joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400176f0
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27b0]
mov eax, 0x28b0
call fcn.140026750
sub rsp, rax
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x28e8], rbx
mov qword [rsp + 0x28f0], rsi
mov rax, qword [0x14004f018]
xor rax, rsp
mov qword [rbp + 0x27a0], rax
mov rbx, rcx
xor r12d, r12d
mov esi, r12d
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x7a0]
call sub.VCRUNTIME140.dll_memset
mov eax, 0x22
mov word [rbp + 0x7a0], ax
test rbx, rbx
je 0x14001795f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jl 0x14001795f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0xffa
jge 0x14001795f
mov rdx, rbx
lea rcx, [rbp + 0x7a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x14003d0ac]
lea rcx, [rbp + 0x7a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x14003e548]
lea rcx, [rsp + 0x30]
call fcn.140002c74
nop
call fcn.1400161a0
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.140016270
mov rbx, rax
lea rcx, [rsp + 0x30]
call fcn.140002b70
test rbx, rbx
je 0x14001795f
lea rdx, str.ShellExecuteW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
je 0x14001795f
lea rcx, [rsp + 0x60]
call fcn.1400170f0
mov ebx, r12d
lea rdi, [rsp + 0x60]
nop dword [rax]
cmp word [rdi], 0
je 0x14001785e
movsxd r14, ebx
imul rax, r14, 0x210
lea r8, [rsp + 0x60]
add r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x7a0]
lea rdx, str.open
xor ecx, ecx
call r15
cmp rax, 0x20
ja 0x14001786e
inc ebx
add rdi, 0x210
cmp ebx, 3
jge 0x140017891
jmp 0x140017820
imul rax, r14, 0x210
mov esi, dword [rbp + rax + 0x16c]
cmp dword [rbp + rax + 0x168], 0
jne 0x140017889
add esi, 0x10
test esi, esi
jne 0x14001795b
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rbp + 0x7a0]
lea rdx, str.open
xor ecx, ecx
call r15
cmp rax, 0x20
ja 0x140017956
lea rax, str._programfiles_x86__Internet_Exploreriexplore.exe
mov qword [rsp + 0x30], rax
lea rax, str._programfiles_Internet_Exploreriexplore.exe
mov qword [rsp + 0x38], rax
mov rbx, r12
nop dword [rax]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x590]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x103
lea rdx, [rbp + 0x590]
mov rcx, qword [rsp + rbx*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [rbp + 0x590]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001794b
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x7a0]
lea r8, [rbp + 0x590]
lea rdx, str.open
xor ecx, ecx
call r15
cmp rax, 0x20
ja 0x140017956
inc rbx
cmp rbx, 2
jae 0x14001795b
jmp 0x1400178e0
mov esi, 0x10
mov eax, esi
jmp 0x140017961
xor eax, eax
mov rcx, qword [rbp + 0x27a0]
xor rcx, rsp
call fcn.140025ac0
lea r11, [rsp + 0x28b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14001c320
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x14004f018]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor eax, eax
mov dword [rsp + 0x20], 0x114
mov qword [rcx + 8], rax
mov rbx, rcx
mov qword [rcx + 0x10], rax
xor edx, edx
mov qword [rcx + 0x18], rax
mov r8d, pe_nt_image_headers64
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x48], rax
mov qword [rcx + 0x50], rax
mov byte [rcx], al
lea rcx, [rsp + 0x24]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov rax, rbx
je 0x14001c3a0
cmp dword [rsp + 0x24], 6
jb 0x14001c3a0
mov byte [rbx], 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140025ac0
add rsp, 0x150
pop rbx
ret

Function at 0x14001c3c0
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rsi, rcx
lea rdx, str.wintrust.dll
lea rcx, [rax - 0x50]
call fcn.140002c74
nop
call fcn.1400161a0
mov rcx, rax
lea rdx, [rsp + 0x28]
call fcn.140016270
mov rbx, rax
lea rcx, [rsp + 0x28]
call fcn.140002b70
lea rdx, str.crypt32.dll
lea rcx, [rsp + 0x48]
call fcn.140002c74
nop
call fcn.1400161a0
mov rcx, rax
lea rdx, [rsp + 0x48]
call fcn.140016270
mov rdi, rax
lea rcx, [rsp + 0x48]
call fcn.140002b70
test rbx, rbx
je 0x14001c516
test rdi, rdi
je 0x14001c516
lea rdx, str.CryptCATAdminCalcHashFromFileHandle
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 8], rax
lea rdx, str.CryptCATAdminAcquireContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x10], rax
lea rdx, str.CryptCATAdminEnumCatalogFromHash
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x18], rax
lea rdx, str.CryptCATCatalogInfoFromContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x20], rax
lea rdx, str.CryptCATAdminReleaseCatalogContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x28], rax
lea rdx, str.CryptCATAdminReleaseContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x30], rax
lea rdx, str.WTHelperProvDataFromStateData
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x38], rax
lea rdx, str.WTHelperGetProvSignerFromChain
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x40], rax
lea rdx, str.WinVerifyTrust
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x48], rax
lea rdx, str.CertNameToStrW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x50], rax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14001e130
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbx
movzx r10d, byte [rcx + 0x100]
mov r11, rdx
movzx ebx, byte [rcx + 0x101]
test r8d, r8d
je 0x14001e19d
mov qword [rsp + 0x10], rdi
mov edi, r8d
nop dword [rax]
nop word [rax + rax]
inc r10b
lea r11, [r11 + 1]
movzx r8d, r10b
movzx r9d, byte [r8 + rcx]
add bl, r9b
movzx edx, bl
movzx eax, byte [rdx + rcx]
mov byte [r8 + rcx], al
mov byte [rdx + rcx], r9b
add r9b, byte [r8 + rcx]
movzx eax, r9b
movzx edx, byte [rax + rcx]
xor byte [r11 - 1], dl
sub rdi, 1
jne 0x14001e160
mov rdi, qword [rsp + 0x10]
mov byte [rcx + 0x101], r10b
mov byte [rcx + 0x100], r10b
pop rbx
ret
Function at 0x1400217d0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov qword [rsp + 0xc0], rbx
mov rbx, rcx
lea rcx, [rbp + 0x77]
call fcn.140013bc0
nop
mov dword [rsp + 0x20], 2
mov r9d, 1
mov r8d, 0x40000000
mov rdx, rbx
lea rcx, [rbp + 0x77]
call fcn.140013e50
test al, al
je 0x140021951
xor esi, esi
mov qword [rbp - 0x21], rsi
mov qword [rbp - 0x19], rsi
mov qword [rbp - 0x11], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp - 9], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 7], xmm1
movdqa xmmword [rbp + 0x17], xmm0
movdqa xmmword [rbp + 0x27], xmm1
mov qword [rbp + 0x37], rsi
mov dword [rbp + 0x3f], 0xffffffff
lea rcx, [rbp - 9]
call fcn.140020e60
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 9]
call fcn.140009fe0
mov dword [rbp + 0x6f], esi
mov rdi, qword [rbp - 0x19]
sub rdi, qword [rbp - 0x21]
mov rbx, qword [rbp + 0x77]
test rbx, rbx
jne 0x140021887
xor dil, dil
jmp 0x1400218e1
cmp qword [rbp - 0x21], 0
jne 0x140021893
xor dil, dil
jmp 0x1400218c7
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
jne 0x1400218a1
xor dil, dil
jmp 0x1400218c7
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x6f]
mov r8d, edi
mov rdx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400218c0
xor dil, dil
jmp 0x1400218c7
cmp edi, dword [rbp + 0x6f]
sete dil
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x1400218e1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1400218e1
mov qword [rbx], 0xffffffffffffffff
mov rcx, qword [rbp - 0x19]
sub rcx, qword [rbp - 0x21]
mov eax, dword [rbp + 0x6f]
cmp rax, rcx
jne 0x1400218fa
test dil, dil
je 0x1400218fa
mov bl, 1
jmp 0x1400218fc
xor bl, bl
lea rcx, [rbp - 9]
call fcn.140023600
nop
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140021953
mov rdx, qword [rbp - 0x11]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002193e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002193e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140025dd4
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x11], rsi
jmp 0x140021953
xor bl, bl
lea rcx, [rbp + 0x77]
call fcn.140013e00
movzx eax, bl
mov rbx, qword [rsp + 0xc0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002ee80
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x250
mov rax, qword [0x14004f018]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor ebp, ebp
mov r15, rcx
mov qword [rcx], rbp
cmp qword [0x14004f770], rbp
jne 0x14002f055
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x20a
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rcx, [rsp + 0x30]
mov word [rsp + 0x236], bp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov rsi, qword [0x14004f778]
mov r14, rax
cmp rax, rsi
ja 0x14002ef46
cmp rsi, 8
mov qword [0x14004f770], rax
lea rbx, [rax + rax]
lea rdi, [0x14004f760]
mov r8, rbx
cmovae rdi, qword [0x14004f760]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_memmove]
mov word [rbx + rdi], bp
jmp 0x14002f055
movabs rbx, 0x7ffffffffffffffe
cmp r14, rbx
ja 0x14002f08c
mov rcx, r14
or rcx, 7
cmp rcx, rbx
ja 0x14002ef84
mov rdx, rsi
mov rax, rbx
shr rdx, 1
sub rax, rdx
cmp rsi, rax
ja 0x14002ef84
lea rax, [rdx + rsi]
mov rbx, rcx
cmp rcx, rax
cmovb rbx, rax
lea rax, [rbx + 1]
movabs rcx, 0x7fffffffffffffff
lea rdx, [rax + rax]
mov r8, 0xffffffffffffffff
cmp rax, rcx
jbe 0x14002efa7
mov rdx, r8
jmp 0x14002efb0
cmp rdx, 0x1000
jb 0x14002efd7
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, r8
call fcn.140025ae4
test rax, rax
je 0x14002f085
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14002efec
test rdx, rdx
je 0x14002efe9
mov rcx, rdx
call fcn.140025ae4
mov rdi, rax
jmp 0x14002efec
mov rdi, rbp
mov qword [0x14004f778], rbx
lea rdx, [rsp + 0x30]
lea rbx, [r14 + r14]
mov qword [0x14004f770], r14
mov r8, rbx
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_memcpy]
mov word [rbx + rdi], bp
cmp rsi, 8
jb 0x14002f04e
mov rcx, qword [0x14004f760]
lea rdx, [rsi*2 + 2]
cmp rdx, 0x1000
jb 0x14002f049
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002f085
mov rcx, r8
call fcn.140025dd4
mov qword [0x14004f760], rdi
mov rax, r15
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140025ac0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003280
int3
Function at 0x140032610
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
cmp qword [rsp + 0x48], 0
jne 0x14003262a
xor eax, eax
jmp 0x14003268d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
je 0x14003264b
mov eax, dword [rsp + 0x20]
and eax, 0x10
test eax, eax
je 0x14003264f
xor eax, eax
jmp 0x14003268d
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.1400325d0
movzx eax, al
test eax, eax
jne 0x140032678
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.140032040
xor eax, eax
jmp 0x14003268d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
add rsp, 0x38
ret

Function at 0x1400327b0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x14004f018]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edx, edx
mov dword [rsp + 0x20], 0x114
mov r8d, pe_nt_image_headers64
lea rcx, [rsp + 0x24]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x14003281e
mov eax, dword [rsp + 0x24]
cmp eax, 5
ja 0x140032804
jne 0x14003281e
cmp dword [rsp + 0x28], 0
jbe 0x14003281e
mov al, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140025ac0
add rsp, 0x158
ret
xor al, al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140025ac0
add rsp, 0x158
ret
Function at 0x1400124d0
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x210
mov r9d, edx
mov rsi, rcx
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x208], rax
lea r8, [0x140034fae]
lea rdi, [rsp + 0x130]
mov r15d, 0x80
mov edx, 0x80
mov rcx, rdi
call fcn.1400126b0
mov word [rsp + 0x30], 0
movzx ebp, byte [rsp + 0x130]
test bpl, bpl
je 0x1400125cf
lea r12, [rsp + 0x30]
xor eax, eax
lea rbx, [rsp + 0x1b0]
nop word cs:[rax + rax]
mov r14, r12
mov rcx, r15
test ax, ax
je 0x140012581
mov rcx, r15
mov rax, r12
nop word cs:[rax + rax]
lea r14, [rax + 2]
dec rcx
cmp word [rax + 2], 0
mov rax, r14
jne 0x140012570
test rcx, rcx
je 0x1400126aa
mov rcx, r14
call fcn.14001b268
lea rcx, [r14 + rax*2]
mov byte [rsp + 0x1b0], bpl
mov byte [rsp + 0x1b1], 0
mov r8d, 2
mov rdx, rbx
call fcn.14001a92c
movzx ebp, byte [rdi + 1]
test bpl, bpl
je 0x1400125cf
inc rdi
dec r15
movzx eax, word [r12 + 2]
add r12, 2
jmp 0x140012550
mov word [rsp + 0x1b0], 0
movzx ebp, byte [rsi]
test bpl, bpl
je 0x140012674
mov r14d, 0x28
lea r15, [rsp + 0x1b0]
xor eax, eax
lea rdi, [rsp + 0x2e]
nop word [rax + rax]
mov rbx, r15
mov rcx, r14
test ax, ax
je 0x140012631
mov rcx, r14
mov rax, r15
nop word cs:[rax + rax]
lea rbx, [rax + 2]
dec rcx
cmp word [rax + 2], 0
mov rax, rbx
jne 0x140012620
test rcx, rcx
je 0x1400126aa
mov rcx, rbx
call fcn.14001b268
lea rcx, [rbx + rax*2]
mov byte [rsp + 0x2e], bpl
mov byte [rsp + 0x2f], 0
mov r8d, 2
mov rdx, rdi
call fcn.14001a92c
movzx ebp, byte [rsi + 1]
test bpl, bpl
je 0x140012674
inc rsi
dec r14
movzx eax, word [r15 + 2]
add r15, 2
jmp 0x140012600
lea rcx, [rsp + 0x1b0]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x208]
xor rcx, rsp
call fcn.140014450
nop
add rsp, 0x210
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.14001a8b0
int3
Function at 0x140012e40
Capabilities:
Check if file exists
Get file attributes
Terminate process

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x90
movaps xmmword [rsp + 0x80], xmm8
movaps xmmword [rsp + 0x70], xmm7
movaps xmmword [rsp + 0x60], xmm6
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rcx, qword [0x14003eaf8]
test rcx, rcx
je 0x140012eaa
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140012e9d
mov rcx, qword [0x14003eaf8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14003eaf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x140041340], 1
jne 0x140012f57
mov rbx, qword [0x14002f060]
mov qword [rsp + 0x50], rbx
movups xmm6, xmmword [0x14002f050]
movaps xmmword [rsp + 0x40], xmm6
movups xmm7, xmmword [0x14002f040]
movaps xmmword [rsp + 0x30], xmm7
movups xmm8, xmmword [0x14002f030]
movaps xmmword [rsp + 0x20], xmm8
lea rsi, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebp, 0x14
lea rdi, [0x14003eb10]
mov r14, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r15, qword [sym.imp.KERNEL32.dll_Sleep]
mov r12, qword [sym.imp.SHELL32.dll_SHFileOperationW]
nop dword [rax + rax]
mov rcx, rdi
call r14
cmp eax, 0xffffffff
je 0x140012f57
and eax, 0x10
je 0x140012f57
mov ecx, 0x64
call r15
mov qword [rsp + 0x50], rbx
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm8
mov rcx, rsi
call r12
dec ebp
jne 0x140012f20
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140014450
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x70]
movaps xmm8, xmmword [rsp + 0x80]
add rsp, 0x90
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140014290
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
mov eax, 0x2030
call fcn.1400143f0
sub rsp, rax
mov rsi, rcx
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2028], rax
mov eax, dword [0x14003eb00]
test eax, eax
je 0x1400142c5
test eax, eax
jg 0x14001430d
jmp 0x140014342
lea rdx, [0x140035126]
lea rcx, [rsp + 0x20]
mov r8d, 0x1000
call fcn.140012740
test al, al
je 0x1400143ca
lea rcx, [rsp + 0x20]
call fcn.14001a5d4
movsxd rcx, dword [0x14003eb00]
lea rdx, [0x140043b80]
mov qword [rdx + rcx*8], rax
lea eax, [rcx + 1]
mov dword [0x14003eb00], eax
test eax, eax
jle 0x140014342
lea rdi, [0x140043b80]
xor ebx, ebx
nop word cs:[rax + rax]
mov rdx, qword [rdi]
mov rcx, rsi
call fcn.14001b230
test eax, eax
je 0x1400143ab
inc rbx
movsxd rax, dword [0x14003eb00]
add rdi, 8
cmp rbx, rax
jl 0x140014320
mov rcx, rsi
call fcn.14001b268
cmp rax, 2
jne 0x140014359
mov bl, 1
cmp word [rsi + 2], 0x3a
je 0x1400143ad
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x140014378
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete bl
test bl, bl
je 0x1400143ad
cmp dword [0x14003eb00], 0x3ff
jg 0x1400143ad
mov rcx, rsi
call fcn.14001a5d4
movsxd rcx, dword [0x14003eb00]
lea rdx, [0x140043b80]
mov qword [rdx + rcx*8], rax
lea eax, [rcx + 1]
mov dword [0x14003eb00], eax
mov bl, 1
mov rcx, qword [rsp + 0x2028]
xor rcx, rsp
call fcn.140014450
mov eax, ebx
add rsp, 0x2030
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140035126]
call fcn.1400137e0
int3

Function at 0x140014bc0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140014c0a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140014c0a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140014c0a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140014c0a
cmp dword [rcx + 0x84], 0xe
jbe 0x140014c0a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140014c0c
xor al, al
add rsp, 0x28
ret
Function at 0x1400193a0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400194e8
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140019557
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140019557
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140019557
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140019557
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140019557
cmp dword [rcx + 0x84], 0xe
jbe 0x140019557
cmp dword [rcx + 0xf8], 0
je 0x140019557
mov ecx, ebx
call fcn.140019420
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14001967c
nop
cmp dword [rbp + 0x20], 0
je 0x1400195a5
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400194b4
int3

Function at 0x1400194e8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400194e8
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140019557
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140019557
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140019557
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140019557
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140019557
cmp dword [rcx + 0x84], 0xe
jbe 0x140019557
cmp dword [rcx + 0xf8], 0
je 0x140019557
mov ecx, ebx
call fcn.140019420
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14001967c
nop
cmp dword [rbp + 0x20], 0
je 0x1400195a5
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400194b4
int3

Function at 0x14001b6f0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001b718
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001b718
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140020f9c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140021023
mov rsi, rbx
cmp word [rax], bp
je 0x140020fe2
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140020fcc
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140020fc8
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14001e4c4
mov rdi, rax
test rax, rax
je 0x140021010
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14002a200
mov rbp, rdi
xor ecx, ecx
call fcn.14001d574
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140025e90
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140025ea6
mov al, 1
jmp 0x140025f06
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140025eb7
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140025f04
mov ecx, dword [rcx + 0x18]
nop
call fcn.140021494
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140025f04
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140025f04
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140025f04
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140025f06
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x180013ea0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
mov qword [rsp + 8], 0
jmp 0x180013ecf
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 8
jae 0x180013f13
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp]
xor rcx, rax
mov rax, rcx
mov qword [rsp], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp]
imul rcx, rax
mov rax, rcx
mov qword [rsp], rax
jmp 0x180013ec2
mov rax, qword [rsp]
add rsp, 0x18
ret