joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003a210
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x14024fa28]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov ebx, r9d
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
jne 0x14003a24c
mov eax, 0x1b62
jmp 0x14003a33c
cmp qword [rcx + 8], 0
jne 0x14003a25d
mov eax, 0x232e
jmp 0x14003a33c
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x14003c8e9.0]
mov rdx, qword [rsi + 0x10]
mov rcx, qword [rsi + 8]
bt ebx, 9
jae 0x14003a2d3
test rdx, rdx
je 0x14003a2bd
mov eax, dword [rdx]
test eax, eax
je 0x14003a2bd
cmp eax, 1
je 0x14003a29a
mov eax, dword [rdx + 4]
add rdx, 8
add rdx, rax
mov eax, dword [rdx]
test eax, eax
jne 0x14003a283
jmp 0x14003a2bd
mov r8d, 0x122
lea rdx, [rsp + 0x30]
call fcn.1401a4df0
test al, al
jne 0x14003a2b8
mov eax, 0x1388
jmp 0x14003a33c
lea rcx, [rsp + 0x30]
mov r8d, 4
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne al
jmp 0x14003a2e7
mov r9, rbp
mov dword [rsp + 0x20], ebx
mov r8, rdi
call fcn.14018d4b0
test eax, eax
sete al
test al, al
je 0x14003a328
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x14003a2f2
mov rcx, qword [rsi + 8]
inc rbx
lea rdx, [rbx + rbx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
je 0x14003a324
mov r8, rdi
mov qword [rsi + 8], rax
mov rdx, rbx
mov rcx, rax
call fcn.1401aec20
xor eax, eax
jmp 0x14003a33c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14018f710
mov ecx, eax
call fcn.1401aea40
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1401c5190
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret

Function at 0x14003a360
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x14024fa28]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdx, qword [rcx + 8]
test rdx, rdx
jne 0x14003a396
lea ecx, [rdx + 0xd]
call fcn.14018f3e0
mov eax, 0xffffffff
jmp 0x14003a45e
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14003a3ba
mov eax, dword [rcx]
test eax, eax
je 0x14003a3ba
cmp eax, 1
je 0x14003a415
mov eax, dword [rcx + 4]
add rcx, 8
add rcx, rax
mov eax, dword [rcx]
test eax, eax
jne 0x14003a3a5
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x104
mov qword [rsp + 0x30], 0
lea r9, [rsp + 0x20]
movzx r8d, byte [0x140256a90]
mov rcx, rdx
call fcn.14018c810
test eax, eax
je 0x14003a436
cmp eax, 1
je 0x14003a421
lea rax, [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
cmp rcx, rax
je 0x14003a40e
test rcx, rcx
je 0x14003a40e
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ebx, 0xffffffff
jmp 0x14003a45c
mov rcx, rdx
call fcn.14018eeb0
mov ebx, eax
jmp 0x14003a45c
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb ebx, ebx
neg ebx
dec ebx
jmp 0x14003a442
mov rcx, qword [rsp + 0x20]
call fcn.14018eeb0
mov ebx, eax
lea rax, [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
cmp rcx, rax
je 0x14003a45c
test rcx, rcx
je 0x14003a45c
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401c5190
add rsp, 0x250
pop rbx
ret
Function at 0x14003a510
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x14024fa28]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rax, qword [rcx]
mov edi, edx
mov rbx, rcx
mov rax, qword [rax + 0x20]
call qword [case.0x14003c8e9.0]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14003a55e
mov rdx, qword [rbx + 0x10]
mov r8d, 0x20
call fcn.14018d9d0
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0xb8]
call qword [case.0x14003c8e9.0]
movzx esi, al
bt edi, 9
jae 0x14003a605
mov rcx, qword [rbx + 0x10]
mov r9, qword [rbx + 8]
test rcx, rcx
je 0x14003a5cb
mov edx, dword [rcx]
test edx, edx
je 0x14003a5cb
cmp edx, 1
je 0x14003a5a8
mov eax, dword [rcx + 4]
add rcx, 8
add rcx, rax
mov edx, dword [rcx]
test edx, edx
jne 0x14003a591
jmp 0x14003a5cb
mov r8d, 0x122
lea rdx, [rsp + 0x20]
mov rcx, r9
call fcn.1401a4df0
test al, al
jne 0x14003a5c6
mov eax, 0x1388
jmp 0x14003a5e0
lea r9, [rsp + 0x20]
xor edx, edx
mov rcx, r9
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x14003a61e
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1401c5190
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rax, qword [rbx]
mov edx, edi
mov rcx, rbx
mov rax, qword [rax + 0xa0]
call qword [case.0x14003c8e9.0]
test eax, eax
je 0x14003a5de
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14018f710
mov ecx, eax
call fcn.1401aea40
lea ecx, [rax - 0x2332]
cmp ecx, 1
jbe 0x14003a5de
test sil, sil
mov ecx, 0x2337
cmovne eax, ecx
jmp 0x14003a5e0
Function at 0x14003c690
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
cmp dword [rcx + 0xd8], 0
mov edi, edx
mov rbx, rcx
je 0x14003c6b8
mov eax, 0x232d
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rsi
xor esi, esi
mov dword [rcx + 0xc0], edi
mov qword [rcx + 0xc8], rsi
test dil, 0x20
je 0x14003c799
mov qword [rcx + 0x148], 0xffffffffffffffff
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14003c74c
mov r8d, dword [rcx]
test r8d, r8d
je 0x14003c74c
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rcx + 4]
lea rdx, [rcx + 8]
add rdx, rax
cmp r8d, 0xf
je 0x14003c71d
mov r8d, dword [rdx]
mov rcx, rdx
test r8d, r8d
jne 0x14003c700
jmp 0x14003c74c
mov r8, rdx
test rdx, rdx
jne 0x14003c72a
mov r8, rsi
jmp 0x14003c747
cmp dword [rdx], esi
je 0x14003c740
nop
mov eax, dword [r8 + 4]
add r8, 8
add r8, rax
cmp dword [r8], esi
jne 0x14003c730
sub r8, rdx
add r8, 8
call sub.VCRUNTIME140.dll_memmove
bt edi, 0x12
jae 0x14003c799
mov dword [rbx + 0xe0], 0x67452301
mov dword [rbx + 0xe4], 0xefcdab89
mov dword [rbx + 0xe8], 0x98badcfe
mov dword [rbx + 0xec], 0x10325476
mov dword [rbx + 0xf0], 0xc3d2e1f0
mov qword [rbx + 0xf8], rsi
mov qword [rbx + 0x100], rsi
mov qword [rbx + 0x148], rsi
mov rax, qword [rbx + 0x168]
mov dword [rbx + 0xd8], 1
cmp rax, 0xffffffffffffffff
je 0x14003c7d2
mov qword [rbx + 0xd0], rax
cmp qword [rbx + 0x48], rsi
jne 0x14003c7c7
cmp rax, qword [rbx + 0x40]
jge 0x14003c7c7
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x168], 0xffffffffffffffff
test dil, dil
jns 0x14003c80f
mov rax, qword [rbx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov rax, qword [rax + 0x38]
call qword [case.0x14003c8e9.0]
test rax, rax
je 0x14003c80f
mov dword [rbx + 0xd8], esi
mov eax, 0x232a
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x40]
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14003fd40
Capabilities:
Encrypt data using curve25519
Hash data using sha512

Disassembly:
push rbp
push rsi
push rdi
push r14
lea rbp, [rsp - 0x198]
sub rsp, 0x298
mov rax, qword [0x14024fa28]
xor rax, rsp
mov qword [rbp + 0x178], rax
mov rdi, r9
mov r14, r8
mov rsi, rdx
test rcx, rcx
je 0x14003ff4e
test rdx, rdx
je 0x14003ff4e
test r8, r8
je 0x14003ff4e
mov qword [rsp + 0x288], r15
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003fda0
add rax, rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x138]
call fcn.1400153d0
movups xmm0, xmmword [rbp + 0x138]
movabs rax, 0x6a09e667f3bcc908
lea rdx, [rsp + 0x50]
movups xmm1, xmmword [rbp + 0x148]
mov qword [rbp - 0x70], rax
lea rcx, [rbp - 0x70]
movabs rax, 0xbb67ae8584caa73b
mov dword [rbp - 0x20], 0x20
mov qword [rbp - 0x68], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rbp - 0x60], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rbp - 0x58], rax
movabs rax, 0x510e527fade682d1
mov qword [rbp - 0x50], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rbp - 0x48], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rbp - 0x40], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rbp - 0x38], rax
xor eax, eax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm1
call fcn.140025e70
movzx eax, byte [rsp + 0x6f]
lea rdx, [rsp + 0x50]
and byte [rsp + 0x50], 0xf8
lea rcx, [rbp + 0x110]
and al, 0x3f
mov r8d, 0x20
or al, 0x40
mov byte [rsp + 0x6f], al
call fcn.140016b50
lea r8, [rbp + 0x110]
lea rdx, [0x1401f2ce0]
lea rcx, [rbp + 0x70]
call fcn.140025110
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x158]
call fcn.14001eb20
mov r15, qword [rdi + 8]
mov rdx, qword [rdi]
mov rcx, r15
sub rcx, rdx
mov byte [rsp + 0x40], 0
cmp rcx, 0x40
jbe 0x14003fed6
lea rax, [rdx + 0x40]
jmp 0x14003ff1d
jae 0x14003ff21
mov rax, qword [rdi + 0x10]
sub rax, rdx
cmp rax, 0x40
jae 0x14003fef4
lea r8, [rsp + 0x40]
mov rcx, rdi
call fcn.140040190
jmp 0x14003ff21
mov qword [rsp + 0x290], rbx
xor edx, edx
mov ebx, 0x40
sub rbx, rcx
mov rcx, r15
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
lea rax, [r15 + rbx]
mov rbx, qword [rsp + 0x290]
mov qword [rdi + 8], rax
mov rax, qword [rdi]
lea r9, [rbp + 0x158]
lea r8, [rbp + 0x138]
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, rsi
call fcn.140026630
mov r15, qword [rsp + 0x288]
mov al, 1
jmp 0x14003ff50
xor al, al
mov rcx, qword [rbp + 0x178]
xor rcx, rsp
call fcn.1401c5190
add rsp, 0x298
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400413f0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx eax, byte [rcx]
xor r9d, r9d
mov r11, rcx
mov r10d, 0xffffffff
test al, al
je 0x140041454
mov qword [rsp], rbx
lea rbx, [0x1401f8ce0]
cmp al, 0x22
je 0x140041444
movzx ecx, al
lea edx, [rax - 0x61]
and cl, 0xdf
movzx r8d, cl
cmp dl, 0x19
movzx ecx, al
mov eax, r10d
cmova r8d, ecx
mov ecx, r10d
xor r8, rax
shr ecx, 8
movzx eax, r8b
mov r10d, dword [rbx + rax*4]
xor r10d, ecx
inc r9d
movzx eax, byte [r11 + r9*2]
test al, al
jne 0x140041412
mov rbx, qword [rsp]
not r10d
mov eax, r10d
add rsp, 8
ret
Function at 0x14005ec10
Capabilities:
Encode data using xor

Disassembly:
movzx eax, byte [rdx]
xor r8d, r8d
mov r11, rdx
mov r10, rcx
mov r9, rdx
test al, al
je 0x14005ec45
movsx eax, al
lea r9, [r9 + 1]
add eax, r8d
imul r8d, eax, 0x401
mov eax, r8d
shr eax, 6
xor r8d, eax
movzx eax, byte [r9]
test al, al
jne 0x14005ec23
lea eax, [r8 + r8*8]
mov ecx, eax
shr rax, 0xb
xor rax, rcx
and eax, 0x3f
mov r8, qword [r10 + rax*8]
test r8, r8
je 0x14005ecb1
nop
mov ecx, dword [r8]
sub ecx, 1
je 0x14005ec87
sub ecx, 1
je 0x14005ec81
sub ecx, 1
je 0x14005ec81
cmp ecx, 1
je 0x14005ec7b
xor eax, eax
jmp 0x14005ec8b
lea rax, [r8 + 0x11]
jmp 0x14005ec8b
lea rax, [r8 + 0x18]
jmp 0x14005ec8b
lea rax, [r8 + 0x38]
mov r9, r11
sub r9, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x14005eca4
inc rax
test ecx, ecx
jne 0x14005ec91
test edx, edx
je 0x14005ecb4
mov r8, qword [r8 + 8]
test r8, r8
jne 0x14005ec60
xor eax, eax
ret
mov rax, r8
ret
Function at 0x14006ad70
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0xf90]
mov eax, 0x1090
call fcn.1401c66b0
sub rsp, rax
mov rax, qword [0x14024fa28]
xor rax, rsp
mov qword [rbp + 0xf80], rax
mov edi, edx
lea rcx, [rsp + 0x30]
call fcn.140069b00
nop
cmp byte [rsp + 0x70], 0
je 0x14006aede
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
call fcn.140197090
lea rcx, str.13.1.6.0
lea rdx, str.7.3.0.0
test al, al
cmovne rdx, rcx
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
call fcn.140040280
test eax, eax
jns 0x14006aede
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp - 0x80]
call sub.VCRUNTIME140.dll_memset
lea r8, str.InstSuppExPrepareUninstallDeferred
lea rdx, str.SELECT_Action_FROM_CustomAction_WHERE_Action_ws
lea rcx, [rbp - 0x80]
call fcn.14006b0f0
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x780]
call sub.VCRUNTIME140.dll_memset
lea r8, str.InstSuppExPrepareUninstallDeferred
lea rdx, str.SELECT_Action_FROM_InstallExecuteSequence_WHERE_Action_ws
lea rcx, [rbp + 0x780]
call fcn.14006b0f0
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
lea rcx, [rbp - 0x80]
mov rbx, 0xffffffffffffffff
mov rax, rbx
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x14006ae70
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
mov ecx, edi
call fcn.1400698c0
test al, al
je 0x14006aeda
lea rax, [rbp + 0x780]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x780]
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14006aeb0
mov qword [rsp + 0x28], rbx
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
mov ecx, edi
call fcn.1400698c0
test al, al
jne 0x14006aede
mov bl, 1
jmp 0x14006aee0
xor bl, bl
cmp byte [rsp + 0x70], 0
je 0x14006af06
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x50]
call fcn.1400036b0
nop
lea rcx, [rsp + 0x30]
call fcn.1400036b0
movzx eax, bl
mov rcx, qword [rbp + 0xf80]
xor rcx, rsp
call fcn.1401c5190
lea r11, [rsp + 0x1090]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14006d930
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rsi, rdx
mov r11, rcx
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
mov r15d, dword [rax + rcx + 0x8c]
mov edi, dword [rax + rcx + 0x88]
add rcx, rdi
mov r14d, dword [rcx + 0x1c]
add r14, r11
mov r13d, dword [rcx + 0x24]
add r13, r11
mov eax, dword [rcx + 0x20]
add rax, r11
mov qword [rsp + 0x80], rax
mov r12d, dword [rcx + 0x18]
cmp rdx, 0xffff
ja 0x14006d9a7
mov eax, esi
sub eax, dword [rcx + 0x10]
cmp eax, dword [rcx + 0x14]
jae 0x14006da0e
lfence
mov r8d, dword [r14 + rax*4]
add r8, r11
jmp 0x14006da09
mov r10d, r8d
mov dword [rsp + 0x20], r8d
nop
cmp r10d, r12d
jae 0x14006da0e
mov ebx, r10d
mov eax, dword [rax + rbx*4]
add rax, r11
mov r9, rsi
sub r9, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x14006d9d7
inc rax
test ecx, ecx
jne 0x14006d9c4
test edx, edx
jne 0x14006d9f7
movsx eax, word [r13 + rbx*2]
mov edx, dword [r14 + rax*4]
cmp edx, edi
jb 0x14006d9f1
lea eax, [rdi + r15]
cmp edx, eax
jb 0x14006da0e
lea r8, [r11 + rdx]
jmp 0x14006da09
inc r10d
mov dword [rsp + 0x20], r10d
mov rax, qword [rsp + 0x80]
jmp 0x14006d9b0
mov qword [rsp + 0x28], r8
jmp 0x14006da22
test r8, r8
jne 0x14006da43
mov rdx, rsi
mov rcx, r11
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
jmp qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rax, r8
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14006da60
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14024fa28]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rdx
mov rsi, rcx
test rdx, rdx
jne 0x14006da8d
xor al, al
jmp 0x14006dc31
xor ebp, ebp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], bp
lea edx, [rbp + 0x2f]
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
lea rdi, [rbp - 1]
test rax, rax
je 0x14006db39
mov r8, rdi
inc r8
cmp word [rbx + r8*2], 0
jne 0x14006dac4
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140003530
lea rcx, [rsp + 0x20]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x38]
cmp r8, 8
cmovae rcx, rdx
mov rax, qword [rsp + 0x30]
lea rax, [rcx + rax*2]
lea rcx, [rsp + 0x20]
cmovae rcx, rdx
cmp rcx, rax
je 0x14006db2c
mov edx, 0x5c
nop
cmp word [rcx], 0x2f
jne 0x14006db19
mov word [rcx], dx
add rcx, 2
cmp rcx, rax
jne 0x14006db10
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x20]
lea rbx, [rsp + 0x20]
cmp r8, 8
cmovae rbx, rdx
mov edx, 0x25
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
je 0x14006dba2
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x14006db9e
mov edx, eax
mov rcx, rsi
call fcn.140011270
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x14006db75
mov rdx, qword [rsi]
mov r8d, dword [rsi + 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x14006db9e
mov ecx, eax
cmp rcx, qword [rsi + 0x10]
ja 0x14006db9e
lfence
lea edx, [rax - 1]
mov rcx, rsi
call fcn.140011270
jmp 0x14006dbba
xor bl, bl
jmp 0x14006dbd6
inc rdi
cmp word [rbx + rdi*2], 0
jne 0x14006dba2
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call fcn.140003530
mov rcx, rsi
call fcn.14006dde0
mov qword [rsi + 0x40], rax
mov rcx, rsi
call fcn.14006e200
cmp qword [rsi + 0x40], 0xffffffffffffffff
setne bl
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14006dc1b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006dc16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006dc16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007ea0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], bp
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401c5190
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140070030
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rdi, rdx
mov r15, rcx
mov ecx, 0x208
call fcn.1401c538c
mov rbp, rax
mov rbx, rax
mov qword [rsp + 0x70], rax
mov edx, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r14d, eax
test eax, eax
je 0x140070269
mov rsi, 0xffffffffffffffff
xor r12d, r12d
cmp r14d, 0x104
jbe 0x1400700e0
lfence
mov eax, 2
mul r14
cmovo rax, rsi
mov rcx, rax
call fcn.1401c538c
mov rbx, rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x70], rax
mov rcx, rbp
call fcn.140007ea0
nop
mov edx, r14d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov rbp, rbx
test eax, eax
je 0x140070269
nop word [rax + rax]
inc rsi
cmp word [rbp + rsi*2], 0
jne 0x1400700e0
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.140003530
mov rax, rdi
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140070109
mov rax, qword [rdi]
mov rcx, qword [rdi + 0x10]
lea r9, [rcx + rcx]
cmp word [r9 + rax - 2], 0x5c
je 0x140070172
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14007014d
lea r8, [rcx + 1]
mov qword [rdi + 0x10], r8
mov rcx, rdi
cmp rdx, 8
jb 0x14007013a
mov rcx, qword [rdi]
movzx eax, word [0x1401f1088]
mov word [r9 + rcx], ax
mov word [rcx + r8*2], r12w
jmp 0x140070172
lfence
mov qword [rsp + 0x20], 1
lea r9, [0x1401f1088]
mov edx, 1
mov rcx, rdi
call fcn.1400033b0
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 8
jb 0x1400701b7
lea rbp, [rcx + 8]
mov qword [rdi + 0x10], rbp
mov rsi, rdi
cmp rdx, 8
jb 0x14007019a
mov rsi, qword [rdi]
lea rcx, [rsi + rcx*2]
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.drivers_
call sub.VCRUNTIME140.dll_memmove
mov word [rsi + rbp*2], r12w
jmp 0x1400701dc
lfence
mov qword [rsp + 0x20], 8
lea r9, str.drivers_
mov edx, 8
mov rcx, rdi
call fcn.1400033b0
mov rbx, qword [rsp + 0x70]
lea rdx, [r15 + 0x10]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x1400701ee
mov rdx, qword [rdx]
mov rcx, rdi
call fcn.140003330
mov rdx, qword [rdi + 0x10]
mov r9, qword [rdi + 0x18]
mov rax, r9
sub rax, rdx
mov rcx, rdi
cmp rax, 4
jb 0x140070230
lea r8, [rdx + 4]
mov qword [rdi + 0x10], r8
cmp r9, 8
jb 0x14007021e
mov rcx, qword [rdi]
mov rax, qword [str..sys]
mov qword [rcx + rdx*2], rax
mov word [rcx + r8*2], r12w
jmp 0x140070252
lfence
mov qword [rsp + 0x20], 4
lea r9, str..sys
mov edx, 4
call fcn.1400033b0
mov rbx, qword [rsp + 0x70]
cmp qword [rdi + 0x18], 8
jb 0x14007025c
mov rdi, qword [rdi]
mov rdx, rdi
call fcn.14006fde0
movzx edi, al
jmp 0x14007026c
xor dil, dil
test rbx, rbx
je 0x140070279
mov rcx, rbx
call fcn.140007ea0
movzx eax, dil
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140070b70
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [0x14024fa28]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov r14, r8
mov rcx, rdx
mov dword [rsp + 0x20], 0
xor edx, edx
lea r9d, [rdx + 3]
lea r8d, [rdx + 1]
call fcn.14018cd60
mov rbx, rax
test rax, rax
je 0x140070bdb
xor r9d, r9d
lea r8, [rbp - 0x49]
xor edx, edx
mov rcx, rax
call fcn.14018db40
cmp eax, 0xffffffff
jne 0x140070be2
mov rcx, rbx
call fcn.14018d330
xor al, al
jmp 0x140070d23
mov rsi, qword [rbp - 0x49]
mov rcx, rsi
call fcn.1401c538c
mov rdi, rax
mov qword [rbp - 0x49], rax
mov r8, rsi
mov rdx, rax
mov rcx, rbx
call fcn.14018ce80
mov rcx, rbx
cmp rax, rsi
je 0x140070c17
call fcn.14018d330
xor bl, bl
jmp 0x140070d18
call fcn.14018d330
mov dword [rbp - 0x39], 0x67452301
mov dword [rbp - 0x35], 0xefcdab89
mov dword [rbp - 0x31], 0x98badcfe
mov dword [rbp - 0x2d], 0x10325476
mov dword [rbp - 0x29], 0xc3d2e1f0
mov qword [rbp - 0x21], 0
mov qword [rbp - 0x19], 0
mov r8, rsi
mov rdx, rdi
lea rcx, [rbp - 0x39]
call fcn.140157410
lea rcx, [rbp - 0x39]
call fcn.1401574f0
mov ecx, dword [rbp - 0x39]
mov eax, ecx
shr eax, 0x18
mov byte [rbp - 0x11], al
mov eax, ecx
shr eax, 0x10
mov byte [rbp - 0x10], al
shr ecx, 8
mov byte [rbp - 0xf], cl
movzx eax, byte [rbp - 0x39]
mov byte [rbp - 0xe], al
mov ecx, dword [rbp - 0x35]
mov eax, ecx
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, ecx
shr eax, 0x10
mov byte [rbp - 0xc], al
shr ecx, 8
mov byte [rbp - 0xb], cl
movzx eax, byte [rbp - 0x35]
mov byte [rbp - 0xa], al
mov ecx, dword [rbp - 0x31]
mov eax, ecx
shr eax, 0x18
mov byte [rbp - 9], al
mov eax, ecx
shr eax, 0x10
mov byte [rbp - 8], al
shr ecx, 8
mov byte [rbp - 7], cl
movzx eax, byte [rbp - 0x31]
mov byte [rbp - 6], al
mov ecx, dword [rbp - 0x2d]
mov eax, ecx
shr eax, 0x18
mov byte [rbp - 5], al
mov eax, ecx
shr eax, 0x10
mov byte [rbp - 4], al
shr ecx, 8
mov byte [rbp - 3], cl
movzx eax, byte [rbp - 0x2d]
mov byte [rbp - 2], al
mov ecx, dword [rbp - 0x29]
mov eax, ecx
shr eax, 0x18
mov byte [rbp - 1], al
mov eax, ecx
shr eax, 0x10
mov byte [rbp], al
shr ecx, 8
mov byte [rbp + 1], cl
movzx eax, byte [rbp - 0x29]
mov byte [rbp + 2], al
movups xmm0, xmmword [rbp - 0x11]
movups xmmword [r14], xmm0
mov eax, dword [rbp - 1]
mov dword [r14 + 0x10], eax
mov bl, 1
mov rcx, rdi
call fcn.140007ea0
movzx eax, bl
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1401c5190
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret