joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140121ef0
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, qword [rcx + 0xf28]
mov edx, 0x18
mov rax, qword [0x1401fa9c0]
mov rdi, rcx
mov esi, dword [rbx + 0x54]
mov qword [0x14020b818], rcx
lea ecx, [rdx - 0x10]
mov qword [0x14020b820], rax
mov rbp, qword [rbx + 0x70]
call fcn.14004881c
test rax, rax
je 0x140122094
mov qword [rbx + 0x70], rax
mov qword [rax + 0x10], rbp
mov rax, qword [rbx + 0x70]
and dword [rax], 0
mov rax, qword [rbx + 0x70]
and dword [rax + 4], 0
mov rax, qword [rbx + 0x70]
and qword [rax + 8], 0
test esi, esi
je 0x140121ff1
mov rcx, qword [rbx + 0x70]
mov eax, dword [rbx + 0x54]
cmp dword [rcx + 4], eax
jae 0x140121fca
mov rdx, qword [rcx + 8]
test rdx, rdx
je 0x140121fc3
mov rax, qword [rdx]
mov qword [rcx + 8], rax
mov rax, qword [rbx + 0x70]
inc dword [rax + 4]
jmp 0x140121fcc
mov cl, byte [rbx + 0x64]
mov r9, qword [rbx + 0x70]
mov rax, qword [rbx + 0x78]
mov r8d, dword [r9]
mov edx, r8d
shr rdx, cl
mov ecx, dword [rbx + 0x60]
and rcx, r8
mov rax, qword [rax + rdx*8]
mov rdx, qword [rax + rcx*8]
lea eax, [r8 + 1]
mov dword [r9], eax
mov rcx, qword [rbx + 0x70]
test rdx, rdx
jne 0x140122081
mov eax, dword [rbx + 0x50]
cmp dword [rcx], eax
jb 0x140121f8d
xor edx, edx
lea rax, [rdx + 0x10]
mov rcx, rdi
neg rdx
sbb rdx, rdx
xor r9d, r9d
and rdx, rax
xor r8d, r8d
call fcn.14001e880
sub rsi, 1
jne 0x140121f68
mov rcx, qword [rbx + 0x70]
mov rax, qword [rcx + 0x10]
mov qword [rbx + 0x70], rax
call qword [sym.imp.tbbmalloc.dll_scalable_free]
mov rcx, qword [rdi + 0xf28]
call fcn.14013a520
mov rcx, rdi
call fcn.140122aa0
test al, al
je 0x140122035
lea rdx, [0x14020b838]
lea rcx, [0x14020b828]
call fcn.1401217a0
mov qword [0x14020b830], rax
and qword [rsp + 0x28], 0
lea r8, [0x1401227d8]
xor r9d, r9d
mov dword [rsp + 0x20], 4
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1401fcd60], rax
test rax, rax
je 0x140122094
mov rcx, rax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.KERNEL32.dll_ResumeThread]
inc dword [rcx + 4]
mov rcx, qword [rbx + 0x70]
mov rax, qword [rdx]
mov qword [rcx + 8], rax
jmp 0x140121fcc
mov edx, 0x44e
xor ecx, ecx
call fcn.14005e3e8
int3

Function at 0x140122abc
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
mov r8, qword [0x1401f8520]
mov r10, qword [0x1401f8518]
test cl, cl
jne 0x140122adf
mov eax, r8d
sub eax, r10d
cmp eax, 0xfc00
jb 0x140122b1e
mov r9, qword [0x1401fb6f0]
sub r8d, r10d
test r9, r9
jne 0x140122aff
mov rdx, r10
lea rcx, str._.s
call fcn.140126dcc
jmp 0x140122b10
movsxd r8, r8d
mov edx, 1
mov rcx, r10
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rax, qword [0x1401f8518]
mov qword [0x1401f8520], rax
add rsp, 0x28
ret
Function at 0x140123344
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x38
cmp byte [0x1401fa4e1], 0
je 0x140123381
xor edx, edx
mov dword [0x1401fa440], 0x16
lea rcx, [0x1401fb6b0]
call fcn.1400f9a90
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 1
call fcn.14000510c
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, 0x4ba
xor ecx, ecx
call fcn.14005e3e8
int3

Function at 0x1401233cc
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
cmp byte [0x1401fcad3], 0
mov dword [0x1401fa440], 0x15
jne 0x1401233ed
test cl, cl
jne 0x1401233ed
xor bl, bl
jmp 0x1401233ef
mov bl, 1
test dl, dl
je 0x140123403
xor edx, edx
lea rcx, [0x1401fb6b0]
call fcn.1400f9a90
jmp 0x140123441
mov rcx, qword [0x1401f7130]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1401fa4f0]
or qword [0x1401f7130], 0xffffffffffffffff
call fcn.1400ba5e4
mov cl, 1
call fcn.140005b0c
cmp qword [0x1401fcf60], 0
je 0x140123441
lea rcx, [0x1401fcf50]
call fcn.14003feb0
cmp byte [0x1401fa4e1], 0
je 0x140123472
test bl, bl
je 0x14012345a
mov edx, 0x1787
xor ecx, ecx
call fcn.1400eb834
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 1
call fcn.14000510c
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ExitProcess]
test bl, bl
je 0x140123482
mov edx, 0x17b3
xor ecx, ecx
call fcn.1400eb834
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14000510c
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140124fc0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov r13, rdx
mov rsi, rcx
mov byte [rdx], 0
mov r9d, dword [rcx + 0x30]
lea r8d, [r9 + r9]
mov eax, 0xaaaaaaab
mul r8d
shr edx, 1
mov ebx, 1
add edx, ebx
cmp dword [rcx], edx
jb 0x14012515d
cmp r9d, 0x401e825f
jae 0x14012515d
xor eax, eax
lea rdx, [0x1401b7110]
mov rcx, rdx
cmp r9d, dword [rcx]
jb 0x14012502a
add eax, ebx
add rcx, 4
cmp eax, 0x16
jb 0x14012501a
and qword [rbp - 0x30], 0
and dword [rbp - 0x24], 0
and dword [rbp - 0x28], 0
mov r14d, dword [rdx + rax*4]
mov edx, r14d
lea rcx, [rbp - 0x30]
call fcn.14004f514
mov rdi, qword [rbp - 0x30]
test eax, eax
je 0x140125144
lea r8, [r14*8]
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
lea rax, [0x1401bb380]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rsi
or dword [rbp - 0x10], 0xffffffff
or dword [rbp - 0xc], 0xffffffff
mov r12d, dword [rbp - 0x28]
lea rcx, [rbp - 0x20]
call fcn.1400c2508
test eax, eax
je 0x140125177
mov rax, qword [rbp - 0x18]
mov ecx, dword [rbp - 0x10]
mov rax, qword [rax + 0x28]
mov rax, qword [rax + rcx*8]
mov ecx, dword [rbp - 0xc]
mov rax, qword [rax]
mov rax, qword [rax + rcx*8]
mov qword [rbp + 0x48], rax
mov r14, rax
shr r14, 0x20
mov rax, qword [rsi + 8]
mov ecx, dword [rax + r14*4]
mov dword [rbp + 0x40], ecx
or r8d, 0xffffffff
lea rdx, [rbp + 0x40]
mov r9d, 4
movzx ecx, r8b
movzx eax, byte [rdx]
xor rcx, rax
lea rax, [0x1401b02b0]
shr r8d, 8
xor r8d, dword [rax + rcx*4]
add rdx, rbx
sub r9, rbx
jne 0x1401250ce
xor edx, edx
mov eax, r8d
div r12d
mov r15d, edx
mov rcx, qword [rdi + rdx*8]
test rcx, rcx
jne 0x140125125
lea ecx, [r9 + 0x10]
call fcn.1400114a4
mov rcx, rax
mov qword [rbp + 0x40], rax
xor eax, eax
test rcx, rcx
je 0x140125144
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rdi + r15*8], rcx
shl r14, 0x20
mov eax, dword [rbp + 0x48]
or r14, rax
mov qword [rbp + 0x40], r14
lea rdx, [rbp + 0x40]
call fcn.1400113a8
test eax, eax
jne 0x140125080
xor ebx, ebx
cmp byte [0x1401fa4b8], 0
jne 0x14012515d
test rdi, rdi
je 0x14012515d
mov rcx, rdi
call qword [sym.imp.tbbmalloc.dll_scalable_free]
mov eax, ebx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [rsi + 0x28]
mov qword [rsi + 0x28], rdi
mov rdi, rax
mov dword [rsi + 0x30], r12d
mov eax, dword [rbp - 0x24]
mov dword [rsi + 0x34], eax
mov byte [r13], bl
jmp 0x140125146
Function at 0x14012a364
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov r13, r8
mov r12, rdx
mov r15, rcx
test r9, r9
je 0x14012a55f
mov rax, qword [r9 + 0x10]
test rax, rax
je 0x14012a55f
cmp qword [rax + 0xc0], 0
je 0x14012a55f
mov rcx, r9
call fcn.14002f438
test rax, rax
je 0x14012a55f
mov rax, qword [rax]
lea rcx, [fcn.140050e10]
xor edi, edi
mov qword [rbp - 0x30], rcx
and qword [rbp - 0x20], rdi
lea rcx, [fcn.140023310]
and dword [rbp - 0x18], edi
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x30]
call fcn.140050e10
test al, al
je 0x14012a55b
mov rdx, qword [rbp - 0x20]
mov eax, dword [rdx + 0x10]
test eax, 0x14000000
je 0x14012a3ea
mov rdx, qword [rdx]
bt eax, 0x1a
jae 0x14012a41c
mov rcx, r15
call fcn.1400131dc
jmp 0x14012a423
mov rax, qword [0x1401fc9e0]
mov esi, dword [rdx + 4]
add rsi, qword [rax]
mov r9, qword [rdx + 0x10]
mov qword [rbp + 0x48], r9
test r9, r9
je 0x14012a3ea
test dword [r9 + 4], 0x1000
je 0x14012a3ea
test byte [r9 + 4], 0xc0
je 0x14012a3ea
mov rbx, qword [0x1401f7eb0]
lea r8, [rbp + 0x48]
add rbx, qword [0x1401f7ec8]
lea rdx, [rbp - 0x40]
lea rcx, [0x1401f7eb0]
call fcn.1400b1e2c
mov rax, qword [rax]
cmp rax, rbx
jne 0x14012a4a7
mov r9, qword [rbp + 0x48]
lea r8, [rbp + 0x48]
lea rdx, [rbp - 0x50]
xor r14d, r14d
lea rcx, [0x1401f7eb0]
call fcn.1400b1f0c
cmp byte [rbp - 0x48], r14b
je 0x14012a4ad
mov rdx, qword [0x1401f7eb8]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rbp + 0x48]
mov qword [rdx + rcx*8], rax
jmp 0x14012a4ad
mov r14d, 1
cmp byte [rbp + 0x50], 0
je 0x14012a4c8
inc edi
test r14d, r14d
jne 0x14012a3ea
mov byte [rsp + 0x20], 1
xor r8d, r8d
jmp 0x14012a545
mov ecx, 0x1505
mov ebx, ecx
jmp 0x14012a4df
imul rbx, rbx, 0x21
movsx rax, al
add rbx, rax
inc rsi
mov al, byte [rsi]
test al, al
jne 0x14012a4d1
mov rcx, rbx
call fcn.14012a270
mov r8, rax
test rax, rax
je 0x14012a4fd
dec dword [0x1401fcd6c]
jmp 0x14012a50c
mov rdx, qword [rbp + 0x48]
mov rcx, rbx
call fcn.140129730
mov r8, rax
mov eax, dword [0x14020c04c]
inc edi
inc dword [0x14020c04c]
lea rcx, [rax + rax*2]
mov rax, qword [0x14020b870]
mov qword [rax + rcx*8], r13
mov qword [rax + rcx*8 + 8], r8
mov qword [rax + rcx*8 + 0x10], 1
test r14d, r14d
jne 0x14012a3ea
mov byte [rsp + 0x20], r14b
mov r9, qword [rbp + 0x48]
mov rdx, r12
mov rcx, r15
call fcn.14012a364
add edi, eax
jmp 0x14012a3ea
mov eax, edi
jmp 0x14012a561
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14012dd54
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov byte [rsp + 0x18], r8b
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r15b, byte [0x1401fa4e8]
mov rbx, rdx
lea rdx, str..NUL
mov rdi, rcx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor r12d, r12d
test eax, eax
jne 0x14012dd9a
mov eax, 1
jmp 0x14012df22
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x14012df13
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp eax, 0xffffffff
je 0x14012df13
xor r9d, r9d
mov qword [rsp + 0x28], r12
xor edx, edx
mov dword [rsp + 0x20], eax
mov rcx, r14
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rsi, rax
test rax, rax
je 0x14012df13
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
jne 0x14012de49
test rbx, rbx
je 0x14012de3b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14012df20
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x14012df13
mov qword [rsp + 0x88], r12
mov rsi, r12
test r15b, r15b
je 0x14012de8d
lea r9, [rsp + 0x80]
mov edx, ebp
lea r8, [rsp + 0x88]
mov rcx, rdi
call fcn.1400264e4
test eax, eax
je 0x14012deb9
jmp 0x14012df13
call fcn.1400546c0
test eax, eax
jne 0x14012dec1
lea r9, [rsp + 0x80]
mov edx, ebp
lea r8, [rsp + 0x88]
mov rcx, rdi
call fcn.1400264e4
test eax, eax
jne 0x14012deb9
call fcn.140005efc
mov rsi, qword [rsp + 0x88]
mov eax, dword [rsi]
or eax, 0xc0000000
cmp word [rdi], r12w
jne 0x14012dee5
mov ecx, 0xffff
cmp word [rdi + 2], cx
jne 0x14012dee5
cmp word [rdi + 4], r12w
je 0x14012dee8
mov dword [rdi + 8], eax
jmp 0x14012dee8
mov dword [rdi + 4], eax
mov edx, 1
mov rcx, rsi
call fcn.14005a620
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
je 0x14012df13
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14012dd90
test rbx, rbx
je 0x14012df20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x14012f91c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
cmp byte [0x1401fcad0], 0
mov rbx, rcx
je 0x14012f941
lea r8, str._INCREMENTAL
mov edx, 0x10cc
xor ecx, ecx
call fcn.1400ebbc8
cmp byte [0x1401fcad3], 0
jne 0x14012f953
test byte [rbx + 0x1c4], 0x40
je 0x14012f95f
mov edx, 0x17b9
xor ecx, ecx
call fcn.1400eb834
mov cl, 1
call fcn.140005b0c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14000510c
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140133c10
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x38
xor eax, eax
cmp byte [0x1401fac40], al
jne 0x140133c2d
cmp byte [0x1401fa4e1], al
jne 0x140133c32
mov byte [0x1401fac40], 1
add rsp, 0x38
ret
cmp byte [0x1401fcad3], al
jne 0x140133c43
test byte [rcx + 0x1c4], 0x40
je 0x140133c4f
mov edx, 0x17b5
xor ecx, ecx
call fcn.1400eb834
mov cl, 1
call fcn.140005b0c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 1
call fcn.14000510c
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140134bdc
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x260
mov rax, qword [0x1401f7030]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r15, r8
mov r12, rdx
mov rbx, rcx
xor r8d, r8d
xor edx, edx
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
xor r13d, r13d
test eax, eax
jne 0x140134c38
mov byte [rbx], r13b
or rbp, 0xffffffffffffffff
mov dword [rbx + 4], ebp
jmp 0x140134cf7
mov eax, 2
mul rdi
mov rbp, 0xffffffffffffffff
cmovo rax, rbp
mov rcx, rax
call qword [sym.imp.tbbmalloc.dll_scalable_malloc]
mov r14, rax
test rax, rax
jne 0x140134c69
mov edx, 0x44e
xor ecx, ecx
call fcn.14005e3e8
int3
mov qword [rsp + 0x30], r14
mov r8d, edi
mov rdx, r14
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rdi - 1]
cmp eax, ecx
jne 0x140134ce8
mov rcx, r14
mov rdi, r14
movzx esi, word [r14]
jmp 0x140134ca1
cmp si, 0x3b
je 0x140134ca6
add rdi, 2
movzx esi, word [rdi]
test si, si
jne 0x140134c94
mov word [rdi], r13w
mov qword [rsp + 0x28], r13
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x104
xor r8d, r8d
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_SearchPathW]
dec eax
cmp eax, 0x102
jbe 0x140134d25
add rdi, 2
mov rcx, rdi
test si, si
je 0x140134ce8
movzx esi, word [rdi]
test si, si
jne 0x140134c94
mov byte [rbx], r13b
mov dword [rbx + 4], ebp
mov rcx, r14
call qword [sym.imp.tbbmalloc.dll_scalable_free]
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14005a600
mov rbx, qword [rsp + 0x2b8]
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r8, r15
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.1400052dc
jmp 0x140134cee
Function at 0x140134d44
Capabilities:
Resolve path using msvcrt

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x590]
sub rsp, 0x690
mov rax, qword [0x1401f7030]
xor rax, rsp
mov qword [rbp + 0x580], rax
mov dil, byte [rbp + 0x5f0]
mov r14d, r9d
mov r12, r8
mov r15, rdx
mov rsi, rcx
test dil, dil
jne 0x140134e36
mov r8, rcx
mov ebx, 0x104
mov edx, ebx
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, str..exe
mov edx, ebx
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__get_wpgmptr]
test eax, eax
je 0x140134dcb
xor ecx, ecx
call fcn.14005e418
int3
and qword [rsp + 0x40], 0
lea r9, [rbp + 0x170]
and qword [rsp + 0x38], 0
lea rdx, [rsp + 0x58]
and qword [rsp + 0x30], 0
mov r8d, 3
and qword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x20], pe_nt_image_headers64
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath_s]
lea rax, str..exe
mov rdx, rbx
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x170]
lea r8, [rsp + 0x58]
mov qword [rsp + 0x20], rsi
lea rcx, [rbp + 0x370]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wmakepath_s]
cmp byte [0x1401fcad2], 0
je 0x140134e62
call fcn.14000775c
test dil, dil
lea rdx, [rsp + 0x60]
mov ecx, 0x2347
cmovne rdx, rsi
call fcn.14000761c
mov rcx, r15
call fcn.1401320c4
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
test dil, dil
lea rbx, [rbp + 0x370]
cmovne rbx, rsi
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__waccess]
test eax, eax
jne 0x140134e99
mov r8, r15
lea rcx, [rsp + 0x50]
mov rdx, rbx
call fcn.1400052dc
jmp 0x140134ec5
test dil, dil
je 0x140134eae
mov r8, rbx
mov edx, 0x486
xor ecx, ecx
call fcn.14005e3e8
int3
mov r8, r15
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.140134bdc
lea rbx, [rsp + 0x60]
cmp byte [rax], 0
mov ecx, dword [rax + 4]
jne 0x140134edd
mov r8, rbx
mov edx, 0x486
xor ecx, ecx
call fcn.14005e3e8
int3
test ecx, ecx
je 0x140134f09
mov rcx, r12
test r14d, r14d
jne 0x140134f00
test dil, dil
lea r8, [rsp + 0x60]
mov edx, 0x52f
cmovne r8, rsi
call fcn.14005e3e8
int3
mov edx, r14d
call fcn.14005e3e8
int3
mov rcx, qword [rbp + 0x580]
xor rcx, rsp
call fcn.14005a600
add rsp, 0x690
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1401357cc
Capabilities:
Enumerate files on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x14020ce38]
mov rbx, rcx
test rcx, rcx
je 0x140135849
test rax, rax
jne 0x14013580a
mov ecx, 0x458
call qword [sym.imp.tbbmalloc.dll_scalable_malloc]
test rax, rax
jne 0x140135803
mov edx, 0x44e
xor ecx, ecx
call fcn.14005e3e8
int3
mov qword [0x14020ce38], rax
mov rcx, qword [0x14020ce40]
test rcx, rcx
je 0x14013582b
call qword [sym.imp.KERNEL32.dll_FindClose]
and qword [0x14020ce40], 0
mov rax, qword [0x14020ce38]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [0x14020ce40], rax
mov rcx, rax
cmp rax, 0xffffffffffffffff
jne 0x140135864
jmp 0x14013587c
mov rcx, qword [0x14020ce40]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov rcx, qword [0x14020ce40]
test eax, eax
je 0x140135876
mov rax, qword [0x14020ce38]
test byte [rax], 0x10
jne 0x140135850
add rax, 0x2c
jmp 0x140135886
call qword [sym.imp.KERNEL32.dll_FindClose]
and qword [0x14020ce40], 0
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1401494d4
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x40
and qword [rcx], 0
lea r8, str.VCTIP_14.29.30148.0_CLIENT_MUTEX
mov rbx, rcx
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx], rax
test rax, rax
jne 0x140149529
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.CreateMutex
lea rcx, [rsp + 0x20]
call fcn.14014a7e8
lea rdx, [0x1401f2a40]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1401495a5
mov rcx, qword [rbx]
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1401495a5
cmp eax, 0x80
je 0x1401495a5
cmp eax, 0x102
je 0x140149582
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x1401d1010]
lea rcx, [rsp + 0x20]
call fcn.14014a7e8
lea rdx, [0x1401f2a40]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
lea rdx, str.WaitForSingleObject_timed_out
lea rcx, [rsp + 0x20]
call fcn.1400d5934
lea rdx, [0x1401f2a40]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
mov rax, rbx
add rsp, 0x40
pop rbx
ret
Function at 0x14014a03c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rdi
sub rsp, 0x40
and qword [r11 + 0x10], 0
lea rax, [r11 + 0x10]
mov r9d, 0x201
mov qword [r11 - 0x28], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftVSCommon15.0SQM_vctip14.29.30148.0
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14014a07a
xor eax, eax
jmp 0x14014a0e4
mov rbx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
and qword [rsp + 0x60], 0
lea r8, str.LastCrash
mov qword [rsp + 0x30], rax
mov r9d, 0x40
lea rax, [rsp + 0x60]
mov dword [rsp + 0x50], 8
mov qword [rsp + 0x28], rax
xor edx, edx
and qword [rsp + 0x20], 0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14014a0d1
cmp dword [rsp + 0x50], 8
jne 0x14014a0d1
mov rdi, qword [rsp + 0x60]
jmp 0x14014a0d3
xor edi, edi
test rbx, rbx
je 0x14014a0e1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x14014a0f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x130
mov rax, qword [0x1401f7030]
xor rax, rsp
mov qword [rsp + 0x120], rax
and qword [rsp + 0x48], 0
lea rax, [rsp + 0x48]
mov r9d, 0x201
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftNET_Framework_SetupNDP_v4Client
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14014a144
xor al, al
jmp 0x14014a1bc
mov rbx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r8, str.Version
lea rax, [rsp + 0x50]
mov edi, 0xc8
mov qword [rsp + 0x28], rax
mov r9d, 2
and qword [rsp + 0x20], 0
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x40], edi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14014a1a8
cmp dword [rsp + 0x40], edi
ja 0x14014a1a8
lea rdx, [0x1401d11b0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
setns dil
jmp 0x14014a1ab
xor dil, dil
test rbx, rbx
je 0x14014a1b9
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, dil
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.14005a600
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rdi
ret
Function at 0x14014a200
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x70
and qword [r11 + 8], 0
and qword [r11 - 0x38], 0
lea rax, [r11 + 8]
mov qword [r11 - 0x40], rax
and qword [r11 - 0x48], 0
mov dword [rsp + 0x28], 0x20206
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftVSCommon15.0SQM_vctip14.29.30148.0
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14014a273
mov r8d, eax
lea rdx, str.RegCreateKeyEx
lea rcx, [rsp + 0x50]
call fcn.14014a7e8
lea rdx, [0x1401f2a40]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
mov rbx, qword [rsp + 0x80]
mov qword [rsp + 0x90], rbx
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x28], 8
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0xb
xor r8d, r8d
lea rdx, str.LastCrash
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14014a2ee
mov r8d, eax
lea rdx, str.RegSetValueEx
lea rcx, [rsp + 0x50]
call fcn.14014a7e8
lea rdx, [0x1401f2a40]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
test rbx, rbx
je 0x14014a2fc
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x70
pop rbx
ret
Function at 0x140152f24
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
call fcn.140153238
mov ebx, eax
test eax, eax
js 0x140152fdc
and word [rsp + 0x20], 0
mov rax, qword [0x1401fd228]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x20]
call fcn.1401566b0
mov ebx, eax
test eax, eax
js 0x140152fd2
mov rcx, qword [0x1401fccf8]
call fcn.1401575ec
test rax, rax
jne 0x140152f7a
mov ebx, 0x8007000e
jmp 0x140152fd2
mov qword [rax], rdi
test byte [rdi + 0xc8], 0x10
je 0x140152fd2
mov rax, qword [rdi + 0x70]
mov rcx, qword [rax + 0x1a50]
lea rax, [0x1401a3214]
test rcx, rcx
cmovne rax, rcx
mov ecx, 0x1505
jmp 0x140152faf
imul ecx, ecx, 0x21
xor ecx, edx
lea rax, [rax + 2]
movzx edx, word [rax]
test edx, edx
jne 0x140152fa6
mov eax, 0xae4c415d
mul ecx
shr edx, 5
imul eax, edx, 0x2f
sub ecx, eax
mov eax, ecx
lea rcx, [0x1401fd0b0]
mov qword [rcx + rax*8], rdi
lea rcx, [rsp + 0x20]
call fcn.140155b3c
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret