joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409c10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and al, 0x30
add al, 0
add bh, al
and al, 0x70
add byte [rax], al
add byte [rax], al

Function at 0x409c90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add bh, al
test byte [rax + riz*4], ah
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rbx + 0xa02484], cl
add byte [rax], al

Function at 0x409cc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov al, byte [rax + rcx]
mov byte [rsp + 0x5c], al
mov eax, dword [rsp + 0x23c]
mov ecx, dword [rsp + 0x108]
mov dword [rsp + 0x274], eax
mov dword [rsp + 0x270], ecx
mov dword [rsp + 0x134], 0
mov dword [rsp + 0x130], 0

Function at 0x409d10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [rsp + 0x130]
cmp eax, dword [rsp + 0x274]
jae 0x409d31
mov eax, dword [rsp + 0x270]
add eax, dword [rsp + 0x134]
mov dword [rsp + 0x134], eax
mov eax, dword [rsp + 0x130]
add eax, 1
mov dword [rsp + 0x130], eax
jmp 0x409cf9
mov eax, dword [rsp + 0x134]
movzx ecx, byte [rsp + 0x5c]
add eax, ecx
mov dword [rsp + 0x108], eax
test byte [rax + rcx], ah
add dword [rax], eax
add byte [rbx + 0xa02484], cl
add byte [rax], al
add eax, 1
mov dword [rsp + 0xa0], eax
jmp 0x409c9c

Function at 0x409da0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add eax, 1
mov dword [rsp + 0x70], eax
jmp 0x409c1d
Function at 0x409f90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or byte [rax - 0x74a2dbbc], cl
test byte [rsp + rax*2], ah
add al, byte [rax]
add byte [rbx + 0x10c248c], cl
add byte [rax], al
Function at 0x40a1a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [rax], 0
add byte [rax - 0x7d], cl
rol byte [rax + rcx*2], 0x89
test byte [rax + rax*4], ah
add byte [rax], al
add bl, ch
mov dh, 0x48
mov eax, dword [rsp + 0x38]
Function at 0x40b390
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
lea rcx, [0x0044be60]
call sub.kernel32.dll_InitializeCriticalSection
mov word [0x0044be88], 0x7f
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp eax, 6
setae al
mov byte [0x0044be58], al
cmp byte [0x0044be58], 0
je 0x40b42f
lea rcx, [0x0040b434]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x0040b44e]
call sub.kernel32.dll_GetProcAddress
mov qword [0x0044be40], rax
lea rcx, [0x0040b434]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x0040b46c]
call sub.kernel32.dll_GetProcAddress
mov qword [0x0044be48], rax
lea rcx, [0x0040b434]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x0040b48a]
call sub.kernel32.dll_GetProcAddress
mov qword [0x0044be50], rax
add rsp, 0x28
ret

Function at 0x40b710
Capabilities:
Get geographical location

Disassembly:
push rbp
sub rsp, 0x1d0
mov rbp, rsp
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x40], rdx
mov word [rbp + 0x4e], r8w
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x58], 0
nop
mov rcx, qword [rbp + 0x40]
call fcn.00408cb0
movzx rax, word [rbp + 0x4e]
cmp word [0x00440a60], ax
ja 0x40b7f8
movzx rax, word [rbp + 0x4e]
cmp ax, word [0x00440e60]
mov word [rbp + 0x4e], ax
ja 0x40b7f8
mov ecx, 0x40
xor r8, r8
cmp ecx, r8d
jb 0x40b7f7
mov eax, ecx
add eax, r8d
mov r9d, 2
xor edx, edx
div r9d
lea rdx, [0x00440a60]
mov r9d, eax
add r9, r9
movzx r10, word [rbp + 0x4e]
cmp word [rdx + r9*8], r10w
jbe 0x40b7b1
mov ecx, eax
sub ecx, 1
jmp 0x40b7f2
lea rdx, [0x00440a60]
mov r8d, eax
add r8, r8
movzx r9, word [rbp + 0x4e]
cmp word [rdx + r8*8], r9w
jae 0x40b7d3
mov r8d, eax
add r8d, 1
jmp 0x40b7f2
mov rcx, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x40]
lea r8, [0x00440a68]
mov eax, eax
add rax, rax
mov r8, qword [r8 + rax*8]
call fcn.0040b5a0
jmp 0x40b7f7
cmp ecx, r8d
jae 0x40b780
nop
mov rax, qword [rbp + 0x40]
cmp qword [rax], 0
jne 0x40b8da
movzx rcx, word [rbp + 0x4e]
movzx ecx, cx
mov edx, 2
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40b8da
movzx rcx, word [rbp + 0x4e]
movzx ecx, cx
mov edx, 0x59
lea r8, [rbp + 0x126]
mov r9d, 0x55
call sub.kernel32.dll_GetLocaleInfoW
movzx rcx, word [rbp + 0x4e]
movzx ecx, cx
mov edx, 0x5a
lea r8, [rbp + 0x7c]
mov r9d, 0x55
call sub.kernel32.dll_GetLocaleInfoW
lea rcx, [rbp + 0x68]
lea rdx, [rbp + 0x126]
mov r8d, 0x55
call fcn.00409cc0
lea rcx, [rbp + 0x60]
lea rdx, [rbp + 0x7c]
mov r8d, 0x55
call fcn.00409cc0
lea rcx, [rbp + 0x58]
lea rdx, [rbp + 0x126]
mov r8d, 0x55
call fcn.00409cc0
mov rcx, qword [rbp + 0x40]
mov edx, 5
mov r8, qword [rbp + 0x68]
lea r9, [0x0040b934]
mov rax, qword [rbp + 0x60]
mov qword [rsp + 0x20], rax
lea rax, [0x0040b944]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.0040a0b0
nop
lea rcx, [rbp + 0x58]
mov edx, 3
call fcn.00408d90
mov rax, qword [rbp + 0x40]
lea rsp, [rbp + 0x1d0]
pop rbp
ret
Function at 0x42ba40
Capabilities:
Encode data using xor

Disassembly:
push rbx
test r8d, r8d
jle 0x42baaa
xor rax, rax
movsxd r9, eax
mov r9d, dword [rdx + r9*4]
movsxd r10, eax
mov r10d, dword [rcx + r10*4]
add r10d, r10d
mov r11d, r9d
and r11d, 1
add r10d, r11d
mov r11d, r10d
sub r11d, r9d
movsxd rbx, eax
shr r11d, 1
xor r11d, 0x40000000
sub r11d, 0x40000000
mov dword [rcx + rbx*4], r11d
mov r11d, r10d
add r11d, r9d
movsxd r9, eax
shr r11d, 1
xor r11d, 0x40000000
sub r11d, 0x40000000
mov dword [rdx + r9*4], r11d
add eax, 1
cmp eax, r8d
jl 0x42ba49
pop rbx
ret

Function at 0x42bb10
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov rax, rcx
cmp dword [rsp + 0x30], 0
jne 0x42bb20
xor r10, r10
jmp 0x42bb34
mov r10d, 1
mov ecx, 0x1f
sub ecx, dword [rsp + 0x30]
shl r10d, cl
xor rcx, rcx
mov r11d, r8d
sub r11d, 1
mov r8d, ecx
cmp r8d, r11d
jg 0x42bb94
add r11d, 1
mov ebx, dword [rax]
movzx rcx, byte [rsp + 0x30]
shr ebx, cl
xor ebx, r10d
sub ebx, r10d
mov ecx, ebx
imul ecx, r9d
add ecx, 0x80
shr ecx, 8
xor ecx, 0x800000
sub ecx, 0x800000
mov ebx, ecx
movzx rcx, byte [rsp + 0x30]
shl ebx, cl
sub ebx, dword [rdx]
mov dword [rdx], ebx
add rdx, 4
add rax, 4
add r8d, 1
cmp r8d, r11d
jne 0x42bb4a
nop
pop rbx
ret

Function at 0x435430
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rax, rcx
test r9d, r9d
jne 0x435451
mov rcx, rax
add r8d, r8d
add r8d, r8d
movsxd r8, r8d
call fcn.004052e0
jmp 0x43549c
xor rcx, rcx
mov r11d, r8d
sub r11d, 1
mov r8d, ecx
cmp r8d, r11d
jg 0x43549b
add r11d, 1
movsxd rcx, r8d
mov r10d, dword [rax + rcx*4]
shr r10d, 0x1f
neg r10d
movsxd rbx, r8d
movsxd rcx, r8d
mov esi, dword [rax + rcx*4]
add esi, r10d
xor esi, r10d
mov ecx, r9d
shr esi, cl
xor esi, r10d
sub esi, r10d
mov dword [rdx + rbx*4], esi
add r8d, 1
cmp r8d, r11d
jne 0x435467
nop
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x435cd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x40
mov ebx, ecx
mov dword [rsp + 0x2c], edx
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x30], r9
mov eax, 1
mov ecx, dword [rsp + 0x2c]
sub ecx, 1
shl eax, cl
mov dword [rsp + 0x3c], eax
movzx rsi, bl
mov eax, esi
sub eax, 1
cmp eax, 2
jbe 0x435d11
call fcn.00405ba0
lea rax, [0x00445410]
movzx rsi, sil
lea rsi, [rsi + rsi*2]
mov esi, dword [rax + rsi*4]
movzx rbx, bl
mov eax, ebx
sub eax, 1
cmp eax, 2
jbe 0x435d36
call fcn.00405ba0
lea rax, [0x00445414]
movzx rbx, bl
lea rbx, [rbx + rbx*2]
mov ebx, dword [rax + rbx*4]
mov edi, 1
mov r14d, dword [rsp + 0x90]
cmp edi, r14d
jg 0x435e33
add r14d, 1
mov rcx, qword [rsp + 0x20]
mov edx, esi
call fcn.00425530
mov r13d, eax
test r13d, r13d
je 0x435d9d
cmp r13d, ebx
jg 0x435d8d
sub r13d, 1
mov rax, qword [rsp + 0x30]
mov dword [rax], r13d
jmp 0x435e19
sub r13d, ebx
neg r13d
mov rax, qword [rsp + 0x30]
mov dword [rax], r13d
jmp 0x435e19
mov rcx, qword [rsp + 0x20]
mov edx, 4
call fcn.004256a0
mov r13d, eax
cmp r13d, 4
jge 0x435dd7
mov rcx, qword [rsp + 0x20]
call fcn.00425630
add r13d, ebx
mov ecx, eax
neg ecx
xor r13d, ecx
add r13d, eax
mov rax, qword [rsp + 0x30]
mov dword [rax], r13d
jmp 0x435e19
mov rcx, qword [rsp + 0x20]
mov edx, dword [rsp + 0x2c]
call fcn.00425530
mov r13d, eax
mov eax, dword [rsp + 0x3c]
cmp r13d, eax
jge 0x435e02
mov eax, ebx
add eax, r13d
add eax, 4
mov rcx, qword [rsp + 0x30]
mov dword [rcx], eax
jmp 0x435e19
mov eax, ebx
add eax, r13d
mov ecx, dword [rsp + 0x3c]
sub eax, ecx
add eax, 4
neg eax
mov rcx, qword [rsp + 0x30]
mov dword [rcx], eax
mov rax, qword [rsp + 0x30]
add rax, 4
mov qword [rsp + 0x30], rax
add edi, 1
cmp edi, r14d
jne 0x435d63
nop
mov rax, qword [rsp + 0x20]
cmp byte [rax + 0x40], 0
sete al
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r13
pop r14
ret
Function at 0x140efd058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140efd1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140efd089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140efd06f
add dl, dl
jne 0x140efd096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140efd0f6
xor eax, eax
add dl, dl
jne 0x140efd0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140efd1ad
add dl, dl
jne 0x140efd0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140efd0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140efd0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140efd0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140efd0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140efd07e
mov eax, 1
add dl, dl
jne 0x140efd106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140efd113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140efd0fb
sub eax, ebx
mov ebx, 1
jne 0x140efd14c
mov ecx, 1
add dl, dl
jne 0x140efd12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140efd13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140efd123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140efd07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140efd168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140efd175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140efd15d
cmp eax, 0x7d00
jae 0x140efd19b
cmp eax, 0x500
jb 0x140efd196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140efd07e
cmp eax, 0x7f
ja 0x140efd19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140efd07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140efd1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140efd07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001360
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x290
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov r14, rcx
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1400013d0
lea rdx, str.Failed_to_take_a_snapshot_of_the_processes.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002000
mov rcx, rax
lea rdx, [0x1400021e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000154d
mov dword [rsp + 0x40], 0x238
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001544
nop
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call fcn.140001e50
nop
lea rdi, [rsp + 0x20]
mov r9, qword [rsp + 0x20]
mov r10, qword [rsp + 0x38]
cmp r10, 7
cmova rdi, r9
lea rax, [rsp + 0x20]
cmova rax, r9
mov rdx, qword [rsp + 0x30]
lea rsi, [rax + rdx*2]
lea rbx, [rsp + 0x20]
cmova rbx, r9
cmp rbx, rsi
je 0x140001465
sub rdi, rbx
nop word [rax + rax]
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
mov word [rdi + rbx], ax
add rbx, 2
cmp rbx, rsi
jne 0x140001440
mov r10, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov r9, qword [rsp + 0x20]
mov rcx, r14
cmp qword [r14 + 0x18], 7
jbe 0x140001472
mov rcx, qword [r14]
lea r8, [rsp + 0x20]
cmp r10, 7
cmova r8, r9
cmp rdx, qword [r14 + 0x10]
jne 0x1400014f7
test rdx, rdx
je 0x1400014a4
sub r8, rcx
nop dword [rax]
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x1400014f7
add rcx, 2
sub rdx, 1
jne 0x140001490
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x1400014f3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov r8, rcx
cmp rdx, 0x1000
jb 0x1400014ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub r8, rcx
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x14000157d
call fcn.140002e4c
mov eax, ebx
jmp 0x14000154f
cmp r10, 7
jbe 0x14000152e
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x140001526
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000157d
mov rcx, r9
call fcn.140002e4c
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400013f0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140002df0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140003770
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400037ba
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400037ba
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400037ba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400037ba
cmp dword [rcx + 0x84], 0xe
jbe 0x1400037ba
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400037bc
xor al, al
add rsp, 0x28
ret
Function at 0x14073a058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14073a1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14073a089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14073a06f
add dl, dl
jne 0x14073a096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14073a0f6
xor eax, eax
add dl, dl
jne 0x14073a0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14073a1ad
add dl, dl
jne 0x14073a0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14073a0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14073a0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14073a0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14073a0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14073a07e
mov eax, 1
add dl, dl
jne 0x14073a106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14073a113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14073a0fb
sub eax, ebx
mov ebx, 1
jne 0x14073a14c
mov ecx, 1
add dl, dl
jne 0x14073a12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14073a13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14073a123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14073a07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14073a168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14073a175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14073a15d
cmp eax, 0x7d00
jae 0x14073a19b
cmp eax, 0x500
jb 0x14073a196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14073a07e
cmp eax, 0x7f
ja 0x14073a19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14073a07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14073a1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14073a07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140026fc4
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001adb8
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001adb8
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140027114
cmp rax, 0xffffffffffffffff
je 0x140027114
xor edi, edi
test rbp, rbp
jle 0x1400270bf
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001d3d0
mov rbx, rax
test rax, rax
jne 0x14002704c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400270b5
mov edx, 0x8000
mov ecx, r14d
call fcn.140014fc0
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001baac
cmp eax, 0xffffffff
je 0x140027095
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14002705c
mov edx, r15d
mov ecx, r14d
call fcn.140014fc0
jmp 0x1400270b5
cmp byte [rsi + 0x38], dil
je 0x1400270ac
cmp dword [rsi + 0x34], 5
jne 0x1400270ac
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1400270b5
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140019468
jmp 0x140027128
jns 0x140027128
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001adb8
cmp rax, 0xffffffffffffffff
jne 0x1400270e0
cmp byte [rsi + 0x30], dil
je 0x140027128
mov edi, dword [rsi + 0x2c]
jmp 0x140027128
mov ecx, r14d
call fcn.140016534
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140027128
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140027128
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140027121
mov eax, dword [rsi + 0x2c]
jmp 0x140027126
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001adb8
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1400043c0
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x28], 0
lea rcx, [0x1400e4374]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.shell32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x140004404
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x140004423
call sub.kernel32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.140039c70
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x30
pop rsi
ret

Function at 0x140004430
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x28], 0
lea rcx, [0x1400e4384]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.shell32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x140004474
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x140004493
call sub.kernel32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.140039c70
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x30
pop rsi
ret

Function at 0x1400044a0
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x28], 0
lea rcx, [0x1400e4394]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.shell32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x1400044e4
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x140004503
call sub.kernel32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.140039c70
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x30
pop rsi
ret

Function at 0x140004510
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x28], 0
lea rcx, [0x1400e43a4]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.shell32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x140004554
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x140004573
call sub.kernel32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.140039c70
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x30
pop rsi
ret

Function at 0x140004580
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x28], 0
lea rcx, [0x1400e43b4]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.shell32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x1400045c4
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x1400045e3
call sub.kernel32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.140039c70
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x30
pop rsi
ret