joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005ef58
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14005efdf
mov rsi, rbx
cmp word [rax], bp
je 0x14005ef9e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14005ef88
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14005ef84
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14005a1c0
mov rdi, rax
test rax, rax
je 0x14005efcc
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400640c0
mov rbp, rdi
xor ecx, ecx
call fcn.14005a184
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140062e20
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140058c80
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140058c80
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140062f70
cmp rax, 0xffffffffffffffff
je 0x140062f70
xor edi, edi
test rbp, rbp
jle 0x140062f1b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14005ce8c
mov rbx, rax
test rax, rax
jne 0x140062ea8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140062f11
mov edx, 0x8000
mov ecx, r14d
call fcn.140057bac
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14005c180
cmp eax, 0xffffffff
je 0x140062ef1
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140062eb8
mov edx, r15d
mov ecx, r14d
call fcn.140057bac
jmp 0x140062f11
cmp byte [rsi + 0x38], dil
je 0x140062f08
cmp dword [rsi + 0x34], 5
jne 0x140062f08
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], send
cmp byte [rsi + 0x30], dil
je 0x140062f11
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14005a184
jmp 0x140062f84
jns 0x140062f84
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140058c80
cmp rax, 0xffffffffffffffff
jne 0x140062f3c
cmp byte [rsi + 0x30], dil
je 0x140062f84
mov edi, dword [rsi + 0x2c]
jmp 0x140062f84
mov ecx, r14d
call fcn.14005fa4c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140062f84
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, recv
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], send
jmp 0x140062f84
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140062f7d
mov eax, dword [rsi + 0x2c]
jmp 0x140062f82
mov eax, socket
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140058c80
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140063d90
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140063db8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140063db8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400733d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, qword [rcx]
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x140073431
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1400733f0
mov ecx, dword [r9]
jmp 0x140073518
cmp ecx, 0x4e0
jb 0x140073518
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140073450
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400734a0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x140398b64
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x1403df2a8]
test rax, rax
je 0x140398bae
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140398bae
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140398bae
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140398bae
cmp dword [rcx + 0x84], 0xe
jbe 0x140398bae
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140398bb0
xor al, al
add rsp, 0x28
ret

Function at 0x1403b1e04
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1403b1c00
Function at 0x140001320
Capabilities:
Create directory

