joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1026af0
Capabilities:
Check mutex on windows

Disassembly:
sub rsp, 0x28
lea r8, str.AFUWIN.5b5b8120_cd0e_11d9_b61b_0001294c3bd8
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1026b1c
mov eax, 0x61
jmp 0x1026b69
call fcn.01027050
mov dword [0x01061624], eax
cmp dword [0x01061624], 5
ja 0x1026b3d
mov ecx, 0x80000001
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
jmp 0x1026b48
mov ecx, 0x80000041
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
call fcn.01028180
movzx eax, al
test eax, eax
je 0x1026b62
lea rax, [0x01026a70]
mov qword [0x010671a8], rax
call fcn.01028970
xor eax, eax
add rsp, 0x28
ret

Function at 0x1026d70
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x150
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x148], 0
mov byte [rsp + 0x40], 0
lea rdi, [rsp + 0x41]
xor eax, eax
mov ecx, 0xfe
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x168]
call fcn.0102a8b0
add rax, 0x100
mov ecx, eax
call fcn.01027240
mov qword [rsp + 0x140], rax
lea rdx, str..exe
mov rcx, qword [rsp + 0x168]
call fcn.0102b7a0
mov qword [rsp + 0x30], rax
lea rdx, str..EXE
mov rcx, qword [rsp + 0x168]
call fcn.0102b7a0
mov qword [rsp + 0x148], rax
cmp qword [rsp + 0x30], 0
jne 0x1026e46
cmp qword [rsp + 0x148], 0
jne 0x1026e46
lea rdx, [rsp + 0x40]
mov ecx, 0xff
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov r9, qword [rsp + 0x168]
lea r8, [rsp + 0x40]
lea rdx, str._s_s.exe
mov rcx, qword [rsp + 0x140]
call fcn.0102ae20
jmp 0x1026e5b
mov rdx, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x140]
call fcn.0102b110
lea rcx, str.d:utility_amideissueeip703582_5.27.06gdkdmieditappGdkCoreSourcePkgPlatformLibWindowsWindows.cpp
call fcn.01027da0
mov r8, rax
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x20], rax
mov r9d, 0xa3
lea rdx, str.__s__d______szFullName_:__s_n
mov ecx, 2
call fcn.01031410
mov rax, qword [rsp + 0x140]
add rsp, 0x150
pop rdi
ret

Function at 0x10280e0
Capabilities:
Get system firmware table

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x28
mov r9d, dword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
mov edx, dword [rsp + 0x30]
mov ecx, 0x41435049
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
add rsp, 0x28
ret

Function at 0x10281f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x30], 0
cmp qword [rsp + 0x50], 0
jne 0x102820d
xor al, al
jmp 0x102825c
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, 0x105
mov rdx, qword [rsp + 0x50]
mov rcx, qword [0x0105dc60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov byte [rsp + 0x34], al
movzx eax, byte [rsp + 0x34]
test eax, eax
je 0x1028253
mov eax, dword [rsp + 0x30]
cmp rax, 0x105
jne 0x1028253
mov byte [rsp + 0x35], 1
jmp 0x1028258
mov byte [rsp + 0x35], 0
mov al, byte [rsp + 0x35]
add rsp, 0x48
ret
Function at 0x1029df0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x98
mov dword [rsp + 0x30], 0
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov qword [0x01061728], rax
cmp qword [0x01061728], 0
jne 0x1029e3a
lea rcx, str.OpenSCManager__
call fcn.0102a200
xor al, al
jmp 0x1029f39
mov r8d, 0xf01ff
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [0x01061728]
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov qword [0x01061730], rax
cmp qword [0x01061728], 0
jne 0x1029e86
lea rcx, str.OpenService__
call fcn.0102a200
mov rcx, qword [0x01061728]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x1029f39
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [0x01061730]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x1029ebe
lea rcx, str.QueryServiceStatusEx__
call fcn.0102a200
jmp 0x1029f1d
cmp dword [rsp + 0x3c], 1
je 0x1029f10
lea r8, [rsp + 0x38]
mov edx, 1
mov rcx, qword [0x01061730]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x1029ef0
lea rcx, str.ControlService__
call fcn.0102a200
jmp 0x1029f1d
lea rdi, [rsp + 0x60]
lea rsi, [rsp + 0x38]
mov ecx, 0x24
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x60]
mov ecx, 3
call fcn.0102a450
mov rcx, qword [0x01061730]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, qword [0x01061730]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [0x01061728]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
add rsp, 0x98
pop rdi
pop rsi
ret
Function at 0x1029f50
Capabilities:
Create service
Query service status
Start service

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xd8
mov byte [rsp + 0x74], 1
mov dword [rsp + 0x70], 0
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov qword [0x01061728], rax
cmp qword [0x01061728], 0
jne 0x1029fa9
lea rcx, str.OpenSCManager__
call fcn.0102a200
xor al, al
jmp 0x102a1e3
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
mov r9d, 0xf01ff
mov r8, qword [rsp + 0xf0]
mov rdx, qword [rsp + 0xf0]
mov rcx, qword [0x01061728]
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov qword [0x01061730], rax
cmp qword [0x01061730], 0
jne 0x102a05c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
je 0x102a05c
lea rcx, str.CreateService__
call fcn.0102a200
mov rcx, qword [0x01061728]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x102a1e3
cmp qword [0x01061730], 0
je 0x102a073
mov rcx, qword [0x01061730]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r8d, 0xf01ff
mov rdx, qword [rsp + 0xf0]
mov rcx, qword [0x01061728]
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov qword [0x01061730], rax
cmp qword [0x01061730], 0
jne 0x102a0b8
lea rcx, str.OpenService__
call fcn.0102a200
mov rcx, qword [0x01061728]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x78]
xor edx, edx
mov rcx, qword [0x01061730]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x102a10d
lea rcx, str.QueryServiceStatusEx__
call fcn.0102a200
mov rcx, qword [0x01061730]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [0x01061728]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x102a1e3
cmp dword [rsp + 0x7c], 4
jne 0x102a11e
jmp 0x102a1ac
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x01061730]
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x102a161
lea rcx, str.StartService__
call fcn.0102a200
mov rcx, qword [0x01061730]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [0x01061728]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x102a1e3
lea rdi, [rsp + 0xa0]
lea rsi, [rsp + 0x78]
mov ecx, 0x24
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0xa0]
mov ecx, 2
call fcn.0102a450
movzx eax, al
test eax, eax
jne 0x102a1ac
mov rcx, qword [0x01061730]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [0x01061728]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x102a1e3
mov rdx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xf0]
call fcn.0102a570
mov byte [rsp + 0x74], al
mov rcx, qword [0x01061730]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [0x01061728]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, byte [rsp + 0x74]
add rsp, 0xd8
pop rdi
pop rsi
ret
Function at 0x102a450
Capabilities:
Check for time delay via gettickcount
Query service status

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov dword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0x14]
mov dword [rsp + 0x30], eax
xor edx, edx
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0x18]
mov ecx, 0xa
div ecx
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0x3e8
jae 0x102a4a4
mov dword [rsp + 0x34], 0x3e8
jmp 0x102a4b6
cmp dword [rsp + 0x34], 0x2710
jbe 0x102a4b6
mov dword [rsp + 0x34], 0x2710
mov rcx, qword [rsp + 0x58]
mov eax, dword [rsp + 0x50]
cmp dword [rcx + 4], eax
jne 0x102a560
mov ecx, dword [rsp + 0x34]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
mov r8, qword [rsp + 0x58]
xor edx, edx
mov rcx, qword [0x01061730]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x102a50a
lea rcx, str.QueryServiceStatusEx__
call fcn.0102a200
xor al, al
jmp 0x102a562
mov rcx, qword [rsp + 0x58]
mov eax, dword [rsp + 0x30]
cmp dword [rcx + 0x14], eax
jbe 0x102a530
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0x14]
mov dword [rsp + 0x30], eax
jmp 0x102a55b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [rsp + 0x3c]
mov rax, qword [rsp + 0x58]
cmp ecx, dword [rax + 0x18]
jbe 0x102a55b
mov edx, dword [rsp + 0x50]
lea rcx, str._ERROR__Timeout_waiting_for_service__x_n
call qword [0x010671a8]
xor al, al
jmp 0x102a562
jmp 0x102a4b6
mov al, 1
add rsp, 0x48
ret

Function at 0x102a570
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x168
mov dword [rsp + 0x48], 0
mov r9, qword [rsp + 0x170]
lea r8, str..Global_s
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.0102a670
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0xffffffffffffffff
jne 0x102a63b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 2
je 0x102a5f8
xor al, al
jmp 0x102a665
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, qword [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0xffffffffffffffff
jne 0x102a63b
xor al, al
jmp 0x102a665
cmp qword [rsp + 0x178], 0
je 0x102a658
mov rcx, qword [rsp + 0x178]
mov rax, qword [rsp + 0x40]
mov qword [rcx], rax
jmp 0x102a663
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x168
ret
Function at 0x14000b738
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000b782
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000b782
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000b782
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000b782
cmp dword [rcx + 0x84], 0xe
jbe 0x14000b782
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000b784
xor al, al
add rsp, 0x28
ret

Function at 0x140011078
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400110e7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400110e7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400110e7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400110e7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400110e7
cmp dword [rcx + 0x84], 0xe
jbe 0x1400110e7
cmp dword [rcx + 0xf8], 0
je 0x1400110e7
mov ecx, ebx
call fcn.140011198
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140010f74
nop
cmp dword [rbp + 0x20], 0
je 0x140011135
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140011140
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x140011078

Function at 0x14001127c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140011078
Function at 0x1400165a8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400165d8
xor eax, eax
jmp 0x14001669b
mov rbp, rbx
cmp word [rax], si
je 0x1400165fd
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400165e4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400165e0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400164c8
movsxd r14, eax
test eax, eax
jne 0x14001663b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400165d1
mov rcx, r14
call fcn.140012d5c
mov rdi, rax
test rax, rax
jne 0x140016654
xor ecx, ecx
call fcn.1400120e4
jmp 0x140016630
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400164c8
test eax, eax
jne 0x140016685
mov rcx, rdi
call fcn.1400120e4
jmp 0x14001668f
xor ecx, ecx
call fcn.1400120e4
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14001a9bc
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001a9d2
mov al, 1
jmp 0x14001aa32
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001a9e3
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001aa30
mov ecx, dword [rcx + 0x18]
nop
call fcn.140016ec8
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001aa30
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001aa30
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001aa30
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001aa32
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x14001ba70
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140015598
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14001bafa
cmp byte [rbp - 0x21], r15b
je 0x14001baf5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14001bb30
call fcn.140012334
test eax, eax
jne 0x14001bb1c
cmp byte [rbp - 0x21], r15b
je 0x14001bb14
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14001bb30
cmp byte [rbp - 0x21], r15b
je 0x14001bb2d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140014b78
test eax, eax
jne 0x14001bbd0
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140015598
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14001bb6f
cmp byte [rbp - 0x21], r15b
je 0x14001bba4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14001bba4
call fcn.140012334
test eax, eax
jne 0x14001bb90
cmp byte [rbp - 0x21], r15b
je 0x14001bb89
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14001bba4
cmp byte [rbp - 0x21], r15b
je 0x14001bba1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140014b78
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14001bbd0
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14001bbd3
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14001bbe1
mov rcx, rdi
call fcn.1400120e4
cmp byte [rbp + 0x3f], r15b
je 0x14001bbf0
mov rcx, qword [rbp + 0x27]
call fcn.1400120e4
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14001e1e0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001e208
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001e208
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x62451920
Capabilities:
Get storage device properties

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x108
lea rbx, [rsp + 0x70]
mov rdi, rdx
mov ebp, ecx
xor edx, edx
mov rcx, rdi
mov rsi, r8
call fcn.624c0498
mov rcx, rbx
mov r8d, ebp
lea rdx, str..PhysicalDrive_d
call qword [0x624e24d8]
xor r9d, r9d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov r8d, 3
mov dword [rsp + 0x20], 3
call qword [0x624e21f8]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x62451a0c
lea r12, [0x624d9240]
xor edx, edx
mov r8d, 0x2710
mov dword [rsp + 0x60], 0
lea r13, [rsp + 0x64]
mov qword [rsp + 0x64], 0
mov rcx, r12
mov dword [rsp + 0x6c], 0
call fcn.624c0498
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x28], 0x2710
mov qword [rsp + 0x20], r12
mov r9d, 0xc
mov r8, r13
mov qword [rsp + 0x30], rax
mov edx, 0x2d1400
mov rcx, rbx
call qword [0x624e2210]
test eax, eax
jne 0x62451a34
mov rcx, rbx
call qword [0x624e21f0]
cmp rsi, 0x13
jbe 0x62451be0
mov rdx, rdi
mov ecx, ebp
call fcn.62451570
add rsp, 0x108
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [0x624d9258]
test eax, eax
je 0x62451a03
add rax, r12
mov r15, qword [0x624e2428]
mov r13d, 0x64
mov qword [rsp + 0x58], rax
mov r12, rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov r14, rax
test r13d, r13d
movzx edx, byte [r12]
je 0x62451b10
test dl, dl
je 0x62451b10
movsx ecx, dl
mov byte [rsp + 0x4e], dl
call r15
test eax, eax
je 0x62451bb0
movzx edx, byte [rsp + 0x4e]
cmp dl, 0x39
jg 0x62451b90
sub edx, 0x30
movsx ecx, byte [r12 + 1]
shl edx, 4
mov byte [rsp + 0x4e], dl
mov byte [rsp + 0x4f], cl
call r15
test eax, eax
je 0x62451bb0
movzx edx, byte [rsp + 0x4f]
cmp dl, 0x39
jg 0x62451ba0
sub edx, 0x30
or dl, byte [rsp + 0x4e]
add r12, 2
movzx ecx, dl
mov byte [rsp + 0x4e], dl
call qword [0x624e2420]
test eax, eax
je 0x62451bb0
movzx edx, byte [rsp + 0x4e]
cmp dl, 0x20
je 0x62451a66
sub r13d, 1
mov byte [r14], dl
add r14, 1
test r13d, r13d
movzx edx, byte [r12]
jne 0x62451a74
mov r8, qword [rsp + 0x50]
mov byte [r14], 0
mov edx, dword [r8]
add r8, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x62451b19
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [r8 + 2]
mov ecx, eax
cmove r8, rdx
add cl, al
sbb r8, 3
sub r8, qword [rsp + 0x50]
cmp r8d, esi
mov r12d, r8d
jae 0x62451a03
mov rdx, qword [rsp + 0x50]
add r8, 1
mov rcx, rdi
call fcn.624c04a8
mov rcx, rbx
call qword [0x624e21f0]
test r12d, r12d
je 0x62451a0c
xor eax, eax
jmp 0x62451a20
and edx, 0xffffffdf
sub edx, 0x37
jmp 0x62451a9f
and edx, 0xffffffdf
sub edx, 0x37
jmp 0x62451acc
mov rcx, qword [rsp + 0x58]
call fcn.624c0450
cmp eax, esi
mov r12d, eax
jae 0x62451a03
mov rdx, qword [rsp + 0x58]
lea r8, [rax + 1]
mov rcx, rdi
call fcn.624c04a8
jmp 0x62451b70
mov eax, 0xffffffff
jmp 0x62451a20
Function at 0x62451cc0
Capabilities:
Get storage device properties

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
movsx eax, byte [rcx]
mov rbx, rdx
mov rsi, r8
cmp al, 0x2a
je 0x62451d41
cmp al, 0x2f
jne 0x62451ce3
movsx eax, byte [rcx + 1]
add rcx, 1
test al, al
je 0x62451dde
sub eax, 0x30
cmp eax, 9
jbe 0x62451d0f
jmp 0x62451d31
lea r8d, [rdx - 0x30]
cmp r8d, 9
ja 0x62451d31
lea r8d, [rax + rax*4]
lea edx, [rdx + r8*2 - 0x30]
add eax, edx
cmp eax, 0x5a
jg 0x62451d31
add rcx, 1
movsx edx, byte [rcx]
test dl, dl
jne 0x62451cf5
mov r8, rsi
mov rdx, rbx
mov ecx, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.62451920
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp r8, 5
jbe 0x62451de5
lea rdx, str.__d:
xor r8d, r8d
mov rcx, rbx
mov rbp, rbx
xor edi, edi
lea r12, str.__d:
call fcn.624c0478
mov edx, 3
jmp 0x62451db0
mov rcx, rbp
add edi, 1
call fcn.624c0450
cdqe
lea rdx, [rbp + rax]
sub rsi, rax
cmp edi, 0x59
lea rbp, [rdx + 1]
mov byte [rdx], 0x2c
jg 0x62451dc8
cmp rsi, 5
jbe 0x62451dc8
mov rdx, r12
mov r8d, edi
mov rcx, rbp
call fcn.624c0478
xor edx, edx
cmp edi, 9
setg dl
add edx, 3
movsxd rdx, edx
mov ecx, edi
sub rsi, rdx
add rdx, rbp
mov r8, rsi
call fcn.62451920
cmp eax, 0xffffffff
jne 0x62451d70
cmp rbx, rbp
jae 0x62451de5
xor eax, eax
mov byte [rbp - 1], 0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor eax, eax
jmp 0x62451d1a
lea r8, str.No_any_serial_number_of_harddisk_got
lea rcx, str..._src_platforms_windows_hdinfo.c
mov edx, 0x23e
call fcn.624441c0
mov eax, 0xffffffff
jmp 0x62451d36
Function at 0x62457770
Capabilities:
Hash data with md5

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x624577aa
xor eax, eax
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov dword [rcx + 0x18], 0
mov qword [rcx], 0
add rsp, 0x28
ret
lea rdx, str.src_hashes_md5.c
lea rcx, [0x624cc211]
mov r8d, 0xe9
call fcn.6245c710
nop
nop
nop word cs:[rax + rax]