joyce8/EMBER2024-capa huggingface dataset:
Function at 0x707d10
Capabilities:
Get disk information

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x60
mov rbp, rsp
mov qword [rbp + 0x38], rcx
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x88], rdx
mov rcx, qword [rbp + 0x88]
call fcn.0040e9a0
nop
lea rcx, [0x00707ff4]
mov rdx, qword [rbp + 0x88]
mov r8d, 1
call fcn.004104d0
cmp eax, 2
jne 0x707d7e
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x88]
call fcn.0040ee60
jmp 0x707f51
lea rcx, [0x00708004]
mov rdx, qword [rbp + 0x88]
mov r8d, 2
call fcn.004104d0
mov ebx, eax
lea rcx, [0x00708004]
mov rdx, qword [rbp + 0x88]
mov r8d, ebx
add r8d, 1
call fcn.004104d0
mov ebx, eax
xor rax, rax
cmp qword [rbp + 0x88], 0
je 0x707dcd
mov rax, qword [rbp + 0x88]
mov eax, dword [rax - 4]
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x88]
movsxd r8, ebx
mov r9d, eax
sub r9d, ebx
add r9d, 1
movsxd r9, r9d
call fcn.00410240
xor rax, rax
cmp qword [rbp + 0x88], 0
je 0x707e04
mov rax, qword [rbp + 0x88]
mov eax, dword [rax - 4]
lea rcx, [rbp + 0x88]
mov edx, ebx
mov r8d, eax
call fcn.004102a0
lea rcx, [rbp + 0x58]
mov edx, 0x104
call fcn.0040fe60
mov rcx, qword [rbp + 0x58]
call fcn.0040fbd0
lea rcx, [0x00708008]
mov rdx, rax
mov r8d, 0x104
call sub.kernel32.dll_QueryDosDeviceW
test eax, eax
je 0x707e8c
mov rcx, qword [rbp + 0x58]
call fcn.0040fbd0
lea rcx, [rbp + 0x58]
mov rdx, rax
call fcn.0040fc70
mov rcx, qword [rbp + 0x88]
mov rdx, qword [rbp + 0x58]
call fcn.00431620
test eax, eax
jne 0x707e8c
mov rcx, qword [rbp + 0x38]
lea rdx, [0x0070801c]
mov rax, qword [rbp + 0x38]
mov r8, qword [rax]
call fcn.00410030
jmp 0x707f51
mov bx, 0x61
lea rcx, [rbp + 0x58]
mov edx, 0x104
call fcn.0040fe60
lea rcx, [rbp + 0x48]
mov edx, ebx
call fcn.0040fc20
lea rcx, [rbp + 0x48]
lea rdx, [0x00707ff4]
call fcn.0040ff40
mov rcx, qword [rbp + 0x48]
call fcn.0040fbd0
mov rsi, rax
mov rcx, qword [rbp + 0x58]
call fcn.0040fbd0
mov rcx, rsi
mov rdx, rax
mov r8d, 0x104
call sub.kernel32.dll_QueryDosDeviceW
test eax, eax
je 0x707f41
mov rcx, qword [rbp + 0x58]
call fcn.0040fbd0
lea rcx, [rbp + 0x58]
mov rdx, rax
call fcn.0040fc70
mov rcx, qword [rbp + 0x88]
mov rdx, qword [rbp + 0x58]
call fcn.00431620
test eax, eax
jne 0x707f41
lea rcx, [rbp + 0x40]
mov edx, ebx
call fcn.0040fc20
mov rcx, qword [rbp + 0x38]
mov edx, 3
mov r8, qword [rbp + 0x40]
lea r9, [0x00707ff4]
mov rax, qword [rbp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
call fcn.00410150
jmp 0x707f51
add bx, 1
cmp bx, 0x7b
jne 0x707e90
nop
nop
lea rcx, [rbp + 0x40]
mov edx, 2
call fcn.0040e8f0
lea rcx, [rbp + 0x58]
call fcn.0040e810
lea rcx, [rbp + 0x88]
call fcn.0040e810
mov rax, qword [rbp + 0x38]
lea rsp, [rbp + 0x60]
pop rbx
pop rsi
pop rbp
ret
Function at 0x70a200
Capabilities:
Get disk information

Disassembly:
push rbp
sub rsp, 0x90
mov rbp, rsp
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], rbp
mov qword [rbp + 0xa0], rcx
nop
nop
lea rcx, [rbp + 0x50]
lea rdx, [0x0070a3b4]
call fcn.004400d0
lea rcx, [rbp + 0x48]
mov rax, qword [rbp + 0x50]
movzx rdx, word [rax]
call fcn.0040fc20
lea rcx, [rbp + 0x48]
lea rdx, [0x0070a3d8]
call fcn.0040ff40
mov rcx, qword [rbp + 0x48]
call fcn.0040fbd0
mov rcx, rax
lea rdx, [rbp + 0x6c]
mov r8d, 0xc
lea r9, [rbp + 0x8c]
lea rax, [rbp + 0x88]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x84]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
je 0x70a2c7
mov rcx, qword [rbp + 0xa0]
mov edx, dword [rbp + 0x8c]
mov r8d, 8
call fcn.004326e0
jmp 0x70a34f
lea rcx, [0x0070a3de]
lea rdx, [rbp + 0x6c]
mov r8d, 0xc
lea r9, [rbp + 0x8c]
lea rax, [rbp + 0x88]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x84]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
je 0x70a32d
mov rcx, qword [rbp + 0xa0]
mov edx, dword [rbp + 0x8c]
mov r8d, 8
call fcn.004326e0
jmp 0x70a34f
mov rcx, qword [rbp + 0xa0]
call fcn.0040e810
jmp 0x70a34f
nop
lea rcx, [rbp + 0x48]
mov edx, 2
call fcn.0040e8f0
mov rax, qword [rbp + 0xa0]
lea rsp, [rbp + 0x90]
pop rbp
ret
Function at 0x718660
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x88
mov rbp, rsp
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x58], rbp
mov qword [rbp + 0xa0], rcx
mov rcx, qword [rbp + 0xa0]
call fcn.0040e9a0
nop
lea rcx, [rbp + 0x50]
call fcn.00700020
lea rcx, [rbp + 0x48]
mov dl, 5
xor r8, r8
xor r9, r9
call fcn.007006f0
lea rcx, [rbp + 0x70]
mov edx, 3
mov r8, qword [rbp + 0x50]
mov r9, qword [rbp + 0x48]
lea rax, [0x007188d4]
mov qword [rsp + 0x20], rax
call fcn.00410150
mov rcx, qword [rbp + 0x70]
mov dl, 1
call fcn.004332c0
test al, al
jne 0x7186ac
mov rcx, qword [0x004d8e18]
mov dl, 1
call fcn.00509130
mov qword [rbp + 0x78], rax
lea rcx, [rbp + 0x40]
lea rdx, [0x007188ec]
mov r8, qword [rbp + 0xa0]
call fcn.00410030
mov rcx, qword [rbp + 0x78]
mov rdx, qword [rbp + 0x40]
mov rax, qword [rbp + 0x78]
mov rax, qword [rax]
call qword [rax + 0x78]
mov rcx, qword [rbp + 0x78]
lea rdx, [0x00718910]
mov rax, qword [rbp + 0x78]
mov rax, qword [rax]
call qword [rax + 0x78]
nop
mov rcx, qword [rbp + 0x78]
mov rdx, qword [rbp + 0x70]
mov rax, qword [rbp + 0x78]
mov rbx, qword [rax]
call qword [rbx + pe_nt_image_headers64]
lea rcx, [rbp + 0x38]
call fcn.00700020
mov rcx, qword [rbp + 0x38]
call fcn.00408860
call fcn.004087e0
mov rcx, qword [rbp + 0xa0]
call fcn.00717fa0
cmp eax, 4
jne 0x7187c4
mov rcx, qword [rbp + 0xa0]
call fcn.00718180
mov dword [rbp + 0x6c], 0
jmp 0x7187aa
mov ecx, 0xa
call sub.kernel32.dll_Sleep_2
add dword [rbp + 0x6c], 1
mov rcx, qword [rbp + 0xa0]
call fcn.00717fa0
cmp eax, 4
jne 0x7187c4
cmp dword [rbp + 0x6c], 0x1f4
jl 0x71879b
mov rcx, qword [rbp + 0xa0]
call fcn.00717fa0
cmp eax, 4
je 0x71880a
mov rcx, qword [rbp + 0x70]
call fcn.0040fbd0
xor rcx, rcx
xor rdx, rdx
mov r8, rax
xor r9, r9
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call sub.shell32.dll_ShellExecuteW
jmp 0x71880a
mov rax, qword [rbp + 0x78]
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x78], 0
mov rcx, qword [rbp + 0x60]
call fcn.0040b560
nop
lea rcx, [rbp + 0x38]
mov edx, 4
call fcn.0040e8f0
lea rcx, [rbp + 0x70]
call fcn.0040e810
lea rcx, [rbp + 0xa0]
call fcn.0040e810
lea rsp, [rbp + 0x88]
pop rbx
pop rbp
ret
Function at 0x71fcc0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x98
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x58], rbp
mov qword [rbp + 0xb0], rcx
mov dword [rbp + 0xb8], edx
nop
nop
mov rcx, qword [0x004dd230]
mov dl, 1
mov r8, qword [0x0078bd68]
lea r9, [0x0071ffc0]
mov qword [rsp + 0x20], 0xa
call fcn.005103d0
mov qword [rbp + 0x80], rax
jmp 0x71fd47
mov rcx, qword [0x004dce90]
mov dl, 1
call fcn.0040b4a0
mov qword [rbp + 0x70], rax
mov rcx, qword [rbp + 0x80]
mov rdx, qword [rbp + 0x70]
mov rax, qword [rbp + 0x80]
mov rbx, qword [rax]
call qword [rbx + 0x48]
nop
mov rcx, qword [rbp + 0x70]
call fcn.006fb550
lea rcx, [rbp + 0x50]
call fcn.00700020
lea rcx, [rbp + 0x48]
mov dl, 5
xor r8, r8
xor r9, r9
call fcn.007006f0
lea rcx, [rbp + 0x68]
mov edx, 3
mov r8, qword [rbp + 0x50]
mov r9, qword [rbp + 0x48]
lea rax, [0x0071ffd8]
mov qword [rsp + 0x20], rax
call fcn.00410150
mov rcx, qword [rbp + 0x70]
mov rdx, qword [rbp + 0x68]
call fcn.0050fe20
mov rcx, qword [rbp + 0x68]
call fcn.0040fbd0
mov rbx, rax
lea rcx, [rbp + 0x40]
lea rdx, [0x0071fff0]
call fcn.006ff0c0
lea rcx, [rbp + 0x38]
mov edx, dword [rbp + 0xb8]
call fcn.00432450
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x38]
call fcn.0040ff40
mov rcx, qword [rbp + 0x40]
call fcn.0040fbd0
xor rcx, rcx
xor rdx, rdx
mov r8, rbx
mov r9, rax
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call sub.shell32.dll_ShellExecuteW
mov rcx, qword [rbp + 0x68]
call fcn.00433900
mov ecx, 0x1f4
call fcn.00522a60
mov rcx, qword [rbp + 0x68]
mov dl, 1
call fcn.004332c0
test al, al
jne 0x71fe28
nop
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x88], rax
mov qword [rbp + 0x80], 0
mov rcx, qword [rbp + 0x88]
call fcn.0040b560
mov rax, qword [rbp + 0x70]
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x70], 0
mov rcx, qword [rbp + 0x78]
call fcn.0040b560
nop
lea rcx, [rbp + 0x38]
mov edx, 4
call fcn.0040e8f0
lea rcx, [rbp + 0x68]
call fcn.0040e810
lea rsp, [rbp + 0x98]
pop rbx
pop rbp
ret
Function at 0x723020
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x128
mov rbp, rsp
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], rbp
mov qword [rbp + 0x140], rcx
mov qword [rbp + 0x148], rdx
mov qword [rbp + 0x150], r8
mov dword [rbp + 0x158], r9d
mov rcx, qword [rbp + 0x140]
call fcn.0040e9a0
mov rcx, qword [rbp + 0x148]
call fcn.0040e9a0
nop
mov dword [rbp + 0x94], 0
mov eax, dword [rbp + 0x158]
or eax, 0x400
mov dword [rbp + 0x11c], eax
lea rcx, [rbp + 0xb0]
mov edx, 0x68
xor r8, r8
call fcn.0040a320
mov dword [rbp + 0xb0], 0x68
mov rax, qword [rbp + 0x160]
mov qword [rbp + 0xc0], rax
lea rcx, [rbp + 0x98]
mov edx, 0x18
xor r8, r8
call fcn.0040a320
cmp qword [rbp + 0x148], 0
je 0x723115
lea rcx, [rbp + 0x140]
mov edx, 4
mov r8, qword [rbp + 0x140]
lea r9, [0x00723328]
mov rax, qword [rbp + 0x148]
mov qword [rsp + 0x20], rax
lea rax, [0x0072333c]
mov qword [rsp + 0x28], rax
call fcn.00410150
nop
lea rcx, [rbp + 0x88]
mov rdx, qword [rbp + 0x150]
xor r8, r8
call qword [0x007918b8]
test eax, eax
je 0x723274
mov rcx, qword [rbp + 0x140]
call fcn.0040fbd0
mov rbx, rax
lea rcx, [rbp + 0x70]
mov rdx, qword [rbp + 0x140]
call fcn.00433a40
mov rcx, qword [rbp + 0x70]
call fcn.0040fbd0
mov rcx, qword [rbp + 0x150]
xor rdx, rdx
mov r8, rbx
xor r9, r9
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov r10d, dword [rbp + 0x11c]
mov dword [rsp + 0x30], r10d
mov r10, qword [rbp + 0x88]
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x98]
mov qword [rsp + 0x50], rax
call sub.advapi32.dll_CreateProcessAsUserW
test eax, eax
je 0x723274
mov eax, dword [rbp + 0xa8]
mov dword [rbp + 0x94], eax
jmp 0x723274
nop
lea rcx, [rbp + 0x68]
mov edx, 2
call fcn.0040e8f0
lea rcx, [rbp + 0x140]
mov edx, 2
call fcn.0040e8f0
mov eax, dword [rbp + 0x94]
lea rsp, [rbp + 0x128]
pop rbx
pop rbp
ret
Function at 0x1400111f4
Capabilities:
Terminate process

Disassembly:
jmp 0x140012e00
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001127b
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014150
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014170
xor al, al
jmp 0x1400141f1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014183
xor al, al
jmp 0x1400141f1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400141ad
xor al, al
jmp 0x1400141f1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400141c1
xor al, al
jmp 0x1400141f1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400141d3
xor al, al
jmp 0x1400141f1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400141ef
xor al, al
jmp 0x1400141f1
mov al, 1
add rsp, 0x38
ret
Function at 0x14000e65c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x420]
sub rsp, 0x520
mov rax, qword [0x1400b3010]
xor rax, rsp
mov qword [rbp + 0x410], rax
mov rcx, rdx
mov rbx, r8
call qword [sym.imp.Qt5Core.dll_public:_unsigned_short_int_const____ptr64___cdecl_QString::utf16_void_const___ptr64]
xor edx, edx
lea rcx, [rbp]
mov r8d, 0x410
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov r8, qword [rbx]
cmp dword [r8 + 4], 0
je 0x14000e6d7
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_unsigned_short_int_const____ptr64___cdecl_QString::utf16_void_const___ptr64]
mov r9, rdi
lea r8, str.__s___s
lea rcx, [rbp]
mov qword [rsp + 0x20], rax
mov edx, 0x410
call fcn.140003ffc
and qword [rsp + 0x60], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x60]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000e807
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
and qword [rsp + 0x68], 0
mov r9d, 2
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, 0x20f01ff
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x70]
and qword [rsp + 0x70], 0
xor r8d, r8d
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
xor eax, eax
lea rcx, [rbp - 0x70]
xorps xmm0, xmm0
mov qword [rbp - 0x78], rax
xor edx, edx
movups xmmword [rsp + 0x78], xmm0
lea ebx, [rax + 0x70]
mov r8d, ebx
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rsp + 0x68]
lea rax, str.winsta0default
mov qword [rbp - 0x60], rax
lea r8, [rbp]
lea rax, [rsp + 0x78]
mov dword [rbp - 0x70], ebx
mov qword [rsp + 0x50], rax
xor r9d, r9d
lea rax, [rbp - 0x70]
mov rdx, rdi
mov qword [rsp + 0x48], rax
and qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x628
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
setne bl
test eax, eax
je 0x14000e7de
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
test bl, bl
je 0x14000e807
mov al, 1
jmp 0x14000e809
xor al, al
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.140016760
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140017780
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x50], rax
mov rdi, rax
test rax, rax
jne 0x1400177bd
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x40]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x98], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x60], r14
cmovo rax, r15
mov rcx, rax
call fcn.14001696c
mov r14, rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x1400178bc
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0xa0], r12
mov r12, r14
mov qword [rsp + 0x68], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
nop word [rax + rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.14001696c
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x40]
inc r14d
cmp r14d, eax
jne 0x140017830
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x90]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x40]
mov rdx, r14
call fcn.140003ef4
mov esi, eax
cmp dword [rsp + 0x40], ebx
je 0x1400178fb
mov rdi, r14
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400178fb
call fcn.1400167d8
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x40]
jne 0x1400178e2
mov rcx, r14
call fcn.1400167d8
mov r14, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x98]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret

Function at 0x140f8a6e4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f8a6ee
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f8a717
pop rbp
sub rbp, 0x33
sub rbp, 0xf8a6e4
sub rsp, 0x20
jmp 0x140f8a736
mov rax, 0xf8a6e4
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x603828c4
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f8a755
jmp 0x140f8a76c
mov word [rbp + 0x2d], cs
clc
invalid
Function at 0x417560
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417706
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x00ca7068]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433d20
xorps xmm15, xmm15
mov r14, qword [0x00d36d40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x4175cb
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4175e0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x417605
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x417619
cmp rbx, 0x1000
jae 0x4175d5
nop dword [rax]
jmp 0x417689
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x41762d
xor edx, edx
jmp 0x417680
mov rcx, qword [0x00ca7068]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433d20
xorps xmm15, xmm15
mov r14, qword [0x00d36d40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x41760f
jmp 0x4175f4
call fcn.00467060
xorps xmm15, xmm15
mov r14, qword [0x00d36d40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00438460
lea rax, [0x00974f9b]
mov ebx, 0x18
call fcn.00438d60
mov rax, qword [rsp + 0x38]
call fcn.00438a60
lea rax, [0x00975043]
mov ebx, 0x19
call fcn.00438d60
mov rax, qword [rsp + 0x30]
nop
call fcn.00438a60
call fcn.004386c0
call fcn.004384e0
lea rax, [0x00976451]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00436b20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004634a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00417560
Function at 0x417740
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41796a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x00ca7070]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00433da0
xorps xmm15, xmm15
mov r14, qword [0x00d36d40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4177b9
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4177cc
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4177f0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x417804
cmp rbx, 0x1000
jae 0x4177c3
jmp 0x417885
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x417816
xor esi, esi
jmp 0x417876
mov rax, qword [0x00ca7070]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00433da0
xorps xmm15, xmm15
mov r14, qword [0x00d36d40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x4177fa
nop
jmp 0x4177e2
call fcn.00467060
xorps xmm15, xmm15
mov r14, qword [0x00d36d40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x417905
call fcn.00438460
lea rax, [0x009751ba]
mov ebx, 0x19
call fcn.00438d60
mov rax, qword [rsp + 0x68]
call fcn.00438a60
lea rax, [0x00975043]
mov ebx, 0x19
call fcn.00438d60
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00438a60
call fcn.004386c0
call fcn.004384e0
lea rax, [0x00973a25]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.00436b20
cmp eax, 0x5af
je 0x4178a8
call fcn.00438460
lea rax, [0x009751ba]
mov ebx, 0x19
nop dword [rax]
call fcn.00438d60
mov rax, qword [rsp + 0x38]
call fcn.00438a60
lea rax, [0x00975043]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00438d60
mov eax, dword [rsp + 0x34]
call fcn.00438a60
call fcn.004386c0
call fcn.004384e0
lea rax, [0x00975f8d]
mov ebx, 0x1f
call fcn.00436b20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004634a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00417740