joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400140d0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14001141f
movzx eax, al
test eax, eax
jne 0x1400140f0
mov ecx, 7
call fcn.140011352
nop
mov byte [rsp + 0x20], 0
call fcn.14001136b
mov byte [rsp + 0x21], al
cmp dword [0x140039468], 1
jne 0x140014114
mov ecx, 7
call fcn.140011352
nop
jmp 0x14001416c
cmp dword [0x140039468], 0
jne 0x140014167
mov dword [0x140039468], 1
lea rdx, [0x14001c660]
lea rcx, [0x14001c330]
call fcn.1400111cc
test eax, eax
je 0x140014148
mov eax, 0xff
jmp 0x140014271
lea rdx, [0x14001c220]
lea rcx, [section..rdata]
call fcn.140011361
mov dword [0x140039468], 2
jmp 0x14001416c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001133e
call fcn.1400112d5
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x1400141c9
mov rcx, qword [rsp + 0x30]
call fcn.140011181
movzx eax, al
test eax, eax
je 0x1400141c9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x14003f020]
nop
call fcn.14001130c
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1400141fd
mov rcx, qword [rsp + 0x38]
call fcn.140011181
movzx eax, al
test eax, eax
je 0x1400141fd
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400113b6
nop
call fcn.140014320
mov dword [rsp + 0x28], eax
call fcn.1400112b2
movzx eax, al
test eax, eax
jne 0x14001421c
mov ecx, dword [rsp + 0x28]
call fcn.140011055
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001422b
call fcn.1400113c0
nop
xor edx, edx
mov cl, 1
call fcn.14001116d
mov eax, dword [rsp + 0x28]
jmp 0x140014271
add rsp, 0x68
ret
Function at 0x140010e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, rdx
mov rsi, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x140010f00
cmp r10, r11
jb 0x140010f77
cmp r10, rdx
ja 0x140010f89
add r11, r9
xor r15d, r15d
nop dword [rax + rax]
cmp r14, r15
je 0x140010f02
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x140010ee0
jmp 0x140010f64
ja 0x140010f0a
mov r11, r10
cmp rax, r8
jne 0x140010eae
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x140010f40
mov rdi, r8
sub ecx, edx
jns 0x140010f5b
jmp 0x140010f66
cmp r8, rsi
je 0x140010f98
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x140010f66
xor al, 1
cmp rdi, rsi
jne 0x140010f20
jmp 0x140010f66
xor eax, eax
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140057950
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140057570
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.1400579c0
int3
Function at 0x140013b8f
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r9, r8
mov rax, rdx
not ecx
lea rdi, [0x14005d6b0]
mov ebx, 0xff
lea rsi, str.C:Usersuser.cargo_registry_srcindex.crates.io_6f17d22bba15001fcrc32fast_1.4.2_src_baseline.rs
cmp r9, 0x40
jb 0x140013cbf
mov r14d, 4
sub r14, 1
jb 0x140013bb4
cmp r9, 0xf
jbe 0x140013cec
movzx edx, byte [rax + 0xf]
movzx r8d, byte [rax + 0xe]
mov ebp, dword [rdi + r8*4 + 0x400]
xor ebp, dword [rdi + rdx*4]
movzx edx, byte [rax + 0xd]
xor ebp, dword [rdi + rdx*4 + 0x800]
movzx edx, byte [rax + 0xc]
xor ebp, dword [rdi + rdx*4 + 0xc00]
movzx edx, byte [rax + 0xb]
xor ebp, dword [rdi + rdx*4 + 0x1000]
movzx edx, byte [rax + 0xa]
xor ebp, dword [rdi + rdx*4 + 0x1400]
movzx edx, byte [rax + 9]
xor ebp, dword [rdi + rdx*4 + 0x1800]
movzx edx, byte [rax + 8]
xor ebp, dword [rdi + rdx*4 + 0x1c00]
movzx edx, byte [rax + 7]
xor ebp, dword [rdi + rdx*4 + 0x2000]
movzx edx, byte [rax + 6]
xor ebp, dword [rdi + rdx*4 + 0x2400]
movzx edx, byte [rax + 5]
xor ebp, dword [rdi + rdx*4 + 0x2800]
movzx edx, byte [rax + 4]
xor ebp, dword [rdi + rdx*4 + 0x2c00]
mov edx, ecx
shr edx, 0x18
movzx r8d, byte [rax + 3]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3000]
mov edx, ecx
shr edx, 0x10
and edx, ebx
movzx r8d, byte [rax + 2]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3400]
mov edx, ecx
shr edx, 8
and edx, ebx
movzx r8d, byte [rax + 1]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3800]
and ecx, ebx
movzx edx, byte [rax]
xor edx, ecx
xor ebp, dword [rdi + rdx*4 + 0x3c00]
mov rcx, rax
mov rdx, r9
mov r8, rsi
call fcn.1400141d2
mov r9, rdx
mov ecx, ebp
jmp 0x140013bc4
xor edx, edx
cmp r9, rdx
je 0x140013cdd
mov r8b, byte [rax + rdx]
xor r8b, cl
movzx r8d, r8b
shr ecx, 8
xor ecx, dword [rdi + r8*4]
inc rdx
jmp 0x140013cc1
not ecx
mov eax, ecx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
lea r8, str.C:Usersuser.cargo_registry_srcindex.crates.io_6f17d22bba15001fcrc32fast_1.4.2_src_baseline.rs
mov ecx, 0xf
mov rdx, r9
call fcn.140057500
int3
Function at 0x140033be3
Capabilities:
Link many functions at runtime

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rcx
mov r14, qword [0x14007c110]
test r14, r14
jne 0x140033d1a
lea rcx, [0x14006cd65]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x140033c4d
mov rbx, rax
lea rdx, [0x14006cd86]
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x140033c4d
mov rdi, rax
lea rdx, [0x14006cd94]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
test eax, eax
je 0x140033c4d
mov r15, rax
xor ebx, ebx
jmp 0x140033cd2
test dword [rax], eax
add byte [rax], al
lea rcx, [0x14006cd20]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
add byte [rax - 0x7b], cl
ror byte [rdi], 0x84
retf
add byte [rax], al
invalid
mov rdi, rax
lea rdx, str.NtCreateKeyedEvent
mov ebp, 0x48000390
mov ecx, eax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x140033d2e
mov r14, rax
lea rdx, str.NtReleaseKeyedEvent
adc eax, 0x390b4
mov rcx, rdi
mov ecx, edi
call qword [sym.imp.kernel32.dll_GetProcAddress]
add al, byte gs:[rax]
test rax, rax
ror byte [rdi], 0x84
xchg ebx, eax
add byte [rax], al
add byte [rax], al
invalid
mov rbx, rax
lea rdx, str.NtWaitForKeyedEvent
add eax, dword [rax]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetProcAddress]
fisub dword [rbp + 2]
add byte [rax - 0x7b], cl
invalid
je 0x140033d2e
mov rdi, rax
lea rcx, [rsp + 0x20]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call r14
test eax, eax
invalid
jne 0x140033d2e
mov r15, qword [rsp + 0x20]
mov ecx, 0x18
call fcn.140009008
std
dec dword [rcx - 0x77]
invalid
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rax + 0x10], r15
xor eax, eax
lock cmpxchg qword [0x14007c110], r14
cmpxchg dword [0x14007c110], esi
je 0x140033d1a
mov rdi, rax
cmp qword [r14], 0
invalid
je 0x140033d0a
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov edx, 8
mov rcx, r14
call fcn.140008050
cmp dword [rbx - 3], eax
dec dword [rcx - 0x77]
mov esi, edi
and qword [rsi + 8], 0
mov qword [rsi], r14
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rdi
ret
lea rax, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_
lea rcx, [rsp + 0x20]
and al, 0x20
mov qword [rcx], rax
mov qword [rcx + 8], 1
mov dword [rcx + 8], 1
add byte [rax], al
mov qword [rcx + 0x10], 8
adc byte [rax], cl
add byte [rax], al
add byte [rdi], cl
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
lea rdx, str.C:Usersuser.cargo_registry_srcindex.crates.io_6f17d22bba15001fparking_lot_core_0.9.10_src_thread_parkerwindowsmod.rs
call fcn.140057450
add al, byte [rax]
int3
Function at 0x140039960
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x140039985
cmp rax, rcx
je 0x14003998b
cmp rdx, 4
jae 0x140039992
xor eax, eax
xor r8d, r8d
jmp 0x140039a30
pop rbp
jmp fcn.14000aa90
xor eax, eax
jmp 0x140039a47
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x14005a520]
movdqa xmm3, xmmword [0x14005a530]
pxor xmm1, xmm1
nop word cs:[rax + rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x1400399c0
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x140039a47
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x140039a30
pop rbp
ret
Function at 0x140040500
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x1400405a0
jmp 0x14004058f
jae 0x14004065f
cmp r8, 0x201
jae 0x1400405a0
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x1400405f7
sub r8, rbx
sub rdi, rbx
cmp r8, rdi
jbe 0x1400405cf
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.140058e50
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x140040620
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x1400406c3
mov r8d, r13d
cmp r12, r8
jne 0x140040580
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400406f5
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14004058f
jmp 0x1400405a0
cmp r14, r8
jb 0x14004070f
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.140040f60
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rax, qword [rbp + 0x3d0]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
cmp qword [rbp + 0x3d8], 0
je 0x1400406ae
mov rcx, qword [rbp + 0x3e0]
mov edx, 2
call fcn.140008050
nop
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rcx, qword [rbp + 0x3d0]
mov qword [rcx + 8], rax
movabs rax, 0x8000000000000000
mov qword [rcx], rax
cmp qword [rbp + 0x3d8], 0
jne 0x14004069d
jmp 0x1400406ae
lea rcx, str.internal_error:_entered_unreachable_code_rustc_eeb90cda1969383f56a2637cbd3037bdf598841clibrary_std_src_threadmod.rs
lea r8, str.z_n_a_
mov edx, 0x28
call fcn.1400575e0
jmp 0x140040724
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.140057570
ud2
Function at 0x140045170
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi

Function at 0x140045f30
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
pop rbp
jmp fcn.14003e450
invalid
test edi, edi
invalid
Function at 0x140056e10
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x140056e5a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140056e5a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140056e5a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140056e5a
cmp dword [rcx + 0x84], 0xe
jbe 0x140056e5a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140056e5c
xor al, al
add rsp, 0x28
ret
Function at 0x140134120
Capabilities:
Execute syscall

Disassembly:
dec dword [rax - 0x75]
adc byte [rdi], cl
invalid
xchg r9, r15
mov qword [rsp + 0x20], r15
xchg r9, r15
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
jmp 0x140134142
lea rax, [0x140134330]
xchg rcx, rax
mov qword [rsp + 0x18], rcx
xchg rcx, rax
mov dword [rsp + 8], 0
jmp 0x14013415f
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x10], rax
jmp 0x1401341d3
xchg rbx, rax
mov rbx, qword [rsp + 0x10]
xchg rbx, rax
inc rax
xchg r10, rax
mov qword [rsp + 0x10], r10
je 0x1401341b6
jne 0x1401341b6
jp 0x1401331c4
lea esi, [rdi + 0xd002]
cmp r8d, 0xfdbcbb9f
rcl r12d, 0x13
dec r13
lea edi, [rbp - 0x2e2]
add r12d, 0x20ea55d7
ror edx, 0xc4
test rdi, rcx
syscall
movabs r14, 0x6fc0a86c773e19eb
cmp r12d, 0x2c883299
lea ebp, [rbx - 0x3239]
ret
jmp 0x1401341d1
xchg r10, rax
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
add rcx, rax
xchg r11, rcx
mov rax, r11
xchg rcx, r11
jmp 0x1401341ed
cmp qword [rsp + 0x10], rax
jae 0x14013431c
mov byte [rsp], 0
mov dword [rsp + 4], 0
jmp 0x140134213
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
mov eax, dword [rsp + 0x50]
jmp 0x140134241
mov rbx, qword [rsp + 0x48]
xchg rdx, rbx
mov ecx, dword [rdx + rcx*4]
jmp 0x14013422c
mov rdx, qword [rsp + 0x40]
add rcx, qword [rdx + rax*8]
xchg r12, rax
mov r12, rcx
xchg r12, rax
jmp 0x14013429b
cmp dword [rsp + 4], eax
jae 0x1401342b4
mov eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx + rax*8]
cmp qword [rsp + 0x10], rax
jb 0x1401342af
jmp 0x140134268
mov eax, dword [rsp + 4]
mov ecx, dword [rsp + 4]
xchg rdx, rbx
je 0x140134279
jne 0x140134279
movabs r14, 0x68677da0772ba1eb
add esi, 0x53c41def
lea r9d, [rcx + 0x25f6]
lea r14d, [rdx + 0xffb4]
cmp rbx, rcx
ret 0x18
jmp 0x14013421c
cmp qword [rsp + 0x10], rax
jae 0x1401342af
mov byte [rsp], 1
jmp 0x1401342b4
jmp 0x140134209
movzx eax, byte [rsp]
test eax, eax
je 0x1401342c5
jmp 0x14013416e
xor edx, edx
mov eax, dword [rsp + 8]
mov ecx, 0x20
div ecx
mov eax, edx
mov eax, eax
mov rcx, qword [rsp + 0x18]
jmp 0x1401342e0
movzx eax, byte [rcx + rax]
xchg rcx, r10
mov r10, qword [rsp + 0x10]
jmp 0x1401342f1
xchg r10, rcx
movzx ecx, byte [rcx]
xor ecx, eax
mov eax, ecx
xchg rcx, r13
mov r13, qword [rsp + 0x10]
jmp 0x140134308
xchg rcx, r13
mov byte [rcx], al
mov eax, dword [rsp + 8]
inc eax
mov dword [rsp + 8], eax
jmp 0x14013416e
add rsp, 0x28
ret
Function at 0x1408d8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1408d81df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1408d8089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408d806f
add dl, dl
jne 0x1408d8096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408d80f6
xor eax, eax
add dl, dl
jne 0x1408d80a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408d81ad
add dl, dl
jne 0x1408d80b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408d80c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408d80d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408d80dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1408d80ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1408d807e
mov eax, 1
add dl, dl
jne 0x1408d8106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408d8113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408d80fb
sub eax, ebx
mov ebx, 1
jne 0x1408d814c
mov ecx, 1
add dl, dl
jne 0x1408d812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1408d813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408d8123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408d807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1408d8168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1408d8175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408d815d
cmp eax, 0x7d00
jae 0x1408d819b
cmp eax, 0x500
jb 0x1408d8196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408d807e
cmp eax, 0x7f
ja 0x1408d819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408d807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1408d81d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1408d807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140004b64
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x140053010]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov esi, ecx
mov rbx, rdx
mov rcx, rdx
call fcn.1400018d8
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.140021750
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, esi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
test eax, eax
jns 0x140004c46
movzx ecx, sil
cmp ecx, 0x26
jne 0x140004bf3
lea rdx, str.ProgramFiles
lea rcx, [rsp + 0x30]
call fcn.140005018
mov rdx, rax
mov rcx, rbx
call fcn.1400017c8
mov rdx, qword [rsp + 0x30]
jmp 0x140004c19
cmp ecx, 0x1c
jne 0x140004c33
lea rdx, str.LocalAppData
lea rcx, [rsp + 0x38]
call fcn.140005018
mov rdx, rax
mov rcx, rbx
call fcn.1400017c8
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140004c33
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rbx]
mov ecx, 1
cmp dword [rax - 0x10], 0
cmovne edi, ecx
mov eax, edi
jmp 0x140004c62
lea rcx, [rsp + 0x40]
call fcn.140034f34
mov r8d, eax
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140001948
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140020b40
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140004eb8
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x140053010]
xor rax, rsp
mov qword [rbp + 0x40], rax
and qword [rsp + 0x38], 0
lea rax, [0x14004a8c8]
xorps xmm0, xmm0
mov qword [rsp + 0x20], rax
movdqu xmmword [rsp + 0x28], xmm0
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 8
lea rcx, [rsp + 0x20]
mov r8, rax
call fcn.140004040
test al, al
jne 0x140004f23
call fcn.14000b9b8
mov edi, eax
jmp 0x140004fbb
lea rcx, [rsp + 0x40]
call fcn.140001ecc
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140003ee4
test al, al
jne 0x140004f49
call fcn.14000b9b8
mov edi, eax
jmp 0x140004fb1
mov r9d, 0x12
lea rdx, [0x14004a6c0]
lea rcx, [rbp - 0x40]
lea r8d, [r9 - 0x11]
call fcn.140001fa0
cmp byte [rbp - 0x74], 0
je 0x140004fa2
lea rcx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x140004fa2
cmp byte [rbp + 0xc], 0
je 0x140004fa2
lea rcx, [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x140004fa2
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
jmp 0x140004fa4
xor al, al
lea rcx, [rbp - 0x40]
mov byte [rbx], al
call fcn.140002160
xor edi, edi
lea rcx, [rsp + 0x40]
call fcn.140002160
mov rdx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
test rdx, rdx
je 0x140004fd8
test rbx, rbx
je 0x140004fe6
mov rcx, rbx
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
test rbx, rbx
je 0x140004fe6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x38]
mov edx, 8
call fcn.140020dec
mov eax, edi
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.140020b40
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140005018
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
call fcn.14000144c
xor ebp, ebp
mov rcx, rax
test rax, rax
je 0x1400050f0
mov rax, qword [rax]
call qword [rax + 0x18]
xor r8d, r8d
xor edx, edx
add rax, 0x18
mov rcx, rsi
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
je 0x1400050c8
test eax, eax
js 0x1400050e5
mov rax, qword [rbx]
lea edx, [rbp + 1]
mov ecx, dword [rax - 0xc]
sub edx, dword [rax - 8]
sub ecx, edi
or edx, ecx
jge 0x140005089
mov edx, edi
mov rcx, rbx
call fcn.140001a54
mov rax, qword [rbx]
mov r8d, edi
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1400050a4
mov eax, ebp
jmp 0x1400050b1
movsxd rdx, dword [rcx - 0xc]
call fcn.14002d1c8
test eax, eax
js 0x1400050e5
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x1400050e5
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], bp
jmp 0x1400050cd
call fcn.14000b9b8
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80070057
call fcn.1400017a4
int3
mov ecx, 0x80004005
call fcn.1400017a4
int3

Function at 0x1400060c4
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.14000144c
xor ebp, ebp
mov rcx, rax
test rax, rax
je 0x140006190
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov esi, 0x103
mov qword [rbx], rax
lea edi, [rsi + 1]
test edi, edi
js 0x14000619b
mov r8, qword [rbx]
mov ecx, 1
mov eax, dword [r8 - 0xc]
sub ecx, dword [r8 - 8]
sub eax, edi
or ecx, eax
jge 0x14000612e
mov edx, edi
mov rcx, rbx
call fcn.140001a54
mov r8, qword [rbx]
mov edx, edi
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, edi
mov esi, eax
sbb eax, eax
and eax, esi
cmp eax, 0xffffffff
jne 0x14000615b
mov rcx, qword [rbx]
test rcx, rcx
jne 0x140006152
mov eax, ebp
jmp 0x14000615f
movsxd rdx, dword [rcx - 0xc]
call fcn.14002d1c8
test eax, eax
js 0x14000619b
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x14000619b
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], bp
cmp esi, edi
jae 0x140006100
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80004005
call fcn.1400017a4
int3
mov ecx, 0x80070057
call fcn.1400017a4
int3