joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401ac060
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x178
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x140310170]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov dword [rsp + 0x20], 0
call fcn.1401ac2e0
movzx eax, al
test eax, eax
je 0x1401ac0ad
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
jmp 0x1401ac0bd
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.1401ad220
nop
mov rdx, qword [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.1401aedf0
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
lea rax, [rsp + 0x30]
xor r8d, r8d
mov dl, 1
mov rcx, rax
call fcn.1401823d0
nop
mov rax, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1401ef4e0
add rsp, 0x178
ret

Function at 0x1401ac124
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x110
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x140310170]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x60], 0
lea rax, [rsp + 0x64]
mov rdi, rax
xor eax, eax
mov ecx, 0x98
rep stosb byte [rdi], al
mov dword [rsp + 0x60], 0x9c
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
lea rdx, [0x1402538b8]
lea rcx, [rsp + 0x38]
call fcn.14004c200
nop
cmp dword [rsp + 0x64], 4
ja 0x1401ac1af
lea rdx, str.WinNT4.0
lea rcx, [rsp + 0x38]
call fcn.14004c7f0
jmp 0x1401ac257
cmp dword [rsp + 0x64], 5
jne 0x1401ac204
cmp dword [rsp + 0x68], 0
jne 0x1401ac1d0
lea rdx, str.Win2000
lea rcx, [rsp + 0x38]
call fcn.14004c7f0
jmp 0x1401ac202
cmp dword [rsp + 0x68], 1
jne 0x1401ac1ea
lea rdx, str.WinXP
lea rcx, [rsp + 0x38]
call fcn.14004c7f0
jmp 0x1401ac202
cmp dword [rsp + 0x68], 2
jb 0x1401ac202
lea rdx, str.Server2003
lea rcx, [rsp + 0x38]
call fcn.14004c7f0
jmp 0x1401ac257
cmp dword [rsp + 0x64], 6
jne 0x1401ac257
cmp dword [rsp + 0x68], 0
jne 0x1401ac225
lea rdx, str.Vista
lea rcx, [rsp + 0x38]
call fcn.14004c7f0
jmp 0x1401ac257
cmp dword [rsp + 0x68], 1
jne 0x1401ac23f
lea rdx, str.Win7
lea rcx, [rsp + 0x38]
call fcn.14004c7f0
jmp 0x1401ac257
cmp dword [rsp + 0x68], 2
jne 0x1401ac257
lea rdx, str.Win8
lea rcx, [rsp + 0x38]
call fcn.14004c7f0
call fcn.1401ac2e0
movzx eax, al
test eax, eax
je 0x1401ac271
lea rax, [0x1402536dc]
mov qword [rsp + 0x28], rax
jmp 0x1401ac27d
lea rax, [0x1402536fc]
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x38]
call fcn.14004fee0
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x120]
call fcn.14004c1c0
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x38]
call fcn.14004c760
nop
mov rax, qword [rsp + 0x120]
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1401ef4e0
add rsp, 0x110
pop rdi
ret
Function at 0x1401ac35c
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x190
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x140310170]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov dword [rsp + 0x44], 0
lea rdx, [0x140253665]
lea rcx, [rsp + 0x98]
call fcn.14004c200
nop
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x3c], 0
lea rcx, [0x140253b58]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.GlobalMemoryStatusEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1401ac44d
mov dword [rsp + 0xc0], 0
lea rax, [rsp + 0xc4]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WLDAP32.dll_Ordinal_60
rep stosb byte [rdi], al
mov dword [rsp + 0xc0], 0x40
lea rcx, [rsp + 0xc0]
call qword [rsp + 0x50]
xor edx, edx
mov rax, qword [rsp + 0xc8]
mov ecx, 0x100000
div rcx
mov dword [rsp + 0x38], eax
xor edx, edx
mov rax, qword [rsp + 0xd0]
mov ecx, 0x100000
div rcx
mov dword [rsp + 0x34], eax
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1401ac4ee
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140253b98]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1401ac4ee
mov eax, dword [rsp + 0x30]
cmp rax, 4
jne 0x1401ac4ee
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.MHz
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp qword [rsp + 0x48], 0
je 0x1401ac501
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x68], 0
lea rax, [rsp + 0x6c]
mov rdi, rax
xor eax, eax
mov ecx, Ordinal_46
rep stosb byte [rdi], al
lea rcx, [0x140253bc0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.GetNativeSystemInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x1401ac558
lea rcx, [rsp + 0x68]
call qword [rsp + 0x58]
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x3c]
mov r8d, dword [rsp + 0x40]
lea rdx, str._d__d__d__d
lea rcx, [rsp + 0x100]
call fcn.1401ad6e4
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x98]
call fcn.14004c7f0
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0x1a0]
call fcn.14004c1c0
mov eax, dword [rsp + 0x44]
or eax, 1
mov dword [rsp + 0x44], eax
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x98]
call fcn.14004c760
nop
mov rax, qword [rsp + 0x1a0]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1401ef4e0
add rsp, 0x190
pop rdi
ret
Function at 0x1401ace5c
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x28], rax
cmp dword [rsp + 0x20], 1
jle 0x1401aced9
mov eax, 8
imul rax, rax, 1
lea rdx, [0x1402536d4]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + rax]
call fcn.14021953c
test eax, eax
je 0x1401aced3
mov eax, 8
imul rax, rax, 1
lea rdx, [0x1402537f0]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + rax]
call fcn.14021953c
test eax, eax
jne 0x1401aced9
mov al, 1
jmp 0x1401acedb
xor al, al
add rsp, 0x48
ret
Function at 0x1401b0424
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov qword [rsp + 0x98], 0xfffffffffffffffe
lea rax, [0x140367c28]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax]
test eax, eax
je 0x1401b0643
lea rax, [0x140367c28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movzx eax, byte [rax + 2]
test eax, eax
jne 0x1401b0641
mov eax, dword [0x140367c4c]
and eax, 1
test eax, eax
jne 0x1401b04a3
mov eax, dword [0x140367c4c]
or eax, 1
mov dword [0x140367c4c], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140367c48], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x30], eax
lea rax, [0x140367c28]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax + 1]
test eax, eax
je 0x1401b053a
lea rax, [0x140367c28]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x14]
mov ecx, dword [rsp + 0x30]
sub ecx, eax
mov eax, ecx
cmp eax, 0x64
jbe 0x1401b053a
lea rax, [0x140367c28]
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0x14]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x30]
lea r8, str._app__Application::process_do_exit___count:_d__will_count_:_d
lea rdx, [0x1402540ee]
xor ecx, ecx
call fcn.140197064
lea rax, [0x140367c28]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov byte [rax + 2], 1
lea rax, [0x140367c28]
mov rax, qword [rax]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 4]
mov ecx, dword [0x140367c48]
add ecx, eax
mov eax, ecx
cmp dword [rsp + 0x30], eax
jbe 0x1401b0612
lea rax, [0x140367c28]
mov rax, qword [rax]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
imul eax, dword [rax + 4], 6
mov ecx, dword [0x140367c48]
add ecx, eax
mov eax, ecx
cmp dword [rsp + 0x30], eax
jbe 0x1401b0599
mov eax, dword [rsp + 0x30]
mov dword [0x140367c48], eax
jmp 0x1401b05c0
lea rax, [0x140367c28]
mov rax, qword [rax]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 4]
mov ecx, dword [0x140367c48]
add ecx, eax
mov eax, ecx
mov dword [0x140367c48], eax
lea rax, [0x140367c28]
mov rax, qword [rax]
mov qword [rsp + 0x88], rax
lea rax, [0x140367c28]
mov rax, qword [rax]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
mov ecx, dword [rcx + 8]
mov dword [rax + 4], ecx
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb0]
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x1401b061d
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [0x140367c28]
mov rax, qword [rax]
mov qword [rsp + 0x90], rax
mov rcx, qword [rsp + 0x90]
call fcn.1401b41c8
jmp 0x1401b045b
jmp 0x1401b0659
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb0]
call qword [rax + reloc.WS2_32.dll_recv]
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb0]
call qword [rax + Ordinal_26]
add rsp, 0xa8
ret
Function at 0x1401b41c8
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
movsd xmm0, qword [0x140256918]
movsd qword [rsp + 0x48], xmm0
cmp qword [0x140367c40], 0
jne 0x1401b41f9
lea rcx, [0x140367c40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x1401b42ce
cmp dword [rsp + 0x58], 0x12
je 0x1401b425f
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x90]
call fcn.1401b285c
movzx eax, al
test eax, eax
jne 0x1401b425d
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x1401b4275
cmp qword [0x140367c20], 0
je 0x1401b4275
mov rcx, qword [0x140367c20]
call fcn.1401b0368
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
cvtsi2sd xmm0, rax
movsd xmm1, qword [0x1402d8390]
mulsd xmm1, xmm0
movaps xmm0, xmm1
cvtsi2sd xmm1, qword [0x140367c40]
divsd xmm0, xmm1
movsd qword [rsp + 0x40], xmm0
movsd xmm0, qword [rsp + 0x40]
comisd xmm0, xmmword [0x140256918]
jbe 0x1401b42c9
jmp 0x1401b42ce
jmp 0x1401b4204
add rsp, 0x88
ret
Function at 0x1401b4650
Capabilities:
Create pipe
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [rsp + 0x60]
mov qword [rax], 0xffffffffffffffff
mov rax, qword [rsp + 0x60]
add rax, 8
mov rdx, qword [rsp + 0x68]
mov rcx, rax
call fcn.14004c200
nop
mov rax, qword [rsp + 0x60]
add rax, 0x28
mov rcx, rax
call fcn.14004c250
nop
mov rax, qword [rsp + 0x60]
mov qword [rax + 0x48], 0xffffffffffffffff
mov rax, qword [rsp + 0x60]
mov qword [rax + 0x50], 0xffffffffffffffff
mov rax, qword [rsp + 0x60]
mov qword [rax + 0x58], 0xffffffffffffffff
mov rax, qword [rsp + 0x60]
mov qword [rax + 0x60], 0xffffffffffffffff
mov rax, qword [rsp + 0x60]
mov qword [rax + 0x68], 0xffffffffffffffff
mov rax, qword [rsp + 0x60]
mov qword [rax + 0x70], 0xffffffffffffffff
mov rax, qword [rsp + 0x60]
add rax, 0xa0
mov rcx, rax
call fcn.14004c250
nop
mov rax, qword [rsp + 0x60]
add rax, 0x78
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [rsp + 0x60]
add rcx, 0xc0
mov r9d, eax
mov r8, qword [section..data]
mov edx, 0x3f
call fcn.1401b5578
mov rax, qword [rsp + 0x60]
add rax, 0xc0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x4000
mov dword [rsp + 0x20], 0x4000
mov r9d, 1
xor r8d, r8d
mov edx, 3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov rcx, qword [rsp + 0x60]
mov qword [rcx + 0x60], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x60]
lea r8, [0x1401b5420]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x60]
mov qword [rcx + 0x70], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rcx, qword [rsp + 0x60]
mov qword [rcx + 0x68], rax
mov rax, qword [rsp + 0x60]
add rsp, 0x58
ret
Function at 0x1401b5448
Capabilities:
Connect pipe
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x458
mov rax, qword [0x140310170]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor edx, edx
mov rax, qword [rsp + 0x460]
mov rcx, qword [rax + 0x60]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x1401b548f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x1401b554a
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, 0x3ff
lea rdx, [rsp + 0x40]
mov rax, qword [rsp + 0x460]
mov rcx, qword [rax + 0x60]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1401b554a
cmp dword [rsp + 0x30], 0
jbe 0x1401b5533
mov rax, qword [rsp + 0x460]
add rax, 0x78
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [rsp + 0x30]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0x400
jae 0x1401b54f4
jmp 0x1401b54f9
call fcn.1401ef60c
mov rax, qword [rsp + 0x38]
mov byte [rsp + rax + 0x40], 0
mov rax, qword [rsp + 0x460]
add rax, 0xa0
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.14004fee0
mov rax, qword [rsp + 0x460]
add rax, 0x78
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0x460]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1401b548f
mov rax, qword [rsp + 0x460]
mov rcx, qword [rax + 0x60]
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor eax, eax
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1401ef4e0
add rsp, 0x458
ret
Function at 0x1401bc8e4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x4d8
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x140310170]
xor rax, rsp
mov qword [rsp + 0x4c0], rax
mov byte [rsp + 0xb8], 0
lea rcx, [rsp + 0x50]
call fcn.1401bcc9c
nop
mov r8d, 0x400
xor edx, edx
lea rcx, [rsp + 0xc0]
call fcn.14020fde0
lea rdx, [0x1402591a0]
mov rcx, qword [rsp + 0x4e0]
call fcn.14021997c
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1401bc9f5
mov r9, qword [rsp + 0x28]
mov r8d, 0x400
mov edx, 1
lea rcx, [rsp + 0xc0]
call fcn.140219d04
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1401bc999
mov r8d, dword [rsp + 0x20]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x50]
call fcn.1401bcd20
jmp 0x1401bc958
lea rcx, [rsp + 0x50]
call fcn.1401bced0
mov rcx, qword [rsp + 0x28]
call fcn.140219a18
lea rax, [rsp + 0xa8]
mov rcx, rax
call fcn.1401bc78c
mov qword [rsp + 0x30], rax
mov r8, qword [rsp + 0x30]
mov edx, 0x104
lea rcx, [0x140367ce0]
call fcn.140219dcc
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call fcn.1401ef8b8
lea rax, [0x140367ce0]
jmp 0x1401bc9f9
jmp 0x1401bc9f7
xor eax, eax
mov rcx, qword [rsp + 0x4c0]
xor rcx, rsp
call fcn.1401ef4e0
add rsp, 0x4d8
ret

Function at 0x1401bcc9c
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
add rax, 0x10
mov r8d, 8
xor edx, edx
mov rcx, rax
call fcn.14020fde0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov dword [rcx + rax], 0x67452301
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x30]
mov dword [rcx + rax], 0xefcdab89
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0x30]
mov dword [rcx + rax], 0x98badcfe
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 0x30]
mov dword [rcx + rax], 0x10325476
add rsp, 0x28
ret
Function at 0x1401c06e8
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
xor eax, eax
test eax, eax
jne 0x1401c06f6
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp qword [rax], 0
je 0x1401c072b
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x28]
mov qword [rax], 0
cmp qword [rsp + 0x48], 0
jne 0x1401c0749
mov rax, qword [rsp + 0x40]
add rax, 0x10
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
jmp 0x1401c0798
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1401c0774
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 2
je 0x1401c0774
mov ecx, dword [rsp + 0x20]
call fcn.1401c0688
jmp 0x1401c0798
mov rax, qword [rsp + 0x40]
add rax, 0x10
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x1401c0796
call fcn.1401c0648
jmp 0x1401c0798
xor eax, eax
add rsp, 0x38
ret

Function at 0x1401c0898
Capabilities:
Get common file path

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x2a8
mov rax, qword [0x140310170]
xor rax, rsp
mov qword [rsp + 0x290], rax
xor eax, eax
test eax, eax
jne 0x1401c08c0
cmp qword [rsp + 0x2b8], 0
jne 0x1401c090e
lea rdx, [rsp + 0x70]
mov ecx, 0x100
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x1401c08f8
call fcn.1401c0648
jmp 0x1401c0a57
cmp dword [rsp + 0x40], 0x100
jbe 0x1401c090c
mov eax, 0x80020013
jmp 0x1401c0a57
jmp 0x1401c0948
mov r9, 0xffffffffffffffff
mov r8, qword [rsp + 0x2b8]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.140219f1c
mov dword [rsp + 0x44], eax
mov ecx, dword [rsp + 0x44]
call fcn.1401c05e4
cmp eax, 0x50
jne 0x1401c0948
mov eax, 0x80020013
jmp 0x1401c0a57
lea r9, [rsp + 0x180]
xor r8d, r8d
lea rdx, [0x14025cb00]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x1401c0973
call fcn.1401c0648
jmp 0x1401c0a57
mov eax, 1
imul rax, rax, 0x103
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0x104
jae 0x1401c0991
jmp 0x1401c0996
call fcn.1401ef60c
mov rax, qword [rsp + 0x50]
mov byte [rsp + rax + 0x180], 0
mov rax, qword [rsp + 0x2b0]
add rax, 0x10
mov r9, 0xffffffffffffffff
lea r8, [rsp + 0x180]
mov edx, 0x101
mov rcx, rax
call fcn.140219f1c
mov dword [rsp + 0x48], eax
mov ecx, dword [rsp + 0x48]
call fcn.1401c05e4
mov dword [rsp + 0x58], Ordinal_30
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x68], 1
mov rax, qword [rsp + 0x2b0]
mov ecx, dword [rsp + 0x2c0]
mov dword [rax + 0x114], ecx
mov rax, qword [rsp + 0x2b0]
add rax, 0x10
mov rcx, qword [rsp + 0x2b0]
mov qword [rsp + 0x38], 0
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0x2100
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov rdx, qword [rsp + 0x2b0]
mov r8d, dword [rdx + 0x114]
mov rdx, rax
call fcn.1401c07a0
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1401ef4e0
add rsp, 0x2a8
ret
Function at 0x1401c0c24
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
xor eax, eax
test eax, eax
jne 0x1401c0c3c
xor eax, eax
test eax, eax
jne 0x1401c0c42
lea rdx, [rsp + 0x3c]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x1401c0c72
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x3c]
mov r8d, dword [rsp + 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x10], 0
jne 0x1401c0cb9
call fcn.1401c0648
jmp 0x1401c0d84
cmp qword [rsp + 0x60], 0
jne 0x1401c0cdc
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 8], rax
jmp 0x1401c0cea
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x78]
mov dword [rax + 0x20], ecx
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
mov qword [rax + 0x18], rcx
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x50]
mov r9d, dword [rax + 0x18]
mov rax, qword [rsp + 0x50]
mov r8d, dword [rax + 0x1c]
mov rax, qword [rsp + 0x50]
mov edx, dword [rax + 0x20]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov rcx, qword [rsp + 0x50]
mov qword [rcx], rax
mov rax, qword [rsp + 0x50]
cmp qword [rax], 0
jne 0x1401c0d82
call fcn.1401c0648
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x50]
mov qword [rax + 0x10], 0
mov eax, dword [rsp + 0x30]
jmp 0x1401c0d84
xor eax, eax
add rsp, 0x48
ret