joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002007c
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x7f]
mov edx, 0x20008
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400201de
mov rcx, qword [rbp + 0x7f]
lea rax, [rbp + 0x6f]
and dword [rbp + 0x6f], 0
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea r14d, [r9 + 1]
mov edx, r14d
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1400200eb
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400201de
mov ecx, dword [rbp + 0x6f]
call fcn.1400302b8
mov r9d, dword [rbp + 0x6f]
mov rbx, rax
mov rcx, qword [rbp + 0x7f]
lea rax, [rbp + 0x6f]
mov r8, rbx
mov qword [rsp + 0x20], rax
mov edx, r14d
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x140020124
mov rcx, rbx
call fcn.14002bee4
jmp 0x1400201de
mov r8, qword [rbx]
lea rdx, [rbp - 9]
mov ecx, 0x44
call qword [sym.imp.ADVAPI32.dll_CopySid]
mov rcx, rbx
call fcn.14002bee4
and qword [rbp - 0x41], 0
lea rax, [rbp - 9]
and dword [rbp - 0x45], 0
lea r9, [rbp + 0x77]
and qword [rbp + 0x77], 0
lea rdx, [rbp - 0x61]
xorps xmm0, xmm0
mov qword [rbp - 0x39], rax
xor r8d, r8d
mov dword [rbp - 0x61], 0x11060000
mov ecx, r14d
mov dword [rbp - 0x5d], r14d
movdqu xmmword [rbp - 0x55], xmm0
mov dword [rbp - 0x59], 3
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x1400201de
mov edx, r14d
lea rcx, [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x1400201cf
mov r8, qword [rbp + 0x77]
lea rcx, [rbp - 0x31]
xor r9d, r9d
mov edx, r14d
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x1400201cf
and dword [rbp - 0x69], 0
lea rax, [rbp - 0x31]
lea rdx, [rbp - 0x79]
mov qword [rbp - 0x71], rax
mov rcx, rdi
mov dword [rbp - 0x79], 0x18
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x1400201de
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, qword [rsp + 0x110]
add rsp, 0xf0
pop r14
pop rdi
pop rbp
ret

Function at 0x1400201f4
Capabilities:
Delete file

Disassembly:
push rbx
mov eax, 0x1070
call fcn.140024fb0
sub rsp, rax
xor ebx, ebx
cmp word [0x140062c92], bx
je 0x14002029c
lea rcx, [0x140062c92]
call fcn.14000f3cc
mov rdx, qword [str.RarSFX]
lea r8d, [rbx + 6]
mov rcx, rax
call fcn.140015c9c
test eax, eax
jne 0x14002029c
lea rcx, [0x140061c90]
call fcn.14001fe04
mov r8d, 0x800
lea rdx, [0x140062c92]
lea rcx, [rsp + 0x60]
call fcn.140013f4c
lea rcx, [rsp + 0x60]
call fcn.14002b758
xor edx, edx
lea r8d, [rbx + 0x38]
lea rcx, [rsp + 0x20]
mov word [rsp + rax*2 + 0x62], bx
call fcn.140025e90
lea eax, [rbx + 0x14]
mov dword [rsp + 0x28], 3
mov word [rsp + 0x40], ax
lea rcx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
add rsp, 0x1070
pop rbx
ret
Function at 0x140020304
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x170
xor ebp, ebp
mov rdi, r8
cmp qword [0x1400502d8], rbp
mov rbx, rdx
mov rsi, rcx
jne 0x14002036c
lea r9d, [rbp + 0x64]
mov ecx, 0x400
lea r8, [rax - 0xd8]
lea edx, [rbp + 0xf]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
movzx eax, word [rsp + 0xa0]
mov word [0x140072328], ax
lea rax, [0x140072328]
mov qword [0x1400502d8], rax
mov word [0x14007232a], bp
mov r8d, 0x32
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140013db0
lea r9, [0x1400502c0]
mov dword [rsp + 0x28], edi
lea r8, [rsp + 0x30]
mov word [rbx], bp
xor edx, edx
mov qword [rsp + 0x20], rbx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
lea r11, [rsp + 0x170]
mov word [rbx + rdi*2 - 2], bp
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1400205c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1f40]
mov eax, 0x2040
call fcn.140024fb0
sub rsp, rax
xor esi, esi
mov rdi, rdx
cmp byte [0x140063c98], sil
mov rbx, rcx
je 0x1400206a7
mov r8d, 0x800
lea rdx, [rbp + 0xf40]
call fcn.140021ee8
lea rax, [rsp + 0x30]
xor r8d, r8d
lea r9d, [rsi + 1]
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareWinRAR_SFX
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400206a7
mov rcx, qword [rsp + 0x30]
lea rax, [rbp + 0x1f70]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x1f78]
lea rax, [rsp + 0x40]
mov dword [rbp + 0x1f70], 0x1000
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0xf40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002069c
mov eax, dword [rbp + 0x1f70]
lea rdx, [rsp + 0x40]
shr eax, 1
mov r8, rdi
mov ecx, eax
mov dword [rbp + 0x1f70], eax
mov eax, 0x7ff
cmp ecx, eax
cmovb eax, ecx
mov rcx, rbx
mov word [rsp + rax*2 + 0x40], si
call fcn.140013f4c
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x2060]
add rsp, 0x2040
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002079c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
mov eax, 0x2020
call fcn.140024fb0
sub rsp, rax
xor r14d, r14d
mov rsi, r8
mov rbx, rcx
test r9, r9
je 0x1400207cf
mov byte [r9], r14b
mov rcx, qword [rsp + 0x2050]
test rcx, rcx
je 0x1400207df
mov byte [rcx], r14b
test rbx, rbx
je 0x140020894
movzx eax, word [rbx]
test ax, ax
je 0x140020894
movsxd rbp, dword [rsp + 0x2058]
mov rdi, r14
mov r8d, r14d
add rbx, 2
cmp ax, 0x3d
jne 0x140020824
test rsi, rsi
je 0x140020830
test rdi, rdi
jne 0x140020830
test r9, r9
je 0x14002081f
mov byte [r9], 1
mov rdi, rdx
jmp 0x14002083f
cmp ax, 0xd
je 0x140020851
cmp ax, 0xa
je 0x140020855
mov word [rdx], ax
add rdx, 2
lea eax, [rbp - 2]
cmp r8d, eax
jge 0x14002084c
movzx eax, word [rbx]
inc r8d
test ax, ax
jne 0x140020802
jmp 0x140020855
mov byte [rcx], 1
jmp 0x140020855
add rbx, 2
mov word [rdx], r14w
test rsi, rsi
je 0x14002088f
mov word [rsi], r14w
test rdi, rdi
je 0x14002088f
mov r8d, 0x1000
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r8, rbp
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140013f4c
mov word [rdi], r14w
mov rax, rbx
jmp 0x140020896
xor eax, eax
lea r11, [rsp + 0x2020]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret

Function at 0x1400208b4
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov ebx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.SHELL32.dll_SHGetMalloc]
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderLocation]
xor ecx, ecx
test eax, eax
sete bl
test eax, eax
jne 0x140020920
mov rcx, qword [rsp + 0x50]
mov rdx, rdi
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov rcx, qword [rsp + 0x58]
cmp eax, 1
mov rdx, qword [rsp + 0x50]
sete bl
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [0x14003f510]
jmp 0x140020923
mov word [rdi], cx
mov al, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140023564
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
and dword [0x140061c80], 0
mov edx, 1
mov rbx, rcx
mov byte [0x14005a85c], 1
mov byte [0x14005a85d], 1
call qword [sym.imp.USER32.dll_ShowWindow]
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 2]
call fcn.1400011a0
cmp qword [0x140072310], 0
jne 0x1400235af
cmp byte [0x14005a862], 0
je 0x1400235b8
cmp dword [0x14005a858], 0
jne 0x1400235cd
xor r9d, r9d
mov edx, 0x111
mov rcx, rbx
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_SendMessageW]
add rsp, 0x20
pop rbx
ret

Function at 0x1400236a0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x1050
call fcn.140024fb0
sub rsp, rax
xor edi, edi
mov rbx, rcx
cmp byte [0x140063c98], dil
je 0x140023772
cmp word [0x140063c9a], di
je 0x140023772
mov r8d, 0x800
lea rdx, [rsp + 0x50]
lea rcx, [0x140063c9a]
call fcn.140021ee8
lea rax, [rsp + 0x1068]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, str.SoftwareWinRAR_SFX
lea rax, [rsp + 0x1070]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140023772
mov rcx, rbx
call fcn.14002b758
lea r9d, [rdi + 1]
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea ecx, [rax*2 + 2]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x1070]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x1070]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x1060]
add rsp, 0x1050
pop rdi
ret

Function at 0x140023784
Capabilities:
Set environment variable

Disassembly:
push rbx
mov eax, 0x2020
call fcn.140024fb0
sub rsp, rax
mov rbx, rcx
mov rdx, rcx
lea rcx, str.sfxcmd
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r8d, 0x1000
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140013c64
mov rbx, rax
test rax, rax
je 0x1400237e6
movzx ecx, word [rax]
jmp 0x1400237cd
add rbx, 2
movzx ecx, word [rbx]
call fcn.140013d8c
test al, al
jne 0x1400237c6
mov rdx, rbx
lea rcx, str.sfxpar
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x2020
pop rbx
ret
Function at 0x1400248d4
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x14002494c
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x14002494c
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x14002494c
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x140024940
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x14002495e
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x14002492e
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x14002494e

Function at 0x1400258ec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140025936
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140025936
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140025936
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140025936
cmp dword [rcx + 0x84], 0xe
jbe 0x140025936
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140025938
xor al, al
add rsp, 0x28
ret

Function at 0x140031654
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140031444
Function at 0x140036644
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140036674
xor eax, eax
jmp 0x140036737
mov rbp, rbx
cmp word [rax], si
je 0x140036699
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140036680
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14003667c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140036594
movsxd r14, eax
test eax, eax
jne 0x1400366d7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14003666d
mov rcx, r14
call fcn.140032ef0
mov rdi, rax
test rax, rax
jne 0x1400366f0
xor ecx, ecx
call fcn.140032d44
jmp 0x1400366cc
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140036594
test eax, eax
jne 0x140036721
mov rcx, rdi
call fcn.140032d44
jmp 0x14003672b
xor ecx, ecx
call fcn.140032d44
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140002e00
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1400048f0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.1400048f0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140002e70
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14000a0a4]
mov rbx, rcx
test esi, esi
jle 0x140002fa0
mov rax, qword [0x14000a0a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140002ebb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140002f45
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140002ea0
mov rcx, rbx
call fcn.1400038c0
mov rdi, rax
test rax, rax
je 0x140002fc2
mov rax, qword [0x14000a0a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140003a00
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000a0a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140002fa7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140002f3e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140002f50
add dword [0x14000a0a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000a0a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140002f3e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140002e00
nop dword [rax]
xor esi, esi
jmp 0x140002ec8
mov rax, qword [0x14000a0a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140002e00
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140002e00
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140003530
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14000a100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000a0e0]
test rbx, rbx
je 0x14000358c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140003583
test rsi, rsi
je 0x140003583
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140003568
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1400038c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140006a90]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400038e0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400038e8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400038e0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000393d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140003934
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400038e0
add rax, 0x28
cmp rax, r9
jne 0x140003920
xor eax, eax
ret

Function at 0x140003940
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006a90]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000395f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140003968
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000395f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140003a00
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006a90]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140003a1f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140003a28
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x1400082b0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x14002a008]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, r8
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x1400082f5
xor al, al
jmp 0x140008342
cmp word [rbx], 0
je 0x14000830d
nop dword [rax + rax]
add rbx, 2
dec rdi
cmp word [rbx], 0
jne 0x140008300
cmp word [rsp + 0x30], 0
je 0x14000833b
lea rcx, [rsp + 0x30]
sub rcx, rbx
nop dword [rax]
cmp rdi, 1
jb 0x140008363
movzx eax, word [rcx + rbx]
dec rdi
mov word [rbx], ax
add rbx, 2
cmp word [rcx + rbx], 0
jne 0x140008320
xor eax, eax
mov word [rbx], ax
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000c2c0
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
call fcn.14000e4d0
int3

Function at 0x140008530
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2030
call fcn.14000c260
sub rsp, rax
mov rax, qword [0x14002a008]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov r11d, dword [0x14002aa48]
lea rsi, [0x14002caa0]
mov rdi, rcx
test r11d, r11d
jne 0x1400085a9
mov r8d, 0x1000
lea rdx, str._HOME_
lea rcx, [rsp + 0x20]
call fcn.1400086a0
test al, al
je 0x14000868f
lea rcx, [rsp + 0x20]
call fcn.140011d20
movsxd r11, dword [0x14002aa48]
mov qword [rsi + r11*8], rax
inc r11d
mov dword [0x14002aa48], r11d
xor r9d, r9d
test r11d, r11d
jle 0x1400085e4
mov r10, rsi
mov r8, qword [r10]
mov rax, rdi
sub r8, rdi
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1400085d4
add rax, 2
test ecx, ecx
jne 0x1400085c0
test edx, edx
je 0x140008607
inc r9d
add r10, 8
cmp r9d, r11d
jl 0x1400085b4
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x1400085f0
cmp rax, 2
jne 0x14000860b
cmp word [rdi + 2], 0x3a
jne 0x14000860b
mov al, 1
jmp 0x14000866e
xor edx, edx
mov qword [rsp + 0x2048], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
test eax, eax
jne 0x140008638
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140008638
mov bl, 1
jmp 0x14000863c
test bl, bl
je 0x140008663
cmp dword [0x14002aa48], 0x400
jge 0x140008663
mov rcx, rdi
call fcn.140011d20
movsxd rdx, dword [0x14002aa48]
mov qword [rsi + rdx*8], rax
inc edx
mov dword [0x14002aa48], edx
movzx eax, bl
mov rbx, qword [rsp + 0x2048]
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.14000c2c0
mov rsi, qword [rsp + 0x2050]
add rsp, 0x2030
pop rdi
ret
lea rcx, str._HOME_
call fcn.140008b00
int3
Function at 0x140008ba0
Capabilities:
Encode data using xor
Get file size
Hash data with crc32
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
xor r14d, r14d
xor r9d, r9d
mov qword [rax - 0x18], r14
mov edx, 0x80000000
mov dword [rax - 0x20], 0x80
mov dword [rax - 0x28], 3
lea r8d, [r14 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140008bf4
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140008d5e
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, 0xffffffff
cmp eax, ebx
je 0x140008d4f
xor r9d, r9d
mov qword [rsp + 0x28], r14
xor edx, edx
mov ebp, eax
mov rcx, rdi
mov dword [rsp + 0x20], r14d
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rsi, rax
test rax, rax
je 0x140008d4f
xor r9d, r9d
mov qword [rsp + 0x20], r14
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r8, rax
test rax, rax
jne 0x140008c6a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140008d55
test ebp, ebp
je 0x140008d24
mov r9, r8
mov r10, rbp
nop dword [rax + rax]
movzx eax, byte [r9]
lea r9, [r9 + 1]
xor ebx, eax
mov eax, ebx
and al, 1
neg al
sbb ecx, ecx
shr ebx, 1
and ecx, 0xedb88320
xor ecx, ebx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb ebx, ebx
shr ecx, 1
and ebx, 0xedb88320
xor ebx, ecx
sub r10, 1
jne 0x140008c80
not ebx
mov eax, 1
test ebx, ebx
mov rcx, r8
cmove ebx, eax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x140008d60
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret