joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400563b0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x1400bba20]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor ebx, ebx
xor eax, eax
lock cmpxchg dword [0x1400bfa60], ebx
mov ecx, eax
jne 0x140056412
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140056405
lea rdx, str.RemoveDllDirectory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [rbx + 2]
test rax, rax
jne 0x14005640a
mov ecx, 1
mov eax, ecx
xchg dword [0x1400bfa60], eax
cmp ecx, 1
jne 0x1400565a9
mov qword [rsp + 0x260], rbp
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x268], rsi
xor edx, edx
mov qword [rsp + 0x270], rdi
mov r8d, 0x208
mov qword [rsp + 0x248], r14
mov qword [rsp + 0x240], r15
call main
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1400565a5
cmp word [rsp + 0x20], bx
je 0x1400565a5
mov ebp, ebx
lea rax, [rsp + 0x20]
mov rsi, rbx
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], bx
jne 0x140056490
mov r15d, 0x5c
test rdi, rdi
je 0x1400564c3
movzx eax, word [rsp + rdi*2 + 0x1e]
mov rbx, rdi
cmp r15w, ax
je 0x1400564c3
mov ecx, 0x2f
cmp cx, ax
je 0x1400564c3
lea ebp, [rcx - 0x2e]
lea rbx, [rdi + 1]
add rbx, 0xb
je 0x1400565a5
lea rbx, [rbx*2 + 2]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
je 0x1400565a5
test rdi, rdi
je 0x140056511
lea r8, [rdi + rdi]
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.14007dfd0
mov rsi, rdi
test ebp, ebp
je 0x14005651d
mov word [r14 + rsi*2], r15w
inc rsi
movups xmm0, xmmword [str.version.dll]
mov rcx, r14
movups xmmword [r14 + rsi*2], xmm0
mov eax, dword [0x1400ab6f0]
mov dword [r14 + rsi*2 + 0x10], eax
movzx eax, word [0x1400ab6f4]
mov word [r14 + rsi*2 + 0x14], ax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, rbx
mov r14, qword [rsp + 0x248]
mov rdi, qword [rsp + 0x270]
mov rsi, qword [rsp + 0x268]
mov rbp, qword [rsp + 0x260]
mov r15, qword [rsp + 0x240]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400793d0
add rsp, 0x250
pop rbx
ret
xor eax, eax
jmp 0x140056564
xor edx, edx
lea rcx, str.version.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x14005658c

Function at 0x140056760
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov qword [rcx + 8], 0
lea rax, vtable.zoom_windows_util::AutoLockFile.0
mov qword [rcx], rax
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
je 0x1400567c7
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400567c7
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov rcx, rdi
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400568a0
Capabilities:
Check if file exists
Create directory
Delete file
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x1400bba20]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, r8
mov rdi, rdx
test rdx, rdx
je 0x140056a37
test rbx, rbx
je 0x140056a37
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x105
call main
mov r8, rdi
lea rcx, [rsp + 0x60]
mov edx, 0x104
call fcn.14005f4d0
mov r8, rbx
lea rcx, [rsp + 0x60]
mov edx, 0x104
call fcn.14005f4d0
xor edx, edx
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x14005693a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140056a37
lea rcx, str._ProductPathHelper::RecursiveRemoveDirA__Path_is:
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [0x1400ab9c0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor edx, edx
lea rcx, [rsp + 0x170]
mov r8d, 0x105
call main
lea r8, [rsp + 0x60]
mov edx, 0x104
lea rcx, [rsp + 0x170]
call fcn.14005f398
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.14005e6d4
cmp rax, 0x104
jae 0x140056a37
mov byte [rsp + rax + 0x170], 0
inc rax
cmp rax, 0x105
jae 0x140056a5a
mov byte [rsp + rax + 0x170], 0
lea rcx, [rsp + 0x20]
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x170]
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x30], rax
mov eax, 0x414
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x28], 3
movups xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x40], ax
call qword [sym.imp.SHELL32.dll_SHFileOperationA]
cmp dword [rsp + 0x44], 0
mov ebx, eax
jne 0x140056a37
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x140056a37
test ebx, 0xfffffbfd
jne 0x140056a37
cmp ebx, 0x400
je 0x140056a37
mov eax, 1
jmp 0x140056a39
xor eax, eax
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400793d0
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x290
pop rdi
ret
call fcn.1400797c4
int3
Function at 0x1400578c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x430
mov rax, qword [0x1400bba20]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x140057952
