joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18006b0b0
Capabilities:
Get disk information

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x180106010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r14d, r8d
mov r12, rdx
mov r15, rcx
xor edi, edi
mov qword [rsp + 0x48], rdi
lea rcx, [rsp + 0x48]
call fcn.18000c470
nop
cmp r8d, 0x3fe
jbe 0x18006b17f
lea ecx, [r14 + 2]
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.180086e04
mov r12, rax
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.18000c480
mov rdx, r12
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x18006b157
cmp eax, r14d
ja 0x18006b157
mov ecx, eax
mov word [r12 + rcx*2], di
lea ecx, [rax + 1]
mov word [r12 + rcx*2], di
mov r14d, eax
jmp 0x18006b1af
lea rcx, [rsp + 0x48]
call fcn.18000c460
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180086280
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, r14
add rax, rax
cmp rax, 0x800
jae 0x18006b293
mov word [rax + rdx], di
lea eax, [r14 + 1]
mov ecx, eax
add rcx, rcx
cmp rcx, 0x800
jae 0x18006b28d
mov word [rcx + rdx], di
mov ebx, edi
test r14d, r14d
je 0x18006b27c
mov rbp, r12
nop dword [rax]
cmp word [rbp], 0
jne 0x18006b26d
cmp edi, ebx
je 0x18006b26d
mov eax, edi
lea rdx, [r12 + rax*2]
lea rcx, [rsp + 0x28]
call fcn.180005ef8
nop
lea rcx, [rsp + 0x28]
call fcn.180005c20
mov rdx, rax
mov rcx, r15
call fcn.18000600c
mov rcx, rdx
test al, al
je 0x18006b247
call fcn.180005c20
mov rdx, rax
mov rcx, r15
call fcn.180005f40
mov rsi, rax
mov rcx, rdx
call fcn.180005c20
mov rdi, rax
mov rdx, qword [rsi]
mov ecx, 0x20
call fcn.180005d08
mov r8, rax
mov rcx, rdi
call fcn.180005c20
mov rdx, rax
mov rcx, r8
call fcn.180005eac
add qword [rsi], 0x20
jmp 0x18006b260
call fcn.180005c20
mov r8, rax
mov rcx, r15
call fcn.180005f40
mov rdx, qword [rax]
call fcn.180006414
nop
lea rcx, [rsp + 0x28]
call fcn.180005bf4
lea edi, [rbx + 1]
inc ebx
add rbp, 2
cmp ebx, r14d
jb 0x18006b1c0
lea rcx, [rsp + 0x48]
call fcn.18000c460
mov al, 1
jmp 0x18006b163
call fcn.1800863bc
int3
call fcn.1800863bc
int3
Function at 0x180071e10
Capabilities:
Get file size
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x180106010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r13, r9
mov r12d, r8d
mov r15, rdx
mov rsi, rcx
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x30], rax
xor edi, edi
test rax, rax
je 0x180071e5e
mov dword [rax], edi
mov dword [r9], edi
cmp qword [rcx], 0xffffffffffffffff
je 0x180071fbc
mov eax, 0x100000
mov ebp, r12d
cmp r12d, eax
cmova ebp, eax
mov dword [rsp + 0x68], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x68]
mov r8d, ebp
mov rdx, r15
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, 0x80004005
test eax, eax
cmovne edx, edi
cmp qword [rsi + 0x28], 0
je 0x180071f89
test edx, edx
je 0x180071f89
mov ecx, dword [rsp + 0x68]
cmp ecx, ebp
jae 0x180071f8d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov rbx, rdi
mov rcx, qword [rsi]
cmp rcx, 0xffffffffffffffff
jne 0x180071ed9
xor dil, dil
jmp 0x180071f0c
mov dword [rsp + 0x6c], edi
lea rdx, [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp eax, 0xffffffff
jne 0x180071efe
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x180071efe
xor dil, dil
jmp 0x180071f0c
mov ebx, dword [rsp + 0x6c]
shl rbx, 0x20
add rbx, rdi
mov dil, 1
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], rax
lea rdx, [rsi + 8]
lea rcx, [rsp + 0x48]
call fcn.180006d90
nop
mov rcx, qword [rsi + 0x28]
mov r10, qword [rcx]
mov r9, r14
xor r8d, r8d
test dil, dil
cmovne r8, rbx
mov rdx, rax
call qword [r10 + 0x30]
mov edx, eax
xor edi, edi
test eax, eax
jne 0x180071f89
mov dword [rsp + 0x70], edi
mov edx, dword [rsp + 0x68]
add rdx, r15
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x70]
mov r8d, ebp
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, 0x80004005
test eax, eax
cmovne edx, edi
mov ecx, dword [rsp + 0x68]
add ecx, dword [rsp + 0x70]
mov dword [rsp + 0x68], ecx
test eax, eax
je 0x180071eb7
jmp 0x180071f8d
mov ecx, dword [rsp + 0x68]
add dword [r13], ecx
test edx, edx
jne 0x180071fb0
test ecx, ecx
je 0x180071fac
mov eax, ecx
add r15, rax
sub r12d, ecx
mov eax, 0x100000
jne 0x180071e70
mov al, 1
jmp 0x180071fbe
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x180071fbc
mov dword [rax], edx
xor al, al
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180086280
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180077860
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x180106010]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor eax, eax
mov dword [rsp + 0x20], VarUI4FromDisp
mov qword [rcx + 8], rax
mov rbx, rcx
mov qword [rcx + 0x10], rax
xor edx, edx
mov qword [rcx + 0x18], rax
mov r8d, VarUI4FromDisp
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x48], rax
mov qword [rcx + 0x50], rax
mov byte [rcx], al
lea rcx, [rsp + 0x24]
call fcn.18008a090
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov rax, rbx
je 0x1800778e0
cmp dword [rsp + 0x24], 6
jb 0x1800778e0
mov byte [rbx], 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180086280
add rsp, 0x150
pop rbx
ret

Function at 0x180077900
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rsi, rcx
lea rdx, str.wintrust.dll
lea rcx, [rax - 0x50]
call fcn.180005ef8
nop
call fcn.18005e290
mov rcx, rax
lea rdx, [rsp + 0x28]
call fcn.18005e330
mov rbx, rax
lea rcx, [rsp + 0x28]
call fcn.180005bf4
lea rdx, str.crypt32.dll
lea rcx, [rsp + 0x48]
call fcn.180005ef8
nop
call fcn.18005e290
mov rcx, rax
lea rdx, [rsp + 0x48]
call fcn.18005e330
mov rdi, rax
lea rcx, [rsp + 0x48]
call fcn.180005bf4
test rbx, rbx
je 0x180077a56
test rdi, rdi
je 0x180077a56
lea rdx, str.CryptCATAdminCalcHashFromFileHandle
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 8], rax
lea rdx, str.CryptCATAdminAcquireContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x10], rax
lea rdx, str.CryptCATAdminEnumCatalogFromHash
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x18], rax
lea rdx, str.CryptCATCatalogInfoFromContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x20], rax
lea rdx, str.CryptCATAdminReleaseCatalogContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x28], rax
lea rdx, str.CryptCATAdminReleaseContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x30], rax
lea rdx, str.WTHelperProvDataFromStateData
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x38], rax
lea rdx, str.WTHelperGetProvSignerFromChain
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x40], rax
lea rdx, str.WinVerifyTrust
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x48], rax
lea rdx, str.CertNameToStrW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x50], rax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1800a1938
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1800a17d8
call fcn.18008ce0c
mov dword [rax], 0x16
call fcn.18008ccbc
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1800a17c0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1800a17c0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1800a180a
lock or dword [rax + 0x14], 0x10
jmp 0x1800a17c0
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1800a1827
mov rcx, qword [rbp + 0x10]
call fcn.1800a4ff4
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1800a037c
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1800a08d4
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x1800a187e
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x1800a17c0
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1800a18ea
mov rcx, qword [rbp + 0x10]
call fcn.1800a037c
cmp eax, 0xffffffff
je 0x1800a18d1
mov rcx, qword [rbp + 0x10]
call fcn.1800a037c
cmp eax, 0xfffffffe
je 0x1800a18d1
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1800a037c
movsxd rdi, eax
lea rsi, [0x1801091d0]
mov rcx, rbx
sar rdi, 6
call fcn.1800a037c
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1800a18d8
lea rax, [0x180106520]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1800a18ea
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1800a1920
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1800a191c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1800a191c
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x1800a17c3
jmp 0x1800a1790
Function at 0x1800afbf0
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x180106010]
xor rax, rsp
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x1800afc6e
and dword [rsp + 0x2c], 0
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
and dword [rsp + 0x28], 0
mov r9d, 2
and qword [rsp + 0x30], 0
mov rdx, 0xffffffff80000002
call fcn.180002880
mov rbx, qword [rsp + 0x20]
test eax, eax
jne 0x1800afc60
lea rdx, str.6B3BA4A8_EC7E_4714_9ECF_EB33995B3384
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test rbx, rbx
je 0x1800afc6e
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [0x180109998]
test rbx, rbx
je 0x1800afca4
jmp 0x1800afc9e
call qword [rbx + 0x38]
mov rcx, qword [rbx]
xor r8d, r8d
mov rdx, rax
call fcn.180004c90
test eax, eax
js 0x1800afcfe
xor ecx, ecx
call qword [rbx + 8]
test eax, eax
js 0x1800afcfe
add rbx, 0x48
cmp qword [rbx], 0
jne 0x1800afc7c
mov rax, qword [0x180109928]
test rax, rax
je 0x1800afcb6
call rax
test eax, eax
js 0x1800afcfe
mov rbx, qword [0x180109eb0]
xor eax, eax
mov rcx, qword [0x180109eb8]
jmp 0x1800afcf9
mov rdi, qword [rbx]
test rdi, rdi
je 0x1800afcf5
call qword [rdi + 0x30]
mov rcx, qword [rdi]
xor r8d, r8d
mov rdx, rax
call fcn.180004c90
test eax, eax
js 0x1800afcfe
xor ecx, ecx
call qword [rdi + 8]
test eax, eax
js 0x1800afcfe
mov rcx, qword [0x180109eb8]
add rbx, 8
cmp rbx, rcx
jb 0x1800afcc8
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180086280
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1800afd1c
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r14
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x180106010]
xor rax, rsp
mov qword [rbp - 8], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov r14d, 1
test eax, eax
js 0x1800afe59
and dword [rbp - 0x14], 0
lea rdi, str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
and qword [rbp - 0x20], 0
lea r9d, [r14 + 1]
and dword [rbp - 0x18], 0
lea rcx, [rbp - 0x20]
and qword [rbp - 0x10], 0
mov rbx, 0xffffffff80000002
mov r8, rdi
mov rdx, rbx
call fcn.180002880
test eax, eax
je 0x1800afe05
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionShell_Extensions
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.1800027c8
test eax, eax
jne 0x1800afdbb
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x1800afdb7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rbp - 0x20], 0
and dword [rbp - 0x18], 0
mov r8, rdi
lea rcx, [rbp - 0x20]
mov rdx, rbx
call fcn.1800027c8
test eax, eax
jne 0x1800afde6
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x1800afde2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rbp - 0x20], 0
and dword [rbp - 0x18], 0
mov r9d, 2
lea rcx, [rbp - 0x20]
mov r8, rdi
mov rdx, rbx
call fcn.180002880
test eax, eax
je 0x1800afe05
mov rcx, qword [rbp - 0x20]
jmp 0x1800afe4e
lea rbx, str.2345SoftMgr_Shell_Extension
mov rcx, rbx
call fcn.18008ce34
mov r9d, r14d
lea rdx, str.6B3BA4A8_EC7E_4714_9ECF_EB33995B3384
xor r8d, r8d
lea ecx, [rax*2 + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov rbx, qword [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x1800afe59
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
test rcx, rcx
je 0x1800afe59
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [0x180109998]
test rbx, rbx
je 0x1800afe94
jmp 0x1800afe8e
mov ecx, r14d
call qword [rbx + 8]
test eax, eax
js 0x1800afef6
call qword [rbx + 0x38]
mov rcx, qword [rbx]
mov r8d, r14d
mov rdx, rax
call fcn.180004c90
test eax, eax
js 0x1800afef6
add rbx, 0x48
cmp qword [rbx], 0
jne 0x1800afe67
mov rbx, qword [0x180109eb0]
xor eax, eax
mov rdx, qword [0x180109eb8]
jmp 0x1800afed8
mov rdi, qword [rbx]
test rdi, rdi
je 0x1800afed4
mov ecx, r14d
call qword [rdi + 8]
test eax, eax
js 0x1800afef6
call qword [rdi + 0x30]
mov rcx, qword [rdi]
mov r8d, r14d
mov rdx, rax
call fcn.180004c90
test eax, eax
js 0x1800afef6
mov rdx, qword [0x180109eb8]
add rbx, 8
cmp rbx, rdx
jb 0x1800afea6
test eax, eax
js 0x1800afef6
mov rdx, qword [0x180109920]
test rdx, rdx
je 0x1800afef6
mov rcx, qword [0x180108068]
call rdx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180086280
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r14, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1800b06ec
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0xd0
mov rax, qword [0x180106010]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov ebx, 0x60
lea rcx, [rsp + 0x40]
xor edx, edx
lea r8d, [rbx + 0x18]
call fcn.18008a090
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x76
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x34], 1
lea r8, str.LastLoadedDPI
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionThemeManager
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1800b0770
lea rcx, [rsp + 0x40]
call fcn.180054a30
mov ebx, eax
mov edx, 0x64
mov ecx, ebx
lea r8d, [rdx - 4]
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov ecx, eax
mov eax, 0x51eb851f
shl ecx, 4
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.180086280
add rsp, 0xd0
pop rbx
ret
Function at 0x1800b07b8
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x180106010]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
mov rax, qword [rcx + 0x58]
cmp qword [rcx + 0x50], rax
je 0x1800b0948
xor eax, eax
mov qword [rbp - 1], rax
lea rcx, [rbp - 1]
call fcn.18000c550
lea rsi, vtable.RC::RCDeferStat.0
mov qword [rbp - 9], rsi
lea rcx, [rbp - 9]
call fcn.1800074b0
lea rcx, [rbp - 9]
call fcn.1800077d0
lea rcx, [rbp + 0x27]
call fcn.1800b112c
nop
xor edi, edi
cmp qword [rbp + 0x37], rdi
je 0x1800b0919
lea rcx, [rbp + 0x27]
call fcn.180055740
test al, al
je 0x1800b0919
movdqa xmm0, xmmword [0x1800d8b10]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], di
mov r8, qword [rbx + 0x50]
cmp qword [r8 + 0x18], 8
jb 0x1800b086d
mov r8, qword [r8]
lea rdx, str.__shortcutsoftmgr
lea rcx, [rbp + 7]
call fcn.180055100
mov dword [rbp - 0x79], 0x70
mov dword [rbp - 0x75], 0x540
mov qword [rbp - 0x71], rdi
lea rax, str.Open
mov qword [rbp - 0x69], rax
lea rax, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae rax, qword [rbp + 0x27]
mov qword [rbp - 0x61], rax
lea rax, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae rax, qword [rbp + 7]
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x51], rdi
mov dword [rbp - 0x49], 1
xor edx, edx
lea r8d, [rdx + 0x38]
lea rcx, [rbp - 0x41]
call fcn.18008a090
lea rcx, [rbp - 0x79]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1800b08ea
xor edx, edx
jmp 0x1800b08fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1800b08f9
or edx, 0xffffffff
jmp 0x1800b08fb
mov edx, eax
lea rcx, [rbp - 9]
call fcn.1800078a0
lea rcx, [rbp - 1]
call fcn.18000c6d0
nop
lea rcx, [rbp + 7]
call fcn.180005c24
jmp 0x1800b0931
mov edx, 0xfffffffe
lea rcx, [rbp - 9]
call fcn.1800078a0
lea rcx, [rbp - 1]
call fcn.18000c6d0
nop
lea rcx, [rbp + 0x27]
call fcn.180005c24
nop
mov qword [rbp - 9], rsi
lea rcx, [rbp - 1]
call fcn.18000c5a0
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.180086280
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140001a94
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001ade
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001ade
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001ade
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001ade
cmp dword [rcx + 0x84], 0xe
jbe 0x140001ade
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001ae0
xor al, al
add rsp, 0x28
ret
Function at 0x140041b10
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
movdqa xmm0, xmmword [rcx]
movdqa xmm1, xmmword [rcx + 0x10]
movdqa xmm9, xmmword [rcx + 0x20]
movdqa xmm8, xmmword [rcx + 0x30]
movdqa xmm10, xmmword [rdx]
pxor xmm10, xmm0
movdqa xmm3, xmmword [rdx + 0x10]
pxor xmm3, xmm0
movdqa xmm4, xmmword [rdx + 0x20]
pxor xmm4, xmm0
movdqa xmm5, xmmword [rdx + 0x30]
pxor xmm5, xmm0
movdqa xmm2, xmmword [rdx + 0x40]
pxor xmm2, xmm0
movdqa xmm6, xmmword [rdx + 0x50]
pxor xmm6, xmm0
movdqa xmm7, xmmword [rdx + 0x60]
pxor xmm7, xmm0
pxor xmm0, xmmword [rdx + 0x70]
aesenc xmm10, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm2, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm0, xmm1
aesenc xmm10, xmm9
aesenc xmm3, xmm9
aesenc xmm4, xmm9
aesenc xmm5, xmm9
aesenc xmm2, xmm9
aesenc xmm6, xmm9
aesenc xmm7, xmm9
aesenc xmm0, xmm9
aesenc xmm10, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm5, xmm8
aesenc xmm2, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm0, xmm8
movdqa xmm1, xmmword [rcx + 0x40]
aesenc xmm10, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm2, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm0, xmm1
movdqa xmm1, xmmword [rcx + 0x50]
aesenc xmm10, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm2, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm0, xmm1
movdqa xmm1, xmmword [rcx + 0x60]
aesenc xmm10, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm2, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm0, xmm1
movdqa xmm1, xmmword [rcx + 0x70]
aesenc xmm10, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm2, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm0, xmm1
movdqa xmm1, xmmword [rcx + 0x80]
aesenc xmm10, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm2, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm0, xmm1
movdqa xmm1, xmmword [rcx + 0x90]
aesenc xmm10, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm2, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm0, xmm1
movdqa xmm1, xmmword [rcx + 0xa0]
aesenclast xmm10, xmm1
aesenclast xmm3, xmm1
movdqa xmmword [rdx], xmm10
movdqa xmmword [rdx + 0x10], xmm3
aesenclast xmm4, xmm1
movdqa xmmword [rdx + 0x20], xmm4
aesenclast xmm5, xmm1
movdqa xmmword [rdx + 0x30], xmm5
aesenclast xmm2, xmm1
aesenclast xmm6, xmm1
movdqa xmmword [rdx + 0x40], xmm2
movdqa xmmword [rdx + 0x50], xmm6
aesenclast xmm7, xmm1
movdqa xmmword [rdx + 0x60], xmm7
aesenclast xmm0, xmm1
movdqa xmmword [rdx + 0x70], xmm0
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x140042980
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret

Function at 0x140048890
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 0
mov qword [rbp + 0x3d0], 2
mov qword [rbp + 0x3d8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor r12d, r12d
xor r13d, r13d
xor edi, edi
cmp r8, 0x201
jae 0x140048930
jmp 0x14004891f
jae 0x1400489ee
cmp r8, 0x201
jae 0x140048930
lea rbx, [rbp - 0x58]
mov r14d, 0x200
mov rsi, r8
jmp 0x140048987
sub r8, rdi
sub r13, rdi
cmp r13, r8
jae 0x14004895f
lea rcx, [rbp + 0x3c8]
mov rdx, rdi
call fcn.140062270
mov r12, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp r12, rax
mov edi, 0xffffffff
cmovb rdi, r12
mov qword [rbp + 0x3d8], rdi
mov r13, r12
mov rbx, qword [rbp + 0x3e8]
mov r14, rdi
mov rsi, rdi
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, esi
mov rdx, rbx
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r15d, eax
test eax, eax
jne 0x1400489af
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x140048a56
mov r8d, r15d
cmp rsi, r8
jne 0x140048910
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140048a79
add rsi, rsi
mov eax, 0xffffffff
cmp rsi, rax
cmovae rsi, rax
mov r8, rsi
cmp r8, 0x201
jb 0x14004891f
jmp 0x140048930
cmp r14, r8
jb 0x140048a93
lea rcx, [rbp + 0x3a8]
mov rdx, rbx
call fcn.14004bce0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test r12, r12
je 0x140048a3f
add r12, r12
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, r12
call fcn.140043660
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test r12, r12
jne 0x140048a27
jmp 0x140048a3f
lea rcx, [0x140064a83]
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.140062ed0
jmp 0x140048aa8
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.140063260
ud2