joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401c6e50
Capabilities:
Hash data using sha256
Read file on windows

Disassembly:
push rbx
push rbp
push rdi
push r13
push r14
sub rsp, 0x110
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rcx, qword [rdx + 8]
xor edi, edi
mov rbp, r8
mov qword [rsp + 0x50], r8
mov r14, r9
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 7]
xor r9d, r9d
mov edx, 0x20001
mov dword [rsp + 0x28], 0x2000000
xor bl, bl
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x1401c7085
mov ecx, 0x10000
mov qword [rsp + 0x108], r12
call fcn.1402b9c60
mov r12, rax
test rax, rax
je 0x1401c7074
movups xmm0, xmmword [0x14032a958]
movups xmm1, xmmword [0x14032a968]
lea r9, [rsp + 0x40]
mov ebx, edi
mov r8d, 0x10000
mov rdx, rax
mov rcx, r13
mov qword [rsp + 0x140], rsi
mov dword [rsp + 0x64], edi
mov esi, edi
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x20], rdi
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm1
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1401c7032
mov qword [rsp + 0x100], r15
mov edi, dword [rsp + 0x40]
test edi, edi
je 0x1401c7020
mov r15d, ebx
add ebx, edi
mov ebp, 0x40
and r15d, 0x3f
mov r14, r12
mov dword [rsp + 0x60], ebx
sub ebp, r15d
cmp ebx, edi
jae 0x1401c6f61
inc esi
mov dword [rsp + 0x64], esi
cmp edi, ebp
jb 0x1401c6fd6
nop word [rax + rax]
mov eax, r15d
lea rcx, [rsp + 0x88]
mov r8d, ebp
mov rdx, r14
add rcx, rax
mov ebx, ebp
call fcn.1402b9d30
sub edi, ebp
mov ebp, 0x40
add r14, rbx
lea rax, [rsp + 0xc8]
lea r8d, [rbp - 0x30]
xor r15d, r15d
mov ecx, dword [rax - 4]
lea rax, [rax - 4]
mov edx, ecx
rol ecx, 8
and ecx, 0xff00ff
ror edx, 8
and edx, 0xff00ff00
or edx, ecx
mov dword [rax], edx
dec r8d
jne 0x1401c6fa4
lea rcx, [rsp + 0x60]
call fcn.14018cbc0
cmp edi, ebp
jae 0x1401c6f70
mov eax, r15d
lea rcx, [rsp + 0x88]
mov r8d, edi
add rcx, rax
mov rdx, r14
call fcn.1402b9d30
lea r9, [rsp + 0x40]
mov r8d, 0x10000
mov rdx, r12
mov rcx, r13
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1401c7020
mov esi, dword [rsp + 0x64]
mov ebx, dword [rsp + 0x60]
jmp 0x1401c6f33
mov rbp, qword [rsp + 0x50]
mov r14, qword [rsp + 0x48]
mov r15, qword [rsp + 0x100]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xd0]
call fcn.14018d7b0
lea rcx, [rsp + 0xd0]
mov r8d, 0x20
mov rdx, rbp
call fcn.1402c4b40
mov rcx, r12
mov bl, 1
test eax, eax
setne al
mov byte [r14], al
call fcn.1402b9c20
mov rsi, qword [rsp + 0x140]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, qword [rsp + 0x108]
movzx eax, bl
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1402b9610
add rsp, 0x110
pop r14
pop r13
pop rdi
pop rbp
pop rbx
ret
Function at 0x1401c70b0
Capabilities:
Hash data using sha256

Disassembly:
push rbx
push rbp
push rdi
push r14
sub rsp, 0xe8
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rcx, qword [rcx + 8]
lea rbx, [rdx + 8]
mov r14, r9
mov rdx, rbx
mov rbp, r8
xor dil, dil
call fcn.1400f9c50
test rax, rax
je 0x1401c7250
mov qword [rsp + 0xe0], r15
lea r9, vtable.type_info.0
lea r8, vtable.type_info.0
xor r15d, r15d
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x20], r15d
call fcn.1402d8fb8
mov rcx, rax
test rax, rax
je 0x1401c724a
mov rax, qword [rax]
mov r8d, 0x10000
mov rdx, rbx
call qword [rax + 0x30]
mov rbx, rax
test rax, rax
je 0x1401c724a
mov ecx, 0x10000
mov qword [rsp + 0x120], rsi
call fcn.1402b9c60
mov rsi, rax
test rax, rax
je 0x1401c720b
movups xmm0, xmmword [0x14032a958]
movups xmm1, xmmword [0x14032a968]
mov rax, qword [rbx]
lea r9, [rsp + 0x30]
mov r8d, 0x10000
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x30], r15d
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm1
call qword [rax + 8]
test al, al
je 0x1401c71d0
nop dword [rax + rax]
mov edx, dword [rsp + 0x30]
test edx, edx
je 0x1401c71d0
lea r8, [rsp + 0x40]
mov rcx, rsi
call fcn.14018d6c0
mov rax, qword [rbx]
lea r9, [rsp + 0x30]
mov r8d, 0x10000
mov rdx, rsi
mov rcx, rbx
call qword [rax + 8]
test al, al
jne 0x1401c71a0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xb0]
call fcn.14018d7b0
lea rcx, [rsp + 0xb0]
mov r8d, 0x20
mov rdx, rbp
call fcn.1402c4b40
mov rcx, rsi
mov dil, 1
test eax, eax
setne al
mov byte [r14], al
call fcn.1402b9c20
mov r8, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [r8]
mov rsi, qword [rsp + 0x120]
movzx eax, dil
mov r15, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1402b9610
add rsp, 0xe8
pop r14
pop rdi
pop rbp
pop rbx
ret
movzx eax, dil
jmp 0x1401c7225
movzx eax, dil
jmp 0x1401c722d
Function at 0x1401c8620
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, qword [rcx + 0x20]
mov rbx, rcx
test rdx, rdx
je 0x1401c866b
mov rcx, qword [rcx + 0x18]
xor r9d, r9d
mov r8d, 0x2710
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
cmp eax, 0x102
jne 0x1401c8659
mov rcx, qword [rbx + 0x20]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x20], 0
add rsp, 0x20
pop rbx
ret
Function at 0x1401cf1a0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbp
mov rdi, rdx
mov rbx, rcx
mov qword [rcx + 8], rdx
xor r14d, r14d
mov qword [rcx + 0x18], r14
lea rbp, vtable.Core::EventWaitHandle.0
mov qword [rcx + 0x10], rbp
xor r9d, r9d
xor r8d, r8d
lea edx, [r14 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x18], rax
lea rsi, vtable.Core::ManualResetEvent.0
mov qword [rbx + 0x10], rsi
lea rax, vtable.HitmanPro35::HashClassifier.0
mov qword [rbx], rax
mov qword [rbx + 0x20], r14
mov qword [rbx + 0x30], r14
mov qword [rbx + 0x28], rbp
xor r9d, r9d
mov edx, 1
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x28], rsi
mov qword [rbx + 0x40], r14
mov qword [rbx + 0x38], rbp
xor r9d, r9d
xor r8d, r8d
lea edx, [r14 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x38], rsi
lea rax, vtable.Core::Mutex.0
mov qword [rbx + 0x48], rax
lea rcx, [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
lea rax, vtable.Core::Queue_class_HitmanPro35::File____ptr64_.0
mov qword [rbx + 0x78], rax
mov dword [rbx + 0x80], r14d
mov qword [rbx + 0x88], r14
mov qword [rbx + 0x90], r14
mov ecx, dword [rdi + 0x10]
mov edx, 0xfa
dec ecx
je 0x1401cf2aa
dec ecx
je 0x1401cf2a2
mov dword [rbx + 0x98], 0x1388
jmp 0x1401cf2b4
mov dword [rbx + 0x98], edx
jmp 0x1401cf2b4
mov dword [rbx + 0x98], 0x9c4
mov byte [rbx + 0xa0], 0
mov eax, 0x32
cmp byte [rdi + 0xe0], 0
cmovne eax, edx
mov dword [rbx + 0x9c], eax
mov rdx, rdi
call fcn.1401cf4a0
mov qword [rbx + 0xa8], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
mov r9, rbx
lea r8, [0x1401cf7a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x20], rax
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1401cf350
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rbx, rcx
lea rax, vtable.HitmanPro35::HashClassifier.0
mov qword [rcx], rax
mov rdx, qword [rcx + 0x20]
xor edi, edi
test rdx, rdx
je 0x1401cf3ba
xor r9d, r9d
mov r8d, 0x3a98
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
cmp eax, 0x102
jne 0x1401cf3ac
or edx, 0xffffffff
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x20], rdi
mov rcx, qword [rbx + 0xa8]
test rcx, rcx
je 0x1401cf3d1
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
nop
lea rax, vtable.Core::Queue_class_HitmanPro35::File____ptr64_.0
mov qword [rbx + 0x78], rax
mov rax, qword [rbx + 0x88]
test rax, rax
je 0x1401cf41d
nop dword [rax + rax]
mov rcx, qword [rax]
mov qword [rbx + 0x88], rcx
test rcx, rcx
je 0x1401cf403
mov qword [rcx + 8], rdi
mov rcx, rax
call fcn.1402177e0
dec dword [rbx + 0x80]
mov rax, qword [rbx + 0x88]
test rax, rax
jne 0x1401cf3f0
mov qword [rbx + 0x88], rdi
mov qword [rbx + 0x90], rdi
lea rax, vtable.Core::Mutex.0
mov qword [rbx + 0x48], rax
lea rcx, [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
nop
lea rsi, vtable.Core::EventWaitHandle.0
mov qword [rbx + 0x38], rsi
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdi, vtable.Core::WaitHandle.0
mov qword [rbx + 0x38], rdi
mov qword [rbx + 0x28], rsi
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x28], rdi
mov qword [rbx + 0x10], rsi
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], rdi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1401cf670
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, qword [rcx + 0x20]
mov rbx, rcx
test rdx, rdx
je 0x1401cf6bb
mov rcx, qword [rcx + 0x18]
xor r9d, r9d
mov r8d, 0x3a98
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
cmp eax, 0x102
jne 0x1401cf6a9
mov rcx, qword [rbx + 0x20]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x20], 0
add rsp, 0x20
pop rbx
ret
Function at 0x1401d19f0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x470
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rbx, rcx
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1401d1aa8
lea rcx, [rsp + 0x250]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
je 0x1401d1aa8
lea r8, [0x140347f58]
lea rcx, [rsp + 0x40]
mov edx, 0x104
call fcn.1402bbbd8
lea r8, [0x140347f58]
lea rcx, [rsp + 0x250]
mov edx, 0x104
call fcn.1402bbbd8
lea rax, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x250]
lea rcx, [rbx + 0x28]
mov qword [rsp + 0x38], rax
call fcn.1401e2370
lea rdx, [rsp + 0x30]
lea r9, [rax + 0x20]
lea rcx, [rbx + 0x28]
mov qword [rsp + 0x20], rax
call fcn.1401cee90
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1402b9610
add rsp, 0x470
pop rbx
ret
Function at 0x1401d1ba0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
cmp dword [0x14042e2b8], 0
mov rbx, rcx
lea rsi, [0x14042e360]
jne 0x1401d1c5b
lea rax, [rsp + 0x68]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersion
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d1c5b
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rdx, str.ProgramFilesDir
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x58], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401d1c50
mov eax, dword [rsp + 0x58]
shr eax, 1
dec eax
mov dword [0x14042e2b8], eax
cdqe
cmp word [rsi + rax*2], 0x5c
je 0x1401d1c50
lea r8, [0x140347f58]
mov edx, 0x104
mov rcx, rsi
call fcn.1402bbbd8
inc dword [0x14042e2b8]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x14042e2bc], 0
lea rdi, [0x14042e570]
jne 0x1401d1d0b
lea rax, [rsp + 0x68]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersion
mov r9d, 0x20219
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d1d0b
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rdx, str.ProgramFilesDir
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x58], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401d1d00
mov eax, dword [rsp + 0x58]
shr eax, 1
dec eax
mov dword [0x14042e2bc], eax
cdqe
cmp word [rdi + rax*2], 0x5c
je 0x1401d1d00
lea r8, [0x140347f58]
mov edx, 0x104
mov rcx, rdi
call fcn.1402bbbd8
inc dword [0x14042e2bc]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movsxd rax, dword [0x14042e2b8]
test eax, eax
jle 0x1401d1d32
mov rdx, qword [rbx]
mov r8, rax
mov rcx, rsi
call fcn.1402bba28
test eax, eax
jne 0x1401d1d32
mov al, 1
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
movsxd rax, dword [0x14042e2bc]
test eax, eax
jle 0x1401d1d4f
mov rdx, qword [rbx]
mov r8, rax
mov rcx, rdi
call fcn.1402bba28
test eax, eax
je 0x1401d1d28
xor al, al
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401e2440
Capabilities:
Get common file path
Query environment variable

Disassembly:
push rdi
sub rsp, 0xa60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xa78], rbx
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rsp + 0xa50], rax
mov rbx, rcx
mov r8d, 1
lea rdx, [0x1403512cc]
call fcn.1402019e0
movzx eax, al
mov r8d, 1
mov rcx, rbx
test eax, eax
jle 0x1401e24ba
lea rdx, [0x1403512cc]
call fcn.1401ffb20
test eax, eax
jle 0x1401e24da
mov r8d, dword [rbx + 0xc]
sub r8d, eax
mov edx, eax
mov rcx, rbx
call fcn.140200670
mov r8d, 1
jmp 0x1401e24d0
lea rdx, [0x140355e60]
call fcn.1402019e0
test al, al
je 0x1401e24da
mov r8d, 4
xor edx, edx
mov rcx, rbx
call fcn.140200670
cmp dword [rbx + 0xc], 0
je 0x1401e25ad
xor r8d, r8d
lea rdx, str.system32_
mov rcx, rbx
call fcn.1402019e0
test al, al
je 0x1401e252f
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1401e25ad
xor edx, edx
lea r8d, [rdx + 8]
mov rcx, rbx
call fcn.140200670
lea r8, [rsp + 0x40]
mov rcx, rbx
call fcn.140200130
jmp 0x1401e25ad
xor r8d, r8d
lea rdx, str.SystemRoot_
mov rcx, rbx
call fcn.1402019e0
test al, al
je 0x1401e2576
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1401e25ad
xor edx, edx
lea r8d, [rdx + 0xb]
mov rcx, rbx
call fcn.140200670
lea r8, [rsp + 0x40]
mov rcx, rbx
call fcn.140200130
jmp 0x1401e25ad
xor edx, edx
mov rcx, rbx
call fcn.1401fd730
cmp ax, 0x25
jne 0x1401e25ad
mov r8d, 0x400
lea rdx, [rsp + 0x250]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rsp + 0x250]
mov rcx, rbx
call fcn.1401fd6c0
mov rcx, rbx
cmp dword [rbx + 0xc], 3
jge 0x1401e25c2
mov rdx, qword [0x14041a158]
jmp 0x1401e2647
mov r9d, 2
lea r8d, [r9 - 1]
lea rdx, [rsp + 0x20]
call fcn.140201490
nop
mov r8d, 1
lea rdx, [0x140362e18]
mov rcx, rax
call fcn.1401ff540
test al, al
sete dil
cmp dword [rsp + 0x28], 0
jle 0x1401e2603
mov rcx, qword [rsp + 0x20]
call fcn.1402b9c20
mov rcx, rbx
test dil, dil
jne 0x1401e25b6
mov r8d, 1
lea rdx, [0x140360f58]
call fcn.1401fefd0
test al, al
je 0x1401e264c
mov r8d, 0x400
lea rdx, [rsp + 0x250]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x1401e264c
lea rdx, [rsp + 0x250]
mov rcx, rbx
call fcn.1401fd6c0
mov rcx, qword [rsp + 0xa50]
xor rcx, rsp
call fcn.1402b9610
mov rbx, qword [rsp + 0xa78]
add rsp, 0xa60
pop rdi
ret
Function at 0x1401e5110
Capabilities:
Create shortcut via ishelllink

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xac0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0xae0], rbx
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rsp + 0xab0], rax
mov rsi, r8
mov rdi, rdx
mov qword [rsp + 0x50], rdx
xor ebp, ebp
mov dword [rsp + 0x38], ebp
lea rax, [0x140348ca0]
mov qword [rdx], rax
mov qword [rdx + 8], rbp
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [0x1403029b0]
xor edx, edx
lea r8d, [rbp + 1]
lea rcx, [0x140302a00]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
mov word [rsp + 0x2b0], bp
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rsp + 0x2b2]
call fcn.1402c22a0
test ebx, ebx
js 0x1401e5272
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
lea r8, [rsp + 0x40]
lea rdx, [0x140302a20]
call qword [rax]
test eax, eax
js 0x1401e5267
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
xor r8d, r8d
mov rdx, qword [rsi]
call qword [rax + 0x28]
test eax, eax
js 0x1401e525c
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x60]
mov r8d, 0x400
lea rdx, [rsp + 0x2b0]
call qword [rax + 0x18]
test eax, eax
js 0x1401e525c
test byte [rsp + 0x60], 0x10
jne 0x1401e525c
lea rdx, [rsp + 0x2b0]
mov rcx, rdi
call fcn.1401fd6c0
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
mov r8d, 0x400
lea rdx, [rsp + 0x2b0]
call qword [rax + 0x50]
lea rdx, [0x14034f008]
mov rcx, rdi
call fcn.1401fd8b0
lea rdx, [rsp + 0x2b0]
mov rcx, rdi
call fcn.1401fd8b0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rax, rdi
mov rcx, qword [rsp + 0xab0]
xor rcx, rsp
call fcn.1402b9610
mov rbx, qword [rsp + 0xae0]
add rsp, 0xac0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401f0250
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0xa60
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0xa70], rbx
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rsp + 0xa50], rax
mov rdi, rdx
mov r8d, 1
lea rdx, [0x140355e60]
mov rcx, rdi
call fcn.1402019e0
test al, al
je 0x1401f02ed
mov r8d, 4
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1402011d0
mov rbx, rax
mov edx, dword [rax + 0xc]
mov rcx, rdi
call fcn.1401ff260
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rdi + 8]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rdi]
call fcn.1402bd21c
mov edx, dword [rbx + 0xc]
mov rcx, rdi
call fcn.140200570
nop
cmp dword [rsp + 0x28], 0
jle 0x1401f02ed
mov rcx, qword [rsp + 0x20]
call fcn.1402b9c20
mov r8d, 1
lea rdx, [0x140360f58]
mov rcx, rdi
call fcn.1401fefd0
test al, al
je 0x1401f0375
mov r8d, 0x400
lea rdx, [rsp + 0x250]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x1401f0375
lea rax, [rsp + 0x250]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401f0330
test ebx, ebx
jle 0x1401f0365
mov edx, ebx
mov rcx, rdi
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rdi + 8]
inc eax
movsxd rdx, eax
lea r8, [rsp + 0x250]
mov rcx, qword [rdi]
call fcn.1402bd21c
jmp 0x1401f036b
cmp dword [rdi + 0xc], 0
jle 0x1401f0375
mov edx, ebx
mov rcx, rdi
call fcn.140200570
mov eax, dword [rdi + 0xc]
cmp eax, 2
jge 0x1401f0391
mov rdx, qword [0x14041a158]
mov rcx, rdi
call fcn.1401fd6c0
jmp 0x1401f044d
cmp eax, 1
jg 0x1401f03fe
lea rcx, [rsp + 0x20]
call fcn.1401fcf30
nop
lea rax, vtable.Core::IndexOutOfRangeException.0
mov qword [rsp + 0x20], rax
mov edx, 0x2a
lea rcx, [rsp + 0x28]
call fcn.1401ff260
mov eax, dword [rsp + 0x30]
inc eax
movsxd rdx, eax
mov r9d, 0x2a
lea r8, str.Index_was_outside_the_bounds_of_the_array.
mov rcx, qword [rsp + 0x28]
call fcn.1402bd21c
mov edx, 0x2a
lea rcx, [rsp + 0x28]
call fcn.140200570
nop
lea rdx, [0x140410838]
lea rcx, [rsp + 0x20]
call fcn.1402c1558
int3
mov rax, qword [rdi]
cmp word [rax + 2], 0x3a
je 0x1401f044d
xor r8d, r8d
lea rdx, str.SystemRoot_
mov rcx, rdi
call fcn.1402019e0
test al, al
je 0x1401f044d
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1401f044d
xor edx, edx
lea r8d, [rdx + 0xb]
mov rcx, rdi
call fcn.140200670
lea r8, [rsp + 0x40]
mov rcx, rdi
call fcn.140200130
mov rcx, qword [rsp + 0xa50]
xor rcx, rsp
call fcn.1402b9610
mov rbx, qword [rsp + 0xa70]
add rsp, 0xa60
pop rdi
ret
Function at 0x1401f0470
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x50], rbx
mov rbx, rcx
lea rcx, [0x14034fce0]
call fcn.1400ff510
call fcn.1400ff8a0
cmp qword [rbx + 0x18], 0
mov qword [rbx + 0x10], rax
jne 0x1401f04d9
mov qword [rsp + 0x40], rdi
xor edi, edi
lea rcx, str..hmpkick
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
cmove rax, rdi
mov rdi, qword [rsp + 0x40]
mov qword [rbx + 0x18], rax
mov rcx, rbx
call fcn.1401f0770
mov rcx, rbx
call fcn.1401f1240
mov rcx, qword [rbx + 0x10]
mov rbx, qword [rsp + 0x50]
test rcx, rcx
je 0x1401f04fd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x48
ret
Function at 0x1401f1310
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x490
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rbx, rdx
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 6]
xor r8d, r8d
call fcn.1400ce2e0
lea r9, [rsp + 0x30]
mov r8d, 8
lea rdx, [rsp + 0x38]
mov rcx, rbx
test al, al
je 0x1401f1369
mov dword [rsp + 0x20], 3
call qword [sym.imp.PSAPI.DLL_EnumProcessModulesEx]
jmp 0x1401f136f
call qword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
jne 0x1401f138c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.EnumProcessModules_error__d_r_n
mov edx, eax
call fcn.1402ba358
jmp 0x1401f144a
mov rdx, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
mov r9d, 0x18
mov rcx, rbx
call qword [sym.imp.PSAPI.DLL_GetModuleInformation]
test eax, eax
jne 0x1401f13c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetModuleInformation_error__d_r_n
mov edx, eax
call fcn.1402ba358
jmp 0x1401f144a
mov rdx, qword [rsp + 0x38]
lea r8, [rsp + 0x270]
mov r9d, 0x104
mov rcx, rbx
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
jne 0x1401f13f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetModuleFileNameEx_error__d_r_n
mov edx, eax
call fcn.1402ba358
jmp 0x1401f144a
xor eax, eax
lea rcx, [rsp + 0x62]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x60], ax
call fcn.1402c22a0
mov rdx, qword [rsp + 0x40]
lea r8, [rsp + 0x60]
mov r9d, 0x104
mov rcx, rbx
call qword [sym.imp.PSAPI.DLL_GetMappedFileNameW]
test eax, eax
jne 0x1401f144a
mov rdx, qword [rsp + 0x40]
lea r8, [rsp + 0x270]
lea rcx, str.Hollow_Process____p_:__ls_r_n
call fcn.1402ba358
mov byte [rdi], 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1402b9610
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x490
pop rdi
ret
Function at 0x1401f1c50
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rdx
mov esi, r8d
mov rdi, rcx
lea r8, [0x140347f58]
mov edx, 0x104
mov rcx, rbx
call fcn.1402bbbd8
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call fcn.1402019e0
test al, al
je 0x1401f1cca
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
jle 0x1401f1cca
mov r8d, esi
xor edx, edx
mov rcx, rdi
call fcn.140200670
lea r8, [rsp + 0x20]
mov rcx, rdi
call fcn.140200130
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1402b9610
add rsp, 0x240
pop rdi
pop rsi
pop rbx
ret