joyce8/EMBER2024-capa huggingface dataset:
Function at 0x19890
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x88
call fcn.00011010
movzx eax, al
cmp eax, 1
jle 0x198e3
call fcn.00011010
movzx eax, al
mov edx, eax
lea rcx, [0x0001c650]
call sub.ntoskrnl.exe_DbgPrint
xor r9d, r9d
mov r8d, 0x1b3
lea rdx, [0x0001cbb0]
lea rcx, [0x0001c620]
call qword [sym.imp.ntoskrnl.exe_RtlAssert]
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax + 0xb8]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 2]
cmp eax, 1
jne 0x19921
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp rax, 0x40
jae 0x1992b
mov eax, 0xc0000001
jmp 0x19ab1
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax + 0x20]
mov rax, qword [rax + 0x40]
lea rdx, [rsp + 0x30]
mov rcx, qword [rax + 0x28]
call fcn.0001a280
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 0
jge 0x19981
xor eax, eax
test eax, eax
jne 0x1996c
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 0x14]
and eax, 0x20
test eax, eax
je 0x19978
lea rcx, [0x0001cbd0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [rsp + 0x78]
jmp 0x19ab1
mov rax, qword [rsp + 0x20]
lea rcx, [rsp + 0x40]
lea rdi, [rax + 0x10]
mov rsi, rcx
mov ecx, 0x1c
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x14], 1
mov rax, qword [rsp + 0x20]
cmp dword [rax + 0x18], 1
je 0x199bc
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x18], 4
mov rax, qword [rsp + 0x20]
cmp dword [rax + 0x1c], 1
je 0x199d3
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x1c], 4
mov rax, qword [rsp + 0x20]
cmp dword [rax + 0x20], 1
je 0x199ea
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x20], 4
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x2c], 0
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x30], 0
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x34], 0
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x38], 0
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x3c], 0
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 4]
or eax, 8
mov rcx, qword [rsp + 0x20]
mov dword [rcx + 4], eax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 4]
or eax, 0x10
mov rcx, qword [rsp + 0x20]
mov dword [rcx + 4], eax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 4]
or eax, 0x200
mov rcx, qword [rsp + 0x20]
mov dword [rcx + 4], eax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 4]
and eax, 0xffffffbf
mov rcx, qword [rsp + 0x20]
mov dword [rcx + 4], eax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 4]
and eax, 0xffffff7f
mov rcx, qword [rsp + 0x20]
mov dword [rcx + 4], eax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0xa0]
mov ecx, dword [rcx + 0x30]
mov dword [rax + 8], ecx
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0xa0]
mov ecx, dword [rcx + 0x30]
mov dword [rax + 0xc], ecx
xor eax, eax
add rsp, 0x88
pop rdi
pop rsi
ret
Function at 0x19e00
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.00011010
movzx eax, al
cmp eax, 1
jle 0x19e4e
call fcn.00011010
movzx eax, al
mov edx, eax
lea rcx, [0x0001c650]
call sub.ntoskrnl.exe_DbgPrint
xor r9d, r9d
mov r8d, 0x2fe
lea rdx, [0x0001cbb0]
lea rcx, [0x0001c620]
call qword [sym.imp.ntoskrnl.exe_RtlAssert]
mov rax, qword [rsp + 0x68]
mov rax, qword [rax + 0xb8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 8]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x19e82
cmp dword [rsp + 0x40], 1
je 0x19f33
jmp 0x19f54
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x68]
cmp qword [rax + 0x38], 0
jne 0x19f29
mov word [rsp + 0x20], 0x54
movzx eax, word [rsp + 0x20]
mov r8d, 0x62735556
mov rdx, rax
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x19ed5
mov dword [rsp + 0x30], 0xc000009a
jmp 0x19f31
lea r9, [0x0001ccd0]
lea r8, [0x0001ccb0]
lea rdx, [0x0001cca0]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_swprintf]
xor eax, eax
test eax, eax
jne 0x19f0a
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x14]
and eax, 0x20
test eax, eax
je 0x19f1b
mov rdx, qword [rsp + 0x38]
lea rcx, [0x0001cc80]
call sub.ntoskrnl.exe_DbgPrint
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x38], rcx
mov dword [rsp + 0x30], 0
jmp 0x19f60
xor eax, eax
test eax, eax
jne 0x19f48
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x14]
and eax, 0x20
test eax, eax
je 0x19f54
lea rcx, [0x0001cc50]
call sub.ntoskrnl.exe_DbgPrint
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 0x30]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
add rsp, 0x58
ret

Function at 0x19f70
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
call fcn.00011010
movzx eax, al
cmp eax, 1
jle 0x19fbe
call fcn.00011010
movzx eax, al
mov edx, eax
lea rcx, [0x0001c650]
call sub.ntoskrnl.exe_DbgPrint
xor r9d, r9d
mov r8d, 0x356
lea rdx, [0x0001cbb0]
lea rcx, [0x0001c620]
call qword [sym.imp.ntoskrnl.exe_RtlAssert]
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x30]
add rsp, 0x28
ret

Function at 0x19fe0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.00011010
movzx eax, al
cmp eax, 1
jle 0x1a02e
call fcn.00011010
movzx eax, al
mov edx, eax
lea rcx, [0x0001c650]
call sub.ntoskrnl.exe_DbgPrint
xor r9d, r9d
mov r8d, 0x3a7
lea rdx, [0x0001cbb0]
lea rcx, [0x0001c620]
call qword [sym.imp.ntoskrnl.exe_RtlAssert]
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0x30]
add rsp, 0x48
ret
Function at 0x1a050
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.00011010
movzx eax, al
cmp eax, 1
jle 0x1a09e
call fcn.00011010
movzx eax, al
mov edx, eax
lea rcx, [0x0001c650]
call sub.ntoskrnl.exe_DbgPrint
xor r9d, r9d
mov r8d, 0x3d9
lea rdx, [0x0001cbb0]
lea rcx, [0x0001c620]
call qword [sym.imp.ntoskrnl.exe_RtlAssert]
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0xb8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 8]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 4
je 0x1a0c7
jmp 0x1a187
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1a118
cmp qword [rsp + 0x20], 0
je 0x1a110
lea r9, [0x0001cd00]
mov r8d, 0x3e7
lea rdx, [0x0001cbb0]
lea rcx, [0x0001cce0]
call qword [sym.imp.ntoskrnl.exe_RtlAssert]
mov dword [rsp + 0x38], 0
jmp 0x1a118
mov dword [rsp + 0x38], 1
mov r8d, 0x62735556
mov edx, 0x10
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1a145
mov dword [rsp + 0x30], 0xc000009a
jmp 0x1a193
mov rax, qword [rsp + 0x20]
mov dword [rax], 1
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call qword [sym.imp.ntoskrnl.exe_ObfReferenceObject]
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x20]
mov qword [rax + 0x38], rcx
jmp 0x1a193
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0x30]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x1a1b0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x38
call fcn.00011010
movzx eax, al
cmp eax, 1
jle 0x1a200
call fcn.00011010
movzx eax, al
mov edx, eax
lea rcx, [0x0001c650]
call sub.ntoskrnl.exe_DbgPrint
xor r9d, r9d
mov r8d, 0x426
lea rdx, [0x0001cbb0]
lea rcx, [0x0001c620]
call qword [sym.imp.ntoskrnl.exe_RtlAssert]
mov r8d, 0x62735556
mov edx, 0x18
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1a22a
mov eax, 0xc000009a
jmp 0x1a268
lea rax, [0x00014180]
mov rdi, qword [rsp + 0x20]
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x10], 0xf
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x14], 0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x20]
mov qword [rax + 0x38], rcx
xor eax, eax
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x1a280
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x90
call fcn.00011010
movzx eax, al
cmp eax, 1
jle 0x1a2d2
call fcn.00011010
movzx eax, al
mov edx, eax
lea rcx, [0x0001c650]
call sub.ntoskrnl.exe_DbgPrint
xor r9d, r9d
mov r8d, 0x4d0
lea rdx, [0x0001cbb0]
lea rcx, [0x0001c620]
call qword [sym.imp.ntoskrnl.exe_RtlAssert]
mov rdi, qword [rsp + 0xa8]
xor eax, eax
mov ecx, 0x40
rep stosb byte [rdi], al
mov rax, qword [rsp + 0xa8]
mov word [rax], 0x40
mov rax, qword [rsp + 0xa8]
mov word [rax + 2], 1
mov rax, qword [rsp + 0xa8]
mov dword [rax + 8], 0xffffffff
mov rax, qword [rsp + 0xa8]
mov dword [rax + 0xc], 0xffffffff
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_IoGetAttachedDeviceReference]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov ecx, 0x1b
call qword [sym.imp.ntoskrnl.exe_IoBuildSynchronousFsdRequest]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x1a38c
mov dword [rsp + 0x70], 0xc000009a
jmp 0x1a41f
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x30], 0xc00000bb
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0xb8]
sub rax, 0x48
mov qword [rsp + 0x50], rax
mov rdi, qword [rsp + 0x50]
xor eax, eax
mov ecx, 0x48
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x50]
mov byte [rax], 0x1b
mov rax, qword [rsp + 0x50]
mov byte [rax + 1], 9
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xa8]
mov qword [rax + 8], rcx
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0x103
jne 0x1a41f
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x70], eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, dword [rsp + 0x70]
add rsp, 0x90
pop rdi
ret
Function at 0x1d010
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor eax, eax
test eax, eax
jne 0x1d031
mov eax, dword [0x00015100]
and eax, 2
test eax, eax
je 0x1d049
lea rcx, [0x0001d1d0]
call sub.ntoskrnl.exe_DbgPrint
lea rcx, [0x0001d1c0]
call sub.ntoskrnl.exe_DbgPrint
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
add rax, 2
mov word [0x000152a2], ax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
mov word [0x000152a0], ax
movzx eax, word [0x000152a2]
mov r8d, 0x62735556
mov rdx, rax
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [0x000152a8], rax
cmp qword [0x000152a8], 0
jne 0x1d0a1
mov eax, 0xc000009a
jmp 0x1d14d
mov rdx, qword [rsp + 0x38]
lea rcx, [0x000152a0]
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
mov rax, qword [rsp + 0x30]
lea rcx, [0x00017010]
mov qword [rax + 0x80], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x80]
mov qword [rax + 0x70], rcx
mov rax, qword [rsp + 0x30]
lea rcx, [0x00017a20]
mov qword [rax + 0x148], rcx
mov rax, qword [rsp + 0x30]
lea rcx, [0x00011800]
mov qword [rax + 0x120], rcx
mov rax, qword [rsp + 0x30]
lea rcx, [0x000171c0]
mov qword [rax + 0xe0], rcx
mov rax, qword [rsp + 0x30]
lea rcx, [0x0001b1c0]
mov qword [rax + 0xe8], rcx
mov rax, qword [rsp + 0x30]
lea rcx, [0x000174c0]
mov qword [rax + 0x68], rcx
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x30]
lea rcx, [0x000175a0]
mov qword [rax + 8], rcx
xor eax, eax
add rsp, 0x28
ret
mov rax, qword [0x00015208]
movabs r9, 0x2b992ddfa232
test rax, rax
je 0x1d17b
cmp rax, r9
jne 0x1d1aa
lea r8, [0x00015208]
movabs rax, 0xfffff78000000320
mov rax, qword [rax]
xor rax, r8
movabs r8, 0xffffffffffff
and rax, r8
cmove rax, r9
mov qword [0x00015208], rax
not rax
mov qword [0x00015200], rax
jmp 0x1d010
Function at 0x1d160
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor eax, eax
test eax, eax
jne 0x1d031
mov eax, dword [0x00015100]
and eax, 2
test eax, eax
je 0x1d049
lea rcx, [0x0001d1d0]
call sub.ntoskrnl.exe_DbgPrint
lea rcx, [0x0001d1c0]
call sub.ntoskrnl.exe_DbgPrint
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
add rax, 2
mov word [0x000152a2], ax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
mov word [0x000152a0], ax
movzx eax, word [0x000152a2]
mov r8d, 0x62735556
mov rdx, rax
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [0x000152a8], rax
cmp qword [0x000152a8], 0
jne 0x1d0a1
mov eax, 0xc000009a
jmp 0x1d14d
mov rdx, qword [rsp + 0x38]
lea rcx, [0x000152a0]
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
mov rax, qword [rsp + 0x30]
lea rcx, [0x00017010]
mov qword [rax + 0x80], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x80]
mov qword [rax + 0x70], rcx
mov rax, qword [rsp + 0x30]
lea rcx, [0x00017a20]
mov qword [rax + 0x148], rcx
mov rax, qword [rsp + 0x30]
lea rcx, [0x00011800]
mov qword [rax + 0x120], rcx
mov rax, qword [rsp + 0x30]
lea rcx, [0x000171c0]
mov qword [rax + 0xe0], rcx
mov rax, qword [rsp + 0x30]
lea rcx, [0x0001b1c0]
mov qword [rax + 0xe8], rcx
mov rax, qword [rsp + 0x30]
lea rcx, [0x000174c0]
mov qword [rax + 0x68], rcx
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x30]
lea rcx, [0x000175a0]
mov qword [rax + 8], rcx
xor eax, eax
add rsp, 0x28
ret
mov rax, qword [0x00015208]
movabs r9, 0x2b992ddfa232
test rax, rax
je 0x1d17b
cmp rax, r9
jne 0x1d1aa
lea r8, [0x00015208]
movabs rax, 0xfffff78000000320
mov rax, qword [rax]
xor rax, r8
movabs r8, 0xffffffffffff
and rax, r8
cmove rax, r9
mov qword [0x00015208], rax
not rax
mov qword [0x00015200], rax
jmp 0x1d010
Function at 0x140002801
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 8], rcx
push r15
xor rax, rax
push rax
sub rsp, 0x28
call fcn.140012440
mov r15, qword [rsp + 0x28]
cmp r15, 1
jne 0x14000283d
push qword [0x14002045c]
pop rcx
call fcn.140007170
and rax, rax
je 0x14000283d
push qword [0x14002045c]
pop rcx
call fcn.14000720c
push qword [0x14002050c]
pop rcx
call fcn.14000da6c
push qword [0x1400204ec]
pop rcx
call fcn.14000da6c
call fcn.1400047ba
push qword [0x1400204ac]
pop rcx
call fcn.14000da6c
push qword [0x140020484]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
push qword [0x14002051c]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
mov rax, qword [rsp + 0x40]
mov qword [0x140020454], rax
jmp 0x14000123b

Function at 0x140002899
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
push rbp
push r15
mov rax, 0x14
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x1400028b2
sub rsp, 0x28
call fcn.140012440
mov rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.1400122f0
add rsp, 0x10
mov rdx, qword [rsp + 0xe8]
lea rcx, [rsp + 0x30]
sub rsp, 0x10
call fcn.1400122f0
add rsp, 0x10
mov rdx, qword [rsp + 0xf0]
lea rcx, [rsp + 0x38]
sub rsp, 0x10
call fcn.1400122f0
add rsp, 0x10
lea rax, [rsp + 0x40]
lea rbp, [rsp + 0x40]
mov dword [rbp], 0x70
mov dword [rbp + 4], 0x140
mov dword [rbp + 0x30], 0
movabs rax, str.open
mov rax, rax
push rax
pop rax
mov qword [rbp + 0x10], rax
mov rax, qword [rsp + 0x28]
mov rax, rax
push rax
pop rax
mov qword [rbp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov rax, rax
push rax
pop rax
mov qword [rbp + 0x20], rax
mov rax, qword [rsp + 0x30]
mov rax, rax
push rax
pop rax
mov qword [rbp + 0x28], rax
lea rax, [rsp + 0x40]
mov rax, rax
push rax
pop rcx
call sub.SHELL32.DLL_ShellExecuteExW
mov qword [rsp + 0xb0], rax
push 0x19
pop rcx
call fcn.140007364
lea rax, [rsp + 0xb8]
mov rax, rax
push rax
lea rbp, [rsp + 0x48]
push qword [rbp + 0x68]
pop rcx
pop rdx
call sub.KERNEL32.dll_GetExitCodeProcess
and rax, rax
je 0x1400029cb
mov r15, qword [rsp + 0xb8]
cmp r15, 0x103
je 0x1400029cb
jmp 0x1400029cd
jmp 0x14000298d
mov rax, qword [rsp + 0xb8]
jmp 0x1400029da
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400123c0
add rsp, 0x28
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.1400123c0
add rsp, 0x28
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.1400123c0
add rsp, 0x28
pop rax
add rsp, 0xc8
pop r15
pop rbp
ret
Function at 0x1400033e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.140012440
push qword [rsp + 0x48]
push qword [rsp + 0x48]
pop rcx
pop rdx
call sub.KERNEL32.dll_LoadResource
mov qword [rsp + 0x28], rax
push qword [rsp + 0x48]
push qword [rsp + 0x48]
pop rcx
pop rdx
call sub.KERNEL32.dll_SizeofResource
mov qword [0x14002046c], rax
push qword [0x14002046c]
pop rcx
call fcn.14000c9e0
mov qword [rsp + 0x30], rax
push qword [0x14002046c]
push qword [rsp + 0x38]
push qword [rsp + 0x38]
pop rcx
pop rdx
pop r8
call fcn.14000cb10
push qword [rsp + 0x28]
pop rcx
call sub.KERNEL32.dll_FreeResource
mov rax, qword [rsp + 0x30]
jmp 0x14000345e
add rsp, 0x38
ret

Function at 0x140004695
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
xor rax, rax
push rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.140012440
mov rcx, qword [rsp + 0x70]
call fcn.140006904
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.1400122f0
add rsp, 0x10
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x30]
sub rsp, 0x10
call fcn.1400122f0
add rsp, 0x10
push rcx
sub rsp, 0x28
call fcn.1400121c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400121c0
add rsp, 0x28
pop rcx
push rax
push 0x800
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140008170
add rsp, 0x28
lea rcx, [rsp + 0x40]
pop rdx
call fcn.140012210
push 0x800
push qword [rsp + 0x40]
pop rcx
pop rdx
call sub.KERNEL32.dll_GetSystemDirectoryW
push qword [rsp + 0x38]
pop rcx
call sub.SHLWAPI.DLL_PathAddBackslashW
mov rcx, qword [rsp + 0x38]
push rcx
sub rsp, 0x28
call fcn.1400121c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400124b0
add rsp, 0x28
pop rax
push rax
call fcn.1400125a0
pop rdx
add rax, rdx
jmp 0x14000477d
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400123c0
add rsp, 0x28
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.1400123c0
add rsp, 0x28
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.1400123c0
add rsp, 0x28
pop rax
add rsp, 0x48
ret
Function at 0x1400047ba
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.140012440
mov r15, qword [0x14002048c]
cmp r15, 1
jne 0x140004889
push qword [0x14002057c]
pop rcx
call fcn.14000d5b4
mov r15, rax
and r15, r15
jle 0x14000481f
mov rcx, qword [0x14002057c]
call fcn.14000d5bc
mov rcx, qword [0x14002057c]
call fcn.14000d5d0
or rax, rax
je 0x14000481f
mov rbp, qword [0x140020584]
push qword [rbp + 0x10]
pop rcx
call fcn.14000da6c
jmp 0x1400047fc
push qword [0x14002056c]
pop rcx
call fcn.14000d5b4
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x140004889
push 5
push 0
push 1
push qword [0x14002056c]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140009070
mov rcx, qword [0x14002056c]
call fcn.14000d5bc
mov rcx, qword [0x14002056c]
call fcn.14000d5d0
or rax, rax
je 0x140004889
mov rbp, qword [0x140020574]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
jmp 0x140004866
mov rax, 1
jmp 0x140004895
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140006904
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f190]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret
Function at 0x14000720c
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.14000719c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021170]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400205b8]
jmp 0x140007248
cmp qword [rbx + 0x18], rdi
je 0x14000724f
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000723f
jmp 0x140007269
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x1400205b8]
call fcn.140011c68
lea rcx, [0x140021170]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
or cl, byte [rdi]
dec dword [0x14f033937]
adc eax, dword [rdi + rdi*8 + 0x14]
sbb dword [rdx - 1], ecx
sbb esp, dword [rcx]
push rbp
call [rbx]
and dword [rsi - 1], edx
sbb al, 0x23
pop rcx
call [rsp]
pop rbx
call [rcx]
and ebx, dword [rcx - 1]
invalid
and ebp, dword [rsi]
call [edi]
invalid
pop rdx
call [rax]
and edx, dword [rdi - 1]
sbb ah, byte [rsi]
pop rbp
call [rdi]
imul edi, edi, 0xff692f20
and al, 0x30
insb byte [rdi], dx
call [rsi]
sub dword [rdi + rdi*8 + 0x19], esp
and eax, 0x2016ff5c
push rdi
call [rax]
sbb byte [rbx], ah
push rbp
call qword [rsi]
sbb byte [rbx], ah
push rbp
call qword [rsi]
and dword [rcx - 1], edx
adc al, 0x24
push rcx
call qword [rdi]
and al, 0x53
jmp qword [rax]
xor edi, edi
adc cl, byte [rcx]
and al, 0xff
sbb eax, 0x20ff1e09
and byte [rcx], cl
sbb edi, edi
and al, 0xa
sbb edi, edi
and al, 0xa
adc al, 0xff
xor byte [rcx], dl
sbb bh, bh
xor edx, dword [rdx]
sbb edi, edi
adc edx, dword ss:[rsi]
push qword [rdx + rdx]
adc al, 0xff
xor eax, 0x33ff1715
adc edx, dword [rsi]
push qword [rbx + rdx]
sbb eax, 0x1e102eff
call [rbx + rax]
ud0

Function at 0x140007284
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov r9, rdx
mov r8, rcx
mov qword [r11 - 0x10], rax
xor edi, edi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x14000734a
lea rcx, [0x140021170]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400205b8]
jmp 0x14000730e
lea rsi, [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14000730b
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx]
lea rcx, [0x1400205b8]
mov rdx, rsi
call fcn.140011c68
jmp 0x14000730e
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400072db
mov rdx, qword [0x14001f118]
lea rcx, [0x1400205b8]
mov rdi, rdx
inc rdx
mov qword [0x14001f118], rdx
lea edx, [rbx + 0x20]
call fcn.140011cb0
lea rcx, [0x140021170]
mov qword [rax], rbp
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop rdi
ret