joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1600098fc
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
and ebx, 1
je 0x160001e68
sub ecx, 0x6780b29c
add edx, 0x9cdbef06
add edi, 0x3d1f1094
add ecx, 0xd84a8edf
rcr edi, 0x8e
fdiv dword [rcx]
iretd
jmp 0x1600046e4

Function at 0x160009cd0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
or eax, 0xd301cb01
add ebx, esi
and ebx, 0x200
je 0x160002a28
rol eax, 0x14
xor ebx, 0x7a6a0514
sub ecx, 0xbbccd892
add edx, 0x88ef1759
add ebx, eax
add ebx, esi
add ebx, edx
and ebx, 0x400
je 0x160005b81
ror edi, 0x18
sub edx, 0x4512c4ac
xor edx, eax
add ebx, edi
add ebx, ecx
add ebx, edx
and ebx, 4
je 0x160009ec5
rol edx, 0xf
add ecx, 0xc469a3d9
xor esi, ebx
sub eax, 0xbbe840d9
add esi, 0x16f8d22a
jmp 0x160001efc
add dword [rbp - 0x20], 0xa7baffd8
xor ebx, dword [rbp - 0x20]
xor edx, 0x1724cafb
rol ecx, 0x1a
xor edx, 0xf089f929
add ebx, ecx
add ebx, eax
and ebx, 0x2000
je 0x160006d20
add edx, 0x3a0ce4ea
rol eax, 4
ror ecx, 2
add ecx, 0xbf3a1c90
add ebx, 0x5ee4753
out dx, al
add eax, 0xcb01d301
and ebx, 4
je 0x160005182
sub ebx, 0x582ae623
xor eax, esi
ror ebx, 0x1c
add ebx, edx
add ebx, edi
add ebx, ecx
and ebx, 0x400
je 0x16000605a
ror ecx, 0xa
add edi, 0x659590d4
ror esi, 0xa
jmp 0x160005422
invalid

Function at 0x160009d70
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x20], 0xe1693541
xor ebx, dword [rbp - 0x20]
xor ecx, 0x111ab383
add esi, 0xf8b66681
add ecx, 0x888d2b15
add edi, 0x2194d4ba
add ebx, ecx
add ebx, edi
add ebx, esi
and ebx, 0x20000
je 0x160008454
sub eax, 0xf03b186e
xor ecx, esi
ror ecx, 0x12
xor ebx, 0x2e9814f2
rol eax, 0xd
add ebx, eax
add ebx, ecx
add ebx, edx
and ebx, 0x20000000
je 0x160009ec5
add ecx, 0xb9f0b162
sub ecx, 0x5668ed75
rol esi, 0xc
rol eax, 0x13
add ebx, ecx
add ebx, edx
and ebx, 0x4000000
je 0x160009d40
xor edx, edi
ror edi, 0x13
add eax, 0x45cbbd3b
rol ebx, 0xb
rol edx, 0xd
jmp 0x160005cfb
mov byte [0x15b02879c], 0x81
jrcxz 0x16000949d
add byte [rax], dl
add byte [rdi], cl
test byte [rdi], cl
test al, 0xff
inc dword [rcx + 0x4a0102e9]
in al, dx
ror ecx, 0xc
xor esi, 0x17fd5d9
add ebx, edx
add ebx, eax
and ebx, 0x8000
je 0x16000723d
ror esi, 0x12
sub ebx, 0x6171941b
sub esi, 0xc4b3c89b
jmp 0x1600063e0
add dword [rbp - 0x20], 0xc3b14ba8
xor ebx, dword [rbp - 0x20]
rol ebx, 2
rol eax, 4
sub edx, 0x5d9c4596
add edx, 0xe54424cd
add edx, 0xd23b37ad
add ebx, ecx
add ebx, edi
add ebx, esi
and ebx, 0x20
je 0x1600042e8
ror ebx, 0xb
rol edx, 0x1b
sub eax, 0x374806d1
add ebx, 0x6210e06b
rol edx, 0x10
add ebx, esi
add ebx, edx
and ebx, 0x8000000
je 0x160003301
rol esi, 0x19
xor ecx, dword [rbp - 0x20]
ror esi, 3
add ebx, edi
add ebx, eax
add ebx, esi
and ebx, 0x10000000
je 0x160005b81
sub esi, 0xbf9d5b3f
xor edx, esi
add edi, 0x761b0806
jmp 0x1600023d8
Function at 0x16000a490
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x20], 0xb0c347f5
xor ebx, dword [rbp - 0x20]
add edi, 0x4bef2e
add edi, 0x2ce02119
xor ebx, 0x68556a56
sub eax, 0x5d6595b4
add edi, 0xc6d84284
add ebx, esi
add ebx, ecx
and ebx, 0x10000
je 0x160008c66
add eax, 0x86911a24
ror ebx, 0x14
add esi, 0xc52a161c
xor eax, edi
add ebx, ecx
add ebx, eax
and ebx, 0x80000000
je 0x160002eca
ror eax, 0x1f
sub esi, 0x6dd95b4a
sub ebx, 0x5c32639c
rol eax, 9
sub edi, 0xfe2e3d9f
add ebx, edi
add ebx, edx
and ebx, 0x10000000
je 0x160003aa7
rol eax, 7
sub esi, 0x6b3f59e3
ror ecx, 7
sub edi, 0xdf0eb2f1
jmp 0x160001ffe
add dword [rbp - 0x20], 0x83e6199e
xor ebx, dword [rbp - 0x20]
ror esi, 0xa
ror esi, 8
sub esi, 0xf7d0659
xor eax, 0xe2396e2e
add ebx, edi
add ebx, eax
add ebx, ecx
and ebx, 0x10
je 0x160003152
add edx, 0x8c82d814
rol edx, 0xa
xor ecx, 0xc15aa761
rol ecx, 0x1d
rol esi, 7
add ebx, edi
add ebx, esi
add ebx, eax
and ebx, 0x10000000
je 0x160009338
add ecx, 0x423f9075
sub eax, 0x987e252a
xor eax, esi
add ebx, edi
add ebx, edx
add ebx, esi
and ebx, 0x8000
je 0x160003aa7
add esi, 0xcfebb436
xor esi, 0x98b641c9
add ecx, 0xd653a1da
add edi, 0x5dcbd87e
jmp 0x160002459
add dword [rbp - 0x20], 0xb98369e6
xor ebx, dword [rbp - 0x20]
rol ecx, 7
ror edx, 0x11
ror edx, 0xa
add eax, 0x1b5c46dd
add ebx, edx
add ebx, ecx
add ebx, esi
and ebx, 0x100000
je 0x160003301
ror edx, 0x10
ror edi, 0x1a
ror edi, 3
add ebx, edi
add ebx, esi
and ebx, 0x200000
je 0x160009816
add esi, 0x28df7b28
ror edi, 0x14
sub edi, 0xc24755e7
xor ebx, 0x12632e55
jmp 0x160007570

Function at 0x16000a4cc
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x20], 0xc1c8bae5
xor ebx, dword [rbp - 0x20]
sub ecx, 0x94ca0dc9
ror eax, 0x16
xor edx, ecx
ror ecx, 2
rol esi, 0x19
add ebx, eax
add ebx, esi
add ebx, edx
and ebx, 2
je 0x1600096e3
add edx, 0x732558be
ror edi, 5
xor ebx, 0x5eaa0463
ror eax, 8
add ebx, eax
add ebx, edx
and ebx, 0x400
je 0x1600034c6
ror eax, 0x11
rol eax, 3
rol eax, 0xd
rol esi, 0xb
xor edx, dword [rbp - 0x20]
add ebx, edi
add ebx, ecx
and ebx, 0x40000
je 0x160005cfb
add edi, 0xc7d245a2
xor esi, 0x1282af0a
rol ebx, 0x11
add edi, 0xc11d5d54
jmp 0x16000288b
rol eax, 0xd
add ebx, ecx
add ebx, edx
and ebx, 0x4000000
je 0x160006b52
rol eax, 0xe
rol ebx, 0x1b
xor ebx, 0xcb4719fd
rol ebx, 0x12
add edi, 0x35f26c95
add ebx, ecx
add ebx, edi
and ebx, 0x10000000
je 0x160005743
xor ebx, 0x27bedea1
sub ebx, 0x6772d4f0
ror ecx, 0x15
add ebx, ecx
add ebx, esi
add ebx, edx
and ebx, 1
je 0x160006bd7
add ebx, 0xf0441141
sub edx, 0x2f216b64
add ecx, 0x6da03afe
rol edx, 0x1c
sub edx, 0xd58382a2
jmp 0x1600068e4

Function at 0x16000a5b0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add eax, 0x1fb54093
xor edi, dword [rbp - 0x18]
rol edi, 5
add ecx, 0x78b725ee
xor edx, 0x87ff2a95
jmp 0x1600069e9
Function at 0x16000a830
Capabilities:
Encode data using xor

Disassembly:
pop rbx
sub rbx, 0xa81c
mov qword [rbp - 0x20], rbx
sub rsp, 0x40
mov rax, qword [rbp - 0x30]
lea r9, [rbp - 0x40]
mov rdx, 0xd000
mov rcx, qword [rbp - 0x20]
add rcx, 0x29ed38
mov r8, 0x40
call rax
add rsp, 0x40
mov rax, qword [rbp - 0x20]
add rax, 0x29ed38
push 0xffffffffd05c09c7
pop rdi
mov rdx, 0xd000
mov ecx, dword [rax]
rol ecx, 0x1a
add ecx, 0xebd5e000
xor ecx, edi
add ecx, edx
sub ecx, edi
rol ecx, 0
rol ecx, 0x14
rol ecx, 6
mov dword [rax], ecx
add rax, 4
sub rdx, 4
cmp edx, 0
ja 0x16000a87f
mov rdx, qword [rbp - 0x20]
add rdx, 0x29ed38
call rdx
mov dword [rsp + 0x18], esi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 8]
mov r11, rcx
movabs rcx, 0x7fffffffffffffe
mov rdi, rdx
cmp rax, rcx
jae 0x1600a21ba
mov r10, qword [rsp + 0x58]
inc rax
mov qword [r11 + 8], rax
mov qword [r10 + 8], r9
mov rax, qword [r11]
cmp r9, rax
jne 0x1600a21d1
mov qword [rax + 8], r10
mov rax, qword [r11]
mov qword [rax], r10
mov rax, qword [r11]
mov qword [rax + 0x10], r10
mov rax, qword [r10 + 8]
mov r9, r10
cmp byte [rax + 0x18], 0
je 0x1600a2203
mov rax, qword [r11]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rcx, qword [rax + 8]
mov rax, rdi
mov qword [rdi], r10
mov byte [rcx + 0x18], 1
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rsp + 0x58]
call fcn.160031c48
lea rcx, str.map_set_T__too_long
call fcn.16006dfa0
int3
test r8b, r8b
je 0x1600a21ed
mov qword [r9], r10
mov rax, qword [r11]
cmp r9, qword [rax]
jne 0x16000a90e
mov qword [rax], r10
jmp 0x16000a90e
mov qword [r9 + 0x10], r10
mov rax, qword [r11]
cmp r9, qword [rax + 0x10]
jne 0x16000a90e
jmp 0x16000a90a
mov rdx, qword [r9 + 8]
mov rsi, r9
mov rbp, r9
mov rcx, qword [rdx + 8]
mov rax, qword [rcx]
cmp rdx, rax
jne 0x1600a2268
mov rax, qword [rcx + 0x10]
cmp byte [rax + 0x18], 0
je 0x1600a22b5
mov rbx, qword [rdx + 0x10]
cmp r9, rbx
jne 0x1600a2238
mov rcx, r11
call fcn.1601af728
mov r9, rdx
cmp rbp, rbx
cmovne r9, rsi
mov rax, qword [r9 + 8]
mov byte [rax + 0x18], 1
mov rax, qword [r9 + 8]
mov rcx, qword [rax + 8]
mov byte [rcx + 0x18], 0
mov rcx, r11
mov rdx, qword [r9 + 8]
mov rdx, qword [rdx + 8]
call fcn.16018ce68
jmp 0x1600a22ac
cmp byte [rax + 0x18], 0
je 0x1600a22b5
mov rbx, qword [rdx]
cmp r9, rbx
jne 0x1600a227e
mov rcx, r11
call fcn.16018ce68
mov r9, rdx
cmp rsi, rbx
cmovne r9, rsi
mov rax, qword [r9 + 8]
mov byte [rax + 0x18], 1
mov rax, qword [r9 + 8]
mov rcx, qword [rax + 8]
mov byte [rcx + 0x18], 0
mov rcx, r11
mov rdx, qword [r9 + 8]
mov rdx, qword [rdx + 8]
call fcn.1601af728
mov rax, qword [r9 + 8]
jmp 0x16000a915
mov byte [rdx + 0x18], 1
mov byte [rax + 0x18], 1
mov rax, qword [r9 + 8]
mov rcx, qword [rax + 8]
mov byte [rcx + 0x18], 0
mov rax, qword [r9 + 8]
mov r9, qword [rax + 8]
jmp 0x1600a22ac
Function at 0x16000b5cc
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edx, dword [rcx + 0x7c]
xor al, al
mov rbx, rcx
cmp edx, 0xffffffff
je 0x16000b6cb
mov ecx, edx
cmp ecx, 0x7c
je 0x16000b6cb
cmp ecx, 0x29
je 0x16000b6bc
cmp ecx, 0x2e
je 0x16000b6f4
cmp ecx, 0x5c
je 0x1600a291a
cmp ecx, 0x5b
je 0x16000b698
cmp ecx, 0x28
je 0x16000b6d6
cmp ecx, 0x5e
je 0x16000b704
cmp ecx, 0x24
je 0x16000b71f
cmp ecx, 0x3f
je 0x1600a29bb
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x1600a29bb
cmp ecx, 0x7b
je 0x1600a29bb
cmp edx, 0x7d
je 0x1600a296f
cmp edx, 0x5d
je 0x1600a298a
movzx edx, word [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.16000bd6c
mov dil, 1
mov rcx, rbx
call fcn.16000b728
test dil, dil
je 0x16000b686
mov rcx, rbx
call fcn.16000b458
mov edx, dword [rbx + 0x7c]
mov al, 1
mov ecx, edx
cmp edx, 0xffffffff
jne 0x16000b5e9
jmp 0x16000b6cb
mov rcx, rbx
call fcn.16000b728
mov rcx, rbx
call fcn.16000b534
cmp dword [rbx + 0x7c], 0x5d
jne 0x1600a29a5
mov rcx, rbx
call fcn.16000b728
jmp 0x16000b67e
cmp dword [rbx + 0x1c], 0
mov ecx, 0x29
je 0x1600a28f6
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call fcn.16000b728
mov rcx, rbx
call fcn.16000b4e0
cmp dword [rbx + 0x7c], 0x29
mov dil, al
je 0x16000b671
jmp 0x1600a29b0
lea rcx, [rbx + 0x40]
mov edx, 5
call fcn.16000ba54
jmp 0x16000b6b2
mov edx, 2
lea rcx, [rbx + 0x40]
call fcn.16000ba54
mov rcx, rbx
call fcn.16000b728
jmp 0x16000b686
mov edx, 3
jmp 0x16000b709
cmp ecx, 0x29
jne 0x16000b5fb
test dword [rbx + 0x80], 0x10000000
jne 0x16000b5fb
mov ecx, 5
call fcn.16006dfe8
int3
mov rcx, rbx
call fcn.16000b728
test byte [rbx + 0x80], 0x80
je 0x1600a2961
cmp word [rbx + 0x78], 0x62
jne 0x1600a293c
mov edx, 4
jmp 0x16000b709
cmp word [rbx + 0x78], 0x42
jne 0x1600a2961
lea rcx, [rbx + 0x40]
mov edx, 4
call fcn.16000ba54
mov rax, qword [rbx + 0x48]
add rax, 0xc
xor dword [rax], 1
jmp 0x16000b712
mov rcx, rbx
call fcn.160193888
nop
jmp 0x16000b67e
test dword [rbx + 0x80], 0x10000000
jne 0x16000b658
mov ecx, 6
call fcn.16006dfe8
int3
test dword [rbx + 0x80], 0x10000000
jne 0x16000b661
mov ecx, 4
call fcn.16006dfe8
int3
mov ecx, 4
call fcn.16006dfe8
int3
mov ecx, 5
call fcn.16006dfe8
int3
mov ecx, 0xa
call fcn.16006dfe8
int3
Function at 0x16000ee88
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov eax, dword [0x160273a0c]
test eax, eax
jne 0x16000ef11
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x11c
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], Ordinal_290
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetVersionExW]
test eax, eax
je 0x1600a402c
mov ecx, dword [rsp + 0x30]
xor eax, eax
mov edx, dword [rsp + 0x24]
mov dword [0x160273a0c], eax
sub ecx, 1
je 0x1600a409f
cmp ecx, 1
jne 0x16000ef11
cmp edx, 5
je 0x1600a4045
cmp edx, 4
jbe 0x1600a4092
lea eax, [rcx + 0x1f]
mov dword [0x160273a0c], eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.16006e590
add rsp, 0x158
ret
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], VarUI4FromDisp
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetVersionExW]
nop
jmp 0x16000eed8
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x1600a4088
sub eax, 1
je 0x1600a406b
cmp eax, 1
je 0x1600a4061
mov eax, reloc.OLEAUT32.dll_SafeArrayLock
jmp 0x16000ef0b
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea ecx, [rdx - 0xf]
jmp 0x1600a4073
mov edx, 8
lea ecx, [rdx - 6]
xor eax, eax
cmp word [rsp + 0x134], cx
cmovae eax, edx
or eax, 4
jmp 0x16000ef0b
mov eax, 4
jmp 0x16000ef0b
mov ecx, 2
mov eax, ecx
mov dword [0x160273a0c], ecx
cmp edx, 4
jne 0x16000ef11
mov ecx, dword [rsp + 0x28]
test ecx, ecx
je 0x1600a40be
cmp ecx, 0xa
je 0x1600a40be
cmp ecx, 0x5a
jne 0x16000ef11
mov ecx, 1
mov eax, ecx
mov dword [0x160273a0c], ecx
jmp 0x16000ef11

Function at 0x16000ef6c
Capabilities:
Hash data using fnv

Disassembly:
xor r9d, r9d
movabs r8, 0xcbf29ce484222325
test rdx, rdx
je 0x16000ef9c
movzx eax, byte [r9 + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc r9
imul r8, r10
cmp r9, rdx
jb 0x16000ef7e
mov rax, r8
shr rax, 0x20
xor rax, r8
ret
Function at 0x160010bf0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x20], 0xc43adc58
xor ebx, dword [rbp - 0x20]
sub eax, 0xdbd73649
sub eax, 0xaf7fcba3
ror edx, 3
ror edx, 0xa
add ebx, ecx
add ebx, edx
and ebx, 4
je 0x160006d20
add ebx, 0x9bddb0c8
rol esi, 0xe
rol edx, 0x1d
sub edx, 0x801e72bd
rol ecx, 0x19
add ebx, eax
add ebx, edi
add ebx, ecx
and ebx, 0x800000
je 0x1600074e0
xor ecx, 0xd8cb01e2
xor ecx, 0xe15218d6
add edi, 0x98607e20
xor eax, esi
add ebx, ecx
add ebx, eax
and ebx, 0x1000
je 0x1600046e4
add eax, 0xe29839f1
ror ebx, 0x1d
xor ecx, esi
jmp 0x160002080
mov edx, 0x7a25ab84
mov ebx, 0xcc782c84
mov esi, 0x84a969bf
mov edi, 0xe2073696
mov ecx, 0x548211a5
mov rsp, rbp
sub rsp, 0x20
add dword [rbp - 0x18], 1
mov eax, dword [rbp - 0x18]
mov dword [rbp - 0x20], 0x975f4393
jmp fcn.1600030cb
add dword [rbp - 0x20], 0xecfffadf
xor ebx, dword [rbp - 0x20]
xor edi, 0xc2fa3533
rol edi, 6
ror esi, 0xb
add ebx, ecx
add ebx, edi
and ebx, 2
je 0x160003db7
sub edi, 0x670a1aa5
ror edx, 0x11
add eax, 0xfed2814c
xor ecx, 0x389da838
add ebx, edi
add ebx, edx
add ebx, esi
and ebx, 0x1000000
je 0x16000486f
add ecx, 0xde1ef84b
xor edx, dword [rbp - 0x20]
ror esi, 0xc
add ebx, esi
add ebx, edi
and ebx, 0x1000
je 0x160001e68
xor edi, 0x8304eb2d
xor esi, dword [rbp - 0x20]
ror edi, 5
sub ebx, 0x1340b3b1
xor edx, 0x13ec068
jmp 0x16000166f
add dword [rbp - 0x20], 0x33917dc8
xor ebx, dword [rbp - 0x20]
xor edi, esi
xor esi, dword [rbp - 0x18]
xor edx, dword [rbp - 0x18]
ror esi, 6
add ecx, 0x1bf346b5
add ebx, edi
add ebx, ecx
add ebx, esi
and ebx, 0x800
je 0x160005cfb
rol edx, 2
ror ebx, 0x16
sub ebx, 0x4e6a6cc9
rol eax, 0x13
add edi, 0xd1cbc737
add ebx, edx
add ebx, ecx
and ebx, 8
je 0x1600059e6
sub edi, 0x863c54c0
add edx, 0x32e763ce
rol esi, 6
ror edx, 0x1b
add ebx, eax
add ebx, esi
and ebx, 0x8000
je 0x160003cb5
ror edi, 0x17
add edx, 0xb1f57103
add edx, 0x73fae042
add esi, 0xb1db2f71
jmp 0x160001895
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp - 0x18], 0x1bf9282
jmp 0x160007b67
Function at 0x160014dd0
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 0x170]
xor ebx, ebx
mov rdi, rcx
test eax, eax
je 0x16007de0d
mov rcx, qword [rcx + 0x1e0]
lea r8, [rsp + 0x48]
xor r9d, r9d
lea rdx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x16007dde4
mov rax, qword [rsp + 0x40]
xorps xmm2, xmm2
cvtsi2sd xmm2, rax
test rax, rax
jns 0x160014e29
addsd xmm2, qword [0x1601f5e80]
mov eax, dword [rdi + 0x170]
xorps xmm0, xmm0
mulsd xmm2, qword [0x1601f5e88]
cvtsi2sd xmm0, rax
comisd xmm0, xmm2
seta bl
test dword [0x160274340], 0x400
jne 0x160014e5f
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov r9d, eax
jmp 0x16007ddfe
test dword [0x160274340], 0x400
je 0x160014e52
mov r9d, dword [rdi + 0x170]
xorps xmm2, xmm2
mov dword [rsp + 0x20], ebx
call fcn.1600fa240
nop
jmp 0x160014e52
test dword [0x160274340], 0x400
je 0x160014e52
xorps xmm2, xmm2
jmp 0x160014e5f

Function at 0x160014e68
Capabilities:
Get memory capacity

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, rcx
mov dword [rsp + 0x30], 0x38
lea rcx, [r11 - 0x48]
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_GlobalMemoryStatus]
mov rbx, qword [rsp + 0x50]
xor edi, edi
mov eax, dword [rsi + 0x168]
mov ebp, edi
shr rbx, 0xa
cmp rbx, rax
setb bpl
cmp dword [rsi + 0x140], ebp
jne 0x16007de26
mov ecx, eax
cmp rbx, rcx
setb dil
mov eax, edi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.16006e590
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
test dword [0x160274340], 0x400
je 0x16007de4e
mov r9d, eax
mov dword [rsp + 0x20], ebp
mov r8d, ebx
lea rdx, [0x1601f9518]
call fcn.1600fa408
mov eax, dword [rsi + 0x168]
mov dword [rsi + 0x140], ebp
jmp 0x160014ec6
Function at 0x160014f48
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x60
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rdi, rcx
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
sub eax, dword [rdi + 0x14c]
xor ebx, ebx
cmp eax, 0x36ee80
ja 0x16007de88
cmp byte [rdi + 0x149], bl
je 0x16007dee9
call fcn.16001639c
call fcn.1600163f0
test al, al
jne 0x16007deff
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov dword [rdi + 0x14c], eax
mov dword [rsp + 0x70], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8, str.PreventIndexOnBattery
lea rdx, str.SOFTWAREPoliciesMicrosoftWindowsWindows_Search
mov rcx, 0xffffffff80000002
call fcn.16005ac0c
mov ecx, ebx
test eax, eax
cmove ecx, dword [rsp + 0x78]
mov dword [rdi + 0x138], ecx
jmp 0x160014f78
cmp dword [rdi + 0x138], ebx
je 0x160014f84
mov ebx, 1
jmp 0x160014f96
cmp dword [rdi + 0x138], ebx
jne 0x160014f96
lea rcx, [rsp + 0x48]
call fcn.1601a1510
nop
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
cmp byte [rdi + 0x149], bl
je 0x16007df3f
mov rax, qword [rax]
call qword [case.0x16003fc5a.0]
mov rcx, qword [rsp + 0x68]
test eax, eax
jns 0x16007df67
mov edx, 0x25e
jmp 0x16007df57
mov rax, qword [rax + 8]
call qword [case.0x16003fc5a.0]
mov rcx, qword [rsp + 0x68]
test eax, eax
jns 0x16007df67
mov edx, 0x262
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_searchgathergthrsvc_backoffctrl.cxx
call fcn.160071f6c
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x160014f96
call fcn.16003fbc0
nop
jmp 0x160014f96
Function at 0x16003e6b0
Capabilities:
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, 4
mov rsi, rcx
mov rcx, qword [rcx + 0x1078]
mov edx, ebx
xor r9d, r9d
mov qword [rax - 0x18], rbx
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_MapViewOfFile]
test rax, rax
je 0x16009491d
mov edi, dword [rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_UnmapViewOfFile]
lea eax, [rdi + 4]
cmp eax, 0x2000
ja 0x160094938
mov rcx, qword [rsi + 0x1078]
xor r9d, r9d
mov ebp, eax
xor r8d, r8d
mov edx, ebx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_MapViewOfFile]
mov rbx, rax
test rax, rax
je 0x16009491d
mov rcx, qword [rsi + 0x1080]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbp
lea edx, [r9 + 2]
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_MapViewOfFile]
mov rsi, rax
test rax, rax
je 0x160094914
mov ecx, edi
mov r8d, ebp
mov rdi, rax
mov rdx, rbx
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call sub.msvcrt.dll_memcpy
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_UnmapViewOfFile]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_UnmapViewOfFile]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_UnmapViewOfFile]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x16003e782
movzx eax, ax
or eax, 0x80070000
jmp 0x16003e782
mov eax, 0x800700a0
jmp 0x16003e782
Function at 0x160041cc4
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
jl 0x160003ea1
shr dword [rbx], 0x81
call 0xea436116
rol dword [rcx], cl
sti
cmp byte [rcx + 0x18], 0
jne 0x160041ccb
ret
mov edx, dword [rcx + 0x28]
mov r9, rcx
mov byte [rcx + 0x18], 0
mov rcx, qword [rcx + 0x20]
jmp 0x160003e64

Function at 0x160044b54
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rdi, qword [rcx]
mov qword [rsp + 0x40], rdi
mov rcx, rdi
call fcn.1600454bc
nop
cmp dword [rdi + 0x70], 0
jne 0x16009623e
lea rcx, [rdi + 0x78]
call fcn.160017c44
mov rbx, rax
test rax, rax
je 0x16009624e
inc dword [rdi + 0xf4]
and dword [rax + 0x38], 0
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov dword [rbx + 0x3c], eax
mov rcx, rdi
call fcn.160045454
nop
test rbx, rbx
je 0x160044bc3
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
lea rcx, [rsp + 0x40]
call fcn.1600adc70
nop
jmp 0x160044bc3
mov eax, dword [rdi + 0xc0]
cmp eax, dword [rdi + 0xf8]
jae 0x160044bab
mov ecx, 0x40
mov rax, qword [0x1601c0fd0]
call qword [case.0x16003fc5a.0]
mov rbx, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x160096297
mov rcx, rax
call fcn.1600f7a44
lea rax, fcn.160118040
mov qword [rbx], rax
and dword [rbx + 0x38], 0
jmp 0x160096299
xor ebx, ebx
test rbx, rbx
je 0x160044bab
and dword [rbx + 0x38], 0
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov dword [rbx + 0x3c], eax
mov rcx, rbx
call fcn.160118374
test eax, eax
jns 0x1600962cf
mov edx, 1
mov rcx, rbx
call fcn.160118040
xor ebx, ebx
jmp 0x160044bab
mov rdx, rbx
call fcn.160017c7c
lea rcx, [rdi + 0xa8]
mov r8, rax
mov rdx, qword [rcx + 0x10]
call fcn.1600323a8
inc dword [rdi + 0xf4]
mov edx, dword [rdi + 0xfc]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetThreadPriority]
nop
jmp 0x160044bab
Function at 0x16005a750
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
mov r10, qword [rcx + 0xb0]
xor ebx, ebx
mov r11, r9
test r10, r10
je 0x16009c6d0
movzx ecx, r8w
call fcn.16005ab74
mov r9d, eax
xor r8d, r8d
mov eax, dword [rsp + 0x60]
mov rcx, r10
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r11
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
jne 0x16009c6d7
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov ebx, 1
mov eax, ebx
add rsp, 0x30
pop rbx
ret
mov ecx, 6
jmp 0x16009c6d9
mov ecx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop
jmp 0x16005a7a5