joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140062654
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp word [0x14008eab0], 0
mov rdi, rcx
lea rbx, [0x14008eab0]
jne 0x14006268b
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov r11d, eax
mov dword [0x14008ecbc], eax
jmp 0x140062692
mov r11d, dword [0x14008ecbc]
sub rdi, rbx
movzx eax, word [rbx]
mov word [rdi + rbx], ax
add rbx, 2
test ax, ax
jne 0x140062695
mov eax, r11d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140062a54
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x230
mov rdi, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x140062a8b
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
and word [rbx], 0
lea rcx, [rsp + 0x20]
mov r9, rbx
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov rax, rbx
mov rbx, qword [rsp + 0x240]
add rsp, 0x230
pop rdi
ret

Function at 0x140062c74
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
xor ebx, ebx
call qword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, ebx
je 0x140062d05
call qword [sym.imp.USER32.dll_EmptyClipboard]
cmp rsi, rbx
je 0x140062cff
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
movsxd rdi, ecx
mov ecx, 0x2000
add rdi, rdi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp rax, rbx
mov rbp, rax
je 0x140062cff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [rbx + 0xd]
mov rdx, rbp
call qword [sym.imp.USER32.dll_SetClipboardData]
cmp rax, rbx
setne bl
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140062fa4
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov r10, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
and qword [rsp + 0x20], rax
mov rdi, rdx
lea r9, [rsp + 0x50]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx + rcx - 2]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rsp, 0x30
pop rdi
ret

Function at 0x140063604
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov edi, r9d
mov rsi, r8
xor r9d, r9d
xor r8d, r8d
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
and dword [rsp + 0x60], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140063e74
Capabilities:
Get common file path
Get file attributes

Disassembly:
sub rsp, 0x28
cmp word [0x14008eed0], 0
jne 0x140063eb1
lea rcx, [0x14008eed0]
call fcn.140063c54
lea rcx, [0x14008eed0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x140063eb1
lea rdx, [0x14008eed0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rax, [0x14008eed0]
add rsp, 0x28
ret

Function at 0x14006410c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x320
mov rdi, r9
mov rbx, r8
lea rcx, [rsp + 0x20]
lea r9, [rdx + 0x10]
lea r8, [rdx + 8]
call fcn.14006b674
mov eax, dword [rsp + 0x368]
mov r11, qword [rbx]
test eax, eax
mov qword [rsp + 0x348], r11
je 0x1400641b0
mov rbx, qword [rsp + 0x360]
add eax, 0xffffffff
mov rbp, rdi
mov r12, rbx
sub rbp, rbx
sub r12, rdi
shr eax, 3
lea esi, [rax + 1]
lea r8, [r12 + rdi]
lea rcx, [rsp + 0x1a0]
mov rdx, rdi
call fcn.14006b524
lea r11, [rsp + 0x348]
mov ecx, 8
mov al, byte [r11]
xor byte [rbx], al
mov al, byte [rbx + rbp]
add rbx, 1
mov byte [r11], al
add r11, 1
sub rcx, 1
jne 0x14006418d
add rdi, 8
sub rsi, 1
jne 0x14006416c
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x1400642fc
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x3a0
xor eax, eax
mov rbp, r8
mov r8d, dword [rcx + 0x248]
and dword [rsp + 0xb0], eax
and dword [rsp + 0xb4], eax
test r8d, r8d
mov esi, r9d
mov rbx, rdx
mov byte [rsp + 0x48], 0
mov qword [rsp + 0x49], rax
mov qword [rsp + 0x51], rax
mov qword [rsp + 0x59], rax
mov dword [rsp + 0x61], eax
mov word [rsp + 0x65], ax
mov byte [rsp + 0x67], al
mov byte [rsp + 0x30], al
mov qword [rsp + 0x31], rax
mov qword [rsp + 0x39], rax
mov word [rsp + 0x41], ax
mov byte [rsp + 0x43], al
mov dword [rsp + 0xb8], 0x67452301
mov dword [rsp + 0xbc], 0xefcdab89
mov dword [rsp + 0xc0], 0x98badcfe
mov dword [rsp + 0xc4], 0x10325476
mov dword [rsp + 0xc8], 0xc3d2e1f0
jle 0x1400643b9
lea rdx, [rcx + 0x147]
lea rcx, [rsp + 0xb0]
call fcn.140002ed4
test rbx, rbx
je 0x1400643ec
cmp byte [rbx], 0
je 0x1400643ec
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
test ecx, ecx
jle 0x1400643ec
mov r8d, ecx
lea rcx, [rsp + 0xb0]
mov rdx, rbx
call fcn.140002ed4
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xb0]
call fcn.140002f9c
lea rcx, [rsp + 0x190]
xor edx, edx
call fcn.140004488
lea ebx, [rdx + 1]
xor r12d, r12d
mov eax, ebx
xor r9d, r9d
lea rdx, [rsp + 0x30]
shr eax, 0x18
lea rcx, [rsp + 0x190]
lea r8d, [r9 + 0x14]
mov byte [rsp + 0x3d8], al
mov eax, ebx
mov byte [rsp + 0x3db], bl
shr eax, 0x10
mov byte [rsp + 0x3d9], al
mov eax, ebx
shr eax, 8
mov byte [rsp + 0x3da], al
call fcn.140006eb4
test rsi, rsi
je 0x14006446f
lea rcx, [rsp + 0x190]
mov r8, rsi
mov rdx, rbp
call fcn.140006c48
lea rdx, [rsp + 0x3d8]
lea rcx, [rsp + 0x190]
mov r8d, 4
call fcn.140006c48
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x190]
call fcn.140006f60
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x68]
mov r8d, 0x20
call sub.msvcrt.dll_memcpy
mov edx, 0x20
mov edi, 0x20
sub edx, r12d
lea rcx, [rsp + r12 + 0x48]
cmp edx, edi
cmovb edi, edx
lea rdx, [rsp + 0x68]
mov r8d, edi
call sub.msvcrt.dll_memcpy
add r12d, edi
add ebx, 1
cmp r12d, 0x20
jb 0x140064413
mov edi, 0x120
lea rcx, [rsp + 0x280]
xor edx, edx
mov r8, rdi
call sub.msvcrt.dll_memset
lea r8d, [rdi - 0x20]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x280]
call fcn.1400036c4
mov rax, qword [rsp + 0x3f8]
mov r8d, dword [rsp + 0x3f0]
mov r9, qword [rsp + 0x3e0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x3e8]
lea rcx, [rsp + 0x280]
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.14000432c
lea rax, [rsp + 0x280]
mov byte [rax], 0
add rax, 1
sub rdi, 1
jne 0x140064559
lea r11, [rsp + 0x3a0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140064e6c
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov rax, rdx
mov rdi, rcx
xor esi, esi
mov dword [rcx + 0x3dc], esi
xor edx, edx
mov rcx, rax
mov r13, r8
call fcn.140063024
cmp rax, 0xffffffffffffffff
mov r12, rax
je 0x140064f61
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x64
mov ebp, eax
jbe 0x140064ee7
lea rcx, [rdi + 8]
mov edx, eax
call fcn.140060478
mov rdx, qword [rdi + 8]
lea r9, [rsp + 0x50]
mov r8d, ebp
mov rcx, r12
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, 0x64
jbe 0x140064f61
mov rax, qword [rdi + 8]
cmp dword [rax], 0x61150600
jne 0x140064f61
mov ecx, dword [rax + 0xc]
mov ebx, ecx
mov eax, ecx
shr eax, 0x10
and ebx, 0xff0000
or ebx, eax
mov eax, ecx
shl ecx, 0x10
and eax, 0xff00
shr ebx, 8
or eax, ecx
shl eax, 8
or ebx, eax
jbe 0x140064f61
xor edx, edx
mov eax, ebp
div ebx
cmp eax, 1
jbe 0x140064f54
add eax, 0xffffffff
mov esi, ebx
mov ebp, eax
mov edx, esi
mov r8d, ebx
mov rcx, rdi
add rdx, qword [rdi + 8]
call fcn.1400646ac
add esi, ebx
sub rbp, 1
jne 0x140064f3b
mov rdx, r13
mov rcx, rdi
call fcn.140064afc
mov esi, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret

Function at 0x1400653fc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x420
and word [rsp + 0x20], 0
mov rbp, rcx
mov rsi, r8
mov rbx, rdx
lea rcx, [rsp + 0x22]
mov r8d, 0x3fe
xor edx, edx
call sub.msvcrt.dll_memset
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
add rcx, 7
cmp rcx, 0x1ff
jae 0x140065466
lea r8, [rsp + 0x20]
lea rdx, str.key4.db
mov rcx, rbx
call fcn.1400639e4
jmp 0x14006546b
and word [rsp + 0x20], ax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140065496
lea rdx, [rsp + 0x20]
mov r8, rsi
mov rcx, rbp
call fcn.140064f8c
test eax, eax
je 0x140065496
mov eax, 1
jmp 0x1400654f3
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
add rcx, 7
cmp rcx, 0x1ff
jae 0x1400654c8
lea r8, [rsp + 0x20]
lea rdx, str.key3.db
mov rcx, rbx
call fcn.1400639e4
jmp 0x1400654cd
and word [rsp + 0x20], ax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400654f1
lea rdx, [rsp + 0x20]
mov r8, rsi
mov rcx, rbp
call fcn.140064e6c
test eax, eax
jne 0x14006548f
xor eax, eax
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140066c28
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
sub rsp, 0x48
xor eax, eax
xor r8d, r8d
mov r10, rdx
mov qword [r11 - 0x27], rax
mov qword [r11 - 0x1f], rax
lea r9, [r11 - 0x20]
mov dword [rsp + 0x31], eax
mov word [rsp + 0x35], ax
mov byte [rsp + 0x37], al
mov byte [rsp + 0x20], 0xcf
mov byte [rsp + 0x26], 0x78
mov byte [rsp + 0x27], 0xd2
mov byte [rsp + 0x22], 0xe6
mov byte [rsp + 0x21], 0x17
mov byte [rsp + 0x25], 0x54
mov byte [rsp + 0x23], 0xaf
mov byte [rsp + 0x24], 0x34
mov edx, r8d
lea r11, [r11 - 0x21]
mov cl, byte [r9 - 8]
mov al, 0xb
imul dl
xor cl, al
add edx, 1
xor cl, byte [r11]
sub r11, 1
mov byte [r9], cl
add r9, 1
cmp edx, 8
jl 0x140066c7f
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x27]
mov al, 0xe
imul r8b
add r8d, 1
xor al, byte [rdx]
sub rdx, 1
xor al, 0x41
mov byte [rcx], al
add rcx, 1
cmp r8d, 8
jl 0x140066ca9
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x20]
mov rcx, r10
call fcn.14006b674
add rsp, 0x48
ret

Function at 0x140066d98
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x320
mov rbx, rdx
lea rbp, [0x14008ad40]
lea rdx, [rsp + 0x20]
mov rcx, rbp
mov esi, r8d
call fcn.140066c28
test esi, esi
mov byte [0x14008adbe], 0x1f
mov byte [0x14008adbf], 0xc1
mov byte [0x14008adb8], 0xda
mov byte [0x14008adbd], 0x1f
mov byte [0x14008adb9], 0x57
mov byte [0x14008adba], 0xca
mov byte [0x14008adbb], 0x86
mov byte [0x14008adbc], 0x3c
je 0x140066e6d
add esi, 0xffffffff
mov rdi, rbx
shr esi, 3
add esi, 1
lea r8, [rsp + 0x330]
lea rcx, [rsp + 0x1a0]
mov rdx, rdi
call fcn.14006b524
xor r11d, r11d
lea ecx, [r11 + 8]
mov al, byte [r11 + rbp + 0x78]
xor byte [rsp + r11 + 0x330], al
mov al, byte [rbx + r11]
add r11, 1
sub rcx, 1
mov byte [r11 + rbp + 0x77], al
jne 0x140066e34
mov rax, qword [rsp + 0x330]
add rdi, 8
mov qword [rbx], rax
add rbx, 8
sub rsi, 1
jne 0x140066e15
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140067488
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, r8
mov rbx, rcx
mov rcx, qword [rcx]
mov esi, r9d
mov rdi, rdx
xor r8d, r8d
xor r9d, r9d
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, qword [rbx]
and dword [rsp + 0x40], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140068508
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
and dword [rcx + 0x420], 0
mov rbx, rdx
mov rdi, rcx
call fcn.1400674f8
xor edx, edx
mov rcx, rbx
call fcn.140063024
cmp rax, 0xffffffffffffffff
mov qword [rdi], rax
je 0x14006859c
and dword [rsp + 0x40], 0
and qword [rsp + 0x20], 0
lea rdx, [rdi + 8]
lea r9, [rsp + 0x40]
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14006859c
mov rax, qword [rdi + 0x428]
cmp dword [rax + 4], 0x89abcdef
je 0x14006857a
mov dword [rdi + 0x420], 0xfff1
jmp 0x1400685a8
cmp dword [rax + 0xec], 0
jne 0x14006858d
mov dword [rax + 0xec], 0x1000
mov rcx, rdi
call fcn.1400683a8
mov eax, 1
jmp 0x1400685aa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi + 0x420], eax
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14006a5b0
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push r12
push r13
sub rsp, 0x60
mov r13, rcx
mov rcx, rdx
mov r12, r8
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14006a6ea
xor edx, edx
mov rcx, rbp
call fcn.140063024
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x14006a6ea
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
mov ebx, eax
je 0x14006a6e1
and qword [rsp + 0x30], 0
and dword [rsp + 0x38], 0
and qword [rsp + 0x40], 0
and dword [rsp + 0x48], 0
and qword [rsp + 0x50], 0
and dword [rsp + 0x58], 0
mov eax, 0x1388
lea edx, [rbx + 0xa]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x5c], eax
call fcn.140060478
mov rdx, qword [rsp + 0x30]
and dword [rsp + 0x98], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x98]
mov r8d, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r11, rbx
xor eax, eax
add r11, qword [rsp + 0x30]
lea ebx, [rbx + rbx*2]
lea rcx, [rsp + 0x40]
mov edx, ebx
mov qword [r11], rax
call fcn.140060478
mov r8, qword [rsp + 0x30]
shr ebx, 1
mov dword [rsp + 0x28], ebx
mov rbx, qword [rsp + 0x40]
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r9, r12
mov r8, rbx
mov rdx, rbp
mov rcx, r13
call fcn.14006a1f0
lea rcx, [rsp + 0x50]
call fcn.140060398
lea rcx, [rsp + 0x40]
call fcn.140060398
lea rcx, [rsp + 0x30]
call fcn.140060398
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r13
pop r12
pop rsi
ret
Function at 0x14006a710
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x230
and word [rsp + 0x20], 0
mov rbp, rcx
mov rsi, r8
mov rbx, rdx
lea rcx, [rsp + 0x22]
mov r8d, 0x208
xor edx, edx
call sub.msvcrt.dll_memset
lea rcx, [0x14008ad40]
mov edx, 0x16b
call fcn.140066f78
or r8, 0xffffffffffffffff
mov r11, rax
xor eax, eax
mov rcx, r8
mov rdi, r11
repne scasw ax, word [rdi]
mov rdi, rbx
not rcx
lea rdx, [rcx - 1]
mov rcx, r8
repne scasw ax, word [rdi]
not rcx
lea rax, [rdx + rcx]
cmp rax, 0x1ff
jae 0x14006a79c
lea r8, [rsp + 0x20]
mov rdx, r11
mov rcx, rbx
call fcn.1400639e4
jmp 0x14006a7a2
and word [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14006a7c2
lea rdx, [rsp + 0x20]
mov r8, rsi
mov rcx, rbp
call fcn.14006a5b0
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14006aba0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r13
push r14
mov eax, 0x12a0
call fcn.1400751b0
sub rsp, rax
and word [rsp + 0x448], 0
and word [rsp + 0xea0], 0
and word [rsp + 0xaa0], 0
mov rsi, r8
mov rbx, rcx
lea rax, [rsp + 0x448]
mov r8, rdx
lea rdx, [0x140076eb0]
lea rcx, [rsp + 0x440]
or r13, 0xffffffffffffffff
mov qword [rsp + 0x848], rax
mov qword [rsp + 0x440], r13
call fcn.140061348
lea rcx, [rsp + 0x440]
call fcn.140061268
mov r14d, 0x1ff
jmp 0x14006ad37
cmp dword [0x14008e7ac], 0
jne 0x14006ad3f
lea rcx, [rsp + 0x440]
call fcn.140060e38
test eax, eax
je 0x14006ad2a
and word [rsp + 0x20], 0
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x208
call sub.msvcrt.dll_memset
xor eax, eax
lea rdi, [rsp + 0xaa0]
mov rcx, r13
repne scasw ax, word [rdi]
not rcx
add rcx, 0xf
cmp rcx, r14
jae 0x14006ac9f
lea r8, [rsp + 0x20]
lea rdx, str.AppDataRoaming
lea rcx, [rsp + 0xaa0]
call fcn.1400639e4
jmp 0x14006aca4
and word [rsp + 0x20], ax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14006acc9
lea r8, [rsp + 0x87c]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14006a710
xor eax, eax
lea rdi, [rsp + 0xaa0]
mov rcx, r13
repne scasw ax, word [rdi]
not rcx
add rcx, 0x10
cmp rcx, r14
jae 0x14006ad00
lea r8, [rsp + 0x20]
lea rdx, str.Application_Data
lea rcx, [rsp + 0xaa0]
call fcn.1400639e4
jmp 0x14006ad05
and word [rsp + 0x20], ax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14006ad2a
lea r8, [rsp + 0x87c]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14006a710
lea rcx, [rsp + 0x440]
call fcn.140061268
test eax, eax
jne 0x14006ac2e
and word [rsp + 0x230], 0
lea rcx, [rsp + 0x232]
xor edx, edx
mov r8d, 0x208
call sub.msvcrt.dll_memset
lea rcx, [0x14008ad40]
mov edx, 0x16c
call fcn.140066f78
mov rcx, r13
mov r11, rax
xor eax, eax
mov rdi, r11
repne scasw ax, word [rdi]
mov rdi, rsi
not rcx
lea rdx, [rcx - 1]
mov rcx, r13
repne scasw ax, word [rdi]
not rcx
lea rax, [rdx + rcx]
cmp rax, r14
jae 0x14006adad
lea r8, [rsp + 0x230]
mov rdx, r11
mov rcx, rsi
call fcn.1400639e4
jmp 0x14006adb6
and word [rsp + 0x230], 0
lea r8, [0x140076a00]
lea rdx, [rsp + 0x230]
mov rcx, rbx
call fcn.14006a5b0
lea rcx, [rsp + 0x440]
call fcn.1400605d8
lea r11, [rsp + 0x12a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r13, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x14006ce4c
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rbx, rcx
jne 0x14006cfac
lea rdi, [0x14008ad40]
mov edx, 0x155
mov rcx, rdi
call fcn.140066f78
mov rcx, rax
call fcn.1400631b4
mov edx, 0x156
mov rcx, rdi
mov qword [rbx], rax
call fcn.140066fe8
mov rcx, rax
call fcn.1400619c4
mov rcx, qword [rbx]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0x157
mov rcx, rdi
mov qword [rbx + 8], rax
call fcn.140066fe8
mov rcx, qword [rbx]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0x158
mov rcx, rdi
mov qword [rbx + 0x10], rax
call fcn.140066fe8
mov rcx, qword [rbx]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0x159
mov rcx, rdi
mov qword [rbx + 0x18], rax
call fcn.140066fe8
mov rcx, qword [rbx]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0x15a
mov rcx, rdi
mov qword [rbx + 0x20], rax
call fcn.140066fe8
mov rcx, qword [rbx]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0x15b
mov rcx, rdi
mov qword [rbx + 0x28], rax
call fcn.140066fe8
mov rcx, qword [rbx]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0x15c
mov rcx, rdi
mov qword [rbx + 0x30], rax
call fcn.140066fe8
mov rcx, qword [rbx]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0x15d
mov rcx, rdi
mov qword [rbx + 0x38], rax
call fcn.140066fe8
mov rcx, qword [rbx]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0x15e
mov rcx, rdi
mov qword [rbx + 0x40], rax
call fcn.140066fe8
mov rcx, qword [rbx]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0x15f
mov rcx, rdi
mov qword [rbx + 0x48], rax
call fcn.140066fe8
mov rcx, qword [rbx]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x50], rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14006d44c
Capabilities:
Authenticate hmac
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x340
mov r13, r9
mov rdi, r8
mov ebp, edx
mov r12, rcx
call fcn.14006d2dc
mov ebx, 0x14
cmp ebp, ebx
mov r14d, 0xff
lea rcx, [rsp + 0x41]
cmovb ebx, ebp
xor esi, esi
mov r8, r14
xor edx, edx
mov byte [rsp + 0x40], sil
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x141]
mov r8, r14
xor edx, edx
mov byte [rsp + 0x140], sil
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x241]
mov r8, r14
xor edx, edx
mov byte [rsp + 0x240], sil
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x40]
mov r8, rbx
mov rdx, rdi
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + 0x140]
mov r8, rbx
mov rdx, rdi
call sub.msvcrt.dll_memcpy
cmp ebp, esi
jbe 0x14006d517
mov rax, rbp
xor byte [rsp + rsi + 0x40], 0x5c
xor byte [rsp + rsi + 0x140], 0x36
add rsi, 1
sub rax, 1
jne 0x14006d500
lea rax, [rsp + 0x240]
mov ebx, 0x8004
lea r8, [rsp + 0x140]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x380]
mov r9d, ebp
mov dword [rsp + 0x28], eax
mov edx, ebx
mov rcx, r12
mov qword [rsp + 0x20], r13
call fcn.14006d33c
mov r11, qword [rsp + 0x388]
mov qword [rsp + 0x30], r11
lea rax, [rsp + 0x240]
lea r8, [rsp + 0x40]
mov r9d, ebp
mov edx, ebx
mov rcx, r12
mov dword [rsp + 0x28], 0x14
mov qword [rsp + 0x20], rax
call fcn.14006d33c
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret

Function at 0x14006e280
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.14006e220
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [rbx], rax
je 0x14006e362
lea rdi, [0x14008ad40]
mov edx, 0xc9
mov rcx, rdi
call fcn.140066fe8
mov rcx, qword [rbx]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0xca
mov rcx, rdi
mov qword [rbx + 0x10], rax
call fcn.140066fe8
mov rcx, qword [rbx]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0xcb
mov rcx, rdi
mov qword [rbx + 0x18], rax
call fcn.140066fe8
mov rcx, qword [rbx]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0xcc
mov rcx, rdi
mov qword [rbx + 0x20], rax
call fcn.140066fe8
mov rcx, qword [rbx]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0xcd
mov rcx, rdi
mov qword [rbx + 0x28], rax
call fcn.140066fe8
mov rcx, qword [rbx]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [rbx + 0x10], 0
mov qword [rbx + 0x30], rax
je 0x14006e35a
cmp qword [rbx + 0x18], 0
je 0x14006e35a
mov dword [rbx + 8], 1
jmp 0x14006e362
mov rcx, rbx
call fcn.14006e220
mov eax, dword [rbx + 8]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret