joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401d3548
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov r10, rdx
mov rbp, rcx
mov r15, qword [rdx + 0x10]
mov r9, rdx
cmp qword [rdx + 0x18], 8
jb 0x1401d3583
mov r9, qword [rdx]
xor esi, esi
movabs r8, 0xcbf29ce484222325
mov ecx, esi
lea rdx, [r15 + r15]
test rdx, rdx
je 0x1401d35b8
movzx eax, byte [rcx + r9]
xor r8, rax
movabs r11, 0x100000001b3
imul r8, r11
inc rcx
cmp rcx, rdx
jb 0x1401d359a
mov rax, qword [rbp + 0x30]
and rax, r8
mov r12, qword [rbp + 0x18]
mov rbx, rax
add rbx, rbx
mov rbx, qword [r12 + rbx*8]
lea r13, [rax + rax]
lea r14, [rbp + 8]
mov r11, qword [r12 + r13*8]
cmp r11, qword [r14]
jne 0x1401d35e3
mov rax, qword [r14]
jmp 0x1401d35eb
mov rax, qword [r12 + r13*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x1401d36d2
lea rcx, [rbx + 0x10]
mov rax, r10
cmp qword [r10 + 0x18], 8
jb 0x1401d3605
mov rax, qword [r10]
mov r8, rcx
cmp qword [rcx + 0x18], 8
jb 0x1401d3612
mov r8, qword [rcx]
mov rdx, qword [rcx + 0x10]
cmp rdx, r15
jne 0x1401d3642
test rdx, rdx
je 0x1401d363c
sub r8, rax
movzx ecx, word [r8 + rax]
movzx r9d, word [rax]
cmp cx, r9w
jne 0x1401d3647
add rax, 2
sub rdx, 1
jne 0x1401d3623
mov eax, esi
test eax, eax
je 0x1401d3650
mov rbx, qword [rbx]
jmp 0x1401d35d9
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x1401d363e
mov rax, rbx
mov rdi, rbx
cmp r11, qword [r14]
jne 0x1401d3660
mov rcx, qword [r14]
jmp 0x1401d3668
mov rcx, qword [r12 + r13*8 + 8]
mov rcx, qword [rcx]
cmp rbx, rcx
je 0x1401d36cd
lea rcx, [rbx + 0x10]
mov rdx, rcx
cmp qword [rcx + 0x18], 8
jb 0x1401d367e
mov rdx, qword [rcx]
mov r8, r10
cmp qword [r10 + 0x18], 8
jb 0x1401d368b
mov r8, qword [r10]
cmp r15, qword [rcx + 0x10]
jne 0x1401d36cd
mov r11, r15
test r15, r15
je 0x1401d36b5
sub r8, rdx
movzx ecx, word [r8 + rdx]
movzx r9d, word [rdx]
cmp cx, r9w
jne 0x1401d36c4
add rdx, 2
sub r11, 1
jne 0x1401d369c
mov ecx, esi
test ecx, ecx
jne 0x1401d36cd
mov rbx, qword [rbx]
mov r11, qword [r12 + r13*8]
jmp 0x1401d3656
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1401d36b7
cmp rax, rbx
jne 0x1401d36d8
mov rdi, qword [r14]
mov rbx, rdi
mov rax, rdi
cmp rdi, rbx
je 0x1401d36eb
inc rsi
mov rax, qword [rax]
cmp rax, rbx
jne 0x1401d36e0
mov rax, qword [r14]
cmp rdi, qword [rax]
jne 0x1401d3723
cmp rbx, rax
jne 0x1401d3723
mov rcx, r14
call fcn.1401c8edc
mov edx, 8
mov rcx, rbp
call fcn.140056470
nop
jmp 0x1401d3728
mov r8, rdi
mov rdi, qword [rdi]
lea rdx, [rsp + 0x60]
mov rcx, rbp
call fcn.1401cbc40
cmp rdi, rbx
jne 0x1401d3710
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1401d55ac
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov rax, qword [0x14044e770]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, r9
mov rsi, r8
mov rbx, rdx
mov r15, rcx
lea rdx, str.OrgId
lea rcx, [rbp - 0x50]
call fcn.14004a9e4
nop
lea rdi, [r15 + 0x30]
lea rdx, [rbp - 0x50]
mov rcx, rdi
call fcn.1401d6930
mov rcx, rax
mov rdx, rbx
call fcn.140061d90
nop
lea rcx, [rbp - 0x50]
call fcn.14004b500
lea rdx, str.CyberEndpoint
lea rcx, [rbp - 0x50]
call fcn.14004a9e4
nop
lea rdx, [rbp - 0x50]
mov rcx, rdi
call fcn.1401d6930
mov rcx, rax
mov rdx, rsi
call fcn.140061d90
nop
lea rcx, [rbp - 0x50]
call fcn.14004b500
lea rdx, str.VortexGeoLocation
lea rcx, [rbp - 0x50]
call fcn.14004a9e4
nop
lea rdx, [rbp - 0x50]
mov rcx, rdi
call fcn.1401d6930
mov rcx, rax
mov rdx, r14
call fcn.140061d90
nop
lea rcx, [rbp - 0x50]
call fcn.14004b500
lea rdx, str.ReadOnlyCnC
lea rcx, [rbp - 0x30]
call fcn.14004a9e4
nop
lea rcx, [r15 + 0x70]
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x50]
call fcn.1401d69e8
mov rcx, qword [rbp - 0x50]
mov eax, dword [rbp + 0x58]
mov dword [rcx + 0x30], eax
lea rcx, [rbp - 0x30]
call fcn.14004b500
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1402ae860
add rsp, 0x78
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1401d5780
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x14044e770]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x38], r8
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x40], rdx
mov r10, qword [rdx + 0x10]
mov r9, rdx
cmp qword [rdx + 0x18], 8
jb 0x1401d57cf
mov r9, qword [rdx]
movabs rdx, 0xcbf29ce484222325
xor ecx, ecx
lea r8, [r10 + r10]
test r8, r8
je 0x1401d5802
movzx eax, byte [rcx + r9]
xor rdx, rax
movabs r11, 0x100000001b3
imul rdx, r11
inc rcx
cmp rcx, r8
jb 0x1401d57e4
mov rcx, qword [rsi + 0xa0]
and rcx, rdx
mov r15, qword [rsi + 0x88]
mov rax, rcx
add rax, rax
mov rax, qword [r15 + rax*8]
lea r12, [rcx + rcx]
mov r13, qword [r15 + r12*8]
cmp r13, qword [rsi + 0x78]
jne 0x1401d5831
mov rcx, qword [rsi + 0x78]
jmp 0x1401d5839
mov rcx, qword [r15 + r12*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1401d58ea
lea rcx, [rax + 0x10]
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1401d5853
mov rdx, qword [rbx]
mov r8, rcx
mov r14, qword [rcx + 0x18]
cmp r14, 8
jb 0x1401d5863
mov r8, qword [rcx]
mov rdi, qword [rcx + 0x10]
cmp rdi, r10
jne 0x1401d5896
mov r11, rdi
test rdi, rdi
je 0x1401d5890
sub r8, rdx
movzx ecx, word [r8 + rdx]
movzx r9d, word [rdx]
cmp cx, r9w
jne 0x1401d589b
add rdx, 2
sub r11, 1
jne 0x1401d5877
xor ecx, ecx
test ecx, ecx
je 0x1401d58a4
mov rax, qword [rax]
jmp 0x1401d5825
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1401d5892
lea rcx, [rax + 0x10]
cmp r14, 8
jb 0x1401d58b1
mov rcx, qword [rcx]
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1401d58be
mov rdx, qword [rbx]
cmp r10, rdi
jne 0x1401d58ea
test r10, r10
je 0x1401d58e4
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x1401d5905
add rcx, 2
sub r10, 1
jne 0x1401d58cb
xor ecx, ecx
test ecx, ecx
je 0x1401d58ee
mov rax, qword [rsi + 0x78]
cmp rax, qword [rsi + 0x78]
je 0x1401d590e
mov ecx, dword [rax + 0x30]
mov rdx, qword [rsp + 0x38]
mov dword [rdx], ecx
mov al, 1
jmp 0x1401d5997
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1401d58e6
lea rcx, [rsp + 0x30]
call fcn.14016cf8c
nop
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
call fcn.1401d56d0
test al, al
je 0x1401d5976
lea rcx, [rsp + 0x30]
call fcn.14016d34c
test al, al
je 0x1401d5976
mov rbx, qword [rsp + 0x30]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x80]
call qword [str.PM_]
mov rdx, qword [rsp + 0x38]
mov dword [rdx], eax
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
mov rax, qword [rax + 0xc0]
call qword [str.PM_]
mov al, 1
jmp 0x1401d5997
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1401d5995
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax + 0xc0]
call qword [str.PM_]
xor al, al
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1402ae860
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401d59c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x14044e770]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x38], r8
mov rbx, rdx
mov r14, rcx
mov qword [rsp + 0x40], rdx
mov r10, qword [rdx + 0x10]
mov r8, rdx
cmp qword [rdx + 0x18], 8
jb 0x1401d5a0f
mov r8, qword [rdx]
movabs rdx, 0xcbf29ce484222325
xor ecx, ecx
lea r9, [r10 + r10]
test r9, r9
je 0x1401d5a42
movzx eax, byte [rcx + r8]
xor rdx, rax
movabs r11, 0x100000001b3
imul rdx, r11
inc rcx
cmp rcx, r9
jb 0x1401d5a24
mov rax, qword [r14 + 0x60]
and rax, rdx
mov r15, qword [r14 + 0x48]
mov rdx, rax
add rdx, rdx
mov rdx, qword [r15 + rdx*8]
lea r12, [rax + rax]
mov r13, qword [r15 + r12*8]
cmp r13, qword [r14 + 0x38]
jne 0x1401d5a6b
mov rax, qword [r14 + 0x38]
jmp 0x1401d5a73
mov rax, qword [r15 + r12*8 + 8]
mov rax, qword [rax]
cmp rdx, rax
je 0x1401d5b24
lea rax, [rdx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1401d5a8d
mov rcx, qword [rbx]
mov r8, rax
mov rsi, qword [rax + 0x18]
cmp rsi, 8
jb 0x1401d5a9d
mov r8, qword [rax]
mov rdi, qword [rax + 0x10]
cmp rdi, r10
jne 0x1401d5ad0
mov r11, rdi
test rdi, rdi
je 0x1401d5aca
sub r8, rcx
movzx eax, word [rcx + r8]
movzx r9d, word [rcx]
cmp ax, r9w
jne 0x1401d5ad5
add rcx, 2
sub r11, 1
jne 0x1401d5ab1
xor eax, eax
test eax, eax
je 0x1401d5ade
mov rdx, qword [rdx]
jmp 0x1401d5a5f
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x1401d5acc
lea rax, [rdx + 0x10]
cmp rsi, 8
jb 0x1401d5aeb
mov rax, qword [rax]
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1401d5af8
mov rcx, qword [rbx]
cmp r10, rdi
jne 0x1401d5b24
test r10, r10
je 0x1401d5b1e
sub rcx, rax
movzx r8d, word [rax + rcx]
movzx r9d, word [rax]
cmp r8w, r9w
jne 0x1401d5b43
add rax, 2
sub r10, 1
jne 0x1401d5b05
xor eax, eax
test eax, eax
je 0x1401d5b28
mov rdx, qword [r14 + 0x38]
cmp rdx, qword [r14 + 0x38]
je 0x1401d5b4c
add rdx, 0x30
mov rcx, qword [rsp + 0x38]
call fcn.140061d90
mov al, 1
jmp 0x1401d5bf7
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x1401d5b20
lea rcx, [rsp + 0x30]
call fcn.14016cf8c
nop
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, r14
call fcn.1401d56d0
test al, al
je 0x1401d5bd3
mov rbx, qword [rsp + 0x30]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x58]
call qword [str.PM_]
cmp eax, 2
jne 0x1401d5bc2
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0xb0]
call qword [str.PM_]
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call fcn.140061d90
nop
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
mov rax, qword [rax + 0xc0]
call qword [str.PM_]
mov al, 1
jmp 0x1401d5bf7
jmp 0x1401d5bd8
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x1401d5bf5
mov rax, qword [rbx]
mov rcx, rbx
mov edx, 1
mov rax, qword [rax + 0xc0]
call qword [str.PM_]
xor al, al
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1402ae860
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401d63a4
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov rax, qword [0x14044e770]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rdx
lea rcx, [rbp - 0x51]
lea rdx, str.SOFTWAREMicrosoftWindows_Advanced_Threat_Protection
call fcn.14004a9e4
lea rdx, [0x140308ab0]
lea rcx, [rbp - 0x71]
call fcn.14004a9e4
mov rdx, qword [rdi]
lea r8, [rbp - 0x51]
add rdx, 0xe0
mov byte [rsp + 0x20], 1
mov r9b, 1
lea rcx, [rbp - 0x71]
call fcn.1401c61ac
lea rcx, [rbp - 0x71]
mov ebx, eax
call fcn.14004b500
lea rcx, [rbp - 0x51]
call fcn.14004b500
or r14, 0xffffffffffffffff
xor esi, esi
test ebx, ebx
jns 0x1401d6511
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rbp - 0x79], eax
call fcn.14004acb4
mov r10, qword [rax + 8]
cmp dword [r10], 2
jbe 0x1401d6511
mov r9, qword [rdi]
lea rax, [rbp - 0x79]
mov qword [rbp - 9], rax
lea rax, str.Failed_to_persist_the_successfully_applied_configuration_command
mov qword [rbp + 7], rax
mov qword [rbp - 1], 4
lea rax, [r9 + 0xa0]
mov qword [rbp + 0xf], 0x82
cmp qword [rax + 0x18], 8
jb 0x1401d6483
mov rax, qword [rax]
lea rdx, [0x14030cae0]
mov rcx, rsi
mov r8, rdx
test rax, rax
je 0x1401d64a4
mov r8, rax
mov rcx, r14
inc rcx
cmp word [rax + rcx*2], si
jne 0x1401d649b
lea eax, [rcx*2 + 2]
mov qword [rbp + 0x17], r8
mov dword [rbp + 0x1f], eax
lea rax, [r9 + 0x10]
mov dword [rbp + 0x23], esi
cmp qword [rax + 0x18], 8
jb 0x1401d64c3
mov rax, qword [rax]
mov rcx, rsi
test rax, rax
je 0x1401d64da
mov rdx, rax
mov rcx, r14
inc rcx
cmp word [rax + rcx*2], si
jne 0x1401d64d1
lea eax, [rcx*2 + 2]
mov qword [rbp + 0x27], rdx
mov dword [rbp + 0x2f], eax
mov dword [rbp + 0x33], esi
lea rax, [rbp - 0x29]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x14039d1ab]
xor r8d, r8d
mov dword [rsp + 0x20], 6
mov rcx, r10
call fcn.140001158
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1401d6553
mov eax, r14d
lock xadd dword [rbx + 8], eax
add eax, r14d
jne 0x1401d6553
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [str.PM_]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
add eax, r14d
jne 0x1401d6553
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [str.PM_]
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1402ae860
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1401d69e8
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
cmp qword [r8 + 0x18], 8
mov r9, r8
mov r11, qword [r8 + 0x10]
mov rsi, rdx
mov r15, rcx
mov r10, r8
jb 0x1401d6a1e
mov r10, qword [r8]
lea rdx, [r11 + r11]
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
test rdx, rdx
je 0x1401d6a51
movzx eax, byte [rcx + r10]
movabs rbx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rbx
cmp rcx, rdx
jb 0x1401d6a33
mov rcx, qword [r15 + 0x30]
mov r12, qword [r15 + 0x18]
and rcx, r8
mov rbx, qword [r15 + 8]
mov rax, rcx
add rax, rax
lea r13, [rcx + rcx]
mov rax, qword [r12 + rax*8]
cmp qword [r12 + r13*8], rbx
jne 0x1401d6a79
mov rcx, rbx
jmp 0x1401d6a81
mov rcx, qword [r12 + r13*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1401d6b43
cmp qword [r9 + 0x18], 8
lea rcx, [rax + 0x10]
mov rdx, r9
jb 0x1401d6a9b
mov rdx, qword [r9]
mov r14, qword [rcx + 0x18]
mov r8, rcx
cmp r14, 8
jb 0x1401d6aab
mov r8, qword [rcx]
mov rbp, qword [rcx + 0x10]
cmp rbp, r11
jne 0x1401d6ade
mov rdi, rbp
test rbp, rbp
je 0x1401d6ad8
sub r8, rdx
movzx ecx, word [r8 + rdx]
movzx r10d, word [rdx]
cmp cx, r10w
jne 0x1401d6ae3
add rdx, 2
sub rdi, 1
jne 0x1401d6abf
xor ecx, ecx
test ecx, ecx
je 0x1401d6aec
mov rax, qword [rax]
jmp 0x1401d6a6e
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1401d6ada
lea rcx, [rax + 0x10]
cmp r14, 8
jb 0x1401d6af9
mov rcx, qword [rcx]
cmp qword [r9 + 0x18], 8
mov rdx, r9
jb 0x1401d6b06
mov rdx, qword [r9]
cmp r11, rbp
jne 0x1401d6b32
test r11, r11
je 0x1401d6b2c
sub rdx, rcx
movzx r8d, word [rdx + rcx]
movzx r10d, word [rcx]
cmp r8w, r10w
jne 0x1401d6b3a
add rcx, 2
sub r11, 1
jne 0x1401d6b13
xor ecx, ecx
test ecx, ecx
je 0x1401d6b35
mov rax, rbx
mov rcx, rax
jmp 0x1401d6b49
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1401d6b2e
mov rax, rbx
mov rcx, rbx
cmp rcx, rbx
jne 0x1401d6bbd
mov rbx, qword [rbx]
lea rax, [rsp + 0x60]
mov rdx, rbx
mov qword [rsp + 0x60], r9
mov qword [rsp + 0x20], rax
mov rdi, qword [rbx + 8]
mov r8, rdi
call fcn.1401d6ca8
mov rdx, rax
movabs rcx, 0x492492492492491
mov rax, qword [r15 + 0x10]
sub rcx, rax
cmp rcx, 1
jae 0x1401d6b97
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov rcx, r15
mov qword [r15 + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [rdi], rdx
mov rdx, rsi
mov r9, qword [r15 + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.1401d3bb4
jmp 0x1401d6bc4
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov rbx, qword [rsp + 0x68]
mov rax, rsi
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1401d8900
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rax - 0x10], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rbx, rdx
mov rdi, rcx
and dword [rax - 0x18], 0
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x1401d8933
mov rcx, qword [rdx]
xor edx, edx
call qword [sym.imp.api_ms_win_core_version_l1_1_1.dll_GetFileVersionInfoSizeW]
mov esi, eax
test eax, eax
sete dl
mov rcx, qword [rsp + 0x48]
lea rax, str.Could_not_read_file_version_info
mov qword [rsp + 0x20], rax
movzx r9d, dl
lea r8, str.amcorewcd_sourcecommon_src_versioninfo.cpp
mov edx, 0x7a
call fcn.1401d86f8
mov ecx, esi
call fcn.1402b45f8
mov qword [rdi], rax
mov dword [rsp + 0x30], 1
cmp qword [rbx + 0x18], 8
jb 0x1401d8984
mov rbx, qword [rbx]
mov r9, rax
mov r8d, esi
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_version_l1_1_1.dll_GetFileVersionInfoW]
mov rcx, qword [rsp + 0x48]
lea rdx, str.Could_not_retrieve_file_version_info
mov qword [rsp + 0x20], rdx
mov r9d, eax
lea r8, str.amcorewcd_sourcecommon_src_versioninfo.cpp
mov edx, 0x83
call fcn.14004a6bc
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1401dea64
Capabilities:
Terminate process

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x14044e770]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov dword [rbp - 0x29], edx
mov edi, r8d
xor edx, edx
mov dword [rbp - 0x39], ecx
mov r8d, ecx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x1401deb2c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
call fcn.14004acb4
mov rcx, qword [rax + 8]
cmp dword [rcx], 3
jbe 0x1401deb1a
and dword [rbp + 0x13], 0
lea rax, str.Failed_to_get_process_handle._TerminateProcess_failed.
and dword [rbp + 0x23], 0
mov edx, 4
and dword [rbp + 0x33], 0
mov qword [rbp + 7], rax
lea rax, [rbp - 0x39]
mov qword [rbp + 0x17], rax
lea rax, [rbp - 0x31]
mov qword [rbp + 0x27], rax
mov dword [rbp + 0xf], 0x37
mov dword [rbp + 0x1f], edx
mov dword [rbp - 0x31], ebx
mov dword [rbp + 0x2f], edx
lea rax, [rbp - 0x19]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x14039d523]
xor r8d, r8d
mov dword [rsp + 0x20], 5
call fcn.140001158
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x1401dec3b
mov edx, edi
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
test eax, eax
jne 0x1401debb5
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
call fcn.14004acb4
mov rcx, qword [rax + 8]
cmp dword [rcx], 3
jbe 0x1401deb1a
and dword [rbp + 0x13], 0
lea rax, [0x14032f080]
and dword [rbp + 0x23], 0
mov edx, 4
and dword [rbp + 0x33], 0
mov qword [rbp + 7], rax
lea rax, [rbp - 0x39]
mov qword [rbp + 0x17], rax
lea rax, [rbp - 0x31]
mov qword [rbp + 0x27], rax
mov dword [rbp + 0xf], CreateCompressor
mov dword [rbp + 0x1f], edx
mov dword [rbp - 0x31], ebx
mov dword [rbp + 0x2f], edx
lea rax, [rbp - 0x19]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x14039d523]
xor r8d, r8d
mov dword [rsp + 0x20], 5
call fcn.140001158
jmp 0x1401deb1a
mov edx, dword [rbp - 0x29]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1401dec39
call fcn.14004acb4
mov rcx, qword [rax + 8]
cmp dword [rcx], 3
jbe 0x1401dec32
and dword [rbp + 0x13], 0
lea rax, str.Process_did_not_end_after_termination
and dword [rbp + 0x23], 0
mov edx, 4
and dword [rbp + 0x33], 0
mov qword [rbp + 7], rax
lea rax, [rbp - 0x39]
mov qword [rbp + 0x17], rax
lea rax, [rbp - 0x29]
mov qword [rbp + 0x27], rax
mov dword [rbp + 0xf], 0x26
mov dword [rbp + 0x1f], edx
mov dword [rbp + 0x2f], edx
lea rax, [rbp - 0x19]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x14039d55f]
xor r8d, r8d
mov dword [rsp + 0x20], 5
call fcn.140001158
mov eax, 0x800705b4
jmp 0x1401dec3b
xor eax, eax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1402ae860
add rsp, 0xb0
pop rdi
pop rbx
pop rbp
ret
Function at 0x1401e0e30
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbx, rcx
lea rax, vtable.sense::Common::MSAClient.0
mov qword [rcx], rax
xor esi, esi
mov dword [rcx + 8], esi
mov qword [rcx + 0x30], rsi
lea eax, [rsi + 7]
mov qword [rcx + 0x38], rax
mov word [rcx + 0x20], si
mov qword [rcx + 0x50], rsi
mov qword [rcx + 0x58], rax
mov word [rcx + 0x40], si
mov qword [rcx + 0xa0], rsi
mov qword [rcx + 0xa8], rax
mov word [rcx + 0x90], si
or rax, 0xffffffffffffffff
mov dword [rcx + 0xb0], eax
mov qword [rcx + 0xb8], rax
mov dword [rsp + 0x70], esi
mov byte [rcx + 0x60], sil
add rcx, 0x68
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [rbx + 0x60], 1
lea rdi, [rbx + 0x18]
mov dword [rdi], esi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
mov r9, rbx
lea r8, [0x1401e0fc0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x1401e0f05
jmp 0x1401e0ef4
or r9d, 0xffffffff
mov r8d, 4
lea rdx, [rsp + 0x70]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitOnAddress]
mov eax, dword [rdi]
test eax, eax
je 0x1401e0edc
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [rsp + 0x68], ecx
lea rdx, [0x14042fbd8]
lea rcx, [rsp + 0x68]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
Function at 0x1401e3768
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
cmp qword [rcx + 0x18], 8
jb 0x1401e3781
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401e37a5
test al, 0x10
je 0x1401e37a5
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x1401e379d
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1401e37b8
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x1401e37b2
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1401e37f1
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
lea edx, [rax - 2]
cmp edx, 1
jbe 0x1401e37f1
cmp qword [rbx + 0x18], 8
jb 0x1401e37d6
mov rbx, qword [rbx]
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1401e37f1
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1401e535c
Capabilities:
Check if file exists
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14044e770]
xor rax, rsp
mov qword [rbp - 0x10], rax
movdqa xmm0, xmmword [0x14034f9a0]
lea r8, [rbp - 0x30]
xor edi, edi
lea rdx, [rbp - 0x50]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], di
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], di
call fcn.1401ef6c4
cmp qword [rbp - 0x38], 8
lea rcx, [rbp - 0x50]
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFileExistsW]
test eax, eax
jne 0x1401e53ed
cmp qword [rbp - 0x38], 8
lea rcx, [rbp - 0x50]
cmovae rcx, qword [rbp - 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1401e53ed
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1401e53ef
mov ebx, edi
lea rcx, [rbp - 0x30]
call fcn.14004b500
lea rcx, [rbp - 0x50]
call fcn.14004b500
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1402ae860
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret