joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d2ac
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x20], 0x70107032
mov dword [rbp - 0x1c], 0x7005700d
mov ebx, 0x7062
mov dword [rbp - 0x18], 0x70037010
mov dword [rbp - 0x14], 0x7026700f
mov dword [rbp - 0x10], 0x70167003
mov dword [rbp - 0xc], 0x70627003
mov dword [rbp - 8], 0x8dc67062
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xc
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d309
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000d328
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov ebx, 0x7060
mov dword [rbp - 0x60], 0x70157030
mov ecx, 0x56
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x5c], 0x7013700c
mov dword [rbp - 0x58], 0x70407005
mov dword [rbp - 0x54], 0x70057033
mov dword [rbp - 0x50], 0x70157003
mov dword [rbp - 0x4c], 0x70057012
mov dword [rbp - 0x48], 0x7023703c
mov dword [rbp - 0x44], 0x700e700f
mov dword [rbp - 0x40], 0x7005700e
mov dword [rbp - 0x3c], 0x70147003
mov dword [rbp - 0x38], 0x700f7009
mov dword [rbp - 0x34], 0x7033700e
mov dword [rbp - 0x30], 0x700f7014
mov dword [rbp - 0x2c], 0x70057012
mov dword [rbp - 0x28], 0x7003703c
mov dword [rbp - 0x24], 0x700e700f
mov dword [rbp - 0x20], 0x7013700e
mov dword [rbp - 0x1c], 0x700f7014
mov dword [rbp - 0x18], 0x70057012
mov dword [rbp - 0x14], 0x7004704e
mov dword [rbp - 0x10], 0x70147001
mov dword [rbp - 8], 0x8dc67060
call fcn.1400026b0
lea r9, [rbp - 0x60]
mov rdx, rax
sub r9, rax
mov r8d, 0x2b
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d3fe
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x14000d42c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov ebx, 0x700a
mov dword [rbp - 0x50], 0x70697028
mov ecx, 0x3e
mov dword [rbp - 0x14], ebx
mov dword [rbp - 0x4c], 0x70797063
mov dword [rbp - 0x48], 0x70657069
mov dword [rbp - 0x44], 0x70307028
mov dword [rbp - 0x40], 0x702a7071
mov dword [rbp - 0x3c], 0x707a7028
mov dword [rbp - 0x38], 0x706f7078
mov dword [rbp - 0x34], 0x706f706c
mov dword [rbp - 0x30], 0x706f7078
mov dword [rbp - 0x2c], 0x70697064
mov dword [rbp - 0x28], 0x7079706f
mov dword [rbp - 0x24], 0x70727024
mov dword [rbp - 0x20], 0x70667067
mov dword [rbp - 0x1c], 0x70307028
mov dword [rbp - 0x18], 0x7071702a
mov dword [rbp - 0x10], 0x8dc6700a
call fcn.1400026b0
lea r9, [rbp - 0x50]
mov rdx, rax
sub r9, rax
mov r8d, 0x1f
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d4d0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14000d4f8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x20
mov dword [rbp - 0x30], 0x702c707e
mov dword [rbp - 0x2c], 0x70307029
mov ebx, 0x705c
mov dword [rbp - 0x28], 0x7039702f
mov dword [rbp - 0x24], 0x7039702f
mov dword [rbp - 0x20], 0x7029703f
mov dword [rbp - 0x1c], 0x7039702e
mov dword [rbp - 0x18], 0x7066707e
mov dword [rbp - 0x14], 0x705c7027
mov dword [rbp - 0x10], 0x8dc6705c
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0x10
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d563
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14000d584
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x7051
mov dword [rbp - 0x30], 0x70237073
mov ecx, 0x26
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x2c], 0x70217035
mov dword [rbp - 0x28], 0x706b7073
mov dword [rbp - 0x24], 0x7073702a
mov dword [rbp - 0x20], 0x70347022
mov dword [rbp - 0x1c], 0x70277023
mov dword [rbp - 0x18], 0x70237034
mov dword [rbp - 0x14], 0x70737022
mov dword [rbp - 0x10], 0x700a706b
mov dword [rbp - 8], 0x8dc67051
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d5f9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14000d618
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x2c
mov dword [rbp - 0x30], 0x708c70dc
mov dword [rbp - 0x2c], 0x7099709b
mov ebx, 0x70fe
mov dword [rbp - 0x28], 0x708d7097
mov dword [rbp - 0x24], 0x708c708a
mov dword [rbp - 0x20], 0x70a17087
mov dword [rbp - 0x1c], 0x708c708e
mov dword [rbp - 0x18], 0x70987091
mov dword [rbp - 0x14], 0x70927097
mov dword [rbp - 0x10], 0x708d709b
mov dword [rbp - 0xc], 0x70c470dc
mov dword [rbp - 8], 0x70fe70a5
mov dword [rbp - 4], 0x8dc670fe
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d698
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14000d6b8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x70e0
mov dword [rbp - 0x20], 0x708e70a9
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x70947093
mov dword [rbp - 0x18], 0x708c7081
mov dword [rbp - 0x14], 0x70a4708c
mov dword [rbp - 0x10], 0x70927089
mov dword [rbp - 8], 0x8dc670e0
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d711
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x14000d730
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x70c2
mov dword [rbp - 0x20], 0x70b17097
mov ecx, 0x1a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x1c], 0x70b070a7
mov dword [rbp - 0x18], 0x70a370ac
mov dword [rbp - 0x14], 0x70a770af
mov dword [rbp - 0x10], 0x70ab708a
mov dword [rbp - 0xc], 0x70b670ac
mov dword [rbp - 4], 0x8dc670c2
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xd
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d790
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000d7b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ecx, 0x3c
mov dword [rbp - 0x40], 0x709170c0
mov dword [rbp - 0x3c], 0x708c708d
mov ebx, 0x70e2
mov dword [rbp - 0x38], 0x7081708b
mov dword [rbp - 0x34], 0x70837095
mov dword [rbp - 0x30], 0x708e708e
mov dword [rbp - 0x2c], 0x70d870c0
mov dword [rbp - 0x28], 0x70c07099
mov dword [rbp - 0x24], 0x708f7081
mov dword [rbp - 0x20], 0x70bd7086
mov dword [rbp - 0x1c], 0x70907092
mov dword [rbp - 0x18], 0x7084708d
mov dword [rbp - 0x14], 0x708e708b
mov dword [rbp - 0x10], 0x70917087
mov dword [rbp - 0xc], 0x70d870c0
mov dword [rbp - 8], 0x70e270b9
mov dword [rbp - 4], 0x8dc670e2
call fcn.1400026b0
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
mov r8d, 0x1e
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d84c
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x14000d86c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, SafeArrayGetElement
mov dword [rbp - 0x20], 0x70a370a8
mov dword [rbp - 0x1c], 0x708a7085
mov ebx, 0x70e6
mov dword [rbp - 0x18], 0x70c8708f
mov dword [rbp - 0x14], 0x709e7083
mov dword [rbp - 0x10], 0x70e67083
mov dword [rbp - 0xc], 0x8dc670e6
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xa
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d8c2
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000d8e4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x70c1
mov dword [rbp - 0x30], 0x70ed70e3
mov ecx, 0x22
mov dword [rbp - 0x10], ebx
mov dword [rbp - 0x2c], 0x70e370e1
mov dword [rbp - 0x28], 0x70b270b4
mov dword [rbp - 0x24], 0x70b370a4
mov dword [rbp - 0x20], 0x70a070af
mov dword [rbp - 0x1c], 0x70a470ac
mov dword [rbp - 0x18], 0x70fb70e3
mov dword [rbp - 0x14], 0x70e370e1
mov dword [rbp - 0xc], 0x8dc670c1
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0x11
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d952
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x14000d974
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ecx, 0x30
mov dword [rbp - 0x40], 0x70b170f5
mov dword [rbp - 0x3c], 0x70a570b8
mov ebx, 0x70d7
mov dword [rbp - 0x38], 0x70be70a3
mov dword [rbp - 0x34], 0x70b270b9
mov dword [rbp - 0x30], 0x70f570a3
mov dword [rbp - 0x2c], 0x70ac70ed
