joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401251c0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
push r15
mov r12, r9
lea r10d, [rdx + 0x3f]
shr r10d, 6
xor edi, edi
mov r11d, edx
mov r15, r8
sub r11d, r10d
mov ebx, edx
inc r11d
mov rsi, rcx
mov eax, edi
lea r9d, [r11 + r11*2]
shr r9d, 2
cmp r9d, dword [r12]
jbe 0x14012520a
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x40]
pop r15
pop r12
pop rdi
pop rsi
ret
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r14
cmp edx, 3
jbe 0x140125365
lea r13, [0x1402d3ad0]
nop dword [rax]
mov ecx, eax
inc eax
movzx r8d, byte [rax + rsi]
inc eax
movzx edx, byte [rcx + rsi]
movzx ebp, byte [rax + rsi]
inc eax
movzx r10d, byte [rax + rsi]
inc eax
test dl, dl
je 0x140125365
cmp dl, 0x2b
jb 0x140125396
cmp r8b, 0x2b
jb 0x140125396
cmp bpl, 0x2b
jb 0x140125396
cmp r10b, 0x2b
jb 0x140125396
cmp dl, 0x7a
ja 0x140125396
cmp r8b, 0x7a
ja 0x140125396
cmp bpl, 0x7a
ja 0x140125396
cmp r10b, 0x7a
ja 0x140125396
movzx r14d, byte [rdx + r13 - 0x2b]
movzx r11d, byte [r8 + r13 - 0x2b]
cmp bpl, 0x3d
jne 0x1401252b9
xor r8b, r8b
jmp 0x1401252bf
movzx r8d, byte [rbp + r13 - 0x2b]
cmp r10b, 0x3d
jne 0x1401252c9
xor cl, cl
jmp 0x1401252cf
movzx ecx, byte [r10 + r13 - 0x2b]
shl r14b, 2
movzx edx, r11b
shr dl, 4
movzx r9d, r8b
or dl, r14b
shl r9b, 6
mov byte [rdi + r15], dl
or r9b, cl
inc edi
cmp bpl, 0x3d
je 0x140125305
shr r8b, 2
shl r11b, 4
or r8b, r11b
mov byte [rdi + r15], r8b
inc edi
cmp r10b, 0x3d
je 0x140125365
mov byte [rdi + r15], r9b
inc edi
add ebx, 0xfffffffc
je 0x14012535c
movzx edx, byte [rax + rsi]
cmp dl, 0x20
ja 0x14012535c
movabs r8, 0x100002400
bt r8, rdx
jae 0x14012535c
inc eax
add ebx, 0xffffffff
je 0x140125346
cmp dl, 0x20
jne 0x140125346
movzx edx, byte [rax + rsi]
inc eax
add ebx, 0xffffffff
jne 0x140125336
cmp dl, 0xd
jne 0x140125357
test ebx, ebx
je 0x140125396
movzx edx, byte [rax + rsi]
inc eax
dec ebx
cmp dl, 0xa
jne 0x140125396
cmp ebx, 3
ja 0x140125230
test r15, r15
je 0x140125375
cmp dword [r12], edi
jbe 0x140125375
mov byte [rdi + r15], 0
mov dword [r12], edi
xor eax, eax
mov r13, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x28]
mov r14, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
pop r15
pop r12
pop rdi
pop rsi
ret
mov eax, 0xffffff66
jmp 0x14012537b
Function at 0x1401332f0
Capabilities:
Hash data using sha1
Hash data using sha256
Hash data using sha384
Hash data using sha512

Disassembly:
xor r8d, r8d
sub edx, 3
je 0x1401334ad
sub edx, 1
je 0x14013349b
sub edx, 2
je 0x140133444
sub edx, 1
je 0x1401333c4
cmp edx, 1
je 0x140133329
mov eax, 0xffffff53
mov qword [rcx + 0x220], r8
ret
test rcx, rcx
je 0x14013331c
mov qword [rcx + 0xd8], r8
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
mov eax, r8d
mov dword [rcx + 0xc0], r8d
mov qword [rcx + 0xc8], r8
mov qword [rcx + 0xd0], r8
mov qword [rcx + 0x220], r8
ret
test rcx, rcx
je 0x14013331c
mov qword [rcx + 0xd8], r8
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x10], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x18], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x20], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x28], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x30], rax
movabs rax, 0x47b5481dbefa4fa4
jmp 0x1401333a0
test rcx, rcx
je 0x14013331c
mov qword [rcx + 0x70], r8
mov eax, r8d
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
mov dword [rcx + 0x68], r8d
mov qword [rcx + 0x60], r8
mov qword [rcx + 0x220], r8
ret
test rcx, rcx
je 0x14013331c
mov dword [rcx + 0x5c], 0xc3d2e1f0
jmp 0x1401334b6
test rcx, rcx
je 0x14013331c
mov dword [rcx + 8], r8d
mov eax, r8d
mov qword [rcx], r8
mov dword [rcx + 0x58], 0x10325476
mov dword [rcx + 0x54], 0x98badcfe
mov dword [rcx + 0x50], 0xefcdab89
mov dword [rcx + 0x4c], 0x67452301
mov qword [rcx + 0x60], r8
mov qword [rcx + 0x220], r8
ret
Function at 0x140135160
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1401352a6
test rdx, rdx
je 0x1401352a6
call fcn.140134c60
test eax, eax
jne 0x1401352ab
mov ecx, dword [rbx]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx], ecx
mov ecx, dword [rbx + 4]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 4], ecx
mov ecx, dword [rbx + 8]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 8], ecx
mov ecx, dword [rbx + 0xc]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 0xc], ecx
mov ecx, dword [rbx + 0x10]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 0x10], ecx
mov ecx, dword [rbx + 0x14]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 0x14], ecx
mov ecx, dword [rbx + 0x18]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 0x18], ecx
mov ecx, dword [rbx + 0x1c]
mov eax, ecx
ror eax, 8
rol ecx, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 0x1c], ecx
xor eax, eax
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov qword [rbx + 0x60], rax
mov dword [rbx + 0x68], eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14013ce60
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xf0
mov rax, qword [0x1402f1100]
xor rax, rsp
mov qword [rbp - 9], rax
mov rax, qword [rbp + 0x67]
mov ecx, 0x1b8
mov r12, qword [rbp + 0x77]
mov rdi, rdx
mov r13d, dword [rbp + 0x7f]
mov esi, 0x37
mov qword [rsp + 0x38], rax
mov r15d, 2
mov eax, ecx
mov byte [rsp + 0x28], r9b
rol ecx, 8
ror eax, 8
xor ecx, eax
mov byte [rsp + 0x20], 1
and ecx, 0xff00ff
xor ecx, eax
mov dword [rsp + 0x30], ecx
xor r14d, r14d
mov r8d, 1
mov qword [rbp - 0x39], r14
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x40], 0x6a09e667
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x44], 0xbb67ae85
mov dword [rsp + 0x48], 0x3c6ef372
mov dword [rsp + 0x4c], 0xa54ff53a
mov dword [rsp + 0x50], 0x510e527f
mov dword [rsp + 0x54], 0x9b05688c
mov dword [rsp + 0x58], 0x1f83d9ab
mov dword [rsp + 0x5c], 0x5be0cd19
mov qword [rbp - 0x49], r14
mov dword [rbp - 0x41], r14d
call fcn.1401347c0
mov ebx, eax
test eax, eax
jne 0x14013d00f
mov r8d, 4
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.1401347c0
mov ebx, eax
test eax, eax
jne 0x14013d00f
cmp byte [rsp + 0x28], 4
je 0x14013cf81
mov r8d, 1
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x40]
call fcn.1401347c0
mov ebx, eax
test eax, eax
jne 0x14013d00f
mov rax, qword [rsp + 0x38]
test rax, rax
jne 0x14013cf98
cmp dword [rbp + 0x6f], r14d
jbe 0x14013cfaf
mov ebx, 0xffffff53
jmp 0x14013d00f
mov r8d, dword [rbp + 0x6f]
lea rcx, [rsp + 0x40]
mov rdx, rax
call fcn.1401347c0
mov ebx, eax
test eax, eax
jne 0x14013d00f
test r12, r12
je 0x14013cfcf
test r13d, r13d
je 0x14013cfcf
mov r8d, r13d
lea rcx, [rsp + 0x40]
mov rdx, r12
call fcn.1401347c0
mov ebx, eax
test eax, eax
jne 0x14013d00f
lea rdx, [rbp - 0x29]
lea rcx, [rsp + 0x40]
call fcn.140135160
mov ebx, eax
test eax, eax
jne 0x14013d00f
cmp esi, 0x20
jbe 0x14013d000
movups xmm0, xmmword [rbp - 0x29]
add esi, 0xffffffe0
movups xmm1, xmmword [rbp - 0x19]
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm1
add rdi, 0x20
jmp 0x14013d00f
mov r8d, esi
lea rdx, [rbp - 0x29]
mov rcx, rdi
call fcn.14016ee10
inc byte [rsp + 0x20]
sub r15, 1
jne 0x14013ced1
mov ecx, 0x20
lea rdx, [rbp - 0x29]
nop word [rax + rax]
mov byte [rdx], r14b
lea rdx, [rdx + 1]
add ecx, 0xffffffff
jne 0x14013d030
test ebx, ebx
setne r14b
mov eax, r14d
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.140143790
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14013d190
Capabilities:
Hash data using sha256

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov rax, qword [0x1402f1100]
xor rax, rsp
mov qword [rbp + 8], rax
movups xmm0, xmmword [r9]
test r8d, r8d
mov rsi, rcx
movups xmm1, xmmword [r9 + 0x10]
mov r14d, 0
mov r12d, 1
mov ecx, r14d
mov edi, r12d
cmovne edi, r8d
mov r15, rdx
test dil, 0x1f
mov eax, edi
movups xmmword [rbp - 0x30], xmm0
setne cl
shr eax, 5
movups xmm0, xmmword [r9 + 0x20]
add ecx, eax
mov r13d, r14d
mov eax, dword [r9 + 0x30]
mov ebx, 0x37
mov dword [rbp], eax
movzx eax, word [r9 + 0x34]
mov word [rbp + 4], ax
movzx eax, byte [r9 + 0x36]
mov byte [rbp + 6], al
mov dword [rsp + 0x20], ecx
movups xmmword [rbp - 0x20], xmm1
movups xmmword [rbp - 0x10], xmm0
je 0x14013d36d
nop dword [rax + rax]
mov r8d, ebx
mov qword [rbp - 0x40], r14
lea rdx, [rbp - 0x30]
mov dword [rsp + 0x50], 0x6a09e667
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x54], 0xbb67ae85
mov dword [rsp + 0x58], 0x3c6ef372
mov dword [rsp + 0x5c], 0xa54ff53a
mov dword [rsp + 0x60], 0x510e527f
mov dword [rsp + 0x64], 0x9b05688c
mov dword [rsp + 0x68], 0x1f83d9ab
mov dword [rsp + 0x6c], 0x5be0cd19
mov qword [rbp - 0x50], r14
mov dword [rbp - 0x48], r14d
call fcn.1401347c0
mov r12d, eax
test eax, eax
jne 0x14013d35f
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.140135160
mov r12d, eax
test eax, eax
jne 0x14013d35f
cmp dword [rsi], 1
mov ecx, dword [rsp + 0x28]
jbe 0x14013d2df
cmp ecx, dword [rsi + 4]
jne 0x14013d2df
cmp byte [rsi + 0x76], 1
je 0x14013d3a7
mov edx, dword [rsp + 0x20]
mov cl, 1
cmp r13d, edx
lea eax, [rdx + 1]
cmovne eax, edx
mov dword [rsp + 0x20], eax
jmp 0x14013d2e4
mov dword [rsi + 4], ecx
xor cl, cl
mov byte [rsi + 0x76], cl
test r15, r15
je 0x14013d35f
test edi, edi
je 0x14013d35f
cmp edi, 0x20
jb 0x14013d34c
movups xmm0, xmmword [rsp + 0x28]
add edi, 0xffffffe0
lea rcx, [rbp + 4]
movups xmm1, xmmword [rsp + 0x38]
mov edx, 0x36
lea rax, [rbp + 4]
movups xmmword [r15], xmm0
movups xmmword [r15 + 0x10], xmm1
add r15, 0x20
sub rdx, rcx
nop
add byte [rax + 2], 1
jne 0x14013d35f
add byte [rax + 1], 1
jne 0x14013d35f
add byte [rax], 1
jne 0x14013d35f
add byte [rax - 1], 1
jne 0x14013d35f
add byte [rax - 2], 1
jne 0x14013d35f
sub rax, 5
lea rcx, [rdx + rax]
test rcx, rcx
jns 0x14013d320
jmp 0x14013d35f
mov r8d, edi
lea rdx, [rsp + 0x28]
mov rcx, r15
call fcn.14016ee10
mov edi, r14d
inc r13d
cmp r13d, dword [rsp + 0x20]
jl 0x14013d230
lea rcx, [rbp - 0x30]
mov byte [rcx], r14b
lea rcx, [rcx + 1]
add ebx, 0xffffffff
jne 0x14013d371
test r12d, r12d
setne r14b
mov eax, r14d
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.140143790
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov eax, 3
jmp 0x14013d387
Function at 0x14013dce0
Capabilities:
Encode data using xor

Disassembly:
push r12
push r13
push r14
sub rsp, 0x150
mov rax, qword [0x1402f1100]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov dword [rsp + 0x60], r8d
mov r14, rcx
mov qword [rsp + 0x68], rdx
test rcx, rcx
je 0x14013df9a
test rdx, rdx
je 0x14013df9a
cmp r8d, 0x10000
ja 0x14013df9a
cmp byte [rcx + 0x18], 1
je 0x14013dd3b
mov eax, 0xffffff39
jmp 0x14013df9f
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x188], rbx
mov qword [rsp + 0x130], r15
call fcn.14013d3b0
xor r15d, r15d
mov ebx, eax
cmp eax, 2
jne 0x14013df64
lea rax, [rsp + 0xa0]
mov ebx, 1
mov qword [rsp + 0x38], rax
lea r9, str.c63w
lea rax, [0x1402d6ee0]
mov dword [rsp + 0x30], 0x20
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0x30
mov ecx, ebx
call fcn.14013e0b0
test eax, eax
jne 0x14013df6d
xorps xmm3, xmm3
lea rcx, [0x1402d6db0]
xorps xmm4, xmm4
mov eax, r15d
nop dword [rax + rax]
movd xmm2, dword [rax + rcx]
xorps xmm0, xmm0
movd xmm1, dword [rsp + rax + 0xa0]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movd xmm1, dword [rax + rcx + 4]
orps xmm3, xmm2
punpcklbw xmm1, xmm0
movd xmm2, dword [rsp + rax + 0xa4]
add rax, 8
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm2, xmm4
movdqa xmm4, xmm2
cmp rax, 0x80
jl 0x14013ddc0
orps xmm3, xmm2
movdqa xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd eax, xmm3
test eax, eax
jne 0x14013df6d
mov r9d, ebx
mov qword [rsp + 0x138], rdi
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
mov rcx, r14
call 0x1403a5d13
int3
test ebx, ebx
je 0x14013df85
cmp ebx, 3
jne 0x14013df7a
mov r15d, 0xffffff2f
mov byte [r14 + 0x18], 3
jmp 0x14013df85
mov r15d, 0xffffff39
mov byte [r14 + 0x18], 2
mov rbx, qword [rsp + 0x188]
mov eax, r15d
mov r15, qword [rsp + 0x130]
jmp 0x14013df9f
mov eax, 0xffffff53
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140143790
add rsp, 0x150
pop r14
pop r13
pop r12
ret
Function at 0x140144758
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
push rdi
call 0x14033d36f
test rax, rax
je 0x1401447a2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401447a2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401447a2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401447a2
cmp dword [rcx + 0x84], 0xe
jbe 0x1401447a2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401447a4
xor al, al
add rsp, 0x28
ret

Function at 0x14016b4c0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14016b4e8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14016b4e8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400154f8
Capabilities:
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
lea rcx, [rax - 0x18]
mov edi, r9d
mov esi, r8d
mov ebp, edx
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
mov rcx, qword [rbx + 0xb40]
mov edx, 0x2710
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14001554b
lea rdx, str._vCloseDriver__WaitForSingleObject_error___d_n
mov r8d, eax
mov rcx, rbx
call fcn.140016c48
jmp 0x1400155c1
mov ecx, dword [rbx + 0xb1c]
sub ecx, 1
je 0x1400155ac
cmp ecx, 1
jne 0x1400155b4
mov rdx, qword [rbx + 0xb58]
mov r9d, esi
mov r8d, ebp
mov rcx, rbx
call fcn.140017cb4
and qword [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x40]
mov rcx, rax
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400155b4
mov rdx, qword [rsp + 0x40]
lea r8, str.SeLoadDriverPrivilege
xor r9d, r9d
mov rcx, rbx
call fcn.140016f74
jmp 0x1400155b4
mov rcx, rbx
int3
mov rcx, qword [rbx + 0xb40]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rbx + 0xb40]
test rcx, rcx
je 0x1400155ed
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str._vCloseDriver__CloseHandle_mutex____d_n
mov rcx, rbx
mov r8d, eax
call fcn.140016c48
and qword [rbx + 0xb40], 0
test edi, edi
je 0x140015603
lea rcx, [rbx + 0xb60]
cmp byte [rcx], 0
je 0x140015603
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140016c48
Capabilities:
Set current directory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x138
mov rax, qword [0x14028b7c8]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rbx, rcx
add rcx, 8
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rdx, [rbx + 0xb60]
lea r8, [0x1401ce258]
lea rcx, [rbx + 0xb48]
int3
Function at 0x1400420e8
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x260
mov rax, qword [0x14028b7c8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov qword [rsp + 0x48], rcx
lea rcx, str.setupapi.dll
xor ebx, ebx
mov r15, rdx
mov ebp, ebx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
cmp rax, rbx
je 0x1400422c4
lea rdx, str.CM_Get_DevNode_Registry_PropertyA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CM_Locate_DevNodeA
mov rcx, rsi
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CM_Get_Child
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CM_Get_Sibling
mov rcx, rsi
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CM_Get_Parent
mov rcx, rsi
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
cmp qword [rsp + 0x40], rbx
je 0x1400422bb
cmp rdi, rbx
je 0x1400422bb
cmp r13, rbx
je 0x1400422bb
cmp r12, rbx
je 0x1400422bb
cmp rax, rbx
je 0x1400422bb
lea rcx, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
call rdi
cmp eax, ebx
jne 0x1400422bb
mov rdi, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x30]
xor r8d, r8d
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x50]
lea edx, [r8 + 0xa]
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x38], 0x200
mov qword [rsp + 0x20], rax
call rdi
cmp eax, ebx
jne 0x14004221e
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x50]
call fcn.1401593e0
cmp eax, ebx
je 0x140042279
mov edx, dword [rsp + 0x30]
lea rcx, [rsp + 0x34]
xor r8d, r8d
call r13
cmp eax, ebx
je 0x140042261
mov edx, dword [rsp + 0x30]
jmp 0x140042252
mov edx, dword [rsp + 0x30]
lea rcx, [rsp + 0x34]
xor r8d, r8d
call r14
cmp eax, ebx
jne 0x140042272
mov edx, dword [rsp + 0x34]
mov dword [rsp + 0x30], edx
lea rcx, [rsp + 0x34]
xor r8d, r8d
call r12
cmp eax, ebx
jne 0x140042237
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x30], eax
cmp ebp, ebx
jne 0x1400422bb
jmp 0x1400421df
mov ebp, 1
jmp 0x140042269
mov ecx, dword [rsp + 0x30]
xor r8d, r8d
lea rax, [rsp + 0x38]
lea ebp, [r8 + 1]
lea r9, [rsp + 0x50]
mov dword [rsp + 0x28], ebx
mov edx, ebp
mov dword [rsp + 0x38], 0x200
mov qword [rsp + 0x20], rax
call rdi
cmp eax, ebx
jne 0x1400422bb
lea r8, [rsp + 0x50]
mov edx, 0x100
mov rcx, r15
int3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140156fd0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400457a0
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x14028b7c8]
xor rax, rsp
mov qword [rsp + 0x90], rax
and qword [rsp + 0x38], 0
mov rbp, rdx
lea rdx, [rsp + 0x40]
mov rcx, rbp
mov rdi, r8
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test eax, eax
je 0x140045911
mov rcx, rsi
call fcn.14013f170
mov r8d, esi
xor edx, edx
mov r9, rax
mov rcx, rbp
mov rbx, rax
call sub.VERSION.dll_GetFileVersionInfoA
mov rcx, rbx
test eax, eax
je 0x14004590c
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x38]
lea rdx, [0x1401cec70]
call sub.VERSION.dll_VerQueryValueA
mov rcx, rbx
test eax, eax
je 0x14004590c
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x30]
lea rdx, [0x1401d34f8]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1400458e9
mov rax, qword [rsp + 0x30]
lea rdx, [0x1401d34d0]
lea rcx, [rsp + 0x50]
movzx r9d, word [rax + 2]
movzx r8d, word [rax]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueA
mov esi, 0x100
test eax, eax
je 0x14004589a
mov r8, qword [rsp + 0x28]
lea rcx, [rdi + 0x10]
mov rdx, rsi
call fcn.140044464
mov rax, qword [rsp + 0x30]
lea rdx, [0x1401d34a8]
lea rcx, [rsp + 0x50]
movzx r9d, word [rax + 2]
movzx r8d, word [rax]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1400458e9
mov r8, qword [rsp + 0x28]
lea rcx, [rdi + 0x110]
mov rdx, rsi
call fcn.140044464
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx + 0xa]
mov dword [rdi], eax
movzx eax, word [rcx + 8]
mov dword [rdi + 4], eax
movzx eax, word [rcx + 0xe]
mov dword [rdi + 8], eax
movzx eax, word [rcx + 0xc]
mov rcx, rbx
mov dword [rdi + 0xc], eax
call fcn.14013f178
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140156fd0
mov rbx, qword [rsp + 0xc0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140058a50
Capabilities:
Get memory capacity

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
movaps xmmword [rax - 0x18], xmm6
mov rsi, rcx
call fcn.14009e8b8
call fcn.140045fd8
mov rdi, qword [rax + 0xe8]
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov r11d, dword [rsp + 0x2c]
pxor xmm6, xmm6
cvtsi2ss xmm6, r11
cmp qword [rdi + 0x128], 0
jne 0x140058b32
mov ecx, 0x170
call fcn.14013f12c
mov qword [rsp + 0x80], rax
test rax, rax
je 0x140058acb
xor edx, edx
mov rcx, rax
call fcn.1400719e4
jmp 0x140058acd
xor eax, eax
mov qword [rdi + 0x128], rax
or dword [rax + 0x148], 0x1c0e000
mov rcx, qword [rdi + 0x128]
add rcx, 8
lea r8, str.System_Memory
mov edx, 0x100
call fcn.140044464
mov r11, qword [rdi]
mov rdx, qword [rdi + 0x128]
mov rcx, rdi
call qword [r11 + 0x28]
mov rbx, qword [rdi + 0x128]
call fcn.140045fd8
mov rcx, qword [rax + 0x70]
mov r8d, dword [rcx + 0x10]
mov dword [rbx + 0x14c], r8d
mov rdx, rbx
mov rcx, qword [rax + 0x70]
call fcn.140004a74
mov r8d, 1
movaps xmm1, xmm6
mov rcx, qword [rdi + 0x128]
int3