joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001df70
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov r10d, edx
movzx r9d, dl
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs rdx, 0x100000001b3
imul r9, rdx
mov eax, r10d
shr eax, 8
movzx ecx, al
xor r9, rcx
imul r9, rdx
mov eax, r10d
shr eax, 0x10
movzx ecx, al
xor r9, rcx
imul r9, rdx
mov eax, r10d
shr rax, 0x18
xor r9, rax
imul r9, rdx
mov rcx, qword [r8 + 0x30]
mov r11, rcx
and r11, r9
mov r9, qword [r8 + 0x18]
add r11, r11
mov rax, qword [r9 + r11*8 + 8]
mov rdx, qword [r8 + 8]
cmp rax, rdx
je 0x14001e00e
mov r8, qword [r9 + r11*8]
nop dword [rax]
cmp r10d, dword [rax + 0x10]
jne 0x14001e009
test rax, rax
cmove rax, rdx
mov qword [rsp + 0x48], rax
cmp rax, rdx
jne 0x14001e053
jmp 0x14001e013
cmp rax, r8
jne 0x14001e05c
mov qword [rsp + 0x48], rdx
movabs rax, 0xad2aca7747985764
mov r8d, 1
and rcx, rax
add rcx, rcx
mov rax, qword [r9 + rcx*8 + 8]
cmp rax, rdx
je 0x14001e062
mov rdx, qword [r9 + rcx*8]
cmp r8d, dword [rax + 0x10]
jne 0x14001e043
add rax, 0x18
jmp 0x14001e057
cmp rax, rdx
je 0x14001e062
mov rax, qword [rax + 8]
jmp 0x14001e037
add rax, 0x18
add rsp, 0x28
ret
mov rax, qword [rax + 8]
jmp 0x14001dff0
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.14002e63c
int3

Function at 0x14001e070
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
mov r10d, edx
movzx r9d, dl
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs rdx, 0x100000001b3
imul r9, rdx
mov eax, r10d
shr eax, 8
movzx ecx, al
xor r9, rcx
imul r9, rdx
mov eax, r10d
shr eax, 0x10
movzx ecx, al
xor r9, rcx
imul r9, rdx
mov eax, r10d
shr rax, 0x18
xor r9, rax
imul r9, rdx
mov rdx, qword [r8 + 0x30]
mov rcx, rdx
and rcx, r9
mov r11, qword [r8 + 0x18]
add rcx, rcx
mov rax, qword [r11 + rcx*8 + 8]
mov r9, qword [r8 + 8]
cmp rax, r9
je 0x14001e10d
mov rcx, qword [r11 + rcx*8]
cmp r10d, dword [rax + 0x10]
je 0x14001e0f8
cmp rax, rcx
je 0x14001e10d
mov rax, qword [rax + 8]
jmp 0x14001e0e7
test rax, rax
cmove rax, r9
cmp rax, r9
je 0x14001e10d
mov rax, qword [rax + 0x18]
add rsp, 0x28
ret
movabs rax, 0xad2aca7747985764
mov r8d, 1
and rdx, rax
add rdx, rdx
mov rax, qword [r11 + rdx*8 + 8]
cmp rax, r9
je 0x14001e14f
mov rcx, qword [r11 + rdx*8]
cmp r8d, dword [rax + 0x10]
jne 0x14001e13d
mov rax, qword [rax + 0x18]
jmp 0x14001e14a
cmp rax, rcx
je 0x14001e14f
mov rax, qword [rax + 8]
jmp 0x14001e131
add rsp, 0x28
ret
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.14002e63c
int3
Function at 0x140021a40
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r15, r8
mov rsi, rdx
mov rdi, rcx
mov edx, dword [r8]
movzx r14d, dl
movabs rax, 0xcbf29ce484222325
xor r14, rax
movabs r8, 0x100000001b3
imul r14, r8
mov eax, edx
shr eax, 8
movzx ecx, al
xor r14, rcx
imul r14, r8
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor r14, rcx
imul r14, r8
mov eax, edx
shr rax, 0x18
xor r14, rax
imul r14, r8
mov rcx, qword [rdi + 0x30]
and rcx, r14
add rcx, rcx
mov r8, qword [rdi + 0x18]
mov rax, qword [r8 + rcx*8 + 8]
lea r12, [rdi + 8]
mov rbp, qword [r12]
cmp rax, rbp
je 0x140021afa
mov rcx, qword [r8 + rcx*8]
cmp edx, dword [rax + 0x10]
je 0x140021ade
nop
cmp rax, rcx
je 0x140021af7
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x140021ad0
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov rax, rsi
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rbp, rax
movabs rax, 0xaaaaaaaaaaaaaaa
cmp qword [rdi + 0x10], rax
je 0x140021c80
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], 0
mov ecx, 0x18
call fcn.140053508
mov rbx, rax
mov qword [rsp + 0x28], rax
mov eax, dword [r15]
mov dword [rbx + 0x10], eax
mov eax, dword [r15 + 4]
mov dword [rbx + 0x14], eax
mov r8, qword [rdi + 0x10]
lea rdx, [r8 + 1]
xorps xmm0, xmm0
test rdx, rdx
js 0x140021b52
cvtsi2ss xmm0, rdx
jmp 0x140021b6a
mov rcx, rdx
shr rcx, 1
mov rax, rdx
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
mov rcx, qword [rdi + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x140021b7d
cvtsi2ss xmm1, rcx
jmp 0x140021b92
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rdi]
seta al
test al, al
je 0x140021c15
mov rcx, rdi
call fcn.14001c9f0
mov rdx, rax
mov rcx, rdi
call fcn.14001c820
mov rdx, qword [rdi + 0x30]
and rdx, r14
add rdx, rdx
mov r8, qword [rdi + 0x18]
mov rcx, qword [r8 + rdx*8 + 8]
mov rax, qword [r12]
cmp rcx, rax
jne 0x140021bda
mov qword [rsp + 0x28], 0
jmp 0x140021bfc
mov rdx, qword [r8 + rdx*8]
mov eax, dword [rbx + 0x10]
cmp eax, dword [rcx + 0x10]
je 0x140021bf4
cmp rcx, rdx
je 0x140021c4d
mov rcx, qword [rcx + 8]
cmp eax, dword [rcx + 0x10]
jne 0x140021be6
mov rax, qword [rcx]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov r8, qword [rdi + 0x10]
mov rbp, qword [rsp + 0x20]
mov rdx, qword [rbp + 8]
lea rax, [r8 + 1]
mov qword [rdi + 0x10], rax
mov qword [rbx], rbp
mov qword [rbx + 8], rdx
mov qword [rdx], rbx
mov qword [rbp + 8], rbx
mov rcx, qword [rdi + 0x18]
mov rax, qword [rdi + 0x30]
and rax, r14
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [r12]
jne 0x140021c5d
mov qword [rcx + rax*8], rbx
jmp 0x140021c6f
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], 0
jmp 0x140021c01
cmp r8, rbp
jne 0x140021c68
mov qword [rcx + rax*8], rbx
jmp 0x140021c74
cmp qword [rcx + rax*8 + 8], rdx
jne 0x140021c74
mov qword [rcx + rax*8 + 8], rbx
mov qword [rsi], rbx
mov byte [rsi + 8], 1
jmp 0x140021ae5
lea rcx, str.unordered_map_set_too_long
call fcn.14002e618
int3
Function at 0x140021c90
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
mov r10d, edx
movzx r9d, dl
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs rdx, 0x100000001b3
imul r9, rdx
mov eax, r10d
shr eax, 8
movzx ecx, al
xor r9, rcx
imul r9, rdx
mov eax, r10d
shr eax, 0x10
movzx ecx, al
xor r9, rcx
imul r9, rdx
mov eax, r10d
shr rax, 0x18
xor r9, rax
imul r9, rdx
mov rdx, qword [r8 + 0x30]
mov rcx, rdx
and rcx, r9
mov r11, qword [r8 + 0x18]
add rcx, rcx
mov rax, qword [r11 + rcx*8 + 8]
mov r9, qword [r8 + 8]
cmp rax, r9
je 0x140021d2d
mov rcx, qword [r11 + rcx*8]
cmp r10d, dword [rax + 0x10]
je 0x140021d18
cmp rax, rcx
je 0x140021d2d
mov rax, qword [rax + 8]
jmp 0x140021d07
test rax, rax
cmove rax, r9
cmp rax, r9
je 0x140021d2d
movzx eax, byte [rax + 0x14]
add rsp, 0x28
ret
movabs rax, 0xad2aca7747985764
mov r8d, 1
and rdx, rax
add rdx, rdx
mov rax, qword [r11 + rdx*8 + 8]
cmp rax, r9
je 0x140021d6f
mov rcx, qword [r11 + rdx*8]
cmp r8d, dword [rax + 0x10]
jne 0x140021d5d
movzx eax, byte [rax + 0x14]
jmp 0x140021d6a
cmp rax, rcx
je 0x140021d6f
mov rax, qword [rax + 8]
jmp 0x140021d51
add rsp, 0x28
ret
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.14002e63c
int3

Function at 0x140021d80
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov r10d, edx
movzx r9d, dl
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs rdx, 0x100000001b3
imul r9, rdx
mov eax, r10d
shr eax, 8
movzx ecx, al
xor r9, rcx
imul r9, rdx
mov eax, r10d
shr eax, 0x10
movzx ecx, al
xor r9, rcx
imul r9, rdx
mov eax, r10d
shr rax, 0x18
xor r9, rax
imul r9, rdx
mov rcx, qword [r8 + 0x30]
mov r11, rcx
and r11, r9
mov r9, qword [r8 + 0x18]
add r11, r11
mov rax, qword [r9 + r11*8 + 8]
mov rdx, qword [r8 + 8]
cmp rax, rdx
je 0x140021e1e
mov r8, qword [r9 + r11*8]
nop dword [rax]
cmp r10d, dword [rax + 0x10]
jne 0x140021e19
test rax, rax
cmove rax, rdx
mov qword [rsp + 0x48], rax
cmp rax, rdx
jne 0x140021e63
jmp 0x140021e23
cmp rax, r8
jne 0x140021e6c
mov qword [rsp + 0x48], rdx
movabs rax, 0xad2aca7747985764
mov r8d, 1
and rcx, rax
add rcx, rcx
mov rax, qword [r9 + rcx*8 + 8]
cmp rax, rdx
je 0x140021e72
mov rdx, qword [r9 + rcx*8]
cmp r8d, dword [rax + 0x10]
jne 0x140021e53
add rax, 0x14
jmp 0x140021e67
cmp rax, rdx
je 0x140021e72
mov rax, qword [rax + 8]
jmp 0x140021e47
add rax, 0x14
add rsp, 0x28
ret
mov rax, qword [rax + 8]
jmp 0x140021e00
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.14002e63c
int3
Function at 0x1400238e0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x140023a9e
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.14001bdd0
mov qword [rsi + 0x38], rdi
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x140023a67
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
mov r10d, dword [rcx + 0x10]
mov r11, qword [rsi + 0x30]
mov eax, r10d
mov rdx, qword [rdx]
shr eax, 8
movzx r8d, al
mov eax, r10d
shr eax, 0x10
movzx r9d, r10b
xor r9, rbp
imul r9, rdi
xor r9, r8
movzx r8d, al
imul r9, rdi
mov eax, r10d
xor r9, r8
shr rax, 0x18
imul r9, rdi
xor r9, rax
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1400239d6
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x140023a56
mov rax, qword [r11 + 8]
cmp r10d, dword [rax + 0x10]
jne 0x140023a0f
mov r10, qword [rax]
cmp r10, rcx
je 0x140023a09
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x140023a56
mov r8, rax
cmp r9, rax
je 0x140023a32
nop word [rax + rax]
mov rax, qword [rax + 8]
mov r8, rax
cmp r10d, dword [rax + 0x10]
je 0x140023a78
cmp r9, rax
jne 0x140023a20
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x140023971
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x140023a56
lea rcx, str.invalid_hash_bucket_count
call fcn.14002e618
int3
Function at 0x140049d0c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x140034d9a
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x140034d7d
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x140034d68

Function at 0x1400692d4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140069100

Function at 0x14007072c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x140070452
call fcn.14005d9a0
mov dword [rax], 0x16
call fcn.14005f6cc
jmp 0x14007059d
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14007059d
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14007059d
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x140070481
lock or dword [rcx + 0x14], 0x10
jmp 0x14007059d
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x140070495
call fcn.14006f2c8
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x1400704a5
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x1400704a8
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.14006bf20
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.140072e68
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x14007058b
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x140070539
mov rcx, rbx
call fcn.14006bf20
cmp eax, 0xffffffff
je 0x140070524
mov rcx, rbx
call fcn.14006bf20
cmp eax, 0xfffffffe
je 0x140070524
mov rcx, rbx
call fcn.14006bf20
movsxd rdi, eax
lea r14, [0x1400a7950]
mov rcx, rbx
sar rdi, 6
call fcn.14006bf20
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x14007052b
lea rdx, [0x1400a32a0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140070539
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x14007055d
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x14007055d
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x14007055d
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x14007057b
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x140070586
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x1400705a2
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x14007041c
Function at 0x140001540
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x38
lea rax, str.ntdll.dll
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtDeviceIoControlFile
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14102a198], rax
cmp qword [0x14102a198], 0
jne 0x140001597
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_while_resolving_NtDeviceIoControlFile:__d_n
call fcn.1400026e0
xor eax, eax
jmp 0x140001740
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtOpenThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14102a188], rax
cmp qword [0x14102a188], 0
jne 0x1400015de
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_while_resolving_NtOpenThread:__d_n
call fcn.1400026e0
xor eax, eax
jmp 0x140001740
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtOpenProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14102a190], rax
cmp qword [0x14102a190], 0
jne 0x140001625
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_while_resolving_NtOpenProcess:__d_n
call fcn.1400026e0
xor eax, eax
jmp 0x140001740
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtQuerySystemInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14102a1b8], rax
cmp qword [0x14102a1b8], 0
jne 0x14000166c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_while_resolving_NtQuerySystemInformation:__d_n
call fcn.1400026e0
xor eax, eax
jmp 0x140001740
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtWriteVirtualMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14102a1a8], rax
cmp qword [0x14102a1a8], 0
jne 0x1400016b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_while_resolving_NtWriteVirtualMemory:__d_n
call fcn.1400026e0
xor eax, eax
jmp 0x140001740
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtReadVirtualMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14102a1a0], rax
cmp qword [0x14102a1a0], 0
jne 0x1400016f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_while_resolving_NtReadVirtualMemory:__d_n
call fcn.1400026e0
xor eax, eax
jmp 0x140001740
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtFsControlFile
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14102a1b0], rax
cmp qword [0x14102a1b0], 0
jne 0x14000173b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_while_resolving_NtFsControlFile:__d_n
call fcn.1400026e0
xor eax, eax
jmp 0x140001740
mov eax, 1
add rsp, 0x38
ret
Function at 0x140001750
Capabilities:
Create pipe
Make suspicious ntfscontrolfile call

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x140028478]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x50], 0
jmp 0x140001786
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0x10000
jge 0x1400019a9
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x20], eax
mov r9d, 0xff
xor r8d, r8d
mov edx, 0x40000002
lea rcx, [0x140027078]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
movsxd rcx, dword [rsp + 0x50]
lea rdx, [0x140c2a180]
mov qword [rdx + rcx*8], rax
movsxd rax, dword [rsp + 0x50]
lea rcx, [0x140c2a180]
cmp qword [rcx + rax*8], 0xffffffffffffffff
jne 0x140001814
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x1400270b0]
call fcn.1400026e0
xor eax, eax
jmp 0x1400019ae
mov r8d, 0x20
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.140003bb0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
jne 0x140001861
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140027110]
call fcn.1400026e0
xor eax, eax
jmp 0x1400019ae
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
lea rcx, [0x140027150]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
movsxd rcx, dword [rsp + 0x50]
lea rdx, [0x14082a140]
mov qword [rdx + rcx*8], rax
movsxd rax, dword [rsp + 0x50]
lea rcx, [0x14082a140]
cmp qword [rcx + rax*8], 0xffffffffffffffff
jne 0x1400018d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140027180]
call fcn.1400026e0
xor eax, eax
jmp 0x1400019ae
movsxd rax, dword [rsp + 0x50]
lea rcx, [0x140c2a180]
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov edx, dword [rsp + 0xb8]
mov dword [rsp + 0x38], edx
mov rdx, qword [rsp + 0xb0]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0x119ff8
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + rax*8]
call qword [0x14102a1b0]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0x103
jne 0x14000197e
movsxd rax, dword [rsp + 0x50]
lea rcx, [0x14082a140]
mov r9d, 1
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x58]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x14000197c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x1400271e0]
call fcn.1400026e0
xor eax, eax
jmp 0x1400019ae
jmp 0x140001999
cmp dword [rsp + 0x54], 0
je 0x140001999
mov edx, dword [rsp + 0x54]
lea rcx, [0x140027230]
call fcn.1400026e0
xor eax, eax
jmp 0x1400019ae
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000177c
mov eax, 1
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400027e0
add rsp, 0xa8
ret
Function at 0x1400031d4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000321e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000321e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000321e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000321e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000321e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003220
xor al, al
add rsp, 0x28
ret

Function at 0x14000c698
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000c488
Function at 0x1400128fc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14001292c
xor eax, eax
jmp 0x1400129ef
mov rbp, rbx
cmp word [rax], si
je 0x140012951
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140012938
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140012934
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14001284c
movsxd r14, eax
test eax, eax
jne 0x14001298f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140012925
mov rcx, r14
call fcn.14000cfbc
mov rdi, rax
test rax, rax
jne 0x1400129a8
xor ecx, ecx
call fcn.14000d500
jmp 0x140012984
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14001284c
test eax, eax
jne 0x1400129d9
mov rcx, rdi
call fcn.14000d500
jmp 0x1400129e3
xor ecx, ecx
call fcn.14000d500
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140018704
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14000e3ac
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14001878e
cmp byte [rbp - 0x21], r15b
je 0x140018789
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400187c4
call fcn.14000e7c8
test eax, eax
jne 0x1400187b0
cmp byte [rbp - 0x21], r15b
je 0x1400187a8
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400187c4
cmp byte [rbp - 0x21], r15b
je 0x1400187c1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14000e230
test eax, eax
jne 0x140018864
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000e3ac
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140018803
cmp byte [rbp - 0x21], r15b
je 0x140018838
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140018838
call fcn.14000e7c8
test eax, eax
jne 0x140018824
cmp byte [rbp - 0x21], r15b
je 0x14001881d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140018838
cmp byte [rbp - 0x21], r15b
je 0x140018835
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14000e230
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140018864
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140018867
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140018875
mov rcx, rdi
call fcn.14000d500
cmp byte [rbp + 0x3f], r15b
je 0x140018884
mov rcx, qword [rbp + 0x27]
call fcn.14000d500
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret