joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008a164
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set current directory
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1a8]
sub rsp, 0x280
mov r13, rdx
xor ebx, ebx
mov rcx, r13
lea rdx, [rsp + 0x30]
mov r15d, r9d
mov r12d, r8d
mov sil, bl
call qword [0x1400b53f8]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14008a218
lea rdx, [0x1400b6558]
lea rcx, [rsp + 0x5c]
call fcn.14002952c
test eax, eax
je 0x14008a206
lea rdx, [0x1400dd7b8]
lea rcx, [rsp + 0x5c]
call fcn.14002952c
test eax, eax
je 0x14008a206
lea rcx, [rsp + 0x5c]
call qword [0x1400b53f0]
mov edx, eax
lea rcx, [rsp + 0x5c]
mov eax, r15d
or edx, r12d
not eax
and edx, eax
call qword [0x1400b5570]
test eax, eax
je 0x14008a235
mov sil, 1
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [0x1400b5420]
test eax, eax
jne 0x14008a1b3
mov rcx, rdi
call qword [0x1400b5400]
mov r14b, byte [rbp + 0x1d0]
test r14b, r14b
jne 0x14008a245
mov al, sil
jmp 0x14008a2e9
mov rcx, rdi
call qword [0x1400b5400]
xor al, al
jmp 0x14008a2e9
lea rdx, [rsp + 0x30]
lea rcx, [0x1400dd7b0]
call qword [0x1400b53f8]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14008a2dc
mov rsi, qword [rbp + 0x1b0]
test byte [rsp + 0x30], 0x10
je 0x14008a2ca
lea rdx, [0x1400b6558]
lea rcx, [rsp + 0x5c]
call fcn.14002952c
test eax, eax
je 0x14008a2ca
lea rdx, [0x1400dd7b8]
lea rcx, [rsp + 0x5c]
call fcn.14002952c
test eax, eax
je 0x14008a2ca
lea rcx, [rsp + 0x5c]
call qword [0x1400b5630]
mov r9d, r15d
mov byte [rsp + 0x20], r14b
mov r8d, r12d
mov rdx, r13
mov rcx, rsi
call fcn.14008a164
test al, al
je 0x14008a2de
lea rcx, [0x1400dd7b8]
call qword [0x1400b5630]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [0x1400b5420]
test eax, eax
jne 0x14008a267
mov bl, 1
mov rcx, rdi
call qword [0x1400b5400]
mov al, bl
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14008a30c
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x280
mov r12, rdx
mov r13, rcx
xor ebx, ebx
lea rdx, [rsp + 0x30]
mov rcx, r12
mov r14d, r9d
mov r15, r8
mov sil, bl
call qword [0x1400b53f8]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14008a3a6
lea rdx, [0x1400b6558]
lea rcx, [rsp + 0x5c]
call fcn.14002952c
test eax, eax
je 0x14008a394
lea rdx, [0x1400dd7b8]
lea rcx, [rsp + 0x5c]
call fcn.14002952c
test eax, eax
je 0x14008a394
mov r8d, r14d
lea rcx, [rsp + 0x5c]
mov rdx, r15
call fcn.14007c4a4
test al, al
je 0x14008a3c4
mov sil, 1
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [0x1400b5420]
test eax, eax
jne 0x14008a353
mov rcx, rdi
call qword [0x1400b5400]
mov bpl, byte [rsp + 0x2d0]
test bpl, bpl
jne 0x14008a3d4
mov al, sil
jmp 0x14008a471
mov rcx, rdi
call qword [0x1400b5400]
xor al, al
jmp 0x14008a471
lea rdx, [rsp + 0x30]
lea rcx, [0x1400dd7b0]
call qword [0x1400b53f8]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14008a464
test byte [rsp + 0x30], 0x10
je 0x14008a452
lea rdx, [0x1400b6558]
lea rcx, [rsp + 0x5c]
call fcn.14002952c
test eax, eax
je 0x14008a452
lea rdx, [0x1400dd7b8]
lea rcx, [rsp + 0x5c]
call fcn.14002952c
test eax, eax
je 0x14008a452
lea rcx, [rsp + 0x5c]
call qword [0x1400b5630]
mov r9d, r14d
mov byte [rsp + 0x20], bpl
mov r8, r15
mov rdx, r12
mov rcx, r13
call fcn.14008a30c
test al, al
je 0x14008a466
lea rcx, [0x1400dd7b8]
call qword [0x1400b5630]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [0x1400b5420]
test eax, eax
jne 0x14008a3ef
mov bl, 1
mov rcx, rdi
call qword [0x1400b5400]
mov al, bl
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14008a688
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1f8]
sub rsp, 0x2d0
lea rcx, [rsp + 0x40]
mov r14, r9
mov r12, r8
call fcn.14000d54c
mov rax, qword [rsp + 0x40]
lea rdx, [0x1400dd7b0]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x78], rax
inc dword [rax]
call fcn.14000534c
mov rcx, qword [rsp + 0x40]
lea rdx, [rbp - 0x80]
mov bl, 1
call qword [0x1400b53f8]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x14008a826
mov r15b, byte [rbp + 0x230]
mov sil, byte [rbp + 0x228]
mov rdi, qword [rbp + 0x220]
mov rcx, qword [rbp + 0x200]
call fcn.140083638
cmp eax, 1
je 0x14008a824
cmp eax, 0xb
jne 0x14008a755
lea ecx, [rax - 1]
call qword [0x1400b52e8]
jmp 0x14008a730
lea rdx, [0x1400b6558]
lea rcx, [rbp - 0x54]
call fcn.14002952c
test eax, eax
je 0x14008a80d
lea rdx, [0x1400dd7b8]
lea rcx, [rbp - 0x54]
call fcn.14002952c
test eax, eax
je 0x14008a80d
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.14000ca70
lea rdx, [rbp - 0x54]
lea rcx, [rsp + 0x40]
call fcn.14000534c
test byte [rbp - 0x80], 0x10
je 0x14008a7f4
test sil, sil
je 0x14008a7b0
inc qword [rdi]
test r15b, r15b
je 0x14008a80d
lea rdx, [0x1400b63a8]
lea rcx, [rsp + 0x40]
call fcn.14000534c
mov rdx, qword [rsp + 0x40]
mov r9, r14
mov rcx, qword [rbp + 0x200]
mov r8, r12
mov byte [rsp + 0x30], r15b
mov byte [rsp + 0x28], sil
mov qword [rsp + 0x20], rdi
call fcn.14008a688
mov bl, al
test al, al
je 0x14008a826
jmp 0x14008a80d
mov ecx, dword [rbp - 0x64]
mov eax, dword [rbp - 0x60]
shl rcx, 0x20
or rcx, rax
add qword [r12], rcx
test sil, sil
je 0x14008a80d
inc qword [r14]
lea rdx, [rbp - 0x80]
mov rcx, r13
call qword [0x1400b5420]
test eax, eax
jne 0x14008a730
jmp 0x14008a826
xor bl, bl
mov rcx, r13
call qword [0x1400b5400]
lea rcx, [rsp + 0x60]
call fcn.140008a8c
lea rcx, [rsp + 0x40]
call fcn.140008a8c
lea r11, [rsp + 0x2d0]
mov al, bl
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14008d5f0
Capabilities:
Connect to http server

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov sil, r9b
mov rdi, rdx
mov rbx, rcx
test r8b, r8b
je 0x14008d61f
mov r8b, r9b
call fcn.14008d728
jmp 0x14008d713
mov ebp, dword [rcx + 0x90]
mov rcx, qword [rdx + 0x60]
and qword [rsp + 0x38], 0
mov eax, dword [rdx + 0xe0]
and dword [rsp + 0x30], 0
mov r9, qword [rdx + 0x40]
movzx r8d, word [rdx + 0xe8]
mov rdx, qword [rdx + 0x20]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbx + 8]
call qword [0x1400b5f60]
mov qword [rbx], rax
test rax, rax
jne 0x14008d67e
xor r9d, r9d
lea edx, [rax + 0x15]
mov r8d, 0xdeadbeef
mov rcx, rbx
call fcn.14008e8cc
jmp 0x14008d713
mov rdx, qword [rdi + 0xc0]
mov r9d, ebp
and qword [rsp + 0x20], 0
mov r8d, 0x80000000
mov rcx, rax
call qword [0x1400b5f70]
mov rdi, rax
test rax, rax
jne 0x14008d6b3
xor r9d, r9d
lea edx, [rax + 0x16]
mov r8d, 0xdeadbeef
jmp 0x14008d6f9
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [0x1400b5f78]
mov ecx, dword [rsp + 0x60]
shl rcx, 0x20
mov eax, eax
or rcx, rax
mov qword [rbx + 0x18], rcx
test sil, sil
je 0x14008d6f1
cmp byte [rbx + 0x48], 0
mov rdx, rdi
mov rcx, rbx
je 0x14008d6ea
call fcn.14008e77c
jmp 0x14008d701
call fcn.14008e690
jmp 0x14008d701
xor r8d, r8d
mov r9b, 1
xor edx, edx
mov rcx, rbx
call fcn.14008e8cc
mov bl, al
test rdi, rdi
je 0x14008d711
mov rcx, rdi
call qword [0x1400b5f30]
mov al, bl
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x14008da04
Capabilities:
Connect to http server
Send data
Send http request

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov eax, dword [rcx + 0x90]
mov r15b, r8b
mov r8, qword [rdx + 0x60]
mov r14d, eax
bts r14d, 0x17
mov r12b, r9b
cmp dword [rdx + 0xe4], 4
mov rsi, rdx
mov r9, qword [rdx + 0x40]
mov rdi, rcx
mov rcx, qword [rcx + 8]
cmovne r14d, eax
mov eax, dword [rdx + 0xe0]
xor r13d, r13d
mov qword [r11 - 0x60], r13
mov dword [r11 - 0x68], r13d
mov dword [rsp + 0x28], eax
mov qword [r11 - 0x78], r8
movzx r8d, word [rdx + 0xe8]
mov rdx, qword [rdx + 0x20]
call qword [0x1400b5f60]
mov qword [rdi], rax
test rax, rax
jne 0x14008da9a
xor r9d, r9d
lea edx, [rax + 0xb]
mov r8d, 0xdeadbeef
mov rcx, rdi
call fcn.14008e8cc
jmp 0x14008dbdd
mov r8, qword [rsi + 0xc0]
xor r9d, r9d
mov qword [rsp + 0x38], r13
xor edx, edx
mov dword [rsp + 0x30], r14d
mov rcx, rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [0x1400b5f28]
mov rbx, rax
test rax, rax
jne 0x14008dad3
lea edx, [rax + 0xc]
jmp 0x14008dbb8
test r15b, r15b
je 0x14008dae6
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.14008e914
bt r14d, 0xc
jae 0x14008db25
mov r14d, 4
lea r9, [rbp + 0x48]
lea r8, [rbp + 0x40]
mov dword [rbp + 0x48], r14d
mov rcx, rbx
lea esi, [r14 + 0x1b]
mov edx, esi
call qword [0x1400b5f58]
bts dword [rbp + 0x40], 8
lea r8, [rbp + 0x40]
mov r9d, r14d
mov edx, esi
mov rcx, rbx
call qword [0x1400b5f40]
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [0x1400b5f68]
test eax, eax
je 0x14008dbb3
mov rdx, rbx
call fcn.14008d9b4
cmp eax, 0xc8
jne 0x14008dbb3
lea rax, [rbp + 0x40]
mov dword [rbp + 0x40], r13d
lea r9, [rbp + 0x48]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x20]
mov dword [rbp + 0x48], 0x20
mov edx, 5
mov rcx, rbx
call qword [0x1400b5f50]
lea rcx, [rbp - 0x20]
mov word [rbp - 2], r13w
call fcn.14002a7a8
mov qword [rdi + 0x18], rax
mov rcx, rdi
test r12b, r12b
je 0x14008dba9
mov rdx, rbx
cmp byte [rdi + 0x48], r13b
je 0x14008dba2
call fcn.14008e77c
jmp 0x14008dbc9
call fcn.14008e690
jmp 0x14008dbc9
xor r8d, r8d
mov r9b, 1
xor edx, edx
jmp 0x14008dbc4
mov edx, 0xd
xor r9d, r9d
mov r8d, 0xdeadbeef
mov rcx, rdi
call fcn.14008e8cc
mov dil, al
test rbx, rbx
je 0x14008dbda
mov rcx, rbx
call qword [0x1400b5f30]
mov al, dil
mov rbx, qword [rsp + 0xb0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14008e51c
Capabilities:
Create http request

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov edi, 1
mov rbx, rcx
cmp edx, edi
jne 0x14008e53b
movzx eax, word [rcx + 0x100]
jmp 0x14008e542
movzx eax, word [rcx + 0x98]
mov rcx, qword [rcx + 0x168]
cmp ax, di
jne 0x14008e552
mov edx, edi
jmp 0x14008e57b
cmp ax, 2
jne 0x14008e579
mov eax, 0x148
lea r9, str._local_
cmp edx, edi
mov edx, 3
lea r8d, [rax - 0x68]
cmovne eax, r8d
mov r8, qword [rax + rbx]
jmp 0x14008e581
xor edx, edx
xor r9d, r9d
xor r8d, r8d
and dword [rsp + 0x20], 0
call qword [0x1400b5f38]
mov qword [rbx + 8], rax
test rax, rax
je 0x14008e5c1
cmp byte [rbx + 0x19c], 0
je 0x14008e5be
and dword [rsp + 0x44], 0
lea r8, [rsp + 0x40]
mov r9d, 8
mov dword [rsp + 0x40], edi
xor ecx, ecx
lea edx, [r9 + 0x2a]
call qword [0x1400b5f40]
mov al, dil
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14008e690
Capabilities:
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x420
mov rbp, rdx
mov rdi, rcx
mov rcx, qword [rcx + 0x50]
lea rdx, [0x1400dd6c0]
call fcn.140034850
mov rsi, rax
test rax, rax
jne 0x14008e6ca
lea edx, [rax + 0x1f]
jmp 0x14008e73c
mov ebx, 1
mov dword [rsp + 0x430], ebx
lea r9, [rsp + 0x430]
mov r8d, 0x400
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [0x1400b5f88]
test eax, eax
je 0x14008e737
mov eax, dword [rsp + 0x430]
test eax, eax
je 0x14008e722
mov edx, eax
lea rcx, [rsp + 0x20]
mov r9, rsi
mov r8, rbx
call fcn.140032974
mov ecx, dword [rsp + 0x430]
add qword [rdi + 0x10], rcx
test ecx, ecx
jne 0x14008e6d6
cmp qword [rdi + 0x10], 0
jne 0x14008e730
mov edx, 0x21
jmp 0x14008e73c
xor edx, edx
xor r8d, r8d
jmp 0x14008e744
mov edx, 0x20
xor bl, bl
mov r8d, 0xdeadbeef
mov r9b, bl
mov rcx, rdi
call fcn.14008e8cc
mov bl, al
test rsi, rsi
je 0x14008e75e
mov rcx, rsi
call fcn.1400348e0
lea r11, [rsp + 0x420]
mov al, bl
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14008e77c
Capabilities:
Query remote server for available data
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov r15, rdx
mov dword [rbp + 0x40], 1
mov rbx, rcx
mov qword [rbp + 0x48], 1
mov rcx, r15
lea rdx, [rbp + 0x48]
xor r9d, r9d
xor r8d, r8d
call qword [0x1400b5f90]
mov rax, qword [rbp + 0x48]
mov ecx, 0x400
test rax, rax
cmove rax, rcx
cmp dword [rbp + 0x40], 0
mov qword [rbp + 0x48], rax
je 0x14008e881
test rax, rax
jne 0x14008e7de
xor edi, edi
jmp 0x14008e7ed
mov rcx, rax
call fcn.140024b88
mov rdi, rax
mov rax, qword [rbp + 0x48]
lea r9, [rbp + 0x40]
mov r8d, eax
mov rdx, rdi
mov rcx, r15
call qword [0x1400b5f88]
test eax, eax
je 0x14008e88f
mov ecx, dword [rbp + 0x40]
test ecx, ecx
je 0x14008e877
mov esi, ecx
test rdi, rdi
je 0x14008e864
test ecx, ecx
je 0x14008e864
and qword [rbp - 0x10], 0
lea rdx, [rbp - 0x10]
and qword [rbp - 8], 0
lea rcx, [rbx + 0x70]
call fcn.14008ecac
xor edx, edx
xor ecx, ecx
call fcn.140024b44
mov rax, qword [rbx + 0x78]
mov rcx, qword [rbx + 0x80]
mov rcx, qword [rax + rcx*8 - 8]
mov qword [rcx], rdi
mov rcx, qword [rbx + 0x80]
mov rax, qword [rbx + 0x78]
mov rcx, qword [rax + rcx*8 - 8]
mov qword [rcx + 8], rsi
mov ecx, dword [rbp + 0x40]
mov eax, ecx
add qword [rbx + 0x10], rax
test ecx, ecx
je 0x14008e881
mov rax, qword [rbp + 0x48]
jmp 0x14008e7d5
xor edx, edx
mov rcx, rdi
call fcn.140024b44
cmp qword [rbx + 0x10], 0
jne 0x14008e8a9
mov edx, 0x21
jmp 0x14008e89e
xor edx, edx
mov rcx, rdi
call fcn.140024b44
mov edx, 0x20
xor r9d, r9d
mov r8d, 0xdeadbeef
jmp 0x14008e8b1
xor r8d, r8d
mov r9b, 1
xor edx, edx
mov rcx, rbx
call fcn.14008e8cc
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14008ea4c
Capabilities:
Parse url

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov rbx, rdx
lea rcx, [rbp - 0x39]
xor edx, edx
mov rsi, r8
lea r8d, [rdx + 0x68]
call fcn.1400261b0
mov r14d, 1
mov dword [rbp - 0x39], 0xf0
mov rcx, rbx
mov dword [rbp - 9], r14d
mov dword [rbp - 0x19], r14d
mov dword [rbp - 0x29], r14d
mov dword [rbp + 0x27], r14d
mov dword [rbp + 0x17], r14d
mov dword [rbp + 7], r14d
call fcn.140028cc8
mov rdx, rax
lea r9, [rbp - 0x39]
xor r8d, r8d
mov rcx, rbx
call qword [0x1400b5f48]
test eax, eax
je 0x14008ebb2
mov r9d, dword [rbp - 0x29]
xor r8d, r8d
mov rdx, qword [rbp - 0x31]
mov rcx, rsi
call fcn.14000c37c
mov r9d, dword [rbp - 0x19]
lea rcx, [rsi + 0x20]
mov rdx, qword [rbp - 0x21]
xor r8d, r8d
call fcn.14000c37c
mov r9d, dword [rbp - 9]
lea rcx, [rsi + 0x40]
mov rdx, qword [rbp - 0x11]
xor r8d, r8d
call fcn.14000c37c
mov r9d, dword [rbp + 7]
lea rcx, [rsi + 0x60]
mov rdx, qword [rbp - 1]
xor r8d, r8d
call fcn.14000c37c
mov r9d, dword [rbp + 0x17]
lea rdi, [rsi + 0x80]
mov rdx, qword [rbp + 0xf]
mov rcx, rdi
xor r8d, r8d
call fcn.14000c37c
mov r9d, dword [rbp + 0x27]
lea rbx, [rsi + 0xa0]
mov rdx, qword [rbp + 0x1f]
mov rcx, rbx
xor r8d, r8d
call fcn.14000c37c
mov r8, rbx
lea rdx, [rbp + 0x37]
mov rcx, rdi
call fcn.14006c334
mov rdx, rax
lea rcx, [rsi + 0xc0]
call fcn.14000ca70
lea rcx, [rbp + 0x37]
call fcn.140008a8c
mov ecx, dword [rbp - 0x25]
movzx eax, word [rbp - 0x15]
mov dword [rsi + 0xe4], ecx
mov word [rsi + 0xe8], ax
sub ecx, r14d
je 0x14008eba8
cmp ecx, r14d
je 0x14008eb9c
mov dword [rsi + 0xe0], 3
jmp 0x14008ebaf
mov dword [rsi + 0xe0], 2
jmp 0x14008ebaf
mov dword [rsi + 0xe0], r14d
mov al, r14b
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x14008ebd0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x188], 0
mov rbx, rcx
je 0x14008ec37
test dl, dl
je 0x14008ec37
mov rcx, qword [rcx + 0x190]
test rcx, rcx
je 0x14008ec00
call qword [0x1400b57e8]
and qword [rbx + 0x190], 0
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [0x1400b5578]
mov r8, rbx
lea rcx, [0x14008ec80]
xor edx, edx
mov qword [rbx + 0x190], rax
call fcn.140031de4
cmp dword [rbx + 0x20], 0
sete al
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp fcn.14008d884
Function at 0x140094d60
Capabilities:
Capture screenshot

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xc0
mov r12d, dword [r8]
lea rdi, [r8 + 8]
mov r15d, dword [rdi]
mov rbx, r8
mov esi, dword [r8 + 0xc]
mov r14d, dword [r8 + 4]
cmp r15d, r12d
jge 0x140094da1
mov dword [r8], r15d
mov dword [rdi], r12d
cmp esi, r14d
jge 0x140094dae
mov dword [r8 + 4], esi
mov dword [r8 + 0xc], r14d
mov r9, rdx
lea r8, [rbp - 0x31]
mov edx, dword [rcx + 0x1d8]
call fcn.14009018c
mov rax, qword [rbp - 0x31]
add dword [rbx], eax
add dword [rdi], eax
mov ecx, dword [rbp - 0x2d]
add dword [rbx + 0xc], ecx
add dword [rbx + 4], ecx
xor ecx, ecx
mov r13d, dword [rdi]
mov eax, dword [rbx + 0xc]
sub r13d, dword [rbx]
sub eax, dword [rbx + 4]
inc r13d
inc eax
mov dword [rbp + 0x77], r13d
mov dword [rbp + 0x67], eax
call qword [0x1400b5ec0]
mov r8d, dword [rbp + 0x67]
mov edx, r13d
mov rcx, rax
mov qword [rbp - 0x29], rax
call qword [0x1400b51f0]
mov rcx, qword [rbp - 0x29]
mov qword [rbp - 0x21], rax
call qword [0x1400b5290]
mov rdx, qword [rbp - 0x21]
mov rcx, rax
mov r13, rax
call qword [0x1400b5288]
mov edx, dword [rbp + 0x67]
mov ecx, dword [rbp + 0x77]
mov r8d, ecx
mov qword [rbp - 0x19], rax
mov eax, edx
neg eax
cmp esi, r14d
mov dword [rbp - 0x39], eax
mov r9d, eax
cmovge r9d, edx
neg r8d
cmp r15d, r12d
cmovge r8d, ecx
cmp esi, r14d
jge 0x140094e55
mov eax, dword [rbx + 0xc]
jmp 0x140094e58
mov eax, dword [rbx + 4]
mov r14, qword [rbp - 0x29]
cmp r15d, r12d
mov dword [rsp + 0x50], 0xcc0020
mov dword [rsp + 0x48], r9d
cmovge rdi, rbx
mov dword [rsp + 0x40], r8d
mov r9d, ecx
mov dword [rsp + 0x38], eax
xor r8d, r8d
mov rcx, r13
mov eax, dword [rdi]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], edx
xor edx, edx
call qword [0x1400b5280]
mov eax, dword [rbp + 0x77]
xor r15d, r15d
mov rsi, qword [rbp - 0x21]
xor r9d, r9d
mov dword [rbp - 0xd], eax
xor r8d, r8d
mov eax, dword [rbp - 0x39]
mov rdx, rsi
mov dword [rbp - 9], eax
mov rcx, r13
lea rax, [rbp - 0x11]
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov dword [rbp - 0x11], 0x28
mov qword [rbp - 5], 0x200001
call qword [0x1400b5278]
mov eax, dword [rbp + 3]
mov rcx, qword [rbp + 0x7f]
mov dword [rcx], eax
mov ecx, eax
call fcn.140024b88
mov r9d, dword [rbp + 0x67]
mov rdi, rax
lea rax, [rbp - 0x11]
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rdi
mov rcx, r13
call qword [0x1400b5278]
mov rdx, qword [rbp - 0x19]
mov rcx, r13
mov ebx, eax
call qword [0x1400b5288]
mov rcx, rsi
call qword [0x1400b5190]
mov rcx, r13
call qword [0x1400b5270]
mov rdx, r14
xor ecx, ecx
call qword [0x1400b5cd8]
test ebx, ebx
je 0x140094f4e
mov rax, rdi
jmp 0x140094f58
mov rcx, rdi
call fcn.140024b44
xor eax, eax
mov rbx, qword [rsp + 0x108]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14009afac
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1f88]
mov eax, 0x2060
call fcn.140048f00
sub rsp, rax
mov r15, rcx
lea rcx, [rsp + 0x20]
call fcn.14000717c
xor r12d, r12d
mov rcx, r15
mov esi, r12d
call fcn.14000be3c
mov rax, qword [r15 + 8]
mov r14b, r12b
mov rdi, qword [rax]
movzx eax, word [rdi]
test ax, ax
je 0x14009b13f
mov ebx, r12d
lea r13d, [r12 + 0x25]
inc esi
inc rbx
cmp ax, r13w
jne 0x14009b0e4
cmp word [rdi + rbx*2], r13w
jne 0x14009b039
mov edx, r13d
lea rcx, [rsp + 0x20]
call fcn.1400090c4
jmp 0x14009b0da
lea rdx, [0x1400b6538]
lea rcx, [rsp + 0x40]
call fcn.14000d54c
jmp 0x14009b063
test ax, ax
je 0x14009b06d
movzx edx, ax
lea rcx, [rsp + 0x40]
call fcn.1400090c4
inc esi
inc rbx
movzx eax, word [rdi + rbx*2]
cmp ax, r13w
jne 0x14009b04c
cmp word [rdi + rbx*2], r12w
je 0x14009b100
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x60]
mov r8d, 0xfff
mov word [rsp + 0x60], r12w
call qword [0x1400b5588]
test eax, eax
je 0x14009b09f
lea rdx, [rsp + 0x60]
jmp 0x14009b0c6
lea rdx, [0x1400de034]
lea rcx, [rsp + 0x20]
call fcn.14000534c
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140005cac
lea rdx, [0x1400de034]
lea rcx, [rsp + 0x20]
call fcn.14000534c
lea rcx, [rsp + 0x40]
call fcn.140008a8c
inc esi
mov r14b, 1
inc rbx
jmp 0x14009b0f1
movzx edx, ax
lea rcx, [rsp + 0x20]
call fcn.1400090c4
movzx eax, word [rdi + rbx*2]
test ax, ax
jne 0x14009b011
jmp 0x14009b12d
lea rdx, [0x1400de034]
mov r14b, 1
lea rcx, [rsp + 0x20]
call fcn.14000534c
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140005cac
lea rcx, [rsp + 0x40]
call fcn.140008a8c
test r14b, r14b
je 0x14009b13f
lea rdx, [rsp + 0x20]
mov rcx, r15
call fcn.140005c40
lea rcx, [rsp + 0x20]
call fcn.140008a8c
lea r11, [rsp + 0x2060]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400a13c8
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x160]
sub rsp, 0x260
lea rax, [rsp + 0x40]
mov dword [rbp + 0x190], 0xff
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0x190]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x60]
and qword [rsp + 0x28], 0
mov r14d, edx
and qword [rsp + 0x20], 0
xor edx, edx
mov rsi, rcx
call qword [0x1400b5020]
cmp eax, 0x103
je 0x1400a1527
mov edi, r14d
or edi, 0x20019
lea rax, [rbp + 0x198]
mov r9d, edi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [0x1400b5028]
test eax, eax
jne 0x1400a154c
mov rcx, qword [rbp + 0x198]
mov edx, r14d
call fcn.1400a13c8
mov rcx, qword [rbp + 0x198]
mov bl, al
call qword [0x1400b5030]
test bl, bl
je 0x1400a154c
and qword [rsp + 0x48], 0
lea rcx, [rsp + 0x48]
and qword [rsp + 0x58], 0
call fcn.1400a0ed4
test al, al
je 0x1400a14bd
lea rcx, [rsp + 0x48]
call fcn.14009faa4
xor r9d, r9d
lea rdx, [rsp + 0x60]
mov r8d, r14d
mov rcx, rsi
call rax
jmp 0x1400a14cb
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [0x1400b5018]
mov rcx, qword [rsp + 0x48]
test eax, eax
jne 0x1400a1541
test rcx, rcx
je 0x1400a14df
call qword [0x1400b5320]
lea rax, [rsp + 0x40]
mov dword [rbp + 0x190], 0xff
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0x190]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x60]
and qword [rsp + 0x28], 0
xor edx, edx
and qword [rsp + 0x20], 0
mov rcx, rsi
call qword [0x1400b5020]
cmp eax, 0x103
jne 0x1400a1439
mov al, 1
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
test rcx, rcx
je 0x1400a154c
call qword [0x1400b5320]
xor al, al
jmp 0x1400a1529