test rdx, rdx
je 0x140057952
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x400
call main
mov r8, rdi
lea rcx, [rsp + 0x20]
mov edx, 0x3ff
call fcn.14005f398
lea r8, [0x14009cf34]
mov edx, 0x3ff
lea rcx, [rsp + 0x20]
call fcn.14005f4d0
mov r8, rbx
lea rcx, [rsp + 0x20]
mov edx, 0x3ff
call fcn.14005f4d0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140057952
mov eax, 1
jmp 0x140057954
xor eax, eax
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.1400793d0
mov rbx, qword [rsp + 0x450]
add rsp, 0x430
pop rdi
ret
Function at 0x1400582a0
Capabilities:
Check if file exists
Delete file
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1400bba20]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbx, rcx
test rcx, rcx
je 0x1400583b4
lea rcx, str._CZoomProductPathHelper::RecursiveRemoveDirA__Path_is:
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x20a
call main
mov r8, rbx
lea rcx, [rsp + 0x60]
mov edx, 0x104
call fcn.140063bf0
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x140058311
add rax, rax
cmp rax, 0x20a
jae 0x1400583db
xor edi, edi
mov word [rsp + rax + 0x60], di
add rax, 2
cmp rax, 0x20a
jae 0x1400583db
mov word [rsp + rax + 0x60], di
lea rcx, [rsp + 0x20]
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x60]
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x30], rax
mov eax, 0x414
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x28], 3
movups xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x40], ax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov esi, eax
cmp dword [rsp + 0x44], edi
jne 0x1400583b4
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400583b4
test esi, 0xfffffbfd
jne 0x1400583b0
cmp esi, 0x400
je 0x1400583b0
mov edi, 1
mov eax, edi
jmp 0x1400583b6
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400793d0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.1400797c4
int3

Function at 0x140058d90
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x1400bba20]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
je 0x140058e30
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140058e30
xor edx, edx
mov dword [rsp + 0x20], 0x238
mov r8d, 0x234
lea rcx, [rsp + 0x24]
call main
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140058e20
nop
mov rdx, rsi
lea rcx, [rsp + 0x20]
call rdi
test eax, eax
jne 0x140058e20
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140058e00
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x140058e32
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400793d0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140058e60
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x2b0
mov rax, qword [0x1400bba20]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
xor edi, edi
mov r14, rcx
xor edx, edx
mov esi, edi
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140059036
xor edx, edx
mov dword [rsp + 0x60], 0x238
mov r8d, 0x234
lea rcx, [rsp + 0x64]
call main
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140058ef9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x68], eax
je 0x140058ef2
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140058ed2
jmp 0x140058ef9
mov esi, dword [rsp + 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x140059036
mov r8d, esi
mov qword [rsp + 0x38], rdi
xor edx, edx
mov qword [rsp + 0x30], rdi
mov ecx, 0x400
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov ebp, edi
mov qword [rsp + 0x40], rdi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x140058f59
mov r8d, esi
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140059036
lea rax, [rsp + 0x40]
mov rcx, rbx
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x140058fd9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r9, [rsp + 0x48]
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x140058fd4
mov eax, dword [rsp + 0x30]
mov edx, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x3c]
shl rdx, 0x20
or rdx, rax
shl rcx, 0x20
mov eax, dword [rsp + 0x38]
or rcx, rax
mov eax, 1
cmp rcx, rdx
cmovb ebp, eax
test rbx, rbx
je 0x140058fe2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x140059036
cmp qword [0x1400bfa68], rdi
jne 0x140059028
lea rcx, [0x14009ff28]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140059036
lea rdx, str.ProcessIdToSessionId
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400bfa68], rax
setne dil
test edi, edi
je 0x140059036
test rax, rax
je 0x140059036
call fcn.140058d40
mov rdx, r14
mov ecx, esi
call rax
jmp 0x140059038
xor eax, eax
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400793d0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400591a0
Capabilities:
Get common file path
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x590]
sub rsp, 0x690
mov rax, qword [0x1400bba20]
xor rax, rsp
mov qword [rbp + 0x580], rax
xor edi, edi
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], edi
call fcn.140058e60
test eax, eax
je 0x14005936a
xor edx, edx
lea rcx, [rsp + 0x54]
mov r8d, 0x418
call main
mov eax, dword [rsp + 0x40]
lea rcx, [rbp + 0x370]
mov edx, 0x104
mov dword [rsp + 0x50], eax
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp eax, 2
jb 0x14005936a
cmp word [rbp + 0x372], 0x3a
jne 0x14005936a
mov ecx, eax
lea rax, [rcx + 0xd]
cmp rax, 0x105
jae 0x14005936a
add rcx, rcx
cmp rcx, 0x20a
jae 0x140059390
mov word [rbp + rcx + 0x370], di
lea rdx, [0x1400ab9d0]
lea rcx, [rbp + 0x370]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rax, [rbp + 0x370]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], di
jne 0x140059272
mov r8d, 0x208
mov word [rbp + 0x374], di
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x370]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov eax, eax
test rax, rax
je 0x14005936a
add rax, 0xfffffffffffffffe
add rax, rbx
cmp rax, 0x209
jae 0x14005936a
lea rdx, [rbp + 0x376]
lea rcx, [rsp + 0x58]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rsp + 0x50]
lea rcx, [0x140059060]
call fcn.140058d90
mov r8d, dword [rsp + 0x54]
test r8d, r8d
je 0x14005936a
xor edx, edx
mov qword [rsp + 0x30], rdi
mov ecx, 0x400
mov qword [rsp + 0x38], rdi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140059353
lea r8, [rsp + 0x30]
mov edx, 2
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14005934a
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov r9d, 2
xor r8d, r8d
mov dword [rsp + 0x20], 1
mov edx, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140059363
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x38]
jmp 0x14005936c
xor eax, eax
mov rcx, qword [rbp + 0x580]
xor rcx, rsp
call fcn.1400793d0
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.1400797c4
int3

Function at 0x1400714c0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400712ec
Function at 0x14007bfa0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x1400bba20]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov edi, 0xffff
xor r14d, r14d
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x14007bfe4
movzx eax, r14w
jmp 0x14007c11a
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x14007c020
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x14007c020
lea ecx, [r9 - 1]
mov dword [rax], ecx
movzx eax, si
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x14007c11a
cmp qword [rcx + 0x80], r14
je 0x14007c117
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14007c05e
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14007c087
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.14006b624
cmp ax, di
je 0x14007c117
movzx edi, si
jmp 0x14007c117
lea r8, [rbp + 0xf]
mov word [rbp + 7], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp + 9]
lea r8, [rbp + 0x3f]
mov qword [rsp + 0x30], r8
lea r8, [rbp + 0x1f]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0x17]
mov qword [rsp + 0x20], r8
lea r8, [rbp + 7]
call qword [case.0x14002b591.0]
test eax, eax
je 0x14007c0dc
sub eax, 1
je 0x14007c0dc
cmp eax, 2
jne 0x14007c117
movzx ecx, word [rbp + 7]
jmp 0x14007c06a
mov r14, qword [rbp + 0xf]
lea rax, [rbp + 0x1f]
sub r14, rax
je 0x14007c106
mov r9, qword [rbx + 0x80]
lea rcx, [rbp + 0x1f]
mov r8, r14
mov edx, 1
call fcn.14005fde0
cmp r14, rax
jne 0x14007c117
lea rax, [rbp + 7]
mov byte [rbx + 0x72], 1
cmp qword [rbp + 0x17], rax
movzx eax, si
jne 0x14007c11a
movzx eax, di
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1400793d0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140086580
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x1400bba20]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor esi, esi
mov rbx, rdx
test rdx, rdx
jne 0x1400862bf
call fcn.14005f4b0
mov dword [rax], 0x16
call fcn.14005e63c
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400793d0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
test rcx, rcx
je 0x140086286
mov dword [rsp + 0x28], esi
lea r8, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14008632d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x140086300
cmp eax, 3
jbe 0x14008631d
cmp eax, 8
je 0x14008630d
cmp eax, 0x12
je 0x14008631d
call fcn.14005f4b0
mov dword [rax], 0x16
jmp 0x140086296
call fcn.14005f4b0
mov dword [rax], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
jmp 0x140086296
call fcn.14005f4b0
mov dword [rax], 2
jmp 0x140086296
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x34]
cmp eax, 0x80
cmove eax, esi
mov dword [rbx], eax
call fcn.1400864c8
lea rcx, [rsp + 0x3c]
mov qword [rbx + 8], rax
call fcn.1400864c8
lea rcx, [rsp + 0x44]
mov qword [rbx + 0x10], rax
call fcn.1400864c8
mov qword [rbx + 0x18], rax
lea rcx, [rbx + 0x24]
mov eax, dword [rsp + 0x50]
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov dword [rbx + 0x20], eax
call fcn.140063bf0
test eax, eax
jne 0x14008638b
mov rax, rdi
jmp 0x14008629a
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14005e68c
int3
jmp 0x140086258
Function at 0x140086588
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x1400bba20]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor edi, edi
mov rbx, rdx
test rcx, rcx
jne 0x1400863fd
call fcn.14005f4b0
mov dword [rax], 0x16
call fcn.14005e63c
or eax, 0xffffffff
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400793d0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x290
pop rdi
ret
cmp rcx, 0xffffffffffffffff
je 0x1400863c9
test rbx, rbx
je 0x1400863c9
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140086458
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x140086431
cmp eax, 3
jbe 0x14008644b
cmp eax, 8
je 0x14008643e
cmp eax, 0x12
je 0x14008644b
call fcn.14005f4b0
mov dword [rax], 0x16
jmp 0x1400863d9
call fcn.14005f4b0
mov dword [rax], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
jmp 0x1400863d9
call fcn.14005f4b0
mov dword [rax], 2
jmp 0x1400863d9
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x34]
cmp eax, 0x80
cmove eax, edi
mov dword [rbx], eax
call fcn.1400864c8
lea rcx, [rsp + 0x3c]
mov qword [rbx + 8], rax
call fcn.1400864c8
lea rcx, [rsp + 0x44]
mov qword [rbx + 0x10], rax
call fcn.1400864c8
mov qword [rbx + 0x18], rax
lea rcx, [rbx + 0x24]
mov eax, dword [rsp + 0x50]
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov dword [rbx + 0x20], eax
call fcn.140063bf0
test eax, eax
je 0x1400863dc
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14005e68c
int3
jmp 0x1400863a0
Function at 0x140001170
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_clock]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_clock]
xor eax, eax
lea r8, section..text
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov edx, 0xffffffff
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x140001b7c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001bc6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001bc6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001bc6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001bc6
cmp dword [rcx + 0x84], 0xe
jbe 0x140001bc6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001bc8
xor al, al
add rsp, 0x28
ret

Function at 0x14086b058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14086b1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14086b089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14086b06f
add dl, dl
jne 0x14086b096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14086b0f6
xor eax, eax
add dl, dl
jne 0x14086b0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14086b1ad
add dl, dl
jne 0x14086b0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14086b0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14086b0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14086b0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14086b0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14086b07e
mov eax, 1
add dl, dl
jne 0x14086b106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14086b113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14086b0fb
sub eax, ebx
mov ebx, 1
jne 0x14086b14c
mov ecx, 1
add dl, dl
jne 0x14086b12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14086b13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14086b123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14086b07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14086b168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14086b175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14086b15d
cmp eax, 0x7d00
jae 0x14086b19b
cmp eax, 0x500
jb 0x14086b196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14086b07e
cmp eax, 0x7f
ja 0x14086b19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14086b07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14086b1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14086b07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20