joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001d84
Capabilities:
Enumerate pe sections

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rdx, qword [rcx]
mov esi, 1
xor ebx, ebx
movzx eax, word [rdx + 0x14]
mov r15, qword [rdx + 0x30]
mov r12, rcx
lea r9, [rax + rdx + 0x18]
movabs rax, 0xffffffff00000000
mov r10d, dword [r9 + 8]
and r15, rax
mov eax, dword [r9 + 0x10]
or r10, r15
mov qword [r11 - 0x48], r10
mov r11d, dword [rcx + 0x24]
sub r11d, esi
not r11d
and r11, r10
mov qword [rsp + 0x28], r11
cmp eax, ebx
jne 0x140001e02
test byte [r9 + 0x24], 0x40
je 0x140001df8
mov eax, dword [rdx + 0x20]
jmp 0x140001e02
test byte [r9 + 0x24], 0x80
je 0x140001e02
mov eax, dword [rdx + 0x24]
mov ecx, dword [r9 + 0x24]
mov r8d, eax
mov dword [rsp + 0x3c], ebx
mov qword [rsp + 0x30], r8
mov r13d, esi
mov dword [rsp + 0x38], ecx
cmp si, word [rdx + 6]
jae 0x140001ed6
lea rdi, [r9 + 0x4c]
mov eax, dword [r12 + 0x24]
mov r14d, dword [rdi - 0x1c]
mov ebp, dword [rdi - 0x14]
sub eax, esi
or r14, r15
not eax
mov esi, eax
and rsi, r14
cmp ebp, ebx
jne 0x140001e55
test byte [rdi], 0x40
je 0x140001e4d
mov ebp, dword [rdx + 0x20]
jmp 0x140001e55
test byte [rdi], 0x80
je 0x140001e55
mov ebp, dword [rdx + 0x24]
cmp r11, rsi
je 0x140001e8f
lea rax, [r8 + r10]
cmp rax, rsi
ja 0x140001e8f
lea rdx, [rsp + 0x20]
mov rcx, r12
call fcn.140001c98
cmp eax, ebx
je 0x140001f0c
mov ecx, dword [rdi]
mov r10, r14
mov qword [rsp + 0x20], r14
mov r11, rsi
mov qword [rsp + 0x28], rsi
mov r8d, ebp
jmp 0x140001eb0
mov eax, dword [rdi]
bt eax, 0x19
jae 0x140001ea1
bt ecx, 0x19
jae 0x140001ea1
or ecx, eax
jmp 0x140001ea7
or ecx, eax
btr ecx, 0x19
mov r8d, ebp
sub r8, r10
add r8, r14
mov rdx, qword [r12]
mov esi, 1
add rdi, 0x28
movzx eax, word [rdx + 6]
add r13d, esi
mov dword [rsp + 0x38], ecx
cmp r13d, eax
mov qword [rsp + 0x30], r8
jl 0x140001e27
lea rdx, [rsp + 0x20]
mov rcx, r12
mov dword [rsp + 0x3c], esi
call fcn.140001c98
cmp eax, ebx
setne bl
mov eax, ebx
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor eax, eax
jmp 0x140001eee
Function at 0x140002ed4
Capabilities:
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x14000c008]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea rcx, [rsp + 0x52]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x50], di
call fcn.1400035b0
lea ebx, [rdi + 1]
lea r8d, [rdi + 0x23]
lea rdx, [rsp + 0x50]
mov r9d, ebx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rdx, str.ckq
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x50]
xor r9d, r9d
mov r8d, ebx
mov edx, 0x40000000
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea r9, [rsp + 0x40]
lea rdx, [0x1409fc2f0]
mov r8d, 0xe64672
mov rcx, rax
mov rbx, rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x1408130f0]
mov edx, 0x1e9200
call fcn.140002000
mov rbx, rax
cmp rax, rdi
je 0x140002ffd
lea rdx, [0x14000d024]
mov rcx, rax
call fcn.140001f10
cmp rax, rdi
je 0x140002fb7
call rax
cmp dword [rbx + 0x1c], edi
je 0x140002fd2
mov rax, qword [rbx]
mov rcx, qword [rbx + 8]
xor r8d, r8d
mov r9d, dword [rax + 0x28]
xor edx, edx
add r9, rcx
call r9
mov rcx, qword [rbx + 8]
cmp rcx, rdi
je 0x140002fe9
xor edx, edx
mov r8d, 0x8000
call qword [0x141862a98]
call qword [0x141862aa8]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [0x141862aa0]
lea rax, [0x141861a04]
or edx, 0xffffffff
lea rcx, [0x1418620c4]
mov dword [rax - 4], edx
mov dword [rax], edx
mov dword [rax + 4], edx
add rax, 0xc
cmp rax, rcx
jl 0x140003007
mov dword [0x141862a60], edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140003190
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
Function at 0x140003b2b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14000c008]
jne 0x1400031aa
rol rcx, 0x10
test cx, 0xffff
jne 0x1400031a6
repz ret
ror rcx, 0x10
jmp 0x140003a84
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x141860a60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x141860b58]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140003b09
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x141860a60]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140003b2b
mov rax, qword [rsp + 0x88]
mov qword [0x141860b58], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x141860af8], rax
mov rax, qword [0x141860b58]
mov qword [0x1418609d0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x141860ae0], rax
mov dword [0x1418609c0], 0xc0000409
mov dword [0x1418609c4], 1
mov rax, qword [0x14000c008]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14000c010]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x141860a58], eax
mov ecx, 1
call fcn.140006318
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400093d0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x141860a58], 0
jne 0x140003bb2
mov ecx, 1
call fcn.140006318
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140005258
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140006e84
nop
cmp dword [0x141860fe8], 1
je 0x140005204
mov dword [0x141860fe4], 1
mov byte [0x141860fe0], r12b
test ebx, ebx
jne 0x1400051f0
mov rcx, qword [0x141862d18]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400051dd
mov rcx, qword [0x141862d10]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x14000517c
call fcn.1400047c0
cmp qword [rdi], rax
jne 0x14000517c
jmp 0x140005162
cmp rdi, rsi
jb 0x1400051dd
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.1400047c0
mov qword [rdi], rax
call rbx
mov rcx, qword [0x141862d18]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x141862d10]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x1400051bb
cmp r13, rax
je 0x1400051db
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x140005162
lea rdx, [0x1400093b8]
lea rcx, [0x1400093b0]
call fcn.140004fac
lea rdx, [0x1400093c8]
lea rcx, [0x1400093c0]
call fcn.140004fac
nop
test r12d, r12d
je 0x140005213
mov ecx, 8
call fcn.140006d84
test r12d, r12d
jne 0x14000523e
mov dword [0x141860fe8], 1
lea ecx, [r12 + 8]
call fcn.140006d84
mov ecx, r15d
call fcn.140004f40
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400050cc

Function at 0x140005264
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1400050cc
Function at 0x140007cf4
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.1400047c0
xor ebx, ebx
mov rdi, rax
cmp qword [0x1418616b8], rbx
jne 0x140007dfa
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140007ecf
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007ecf
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1418616b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1418616c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x1418616c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x1418616d8], rax
test rax, rax
je 0x140007df1
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x1418616d0], rax
jmp 0x140007e01
mov rax, qword [0x1418616d0]
jmp 0x140007e08
mov rax, qword [0x1418616d0]
mov r11, qword [0x1418616d8]
cmp rax, rdi
je 0x140007e70
cmp r11, rdi
je 0x140007e70
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x1418616d8]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x140007e70
test rax, rax
je 0x140007e70
call rsi
test rax, rax
je 0x140007e6a
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140007e6a
test byte [rsp + 0x38], 1
jne 0x140007e70
bts ebp, 0x15
jmp 0x140007eae
mov rcx, qword [0x1418616c0]
cmp rcx, rdi
je 0x140007eae
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140007eae
call rax
mov rbx, rax
test rax, rax
je 0x140007eae
mov rcx, qword [0x1418616c8]
cmp rcx, rdi
je 0x140007eae
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140007eae
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1418616b8]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140007ecf
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140007ed1
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1400126c0
Capabilities:
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x160
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov dword [rsp + 0x20], 0x130
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140012714
xor r9d, r9d
lea r8, str.Error
lea rdx, str.Failed_to_create_snapshot_of_running_processes
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140012760
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140012757
nop word [rax + rax]
lea rdx, [rsp + 0x4c]
lea rcx, str.program.exe
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
mov rcx, rbx
test eax, eax
je 0x14001277b
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140012730
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140013210
add rsp, 0x160
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x140012762
Function at 0x140013b2c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140013b76
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140013b76
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140013b76
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140013b76
cmp dword [rcx + 0x84], 0xe
jbe 0x140013b76
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140013b78
xor al, al
add rsp, 0x28
ret
Function at 0x1400017f0
Capabilities:
Execute command
Set console window title

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rcx, [0x140004478]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.MODE_75_8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
lea rcx, [0x140004770]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea rdx, str.Clear_History__12BitStore
lea rcx, [rsp + 0x28]
call fcn.140001a00
nop
mov edx, 0xc
mov r8d, 0x64
lea rcx, [rsp + 0x28]
call fcn.1400012a0
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov r9, rax
cmp rbx, 0x989680
jne 0x14000187a
imul rax, r9, 0x64
jmp 0x1400018f3
cmp rbx, 0x16e3600
jne 0x1400018d8
movabs r10, 0xb2f4fc0794908cf3
mov rax, r10
imul r9
add rdx, r9
sar rdx, 0x18
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
imul r8, rdx, 0x3b9aca00
imul rcx, rdx, 0x16e3600
sub r9, rcx
imul rcx, r9, 0x3b9aca00
mov rax, r10
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rax, rdx
add rax, r8
jmp 0x1400018f3
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7fffffff88ca6bff
cmp rax, rcx
jge 0x14000190a
add rax, 0x77359400
jmp 0x140001914
movabs rax, 0x7fffffffffffffff
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
call fcn.1400022d0
lea rcx, [0x140004478]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x140001976
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001971
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001971
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400024b4
call fcn.140001520
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140002450
add rsp, 0x50
pop rbx
ret

Function at 0x140002dd0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002e1a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002e1a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002e1a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002e1a
cmp dword [rcx + 0x84], 0xe
jbe 0x140002e1a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002e1c
xor al, al
add rsp, 0x28
ret
Function at 0x1400028c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400028ed
xor eax, eax
jmp 0x140002a59
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140002927
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140002927
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140002a59
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140002a4c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000296a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002995
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002a51
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002a04
sub eax, 1
je 0x140002a04
cmp eax, 2
jne 0x140002a4c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002a51
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140002a32
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140002a4c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140002a51
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140003a80
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140002ce0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140002db3
cmp byte [rcx + 0x71], 0
je 0x140002db3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140002daf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002d74
sub eax, 1
je 0x140002d78
cmp eax, 2
jne 0x140002daf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003a80
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140002da6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140002daf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140002d5c
xor al, al
jmp 0x140002d5c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003a80
add rsp, 0x60
pop rbx
ret

Function at 0x140004400
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000444a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000444a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000444a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000444a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000444a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000444c
xor al, al
add rsp, 0x28
ret
Function at 0x1400304f0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140030516
mov r8, rdx
mov rdx, qword [rbx]
call fcn.14000d814
jmp 0x140030581
cmp byte [0x14028ad28], 0
jne 0x14003055a
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003054a
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14028ad20], rax
jmp 0x140030551
mov rax, qword [0x14028ad20]
mov byte [0x14028ad28], 1
jmp 0x140030561
mov rax, qword [0x14028ad20]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x14003057b
mov r8d, dword [rbx + 8]
xor r9d, r9d
call qword [case.0x14004d5ee.0]
jmp 0x140030581
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14003f23c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor ebx, ebx
mov rdi, r8
mov rsi, rdx
mov r15, rcx
test r8, r8
jne 0x14003f26d
call fcn.140028258
mov rdi, qword [rax + 0x18]
lea r8, [0x1401dcad8]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x14003f2d6
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x14003f2d6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14003f2c9
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r14
mov rcx, r15
mov r8d, eax
call fcn.14003f2f4
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
jmp 0x14003f2d8
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140003f94
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140003fce
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140003fd3
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14000401c
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140006390]
cmp byte [rcx + rax], 0
je 0x14000401c
dec r8
sub rdx, 1
jne 0x140004002
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140004a4c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004a96
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004a96
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004a96
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004a96
cmp dword [rcx + 0x84], 0xe
jbe 0x140004a96
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004a98
xor al, al
add rsp, 0x28
ret
Function at 0x180011203
Capabilities:
Create thread

Disassembly:
jmp 0x180011b30
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x30]
lea rcx, [0x1800290d7]
call fcn.1800113ca
nop
mov eax, dword [rbp + 0xf8]
mov dword [rbp + 0xc0], eax
cmp dword [rbp + 0xc0], 1
je 0x180011b70
jmp 0x180011b9a
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rbp + 0xf0]
lea r8, [0x1800112bc]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov eax, 1
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret

Function at 0x18001123a
Capabilities:
Terminate process

Disassembly:
jmp 0x180018010
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret