joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1803726a0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0x58]
call fcn.1800058e0
nop
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jle 0x180372798
mov eax, dword [rsp + 0x20]
shl eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
inc eax
cdqe
mov qword [rsp + 0x38], rax
mov eax, 2
mov rcx, qword [rsp + 0x38]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1803944a8
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov r8d, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
cmp dword [rsp + 0x24], eax
jg 0x180372784
movsxd rax, dword [rsp + 0x24]
xor ecx, ecx
mov rdx, qword [rsp + 0x30]
mov word [rdx + rax*2], cx
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.18000e530
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.180393fb0
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x90]
call fcn.180005870
mov eax, dword [rsp + 0x28]
or eax, 1
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x58]
call fcn.1800057f0
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180393f50
add rsp, 0x88
ret
Function at 0x180372bb0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x180372bcd
jmp 0x180372cec
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.USER32.dll_GetLastActivePopup]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x180372bfc
mov edx, 9
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rsp + 0x40], 0
xor r9d, r9d
lea r8, [rsp + 0x40]
xor edx, edx
mov ecx, 0x2000
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
cmp dword [rsp + 0x40], 0x64
jb 0x180372c36
mov r9d, 3
xor r8d, r8d
xor edx, edx
mov ecx, 0x2001
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x48], eax
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rsp + 0x44], eax
mov r8d, 1
mov edx, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x48]
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, 0xffffffffffffffff
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, 0xfffffffffffffffe
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
xor r8d, r8d
mov edx, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x48]
call qword [sym.imp.USER32.dll_AttachThreadInput]
add rsp, 0x68
ret

Function at 0x180372f40
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor edi, edi
mov rbx, rcx
mov qword [rcx], rdi
cmp qword [0x1804e5ef8], rdi
jne 0x180372fcb
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x20a
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rax, [rsp + 0x30]
mov word [rsp + 0x236], di
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], di
jne 0x180372fb0
lea rdx, [rsp + 0x30]
lea rcx, [0x1804e5ee8]
call fcn.180005cd0
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180393f50
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x180373070
Capabilities:
Check os version
Get session user name

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x260
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rsi, rcx
mov eax, dword [0x1804f1a08]
test eax, eax
jle 0x1803730bd
inc eax
mov dword [0x1804f1a08], eax
mov al, 1
jmp 0x18037321d
xor bpl, bpl
xor r14d, r14d
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
lea ecx, [r14 + 1]
call fcn.180393f74
mov rbx, rax
mov qword [rsp + 0x30], rax
mov byte [rax], bpl
xor edx, edx
mov r8d, 0x118
lea rcx, [rsp + 0x44]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x40], 0x11c
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x180373114
cmp dword [rsp + 0x44], 6
setae al
mov byte [rbx], al
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call fcn.18017c260
movzx ebx, al
lea rcx, [rsp + 0x30]
call fcn.18017b210
test bl, bl
je 0x180373206
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x180373206
lea rdx, str.ImpersonateLoggedOnUser
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x28]
mov rcx, rbx
call rax
test eax, eax
je 0x1803731fb
inc dword [0x1804f1a08]
mov rcx, qword [rsi]
test rcx, rcx
je 0x180373187
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi], rbx
mov rbx, r14
mov bpl, 1
cmp qword [0x1804e5f18], rbx
jne 0x1803731fb
xor edx, edx
mov r8d, 0x20a
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov word [rsp + 0x246], r14w
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], bx
jne 0x1803731e0
lea rdx, [rsp + 0x40]
lea rcx, [0x1804e5f08]
call fcn.180005cd0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x18037320b
mov rbx, qword [rsp + 0x28]
test rbx, rbx
je 0x180373219
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bpl
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180393f50
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180380f40
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x460
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbx, rdx
mov r14d, ecx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x30], rdx
xor esi, esi
mov qword [rdx + 0x10], rsi
mov rax, rdx
cmp qword [rdx + 0x18], 8
jb 0x180380f84
mov rax, qword [rdx]
mov word [rax], si
call fcn.180381060
movzx edi, al
mov byte [rsp + 0x20], al
jmp 0x180380fa9
test dil, dil
jne 0x180381029
cmp r14d, 0x1a
jne 0x180381029
mov qword [rbx + 0x10], rsi
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x180380fc5
mov rax, qword [rbx]
mov word [rax], si
xor edx, edx
mov r8d, 0x410
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x207
lea rdx, [rsp + 0x40]
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x180381000
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.180005cd0
movzx edi, dil
mov eax, 1
cmp qword [rbx + 0x10], 0
cmovne edi, eax
movzx eax, dil
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.180393f50
mov rbx, qword [rsp + 0x490]
add rsp, 0x460
pop r14
pop rdi
pop rsi
ret

Function at 0x180381310
Capabilities:
Query environment variable

Disassembly:
mov rdx, rcx
mov ecx, 0x1a
jmp fcn.180380f40

Function at 0x180381b60
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
cmp rcx, 0xffffffffffffffff
je 0x180381b9b
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x180381b9b
lea rdx, [rbx + 0x60]
lea rcx, [rbx + 0x20]
call fcn.18018e6b0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x18038d430
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, rcx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x28], rcx
test rcx, rcx
je 0x18038d47d
mov rcx, qword [rcx]
test rcx, rcx
je 0x18038d47d
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rsi + 0x38]
cmp eax, 0x7530
jb 0x18038d503
lea rcx, [rsi + 8]
call fcn.1800122a0
lea rcx, [rsi + 0x20]
call fcn.1800122a0
lea rdx, [rsi + 8]
mov rcx, rsi
call fcn.18038d540
lea r9, [rsi + 0x20]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.18038d840
lea r9, [rsi + 0x20]
mov r8b, 1
xor edx, edx
mov rcx, rsi
call fcn.18038d840
lea r9, [rsi + 0x20]
xor r8d, r8d
mov dl, 1
mov rcx, rsi
call fcn.18038d840
lea r9, [rsi + 0x20]
mov r8b, 1
movzx edx, r8b
mov rcx, rsi
call fcn.18038d840
lea rdx, [rsi + 0x20]
call fcn.18038e9c0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsi + 0x38], eax
mov rcx, qword [rsi]
test rcx, rcx
je 0x18038d511
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov qword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180393f50
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x180392a10
Capabilities:
Get file size

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.180160610
nop
lea rcx, [rsp + 0x48]
call fcn.18015b0b0
xor ebp, ebp
test al, al
jne 0x180392a61
xor dil, dil
jmp 0x180392b53
mov qword [rsp + 0x30], rbp
mov ecx, 8
call fcn.180393f74
mov qword [rsp + 0x40], rax
mov qword [rax], 0xffffffffffffffff
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov r9d, 1
mov r8d, 0x80000000
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x30]
call fcn.180179420
mov rbx, qword [rsp + 0x30]
test al, al
je 0x180392b23
mov rdi, rbp
test rbx, rbx
je 0x180392b23
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
jne 0x180392acb
xor sil, sil
jmp 0x180392afa
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
jne 0x180392aec
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x180392aec
xor sil, sil
jmp 0x180392afa
mov edi, dword [rsp + 0x40]
shl rdi, 0x20
add rdi, rsi
mov sil, 1
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x180392b14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x180392b14
mov qword [rbx], 0xffffffffffffffff
test sil, sil
je 0x180392b23
test rdi, rdi
je 0x180392b23
mov dil, 1
jmp 0x180392b26
xor dil, dil
test rbx, rbx
je 0x180392b53
mov rcx, qword [rbx]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x180392b41
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rbp
mov edx, 8
mov rcx, rbx
call fcn.180393fb0
mov qword [rsp + 0x30], rbp
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x180392b98
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180392b93
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180392b93
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180393fb0
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], bp
movzx eax, dil
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.180393f50
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x180b3a058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.180b3a1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180b3a089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180b3a06f
add dl, dl
jne 0x180b3a096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180b3a0f6
xor eax, eax
add dl, dl
jne 0x180b3a0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180b3a1ad
add dl, dl
jne 0x180b3a0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180b3a0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180b3a0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180b3a0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x180b3a0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x180b3a07e
mov eax, 1
add dl, dl
jne 0x180b3a106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180b3a113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180b3a0fb
sub eax, ebx
mov ebx, 1
jne 0x180b3a14c
mov ecx, 1
add dl, dl
jne 0x180b3a12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180b3a13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180b3a123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180b3a07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180b3a168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180b3a175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180b3a15d
cmp eax, 0x7d00
jae 0x180b3a19b
cmp eax, 0x500
jb 0x180b3a196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180b3a07e
cmp eax, 0x7f
ja 0x180b3a19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180b3a07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x180b3a1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x180b3a07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140007c80
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rcx, qword [0x14002d0a0]
test rcx, rcx
je 0x140007cbb
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140007ce0
mov rcx, qword [0x14002d0a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x1400300e0], 0
jne 0x140007cf8
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, qword [0x14002d0a0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x140007cae
mov edx, 0x414
lea r12, [rsp + 0x20]
lea rsi, [0x14001d392]
mov qword [rsp + 0x20], 0
lea rdi, [0x140030100]
movq xmm0, rsi
mov rcx, r12
mov dword [rsp + 0x28], 3
movq xmm6, rdi
mov word [rsp + 0x40], dx
mov rbp, qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, 0x14
punpcklqdq xmm6, xmm0
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], rsi
movaps xmmword [rsp + 0x30], xmm6
call rbp
mov r13, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140007dc4
test al, 0x10
je 0x140007cc4
mov ecx, 0x64
call r14
mov eax, 0x414
mov qword [rsp + 0x50], rsi
mov rcx, r12
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 3
mov word [rsp + 0x40], ax
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
movaps xmmword [rsp + 0x30], xmm6
call rbp
sub ebx, 1
je 0x140007cc4
mov rcx, rdi
call r13
cmp eax, 0xffffffff
jne 0x140007d70
jmp 0x140007cc4

Function at 0x14000e430
Capabilities:
Create directory

Disassembly:
push rdi
mov eax, 0x2020
push rsi
push rbx
call fcn.1400154d0
sub rsp, rax
mov eax, dword [0x140034100]
mov rsi, rcx
test eax, eax
je 0x14000e4d0
xor ebx, ebx
lea rdi, [0x140032100]
test eax, eax
jg 0x14000e46c
jmp 0x14000e480
add rbx, 1
cmp dword [0x140034100], ebx
jle 0x14000e480
mov rdx, qword [rdi + rbx*8]
mov rcx, rsi
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x14000e460
jmp 0x14000e4b7
mov rcx, rsi
call sub.msvcrt.dll_wcslen
cmp rax, 2
jne 0x14000e495
cmp word [rsi + 2], 0x3a
je 0x14000e4b7
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14000e520
movsxd rbx, dword [0x140034100]
cmp ebx, 0x3ff
jle 0x14000e538
mov eax, 1
add rsp, 0x2020
pop rbx
pop rsi
pop rdi
ret
lea rdi, [rsp + 0x20]
lea rbx, str.HOME
mov r8d, 0x1000
mov rdx, rbx
mov rcx, rdi
call fcn.140007540
test al, al
je 0x14000e55a
movsxd rbx, dword [0x140034100]
mov rcx, rdi
lea rdi, [0x140032100]
call sub.msvcrt.dll__wcsdup
mov qword [rdi + rbx*8], rax
mov eax, dword [0x140034100]
add eax, 1
mov dword [0x140034100], eax
jmp 0x14000e451
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000e4a4
xor eax, eax
jmp 0x14000e4bc
mov rcx, rsi
call sub.msvcrt.dll__wcsdup
add dword [0x140034100], 1
mov rdx, rax
lea rax, [0x140032100]
mov qword [rax + rbx*8], rdx
jmp 0x14000e4b7
mov rcx, rbx
call fcn.140007bc0
nop
nop word cs:[rax + rax]
nop
Function at 0x1400141b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.14001b100
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.14001b100
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x140014e82
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140034228]
test eax, eax
je 0x140014f1a
lea rax, [0x140034200]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140034230]
mov qword [rbp - 8], rax
jmp 0x140014efe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140014ef2
cmp qword [rbp - 0x10], 0
je 0x140014ef2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140014eb8
lea rax, [0x140034200]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x140014f1b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140015020
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140015048
mov eax, 0
jmp 0x140015096
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140015071
mov eax, 0
jmp 0x140015096
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140015091
mov eax, 0
jmp 0x140015096
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x14001509c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14001511a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140015111
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140015111
mov rax, qword [rbp - 8]
jmp 0x14001512f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x1400150e4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400085c0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rdx
mov rdx, rcx
mov rcx, rax
jmp 0x140012c00
mov rax, qword gs:[0x30]
mov r10, rcx
mov r8, qword [rax + 0x60]
mov r9, qword [r8 + 0x18]
add r9, 0x20
mov rax, qword [r9]
nop dword [rax + rax]
cmp qword [rax + 0x20], rdx
je 0x140012c3d
test rdx, rdx
je 0x140012c3d
mov rax, qword [rax]
cmp rax, r9
jne 0x140012c20
mov qword [rcx], 0
xor eax, eax
ret
mov rcx, qword [rax + 0x40]
mov qword [r10], rcx
movzx eax, word [rax + 0x38]
shr eax, 1
ret