joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140071668
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor edi, edi
mov r12, rdx
mov r14, rcx
test rcx, rcx
je 0x1400717bc
test rdx, rdx
je 0x1400717bc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, 0x8000
mov esi, eax
mov ecx, ebp
call fcn.1400ac0b4
mov rbx, rax
test rax, rax
jne 0x1400716c2
lea edi, [rax + 8]
jmp 0x1400717b0
mov r8d, esi
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
jne 0x1400716e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x1400717b0
lea r9, [rsp + 0x70]
mov dword [rsp + 0x70], edi
mov r8d, ebp
mov rdx, rbx
mov rcx, rsi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
jne 0x140071718
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400717b0
mov eax, dword [rsp + 0x70]
mov ebp, edi
shr eax, 3
mov r15b, dil
mov dword [rsp + 0x70], eax
test eax, eax
je 0x14007179d
xor eax, eax
mov r13d, ebp
xorps xmm0, xmm0
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x20]
mov rcx, rsi
movups xmmword [rsp + 0x20], xmm0
mov rdx, qword [rbx + r13*8]
lea r9d, [rax + 0x18]
call sub.PSAPI.DLL_GetModuleInformation
test eax, eax
je 0x14007176f
cmp qword [rsp + 0x20], r14
jg 0x14007176f
mov eax, dword [rsp + 0x28]
mov rcx, r14
sub rcx, qword [rsp + 0x20]
cmp rcx, rax
jl 0x140071779
inc ebp
cmp ebp, dword [rsp + 0x70]
jae 0x14007179d
jmp 0x14007172c
mov rdx, qword [rbx + r13*8]
mov r9d, 0x104
mov r8, r12
mov rcx, rsi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x140071797
mov r15b, 1
jmp 0x14007179d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15b, r15b
jne 0x1400717b0
mov edi, 5
mov rcx, rbx
call fcn.1400ab6e0
mov eax, edi
jmp 0x1400717c1
mov eax, 0x57
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x140071bac
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x140150a10]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, r8
test rcx, rcx
je 0x140071c3a
cmp edx, 1
jb 0x140071c3a
test rbx, rbx
je 0x140071c3a
cmp r9d, 0x10
jne 0x140071c3a
and dword [rsp + 0x24], 0
mov r8d, edx
and dword [rsp + 0x20], 0
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x28], 0x67452301
mov dword [rsp + 0x2c], 0xefcdab89
mov dword [rsp + 0x30], 0x98badcfe
mov dword [rsp + 0x34], 0x10325476
call fcn.140071d64
lea rcx, [rsp + 0x20]
call fcn.140071c58
mov r8d, 0x10
lea rdx, [rsp + 0x78]
mov rcx, rbx
call fcn.1400ada20
xor eax, eax
jmp 0x140071c3d
or eax, 0xffffffff
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400ab6c0
add rsp, 0xa0
pop rbx
ret
Function at 0x14007321c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x68
lea rbp, [rsp + 0x30]
mov rax, qword [0x140150a10]
xor rax, rbp
mov qword [rbp + 0x28], rax
mov r14, rdx
mov r15, rcx
mov rsi, qword [rbp + 0x90]
test rsi, rsi
je 0x140073263
and dword [rsi], 0
and dword [rbp], 0
mov dword [rbp + 4], 0x1f4
and qword [rbp + 8], 0
mov eax, dword [rsp]
mov eax, 0x210
sub rsp, rax
lea rbx, [rsp + 0x30]
mov eax, dword [rbx]
mov qword [rbp + 0x10], rbx
test rbx, rbx
je 0x14007329c
mov dword [rbx], 0xcccc
add rbx, 0x10
mov qword [rbp + 0x10], rbx
mov qword [rbp + 8], rbx
jmp 0x1400732ba
test rbx, rbx
je 0x14007341f
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp]
xor r8d, r8d
mov rdx, r14
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
cmp eax, 0xea
jne 0x1400733cb
lea rcx, [rbx - 0x10]
cmp dword [rcx], 0xdddd
jne 0x140073302
call fcn.1400b2c30
and qword [rbp + 8], 0
mov eax, dword [rbp + 4]
lea rcx, [rax + 0x10]
cmp rax, rcx
sbb rdx, rdx
and rdx, rcx
je 0x140073383
cmp rdx, 0x400
ja 0x14007335f
lea rax, [rdx + 0xf]
cmp rax, rdx
ja 0x140073335
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1400ac160
sub rsp, rax
lea rbx, [rsp + 0x30]
mov qword [rbp + 0x18], rbx
test rbx, rbx
je 0x140073385
mov dword [rbx], 0xcccc
add rbx, 0x10
mov qword [rbp + 0x18], rbx
jmp 0x140073385
mov rcx, rdx
call fcn.1400bd548
mov rbx, rax
mov qword [rbp + 0x20], rax
test rax, rax
je 0x140073385
mov dword [rax], 0xdddd
add rbx, 0x10
mov qword [rbp + 0x20], rbx
jmp 0x140073385
xor ebx, ebx
mov qword [rbp + 8], rbx
jmp 0x1400733a3
test rbx, rbx
je 0x14007341f
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp]
xor r8d, r8d
mov rdx, r14
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
jne 0x14007340a
cmp dword [rbp], 3
je 0x1400733dc
mov edi, 0xd
jmp 0x14007340a
mov rax, qword [rbp + 0x88]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x80]
lea r8, [rbp]
mov edx, dword [rbp + 4]
mov rcx, rbx
call fcn.140073668
mov edi, eax
test rsi, rsi
je 0x14007340a
mov eax, dword [rbp]
mov dword [rsi], eax
lea rcx, [rbx - 0x10]
cmp dword [rcx], 0xdddd
jne 0x14007341b
call fcn.1400b2c30
mov eax, edi
jmp 0x140073424
mov eax, 0xe
mov rcx, qword [rbp + 0x28]
xor rcx, rbp
call fcn.1400ab6c0
lea rsp, [rbp + 0x38]
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140073440
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x70], rbx
mov rax, qword [0x140150a10]
xor rax, rbp
mov qword [rbp + 0x28], rax
mov r14, r9
mov rbx, r8
mov rsi, rdx
mov r15, rcx
mov dword [rbp], 1
and dword [rbp + 4], 0
mov rdi, qword [rbp + 0x80]
test rdi, rdi
je 0x140073499
mov eax, dword [rdi]
mov dword [rbp + 4], eax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r14
lea r9, [rbp]
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test rbx, rbx
je 0x1400734bd
mov ecx, dword [rbp]
mov dword [rbx], ecx
cmp dword [rbp], 1
je 0x1400734cd
cmp dword [rbp], 7
jne 0x14007364a
test rdi, rdi
je 0x14007364a
mov ecx, dword [rdi]
test ecx, ecx
je 0x14007364a
test eax, eax
je 0x1400734ef
cmp eax, 0xea
jne 0x14007364a
mov eax, dword [rbp + 4]
mov dword [rbp + 4], ecx
mov dword [rdi], eax
test r14, r14
je 0x140073509
mov r8d, eax
xor edx, edx
mov rcx, r14
call fcn.1400ae360
and qword [rbp + 0x10], 0
mov eax, dword [rbp + 4]
lea rcx, [rax + 0x10]
cmp rax, rcx
sbb rdx, rdx
and rdx, rcx
je 0x14007358a
cmp rdx, 0x400
ja 0x140073566
lea rax, [rdx + 0xf]
cmp rax, rdx
ja 0x14007353c
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1400ac160
sub rsp, rax
lea rbx, [rsp + 0x30]
mov qword [rbp + 0x18], rbx
test rbx, rbx
je 0x14007358c
mov dword [rbx], 0xcccc
add rbx, 0x10
mov qword [rbp + 0x18], rbx
jmp 0x14007358c
mov rcx, rdx
call fcn.1400bd548
mov rbx, rax
mov qword [rbp + 0x20], rax
test rax, rax
je 0x14007358c
mov dword [rax], 0xdddd
add rbx, 0x10
mov qword [rbp + 0x20], rbx
jmp 0x14007358c
xor ebx, ebx
mov qword [rbp + 0x10], rbx
jmp 0x1400735ae
test rbx, rbx
jne 0x1400735bb
lea eax, [rbx + 0xe]
jmp 0x14007364a
mov r8d, dword [rbp + 4]
xor edx, edx
mov rcx, rbx
call fcn.1400ae360
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test eax, eax
jne 0x140073637
cmp dword [rbp], 1
jne 0x14007361a
mov eax, dword [rdi]
shr eax, 1
mov dword [rbp + 8], eax
lea r9, [rbp + 8]
mov r8, r14
mov rdx, rbx
lea ecx, [rsi + 3]
call fcn.140071ae8
mov esi, eax
mov eax, dword [rbp + 8]
add eax, eax
mov dword [rdi], eax
jmp 0x140073637
cmp dword [rbp], 7
jne 0x140073635
mov r9, rdi
mov r8, r14
mov rdx, rbx
mov rcx, r15
call fcn.1400730fc
mov esi, eax
jmp 0x140073637
xor esi, esi
lea rcx, [rbx - 0x10]
cmp dword [rcx], 0xdddd
jne 0x140073648
call fcn.1400b2c30
mov eax, esi
mov rcx, qword [rbp + 0x28]
xor rcx, rbp
call fcn.1400ab6c0
mov rbx, qword [rbp + 0x70]
lea rsp, [rbp + 0x30]
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400739e0
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
and qword [rcx + 8], 0
mov rbx, rcx
and qword [rcx + 0x10], 0
xor edx, edx
and qword [rcx + 0x18], 0
and qword [rcx + 0x20], 0
and qword [rcx + 0x28], 0
and qword [rcx + 0x30], 0
and qword [rcx + 0x38], 0
lea rcx, str.mfehida.dll
call fcn.140074624
mov qword [rbx], rax
test rax, rax
je 0x140073ab2
lea rdx, str.MPTMappedFileHelperInitialize
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.MPTGetModuleFileName
mov qword [rbx + 8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.MPTGetModuleFileNameEx
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.MPTGetMappedFileName
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.MPTGetProcessImageFileName
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.MPTQueryFullProcessImageName
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.MPTMappedFileHelperTerminate
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x38], rax
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x140073be4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rbp, r9
lea rax, [r11 - 0x20]
mov rdi, r8
mov qword [r11 - 0x38], rax
mov r14, rdx
mov r15b, cl
mov r9d, 0x20219
lea rdx, str.SoftwareMcAfeeSystemCore
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov ebx, 3
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor esi, esi
test eax, eax
cmove rsi, qword [rsp + 0x38]
test rsi, rsi
je 0x140073cd1
lea eax, [rbp*2]
xor r8d, r8d
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rdi
mov rcx, rsi
lea rdx, str.szInstallDir32
test r15b, r15b
jne 0x140073c7d
lea rdx, str.szInstallDir64
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x140073cc8
test rdi, rdi
je 0x140073cc8
lea r8, [0x1401252d8]
mov rdx, rbp
mov rcx, rdi
call fcn.140074728
test eax, eax
js 0x140073cbb
test r14, r14
je 0x140073cc8
mov r8, r14
mov rdx, rbp
mov rcx, rdi
call fcn.140074728
test eax, eax
jns 0x140073cc8
mov ecx, 0x6f
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x68]
test ebx, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
sete al
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x140075148
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x140150a10]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rcx
xor ebp, ebp
mov dword [rcx], ebp
mov qword [rcx + 8], rbp
mov qword [rcx + 0x10], rbp
mov dword [rcx + 0x18], ebp
mov qword [rcx + 0x20], rbp
mov qword [rcx + 0x28], rbp
lea rbx, [rcx + 0x30]
mov qword [rsp + 0x28], rbx
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
lea ecx, [rbp + 0x58]
call fcn.1400ab6e8
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
mov dword [rdi + 0x40], ebp
lea rbx, [rdi + 0x48]
mov qword [rbx], rbp
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 7
mov word [rbx], bp
test rsi, rsi
je 0x1400751da
mov rdx, rsi
jmp 0x14007521e
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x30]
call fcn.1400ae360
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathStripToRootW]
lea rdx, str.Program_FilesCommon_FilesMcAfeePlatformCore_trusted.js
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14000dfe0
nop
mov rax, rdi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400ab6c0
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop rdi
pop rsi
pop rbp
ret
Function at 0x140077240
Capabilities:
Check if file exists
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x440]
sub rsp, 0x540
mov rax, qword [0x140150a10]
xor rax, rsp
mov qword [rbp + 0x430], rax
mov rdi, rcx
xor ebx, ebx
cmp dword [rcx + 0x20], ebx
jne 0x140077279
xor eax, eax
jmp 0x1400774aa
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
mov r8d, 3
lea rcx, [rsp + 0x60]
call fcn.14007705c
nop
mov esi, 0x104
mov r8d, esi
xor edx, edx
lea rcx, [rbp + 0x320]
call fcn.1400ae360
mov r8d, esi
xor edx, edx
lea rcx, [rbp + 0x210]
call fcn.1400ae360
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov r8, rax
mov edx, esi
lea rcx, [rbp + 0x320]
lea rax, [rbp + 0x320]
sub r8, rax
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x1400772fb
mov al, byte [r8 + rcx]
test al, al
je 0x1400772fb
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x1400772dc
lea rax, [rcx - 1]
test rdx, rdx
cmovne rax, rcx
mov byte [rax], bl
mov r8, rsi
lea rcx, [rbp + 0x210]
lea rax, [rbp + 0x210]
mov r9, qword [rsp + 0x60]
sub r9, rax
lea rax, [r8 + 0x7ffffefa]
test rax, rax
je 0x140077340
mov al, byte [r9 + rcx]
test al, al
je 0x140077340
mov byte [rcx], al
inc rcx
sub r8, 1
jne 0x140077321
lea rax, [rcx - 1]
test r8, r8
cmovne rax, rcx
mov byte [rax], bl
lea rcx, [rbp + 0x210]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea r8, [0x140100f6c]
mov rdx, rsi
lea rcx, [rbp + 0x210]
call fcn.140077194
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
or dword [rsp + 0x38], 0xffffffff
lea rax, [0x140077530]
mov qword [rsp + 0x30], rax
lea rax, [0x1400774d0]
mov qword [rsp + 0x28], rax
lea rax, [0x140077540]
mov qword [rsp + 0x20], rax
lea r9, [0x140077520]
lea r8, [fcn.1400774e0]
lea rdx, [0x140077560]
lea rcx, [0x140077550]
mov rax, qword [rdi + 8]
call qword [case.0x14005c601.0]
mov rsi, rax
test rax, rax
je 0x140077494
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x100]
call fcn.1400ae360
lea rax, [rbp + 0x100]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
lea rax, [0x140077570]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp + 0x210]
lea rdx, [rbp + 0x320]
mov rcx, rsi
mov rax, qword [rdi + 0x10]
call qword [case.0x14005c601.0]
mov rcx, rsi
mov rax, qword [rdi + 0x18]
call qword [case.0x14005c601.0]
lea rcx, [rbp + 0x104]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x140077494
cmp dword [rbp + 0x100], ebx
je 0x140077486
lea rax, [rbp - 8]
mov qword [rbp - 0x10], rax
mov r8d, 3
lea rdx, [rbp + 0x104]
lea rcx, [rbp - 0x10]
call fcn.140076f50
nop
mov rcx, qword [rbp - 0x10]
call fcn.14006f6e0
mov ebx, eax
lea rax, [rbp - 8]
mov rcx, qword [rbp - 0x10]
cmp rcx, rax
je 0x140077486
call fcn.1400b2c30
lea rcx, [rbp + 0x104]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
cmp rcx, rax
je 0x1400774a8
call fcn.1400b2c30
mov eax, ebx
mov rcx, qword [rbp + 0x430]
xor rcx, rsp
call fcn.1400ab6c0
mov rbx, qword [rsp + 0x570]
add rsp, 0x540
pop rdi
pop rsi
pop rbp
ret
Function at 0x14007b2f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140150a10]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x30], rdx
mov r8, qword [r8 + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14007b32a
mov rdx, qword [rdi]
xor ebp, ebp
movabs r9, 0xcbf29ce484222325
mov ecx, ebp
add r8, r8
je 0x14007b363
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x14007b350
mov r8, rdi
lea rdx, [rsp + 0x20]
lea rcx, [0x14015d6b0]
call fcn.140046390
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x14007b4e3
cmp qword [0x14015d6b8], rcx
je 0x14007b4e3
mov qword [rsp + 0x30], rsi
mov rcx, qword [rcx + 0x68]
test rcx, rcx
je 0x14007b50e
mov rax, qword [rcx]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rax, qword [rax + 0x10]
call qword [case.0x14005c601.0]
nop
mov rsi, qword [rsp + 0x48]
test rsi, rsi
jne 0x14007b41c
mov rdx, rdi
mov rcx, rbx
call fcn.140009d00
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x14007b4ee
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b412
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007b514
call fcn.1400ab6e0
jmp 0x14007b4ee
mov qword [rbx], rbp
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], rbp
lea rdi, [rsp + 0x38]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
cmovae rdi, rcx
cmp rsi, 8
jae 0x14007b451
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
mov ebp, 7
jmp 0x14007b4a3
mov rbp, rsi
or rbp, 7
movabs rax, 0x7ffffffffffffffe
cmp rbp, rax
cmova rbp, rax
mov rdx, rbp
add rdx, 1
mov rax, 0xffffffffffffffff
cmovb rdx, rax
mov rcx, rbx
call fcn.14000e0c0
mov qword [rbx], rax
lea r8, [rsi*2 + 2]
mov rdx, rdi
mov rcx, rax
call fcn.1400ada20
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], rbp
cmp rdx, 8
jb 0x14007b4ee
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b412
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007b514
jmp 0x14007b412
mov rdx, rdi
mov rcx, rbx
call fcn.140009d00
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400ab6c0
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
call fcn.1400a87e0
int3
call fcn.1400b2bb8
int3
Function at 0x1400912c0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140150a10]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, rcx
mov eax, r8d
mov edi, r8d
xor edi, 8
and al, 8
cmove edi, r8d
test rcx, rcx
jne 0x1400912f9
xor eax, eax
jmp 0x1400913c3
xor ebp, ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140105e90]
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x28], rbx
test eax, eax
jns 0x14009132b
mov edi, ebp
jmp 0x1400913b2
mov r9, rsi
mov r8, rbx
lea rdx, [0x140105588]
lea rcx, [rsp + 0x30]
call fcn.1400911b0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
mov r8d, edi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x14009139f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009139a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400913e0
call fcn.1400ab6e0
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], bp
test rbx, rbx
je 0x1400913c0
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400ab6c0
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
call fcn.1400b2bb8
nop
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400912c0

Function at 0x1400913f0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140150a10]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, rcx
mov eax, r8d
mov edi, r8d
xor edi, 8
and al, 8
cmove edi, r8d
test rcx, rcx
jne 0x1400912f9
xor eax, eax
jmp 0x1400913c3
xor ebp, ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140105e90]
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x28], rbx
test eax, eax
jns 0x14009132b
mov edi, ebp
jmp 0x1400913b2
mov r9, rsi
mov r8, rbx
lea rdx, [0x140105588]
lea rcx, [rsp + 0x30]
call fcn.1400911b0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
mov r8d, edi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x14009139f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009139a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400913e0
call fcn.1400ab6e0
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], bp
test rbx, rbx
je 0x1400913c0
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400ab6c0
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
call fcn.1400b2bb8
nop
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400912c0