mov dword [rbp - 0x28], 0x70a370f5
mov dword [rbp - 0x24], 0x70b970a2
mov dword [rbp - 0x20], 0x70b270b9
mov dword [rbp - 0x1c], 0x70a470bb
mov dword [rbp - 0x18], 0x70ed70f5
mov dword [rbp - 0x14], 0x70d7708c
mov dword [rbp - 0x10], 0x8dc670d7
call fcn.1400026b0
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d9fb
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x14000da1c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov ecx, 0x7c
mov dword [rbp - 0x39], 0x7066704c
mov dword [rbp - 0x35], 0x706c707c
mov ebx, 0x700f
mov dword [rbp - 0x31], 0x70537060
mov dword [rbp - 0x2d], 0x7066704c
mov dword [rbp - 0x29], 0x706c707c
mov dword [rbp - 0x25], 0x702f7060
mov dword [rbp - 0x21], 0x7061704e
mov dword [rbp - 0x1d], 0x704c7076
mov dword [rbp - 0x19], 0x70617060
mov dword [rbp - 0x15], 0x706a7061
mov dword [rbp - 0x11], 0x707b706c
mov dword [rbp - 0xd], 0x705c702f
mov dword [rbp - 9], 0x706c706a
mov dword [rbp - 5], 0x707d707a
mov dword [rbp - 1], 0x702f706a
mov dword [rbp + 3], 0x70607042
mov dword [rbp + 7], 0x7066706d
mov dword [rbp + 0xb], 0x70667063
mov dword [rbp + 0xf], 0x7076707b
mov dword [rbp + 0x13], 0x704c702f
mov dword [rbp + 0x17], 0x70667063
mov dword [rbp + 0x1b], 0x7061706a
mov dword [rbp + 0x1f], 0x7053707b
mov dword [rbp + 0x23], 0x707d707f
mov dword [rbp + 0x27], 0x7069706a
mov dword [rbp + 0x2b], 0x707d706a
mov dword [rbp + 0x2f], 0x7061706a
mov dword [rbp + 0x33], 0x706a706c
mov dword [rbp + 0x37], 0x7021707c
mov dword [rbp + 0x3b], 0x70627077
mov dword [rbp + 0x3f], 0x700f7063
mov dword [rbp + 0x43], 0x8dc6700f
call fcn.1400026b0
lea r9, [rbp - 0x39]
mov rdx, rax
sub r9, rax
mov r8d, 0x3e
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000db3e
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000db74
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x7071
mov dword [rbp - 0x30], 0x70127053
mov ecx, 0x26
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x2c], 0x701f701e
mov dword [rbp - 0x28], 0x7002701f
mov dword [rbp - 0x24], 0x701e7005
mov dword [rbp - 0x20], 0x70147003
mov dword [rbp - 0x1c], 0x7015705f
mov dword [rbp - 0x18], 0x70057010
mov dword [rbp - 0x14], 0x704b7053
mov dword [rbp - 0x10], 0x70537051
mov dword [rbp - 8], 0x8dc67071
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000dbe9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x14000f984
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x298]
sub rsp, 0x390
lea rax, [0x140012120]
mov rdi, rcx
movups xmm0, xmmword [rax]
lea r8, [rbp - 0x50]
mov ecx, 0x80
movups xmm1, xmmword [rax + 0x10]
xor r14d, r14d
mov rsi, rdx
movups xmmword [r8], xmm0
lea rbx, [rbp - 0x50]
movups xmm0, xmmword [rax + 0x20]
movups xmmword [r8 + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [r8 + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [r8 + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [r8 + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [r8 + 0x50], xmm1
movups xmmword [r8 + 0x60], xmm0
add r8, rcx
movups xmm0, xmmword [rax + 0x70]
add rax, rcx
movups xmmword [r8 - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movups xmmword [r8], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [r8 + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
mov rax, qword [rax + 0x40]
movups xmmword [r8 + 0x20], xmm1
movups xmmword [r8 + 0x30], xmm0
mov qword [r8 + 0x40], rax
cmp word [rbp - 0x50], r14w
je 0x14000fb13
mov r8d, 0x208
lea rdx, [rbp + 0x80]
lea rcx, str.LOCALAPPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rdx, rsi
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, rbx
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.History
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x80]
call fcn.14000ff38
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000fb13
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14000f27c
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.14000f8ac
test eax, eax
jne 0x14000fb13
lea r9, [0x14000ecb8]
mov qword [rsp + 0x20], rdi
lea r8d, [rax + 1]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14000f39c
mov rcx, qword [rsp + 0x30]
call fcn.1400025b4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cdqe
lea rbx, [rbx + rax*2]
cmp word [rbx], r14w
jne 0x14000fa44
lea r11, [rsp + 0x390]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000fb34
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x620]
sub rsp, 0x720
mov rbx, rdx
mov rdi, rcx
lea rdx, [rbp - 0x50]
mov r8d, 0x208
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rdx, rbx
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str..default_release
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x3d0]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000fc50
lea rdx, [rbp + 0x3fc]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.places.sqlite
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x50]
call fcn.14000ff38
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000fc50
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14000f27c
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.14000f8ac
test eax, eax
jne 0x14000fc50
lea r9, [0x14000eed8]
mov qword [rsp + 0x20], rdi
lea r8d, [rax + 1]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14000f39c
mov rcx, qword [rsp + 0x30]
call fcn.1400025b4
xor eax, eax
jmp 0x14000fc55
mov eax, 1
lea r11, [rsp + 0x720]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x14000fddc
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rbx, rdx
mov rdi, rcx
lea rdx, [rbp - 0x50]
mov r8d, 0x208
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rdx, rbx
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x50]
call fcn.14000ff38
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000fe83
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14000f27c
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.14000f8ac
test eax, eax
jne 0x14000fe83
lea r9, [0x14000f104]
mov qword [rsp + 0x20], rdi
lea r8d, [rax + 1]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14000f39c
mov rcx, qword [rsp + 0x30]
call fcn.1400025b4
lea r11, [rsp + 0x2c0]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14000ff38
Capabilities:
Check if file exists
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0xd0
mov r15, rdx
mov byte [rsp + 0x40], 0x88
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 2
mov ecx, 1
movsxd rdx, eax
call fcn.140002588
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
and qword [rsp + 0x38], 0
or r9d, 0xffffffff
and qword [rsp + 0x30], 0
mov r8, rbx
mov dword [rsp + 0x28], eax
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x140010077
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OpenFile]
mov rcx, rdi
movsxd rsi, eax
call fcn.1400025b4
cmp rsi, 0xffffffffffffffff
je 0x140010077
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
je 0x140010077
lea ecx, [rbx + 1]
call fcn.1400025dc
mov rbp, rax
test rax, rax
je 0x140010077
and qword [rsp + 0x28], 0
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebx
mov rcx, rsi
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r14, rax
test rax, rax
je 0x140010077
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r8d, ebx
mov rcx, rbp
mov rdx, rax
mov rdi, rax
call fcn.1400100f0
mov rcx, rdi
mov qword [r15], rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbp
jmp 0x140010079
xor eax, eax
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1800014f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x180092684
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
movabs r10, 0x180161c32
add dword [rax], eax
add byte [rax], al
xor r9d, r9d
mov dword [rax + 8], 0x62756373
mov r10, qword [r10]
mov byte [rax + 0xc], r9b
mov edx, 0x3d0904
mov eax, r9d
lea rcx, [rsp + 0x20]
mov byte [rcx], al
inc eax
inc rcx
cmp eax, 0x6e
jb 0x1800926c2
dec rdx
jne 0x1800926ba
movsxd rax, dword [r10 + 0x3c]
mov ecx, dword [rax + r10 + 0x88]
test ecx, ecx
je 0x180092772
lea rax, [r10 + rcx]
mov r11d, r9d
mov esi, dword [rax + 0x18]
test esi, esi
jle 0x180092772
mov ebx, dword [rax + 0x24]
mov r14d, dword [rax + 0x1c]
mov r8d, dword [rax + 0x20]
movsx eax, byte [rsp + 0x20]
imul ecx, eax, 0x298
lea rax, [r10 + r8]
add rbx, r10
movsxd rdx, ecx
lea rdi, [rax + rdx*4]
movzx eax, word [rbx]
lea r8, [rsp + 0xb0]
lea rcx, [r14 + rax*4]
mov eax, dword [rdi]
mov ebp, dword [rcx + r10]
add rax, r10
jmp 0x18009273e
cmp cl, byte [r8]
jne 0x180092744
inc rax
inc r8
mov cl, byte [rax]
test cl, cl
jne 0x180092733
mov cl, byte [rax]
mov edx, r9d
mov eax, r9d
cmp cl, byte [r8]
seta dl
cmp byte [r8], cl
seta al
cmp edx, eax
je 0x18009276e
inc r11d
add rdi, 4
add rbx, 2
cmp r11d, esi
jl 0x180092719
jmp 0x180092772
lea r9, [r10 + rbp]
call r9
lea r11, [rsp + 0x90]
xor eax, eax
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x180009620
Capabilities:
Create thread
Resume thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
xor eax, eax
mov ecx, 1
lock cmpxchg dword [rbx + 0x3c], ecx
setne dl
test dl, dl
jne 0x18000967d
lea rax, [rbx + 0x38]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x180009710]
xor edx, edx
mov dword [rsp + 0x20], 4
xor ecx, ecx
call fcn.1800c19dc
mov qword [rbx + 0x30], rax
mov rax, qword [rbx + 0x30]
test rax, rax
je 0x180009698
mov rcx, qword [rbx + 0x30]
add rsp, 0x30
pop rbx
jmp qword [sym.imp.KERNEL32.dll_ResumeThread]
xor r9d, r9d
lea rdx, str.c:dvsp4_build_sw_relgpu_drvinstaller_coreinstaller_core_vs2017incSimpleThread.h
mov r8d, 0x86
mov ecx, 0x80004005
call fcn.18003abe0
int3
call fcn.180039260
int3
Function at 0x18000ea20
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0xf0], rbx
mov rax, qword [0x1801610c0]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov r12, rdx
mov r15, rcx
mov ecx, 0x800
call fcn.180091f10
mov rbx, rax
mov qword [rsp + 0x50], rax
mov eax, 0x400
mov dword [rsp + 0x44], eax
xor esi, esi
mov ebp, esi
or r13, 0xffffffffffffffff
movzx edi, byte [rsp + 0x40]
nop dword [rax]
nop dword [rax + rax]
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x48]
mov r8, rbx
mov edx, ebp
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0xea
jne 0x18000eb25
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x44], eax
lea ecx, [rax + 1]
mov eax, 2
mul rcx
cmovo rax, r13
mov rcx, rax
call fcn.180091f10
mov r14, rax
cmp rax, rbx
je 0x18000eaf6
mov edx, 2
mov rcx, rbx
call fcn.180091f20
mov rbx, r14
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x44]
mov r8, r14
mov edx, ebp
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x18000eb8d
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], si
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.180038970
nop
mov byte [rsp + 0x20], dil
lea r9, [rsp + 0x70]
lea rdx, [rsp + 0x60]
mov rcx, r12
call fcn.18000e770
nop
lea rcx, [rsp + 0x70]
call fcn.1800389f0
inc ebp
mov eax, dword [rsp + 0x44]
jmp 0x18000ea90
cmp eax, 0x103
cmovne esi, eax
mov edx, 2
mov rcx, rbx
call fcn.180091f20
mov eax, esi
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1800916f0
mov rbx, qword [rsp + 0xf0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret