joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140147af0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push r12
push r13
sub rsp, 0x30
xor ebx, ebx
test r8, r8
mov rbp, r9
mov rsi, r8
mov r12d, edx
mov r13, rcx
jne 0x140147b3c
call fcn.1401490c0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
mov dword [rax], 0x16
call fcn.140147cf0
xor eax, eax
jmp 0x140147be2
mov qword [rsp + 0x50], rdi
call fcn.1400152e0
mov edx, 0x2d8
mov ecx, 1
call fcn.14014bea0
test rax, rax
mov rdi, rax
je 0x140147bc8
call fcn.14014b790
mov rcx, rdi
mov rdx, qword [rax + 0xc0]
call fcn.14014b570
mov rcx, qword [rsp + 0x78]
mov eax, dword [rsp + 0x70]
test rcx, rcx
lea r8, [rsp + 0x60]
mov rdx, r12
cmovne r8, rcx
mov r9, rdi
mov rcx, r13
mov qword [rsp + 0x28], r8
lea r8, [0x140147a50]
mov qword [rdi + 0x90], rsi
mov qword [rdi + 0x98], rbp
mov qword [rdi + 8], 0xffffffffffffffff
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x140147bdd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call fcn.1401465e0
test ebx, ebx
je 0x140147bdb
mov ecx, ebx
call fcn.140149120
xor eax, eax
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop r12
pop rsi
ret

Function at 0x140147cf0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x5b0
mov rbp, rcx
mov rcx, qword [0x1402057f8]
mov ebx, r9d
mov rdi, r8
mov rsi, rdx
call fcn.14014b470
test rax, rax
je 0x140147d44
mov r10, qword [rsp + 0x5e0]
mov r9d, ebx
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], r10
call rax
jmp 0x140147dd9
mov ecx, 2
call fcn.140154650
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x98
call fcn.1401489d0
mov rax, qword [rsp + 0x5b8]
mov dword [rsp + 0x40], 0xc000000d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x140147dc5
test ebx, ebx
jne 0x140147dc5
lea ecx, [rax + 2]
call fcn.140154650
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc000000d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14014a0a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
sub rsp, 0x30
lea r12, reloc.OLEAUT32.dll_SysReAllocString
xor esi, esi
mov edi, ecx
mov rax, r12
mov ebx, esi
nop
cmp ecx, dword [rax]
je 0x14014a0de
add ebx, 1
add rax, 0x10
cmp ebx, 0x17
jb 0x14014a0c0
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
cmp ebx, 0x17
jae 0x14014a2c5
mov ecx, 3
call fcn.140159a60
cmp eax, 1
je 0x14014a27c
mov ecx, 3
call fcn.140159a60
test eax, eax
jne 0x14014a115
cmp dword [reloc.OLEAUT32.dll_SysReAllocString], 1
je 0x14014a27c
cmp edi, 0xfc
je 0x14014a2c5
mov qword [rsp + 0x50], rbp
lea rbp, [0x140205870]
lea r8, str.Runtime_Error__n_nProgram:
mov rcx, rbp
mov edx, 0x314
call fcn.140147580
test eax, eax
je 0x14014a159
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140147c10
lea rdx, [0x140205889]
mov r8d, 0x104
xor ecx, ecx
mov byte [0x14020598d], sil
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x14014a1a9
lea r8, str._program_name_unknown_
lea rcx, [0x140205889]
mov edx, 0x2fb
call fcn.140147580
test eax, eax
je 0x14014a1a9
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140147c10
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x140205889]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 0x3c
jbe 0x14014a1f8
lea rcx, [rcx + rbp - 0x23]
lea rdx, [0x140205b84]
lea r9d, [rax + 3]
lea r8, [0x14017d0a4]
sub rdx, rcx
call fcn.140159940
test eax, eax
je 0x14014a1f8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140147c10
lea r8, [0x14017d0a0]
mov edx, 0x314
mov rcx, rbp
call fcn.140159880
test eax, eax
je 0x14014a224
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140147c10
movsxd r8, ebx
mov edx, 0x314
mov rcx, rbp
add r8, r8
mov r8, qword [r12 + r8*8 + 8]
call fcn.140159880
test eax, eax
je 0x14014a254
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140147c10
lea rdx, str.Microsoft_Visual_C_Runtime_Library
mov r8d, 0x12010
mov rcx, rbp
call fcn.140159620
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x14014a2c5
cmp rax, 0xffffffffffffffff
je 0x14014a2c5
xor eax, eax
movsxd rcx, ebx
lea r9, [rsp + 0x58]
add rcx, rcx
mov qword [rsp + 0x20], rsi
mov rdx, qword [r12 + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x14014abe0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov eax, dword [0x140205d9c]
xor r12d, r12d
test eax, eax
mov ebp, r12d
jne 0x14014ac3c
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x14014ac1c
mov dword [0x140205d9c], 1
jmp 0x14014ac4f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x14014ac36
mov dword [0x140205d9c], 2
jmp 0x14014acb9
mov eax, dword [0x140205d9c]
cmp eax, 1
jne 0x14014acb0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x14014ac8a
cmp word [rdi], bp
mov rax, rdi
je 0x14014ac69
add rax, 2
cmp word [rax], bp
jne 0x14014ac57
add rax, 2
cmp word [rax], bp
jne 0x14014ac57
sub eax, edi
add eax, 2
movsxd rsi, eax
mov rcx, rsi
call fcn.14014be30
test rax, rax
mov rbx, rax
jne 0x14014ac91
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x14014adab
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call fcn.140148c90
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbx
jmp 0x14014adab
cmp eax, 2
je 0x14014acb9
test eax, eax
jne 0x14014ac8a
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
test rax, rax
mov rsi, rax
je 0x14014ac8a
cmp byte [rax], bpl
mov rbx, rax
je 0x14014ad08
nop
or r9d, 0xffffffff
mov r8, rbx
xor ecx, ecx
lea edx, [r9 + 2]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x14014ac8a
or rcx, 0xffffffffffffffff
add ebp, eax
mov rdi, rbx
xor eax, eax
repne scasb al, byte [rdi]
not rcx
add rbx, rcx
cmp byte [rbx], al
jne 0x14014acd0
add ebp, 1
mov edx, 2
movsxd rcx, ebp
call fcn.14014bea0
test rax, rax
mov r12, rax
jne 0x14014ad2d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
jmp 0x14014adab
cmp byte [rsi], 0
mov qword [rsp + 0x50], r13
mov rbx, rax
mov r13, rsi
je 0x14014ad95
nop
or r9d, 0xffffffff
mov eax, ebp
mov rcx, rbx
sub rcx, r12
lea edx, [r9 + 2]
mov r8, r13
sar rcx, 1
sub eax, ecx
xor ecx, ecx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x14014adbe
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r13
repne scasb al, byte [rdi]
mov rdi, rbx
not rcx
add r13, rcx
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
cmp byte [r13], al
not rcx
lea rbx, [rbx + rcx*2]
jne 0x14014ad40
mov rcx, rsi
mov word [rbx], 0
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov rax, r12
mov r13, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov rcx, r12
call fcn.1401465e0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
jmp 0x14014ada6
Function at 0x14014bce7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1401ea158]
jne 0x1401447ca
rol rcx, 0x10
test cx, 0xffff
jne 0x1401447c6
repz ret
ror rcx, 0x10
jmp 0x14014bc40
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140205e50]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140205f48]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14014bcc5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140205e50]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14014bce7
mov rax, qword [rsp + 0x88]
mov qword [0x140205f48], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140205ee8], rax
mov rax, qword [0x140205f48]
mov qword [0x140205dc0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140205ed0], rax
mov dword [0x140205db0], 0xc0000409
mov dword [0x140205db4], 1
mov rax, qword [0x1401ea158]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1401ea160]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140205e48], eax
mov ecx, 1
call fcn.140154650
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14017d118]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140205e48], 0
jne 0x14014bd6e
mov ecx, 1
call fcn.140154650
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140159620
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x50
mov edi, r8d
mov r13, rdx
mov r14, rcx
call fcn.14014b380
xor ebx, ebx
cmp qword [0x1402066e8], rbx
mov rbp, rax
mov dword [rsp + 0x98], ebx
mov dword [rsp + 0x30], ebx
jne 0x14015974c
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rsi, rax
je 0x14015985f
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14015985f
mov rcx, rax
call fcn.14014b2b0
lea rdx, [0x14017d558]
mov rcx, rsi
mov qword [0x1402066e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.14014b2b0
lea rdx, [0x14017d540]
mov rcx, rsi
mov qword [0x1402066f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.14014b2b0
lea rcx, [rsp + 0x98]
mov qword [0x1402066f8], rax
call fcn.140149370
test eax, eax
je 0x1401596ff
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.140147c10
cmp dword [rsp + 0x98], 2
jne 0x14015974c
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.14014b2b0
test rax, rax
mov qword [0x140206708], rax
je 0x14015974c
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.14014b2b0
mov qword [0x140206700], rax
mov rcx, qword [0x140206700]
mov qword [rsp + 0x80], r12
cmp rcx, rbp
je 0x1401597f8
cmp qword [0x140206708], rbp
je 0x1401597f8
call fcn.14014b470
mov rcx, qword [0x140206708]
mov rsi, rax
call fcn.14014b470
test rsi, rsi
mov r12, rax
je 0x1401597f8
test rax, rax
je 0x1401597f8
call rsi
test rax, rax
je 0x1401597c3
lea rcx, [rsp + 0x34]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1401597c3
test byte [rsp + 0x40], 1
jne 0x1401597f8
lea rcx, [rsp + 0x30]
call fcn.1401493c0
test eax, eax
je 0x1401597e5
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.140147c10
cmp dword [rsp + 0x30], 4
jb 0x1401597f2
bts edi, 0x15
jmp 0x140159836
bts edi, 0x12
jmp 0x140159836
mov rcx, qword [0x1402066f0]
cmp rcx, rbp
je 0x140159836
call fcn.14014b470
test rax, rax
je 0x140159836
call rax
test rax, rax
mov rbx, rax
je 0x140159836
mov rcx, qword [0x1402066f8]
cmp rcx, rbp
je 0x140159836
call fcn.14014b470
test rax, rax
je 0x140159836
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1402066e8]
call fcn.14014b470
mov r12, qword [rsp + 0x80]
test rax, rax
je 0x14015985f
mov r9d, edi
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140159861
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x14015a260
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401ea158]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x20]
mov r9d, 6
mov edx, 0x1004
mov byte [rsp + 0x26], 0
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x14015a2a7
or eax, 0xffffffff
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401447b0
add rsp, 0x38
ret
lea rcx, [rsp + 0x20]
call fcn.14015c5f0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401447b0
add rsp, 0x38
ret
Function at 0x14015cb80
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x1401ea158]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov qword [r11 + 8], rbp
lea rdx, [rsp + 0x20]
xor ebx, ebx
mov ecx, 0x105
mov qword [r11 + 0x10], rsi
lea rdi, [rsp + 0x20]
mov ebp, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp eax, 0x104
mov esi, eax
jle 0x14015cc18
mov qword [rsp + 0x160], r12
lea r12d, [rax + 1]
lea edx, [rbx + 1]
movsxd rcx, r12d
call fcn.14014bea0
test rax, rax
mov rdi, rax
jne 0x14015cbf9
call fcn.1401490c0
mov esi, ebx
mov dword [rax], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
jmp 0x14015cc10
test esi, esi
mov ebp, 1
je 0x14015cc10
mov rdx, rax
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
mov r12, qword [rsp + 0x160]
test esi, esi
mov rsi, qword [rsp + 0x158]
je 0x14015cc37
cmp byte [rdi + 1], 0x3a
jne 0x14015cc42
movzx ecx, byte [rdi]
call fcn.14015e890
lea ebx, [rax - 0x40]
jmp 0x14015cc42
call fcn.1401490c0
mov dword [rax], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
test ebp, ebp
mov rbp, qword [rsp + 0x150]
je 0x14015cc56
mov rcx, rdi
call fcn.1401465e0
mov eax, ebx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1401447b0
mov rbx, qword [rsp + 0x168]
add rsp, 0x140
pop rdi
ret
Function at 0x1401634ac
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x1401ea158]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call fcn.1401489d0
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x140000000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call fcn.1401489d0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x14016353f
cmp dword [rsp + 0x24], 5
jb 0x140163559
jmp 0x140163555
cmp dword [rsp + 0x30], esi
jne 0x140163559
cmp dword [rsp + 0x24], 4
ja 0x140163555
jne 0x140163559
cmp dword [rsp + 0x28], 0
jbe 0x140163559
mov byte [rbx + 0x18], sil
lea rax, [0x14017e780]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.1401632ec
movzx ecx, byte [0x14020856c]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x14020856c], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1401447b0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140002aa8
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
call fcn.140001ca8
xor r14d, r14d
test eax, eax
js 0x140002b7c
test rbx, rbx
jne 0x140002adc
or esi, 0xffffffff
mov edi, esi
jmp 0x140002b2a
mov edi, r14d
mov ecx, r14d
cmp word [rbx], r14w
je 0x140002b18
cmp ecx, 0x7fffffff
jae 0x140002ad5
mov eax, ecx
cmp word [rbx + rax*2], 0x5c
je 0x140002b0c
cmp word [rbx + rax*2], 0x2f
je 0x140002b0c
cmp word [rbx + rax*2], 0x3a
jne 0x140002b0f
cmp ecx, 1
jne 0x140002b0f
lea edi, [rcx + 1]
inc ecx
cmp word [rbx + rcx*2], r14w
jne 0x140002ae8
or esi, 0xffffffff
mov ecx, edi
cmp word [rbx + rcx*2], r14w
cmove edi, esi
cmp edi, 7
jb 0x140002b77
lea eax, [rdi - 5]
mov r8d, 5
lea rcx, [rbx + rax*2]
lea rdx, str.x64_
call fcn.140019254
test eax, eax
jne 0x140002b77
mov eax, dword [0x140022168]
lea ecx, [rdi - 4]
mov dword [rbx + rcx*2], eax
movzx eax, word [0x14002216c]
mov word [rbx + rcx*2 + 4], ax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x140002b77
shr eax, 4
test al, 1
jne 0x140002b77
xor eax, eax
jmp 0x140002b7c
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1400041c8
Capabilities:
Get hostname

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rbx, rdx
and dword [rax + 8], 0
lea r8, [rax + 8]
xor edx, edx
lea ecx, [rdx + 5]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x140004293
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x140004293
and qword [rsp + 0x50], 0
mov edx, dword [rsp + 0x40]
mov eax, 2
mul rdx
mov rdx, 0xffffffffffffffff
cmovo rax, rdx
mov rcx, rax
call fcn.140007060
mov rdi, rax
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x40]
mov rdx, rax
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x140004273
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
jmp 0x140004281
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
xor ebx, ebx
mov rcx, rdi
call fcn.140006d70
and qword [rsp + 0x50], 0
mov eax, ebx
jmp 0x1400042b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovns ecx, eax
mov eax, ecx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14000483c
Capabilities:
Access the windows event log

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x18], r8
push rdi
push r12
push r14
sub rsp, 0x60
mov ebp, edx
movzx r14d, cx
lea rdx, str.Visual_Studio_Remote_Debugger
xor ecx, ecx
mov rsi, r9
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rdi, rax
mov r12d, 0x80004005
test rax, rax
jne 0x14000489a
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
cmovns ebx, r12d
jmp 0x14000489c
xor ebx, ebx
test ebx, ebx
jne 0x140004936
and qword [rsp + 0x50], 0
lea rcx, [rsp + 0x50]
xor ebx, ebx
call fcn.1400193cc
test eax, eax
js 0x1400048c2
mov rax, qword [rsp + 0x50]
mov rbx, qword [rax]
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov ecx, 1
mov eax, dword [rsp + 0xa0]
xor r8d, r8d
mov dword [rsp + 0x30], eax
mov r9d, ebp
mov word [rsp + 0x28], cx
movzx edx, r14w
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x140004921
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
cmovns ebx, r12d
jmp 0x140004923
xor ebx, ebx
mov rcx, qword [rsp + 0x50]
call fcn.1400193c4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rdi
ret
Function at 0x140004954
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov rax, qword [0x140029010]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor ebp, ebp
mov rsi, rcx
mov word [rcx], bp
xor r8d, r8d
lea ebx, [rbp + 2]
mov ecx, ebx
lea edx, [rbp + 1]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
mov r12d, 0x80004005
cmp rax, 0xffffffffffffffff
jne 0x1400049b9
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
cmovns ecx, r12d
jmp 0x1400049bb
mov ecx, ebp
test ecx, ecx
jns 0x1400049c6
mov eax, ecx
jmp 0x140004a78
xor eax, eax
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x2a], rax
mov rcx, rdi
mov dword [rsp + 0x32], eax
mov word [rsp + 0x36], ax
lea r8d, [rax + 0x10]
mov qword [rsp + 0x28], rbx
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x140004a0d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
cmovns ebx, r12d
jmp 0x140004a0f
mov ebx, ebp
mov rcx, rdi
test ebx, ebx
jns 0x140004a20
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, ebx
jmp 0x140004a78
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], socket
lea rdx, [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x140004a59
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
cmovns ebx, r12d
jmp 0x140004a5b
mov ebx, ebp
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test ebx, ebx
js 0x140004a1c
movzx ecx, word [rsp + 0x2a]
call qword [sym.imp.WS2_32.dll_ntohs]
mov word [rsi], ax
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140006d10
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x14000a5d4
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, str.FlsAlloc
xor ecx, ecx
lea r8, [0x14001b870]
lea rdx, str.FlsAlloc
call fcn.14000a3fc
mov rbx, rax
test rax, rax
je 0x14000a614
mov rcx, rax
call fcn.1400076b8
mov rcx, rdi
call rbx
jmp 0x14000a61a
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000a67c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
lea r9, str.FlsGetValue
mov ecx, 2
lea r8, [0x14001b898]
lea rdx, str.FlsGetValue
call fcn.14000a3fc
mov rdi, rax
test rax, rax
je 0x14000a6bd
mov rcx, rax
call fcn.1400076b8
mov ecx, ebx
call rdi
jmp 0x14000a6c5
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000a6d0
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, str.FlsSetValue
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 3
lea r8, [0x14001b8b0]
call fcn.14000a3fc
mov rsi, rax
test rax, rax
je 0x14000a71c
mov rcx, rax
call fcn.1400076b8
mov rdx, rbx
mov ecx, edi
call rsi
jmp 0x14000a727
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret