joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140020200
Capabilities:
Get geographical location

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rax, qword [0x1400e9088]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
mov qword [rsp + 0x30], rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], rbx
mov word [rcx], bx
lea r8d, [rbx + 7]
lea rdx, [0x1400beb58]
call fcn.140011970
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea edx, [rbx + 0x5a]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
movsxd rsi, eax
test eax, eax
jle 0x1400202e5
xor eax, eax
mov qword [rsp + 0x38], rax
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.1400224a0
nop
mov rax, qword [rsp + 0x38]
mov word [rax], bx
mov r9d, esi
mov r8, qword [rsp + 0x38]
lea edx, [rbx + 0x5a]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1400202d6
mov rdx, qword [rsp + 0x38]
cmp word [rdx], bx
je 0x1400202ca
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x1400202c0
mov r8, rbx
mov rcx, rdi
call fcn.140011970
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400202e5
call fcn.140056314
mov rax, rdi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140056280
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400229e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x1400e9088]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov r9, qword [r8 + 0x20]
mov rdi, r8
add r8, 0x10
mov rsi, rdx
mov r10, rcx
cmp qword [r8 + 0x18], 8
jb 0x140022a16
mov r8, qword [r8]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
add r9, r9
je 0x140022a45
movabs r11, 0x100000001b3
movzx eax, byte [r8 + rcx]
inc rcx
xor rdx, rax
imul rdx, r11
cmp rcx, r9
jb 0x140022a31
mov r8, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and r8, rdx
shl r8, 4
add rcx, r8
cmp qword [rcx + 8], rdi
jne 0x140022a82
cmp qword [rcx], rdi
jne 0x140022a78
mov rax, qword [r10 + 8]
mov qword [rcx], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [r8 + rcx + 8], rax
jmp 0x140022a8d
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
jmp 0x140022a8d
cmp qword [rcx], rdi
jne 0x140022a92
mov rax, qword [rdi]
mov qword [rcx], rax
mov rdi, qword [rsp + 0x60]
mov rdx, qword [rdi + 8]
lea rcx, [rdi + 0x10]
mov rbx, qword [rdi]
mov qword [rdx], rbx
mov r8, qword [rdi]
mov rdx, qword [rdi + 8]
mov qword [r8 + 8], rdx
dec qword [r10 + 0x10]
call fcn.1400200b0
mov rcx, rdi
call fcn.1400562e0
mov rax, rsi
mov qword [rsi], rbx
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.140056280
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400231b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x70
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0xa8], rbx
mov rax, qword [0x1400e9088]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, r8
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x40], rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], rbx
mov word [rcx], bx
lea r8d, [rbx + 7]
lea rdx, [0x1400beb88]
call fcn.140011970
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x50], rbx
cmp qword [r14 + 0x18], 8
jb 0x140023223
mov r14, qword [r14]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rdx, r14
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140023340
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x58], ebx
cmp qword [rdi + 0x18], 8
jb 0x140023262
mov rdx, qword [rdi]
jmp 0x140023265
mov rdx, rdi
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x58]
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140023335
cmp dword [rsp + 0x58], 1
jne 0x140023335
xor eax, eax
mov qword [rsp + 0x60], rax
mov edx, dword [rsp + 0x48]
lea rcx, [rsp + 0x60]
call fcn.140023e00
nop
mov rax, qword [rsp + 0x60]
mov byte [rax], 0
mov rax, qword [rsp + 0x60]
mov byte [rax + 1], 0
cmp qword [rdi + 0x18], 8
jb 0x1400232cb
mov rdi, qword [rdi]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140023326
mov rdx, qword [rsp + 0x60]
cmp word [rdx], ax
je 0x14002331a
or rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x140023310
mov r8, rbx
mov rcx, rsi
call fcn.140011970
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140023335
call fcn.140056314
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rsi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140056280
mov rbx, qword [rsp + 0xa8]
add rsp, 0x70
pop r14
pop rdi
pop rsi
ret
Function at 0x140023ed0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, qword [0x1400e9088]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov rbp, qword [r8 + 0x18]
mov rdi, r8
mov r13, qword [r8 + 0x10]
mov r12, rdx
mov rsi, rcx
cmp rbp, 8
jb 0x140023f0d
mov r8, qword [r8]
lea r9, [r13*2]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
test r9, r9
je 0x140023f44
movabs r10, 0x100000001b3
movzx eax, byte [r8 + rcx]
inc rcx
xor rdx, rax
imul rdx, r10
cmp rcx, r9
jb 0x140023f30
mov rcx, qword [rsi + 0x30]
and rcx, rdx
mov rdx, qword [rsi + 0x18]
mov rsi, qword [rsi + 8]
mov rax, rcx
add rax, rax
mov rbx, qword [rdx + rax*8]
lea rax, [rcx + rcx]
mov r14, qword [rdx + rax*8]
lea r15, [rdx + rax*8]
nop dword [rax]
cmp r14, rsi
jne 0x140023f7a
mov rax, rsi
jmp 0x140023f81
mov rax, qword [r15 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x140023fef
cmp rbp, 8
jb 0x140023f91
mov r8, qword [rdi]
jmp 0x140023f94
mov r8, rdi
cmp qword [rbx + 0x28], 8
jb 0x140023fa1
mov rcx, qword [rbx + 0x10]
jmp 0x140023fa5
lea rcx, [rbx + 0x10]
mov rdx, qword [rbx + 0x20]
mov r9, r13
call fcn.1400113b0
test eax, eax
je 0x140023fba
mov rbx, qword [rbx]
jmp 0x140023f70
cmp qword [rbx + 0x28], 8
jb 0x140023fc7
mov r8, qword [rbx + 0x10]
jmp 0x140023fcb
lea r8, [rbx + 0x10]
cmp rbp, 8
jb 0x140023fd4
mov rdi, qword [rdi]
mov r9, qword [rbx + 0x20]
mov rdx, r13
mov rcx, rdi
call fcn.1400113b0
test eax, eax
cmovne rbx, rsi
mov qword [r12], rbx
jmp 0x140023ff3
mov qword [r12], rsi
mov rax, r12
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.140056280
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140027a90
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x248]
sub rsp, 0x340
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400e9088]
xor rax, rsp
mov qword [rbp + 0x230], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], rsi
mov word [rsp + 0x58], si
lea r8d, [rsi + 7]
lea rdx, str.0.0.0.0
lea rcx, [rsp + 0x58]
call fcn.140011970
nop
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x20]
call fcn.140077860
mov r8d, 0x105
lea rdx, [rbp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x140027b51
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rsi
mov word [rbx], si
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.140011c00
jmp 0x140027c66
xor eax, eax
mov qword [rbp - 0x78], rax
xor edx, edx
lea rcx, [rbp + 0x20]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test eax, eax
je 0x140027c4a
xor eax, eax
mov qword [rsp + 0x78], rax
mov edx, edi
lea rcx, [rsp + 0x78]
call fcn.140023e00
nop
mov r9, qword [rsp + 0x78]
mov r8d, edi
xor edx, edx
lea rcx, [rbp + 0x20]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x50], esi
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x48]
lea rdx, [0x1400bfe8c]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x140027bd1
cmp dword [rsp + 0x50], 0x34
jne 0x140027bd1
mov rax, qword [rsp + 0x48]
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
xor edx, edx
lea r8d, [rdx + 0x58]
lea rcx, [rbp - 0x40]
call fcn.140077860
mov ecx, dword [rbp - 0x74]
movzx eax, cx
shr ecx, 0x10
mov r8d, dword [rbp - 0x78]
movzx r9d, r8w
shr r8d, 0x10
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, str._d._d._d._d
lea rcx, [rbp - 0x40]
call fcn.140023e70
cmp word [rbp - 0x40], 0
jne 0x140027c19
mov r8, rsi
jmp 0x140027c2c
lea rax, [rbp - 0x40]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140027c21
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x58]
call fcn.140011970
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140027c4a
call fcn.140056314
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rsi
mov word [rbx], si
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.140011c00
mov dword [rsp + 0x30], 1
mov r8, qword [rsp + 0x70]
cmp r8, 8
jb 0x140027c8b
inc r8
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x58]
call fcn.1400129b0
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], rsi
mov word [rsp + 0x58], si
mov rax, rbx
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
call fcn.140056280
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140027e30
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rdi, rcx
cmp qword [rcx + 0x20], 8
jb 0x140027e5d
mov rsi, qword [rcx + 8]
jmp 0x140027e61
lea rsi, [rcx + 8]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
nop
sub eax, dword [rdi]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rsi
lea rax, str._s_took__d_ms
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [r9 + 0x6e]
lea rdx, str...PdsmqShim.Native.DynamicCommon.cpp
lea ecx, [r9 + 4]
call fcn.140022c00
nop
mov r8, qword [rdi + 0x20]
cmp r8, 8
jb 0x140027eb2
inc r8
mov rdx, qword [rdi + 8]
lea rcx, [rdi + 8]
call fcn.1400129b0
nop
mov qword [rdi + 0x20], 7
xor ecx, ecx
mov qword [rdi + 0x18], rcx
cmp qword [rdi + 0x20], 8
jb 0x140027ed0
mov rax, qword [rdi + 8]
mov word [rax], cx
jmp 0x140027ed4
mov word [rdi + 8], cx
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x140027fd0
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rsi, r8
mov r14, rdx
mov rdi, rcx
xor r12d, r12d
mov dword [rax - 0x38], r12d
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], r12
mov word [rcx], r12w
mov dword [rax - 0x38], 1
lea rcx, [r8 + 2]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
mov r15, rdx
shr r15, 1
shl r15, 2
mov ebx, r12d
lea r13, [0x140000000]
test r8, r8
je 0x140028110
cmp rbx, r8
jae 0x14002805c
movzx ebp, byte [rbx + r14]
inc rbx
jmp 0x14002805f
mov rbp, r12
cmp rbx, rsi
jae 0x14002806e
movzx ecx, byte [rbx + r14]
inc rbx
jmp 0x140028071
mov rcx, r12
cmp rbx, rsi
jae 0x140028080
movzx eax, byte [rbx + r14]
inc rbx
jmp 0x140028083
mov rax, r12
shl rbp, 8
add rbp, rcx
shl rbp, 8
add rbp, rax
mov rax, rbp
shr rax, 0x12
movsx r8d, byte [rax + r13 + 0xbec70]
mov edx, 1
mov rcx, rdi
call fcn.140016f70
mov rax, rbp
shr rax, 0xc
and eax, 0x3f
movsx r8d, byte [rax + r13 + 0xbec70]
mov edx, 1
mov rcx, rdi
call fcn.140016f70
mov rax, rbp
shr rax, 6
and eax, 0x3f
movsx r8d, byte [rax + r13 + 0xbec70]
mov edx, 1
mov rcx, rdi
call fcn.140016f70
and ebp, 0x3f
movsx r8d, byte [r13 + rbp + 0xbec70]
mov edx, 1
mov rcx, rdi
call fcn.140016f70
cmp rbx, rsi
jb 0x140028052
movabs rax, 0xaaaaaaaaaaaaaaab
mul rsi
shr rdx, 1
lea rax, [rdx + rdx*2]
sub rsi, rax
mov rdx, qword [r13 + rsi*8 + 0xbec50]
test rdx, rdx
je 0x14002815f
lea rax, [r15 + r15]
mov r8d, 0x3d
nop
cmp qword [rdi + 0x18], 8
jb 0x14002814c
mov rcx, qword [rdi]
jmp 0x14002814f
mov rcx, rdi
mov word [rax + rcx - 2], r8w
sub rax, 2
sub rdx, 1
jne 0x140028140
mov rax, rdi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14002c070
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400e9088]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp byte [0x1400ef341], 0
jne 0x14002c128
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], 0
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareHPNGTrackingPdsmq
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002c121
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x40]
mov dword [rsp + 0x38], eax
lea rdx, str.TrackingDisabled
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rsp + 0x38]
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002c116
cmp dword [rsp + 0x38], 1
sete byte [0x1400ef340]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [0x1400ef341], 1
movzx eax, byte [0x1400ef340]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140056280
add rsp, 0x58
ret
Function at 0x14002c160
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rbx, r8
movzx esi, dl
mov edi, ecx
cmp qword [r8 + 0x18], 8
jb 0x14002c18c
mov rcx, qword [r8]
jmp 0x14002c18f
mov rcx, rbx
lea rdx, str.true
lea rax, str.false
test sil, sil
cmovne rax, rdx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
lea rax, str.error_d__keepTicket_s__filePath_s
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [r9 + 0x48]
lea rdx, str.PdsmqConnector.cpp
lea ecx, [r9 + 4]
call fcn.140022c00
test edi, edi
je 0x14002c251
mov edx, edi
lea rcx, [rsp + 0x48]
call fcn.140019120
nop
cmp qword [rax + 0x18], 8
jb 0x14002c1f0
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
lea rax, str.Error_code:__d___s_
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [r9 + 0x4c]
lea rdx, str.PdsmqConnector.cpp
lea ecx, [r9 + 1]
call fcn.140022c00
nop
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x14002c23a
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.1400129b0
mov qword [rsp + 0x60], 7
xor eax, eax
mov qword [rsp + 0x58], rax
mov word [rsp + 0x48], ax
jmp 0x14002c274
lea rax, str.SUCCESS_
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [r9 + 0x50]
lea rdx, str.PdsmqConnector.cpp
lea ecx, [r9 + 4]
call fcn.140022c00
test sil, sil
jne 0x14002c2f2
cmp qword [rbx + 0x10], 0
je 0x14002c2f2
cmp qword [rbx + 0x18], 8
jb 0x14002c28c
mov rcx, qword [rbx]
jmp 0x14002c28f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14002c2be
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp qword [rbx + 0x18], 8
jb 0x14002c2ab
mov rbx, qword [rbx]
lea rax, str.Cannot_delete__s
mov r8d, 0x5b
lea ecx, [r8 - 0x59]
jmp 0x14002c2d9
cmp qword [rbx + 0x18], 8
jb 0x14002c2c8
mov rbx, qword [rbx]
lea rax, str.Deleted__s
mov r8d, 0x5f
lea ecx, [r8 - 0x5b]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea rdx, str.PdsmqConnector.cpp
call fcn.140022c00
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14002c30d
lea rcx, str.Press_any_key_to_continue.
call fcn.140080774
call fcn.140082614
mov eax, edi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140030e00
Capabilities:
Hash data using sha1

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400e9088]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
xor eax, eax
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x70], SafeArrayGetLBound
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x58], al
mov dword [rsp + 0x40], 0x67452301
mov dword [rsp + 0x44], 0xefcdab89
mov dword [rsp + 0x48], 0x98badcfe
mov dword [rsp + 0x4c], 0x10325476
mov dword [rsp + 0x50], 0xc3d2e1f0
mov qword [rsp + 0x78], rax
xor r8d, r8d
lea rdx, [0x1400be562]
lea rcx, [rsp + 0x58]
call fcn.140003930
nop
xor edx, edx
mov r8d, 0xf0
lea rcx, [rbp - 0x80]
call fcn.140077860
mov rdx, rbx
lea rcx, [rbp - 0x80]
call fcn.140031190
nop
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x40]
call fcn.14002f4f0
nop
lea rcx, [rbp + 0x10]
call fcn.140031100
lea rax, [rbp + 0x10]
mov qword [rsp + 0x38], rax
lea rax, vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x10], rax
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x10], rax
lea rcx, [rbp + 0x10]
call fcn.14003a510
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.14002f770
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x58]
call fcn.1400033a0
mov rax, rdi
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.140056280
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x140058c00
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140058c13
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.140059278
lea rdx, [0x1400e5f38]
lea rcx, [rsp + 0x20]
call fcn.140075be0
int3

Function at 0x140064fe8
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1400ee100]
xor edx, edx
jmp fcn.140058c00

Function at 0x1400659d8
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1400ee100]
jmp fcn.140058c00
Function at 0x140090cc8
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x140090b2e
call fcn.14007d208
mov dword [rax], SafeArrayPutElement
call fcn.14007c0f8
mov eax, 0xffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140090b10
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x140090b10
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x20]
shr ecx, 1
test cl, 1
je 0x140090b60
lock or dword [rax + 0x14], 0x10
jmp 0x140090b10
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x140090b7d
mov rcx, qword [rbp + 0x20]
call fcn.1400910b4
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x10], 1
jne 0x140090b92
mov rcx, qword [rax]
mov sil, 1
mov r14b, byte [rcx]
jmp 0x140090b98
xor sil, sil
xor r14b, r14b
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.14008deb8
mov rdx, qword [rbp + 0x20]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.14009ab40
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x20]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 2
ja 0x140090beb
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x20]
and dword [rax + 0x10], 0
jmp 0x140090b10
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x140090c57
mov rcx, qword [rbp + 0x20]
call fcn.14008deb8
cmp eax, 0xffffffff
je 0x140090c3e
mov rcx, qword [rbp + 0x20]
call fcn.14008deb8
cmp eax, 0xfffffffe
je 0x140090c3e
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.14008deb8
movsxd rdi, eax
lea r15, [0x1400ee900]
mov rcx, rbx
sar rdi, 6
call fcn.14008deb8
and eax, 0x3f
shl rax, 6
add rax, qword [r15 + rdi*8]
jmp 0x140090c45
lea rax, [0x1400e95f0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140090c57
mov rax, qword [rbp + 0x20]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x20], 0x200
jne 0x140090c8d
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x140090c89
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x140090c89
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
test sil, sil
je 0x140090cab
movzx edx, byte [rcx]
dec dword [rax + 0x10]
shl dx, 8
movzx ecx, r14b
or dx, cx
inc qword [rax]
jmp 0x140090cb6
movzx edx, word [rcx]
add dword [rax + 0x10], 0xfffffffe
add qword [rax], 2
movzx eax, dx
jmp 0x140090b15
jmp 0x140090adc
Function at 0x1406de058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1406de1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406de089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406de06f
add dl, dl
jne 0x1406de096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406de0f6
xor eax, eax
add dl, dl
jne 0x1406de0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406de1ad
add dl, dl
jne 0x1406de0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406de0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406de0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406de0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406de0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406de07e
mov eax, 1
add dl, dl
jne 0x1406de106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406de113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406de0fb
sub eax, ebx
mov ebx, 1
jne 0x1406de14c
mov ecx, 1
add dl, dl
jne 0x1406de12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406de13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406de123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406de07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406de168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406de175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406de15d
cmp eax, 0x7d00
jae 0x1406de19b
cmp eax, 0x500
jb 0x1406de196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406de07e
cmp eax, 0x7f
ja 0x1406de19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406de07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406de1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406de07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20