joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001130
Capabilities:
Encode data using xor
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0xf0
mov ebp, edx
mov r10, rcx
test rcx, rcx
je 0x1400012b0
test edx, edx
je 0x1400012b0
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400012b0
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x1400012b0
movups xmm0, xmmword [rax + 0x18]
lea rcx, [rsp]
xor r11d, r11d
movups xmm1, xmmword [rax + 0x28]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x38]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x48]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x68]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x78]
movups xmmword [rcx + 0x50], xmm1
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax + 0x88]
sub rax, 0xffffffffffffff68
movups xmmword [rcx - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rcx], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm1
movups xmm1, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm0
movups xmm0, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm1
movups xmm1, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x60], xmm1
mov eax, dword [rsp + 0x70]
add rax, r10
mov ebx, dword [rax + 0x20]
mov r15d, dword [rax + 0x1c]
add rbx, r10
mov edi, dword [rax + 0x24]
add r15, r10
mov r14d, dword [rax + 0x14]
add rdi, r10
test r14d, r14d
je 0x1400012b0
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rdi]
mov r9d, dword [rbx]
add r9, r10
mov rdx, r9
mov esi, dword [r15 + rax*4]
xor eax, eax
add rsi, r10
cmp byte [r9], al
je 0x140001267
nop word [rax + rax]
inc rdx
cmp byte [rdx], al
jne 0x140001260
mov r8, rax
sub rdx, r9
je 0x1400012a0
nop
movsx ecx, byte [r9 + r8]
inc r8
add ecx, eax
imul eax, ecx, 0x81
mov ecx, eax
shr ecx, 6
xor eax, ecx
cmp r8, rdx
jne 0x140001270
lea ecx, [rax + rax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
cmp ebp, eax
je 0x1400012cf
inc r11d
add rbx, 4
add rdi, 2
cmp r11d, r14d
jb 0x140001240
xor eax, eax
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov rax, rsi
jmp 0x1400012b2
Function at 0x14006ce70
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14006ce7d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14006ce8d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14006ce75
lea eax, [rcx + 1]
jmp 0x14006ce9b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14006ceae
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14006ce94
sub eax, 3
jb 0x14006cece
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14006cf1d
sar eax, 1
movsxd rbp, eax
jb 0x14006cf04
jmp 0x14006cedc
add ebx, ebx
jne 0x14006ceda
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14006cf04
inc ecx
add ebx, ebx
jne 0x14006ceea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14006cf04
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14006cefd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14006ceec
add ecx, 2
jmp 0x14006cf09
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14006ce32
jmp 0x14006ce7d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2d000
mov dl, 0xe
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14006cf6d
cmp rsi, rcx
jae 0x14006cf75
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14006cf54
cmp al, 0x8f
ja 0x14006cf54
cmp byte [rsi - 2], 0xf
je 0x14006cf5a
sub al, 0xe8
cmp al, 1
ja 0x14006cf3e
cmp rsi, rcx
jae 0x14006cf75
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14006cf44
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14006cf75
lodsb al, byte [rsi]
jmp 0x14006cf54
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x68000]
mov eax, dword [rdi]
or eax, eax
je 0x14006cfd2
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x6db30]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14006cf82
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14006cfcc
mov qword [rbx], rax
add rbx, 8
jmp 0x14006cfa2
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14006d00c
cmp al, 0xef
ja 0x14006cffe
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14006cfde
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14006cfed
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x227]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14006d060
sub rsp, 0xffffffffffffff80
jmp 0x140013ff0
Function at 0x140069530
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14006953d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14006954d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140069535
lea eax, [rcx + 1]
jmp 0x14006955b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14006956e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140069554
sub eax, 3
jb 0x14006958e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400695dd
sar eax, 1
movsxd rbp, eax
jb 0x1400695c4
jmp 0x14006959c
add ebx, ebx
jne 0x14006959a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400695c4
inc ecx
add ebx, ebx
jne 0x1400695aa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400695c4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1400695bd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1400695ac
add ecx, 2
jmp 0x1400695c9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1400694f2
jmp 0x14006953d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2d000
mov dl, 0xe
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14006962d
cmp rsi, rcx
jae 0x140069635
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140069614
cmp al, 0x8f
ja 0x140069614
cmp byte [rsi - 2], 0xf
je 0x14006961a
sub al, 0xe8
cmp al, 1
ja 0x1400695fe
cmp rsi, rcx
jae 0x140069635
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140069604
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140069635
lodsb al, byte [rsi]
jmp 0x140069614
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x65000]
mov eax, dword [rdi]
or eax, eax
je 0x140069692
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x69b30]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140069642
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14006968c
mov qword [rbx], rax
add rbx, 8
jmp 0x140069662
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1400696cc
cmp al, 0xef
ja 0x1400696be
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14006969e
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x1400696ad
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x227]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140069720
sub rsp, 0xffffffffffffff80
jmp 0x140013ff0
Function at 0x140040da0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x14004dd08], rbx
je 0x140040e07
cmp rax, rbx
jne 0x140040dfa
mov ebx, 1
mov esi, ebx
jmp 0x140040e0c
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x140040ddf
mov ebx, 1
mov eax, dword [0x14004dd10]
cmp eax, ebx
jne 0x140040e24
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x140040e90
mov eax, dword [0x14004dd10]
test eax, eax
jne 0x140040e85
mov dword [0x14004dd10], ebx
lea r15, [0x140044330]
lea rdi, [0x140044318]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x140040e77
test eax, eax
jne 0x140040e7b
cmp qword [rdi], r14
je 0x140040e6c
mov rax, qword [rdi]
mov rcx, qword [0x1400442d8]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x140040e4e
test eax, eax
je 0x140040e8b
mov eax, 0xff
jmp 0x140040fe6
mov dword [0x14004d384], ebx
mov edi, 0x1f
mov eax, dword [0x14004dd10]
cmp eax, ebx
jne 0x140040eb7
lea rdx, [0x140044310]
lea rcx, [0x1400442e0]
call sub.msvcrt.dll__initterm
mov dword [0x14004dd10], 2
test esi, esi
jne 0x140040ec5
mov rax, r14
xchg qword [0x14004dd08], rax
cmp qword [0x14004dd28], r14
je 0x140040ef8
lea rcx, [0x14004dd28]
call fcn.140041400
test eax, eax
je 0x140040ef8
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14004dd28]
mov r9, qword [0x1400442d8]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x140040f11
mov eax, 0xff
jmp 0x140040fe6
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x140040f97
test ax, ax
je 0x140040f2c
test edx, edx
jne 0x140040f97
sub ax, bx
cmp ax, di
ja 0x140040f42
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x140040f2c
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400024cc
mov dword [0x14004d380], eax
cmp dword [0x14004d3a0], r14d
jne 0x140040f80
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14004d384], r14d
jne 0x140040f95
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14004d380]
jmp 0x140040fe6
cmp ax, 0x22
jne 0x140040fab
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x140040f1a
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.140177000
add rsp, 0x28
jmp 0x140040da0
Function at 0x14000d85c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14000d896
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14000d89b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14000d8e4
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140011a00]
cmp byte [rcx + rax], 0
je 0x14000d8e4
dec r8
sub rdx, 1
jne 0x14000d8ca
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14000e4d4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000e51e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000e51e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000e51e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000e51e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000e51e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000e520
xor al, al
add rsp, 0x28
ret
Function at 0x14000e800
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x90], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x90]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0xa8], rax
mov rdi, rax
test rax, rax
jne 0x14000e846
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x90]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x60], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x48], r14
cmovo rax, r15
mov rcx, rax
call fcn.14000e9b8
mov r14, rax
mov qword [rsp + 0xa0], rax
mov eax, dword [rsp + 0x90]
test eax, eax
je 0x14000e93f
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x58], r12
mov r12, r14
mov qword [rsp + 0x50], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.14000e9b8
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x90]
inc r14d
cmp r14d, eax
jne 0x14000e8b0
mov r14, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
mov r13, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x90]
mov rdx, r14
call fcn.140005020
mov esi, eax
cmp dword [rsp + 0x90], ebx
je 0x14000e98c
mov rdi, r14
nop dword [rax + rax]
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000e98c
call fcn.14000dc7c
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x90]
jne 0x14000e970
mov rcx, r14
call fcn.14000dc7c
mov r14, qword [rsp + 0x48]
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
jmp 0x14000e800
Function at 0x14000e9b0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x90], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x90]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0xa8], rax
mov rdi, rax
test rax, rax
jne 0x14000e846
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x90]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x60], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x48], r14
cmovo rax, r15
mov rcx, rax
call fcn.14000e9b8
mov r14, rax
mov qword [rsp + 0xa0], rax
mov eax, dword [rsp + 0x90]
test eax, eax
je 0x14000e93f
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x58], r12
mov r12, r14
mov qword [rsp + 0x50], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.14000e9b8
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x90]
inc r14d
cmp r14d, eax
jne 0x14000e8b0
mov r14, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
mov r13, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x90]
mov rdx, r14
call fcn.140005020
mov esi, eax
cmp dword [rsp + 0x90], ebx
je 0x14000e98c
mov rdi, r14
nop dword [rax + rax]
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000e98c
call fcn.14000dc7c
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x90]
jne 0x14000e970
mov rcx, r14
call fcn.14000dc7c
mov r14, qword [rsp + 0x48]
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
jmp 0x14000e800
Function at 0x140002230
Capabilities:
Access the windows event log

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov ebp, r8d
mov esi, edx
mov rbx, rcx
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea r14, str.RemoveTasks
mov r8, r14
mov r9d, ebp
call fcn.1400035b0
movsxd r15, eax
lea r12, [r15*2 + 2]
inc r15
mov rcx, r12
call fcn.140002488
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, r12
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], esi
mov rcx, rdi
mov rdx, r15
call fcn.140003630
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x1400022fc
mov rbx, rax
lea rax, [rsp + 0x50]
mov qword [rax], rdi
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rbx
mov dx, 1
xor r8d, r8d
mov r9d, esi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rdi
call fcn.140002490
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003110
nop
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140001ec0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140001ee8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140001f0e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140001f10
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140001f69
test ecx, ecx
jle 0x140001f49
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140001f69
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140001f69
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140001f90
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140001fb2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140001fc8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140001fe4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140001fe6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140002022
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400020be
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000205d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000209e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x1400020be
cmp rbx, rax
ja 0x140002070
test rbx, rbx
je 0x1400020be
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140002520
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000254d
xor eax, eax
jmp 0x1400026b9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140002587
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140002587
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400026b9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400026ac
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400025ca
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400025f5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400026b1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002664
sub eax, 1
je 0x140002664
cmp eax, 2
jne 0x1400026ac
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400026b1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140002692
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400026ac
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400026b1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140003280
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret