joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400697e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
cmp byte [rcx], 0x23
mov rbp, rdx
mov rbx, rcx
sete sil
test sil, sil
je 0x14006980f
inc rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, rbp
inc eax
lea edx, [rax + rax*2]
call fcn.1400632e0
mov r11, qword [rbp]
xor edi, edi
xor cl, cl
mov byte [r11], 0
mov edx, edi
mov r12, r11
cmp byte [rbx], cl
je 0x140069861
nop word [rax + rax]
movzx eax, byte [rbx]
cmp al, 0x3d
jne 0x1400698e1
test cl, cl
jle 0x140069859
mov byte [r11], dl
inc r11
xor cl, cl
mov edx, edi
inc rbx
cmp byte [rbx], dil
jne 0x140069840
mov rcx, r12
mov byte [r11], dil
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test sil, sil
je 0x1400698c2
mov r8, rdi
movsxd r9, eax
test eax, eax
jle 0x1400698c2
lea r10, [0x14014d938]
nop word [rax + rax]
mov eax, 0x66666667
inc r8
imul edi
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, edi
inc edi
lea ecx, [rdx + rdx*4]
shl ecx, 2
sub eax, ecx
movsxd rcx, eax
movzx eax, byte [rcx + r10]
xor byte [r8 + r12 - 1], al
cmp r8, r9
jl 0x140069890
mov rax, qword [rbp]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
cmp al, 0x2b
jne 0x1400698e9
xor al, al
jmp 0x140069907
cmp al, 0x2f
jne 0x1400698f1
mov al, 1
jmp 0x140069907
cmp al, 0x39
ja 0x1400698f9
add al, 0xd2
jmp 0x140069907
cmp al, 0x5a
ja 0x140069901
add al, 0xcb
jmp 0x140069907
cmp al, 0x7a
ja 0x140069944
add al, 0xc5
movzx r8d, al
test r8d, r8d
js 0x140069944
shl r8d, cl
or edx, r8d
add cl, 6
nop dword [rax]
cmp cl, 8
jge 0x140069936
test cl, cl
jle 0x140069859
cmp byte [rbx], dil
jne 0x140069859
mov byte [r11], dl
inc r11
shr edx, 8
add cl, 0xf8
jmp 0x140069920
xor eax, eax
jmp 0x1400698c6
Function at 0x140069950
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movzx r13d, r8b
mov r14, rdx
mov rbp, rcx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [rsp + 0x50]
mov esi, eax
mov r12d, eax
call fcn.140063230
lea r15, [0x140000000]
test r13b, r13b
jne 0x140069a2e
mov eax, 0x14
lea rcx, [rsp + 0x50]
cmp r12d, eax
cmovl r12d, eax
lea ebx, [r12 + 2]
mov edx, ebx
call fcn.1400632e0
mov rdi, qword [rsp + 0x50]
movsxd r8, ebx
mov rcx, rdi
xor edx, edx
call fcn.14010c6c0
lea r11d, [rsi + 1]
mov rdx, rbp
movsxd r8, r11d
mov rcx, rdi
call fcn.14010cd30
xor ebp, ebp
movsxd r9, r12d
mov r11d, ebp
mov r8, rbp
test r12d, r12d
jle 0x140069a29
nop
mov eax, 0x66666667
inc r8
imul r11d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r11d
inc r11d
lea ecx, [rdx + rdx*4]
shl ecx, 2
sub eax, ecx
movsxd rcx, eax
movzx eax, byte [rcx + r15 + 0x14d938]
xor byte [r8 + rdi - 1], al
cmp r8, r9
jl 0x1400699f0
mov esi, r12d
jmp 0x140069a30
xor ebp, ebp
lea edx, [rsi + rsi*2 + 0xd]
mov rcx, r14
call fcn.1400635c0
mov rbx, qword [r14]
mov word [rbx], bp
add rbx, 2
mov word [rbx], bp
cmp byte [rdi], 0
je 0x140069b2c
test r13b, r13b
jne 0x140069a64
mov eax, 0x23
add rbx, 2
mov word [rbx - 2], ax
movsxd r8, r12d
mov word [rbx], bp
movzx edx, byte [rdi]
add r8, rdi
mov cl, 8
mov r9d, 0x3d
inc rdi
nop dword [rax + rax]
cmp cl, 6
jge 0x140069a8e
test cl, cl
jle 0x140069ae8
cmp rdi, r8
jne 0x140069aeb
movzx eax, dl
and al, 0x3f
test r13b, r13b
je 0x140069aa5
movzx eax, al
mov al, byte [rax + r15 + 0x14d8f0]
jmp 0x140069acb
test al, al
jne 0x140069aad
mov al, 0x2b
jmp 0x140069acb
cmp al, 1
jne 0x140069ab5
mov al, 0x2f
jmp 0x140069acb
cmp al, 0xc
jae 0x140069abd
add al, 0x2e
jmp 0x140069acb
cmp al, 0x26
jae 0x140069ac5
add al, 0x35
jmp 0x140069acb
cmp al, 0x40
jae 0x140069acb
add al, 0x3b
movzx eax, al
add rbx, 2
shr edx, 6
add cl, 0xfa
mov word [rbx - 2], ax
jns 0x140069a80
mov word [rbx], r9w
add rbx, 2
jmp 0x140069a80
cmp rdi, r8
jae 0x140069b1e
movzx eax, byte [rdi]
inc rdi
shl eax, cl
add cl, 8
or edx, eax
cmp rdi, r8
jae 0x140069b1e
movzx eax, byte [rdi]
inc rdi
shl eax, cl
add cl, 8
or edx, eax
cmp rdi, r8
jae 0x140069b1e
movzx eax, byte [rdi]
inc rdi
shl eax, cl
or edx, eax
add cl, 8
test cl, cl
jg 0x140069a80
mov word [rbx], bp
mov rbx, qword [r14]
lea rcx, [rsp + 0x50]
call fcn.14005b520
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140069bd0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
lea rcx, [rsp + 0x30]
lea edx, [rax + rax*2]
call fcn.1400632b0
mov rdx, qword [rsp + 0x30]
xor r10d, r10d
mov byte [rdx], 0x20
lea r9, [rdx + 1]
xor cl, cl
mov byte [r9], 0
mov r8d, r10d
cmp byte [rbx], cl
je 0x140069c2f
movzx eax, byte [rbx]
cmp al, 0x3d
jne 0x140069c5f
test cl, cl
jle 0x140069c27
mov byte [r9], r8b
inc r9
xor cl, cl
mov r8d, r10d
inc rbx
cmp byte [rbx], r10b
jne 0x140069c11
mov byte [r9], r10b
or r8d, 0xffffffff
mov rcx, rdi
mov r9d, 0xfde9
call fcn.140063690
mov rbx, qword [rdi]
lea rcx, [rsp + 0x30]
call fcn.14005b520
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp al, 0x41
jb 0x140069c6b
cmp al, 0x5a
ja 0x140069c6b
sub al, 0x41
jmp 0x140069c91
cmp al, 0x61
jb 0x140069c77
cmp al, 0x7a
ja 0x140069c77
sub al, 0x47
jmp 0x140069c91
cmp al, 0x30
jb 0x140069c83
cmp al, 0x39
ja 0x140069c83
add al, 4
jmp 0x140069c91
cmp al, 0x2b
jne 0x140069c8b
mov al, 0x3e
jmp 0x140069c91
cmp al, 0x2f
jne 0x140069cc5
mov al, 0x3f
movzx eax, al
shl eax, cl
or r8d, eax
add cl, 6
nop dword [rax]
cmp cl, 8
jge 0x140069cb6
test cl, cl
jle 0x140069c27
cmp byte [rbx], r10b
jne 0x140069c27
mov byte [r9], r8b
inc r9
shr r8d, 8
add cl, 0xf8
jmp 0x140069ca0
mov rax, qword [rdi]
lea rcx, [rsp + 0x30]
mov word [rax], r10w
call fcn.14005b520
mov rbx, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x14006b2a0
Capabilities:
Clear file content

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
xor r8d, r8d
call fcn.14005c450
mov rcx, qword [rbx]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_SetEndOfFile]
Function at 0x14006ba50
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push r12
push r14
push r15
sub rsp, 0x58
mov rbx, rcx
mov r12, rdx
lea rcx, [rsp + 0x38]
mov edx, 0x500000
movsxd rbp, r9d
mov rsi, r8
call fcn.1400632b0
mov rax, qword [rsp + 0x38]
movzx r15d, byte [rsp + 0xb0]
add rax, 0x100000
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0xa8], 0
and rax, 0xfffffffffff00000
mov qword [rsp + 0xa0], rax
test r15b, r15b
jne 0x14006babf
xor ebp, ebp
xor eax, eax
mov qword [rsp + 0x30], rax
jmp 0x14006badb
lea rax, [rsi + rbp]
cqo
and edx, 0x1ff
add rax, rdx
and eax, 0x1ff
sub rax, rdx
mov qword [rsp + 0x30], rax
test r15b, r15b
mov ecx, 0x100000
mov r14d, 0x10000000
cmovne r14d, ecx
test rsi, rsi
jle 0x14006bc1a
mov qword [rsp + 0x98], rdi
movsxd rcx, r14d
mov qword [rsp + 0x50], r13
test ebp, ebp
jne 0x14006bb15
cdqe
cmp rsi, rax
jle 0x14006bb15
xor al, al
jmp 0x14006bb17
mov al, 1
cmp rsi, rcx
mov edi, esi
mov r13, r12
cmovg edi, r14d
mov r8d, edi
test al, al
je 0x14006bbb5
mov edi, 0x200
mov rcx, rbx
sub edi, ebp
mov eax, edi
cmp rax, rsi
cmovg edi, esi
xor edx, edx
lea r8d, [rdx + 1]
call fcn.14005c450
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x90]
lea r9, [rsp + 0xa8]
mov r8d, 0x200
mov rbx, rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rax, qword [rsp + 0xa0]
movsxd rcx, ebp
mov r8d, edi
mov rdx, r12
add rcx, rax
mov r13, rax
call fcn.14010cd30
mov rdx, rbx
mov rbx, qword [rsp + 0x90]
mov rcx, rbx
xor r8d, r8d
call fcn.14005c450
mov r8d, 0x200
jmp 0x14006bbc3
test r15b, r15b
je 0x14006bbc3
and edi, 0xfffffe00
mov r8d, edi
lea r9, [rsp + 0xa8]
mov rdx, r13
mov rcx, rbx
mov dword [rsp + 0xa8], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rax, qword [rsp + 0x30]
mov r11d, edi
sub rsi, r11
add r12, r11
xor ebp, ebp
movsxd rcx, r14d
test rsi, rsi
jg 0x14006bb06
mov r13, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x98]
lea rcx, [rsp + 0x38]
call fcn.14005b520
mov rax, qword [rsp + 0x40]
add rsp, 0x58
pop r15
pop r14
pop r12
pop rsi
pop rbp
pop rbx
ret
Function at 0x14006c7b0
Capabilities:
Query environment variable

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0xe8], rbx
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov ebp, r9d
mov r14, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
lea rbx, [0x14019cf50]
mov qword [rsp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
test ebp, ebp
sets r13b
mov byte [rsp + 0x20], r13b
and bpl, 0x40
movzx esi, byte [rsi + 0xf]
and sil, 0x11
test r13b, r13b
jne 0x14006c82e
test bpl, bpl
je 0x14006c831
xor sil, sil
lea rdx, str.RANDOM
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14006c893
xor r15d, r15d
mov word [rsp + 0x40], r15w
call fcn.14005d820
movabs rdx, 0x7fffffffffffffff
and rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140062c80
mov word [rsp + 0x7e], r15w
lea edx, [r15 + 3]
mov rcx, r14
call fcn.1400635c0
mov r12, qword [r14]
movzx eax, word [rsp + 0x40]
mov word [r12], ax
lea rsi, [r12 + 2]
jmp 0x14006c9f1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor bpl, bpl
movsx r12d, sil
mov dword [rsp + 0x24], r12d
xor r15d, r15d
test r13b, r13b
jne 0x14006c8d4
cmp word [rdi], 0x26
je 0x14006c8c0
test sil, sil
je 0x14006c8d4
jmp 0x14006c97b
add rdi, 2
mov r12d, 1
mov dword [rsp + 0x24], r12d
jmp 0x14006c97b
mov edx, 0x52
mov rcx, r14
call fcn.1400635c0
mov r12, qword [r14]
mov rsi, r12
mov word [r12], r15w
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8d, 0x50
mov rdx, qword [r14]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r13d, eax
test eax, eax
jle 0x14006c94e
cmp word [r12], r15w
jne 0x14006c945
lea edx, [rax + 0xc]
mov rcx, r14
call fcn.1400635c0
mov r12, qword [r14]
mov rsi, r12
mov word [r12], r15w
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r8d, [r13 + 0xa]
mov rdx, qword [r14]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r13d, eax
test r13d, r13d
jg 0x14006c9ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
jne 0x14006c9e5
test bpl, bpl
jne 0x14006c9f1
mov bpl, 1
cmp byte [rsp + 0x20], r15b
jne 0x14006c9f1
mov r12d, dword [rsp + 0x24]
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x28]
call fcn.1400307c0
test rax, rax
jne 0x14006c9ab
test r12d, r12d
jne 0x14006c9a6
test bpl, bpl
jne 0x14006c9a6
mov bpl, 1
jmp 0x14006c8d4
mov ebp, r15d
jmp 0x14006c9b9
mov rdi, qword [rax]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, eax
lea edx, [rbp + 2]
mov rcx, r14
call fcn.1400635c0
mov r12, qword [r14]
mov rsi, r12
sub ebp, 1
js 0x14006c9f1
nop
movzx ecx, word [rdi]
mov word [rsi], cx
add rsi, 2
add rdi, 2
sub ebp, 1
jns 0x14006c9d0
jmp 0x14006c9f1
test r13d, r13d
jle 0x14006c9f1
movsxd rcx, r13d
lea rsi, [r12 + rcx*2]
mov word [rsi], r15w
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, r12
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14010bcc0
mov rbx, qword [rsp + 0xe8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006dd30
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r13
sub rsp, 0x50
xor r13d, r13d
mov rsi, r8
mov rdi, rdx
mov qword [rsp + 0x30], r13
lea r8d, [r13 + 1]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14006de5f
test rax, rax
je 0x14006de5f
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x88]
test rdi, rdi
cmovne rbp, rdi
mov rcx, rax
xor edx, edx
mov qword [rsp + 0x78], r12
mov dword [rsp + 0x88], r13d
call qword [sym.imp.KERNEL32.dll_GetFileSize]
test rsi, rsi
mov r12d, r13d
mov dword [rbp], eax
setne r12b
test r12d, r12d
je 0x14006dde8
lea ecx, [r13 + 2]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x14006ddf7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdi, rax
jmp 0x14006ddf2
mov ecx, eax
call fcn.140063080
mov rdi, rax
test rdi, rdi
jne 0x14006de23
cmp rbx, 0xffffffffffffffff
je 0x14006de06
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbp, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r13
pop rdi
pop rsi
ret
mov r8d, dword [rbp]
lea r9, [rsp + 0x40]
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test r12d, r12d
je 0x14006de4b
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp rbx, 0xffffffffffffffff
je 0x14006de5a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
jmp 0x14006de08
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r13
pop rdi
pop rsi
ret
Function at 0x14006e250
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
mov rbp, r8
movzx r13d, dl
mov rsi, rcx
test r8, r8
je 0x14006e305
mov ecx, 0x18
call fcn.1400cf938
mov rbx, rax
test rax, rax
je 0x14006e2ad
xor edi, edi
mov byte [rax + 0x10], 0
mov dword [rax + 0x14], edi
lea rax, vtable.CXLock.0
mov qword [rbx + 8], rdi
mov qword [rbx], rax
jmp 0x14006e2b2
xor edi, edi
mov rbx, rdi
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx + 8], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x14019cf50]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp qword [rbx + 8], 0
je 0x14006e346
cmp r12d, 0xb7
sete dil
mov dword [rbp], edi
jmp 0x14006e346
mov ecx, 0x18
call fcn.1400cf938
mov rbx, rax
test rax, rax
je 0x14006e341
xor edi, edi
mov r8, rsi
xor edx, edx
mov qword [rax + 8], rdi
mov byte [rax + 0x10], dil
mov dword [rax + 0x14], edi
lea rax, vtable.CXLock.0
xor ecx, ecx
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx + 8], rax
jmp 0x14006e346
xor edi, edi
mov rbx, rdi
cmp qword [rbx + 8], 0
mov r12, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x40]
jne 0x14006e388
nop dword [rax]
lea rcx, [0x14019c170]
mov edx, 1
call fcn.14002bb1c
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx + 8], rax
cmp rax, 0
je 0x14006e360
mov rsi, qword [rsp + 0x48]
test r13b, r13b
mov r13, qword [rsp + 0x20]
je 0x14006e3a8
mov rcx, qword [rbx + 8]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [rbx + 0x10], 1
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x14006eb80
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x200], 0
mov rbx, rcx
je 0x14006ebc0
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x14006ebbb
movabs rax, 2
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rsp + 0x38]
mov eax, dword [rsp + 0x3c]
mov r10, qword [rbx]
mov rcx, qword [rbx + 0x20]
shl eax, 0x10
xor r8d, r8d
movsxd r9, eax
movsxd rax, edx
mov edx, 0x84
or r9, rax
call qword [r10 + reloc.OLEAUT32.dll_VariantClear]
cdqe
add rsp, 0x20
pop rbx
ret

Function at 0x14006ebf0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rsi, rcx
mov edx, 0x104
mov rcx, rbx
call fcn.1400635c0
mov r11, qword [rbx]
xor eax, eax
mov word [r11], ax
mov rdx, qword [rbx]
mov r8d, 0x104
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
jle 0x14006ec57
mov rcx, qword [rbx]
cmp word [rcx], 0
jne 0x14006ec57
lea edx, [rax + 2]
mov rcx, rbx
call fcn.1400635c0
mov rdx, qword [rbx]
lea r8d, [rdi + 1]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14006edd0
Capabilities:
Get disk information
Get disk information via ioctl

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x2a0
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0x290], rax
lea eax, [rcx - 0x61]
cmp ax, 0x19
ja 0x14006ee00
mov eax, 0xffdf
and cx, ax
mov edx, 0x5c
xor ebp, ebp
mov r8d, 0x3a
mov word [rsp + 0x68], cx
mov word [rsp + 0x78], cx
mov word [rsp + 0x6a], r8w
mov word [rsp + 0x7a], r8w
mov word [rsp + 0x6c], dx
mov word [rsp + 0x70], dx
mov word [rsp + 0x72], dx
mov eax, 0x2e
mov word [rsp + 0x76], dx
mov qword [rsp + 0x30], rbp
lea r8d, [rbp + 3]
lea rcx, [rsp + 0x70]
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x2b8], rbx
mov word [rsp + 0x6e], bp
mov word [rsp + 0x74], ax
mov word [rsp + 0x7c], bp
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14006efe0
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov edx, 0x2d1080
mov rcx, rdi
mov dword [rsp + 0x28], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], ebp
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x14006efe0
mov ebx, dword [rsp + 0x5c]
cmp ebx, 0xffffffff
je 0x14006efe0
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor r8d, r8d
mov ecx, ebx
mov edx, eax
mov dword [rsp + 0x40], ebp
call fcn.140060d40
test eax, eax
je 0x14006efe0
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov edx, eax
mov qword [rsp + 0x2c0], rsi
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x4c], ebp
mov dword [rsp + 0x44], ebp
mov dword [rsp + 0x40], eax
call qword [sym.imp.SETUPAPI.dll_CM_Get_Parent]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x4c]
lea rcx, [rsp + 0x48]
xor r9d, r9d
call qword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Status]
mov esi, dword [rsp + 0x48]
lea ebx, [rbp + 1]
shr esi, 0xe
and sil, 1
nop
mov word [rsp + 0x80], bp
test sil, sil
je 0x14006ef80
mov ecx, dword [rsp + 0x40]
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x44]
mov r9d, 0x208
mov dword [rsp + 0x20], ebp
call qword [sym.imp.SETUPAPI.dll_CM_Request_Device_EjectW]
jmp 0x14006efa1
mov ecx, dword [rsp + 0x40]
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x44]
mov r9d, 0x208
mov dword [rsp + 0x20], ebp
call qword [sym.imp.SETUPAPI.dll_CM_Query_And_Remove_SubTreeW]
test eax, eax
jne 0x14006efab
cmp dword [rsp + 0x44], ebp
je 0x14006efc8
lea rcx, [0x14019c170]
mov edx, 0xc8
xor dil, dil
call fcn.14002bb1c
inc ebx
cmp ebx, 3
jle 0x14006ef50
jmp 0x14006efcb
mov dil, 1
mov rsi, qword [rsp + 0x2c0]
mov eax, 2
test dil, dil
cmovne eax, ebp
jmp 0x14006efe5
mov eax, 1
mov rbx, qword [rsp + 0x2b8]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.14010bcc0
mov rbp, qword [rsp + 0x2c8]
add rsp, 0x2a0
pop rdi
ret
Function at 0x14006f340
Capabilities:
Allocate or change rwx memory
Parse pe header

Disassembly:
push rbp
push r12
push r15
sub rsp, 0x30
mov r15, r9
mov rbp, r8
mov r12, rcx
cmp edx, 0x40
jae 0x14006f364
xor eax, eax
add rsp, 0x30
pop r15
pop r12
pop rbp
ret
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14006f358
movsxd rcx, dword [rcx + 0x3c]
lea eax, [rcx + 0x108]
cmp edx, eax
jl 0x14006f358
cmp dword [r12 + rcx], 0x4550
mov qword [rsp + 0x60], rdi
lea rdi, [r12 + rcx]
jne 0x14006f572
movzx eax, word [rdi + 0x16]
mov ecx, 0x2000
test cx, ax
jne 0x14006f572
test al, 2
je 0x14006f572
movzx eax, word [rdi + 0x14]
mov r8d, 0xe0
cmp ax, r8w
je 0x14006f3cb
mov ecx, 0xf0
cmp ax, cx
jne 0x14006f572
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x20], r14
lea rsi, [rdi + 0x108]
cmp ax, r8w
jne 0x14006f3e9
lea rsi, [rdi + 0xf8]
mov r9, rsi
mov r8, rdi
mov rcx, r12
call fcn.140061b40
mov r14, qword [rsp + 0x78]
mov qword [r14], rax
mov r11, rax
test rax, rax
je 0x14006f491
movzx eax, word [rdi + 6]
mov qword [rsp + 0x50], rbx
mov ebx, dword [rdi + 0x54]
mov qword [rsp + 0x28], r13
test eax, eax
jle 0x14006f43c
lea rcx, [rsi + 0x14]
mov rdx, rax
mov eax, dword [rcx]
test eax, eax
je 0x14006f432
cmp eax, ebx
cmovb ebx, eax
add rcx, 0x28
sub rdx, 1
jne 0x14006f427
movsxd rax, dword [r12 + 0x3c]
mov r9d, 0x40
mov r8d, 0x1000
mov rcx, qword [rax + r12 + 0x30]
mov rdx, r11
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r13, qword [rsp + 0x70]
mov qword [r13], rax
test rax, rax
jne 0x14006f4aa
mov rdx, qword [r14]
lea r9d, [rax + 0x40]
mov r8d, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [r13], rax
test rax, rax
jne 0x14006f4aa
mov r13, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r12
pop rbp
ret
mov rcx, qword [r13]
mov r8d, ebx
mov rdx, r12
call fcn.14010cd30
mov r11, qword [r13]
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov qword [rbp], rcx
lea r10, [rcx + 0x108]
mov qword [r15], r10
mov r9, qword [rbp]
mov ecx, dword [r9 + 0x54]
mov edx, dword [r9 + 0x38]
call fcn.140061b20
xor esi, esi
mov rdi, rax
add rdi, qword [r13]
cmp si, word [r9 + 6]
jae 0x14006f568
mov rbx, rsi
mov eax, dword [rbx + r10 + 0xc]
test eax, eax
je 0x14006f506
mov rdi, rax
add rdi, qword [r13]
mov eax, dword [rbx + r10 + 0x10]
test eax, eax
je 0x14006f542
mov edx, dword [rbx + r10 + 0x14]
mov r8, rax
mov rcx, rdi
add rdx, r12
call fcn.14010cd30
mov r10, qword [r15]
mov ecx, dword [rbx + r10 + 0x10]
cmp dword [rbx + r10 + 8], ecx
jae 0x14006f542
mov rax, qword [rbp]
mov edx, dword [rax + 0x38]
call fcn.140061b20
add rdi, rax
jmp 0x14006f556
mov rax, qword [rbp]
mov ecx, dword [rbx + r10 + 8]
mov edx, dword [rax + 0x38]
call fcn.140061b20
add rdi, rax
mov rax, qword [rbp]
inc esi
add rbx, 0x28
movzx ecx, word [rax + 6]
cmp esi, ecx
jl 0x14006f4f6
mov eax, 1
jmp 0x14006f487
xor eax, eax
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r12
pop rbp
ret