joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001ba0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x1a0
mov rax, qword [0x140015140]
xor rax, rsp
mov qword [rsp + 0x190], rax
xor eax, eax
lea r9, [rsp + 0x3c]
lea rdx, [rsp + 0x68]
lea rcx, [0x140010ac4]
lea r8d, [rax + 1]
mov dword [rsp + 0x48], 0x20
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x30], 0x104
call qword [sym.imp.SETUPAPI.dll_SetupDiClassGuidsFromNameA]
lea rcx, [rsp + 0x68]
mov r9d, 2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
lea r8, [rsp + 0x48]
xor edx, edx
mov rcx, rax
mov rsi, rax
xor edi, edi
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x140001d39
mov r8d, dword [rsp + 0x5c]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x34]
xor r9d, r9d
call qword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Status]
test eax, eax
jne 0x140001d1e
bt dword [rsp + 0x34], 0x1e
jb 0x140001d1e
lea r8d, [rax + 1]
lea rdx, [rsp + 0x48]
xor r9d, r9d
mov rcx, rsi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 2
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x140001d1e
call fcn.140001b30
xor r8d, r8d
mov dword [rsp + 0x30], 0x103
test eax, eax
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
lea rdx, str.MatchingDeviceId
mov qword [rsp + 0x20], rax
mov rcx, rbx
je 0x140001cef
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140001d15
lea r8d, [rax + 0xa]
lea rdx, str.rtk_teammp
jmp 0x140001d04
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140001d15
lea r8d, [rax + 0xe]
lea rdx, str.rtl_teaming_mp
lea rcx, [rsp + 0x80]
call fcn.1400038c0
test eax, eax
je 0x140001d60
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add edi, 1
lea r8, [rsp + 0x48]
mov rcx, rsi
mov edx, edi
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x140001c40
xor eax, eax
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400036b0
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov eax, 1
jmp 0x140001d3b
Function at 0x140001d70
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
push rbp
sub rsp, 0x40
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
mov rbp, rax
jne 0x140001da3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.OpenSCManager
mov edx, eax
call fcn.140001290
int3
mov rdx, qword [str.SDLService]
mov r8d, 0xf01ff
mov rcx, rax
mov qword [rsp + 0x58], rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
test rax, rax
mov rsi, rax
jne 0x140001ddb
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.OpenService
mov edx, eax
call fcn.140001290
int3
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
mov rcx, rsi
call fcn.1400014b0
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x140001e18
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140010988]
mov edx, eax
call fcn.140001290
int3
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rdi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [rsp + 0x24]
mov ebx, dword [rsp + 0x34]
mov edi, eax
cmp ecx, 2
jne 0x140001eb4
mov qword [rsp + 0x68], r12
mov r12d, 0x2710
mov eax, 0xcccccccd
mul dword [rsp + 0x38]
shr edx, 3
cmp edx, 0x3e8
jae 0x140001e5d
mov edx, 0x3e8
jmp 0x140001e64
cmp edx, r12d
cmova edx, r12d
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140001eab
cmp dword [rsp + 0x34], ebx
jbe 0x140001e92
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [rsp + 0x34]
mov edi, eax
jmp 0x140001ea0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, dword [rsp + 0x38]
ja 0x140001eab
mov ecx, dword [rsp + 0x24]
cmp ecx, 2
je 0x140001e42
jmp 0x140001eaf
mov ecx, dword [rsp + 0x24]
mov r12, qword [rsp + 0x68]
cmp ecx, 4
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
jne 0x140001ecd
mov rcx, rsi
call fcn.1400014b0
jmp 0x140001ed3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x58]
mov al, 1
add rsp, 0x40
pop rbp
ret
Function at 0x140001f00
Capabilities:
Continue service
Pause service
Stop service

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rdi, rcx
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
mov rsi, rax
jne 0x140001f3a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.OpenSCManager
mov edx, eax
call fcn.140001290
int3
mov rdx, qword [str.SDLService]
mov r8d, 0xf01ff
mov rcx, rax
mov qword [rsp + 0x50], rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
test rax, rax
mov rbx, rax
jne 0x140001f72
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.OpenService
mov edx, eax
call fcn.140001290
int3
lea rdx, str.STOP
mov rcx, rdi
call fcn.140003b60
test eax, eax
jne 0x140001fa6
lea rcx, str.Service_is_stopping..._n
call fcn.1400030f0
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x140002012
lea rdx, str.PAUSE
mov rcx, rdi
call fcn.140003b60
test eax, eax
jne 0x140001fda
lea rcx, str.Service_is_pausing..._n
call fcn.1400030f0
lea r8, [rsp + 0x20]
mov edx, 2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x140002012
lea rdx, str.RESUME
mov rcx, rdi
call fcn.140003b60
test eax, eax
jne 0x14000200e
lea rcx, str.Service_is_resuming..._n
call fcn.1400030f0
lea r8, [rsp + 0x20]
mov edx, 3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x140002012
mov eax, dword [rsp + 0x58]
test eax, eax
jne 0x14000202b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140010978]
mov edx, eax
call fcn.140001290
int3
mov rcx, rbx
call fcn.1400014b0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov al, 1
add rsp, 0x40
pop rdi
ret

Function at 0x140002060
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x4448
call fcn.14000f9d0
sub rsp, rax
call fcn.140001b30
xor edx, edx
xor ecx, ecx
test eax, eax
lea r8, str.cmd.exe
lea r9, str._c__net_start_RtNdPt60_
jne 0x14000208f
lea r9, str._c__net_start_RtNdPt5x_
xor eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
call qword [sym.imp.RTDiagLib.dll_API_CheckProtDrvInst]
test eax, eax
je 0x1400020f9
call qword [sym.imp.RTDiagLib.dll_API_CheckMiniportDrvInst]
test eax, eax
je 0x1400020f9
cmp byte [0x140017b16], 0
je 0x1400020ca
call qword [sym.imp.RTDiagLib.dll_API_Close]
mov byte [0x140017b16], 0
call qword [sym.imp.RTDiagLib.dll_API_Open]
cmp eax, 1
jne 0x1400020f9
lea rcx, [rsp + 0x30]
mov byte [0x140017b16], al
call qword [sym.imp.RTDiagLib.dll_API_GetAdapterList_A]
test eax, eax
je 0x1400020f9
call fcn.140001840
mov al, 1
add rsp, 0x4448
ret
xor al, al
add rsp, 0x4448
ret
Function at 0x140002720
Capabilities:
Create thread
Get system information on windows

Disassembly:
sub rsp, 0x68
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea r11, [rsp + 0x70]
lea r8, [0x140002110]
mov qword [rsp + 0x28], r11
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [0x140018f60], rax
jne 0x140002766
add rsp, 0x68
ret
mov dword [0x140018f6c], 1
mov eax, 1
add rsp, 0x68
ret

Function at 0x140002780
Capabilities:
Create service
Persist via windows service

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x140015140]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0x170]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x70]
mov word [rsp + 0x70], 0x22
lea r8, [rsp + 0x170]
repne scasb al, byte [rdi]
xor edx, edx
nop
movzx eax, byte [r8 + rdx]
add rdx, 1
test al, al
mov byte [rdi + rdx - 2], al
jne 0x1400027e0
xor eax, eax
or rcx, 0xffffffffffffffff
xor edx, edx
lea rdi, [rsp + 0x70]
lea r8d, [rdx + 2]
repne scasb al, byte [rdi]
movzx eax, word [0x140010b50]
xor ecx, ecx
mov word [rdi - 1], ax
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
mov rbx, rax
jne 0x140002834
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.OpenSCManager
mov edx, eax
call fcn.140001290
int3
mov rdx, qword [str.SDLService]
xor eax, eax
mov r9d, 0xf01ff
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov r8, rdx
mov rcx, rbx
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x110
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
test rax, rax
mov rdi, rax
jne 0x1400028a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateService
mov edx, eax
call fcn.140001290
int3
call fcn.140001d70
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400036b0
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x290
pop rdi
ret
Function at 0x140003c00
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8d, 0x94
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x140003c5e
cmp dword [0x140018ff0], 2
je 0x140003c40
call fcn.1400070a0
mov ecx, 0x12
call fcn.140006e60
mov ecx, 0xff
call fcn.1400032a0
mov eax, 0xff
jmp 0x140003e66
mov dword [rax], 0x94
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x140003c8f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0xff
jmp 0x140003e66
mov r13d, dword [rbx + 0x10]
mov esi, dword [rbx + 4]
mov r12d, dword [rbx + 8]
mov edi, dword [rbx + 0xc]
and edi, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r13d, 2
je 0x140003cc1
bts edi, 0xf
mov eax, esi
shl eax, 8
add eax, r12d
mov dword [0x140018f7c], r13d
mov dword [0x140018f84], eax
mov dword [0x140018f88], esi
mov dword [0x140018f8c], r12d
mov dword [0x140018f80], edi
cmp word [0x140000000], 0x5a4d
jne 0x140003d47
movsxd rax, dword [0x14000003c]
lea rcx, [0x140000000]
add rax, rcx
cmp dword [rax], 0x4550
je 0x140003d15
xor ebx, ebx
mov dword [rsp + 0x50], ebx
jmp 0x140003d4d
cmp word [rax + 0x18], 0x20b
je 0x140003d25
xor ebx, ebx
mov dword [rsp + 0x50], ebx
jmp 0x140003d4d
cmp dword [rax + 0x84], 0xe
ja 0x140003d36
xor ebx, ebx
mov dword [rsp + 0x50], ebx
jmp 0x140003d4d
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0x50], ebx
jmp 0x140003d4d
xor ebx, ebx
mov dword [rsp + 0x50], ebx
mov ecx, 1
call fcn.140009810
test eax, eax
jne 0x140003d7d
cmp dword [0x140018ff0], 2
je 0x140003d69
call fcn.1400070a0
mov ecx, 0x1c
call fcn.140006e60
mov ecx, 0xff
call fcn.1400032a0
call fcn.140006d40
test eax, eax
jne 0x140003da8
cmp dword [0x140018ff0], 2
je 0x140003d94
call fcn.1400070a0
mov ecx, 0x10
call fcn.140006e60
mov ecx, 0xff
call fcn.1400032a0
call fcn.1400075f0
nop
call fcn.140005dc0
test eax, eax
jns 0x140003dc1
mov ecx, 0x1b
call fcn.140003270
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [0x14001aff0], rax
call fcn.140009640
mov qword [0x140018fe0], rax
call fcn.140009530
test eax, eax
jns 0x140003ded
mov ecx, 8
call fcn.140003270
call fcn.1400091a0
test eax, eax
jns 0x140003e00
mov ecx, 9
call fcn.140003270
mov ecx, 1
call fcn.1400033e0
test eax, eax
je 0x140003e15
mov ecx, eax
call fcn.140003270
mov r8, qword [0x140018fa8]
mov qword [0x140018fb0], r8
mov rdx, qword [0x140018f98]
mov ecx, dword [0x140018f90]
call fcn.1400029f0
mov edi, eax
mov dword [rsp + 0x20], eax
test ebx, ebx
jne 0x140003e46
mov ecx, eax
call fcn.1400035f0
call fcn.140003610
jmp 0x140003e64
mov eax, edi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
sub rsp, 0x28
call fcn.140009870
add rsp, 0x28
jmp 0x140003c00
Function at 0x1400044e0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x5b0
mov rbp, rcx
mov rcx, qword [0x140018ff8]
mov ebx, r9d
mov rdi, r8
mov rsi, rdx
call fcn.140006840
test rax, rax
je 0x140004534
mov r10, qword [rsp + 0x5e0]
mov r9d, ebx
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], r10
call rax
jmp 0x1400045c9
mov ecx, 2
call fcn.14000a970
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x98
call fcn.1400037c0
mov rax, qword [rsp + 0x5b8]
mov dword [rsp + 0x40], 0xc000000d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x1400045b5
test ebx, ebx
jne 0x1400045b5
lea ecx, [rax + 2]
call fcn.14000a970
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc000000d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140006e60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
sub rsp, 0x30
lea r12, [0x140015710]
xor esi, esi
mov edi, ecx
mov rax, r12
mov ebx, esi
nop
cmp ecx, dword [rax]
je 0x140006e9e
add ebx, 1
add rax, 0x10
cmp ebx, 0x17
jb 0x140006e80
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
cmp ebx, 0x17
jae 0x140007085
mov ecx, 3
call fcn.14000c850
cmp eax, 1
je 0x14000703c
mov ecx, 3
call fcn.14000c850
test eax, eax
jne 0x140006ed5
cmp dword [0x140015150], 1
je 0x14000703c
cmp edi, 0xfc
je 0x140007085
mov qword [rsp + 0x50], rbp
lea rbp, [0x140019020]
lea r8, str.Runtime_Error__n_nProgram:
mov rcx, rbp
mov edx, 0x314
call fcn.14000c7a0
test eax, eax
je 0x140006f19
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140004440
lea rdx, [0x140019039]
mov r8d, 0x104
xor ecx, ecx
mov byte [0x14001913d], sil
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x140006f69
lea r8, str._program_name_unknown_
lea rcx, [0x140019039]
mov edx, 0x2fb
call fcn.14000c7a0
test eax, eax
je 0x140006f69
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140004440
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x140019039]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 0x3c
jbe 0x140006fb8
lea rcx, [rcx + rbp - 0x23]
lea rdx, [0x140019334]
lea r9d, [rax + 3]
lea r8, [0x140011264]
sub rdx, rcx
call fcn.14000c680
test eax, eax
je 0x140006fb8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140004440
lea r8, [0x140011260]
mov edx, 0x314
mov rcx, rbp
call fcn.14000c5c0
test eax, eax
je 0x140006fe4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140004440
movsxd r8, ebx
mov edx, 0x314
mov rcx, rbp
add r8, r8
mov r8, qword [r12 + r8*8 + 8]
call fcn.14000c5c0
test eax, eax
je 0x140007014
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140004440
lea rdx, str.Microsoft_Visual_C_Runtime_Library
mov r8d, 0x12010
mov rcx, rbp
call fcn.14000c360
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x140007085
cmp rax, 0xffffffffffffffff
je 0x140007085
xor eax, eax
movsxd rcx, ebx
lea r9, [rsp + 0x58]
add rcx, rcx
mov qword [rsp + 0x20], rsi
mov rdx, qword [r12 + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x140007f57
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140015140]
jne 0x1400036ca
rol rcx, 0x10
test cx, 0xffff
jne 0x1400036c6
repz ret
ror rcx, 0x10
jmp 0x140007eb0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140019670]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140019768]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140007f35
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140019670]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140007f57
mov rax, qword [rsp + 0x88]
mov qword [0x140019768], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140019708], rax
mov rax, qword [0x140019768]
mov qword [0x1400195e0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400196f0], rax
mov dword [0x1400195d0], 0xc0000409
mov dword [0x1400195d4], 1
mov rax, qword [0x140015140]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140015148]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140019668], eax
mov ecx, 1
call fcn.14000a970
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400112d8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140019668], 0
jne 0x140007fde
mov ecx, 1
call fcn.14000a970
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140009640
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [0x140019c98]
test eax, eax
jne 0x140009693
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x140009673
mov dword [0x140019c98], 1
jmp 0x1400096ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x14000968d
mov dword [0x140019c98], 2
jmp 0x140009789
mov eax, dword [0x140019c98]
cmp eax, 1
jne 0x140009780
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x1400097d3
cmp word [rdi], 0
mov qword [rsp + 0x50], rbp
mov rbx, rdi
mov qword [rsp + 0x58], r12
je 0x1400096d5
add rbx, 2
cmp word [rbx], 0
jne 0x1400096c1
add rbx, 2
cmp word [rbx], 0
jne 0x1400096c1
xor r12d, r12d
sub rbx, rdi
mov r8, rdi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
sar rbx, 1
lea r9d, [rbx + 1]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
movsxd rbp, eax
je 0x140009773
mov rcx, rbp
call fcn.14000a980
test rax, rax
mov rsi, rax
je 0x140009773
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea r9d, [rbx + 1]
mov r8, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x14000974d
mov rcx, rsi
call fcn.140003ec0
mov rsi, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbp, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x140009759
cmp eax, 2
je 0x140009789
test eax, eax
jne 0x1400097d3
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
test rax, rax
mov rbx, rax
je 0x1400097d3
cmp byte [rax], 0
je 0x1400097b2
nop
add rax, 1
cmp byte [rax], 0
jne 0x1400097a0
add rax, 1
cmp byte [rax], 0
jne 0x1400097a0
sub eax, ebx
add eax, 1
movsxd rsi, eax
mov rcx, rsi
call fcn.14000a980
test rax, rax
mov rdi, rax
jne 0x1400097e5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14000c9d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x14000c360
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x50
mov edi, r8d
mov r13, rdx
mov r14, rcx
call fcn.140006750
xor ebx, ebx
cmp qword [0x140019cb0], rbx
mov rbp, rax
mov dword [rsp + 0x98], ebx
mov dword [rsp + 0x30], ebx
jne 0x14000c48c
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rsi, rax
je 0x14000c59f
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000c59f
mov rcx, rax
call fcn.140006680
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140019cb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140006680
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140019cb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140006680
lea rcx, [rsp + 0x98]
mov qword [0x140019cc0], rax
call fcn.140003340
test eax, eax
je 0x14000c43f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.140004440
cmp dword [rsp + 0x98], 2
jne 0x14000c48c
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140006680
test rax, rax
mov qword [0x140019cd0], rax
je 0x14000c48c
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140006680
mov qword [0x140019cc8], rax
mov rcx, qword [0x140019cc8]
mov qword [rsp + 0x80], r12
cmp rcx, rbp
je 0x14000c538
cmp qword [0x140019cd0], rbp
je 0x14000c538
call fcn.140006840
mov rcx, qword [0x140019cd0]
mov rsi, rax
call fcn.140006840
test rsi, rsi
mov r12, rax
je 0x14000c538
test rax, rax
je 0x14000c538
call rsi
test rax, rax
je 0x14000c503
lea rcx, [rsp + 0x34]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14000c503
test byte [rsp + 0x40], 1
jne 0x14000c538
lea rcx, [rsp + 0x30]
call fcn.140003390
test eax, eax
je 0x14000c525
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.140004440
cmp dword [rsp + 0x30], 4
jb 0x14000c532
bts edi, 0x15
jmp 0x14000c576
bts edi, 0x12
jmp 0x14000c576
mov rcx, qword [0x140019cb8]
cmp rcx, rbp
je 0x14000c576
call fcn.140006840
test rax, rax
je 0x14000c576
call rax
test rax, rax
mov rbx, rax
je 0x14000c576
mov rcx, qword [0x140019cc0]
cmp rcx, rbp
je 0x14000c576
call fcn.140006840
test rax, rax
je 0x14000c576
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140019cb0]
call fcn.140006840
mov r12, qword [rsp + 0x80]
test rax, rax
je 0x14000c59f
mov r9d, edi
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x14000c5a1
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret