joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140013b80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140070040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140013bad
xor eax, eax
jmp 0x140013d19
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140013be7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140013be7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140013d19
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140013d0c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140013c2a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140013c55
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140013d11
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140013cc4
sub eax, 1
je 0x140013cc4
cmp eax, 2
jne 0x140013d0c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140013d11
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140013cf2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140013d0c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140013d11
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14003ac30
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400168c0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140070040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140016993
cmp byte [rcx + 0x71], 0
je 0x140016993
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14001698f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140016954
sub eax, 1
je 0x140016958
cmp eax, 2
jne 0x14001698f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14003ac30
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140016986
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14001698f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14001693c
xor al, al
jmp 0x14001693c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14003ac30
add rsp, 0x60
pop rbx
ret
Function at 0x140026a30
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140070040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, 0xffff
movzx edi, dx
mov rbx, rcx
cmp si, dx
jne 0x140026a61
xor eax, eax
jmp 0x140026bab
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x140026a9e
mov r9, qword [rcx + 0x58]
movsxd r10, dword [r9]
lea rdx, [r8 + r10*2]
cmp r8, rdx
jae 0x140026a9e
lea ecx, [r10 - 1]
movzx eax, di
mov dword [r9], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], di
jmp 0x140026bab
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x140026ba0
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140026ae5
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140026af3
movzx ecx, di
jmp 0x140026b47
lea rax, [rsp + 0x40]
mov word [rsp + 0x50], di
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x52]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140026b60
sub eax, 1
je 0x140026b60
cmp eax, 2
jne 0x140026ba0
movzx ecx, word [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
cmp ax, si
cmove di, si
movzx eax, di
jmp 0x140026ba3
mov rbp, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x140026b8e
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbp, rax
jne 0x140026ba0
lea rax, [rsp + 0x50]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x48], rax
cmovne si, di
movzx eax, si
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14003ac30
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400276d0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140070040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400277a5
cmp byte [rcx + 0x72], 0
je 0x1400277a5
mov rax, qword [rcx]
mov qword [rsp + 0x78], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x1400277a1
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140027766
sub eax, 1
je 0x14002776a
cmp eax, 2
jne 0x1400277a1
mov byte [rbx + 0x72], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14003ac30
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140027798
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400277a1
cmp byte [rbx + 0x72], 0
sete al
jmp 0x14002774e
xor al, al
jmp 0x14002774e
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14003ac30
add rsp, 0x60
pop rbx
ret
Function at 0x14003a1a8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14003a1e2
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14003a1e7
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14003a230
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14003fae0]
cmp byte [rcx + rax], 0
je 0x14003a230
dec r8
sub rdx, 1
jne 0x14003a216
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14003b8c0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003b90a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003b90a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003b90a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003b90a
cmp dword [rcx + 0x84], 0xe
jbe 0x14003b90a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003b90c
xor al, al
add rsp, 0x28
ret
Function at 0x1400043c0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r13
push r14
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x140038040]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rdi, rcx
mov qword [rsp + 0x58], rcx
xor r13d, r13d
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1c
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xorps xmm0, xmm0
test eax, eax
jne 0x1400045c5
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r13
lea rax, [rbp + 0x80]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r13b
jne 0x140004446
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x60]
call fcn.140020f00
nop
movzx eax, word [0x14002f6ec]
mov word [rsp + 0x30], ax
movzx eax, byte [0x14002f6ee]
mov byte [rsp + 0x30], 0x5c
xor byte [rsp + 0x31], 0x51
xor al, 0x53
mov byte [rsp + 0x32], al
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140004490
lea rsi, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rsi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x70]
test rbx, rbx
je 0x140004538
test r14, r14
je 0x140004538
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x80]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x30]
add rdx, rbx
lea rax, [rsp + 0x30]
cmp rax, rdx
je 0x140004500
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rbp + rax - 0x80], 1
inc rcx
cmp rcx, rdx
jne 0x1400044f0
lea rax, [r14 - 1]
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
add r8, rsi
movzx eax, byte [r8]
cmp byte [rbp + rax - 0x80], 0
jne 0x140004533
cmp r8, rsi
je 0x140004538
dec r8
movzx eax, byte [r8]
cmp byte [rbp + rax - 0x80], 0
je 0x140004520
sub r8, rsi
jmp 0x14000453f
mov r8, 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
cmp r14, r8
cmovb r8, r14
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.140020f00
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x1400045b2
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400045ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400045ad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002a670
movups xmm1, xmmword [rsp + 0x38]
movups xmm2, xmmword [rsp + 0x48]
movups xmmword [rdi], xmm1
movups xmmword [rdi + 0x10], xmm2
jmp 0x1400045e5
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], r13
mov r8d, 0x1b
lea rdx, str.Failed_to_get_AppData_path.
mov rcx, rdi
call fcn.140020f00
mov rax, rdi
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.14002a650
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rbp
ret
Function at 0x140001bd4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001c1e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001c1e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001c1e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001c1e
cmp dword [rcx + 0x84], 0xe
jbe 0x140001c1e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001c20
xor al, al
add rsp, 0x28
ret
Function at 0x140001156
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor eax, eax
cpuid
mov eax, 1
cpuid
movabs r9, 0xb2d05e00
cpuid
rdtsc
shl rdx, 0x20
or rax, rdx
mov rcx, rax
fldpi
frndint
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, rcx
cmp rax, r9
jb 0x140001179
push rbp
mov rbp, rsp
sub rsp, 8
mov r10, 0xa
mov rcx, 0x12345678
dec rcx
xor r9, r9
mov rax, rcx
jne 0x1400011a4
xor rax, rax
mov rax, rbx
add rax, rdx
nop
nop
nop
dec r10
xor r11, r11
jne 0x14000119d
xor rax, rax
mov rax, 0xa
dec rax
nop
nop
add rsp, 8
pop rbp
ret

Function at 0x140003b01
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub rsp, 0xa0
mov rcx, 0
mov rdx, 0xac96
mov r8, 0x1000
lea r9, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x140003b52
mov rbx, rax
call 0x140003b35
nop
pop rsi
mov r9, rax
add rsi, 0x465bc
mov rcx, 0xac96
mov r8, rcx
lea rax, [rsi]
mov dl, byte [rax]
mov byte [rbx], dl
add rsi, 1
add rbx, 1
add rax, 1
dec r8
jne 0x140003b4e
call r9
mov ecx, 1
ret
Function at 0x1400119b0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Set current directory

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x4d0], rbx
mov rax, qword [0x140047650]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov rdi, rdx
mov rbx, rcx
cmp qword [rdx + 0x18], 8
jb 0x1400119f7
mov rcx, qword [rdx]
jmp 0x1400119fa
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140011b40
test al, 0x10
jne 0x140011b40
xor esi, esi
mov qword [rsp + 0x20], rsi
cmp qword [rdi + 0x18], 8
jb 0x140011a22
mov rdi, qword [rdi]
lea r9, [rsp + 0x20]
lea r8, [rbp + 0x180]
mov edx, 0x104
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rsi
mov word [rsp + 0x50], si
cmp word [rbp + 0x180], si
jne 0x140011a5d
mov r9, rsi
jmp 0x140011a7a
lea rax, [rbp + 0x180]
or r9, 0xffffffffffffffff
nop dword [rax + rax]
inc r9
cmp word [rax + r9*2], si
jne 0x140011a70
mov r8, r9
lea rdx, [rbp + 0x180]
lea rcx, [rsp + 0x50]
call fcn.1400073b0
nop
mov rax, qword [rsp + 0x20]
mov word [rax], si
lea rdx, [rsp + 0x70]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
nop
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rsi
mov word [rsp + 0x30], si
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140012550
test al, al
jne 0x140011ae2
xor bl, bl
jmp 0x140011af8
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140010c00
movzx ebx, al
cmp qword [rsp + 0x48], 8
jb 0x140011b0a
mov rcx, qword [rsp + 0x30]
call fcn.14001ac88
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rsi
mov word [rsp + 0x30], si
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
nop
cmp qword [rsp + 0x68], 8
jb 0x140011b3b
mov rcx, qword [rsp + 0x50]
call fcn.14001ac88
movzx eax, bl
jmp 0x140011b7f
add rbx, 0x20
xor r8d, r8d
lea rdx, [0x14003c888]
mov rcx, rbx
call fcn.1400073b0
mov r8d, 0x10
lea rdx, str.File_not_found:
mov rcx, rbx
call fcn.14000a9f0
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call fcn.140009e10
xor al, al
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.14001aca0
mov rbx, qword [rsp + 0x4d0]
add rsp, 0x4a0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140012e30
Capabilities:
Get file system object information

Disassembly:
sub rsp, 0x518
mov rax, qword [0x140047650]
xor rax, rsp
mov qword [rsp + 0x500], rax
lea rdx, [rsp + 0x2f0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x38]
xor edx, edx
mov r8d, 0x2b0
mov qword [rsp + 0x30], 0
call fcn.14001c480
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x2f0]
mov r9d, 0x2b8
xor edx, edx
mov dword [rsp + 0x20], 0x2000
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, 0x4550
cmp ax, cx
jne 0x140012ec9
shr eax, 0x10
test ax, ax
jne 0x140012ec9
mov al, 1
mov rcx, qword [rsp + 0x500]
xor rcx, rsp
call fcn.14001aca0
add rsp, 0x518
ret
xor al, al
mov rcx, qword [rsp + 0x500]
xor rcx, rsp
call fcn.14001aca0
add rsp, 0x518
ret
Function at 0x140014950
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x450
mov rax, qword [0x140047650]
xor rax, rsp
mov qword [rsp + 0x440], rax
lea rax, [rsp + 0x38]
mov r14d, ecx
xor ebx, ebx
lea rdx, str.SOFTWAREParalint.comNotifuDebug
mov esi, 0x80004005
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
lea edi, [rbx + 3]
mov ebp, esi
mov dword [rsp + 0x30], 0x200
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140014a92
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.Level
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140014a0c
cmp dword [rsp + 0x34], 1
jne 0x140014a0c
mov eax, dword [rsp + 0x30]
dec eax
cmp eax, 0x1fe
cmovbe ebp, ebx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
jne 0x140014a92
lea rdx, [rsp + 0x40]
lea rcx, str.None
call fcn.14001b968
test eax, eax
jne 0x140014a34
mov edi, ebx
jmp 0x140014a92
lea rdx, [rsp + 0x40]
lea rcx, str.Error
call fcn.14001b968
test eax, eax
jne 0x140014a4e
lea edi, [rax + 4]
jmp 0x140014a92
lea rdx, [rsp + 0x40]
lea rcx, str.Warning
call fcn.14001b968
test eax, eax
je 0x140014a92
lea rdx, [rsp + 0x40]
lea rcx, str.Info
call fcn.14001b968
test eax, eax
je 0x140014a8d
lea rdx, [rsp + 0x40]
lea rcx, str.Information
call fcn.14001b968
test eax, eax
jne 0x140014a92
mov edi, 2
cmp r14d, edi
jl 0x140014b2d
lea rax, [rsp + 0x38]
lea rdx, str.SOFTWAREParalint.comNotifuDebug
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x30], 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140014b2d
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.Output
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140014b15
cmp dword [rsp + 0x34], 1
jne 0x140014b15
mov eax, dword [rsp + 0x30]
dec eax
cmp eax, 0x1fe
cmovbe esi, ebx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [0x140014930]
test esi, esi
cmove rbx, rax
mov rax, rbx
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14001aca0
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140014d30
Capabilities:
Get file version info

Disassembly:
push rsi
sub rsp, 0x250
mov rax, qword [0x140047650]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rax, rdx
mov rsi, rcx
lea rdx, [rsp + 0x30]
mov rcx, rax
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x140014d84
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x140014e1c
movzx eax, ax
or eax, 0x80070000
jmp 0x140014e1c
mov rcx, qword [rsi + 0x20]
mov qword [rsp + 0x270], rbx
mov qword [rsp + 0x278], rdi
call fcn.14001b6e8
xor ebx, ebx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov qword [rsi + 0x20], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test eax, eax
jne 0x140014dc4
mov ebx, 0x80004005
jmp 0x140014e0a
mov rcx, rdi
call fcn.14001574c
mov qword [rsi + 0x20], rax
test rax, rax
jne 0x140014ddc
mov ebx, 0x8007000e
jmp 0x140014e0a
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r9, rax
mov r8d, edi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x140014e0a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x140014e0a
movzx ebx, ax
or ebx, 0x80070000
mov rdi, qword [rsp + 0x278]
mov eax, ebx
mov rbx, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14001aca0
add rsp, 0x250
pop rsi
ret

Function at 0x140023194
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140022ffc
Function at 0x418300
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41848b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x009f4a58]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00436e60
xorps xmm15, xmm15
mov r14, qword [0x00ae2598]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x418365
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x418374
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x418393
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x4183a3
cmp rbx, 0x1000
jae 0x41836b
jmp 0x41840d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4183b5
xor edx, edx
jmp 0x418404
mov rcx, qword [0x009f4a58]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00436e60
xorps xmm15, xmm15
mov r14, qword [0x00ae2598]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x418399
jmp 0x418388
call fcn.0046e580
xorps xmm15, xmm15
mov r14, qword [0x00ae2598]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.0043b3a0
lea rax, [0x00797c05]
mov ebx, 0x18
nop dword [rax]
call fcn.0043bc20
mov rax, qword [rsp + 0x38]
call fcn.0043b960
lea rax, [0x00798515]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.0043bc20
mov rax, qword [rsp + 0x30]
call fcn.0043b960
call fcn.0043b5e0
call fcn.0043b400
lea rax, [0x0079d322]
mov ebx, 0x21
call fcn.00439900
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046ae20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00418300