joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003d20
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x98
movabs rax, 0x6c6320726f727245
movabs rdx, 0x7520676e696e6165
mov qword [rsp + 0x20], rax
movabs rax, 0x6b5f6e6970732070
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20726f6620737965
mov qword [rsp + 0x30], rax
movabs rax, 0x20646165726874
mov qword [rsp + 0x38], rdx
xor edx, edx
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov word [rsp + 0x88], ax
mov byte [rsp + 0x8a], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x47]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x140003e32
mov eax, 0x28
lea rcx, [rsp + 0x20]
jmp 0x140003e0a
add rax, 1
cmp rax, 0x6b
je 0x140003e27
cmp byte [rcx + rax], 0
movsxd rdx, eax
jne 0x140003e00
cmp edx, 0x6a
je 0x140003e27
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rdx + 0x20], 0xa
mov byte [rsp + rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov eax, 0x28
mov edx, 0x27
lea rcx, [rsp + 0x20]
jmp 0x140003e1b
Function at 0x140004840
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, qword [0x14001aea0]
mov rax, qword [rsi]
test rax, rax
je 0x140004a30
cmp qword [rax + 0x28], 0
jne 0x140004a18
lea rcx, [0x14001e1d8]
cmp dword [rcx], 1
mov qword [rax + 0x28], rcx
je 0x140004a25
call fcn.140003e50
mov rax, qword [rsi]
test rax, rax
je 0x1400048c0
cmp qword [rax + 0x30], 0
jne 0x1400048e0
lea rdx, [0x140019078]
mov qword [rax + 0x30], rdx
mov rax, rdx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x1400048f4
mov rax, r12
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call fcn.140008b60
cmp qword [rax + 0x30], 0
mov rax, qword [rsi]
je 0x140004890
test rax, rax
jne 0x1400048e0
call fcn.140008b60
nop dword [rax]
mov rax, qword [rax + 0x30]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
jne 0x1400048ae
call fcn.140003990
cmp qword [0x140021050], 0
mov rbx, rax
je 0x1400048ae
test rax, rax
je 0x1400048ae
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rbx + 0x70], eax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x38], 0xffffffffffffffff
lea rcx, [rbx + 0x68]
mov qword [rbx + 0x30], rax
call fcn.14000aa00
cmp eax, 1
je 0x140004a9d
mov rbp, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x68], 0xffffffffffffffff
mov dword [rbx + 0xb8], 0
mov qword [rbx + 0x28], 0
call rbp
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r12, rax
call rbp
mov dword [rsp + 0x30], 2
mov r8, rdi
mov rdx, r12
mov dword [rsp + 0x28], 0
mov rcx, rax
lea r9, [rbx + 0x28]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x140018f06
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0xc0], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
mov rax, qword [rsi]
test rax, rax
je 0x140004a78
cmp qword [rax + 0x30], 0
je 0x140004a60
mov rax, qword [rax + 0x30]
mov ecx, dword [rax]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140018f06
mov r12, rbx
mov rax, r12
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rax + 0x28]
cmp dword [rcx], 1
jne 0x14000487c
mov rax, qword [rsi]
jmp 0x140004889
call fcn.140008b60
cmp qword [rax + 0x28], 0
mov rax, qword [rsi]
je 0x140004868
test rax, rax
jne 0x140004a18
call fcn.140008b60
mov rcx, qword [rax + 0x28]
cmp dword [rcx], 1
jne 0x14000487c
jmp 0x140004881
lea rdx, [0x140019078]
mov qword [rax + 0x30], rdx
mov rax, rdx
jmp 0x1400049ee
call fcn.140008b60
mov r8, rax
mov rax, qword [rsi]
cmp qword [r8 + 0x30], 0
je 0x140004a60
test rax, rax
jne 0x1400049ea
call fcn.140008b60
jmp 0x1400049ea
call fcn.140003d20
nop word cs:[rax + rax]
nop dword [rax]
mov rax, qword [0x14001aea0]
mov rdx, qword [rax]
lea rax, [0x14001e1e8]
mov qword [rdx + 0x10], rax
ret
Function at 0x1400089e0
Capabilities:
Print debug messages

Disassembly:
push r12
push rbx
sub rsp, 0x58
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140008a00
add rsp, 0x58
pop rbx
pop r12
ret
lea rdx, [rsp + 0x48]
mov r9d, 0x400
mov r8d, eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdx
mov ecx, 0x1100
xor edx, edx
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x140008a48
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400089f4
int3
mov rcx, qword [rsp + 0x48]
mov rbx, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rbx
mov rcx, r12
call rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140008a35
Function at 0x140008b60
Capabilities:
Check mutex on windows

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [0x14001e2c0]
mov dword [rsp + 0x2c], eax
lea rcx, [rsp + 0x2c]
lea r9, [rsp + 0x30]
movzx eax, byte [rcx]
add rcx, 1
add rdx, 2
mov r8d, eax
and eax, 0xf
shr r8b, 4
add eax, 0x61
add r8d, 0x41
mov byte [rdx - 1], al
mov byte [rdx - 2], r8b
cmp rcx, r9
jne 0x140008b83
lea rax, [0x14001e2c8]
mov ecx, 0x5f
lea rdx, str.__shmem3_winpthreads_tdm_
lea r8, [rax + 0x1a]
jmp 0x140008bcb
movzx ecx, byte [rdx]
add rax, 1
add rdx, 1
mov byte [rax - 1], cl
cmp rax, r8
jne 0x140008bc8
lea rax, [0x14001e300]
mov ecx, 0x5f
lea rdx, str.__shmem3_winpthreads_tdm_
lea r8, [rax + 0x19]
jmp 0x140008bfb
movzx ecx, byte [rdx]
add rax, 1
add rdx, 1
mov byte [rax - 1], cl
cmp rax, r8
jne 0x140008bf8
xor ecx, ecx
mov byte [0x14001e319], 0x2d
movabs rax, 0x6161616161616161
movabs rdx, 0x6161616161616161
mov qword [0x14001e322], rdx
lea r8, [0x14001e2c0]
lea rbx, [0x14001e31a]
mov qword [0x14001e332], rdx
mov qword [0x14001e342], rdx
mov qword [0x14001e352], rdx
xor edx, edx
mov qword [0x14001e31a], rax
mov qword [0x14001e32a], rax
mov qword [0x14001e33a], rax
mov qword [0x14001e34a], rax
mov byte [0x14001e35a], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, 0xffffffff
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140008dd6
lea rcx, [0x14001e300]
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x140008d21
lea rsi, [0x14001e200]
lea r8, [0x14001e35a]
mov rax, rbx
lea ecx, [rbx + 0x40]
nop dword [rax]
mov edx, ecx
sub edx, eax
bt rsi, rdx
jae 0x140008ccd
mov byte [rax], 0x41
add rax, 1
cmp r8, rax
jne 0x140008cc0
lea rcx, [0x14001e300]
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
je 0x140008dc3
lea rcx, [0x140008a70]
mov qword [0x14001e200], rsi
call sub.msvcrt.dll__onexit
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x14001e200]
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
mov r8d, 0x5b
lea rdx, [0x14001e300]
movzx ecx, ax
call qword [sym.imp.KERNEL32.dll_GetAtomNameA]
lea r8, [0x14001e35a]
xor edx, edx
lea r10d, [rbx + 0x40]
mov r11d, eax
mov r9d, 1
mov rax, rbx
test r11d, r11d
je 0x140008df6
nop dword [rax]
cmp byte [rax], 0x41
jne 0x140008d73
mov ecx, r10d
mov rbx, r9
sub ecx, eax
shl rbx, cl
or rdx, rbx
add rax, 1
cmp r8, rax
jne 0x140008d60
mov rax, rdx
mov qword [0x14001e200], rax
lea rsi, [0x14001e200]
jmp 0x140008d99
cmp rdx, rsi
je 0x140008cff
mov rdx, rax
mov rax, qword [rax + 8]
test rax, rax
jne 0x140008d90
cmp rdx, rsi
je 0x140008cff
mov qword [rdx + 8], rsi
lea rcx, [0x140008a70]
call sub.msvcrt.dll__onexit
jmp 0x140008cff
lea rcx, str.failed_to_add_string_to_atom_table_n
call fcn.1400089e0
xor eax, eax
jmp 0x140008d18
lea rcx, str.failed_to_to_lock_creation_mutex_n
call fcn.1400089e0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
lea rcx, str.failed_to_get_string_from_atom_n
call fcn.1400089e0
xor eax, eax
jmp 0x140008d7f
Function at 0x140010ad0
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x1a0
mov rax, qword [0x140050010]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rax, qword [0x140108af0]
lea rcx, [rsp + 0x70]
mov dword [rax + 0x12ca374], 0
call fcn.14002a04c
lea rcx, [rsp + 0x70]
call fcn.14002a3b8
mov r8, qword [0x140108af0]
mov rbx, rax
movups xmm0, xmmword [rax]
cmp dword [r8 + 0x12ca35c], 0
movups xmmword [r8 + 0x41746d0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r8 + 0x41746e0], xmm1
mov ecx, dword [rax + 0x20]
mov dword [r8 + 0x41746f0], ecx
jne 0x140010b53
cmp dword [r8 + 0x12ca370], 0
je 0x140010cf9
add r8, 0xbb0be0
lea rdx, str._sLogFile
lea rcx, [rsp + 0x90]
call fcn.140001190
lea rcx, [rsp + 0x90]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
cmp eax, 1
je 0x140010b91
xor edx, edx
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rax, qword [0x140108af0]
cmp dword [rax + 0x12ca39c], 0
jne 0x140010c01
cmp dword [rax + 0x12ca360], 2
jne 0x140010c01
mov edx, dword [rbx + 0x10]
lea rcx, [rax + 0xbb0ce0]
mov eax, dword [rbx]
lea r8, [rsp + 0x90]
mov r9d, dword [rbx + 0x14]
inc edx
mov dword [rsp + 0x48], 0x2e
add r9d, 0x76c
mov dword [rsp + 0x40], eax
mov eax, dword [rbx + 4]
mov dword [rsp + 0x38], eax
mov eax, dword [rbx + 8]
mov dword [rsp + 0x30], eax
mov eax, dword [rbx + 0xc]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edx
lea rdx, str._slog__04d__02d_02d__02d_02d_02d_RAW_cbin
call fcn.140001190
jmp 0x140010ca6
cmp dword [rax + 0x41746f8], 1
lea rcx, [0x140047c50]
lea rdx, [0x140047c4c]
cmovne rdx, rcx
lea rcx, [rsp + 0x78]
call fcn.140001190
mov rax, qword [0x140108af0]
lea r10, [rsp + 0x78]
mov r8d, dword [rbx + 0x10]
mov r9d, dword [rbx + 0x14]
inc r8d
mov dword [rsp + 0x60], 0x2e
add r9d, 0x76c
movsd xmm0, qword [rax + 0x18]
lea rcx, [rax + 0xbb0ce0]
mov eax, dword [rax + 0x5c]
mulsd xmm0, qword [0x1400494b8]
mov qword [rsp + 0x58], r10
mov dword [rsp + 0x50], eax
mov eax, dword [rbx]
cvttsd2si edx, xmm0
mov dword [rsp + 0x48], edx
lea rdx, str._slog__04d__02d_02d__02d_02d_02d_R_05d_Th_02d__s_ccsv
mov dword [rsp + 0x40], eax
mov eax, dword [rbx + 4]
mov dword [rsp + 0x38], eax
mov eax, dword [rbx + 8]
mov dword [rsp + 0x30], eax
mov eax, dword [rbx + 0xc]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r8d
lea r8, [rsp + 0x90]
call fcn.140001190
mov rax, qword [0x140108af0]
xorps xmm0, xmm0
mov dword [rax + 0x41746cc], 1
movups xmmword [rax + 0xbb0b50], xmm0
movups xmmword [rax + 0xbb0b60], xmm0
movups xmmword [rax + 0xbb0b70], xmm0
movups xmmword [rax + 0xbb0b80], xmm0
movups xmmword [rax + 0xbb0b90], xmm0
movups xmmword [rax + 0xbb0ba0], xmm0
movups xmmword [rax + 0xbb0bb0], xmm0
movups xmmword [rax + 0xbb0bc0], xmm0
movups xmmword [rax + 0xbb0bd0], xmm0
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14001d8d0
add rsp, 0x1a0
pop rbx
ret
Function at 0x1400149c0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x48
mov rax, qword [0x140050010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r8, qword [0x140108af0]
cmp dword [r8 + 0x41747ec], 0
je 0x140014a84
lea rcx, [r8 + 0x12c92e0]
mov dword [rsp + 0x20], 0xa
mov r8d, dword [r8 + 0x41747e8]
lea rdx, str.AVERAGE__d_c_c
mov r9d, InitCommonControls
call fcn.140001190
mov rdx, qword [0x140108af0]
cmp dword [rdx + 0x12ca2f8], 1
jne 0x140014a74
mov qword [rsp + 0x40], rbx
mov rbx, qword [rdx + 0x4174770]
cmp dword [rbx + 8], 1
je 0x140014a6f
add rdx, 0x12c92e0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140014a40
mov rcx, qword [rbx + 0xe00028]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rbx + 0xe00020], 0
mov rbx, qword [rsp + 0x40]
call fcn.140014790
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14001d8d0
add rsp, 0x48
ret
Function at 0x1400162f0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x140108af0]
lea rdx, [0x140047d80]
add rcx, 0xbb0ee0
call fcn.140029200
mov rbx, rax
test rax, rax
jne 0x14001631e
add rsp, 0x20
pop rbx
ret
mov rcx, qword [0x140108af0]
mov edx, 0x80
add rcx, 0xbb12e0
mov qword [rsp + 0x30], rdi
mov r9, rbx
lea r8d, [rdx - 0x7f]
call fcn.14002a660
mov rcx, qword [0x140108af0]
xor edi, edi
add rcx, 0xbb12e0
mov r9, rbx
lea edx, [rdi + 0x20]
lea r8d, [rdi + 1]
call fcn.14002a660
cmp eax, 1
jl 0x1400163dd
mov r8, qword [0x140108af0]
mov r9, rbx
movzx ecx, byte [r8 + 0xbb12e8]
movzx eax, byte [r8 + 0xbb12e9]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 0xbb12ea]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 0xbb12eb]
shl ecx, 8
or ecx, eax
sub ecx, 0x20
movsxd rdx, ecx
lea rcx, [r8 + 0xbb1300]
mov r8d, 1
call fcn.14002a660
mov rcx, qword [0x140108af0]
mov edx, 0x20
add rcx, 0xbb12e0
mov r9, rbx
inc edi
lea r8d, [rdx - 0x1f]
call fcn.14002a660
cmp eax, 1
jge 0x140016366
mov rcx, rbx
call fcn.140029718
mov rcx, rbx
call fcn.140029718
mov eax, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
Function at 0x140016a60
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rcx, qword [0x140108af0]
lea rdx, [0x140047d80]
add rcx, 0xbb0ee0
call fcn.140029200
mov rdi, rax
test rax, rax
jne 0x140016ab4
mov rax, qword [0x140108af0]
xor esi, esi
mov dword [rax + 0x417477c], esi
mov dword [rax + 0x12ca370], esi
lea eax, [rdi - 1]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [0x140108af0]
mov edx, 0x80
mov qword [rsp + 0x38], rbx
add rcx, 0xbb12e0
mov r9, rdi
mov qword [rsp + 0x40], rbp
lea r8d, [rdx - 0x7f]
call fcn.14002a660
mov rcx, qword [0x140108af0]
xor esi, esi
mov ebp, esi
mov eax, dword [rcx + 0x12ca374]
inc eax
test eax, eax
jle 0x140016c1b
nop dword [rax + rax]
mov edx, 0x20
add rcx, 0xbb12e0
mov r9, rdi
lea r8d, [rdx - 0x1f]
call fcn.14002a660
cmp eax, 1
jl 0x140016bc6
mov rcx, qword [0x140108af0]
mov r9, rdi
mov r8d, 1
movzx eax, byte [rcx + 0xbb12e9]
movzx ebx, byte [rcx + 0xbb12e8]
shl ebx, 8
or ebx, eax
movzx eax, byte [rcx + 0xbb12ea]
shl ebx, 8
or ebx, eax
movzx eax, byte [rcx + 0xbb12eb]
shl ebx, 8
or ebx, eax
movzx eax, byte [rcx + 0xbb12fc]
mov byte [rsp + 0x30], al
movzx eax, byte [rcx + 0xbb12fd]
mov byte [rsp + 0x31], al
movzx eax, byte [rcx + 0xbb12fe]
mov byte [rsp + 0x32], al
movzx eax, byte [rcx + 0xbb12ff]
mov byte [rsp + 0x33], al
lea eax, [rbx - 0x20]
movss xmm0, dword [rsp + 0x30]
cvtps2pd xmm0, xmm0
movsxd rdx, eax
movsd qword [rcx + 0x12ca3d8], xmm0
add rcx, 0xbb1300
call fcn.14002a660
mov rcx, qword [0x140108af0]
inc ebp
mov eax, dword [rcx + 0x12ca374]
inc eax
cmp ebp, eax
jl 0x140016b00
jmp 0x140016c1f
mov rcx, rdi
call fcn.140029718
mov rax, qword [0x140108af0]
mov dword [rax + 0x417477c], esi
cmp dword [rax + 0x12ca370], esi
jle 0x140016bed
mov dword [rax + 0x12ca670], 5
mov dword [rax + 0x12ca370], esi
or dword [rax + 0xbb0b44], 0x1000
or dword [rax + 0xbb0b48], 0x40000
mov dword [rax + 0x41746b8], esi
or dword [rax + 0xbb0b44], 0x40
mov eax, 0xffffffff
jmp 0x140016c5b
mov ebx, dword [rsp + 0x30]
mov rcx, rdi
call fcn.140029718
mov rdi, qword [0x140108af0]
add ebx, 0xffffffe0
movsxd r8, ebx
lea rdx, [rdi + 0xbb1300]
lea rcx, [rdi + 0xa0]
call fcn.1400212e0
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
mov dword [rdi + 0x12ca2e0], eax
call fcn.140016c70
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140017140
Capabilities:
Create thread

Disassembly:
push rbx
push rdi
sub rsp, 0x78
mov rax, qword [0x140050010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [rcx + 0xe00028]
mov edi, r8d
dec rax
mov r10, rdx
mov rbx, rcx
cmp rax, 0xfffffffffffffffd
ja 0x140017176
mov eax, 1
jmp 0x1400171c1
mov qword [rsp + 0x70], rsi
xor r9d, r9d
xor esi, esi
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov rcx, r10
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbx + 0xe00028], rax
cmp rax, 0xffffffffffffffff
jne 0x1400171d5
mov dword [rbx + 8], 1
xor eax, eax
mov rsi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14001d8d0
add rsp, 0x78
pop rdi
pop rbx
ret
mov edx, 0x100000
mov dword [rbx + 8], esi
mov r8d, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetupComm]
test eax, eax
je 0x1400171ba
mov rcx, qword [rbx + 0xe00028]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetCommState]
mov eax, dword [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov rcx, qword [rbx + 0xe00028]
and eax, 0xffff8001
or eax, 1
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x48], eax
mov word [rsp + 0x52], 8
mov byte [rsp + 0x54], sil
call qword [sym.imp.KERNEL32.dll_SetCommState]
test eax, eax
je 0x1400171ba
mov qword [rsp + 0x28], rsi
lea r8, [0x140017270]
mov r9, rbx
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call fcn.140029064
mov qword [rbx + 0xe00030], rax
mov eax, 1
jmp 0x1400171bc
Function at 0x1400191e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0xd0
mov rax, qword [0x140050010]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edi, edi
mov ecx, 0x440
mov r14d, edi
call fcn.14001d8f8
mov ecx, 0x400
mov rbp, rax
call fcn.14001d8f8
xor edx, edx
mov r8d, 0x440
mov rcx, rbp
mov rbx, rax
call fcn.14001f1a0
xor edx, edx
mov r8d, 0x400
mov rcx, rbx
call fcn.14001f1a0
mov esi, edi
mov r12, rbp
nop word [rax + rax]
xorps xmm0, xmm0
lea rcx, [0x14003e6a0]
mov r9d, 2
xor r8d, r8d
xor edx, edx
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
lea r8, [rsp + 0x48]
mov dword [rsp + 0x48], 0x20
mov rcx, rax
mov edx, r14d
mov r15, rax
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x140019399
xor r9d, r9d
mov dword [rsp + 0x28], 1
xorps xmm0, xmm0
mov dword [rsp + 0x44], edi
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x40], InitCommonControls
mov rcx, r15
mov dword [rsp + 0x20], 1
lea r8d, [r9 + 1]
movups xmmword [rsp + 0x68], xmm0
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0x44]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
lea rdx, str.PortName
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea rcx, [rsp + 0x6b]
call fcn.14002589c
mov dword [r12], eax
lea rdx, [rsp + 0x48]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x40
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, r15
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
lea rcx, [rsp + 0x80]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], dil
jne 0x140019360
movsxd r8, eax
lea rdx, [rsp + 0x80]
movsxd rax, esi
imul rcx, rax, 0x44
add rcx, 4
add rcx, rbp
call fcn.1400212e0
inc r14d
inc esi
add r12, 0x44
cmp esi, 0x10
jl 0x140019260
test r14d, r14d
jle 0x14001940a
movsxd rdx, r14d
lea r9, [0x1400191b0]
mov r8d, 0x44
mov rcx, rbp
call fcn.140024730
mov rsi, rbp
nop dword [rax]
test edi, edi
jne 0x1400193cc
mov rcx, rbx
mov r9, rbp
jmp 0x1400193ec
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], 0
jne 0x1400193d3
movsxd rcx, eax
movsxd rax, edi
add rcx, rbx
imul r9, rax, 0x44
add r9, rbp
mov r8d, dword [rsi]
lea rdx, str.COM_d_:__s_n
add r9, 4
call fcn.140001190
inc edi
add rsi, 0x44
cmp edi, r14d
jl 0x1400193c0
mov r9d, 0x40
lea r8, str.Available_COMM_port
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rbx
call fcn.14001d8f0
mov rcx, rbp
call fcn.14001d8f0
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14001d8d0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14001e424
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001e46e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001e46e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001e46e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001e46e
cmp dword [rcx + 0x84], 0xe
jbe 0x14001e46e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001e470
xor al, al
add rsp, 0x28
ret

Function at 0x14002abc0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14002a9b0
Function at 0x140031134
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.14003b0b0
sub rsp, rax
mov rax, qword [0x140050010]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14002e4a0
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x140031183
mov rax, rbp
jmp 0x14003128b
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x1082c0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.140030d78
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x1082c0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x140031287
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140031287
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.140030d78
test rax, rax
js 0x140031287
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x140031287
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x140031279
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x140031279
cmp byte [rcx], 0xd
jne 0x14003125f
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x14003126e
cmp byte [rcx + 1], 0xa
jne 0x14003126e
inc rcx
jmp 0x14003126e
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x50500]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x140031241
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x14003128b
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14001d8d0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400313f8
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x1400313d5
call fcn.14002c454
mov dword [rax], 0x16
call fcn.14002c318
or eax, 0xffffffff
jmp 0x1400313f2
sub dword [rcx + 0x10], 1
jns 0x1400313e4
add rsp, 0x28
jmp fcn.140033064
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x1400313b4