joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009ed0
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x188
mov rax, qword [0x140050688]
xor rax, rsp
mov qword [rsp + 0x178], rax
cmp dword [rsp + 0x1a8], 2
jne 0x140009f11
mov eax, 1
jmp 0x14000a02a
lea r8, str.Clean_up_registry...
mov edx, 0x3e9
mov rcx, qword [rsp + 0x190]
call qword [sym.imp.USER32.dll_SetDlgItemTextA]
lea rax, [rsp + 0x170]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rsp + 0x1a0]
mov rcx, qword [rsp + 0x198]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x14000a001
mov r9d, 0x104
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x170]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x44], 0x104
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x170]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x4c], 0
je 0x140009ff3
cmp dword [rsp + 0x48], 0
je 0x140009ff3
mov rdx, qword [rsp + 0x1a0]
mov rcx, qword [rsp + 0x198]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rcx, qword [rsp + 0x170]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 0x3e8
mov rcx, qword [rsp + 0x190]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x405
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageA]
xor eax, eax
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14001f810
add rsp, 0x188
ret

Function at 0x14000a050
Capabilities:
Delete file

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x158
mov rax, qword [0x140050688]
xor rax, rsp
mov qword [rsp + 0x148], rax
cmp dword [rsp + 0x178], 2
jne 0x14000a091
mov eax, 1
jmp 0x14000a138
lea r8, str.Clean_up_files...
mov edx, 0x3e9
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.USER32.dll_SetDlgItemTextA]
mov rdx, qword [rsp + 0x168]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rdx, qword [rsp + 0x170]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [rsp + 0x178], 0
jne 0x14000a0f3
lea r8, [rsp + 0x30]
mov edx, 0x3e9
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.USER32.dll_SetDlgItemTextA]
lea rcx, [rsp + 0x30]
call fcn.140001f60
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [rsp + 0x140], eax
mov edx, 0x3e8
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x405
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageA]
xor eax, eax
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
call fcn.14001f810
add rsp, 0x158
ret
Function at 0x14000a160
Capabilities:
Delete directory

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
cmp dword [rsp + 0x50], 2
jne 0x14000a181
mov eax, 1
jmp 0x14000a1d2
cmp dword [rsp + 0x50], 0
jne 0x14000a19d
mov r8, qword [rsp + 0x48]
mov edx, 0x3e9
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.USER32.dll_SetDlgItemTextA]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov dword [rsp + 0x20], eax
mov edx, 0x3e8
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x405
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageA]
xor eax, eax
add rsp, 0x38
ret
Function at 0x14000a210
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x4e8
mov rax, qword [0x140050688]
xor rax, rsp
mov qword [rsp + 0x4d8], rax
cmp dword [rsp + 0x4f8], 2
jne 0x14000a246
mov eax, 1
jmp 0x14000a484
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x14000a261
xor eax, eax
jmp 0x14000a484
lea rdx, str.inf
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea r8, [rsp + 0x50]
lea rdx, str._soem.inf
lea rcx, [rsp + 0x170]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x168], rax
cmp qword [rsp + 0x168], 0xffffffffffffffff
je 0x14000a2c3
mov dword [rsp + 0x4d0], 1
jmp 0x14000a2ce
mov dword [rsp + 0x4d0], 0
mov eax, dword [rsp + 0x4d0]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x14000a474
xor r9d, r9d
mov r8d, 2
lea rdx, str.Mouse
lea rcx, [rsp + 0x2ac]
call qword [sym.imp.SETUPAPI.dll_SetupOpenInfFileA]
mov qword [rsp + 0x160], rax
cmp qword [rsp + 0x160], 0xffffffffffffffff
je 0x14000a455
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x104
lea rax, [rsp + 0x3c0]
mov qword [rsp + 0x20], rax
lea r9, str.CatalogFile
lea r8, str.Version
mov rdx, qword [rsp + 0x160]
xor ecx, ecx
call qword [sym.imp.SETUPAPI.dll_SetupGetLineTextA]
test eax, eax
je 0x14000a447
lea rdx, str.Apfiltr.cat
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x14000a447
cmp qword [0x140052308], 0
je 0x14000a3c7
lea r8, [rsp + 0x2ac]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.SHLWAPI.dll_PathCombineA]
lea rcx, [rsp + 0x3c0]
call fcn.140001f60
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x2ac]
call qword [0x140052308]
jmp 0x14000a447
lea r8, [rsp + 0x2ac]
lea rdx, [0x14003e634]
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9d, 1
lea r8, [rsp + 0x3c0]
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x4f0]
call fcn.14000a050
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.SHLWAPI.dll_PathRemoveExtensionA]
lea rdx, str..PNF
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.SHLWAPI.dll_PathAddExtensionA]
mov r9d, 1
lea r8, [rsp + 0x3c0]
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x4f0]
call fcn.14000a050
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
lea rdx, [rsp + 0x280]
mov rcx, qword [rsp + 0x168]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [rsp + 0x40], eax
jmp 0x14000a2d9
mov rcx, qword [rsp + 0x168]
call qword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov rcx, qword [rsp + 0x4d8]
xor rcx, rsp
call fcn.14001f810
add rsp, 0x4e8
ret
Function at 0x14000a4b0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x2b8
mov rax, qword [0x140050688]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov dword [rsp + 0x298], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [0x14003e660]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x4c], 0
je 0x14000a51b
mov eax, dword [rsp + 0x298]
jmp 0x14000a6ef
mov dword [rsp + 0x50], 0x104
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x4c], 0
je 0x14000a581
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x298]
jmp 0x14000a6ef
mov dword [rsp + 0x54], 1
jmp 0x14000a596
mov eax, dword [rsp + 0x54]
add eax, 1
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x4c], 0
jne 0x14000a6dd
lea rax, [rsp + 0x290]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x4c], 0
jne 0x14000a674
mov dword [rsp + 0x50], 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.TapTyping
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x4c], 0
jne 0x14000a674
lea r9, [rsp + 0x70]
lea r8, str.SYSTEMCurrentControlSetControlClass4D36E96F_E325_11CE_BFC1_08002BE10318
lea rdx, str._s_s
lea rcx, [rsp + 0x180]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
cmp eax, dword [rsp + 0x2c8]
ja 0x14000a674
lea rdx, [rsp + 0x180]
mov rcx, qword [rsp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [rsp + 0x298], 1
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x298], 0
je 0x14000a68e
jmp 0x14000a6dd
mov dword [rsp + 0x50], 0x104
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x70]
mov edx, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [rsp + 0x4c], eax
jmp 0x14000a58b
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x298]
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.14001f810
add rsp, 0x2b8
ret
Function at 0x14000d708
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x180
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140050688]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rdx
lea r8, [rsp + 0x30]
mov rdx, qword [rdx]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov ebx, eax
test eax, eax
jne 0x14000d807
mov r9d, 0x104
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov ebx, eax
test eax, eax
jne 0x14000d7de
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x28]
call fcn.14000c07c
nop
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
call fcn.14000d708
mov ebx, eax
test eax, eax
setne byte [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14000d7c5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp byte [rsp + 0x20], 0
je 0x14000d7ce
jmp 0x14000d7de
jmp 0x14000d75e
cmp ebx, 0x103
je 0x14000d7ee
cmp ebx, 0x3f2
jne 0x14000d7fc
mov rdx, qword [rsi]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ebx, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14001f810
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14000f150
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test rdx, 0xffffffffffff0000
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xb0], rdx
jne 0x14000f18f
cmp dword [rcx + 0xa8], 0
jne 0x14000f18f
movzx eax, dx
mov dword [rcx + 0xa8], eax
call fcn.1400191a0
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.14000f0f4
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140011208
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
call fcn.1400191f0
mov rbx, rax
mov rax, qword [rax + 0x78]
test rax, rax
je 0x14001123f
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x14001123f
xor r9d, r9d
xor r8d, r8d
mov edx, 0x401
call qword [sym.imp.USER32.dll_SendMessageA]
test edi, edi
mov rbx, qword [rbx + 0xa0]
je 0x14001126f
test rbx, rbx
je 0x14001126f
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x14001126f
mov rax, qword [rbx]
or rdx, 0xffffffffffffffff
mov rcx, rbx
call qword [rax + 0x2d0]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140017194
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
test rdx, rdx
mov rsi, rdx
mov rbp, rcx
je 0x1400171fc
call fcn.1400191a0
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
je 0x1400171fc
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rbx, rax
je 0x14001721e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.140016bf0
test rdi, rdi
mov esi, eax
je 0x14001721c
test rbx, rbx
je 0x14001721c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x140019a60
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x130
mov rax, qword [0x140050688]
xor rax, rsp
mov qword [rsp + 0x120], rax
test rcx, rcx
mov rbx, rdx
mov rdi, rcx
jne 0x140019a95
call fcn.140019510
int3
test rdx, rdx
jne 0x140019aa0
call fcn.140019510
int3
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x20], 0
mov esi, eax
call fcn.140020cb0
mov r8d, 0x100
cmp esi, r8d
ja 0x140019af1
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, esi
jne 0x140019af1
lea rcx, [rsp + 0x20]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x140019afd
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetWindowTextA]
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.14001f810
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14001a374
Capabilities:
Set thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov esi, 1
mov r14, r8
mov rdi, rdx
cmp dword [rdx + 0x10], esi
mov r12, rcx
mov ebp, esi
jle 0x14001a401
lea ebx, [rsi + 7]
lea r13d, [rsi + 0xf]
test r14, r14
je 0x14001a3cd
mov rax, qword [r12 + 0x10]
cmp qword [rax + r13 + 8], r14
je 0x14001a3cd
mov rax, qword [rdi + 0x18]
cmp qword [rbx + rax], 0
je 0x14001a3ed
xor esi, esi
jmp 0x14001a3ed
mov rax, qword [rdi + 0x18]
mov rcx, qword [rbx + rax]
test rcx, rcx
je 0x14001a3e4
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rax, qword [rdi + 0x18]
and qword [rbx + rax], 0
add ebp, 1
add r13, 0x10
add rbx, 8
cmp ebp, dword [rdi + 0x10]
jl 0x14001a3ad
test esi, esi
je 0x14001a448
lea rcx, [r12 + 0x28]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [r12 + 0x18]
mov rdx, rdi
call fcn.140019e94
lea rcx, [r12 + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r11, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [r11]
mov ecx, dword [r12]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x140023017
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140050688]
jne 0x14001f82a
rol rcx, 0x10
test cx, 0xffff
jne 0x14001f826
repz ret
ror rcx, 0x10
jmp 0x140022f70
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140055d60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140055e58]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140022ff5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140055d60]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140023017
mov rax, qword [rsp + 0x88]
mov qword [0x140055e58], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140055df8], rax
mov rax, qword [0x140055e58]
mov qword [0x140055cd0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140055de0], rax
mov dword [0x140055cc0], 0xc0000409
mov dword [0x140055cc4], 1
mov rax, qword [0x140050688]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140050690]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140055d58], eax
mov ecx, 1
call fcn.14002e640
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140041c68]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140055d58], 0
jne 0x14002309e
mov ecx, 1
call fcn.14002e640
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x140025090
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x5b0
mov rbp, rcx
mov rcx, qword [0x140056280]
mov ebx, r9d
mov rdi, r8
mov rsi, rdx
call fcn.140024140
test rax, rax
je 0x1400250e4
mov r10, qword [rsp + 0x5e0]
mov r9d, ebx
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], r10
call rax
jmp 0x140025179
mov ecx, 2
call fcn.14002e640
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x98
call fcn.140020cb0
mov rax, qword [rsp + 0x5b8]
mov dword [rsp + 0x40], 0xc000000d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x140025165
test ebx, ebx
jne 0x140025165
lea ecx, [rax + 2]
call fcn.14002e640
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc000000d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400276c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
sub rsp, 0x30
lea r12, [0x140050f50]
xor esi, esi
mov edi, ecx
mov rax, r12
mov ebx, esi
nop
cmp ecx, dword [rax]
je 0x1400276fe
add ebx, 1
add rax, 0x10
cmp ebx, 0x17
jb 0x1400276e0
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
cmp ebx, 0x17
jae 0x1400278e5
mov ecx, 3
call fcn.1400308b0
cmp eax, 1
je 0x14002789c
mov ecx, 3
call fcn.1400308b0
test eax, eax
jne 0x140027735
cmp dword [0x1400506d0], 1
je 0x14002789c
cmp edi, 0xfc
je 0x1400278e5
mov qword [rsp + 0x50], rbp
lea rbp, [0x140056290]
lea r8, str.Runtime_Error__n_nProgram:
mov rcx, rbp
mov edx, 0x314
call fcn.1400209c0
test eax, eax
je 0x140027779
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140024ff0
lea rdx, [0x1400562a9]
mov r8d, 0x104
xor ecx, ecx
mov byte [0x1400563ad], sil
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1400277c9
lea r8, str._program_name_unknown_
lea rcx, [0x1400562a9]
mov edx, 0x2fb
call fcn.1400209c0
test eax, eax
je 0x1400277c9
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140024ff0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x1400562a9]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 0x3c
jbe 0x140027818
lea rcx, [rcx + rbp - 0x23]
lea rdx, [0x1400565a4]
lea r9d, [rax + 3]
lea r8, [0x1400423d4]
sub rdx, rcx
call fcn.140022640
test eax, eax
je 0x140027818
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140024ff0
lea r8, [0x1400423d0]
mov edx, 0x314
mov rcx, rbp
call fcn.140020900
test eax, eax
je 0x140027844
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140024ff0
movsxd r8, ebx
mov edx, 0x314
mov rcx, rbp
add r8, r8
mov r8, qword [r12 + r8*8 + 8]
call fcn.140020900
test eax, eax
je 0x140027874
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140024ff0
lea rdx, str.Microsoft_Visual_C_Runtime_Library
mov r8d, 0x12010
mov rcx, rbp
call fcn.140030650
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x1400278e5
cmp rax, 0xffffffffffffffff
je 0x1400278e5
xor eax, eax
movsxd rcx, ebx
lea r9, [rsp + 0x58]
add rcx, rcx
mov qword [rsp + 0x20], rsi
mov rdx, qword [r12 + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x140027900
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov ecx, 3
call fcn.1400308b0
cmp eax, 1
je 0x140027932
mov ecx, 3
call fcn.1400308b0
test eax, eax
jne 0x1400279e6
cmp dword [0x1400506d0], 1
jne 0x1400279e6
mov qword [rsp + 0x48], rbx
lea rbx, [0x140050f50]
mov qword [rsp + 0x30], rdi
mov rax, rbx
xor edi, edi
cmp dword [rax], 0xfc
je 0x14002795e
add edi, 1
add rax, 0x10
cmp edi, 0x17
jb 0x140027948
jmp 0x1400279d2
cmp edi, 0x17
jae 0x1400279d2
mov ecx, 3
call fcn.1400308b0
cmp eax, 1
je 0x140027989
mov ecx, 3
call fcn.1400308b0
test eax, eax
jne 0x1400279d2
cmp dword [0x1400506d0], 1
jne 0x1400279d2
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x1400279d2
cmp rax, 0xffffffffffffffff
je 0x1400279d2
movsxd rcx, edi
xor eax, eax
lea r9, [rsp + 0x40]
add rcx, rcx
mov qword [rsp + 0x20], rax
mov rdx, qword [rbx + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xff
call fcn.1400276c0
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret