joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ff840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5ff92a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x4f10366e30146557
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x724f10366e301465
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6a732d49376f2349
mov qword [rsp + 0x38], rdx
movabs rdx, 0x70c070e060d0209
mov qword [rsp + 0x19], rdx
movabs rdx, 0xd0a10050503070c
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x20d09060a010309
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x5ff8cd
movzx r9d, byte [rsp + rsi + 0x2f]
sub r9d, edx
lea edx, [r9 + 0x2a]
mov byte [rsp + rdi + 0x2f], dl
lea edx, [r8 + 0x2a]
mov byte [rsp + rsi + 0x2f], dl
add rax, 2
cmp rax, 0x16
jge 0x5ff8fa
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x5ff91d
movzx r8d, byte [rsp + rdi + 0x2f]
sub r8d, edx
cmp rsi, 0x11
jb 0x5ff8b0
jmp 0x5ff911
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00467060
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.0046d060
mov eax, edi
mov ecx, 0x11
call fcn.0046d060
nop
call fcn.0046ad80
jmp fcn.005ff840

Function at 0x5ffce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5ffddd
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x68ecf3efc27cf3ee
mov qword [rsp + 0x32], rdx
movabs rdx, 0x6976de7306d568ec
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe86e71dce1420363
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa0b000806071213
mov qword [rsp + 0x18], rdx
movabs rdx, 0x302110107050212
mov qword [rsp + 0x20], rdx
movabs rdx, 0x406030211010705
mov qword [rsp + 0x22], rdx
movabs rdx, 0x50f0b0b15030912
mov qword [rsp + 0x2a], rdx
xor eax, eax
jmp 0x5ffd80
movzx r9d, byte [rsp + rsi + 0x32]
sub r9d, edx
lea edx, [r9 - 0x72]
mov byte [rsp + rdi + 0x32], dl
lea edx, [r8 - 0x72]
mov byte [rsp + rsi + 0x32], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x5ffdad
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x5ffdd0
movzx r8d, byte [rsp + rdi + 0x32]
sub r8d, edx
cmp rsi, 0x16
jb 0x5ffd5f
jmp 0x5ffdc4
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0x16
call fcn.00467060
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.0046d060
mov eax, edi
mov ecx, 0x16
call fcn.0046d060
nop
nop dword [rax]
call fcn.0046ad80
jmp fcn.005ffce0
Function at 0x601e60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x601f18
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xdd3fd566d4c5d627
mov qword [rsp + 0x28], rdx
movabs rdx, 0x1050506050307
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x201
xor eax, eax
jmp 0x601eb5
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6b]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0xa
jge 0x601ee8
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x601f0b
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6b]
nop
cmp rsi, 8
jb 0x601e9b
jmp 0x601eff
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.00467060
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.0046d060
mov eax, edi
mov ecx, 8
call fcn.0046d060
nop
call fcn.0046ad80
nop dword [rax]
jmp fcn.00601e60
Function at 0x604240
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x604435
push rbp
mov rbp, rsp
sub rsp, 0x78
movq qword [rsp + 0x70], xmm15
mov byte [rsp + 0x1b], 0
movups xmmword [rsp + 0x48], xmm15
mov rsi, qword [rax + 0x20]
test rsi, rsi
jne 0x604319
mov qword [rsp + 0x88], rax
lea rsi, [rax + 0x14]
mov rcx, rax
xor eax, eax
mov edi, 1
lock cmpxchg dword [rcx + 0x14], edi
sete dil
test dil, dil
jne 0x6042b2
mov qword [rsp + 0x58], rsi
mov rax, rsi
nop dword [rax]
call fcn.0048e820
mov rcx, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x58]
lea rdi, [0x00604460]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rsi
lea rsi, [rsp + 0x60]
mov qword [rsp + 0x70], rsi
mov byte [rsp + 0x1b], 1
cmp qword [rcx + 0x20], 0
jne 0x6042f4
movabs rdx, 0x6af232244d61fc56
mov qword [rsp + 0x3c], rdx
mov dword [rsp + 0x44], 0xe44cb6df
xor eax, eax
jmp 0x604343
movups xmmword [rsp + 0x48], xmm15
mov byte [rsp + 0x1b], 0
mov rdx, qword [rsp + 0x70]
mov rax, qword [rdx]
call rax
mov rbx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x48]
add rsp, 0x78
pop rbp
ret
movups xmmword [rsp + 0x48], xmm15
xor eax, eax
xor ebx, ebx
add rsp, 0x78
pop rbp
ret
lea rdx, [0x0064dc9b]
movzx esi, byte [rdx + rax]
movzx edi, byte [rsp + rax + 0x3c]
sub edi, esi
mov byte [rsp + rax + 0x3c], dil
inc rax
cmp rax, 0xc
jl 0x604329
lea rax, [rsp + 0x1c]
lea rbx, [rsp + 0x3c]
mov ecx, 0xc
call fcn.00467060
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rdx + 8]
cmp rbx, rcx
jne 0x60438c
mov rsi, qword [rdx]
mov rbx, rax
mov rax, rsi
call fcn.00403060
nop dword [rax]
test al, al
jne 0x60439e
mov rdx, qword [rsp + 0x88]
mov rax, qword [rdx]
mov rbx, qword [rdx + 8]
movzx ecx, byte [rdx + 0x10]
call fcn.00604800
jmp 0x6043b2
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx]
mov rbx, qword [rcx + 8]
call fcn.00603420
test rbx, rbx
je 0x6043e1
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rcx
mov byte [rsp + 0x1b], 0
mov rdx, qword [rsp + 0x70]
mov rax, qword [rdx]
call rax
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x78
pop rbp
nop
ret
mov rcx, qword [rsp + 0x88]
add rcx, 0x20
mov rbx, rax
mov rax, rcx
call fcn.00460d00
movups xmmword [rsp + 0x48], xmm15
mov byte [rsp + 0x1b], 0
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rdx]
call rcx
mov rbx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x48]
add rsp, 0x78
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.0046ad80
mov rax, qword [rsp + 8]
jmp fcn.00604240
Function at 0x607620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x607728
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x412064004cfc3a1b
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x20544b6972f44a40
mov qword [rsp + 0x44], rdx
movabs rdx, 0xf445ba1d20544b69
mov qword [rsp + 0x48], rdx
movabs rdx, 0xae2114b08050e51
mov qword [rsp + 0x50], rdx
movabs rdx, 0x100d1a0817171116
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x180a160919041507
mov qword [rsp + 0x24], rdx
movabs rdx, 0x80713110e140d
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x308040117070212
mov qword [rsp + 0x34], rdx
xor eax, eax
jmp 0x6076cb
movzx r9d, byte [rsp + rsi + 0x3c]
sub r9d, edx
lea edx, [r9 + 0x4c]
mov byte [rsp + rdi + 0x3c], dl
lea edx, [r8 + 0x4c]
mov byte [rsp + rsi + 0x3c], dl
add rax, 2
cmp rax, 0x20
jge 0x6076f8
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x60771b
movzx r8d, byte [rsp + rdi + 0x3c]
sub r8d, edx
cmp rsi, 0x1c
jb 0x6076ae
jmp 0x60770f
xor eax, eax
lea rbx, [rsp + 0x3c]
mov ecx, 0x1c
call fcn.00467060
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.0046d060
mov eax, edi
mov ecx, 0x1c
call fcn.0046d060
nop
call fcn.0046ad80
jmp fcn.00607620

Function at 0x607740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x607806
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x645fe56bdd651b75
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x6ccf
movabs rdx, 0x803060803050405
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 0x301
xor eax, eax
jmp 0x6077a0
movzx r9d, byte [rsp + rsi + 0x26]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4d]
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x6077d2
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x6077f7
movzx r8d, byte [rsp + rdi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4d]
cmp rsi, 0xa
jb 0x607782
jmp 0x6077eb
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
nop
call fcn.00467060
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.0046d060
mov eax, edi
mov ecx, 0xa
nop
call fcn.0046d060
nop
call fcn.0046ad80
jmp fcn.00607740
Function at 0x608160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x60825b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x63ef44347265704d
mov qword [rsp + 0x34], rdx
movabs rdx, 0x4663382963ef4434
mov qword [rsp + 0x38], rdx
movabs rdx, 0x2e641b21216cff20
mov qword [rsp + 0x40], rdx
movabs rdx, 0x41010100f0f0707
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x10100f110d001111
mov qword [rsp + 0x22], rdx
movabs rdx, 0x50410100f110d00
mov qword [rsp + 0x24], rdx
movabs rdx, 0xb0806090b0c0800
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x6081f9
movzx r9d, byte [rsp + rsi + 0x34]
lea edx, [r9 + rdx]
lea edx, [rdx + 0xc]
mov byte [rsp + rdi + 0x34], dl
mov byte [rsp + rsi + 0x34], r8b
add rax, 2
cmp rax, 0x1a
jge 0x60822b
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x60824e
movzx r8d, byte [rsp + rdi + 0x34]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0xc]
cmp rsi, 0x14
jb 0x6081df
jmp 0x608242
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.00467060
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.0046d060
mov eax, edi
mov ecx, 0x14
call fcn.0046d060
nop
nop dword [rax + rax]
call fcn.0046ad80
jmp fcn.00608160
Function at 0x417621
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r15, r8
cmp edx, 0x10000
jb 0x4176c3
mov rdi, rcx
movsxd rax, dword [rcx + 0x3c]
mov r13d, dword [rcx + rax + 0x88]
movabs rcx, 0x3f63a5bf9d5eef0b
sub r13, rcx
add r13, rdi
add r13, rcx
cmp dword [r13 + 0x18], 0
je 0x4176c3
mov r12d, edx
mov r14d, dword [rdi + rax + 0x8c]
mov ebp, dword [r13 + 0x20]
mov ebx, dword [r13 + 0x24]
add rbx, rdi
add rbp, rdi
xor esi, esi
mov eax, dword [rbp]
lea rcx, [rax + rdi]
cmp byte [rax + rdi], 0
mov edx, 0
je 0x4176a3
xor edx, edx
cmp byte [rcx + rdx + 1], 0
lea rdx, [rdx + 1]
jne 0x417698
mov r8d, 0xb801fcda
call fcn.00422a90
cmp eax, r12d
je 0x41770b
add rbp, 4
add rbx, 2
inc esi
cmp esi, dword [r13 + 0x18]
jb 0x417684
mov qword [r15], 0
xor edi, edi
mov eax, dword [0x0044829c]
lea ecx, [rax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmp dword [0x00448298], 0xa
setl cl
test cl, al
jne 0x4176f7
xor cl, al
jne 0x4176f7
jmp 0x4176f5
mov rax, rdi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [0x0044829c]
lea ecx, [rax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmp dword [0x00448298], 0xa
setl cl
test cl, al
jne 0x417736
xor cl, al
jne 0x417736
jmp 0x417734
movzx r8d, word [rbx]
mov rcx, rdi
mov rdx, r13
call fcn.0040f58f
mov rdi, rax
mov rcx, rax
mov rdx, r13
mov r8d, r14d
call fcn.0040e1ff
test eax, eax
je 0x4176cc
mov rcx, rdi
call fcn.00402797
mov rdi, rax
jmp 0x4176cc
Function at 0x4225ec
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, dword [0x00448214]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete r9b
cmp dword [0x00448210], 0xa
setl dl
mov eax, dword [0x00448194]
mov r8d, dword [0x00448190]
test dl, r9b
jne 0x422685
xor dl, r9b
jne 0x422685
lea edx, [rax - 1]
imul edx, eax
and edx, 1
test edx, edx
sete r9b
setne al
cmp r8d, 0xa
setl bl
cmp r8d, 9
setg dl
cmp bl, r9b
jne 0x422652
or dl, al
xor dl, 1
je 0x422681
mov al, byte [rcx]
mov eax, dword [0x00448194]
mov r8d, dword [0x00448190]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete dl
cmp r8d, 0xa
setl bl
test bl, dl
jne 0x422685
xor bl, dl
jne 0x422685
mov al, byte [rcx]
jmp 0x422652
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete al
cmp r8d, 0xa
setl dl
test dl, al
jne 0x4226a5
xor dl, al
je 0x4226d8
mov r10b, byte [rcx]
mov eax, dword [0x00448194]
mov r8d, dword [0x00448190]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete r9b
cmp r8d, 0xa
setl al
test al, r9b
jne 0x4226dc
xor al, r9b
jne 0x4226dc
mov al, byte [rcx]
jmp 0x4226a5
mov ebx, dword [0x00448214]
mov r9d, dword [0x00448210]
lea eax, [rbx - 1]
imul eax, ebx
not eax
or eax, 0xfffffffe
cmp eax, 0xffffffff
sete r11b
cmp r9d, 0xa
setl bl
test bl, r11b
jne 0x422713
xor bl, r11b
jne 0x422713
not edx
jmp 0x42262f
not r10b
or r10b, 0xfe
cmp r10b, 0xff
je 0x422724
not eax
jmp 0x42277e
mov r9d, 1
xor r8d, r8d
mov bl, byte [rcx + r9]
mov edx, ebx
shr dl, 1
shl bl, 7
mov eax, edx
not al
not bl
mov r10d, eax
and r10b, 0x98
and dl, 6
or dl, r10b
and bl, 0x98
xor bl, dl
and al, 0x61
or al, bl
mov byte [rcx + r9], al
inc r8
inc r9
cmp r9, 0xc
jne 0x42272d
mov eax, dword [0x00448214]
mov r9d, dword [0x00448210]
lea edx, [rax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
and eax, edx
test eax, eax
sete al
cmp r9d, 0xa
setl dl
test dl, al
jne 0x422794
xor dl, al
jne 0x422794
jmp 0x422792
inc rcx
mov rax, rcx
pop rbx
ret
Function at 0x422bdc
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x10
mov eax, dword [rcx]
mov r9d, dword [rcx + 4]
mov ebp, dword [rdx]
mov dword [rsp + 0xc], ebp
mov ebp, dword [rdx + 4]
mov dword [rsp + 8], ebp
mov ebp, dword [rdx + 8]
mov dword [rsp + 4], ebp
mov edx, dword [rdx + 0xc]
mov dword [rsp], edx
xor r14d, r14d
mov r12d, 0xc7bb9798
mov r15d, 0x20
mov r10d, 0x6c63a3e
mov ebp, 0x38446867
xor r8d, r8d
mov r13d, 0xb545741d
mov r11d, r9d
mov edx, r9d
shl edx, 4
add edx, dword [rsp + 0xc]
lea edi, [r11 + rbp]
mov ebx, edx
not ebx
mov r9d, 0x4aba8be2
and ebx, r9d
and edx, r13d
or edx, ebx
mov esi, r12d
sub esi, r11d
and esi, r9d
and edi, r13d
or edi, esi
xor edi, edx
mov edx, r11d
shr edx, 5
add edx, dword [rsp + 8]
mov ebx, edi
not ebx
mov esi, 0xf939c5c1
and ebx, esi
and edi, r10d
or edi, ebx
mov ebx, edx
not ebx
and ebx, esi
and edx, r10d
or edx, ebx
xor edx, edi
add eax, edx
mov edx, eax
neg edx
shl edx, 4
mov ebx, dword [rsp + 4]
sub ebx, edx
lea edx, [rax + rbp]
mov esi, r12d
sub esi, eax
and esi, ebx
not ebx
and ebx, edx
or esi, ebx
mov r9d, eax
shr r9d, 5
add r9d, dword [rsp]
mov edx, esi
not edx
and edx, r9d
not r9d
and r9d, esi
or r9d, edx
add r9d, r11d
mov edx, 0x38446867
add r14d, edx
inc r8d
add r12d, 0xc7bb9799
add ebp, edx
dec r15d
jne 0x422c2f
mov edx, dword [0x00448314]
mov ebp, dword [0x00448310]
lea ebx, [rdx - 1]
imul ebx, edx
mov edx, ebx
xor edx, 0xfffffffe
test edx, ebx
setne r8b
sete r10b
cmp ebp, 9
setg bl
cmp ebp, 0xa
setl dl
xor dl, r10b
jne 0x422d1d
or bl, r8b
xor bl, 1
je 0x422d4b
mov dword [rcx], eax
mov dword [rcx + 4], r9d
mov edx, dword [0x00448314]
lea ebp, [rdx - 1]
imul ebp, edx
mov edx, ebp
xor edx, 0xfffffffe
test edx, ebp
sete dl
cmp dword [0x00448310], 0xa
setl bl
test bl, dl
jne 0x422d53
xor bl, dl
jne 0x422d53
mov dword [rcx], eax
mov dword [rcx + 4], r9d
jmp 0x422d1d
add rsp, 0x10
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140001400
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140001433
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140001477
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x140001472
cmp rbx, r11
jae 0x140001477
add edi, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x140001460
cmp rbx, r11
jb 0x14000147b
xor eax, eax
jmp 0x140001487
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400023b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdx, rcx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x1400023eb
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400023e9
mov al, 1
jmp 0x1400023eb
xor al, al
add rsp, 0x30
pop rdi
ret
Function at 0x1400041e0
Capabilities:
Accept command line arguments

Disassembly:
push rdi
sub rsp, 0xa0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xb0], rbx
mov edi, ecx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rbx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
xor r9d, r9d
mov r8, rbx
xor edx, edx
call fcn.1400070e4
test eax, eax
jne 0x140004237
lea rcx, str.Fatal_Error:_MFC_initialization_failed_n
call fcn.1400168e8
mov ebx, 1
jmp 0x140004315
cmp edi, 6
jae 0x140004243
xor eax, eax
jmp 0x140004317
lea rcx, [rsp + 0x30]
call fcn.140001b00
nop
xor edi, edi
mov dword [rsp + 0x78], edi
mov qword [rsp + 0x80], rdi
lea rcx, str.difxapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x80], rax
test rax, rax
je 0x1400042d1
mov ebx, 1
mov dword [rsp + 0x78], ebx
lea rdx, str.DriverPackageInstallW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x88], rax
lea rdx, str.DriverPackagePreinstallW
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x90], rax
lea rdx, str.DIFXAPISetLogCallbackW
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x98], rax
lea rcx, [rsp + 0x30]
call fcn.1400028c0
lea rcx, [rsp + 0x30]
call fcn.140001d70
nop
lea rcx, [rsp + 0x30]
call fcn.140002f70
mov ebx, edi
cmp eax, 1
sete bl
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14000430b
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [rsp + 0x30]
call fcn.140002270
mov eax, ebx
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
Function at 0x140006270
Capabilities:
Get geographical location

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x2f0
mov rax, qword [0x1400381f8]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov eax, r8d
mov rsi, rdx
mov rbx, rcx
cmp r8d, 0x800
jne 0x1400062e2
lea r8, [0x14002a338]
lea rcx, [rsp + 0xa0]
mov edx, 4
call fcn.14001731c
test eax, eax
je 0x140006304
cmp eax, 0xc
je 0x1400062dc
cmp eax, 0x16
je 0x1400062d6
cmp eax, 0x22
je 0x1400062d6
cmp eax, 0x50
je 0x140006304
call fcn.1400047a0
int3
call fcn.1400047a0
int3
call fcn.140004758
int3
mov r9d, 4
lea r8, [rsp + 0xa0]
mov ecx, eax
lea edx, [r9 - 1]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140006427
call fcn.140017e28
mov edi, dword [rax]
call fcn.140017e28
lea rcx, [rsp + 0xb0]
and dword [rax], 0
lea rax, [rsp + 0xa0]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov esi, 0x112
lea r8d, [rsi - 1]
mov rdx, rsi
call fcn.140017dbc
mov ebx, eax
call fcn.140017e28
cmp dword [rax], 0
je 0x14000638c
call fcn.140017e28
cmp dword [rax], 0
je 0x140006393
cmp dword [rax], 0xc
je 0x140006381
cmp dword [rax], 0x16
je 0x140006376
cmp dword [rax], 0x22
je 0x140006376
cmp dword [rax], 0x50
je 0x140006393
mov ecx, 0x80004005
call fcn.1400017b0
int3
mov ecx, 0x80070057
call fcn.1400017b0
int3
mov ecx, 0x8007000e
call fcn.1400017b0
int3
call fcn.140017e28
mov dword [rax], edi
cmp ebx, 0xffffffff
je 0x140006427
cmp ebx, esi
jae 0x140006427
lea rcx, [rsp + 0xb0]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
xor edx, edx
lea rcx, [rsp + 0x34]
lea r8d, [rdx + 0x6c]
mov rbx, rax
mov dword [rsp + 0x30], 0x70
call fcn.140017fd0
lea rcx, str.KERNEL32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006412
lea rdx, str.FindActCtxSectionStringW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140006412
lea rcx, [rsp + 0x30]
xor edx, edx
mov r9, rbx
mov qword [rsp + 0x20], rcx
lea r8d, [rdx + 2]
xor ecx, ecx
call rax
mov rcx, rbx
test eax, eax
jne 0x14000641a
lea rcx, [rsp + 0xb0]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x140006429
xor eax, eax
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.140015f60
add rsp, 0x2f0
pop rdi
pop rsi
pop rbx
ret

Function at 0x14000dea0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.14000ca64
mov rsi, rax
test rax, rax
je 0x14000df1c
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
test rbx, rbx
je 0x14000df17
cmp dword [rbx], 0x40
jb 0x14000df17
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x14000df17
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x14000df20
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140016848
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.14001add8
nop
cmp dword [0x14003d558], 1
je 0x1400167f4
mov dword [0x14003d554], 1
mov byte [0x14003d550], r12b
test ebx, ebx
jne 0x1400167e0
mov rcx, qword [0x14003f920]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400167cd
mov rcx, qword [0x14003f918]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x14001676c
call fcn.14001a608
cmp qword [rdi], rax
jne 0x14001676c
jmp 0x140016752
cmp rdi, rsi
jb 0x1400167cd
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.14001a608
mov qword [rdi], rax
call rbx
mov rcx, qword [0x14003f920]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x14003f918]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x1400167ab
cmp r13, rax
je 0x1400167cb
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x140016752
lea rdx, [0x1400298c0]
lea rcx, [0x1400298a8]
call fcn.14001659c
lea rdx, [0x1400298d0]
lea rcx, [0x1400298c8]
call fcn.14001659c
nop
test r12d, r12d
je 0x140016803
mov ecx, 8
call fcn.14001acd8
test r12d, r12d
jne 0x14001682e
mov dword [0x14003d558], 1
lea ecx, [r12 + 8]
call fcn.14001acd8
mov ecx, r15d
call fcn.140016530
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400166bc

Function at 0x140016854
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1400166bc