Disassembly:
mov eax, 0x14d8
call fcn.140018d20
sub rsp, rax
mov rax, qword [0x140027010]
xor rax, rsp
mov qword [rsp + 0x14c0], rax
cmp byte [0x140028fc0], 0
je 0x1400014cb
cmp qword [0x140028fc8], 0
jne 0x1400014cb
mov qword [rsp + 0x14d0], rbx
xor ebx, ebx
mov qword [rsp + 0x58], rbx
lea edx, [rbx + 0x10]
call fcn.140008160
movups xmm0, xmmword [str.DebugLogs]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], 0xf
mov qword [rsp + 0x60], 9
movups xmmword [rax], xmm0
movzx ecx, word [0x140021ee0]
mov word [rax + 0x10], cx
lea rcx, [rsp + 0x50]
mov word [rax + 0x12], bx
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400013e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1400013e2
cmp eax, 0xb7
je 0x1400013e2
mov edx, eax
lea rcx, str.Failed_to_create_log_directory
call fcn.140001250
jmp 0x140001485
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rsp + 0x4a]
movzx edx, word [rsp + 0x48]
movzx eax, word [rsp + 0x4c]
movzx r10d, word [rsp + 0x46]
movzx r9d, word [rsp + 0x42]
movzx r8d, word [rsp + 0x40]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x28], edx
lea rdx, str.DebugLogs_04d_02d_02d__02d_02d_02d_upd.txt
mov dword [rsp + 0x20], r10d
call qword [sym.imp.USER32.dll_wsprintfW]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x70]
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140028fc8], rax
cmp rax, 0xffffffffffffffff
jne 0x140001485
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_create_log_file
call fcn.140001250
mov qword [0x140028fc8], rbx
mov rdx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x14d0]
cmp rdx, 8
jb 0x1400014cb
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400014c6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400014e3
call fcn.140009ae0
mov rcx, qword [rsp + 0x14c0]
xor rcx, rsp
call fcn.140009590
add rsp, 0x14d8
ret
call fcn.14000ff34
int3
Function at 0x140001ca0
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x140027010]
xor rax, rsp
mov qword [rbp + 0x47], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
mov edx, 0x10
call fcn.140008160
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x37], 0xe
mov qword [rbp + 0x3f], 0xf
movups xmm0, xmmword [str.tupdates_ready]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1400220d0]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x1400220d8]
mov dword [rax + 0x18], ecx
xor ebx, ebx
mov word [rax + 0x1c], bx
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
lea edx, [rbx + 0x10]
call fcn.140008160
mov qword [rbp + 7], rax
mov qword [rbp + 0x17], 0xd
mov qword [rbp + 0x1f], 0xf
movups xmm0, xmmword [str.tupdates_temp]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1400220f0]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x1400220f8]
mov word [rax + 0x18], cx
mov word [rax + 0x1a], bx
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], rbx
mov qword [rbp - 1], 7
lea edx, [rbx + 0x10]
call fcn.140008160
mov qword [rbp - 0x19], rax
mov qword [rbp - 9], 8
mov qword [rbp - 1], 0xf
movups xmm0, xmmword [str.tupdates]
movups xmmword [rax], xmm0
mov word [rax + 0x10], bx
lea rcx, [rbp + 0x27]
call fcn.140001980
lea rcx, [rbp + 7]
call fcn.140001980
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
nop
mov rdx, qword [rbp - 1]
cmp rdx, 8
jb 0x140001df8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001df3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001ea4
call fcn.140009ae0
mov qword [rbp - 9], rbx
mov qword [rbp - 1], 7
mov word [rbp - 0x19], bx
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x140001e45
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e3f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001eaa
call fcn.140009ae0
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 8
jb 0x140001e81
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e7c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001e9e
call fcn.140009ae0
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140009590
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rbp
ret
call fcn.14000ff34
nop
call fcn.14000ff34
nop
call fcn.14000ff34
int3
Function at 0x140006c50
Capabilities:
Create directory

Disassembly:
push rbx
mov eax, 0x3d80
call fcn.140018d20
sub rsp, rax
mov rax, qword [0x140027010]
xor rax, rsp
mov qword [rsp + 0x3d70], rax
mov rbx, rcx
lea rdx, str._stdata_
mov r8, rcx
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140006cad
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140006ce6
mov r8, rbx
lea rdx, str._sdumps_
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140006ced
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140006ced
xor eax, eax
jmp 0x140006dea
lea r8, str.Updater.exe
mov edx, 0xa28
lea rcx, [rsp + 0x14d0]
call fcn.14000fabc
mov edx, 0x2e
lea rcx, [rsp + 0x14d0]
call fcn.14000b1e8
test rax, rax
je 0x140006d2d
lea rdx, [0x14002207c]
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movzx ecx, word [rsp + 0x7c]
movzx edx, word [rsp + 0x7a]
movzx r8d, word [rsp + 0x78]
movzx r9d, word [rsp + 0x76]
movzx r10d, word [rsp + 0x72]
movzx r11d, word [rsp + 0x70]
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x58], eax
lea rax, str.0.1.0
mov dword [rsp + 0x50], ecx
lea rcx, [rsp + 0x2920]
mov dword [rsp + 0x48], edx
lea rdx, str._s_s__s__04d_02d_02d__02d_02d_02d__ld__ld.dmp
mov dword [rsp + 0x40], r8d
lea r8, [rsp + 0x80]
mov dword [rsp + 0x38], r9d
lea r9, [rsp + 0x14d0]
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], r11d
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
lea rcx, [rsp + 0x2920]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], eax
mov edx, 0xc0000000
mov dword [rsp + 0x20], 2
lea r8d, [rax + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, qword [rsp + 0x3d70]
xor rcx, rsp
call fcn.140009590
add rsp, 0x3d80
pop rbx
ret
Function at 0x140006e10
Capabilities:
Query environment variable

Disassembly:
push rdi
mov eax, 0x2900
call fcn.140018d20
sub rsp, rax
mov rax, qword [0x140027010]
xor rax, rsp
mov qword [rsp + 0x28f0], rax
mov rdi, rcx
mov rcx, qword [0x140028fc8]
test rcx, rcx
je 0x140006e51
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140028fc8], 0
lea rcx, str.DBGHELP.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x140006fc5
lea rdx, str.MiniDumpWriteDump
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140029020], rax
test rax, rax
je 0x140006fc5
mov qword [rsp + 0x2920], rsi
xor ecx, ecx
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8d, 0xa28
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140006fbd
mov eax, eax
lea rdx, str.Updater.exe
mov qword [rsp + 0x2918], rbx
lea rbx, [rsp + rax*2 + 0x3a]
mov rcx, rbx
call fcn.14000f94c
test eax, eax
jne 0x140006f01
lea rdx, [0x14002207c]
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x50]
call fcn.140006c50
mov rsi, rax
lea rcx, [rax + 1]
test rcx, 0xfffffffffffffffe
jne 0x140006f57
mov r8d, 0xa28
lea rdx, [rsp + 0x14a0]
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x140006f52
mov eax, eax
lea rcx, [rsp + 0x14a0]
lea r8, str.Telegram_Desktop
lea rdx, str._s_
lea rcx, [rcx + rax*2]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x14a0]
call fcn.140006c50
mov rsi, rax
test rsi, rsi
je 0x140006fb5
cmp rsi, 0xffffffffffffffff
je 0x140006fb5
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov qword [rsp + 0x44], rdi
mov rdi, qword [0x140029020]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x4c], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov r9d, 1
mov qword [rsp + 0x20], rcx
mov r8, rsi
mov rcx, rax
mov edx, ebx
call rdi
mov rbx, qword [rsp + 0x2918]
mov rsi, qword [rsp + 0x2920]
mov rcx, qword [rsp + 0x28f0]
xor rcx, rsp
call fcn.140009590
add rsp, 0x2900
pop rdi
ret
Function at 0x14000a21c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000a266
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000a266
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000a266
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000a266
cmp dword [rcx + 0x84], 0xe
jbe 0x14000a266
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000a268
xor al, al
add rsp, 0x28
ret
Function at 0x1400135f0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140013677
mov rsi, rbx
cmp word [rax], bp
je 0x140013636
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140013620
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14001361c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400122a0
mov rdi, rax
test rax, rax
je 0x140013664
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14000f200
mov rbp, rdi
xor ecx, ecx
call fcn.1400123b4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001869c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x140018714
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x140018714
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x140018714
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x140018708
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x140018726
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x1400186f6
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x140018716

Function at 0x140018c50
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140018c78
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140018c78
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001c30
Capabilities:
Encode data using xor

Disassembly:
add byte [rsi - 0x28], 0x51
stc
xor dword [r10 - 0x6747c396], ecx
mov ah, 0x16
add eax, 0x458ec23a
xor byte [rcx + 0x12], bl
cli
and byte [rdi], ah
jl 0x140001c22
invalid
xor edx, eax
mov bh, 0x40
invalid

Function at 0x1400034f8
Capabilities:
Encode data using xor

Disassembly:
lea edi, [rax + 0x5ecc378f]
rol byte [rbx], 1
add edi, dword [rcx + 0x7e]
add edi, dword [rcx + 0x7e]
xor dword [rax + rbx*2], edi
xor byte [rdi + 0x29], cl
mov eax, ebx
xchg esp, eax
push 0x37166474
jl 0x1400034f1
pop rcx
mov bl, 0xff
adc ch, byte [rdi + 0x6c3032c1]
scasb al, byte [rdi]
mov bh, 2
mov ch, 0xab
mov eax, dword [rsi]
mov ecx, 0x3fbe9357
movabs eax, dword [0xe7cf0762336d3d3b]
xchg esi, eax
invalid
jno 0x140003596
push rcx
enter 0xffffffffffffe76d, 0x34
insd dword [rdi], dx
out 0x34, eax
retf 0x3e1a
cli
jb 0x14000357d
push rcx
pop rdi
invalid

Function at 0x140004a0c
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x69
and ah, byte [rbp + 0x13]
push rbp
ret
adc edx, dword gs:[rbp - 0x3d]
mov ah, bh
jne 0x1400049c3
sahf
mov eax, 0x1d7c619
rol byte [esi + edi + 0x23fc6228], cl
out dx, eax
movabs dword [0x93f442889f3bdb8a], eax
mov byte [rdx - 0xc], al
xchg ebx, eax
mov cl, 3
pop rcx
loope 0x140004a6f
test al, 0x56
call 0x191e9915c
sbb esi, ebx
invalid
sub dword [rdx - 0x1c], ebp
sbb eax, 0xd6d56c31
mov ecx, 0x907be233
lea edx, [rbp - 0x44]
jbe 0x1400049c6
mov ebp, dword [rsi - 0x395aada3]
or eax, 0x23a2be52
invalid
invalid

Function at 0x14000a08c
Capabilities:
Encode data using xor

Disassembly:
pushfq
pop rcx
fsubr dword [rsi + 0x3c35e975]
jle 0x14000a08d
invalid

Function at 0x14000a95c
Capabilities:
Encode data using xor

Disassembly:
pop rdx
test eax, 0x6f163767
imul byte [rbx + 0xe]
imul byte [rbx + 0xe]
xchg ecx, eax
sal dword [rcx], 0x84
jmp 0x14000a942

Function at 0x14000ed34
Capabilities:
Encode data using add xor sub operations

Disassembly:
xchg edi, eax
jae 0x14000ed1b
out 0xbc, eax
int1
xor al, 0
cmp dh, cl
rcl byte [rdx], cl
mov byte [rdi - 0x76], dh
mov bl, 0x1a
push rcx
mov ecx, 0xc8434ac4
in al, 0x1b
add byte [rax - 0x2e44ff70], dl
cmp al, 0xa
pop rdx
xor al, byte [rcx + rbp*8]
sub ebx, dword [rbx - 0x31]

Function at 0x1400117a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor dl, 0xff
mov byte [rsp + 0xb5], dl
mov qword [rsp + 0xa8], rcx
invalid
invalid

Function at 0x140011838
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r14, qword [rsp + 0x98]
add r14, rdi
mov word [rsp + 0xb6], 0xf37b
mov rdi, r11
Function at 0x1400012c0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x48], edi
call fcn.140004c98
mov rcx, rax
test rax, rax
setne dil
test edi, edi
jne 0x140001304
mov ecx, 0x80004005
call fcn.140002160
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
mov dword [rsp + 0x48], 1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rdi, rax
test rax, rax
je 0x1400013f6
xor edx, edx
mov r8d, 0x20a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x1400013f6
mov r8, rax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_HeapSize]
mov r8, rax
xor edx, edx
mov rcx, rsi
call fcn.140030880
mov r9d, 1
lea r8d, [r9 + 0x22]
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, 1
jne 0x1400013bf
mov edx, 0x105
mov rcx, rdx
mov rax, rsi
cmp word [rax], 0
je 0x14000139a
add rax, 2
sub rcx, 1
jne 0x140001388
jmp 0x1400013a4
test rcx, rcx
je 0x1400013a4
cmp rdx, rcx
jne 0x1400013bf
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x1400013f6
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400013f6
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, rsi
mov rcx, rbx
call fcn.140001fb0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x1400013f6
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rbx]
cmp dword [rax - 0x10], 0
je 0x140001425
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, str.EPSONPRIUS
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str.EPSONPRIUS
mov rcx, rbx
call fcn.1400019e0
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140001c00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140001c33
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140001c77
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x140001c72
cmp rbx, r11
jae 0x140001c77
add edi, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x140001c60
cmp rbx, r11
jb 0x140001c7b
xor eax, eax
jmp 0x140001c87
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret