcx, [0x1400140e0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
jmp 0x140007caa
movsxd rax, ecx
lea rbx, [rax + rax*2]
mov rax, qword [0x1400140c8]
shl rbx, 4
mov dword [rbx + rax], r12d
test ecx, ecx
js 0x140007c91
lfence
mov rax, qword [0x1400140c8]
mov qword [rbx + rax + 8], rbp
mov rax, qword [0x1400140c8]
mov dword [rbx + rax + 0x10], esi
call fcn.140001df0
mov r8, qword [0x1400140c8]
mov dword [rbx + r8 + 0x14], eax
xor r8d, r8d
mov rcx, qword [0x1400140c8]
add rcx, 0x18
add rcx, rbx
lea edx, [r8 + 1]
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
lea rcx, [0x1400140e0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
jmp 0x140007caa
movzx ecx, dil
call qword [sym.imp.ntoskrnl.exe_KeLowerIrql]
call fcn.140001e30
lea r11, [rsp + 0x60]
mov eax, r14d
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140009970
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x140010030]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rax, qword [0x140011260]
lea r9, [0x140011280]
movsxd rdx, ecx
lea r8, [0x14000d640]
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0xb0]
mov rbx, qword [rax + rdx*8]
mov edx, 0xc8
call sub.ntoskrnl.exe_swprintf_s
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x90]
mov dword [rsp + 0x60], 0x30
xorps xmm0, xmm0
mov qword [rsp + 0x70], rax
xor edi, edi
mov dword [rsp + 0x78], 0x240
movdqu xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x68], rdi
lea rcx, [rsp + 0x60]
mov qword [rbx + 0x110], rdi
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
mov dword [rsp + 0x50], edi
lea r9, [rsp + 0xa0]
mov qword [rsp + 0x48], rdi
lea r8, [rsp + 0x60]
mov dword [rsp + 0x40], 0x24
lea rcx, [rbx + 0x110]
mov dword [rsp + 0x38], edi
mov edx, 0x10100005
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000cd00
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x140001878
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
xor r8d, r8d
xor edx, edx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor ebp, ebp
mov edi, eax
test eax, eax
je 0x1400018a6
dec edi
mov edx, ebx
mov ecx, edi
call fcn.1400095c0
lea r8d, [rdi + 1]
mov rdx, rax
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rsi, qword [rsp + 0x40]
movsxd rcx, edi
mov word [rbx + rcx*2], bp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400037a4
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rsi, rcx
xor r9d, r9d
mov rcx, qword [rcx]
xor r8d, r8d
mov edx, 0x147
call qword [sym.imp.USER32.dll_SendMessageW]
or r15, 0xffffffffffffffff
mov rbp, rax
cmp rax, r15
je 0x140003864
mov rcx, qword [rsi]
lea edx, [r15 - 0xf]
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
test al, 1
jne 0x140003864
xor r14d, r14d
cmp qword [rsi + 0x30], r14
jne 0x140003864
mov rcx, qword [rsi]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov rcx, qword [0x1400c2978]
xor edx, edx
movsxd rbx, eax
lea r8, [rbx*2 + 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r8d, [rbx + 1]
mov rdx, rax
mov rdi, rax
mov word [rax], r14w
mov rcx, qword [rsi]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rsi]
mov r9, rdi
mov r8, r15
mov edx, 0x158
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1400c2978]
mov r8, rdi
cmp rax, r15
cmove rbp, r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x40]
mov rax, rbp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x140004550
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdx, rcx
mov rcx, qword [0x1400c3390]
call fcn.140009758
xor ebp, ebp
mov rsi, rax
test rax, rax
je 0x1400045d0
mov rcx, qword [rax + 8]
mov rax, qword [rcx + 0x28]
test rax, rax
je 0x140004595
mov edx, ebx
mov rcx, rsi
call rax
jmp 0x1400045d0
mov rcx, qword [rsi]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ecx, eax
mov edx, ebx
mov edi, eax
call fcn.1400095c0
lea r8d, [rdi + 1]
mov rdx, rax
mov rbx, rax
mov word [rax], bp
mov rcx, qword [rsi]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, rbx
call fcn.140009120
sub edi, eax
mov ecx, edi
call fcn.140009650
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400075c0
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1400c3960], eax
add rsp, 0x28
ret

Function at 0x1400077fc
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x230
xor ebx, ebx
test rcx, rcx
je 0x140007886
mov rdx, rcx
mov r8d, 0x104
lea rcx, [rsp + 0x20]
call fcn.140009574
lea rcx, [rsp + 0x20]
mov word [rsp + 0x228], bx
call fcn.140009120
lea rcx, [rsp + 0x20]
lea rcx, [rcx + rax*2]
lea rax, [rsp + 0x20]
cmp rcx, rax
jbe 0x140007872
lea rdx, [rcx - 2]
movzx eax, word [rdx]
sub ax, 0x20
cmp ax, 0x3c
ja 0x140007872
movabs r8, 0x1000000000008001
bt r8, rax
jae 0x140007872
lea rax, [rsp + 0x20]
mov rcx, rdx
cmp rdx, rax
ja 0x140007844
mov word [rcx], bx
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cdqe
jmp 0x140007888
xor eax, eax
add rsp, 0x230
pop rbx
ret