joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000179c
Capabilities:
Find process by pid
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x70
lea rcx, [0x140002e10]
call sub.ntoskrnl.exe_DbgPrint
xor edx, edx
lea rcx, [rbp - 0x30]
lea r8d, [rdx + 0x28]
call fcn.140002b80
call qword [sym.imp.ntoskrnl.exe_ObGetFilterVersion]
and qword [rbp - 0x18], 0
lea rdx, [0x140002e30]
mov r14d, 1
mov word [rbp - 0x30], ax
lea rcx, [rbp - 0x28]
mov word [rbp - 0x2e], r14w
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rax, qword [sym.imp.ntoskrnl.exe_PsProcessType]
lea rdx, [0x140005100]
and dword [rbp - 0x44], 0
lea rcx, [rbp - 0x30]
and qword [rbp - 0x38], 0
mov qword [rbp - 0x50], rax
lea rax, [0x1400018a0]
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x50]
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x48], r14d
call qword [sym.imp.ntoskrnl.exe_ObRegisterCallbacks]
and qword [rbp + 0x10], 0
lea ebx, [r14 + 3]
mov edi, 0x3fff
lea rdx, [rbp + 0x10]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x14000187b
mov rcx, qword [rbp + 0x10]
call fcn.1400016dc
test al, al
je 0x140001871
mov rcx, qword [rbp + 0x10]
add rcx, 0x188
call fcn.1400019e8
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
add rbx, 4
sub rdi, r14
jne 0x140001843
lea r11, [rsp + 0x70]
xor eax, eax
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x1400019a4
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
lea rcx, [0x140001600]
call qword [sym.imp.ntoskrnl.exe_PsSetCreateProcessNotifyRoutineEx]
mov ebx, eax
test eax, eax
jns 0x1400019d8
mov edx, eax
lea rcx, [0x140002e40]
call sub.ntoskrnl.exe_DbgPrint
mov eax, ebx
mov byte [0x140005108], 0
jmp 0x1400019df
mov byte [0x140005108], 1
add rsp, 0x20
pop rbx
ret
Function at 0x140001a34
Capabilities:
Attach user process memory
Find process by pid
Print debug messages

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x88
mov rax, qword [0x140005030]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, r9d
mov r14, r8
mov rdi, rdx
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rbx, qword [rsp + 0x30]
test rbx, rbx
jne 0x140001a87
lea rcx, [0x140002f30]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x140001b5b
xor edx, edx
lea r8d, [rdx + 0x30]
lea rcx, [rsp + 0x48]
call fcn.140002b80
lea rdx, [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140001ad2
lea rcx, [0x140002f60]
jmp 0x140001a7b
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmBuildMdlForNonPagedPool]
nop
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPages]
mov rdi, rax
mov qword [rsp + 0x40], rax
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call fcn.140002840
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
mov al, 1
jmp 0x140001b5b
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140002590
add rsp, 0x88
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x140001b78
Capabilities:
Attach user process memory
Find process by pid
Print debug messages

Disassembly:
push rbx
push rdi
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x140005030]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r15, r9
mov r14d, r8d
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdx
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp qword [rsp + 0x20], 0
jne 0x140001bd6
mov edx, ebx
lea rcx, [0x140002ed0]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x140001c5f
xor edx, edx
lea r8d, [rdx + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140002b80
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov r8d, 1
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.140002840
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, 1
jmp 0x140001c5f
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140002590
add rsp, 0x78
pop r15
pop r14
pop rdi
pop rbx
ret
Function at 0x140001cd8
Capabilities:
Attach user process memory
Find process by pid
Print debug messages

Disassembly:
push rbx
push rdi
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x140005030]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r15, r9
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdx
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp qword [rsp + 0x20], 0
jne 0x140001d39
mov edx, ebx
lea rcx, [0x140002ed0]
call sub.ntoskrnl.exe_DbgPrint
xor eax, eax
jmp 0x140001dd5
xor edx, edx
lea r8d, [rdx + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140002b80
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov rdx, r14
sub rdx, rdi
mov r8d, 1
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov r9d, dword [rsp + 0xd0]
mov r8, r15
mov rdx, r14
mov rcx, rdi
call fcn.140001c78
mov rbx, rax
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rbx
jmp 0x140001dd5
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140002590
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rbx
ret

Function at 0x140001df0
Capabilities:
Attach user process memory
Find process by pid
Print debug messages

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x140005030]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r15, r9
mov r14d, r8d
mov rsi, rdx
mov rbx, rcx
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], r14d
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rdi, qword [rsp + 0x20]
test rdi, rdi
jne 0x140001e51
mov edx, ebx
lea rcx, [0x140003000]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x140001ef7
xor edx, edx
lea r8d, [rdx + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140002b80
lea rdx, [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov edx, 8
lea r8d, [rdx - 7]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rdi, r14
add rdi, qword [rsi]
mov ebx, dword [rsp + 0xc0]
mov r8d, 1
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov r8d, ebx
mov rdx, rdi
mov rcx, r15
call fcn.140002840
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, 1
jmp 0x140001ef7
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140002590
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140002078
Capabilities:
Attach user process memory
Find process by pid
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140005030]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rdi, rdx
mov rsi, rcx
and qword [r11 - 0x78], 0
lea rdx, [r11 - 0x78]
mov rcx, qword [rcx]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x1400020cd
lea rcx, [0x1400030d0]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x140002207
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x1400020e5
lea rcx, [0x140003080]
jmp 0x1400020c1
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rbx, rax
test rax, rax
jne 0x140002111
lea rcx, [0x140002d70]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x1400020c6
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
add rbx, qword [0x140005018]
mov r15d, 8
mov r8d, r15d
mov edx, r15d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov r14, qword [rbx]
mov rax, qword [0x140005020]
add r14, rax
mov r8d, r15d
mov edx, r15d
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rbx, qword [r14]
lea rdx, [rsi + 8]
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
cmp r14, rbx
je 0x1400021e0
mov r8b, 1
lea rdx, [rbx + 0x58]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
je 0x1400021ca
lea r9, [rbx + 0x58]
mov r8d, dword [rbx + 0x40]
mov rdx, qword [rbx + 0x30]
lea rcx, [0x140002d90]
call sub.ntoskrnl.exe_DbgPrint
mov rax, qword [rbx + 0x30]
mov qword [rdi], rax
mov rax, qword [rbx + 0x38]
mov qword [rdi + 8], rax
mov eax, dword [rbx + 0x40]
mov qword [rdi + 0x10], rax
jmp 0x1400021e0
mov rbx, qword [rbx]
mov r8d, r15d
mov edx, 0x50
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
jmp 0x14000217f
jmp 0x1400021ef
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, 1
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140002590
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140011d90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rdi, r8
mov ebx, edx
test r8, r8
je 0x140011ef6
mov rax, qword [rcx]
call qword [rax]
mov rsi, rax
test ebx, ebx
je 0x140011dfd
cmp ebx, 3
je 0x140011dfd
sub ebx, 1
je 0x140011dec
cmp ebx, 1
jne 0x140011ef6
movzx edx, di
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadIconW]
jmp 0x140011ef8
movzx edx, di
mov rcx, rsi
call qword [sym.imp.USER32.dll_LoadCursorW]
jmp 0x140011ef8
movzx edx, di
mov r8d, 0xa
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r14, rax
test rax, rax
je 0x140011ef6
xor r12d, r12d
mov edi, r12d
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
je 0x140011ef6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
test rax, rax
je 0x140011ec5
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov qword [rsp + 0x40], r12
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r8d, eax
mov rdx, r15
lea rcx, [rsp + 0x20]
call fcn.14000eef0
test rax, rax
je 0x140011e9e
mov rdi, qword [rsp + 0x20]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov qword [rsp + 0x40], r12
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140011ec5
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov qword [rsp + 0x40], r12
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
test rdi, rdi
je 0x140011ef6
cmp ebx, 3
jne 0x140011ef1
mov rcx, rdi
call fcn.140011880
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, rbx
jmp 0x140011ef8
mov rax, rdi
jmp 0x140011ef8
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140011fb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x20
xor esi, esi
mov r14, r9
mov qword [r8 + 0x28], rsi
mov rbx, r8
mov rbp, rdx
test rdx, rdx
jne 0x140011fe2
lea eax, [rdx + 1]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
mov rax, qword [rcx]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r15
call qword [rax]
movzx edx, bp
mov r8, r14
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15, rax
test rax, rax
je 0x1400120d7
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
je 0x1400120d7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x1400120ce
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov qword [rbx + 0x28], rsi
cmp qword [rbx + 0x20], rdi
jl 0x1400120ac
cmp rdi, 1
jne 0x14001206a
movzx ecx, byte [r14]
mov rax, qword [rbx + 0x18]
mov byte [rax], cl
inc qword [rbx + 0x28]
jmp 0x1400120c9
cmp rdi, 2
jne 0x140012081
movzx ecx, word [r14]
mov rax, qword [rbx + 0x18]
mov word [rax], cx
add qword [rbx + 0x28], rdi
jmp 0x1400120c9
cmp rdi, 4
jne 0x140012096
mov ecx, dword [r14]
mov rax, qword [rbx + 0x18]
mov dword [rax], ecx
add qword [rbx + 0x28], rdi
jmp 0x1400120c9
cmp rdi, 8
jne 0x1400120ac
mov rcx, qword [r14]
mov rax, qword [rbx + 0x18]
mov qword [rax], rcx
add qword [rbx + 0x28], rdi
jmp 0x1400120c9
test eax, eax
je 0x1400120c9
mov rdx, rdi
mov rcx, rbx
call fcn.140013dd0
mov r8, rdi
mov rdx, r14
mov rcx, rax
call fcn.1400446f0
mov esi, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r15, qword [rsp + 0x48]
mov rax, rsi
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
Function at 0x140013340
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
test rcx, rcx
je 0x1400134a3
cmp word [rcx], 0
je 0x1400134a3
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
mov dword [rbp + 4], eax
mov dword [rbp - 0x60], 0x68
test r8, r8
js 0x1400133a9
or dword [rbp - 0x24], 1
mov word [rbp - 0x20], r8w
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [rsp + 0x50], rax
lea rsi, vtable.CVolObject.0
mov qword [rsp + 0x50], rsi
xor edi, edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
lea r14, vtable.CVolMem.0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x80], 0x40
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.140013f70
mov rdx, qword [rsp + 0x68]
cmp qword [rsp + 0x78], rdi
cmove rdx, rdi
lea rax, [rbp - 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140013445
mov ebx, edi
jmp 0x14001346d
mov edx, 0x1f4
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 1
mov qword [rsp + 0x50], r14
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x14001348a
lea rcx, [rsp + 0x50]
mov r8, qword [rsp + 0x50]
call qword [r8 + 0x18]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x50], rsi
mov rax, rbx
jmp 0x1400134a5
xor eax, eax
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400134d0
Capabilities:
Get common file path
Set current directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x140072010]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rbx, rcx
test rcx, rcx
je 0x1400136b6
cmp word [rcx], 0
je 0x1400136b6
lea rcx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rsp + 0x20], rcx
lea r14, vtable.CVolObject.0
mov qword [rsp + 0x20], r14
xor esi, esi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rsi
lea rax, vtable.CWString.0
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rsi
lea r15, vtable.CVolMem.0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], 0x40
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x70], 0xfe
mov edi, esi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rsi
movzx eax, word [rbx]
cmp ax, 0x5c
je 0x1400135cb
test ax, ax
je 0x14001360a
cmp word [rbx + 2], 0x3a
jne 0x14001360a
cmp word [rbx + 4], 0x5c
jne 0x14001360a
mov edx, 0x5c
mov rcx, rbx
call fcn.140041490
test rax, rax
je 0x140013605
cmp rax, rbx
jbe 0x1400135ee
lea rcx, [rax - 2]
cmp word [rcx], 0x3a
cmovne rax, rcx
sub rax, rbx
lea r8, [rax + 2]
sar r8, 1
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140015370
mov rdi, qword [rsp + 0x38]
test rdi, rdi
jne 0x140013620
cmp qword [rsp + 0x68], rdi
je 0x140013667
mov rdi, qword [rsp + 0x58]
test rdi, rdi
je 0x140013667
cmp word [rdi], 0
je 0x140013667
lea rdx, [rbp - 0x70]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x140013667
cmp word [rdi], 0
je 0x140013648
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
cmp word [rbp - 0x70], 0
je 0x140013673
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
jmp 0x140013673
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], r15
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x140013698
lea rcx, [rsp + 0x40]
mov rax, qword [rsp + 0x40]
call qword [rax + 0x18]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x20], r14
mov rax, rbx
jmp 0x1400136b8
xor eax, eax
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.14003fda0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14002b730
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x10
movdqa xmm4, xmmword [0x140066e70]
xor ebx, ebx
movdqa xmm5, xmmword [0x140066e40]
xor edi, edi
movaps xmmword [rsp], xmm6
mov r10, r8
movdqa xmm6, xmmword [0x140066e10]
mov r9, rdx
xorps xmm3, xmm3
cmp r8, 4
jb 0x14002b7f8
lea r11d, [rbx + 4]
movdqu xmm1, xmmword [r9 + rbx*4]
mov edx, 8
add rbx, 4
add r11, 4
movdqa xmm0, xmm1
movdqa xmm2, xmm1
pand xmm0, xmm5
pand xmm1, xmm6
pcmpeqd xmm0, xmm3
pcmpeqd xmm1, xmm3
pxor xmm1, xmm0
pand xmm2, xmm4
pmovmskb eax, xmm1
pcmpeqd xmm2, xmm3
pxor xmm0, xmm2
movzx ecx, ax
popcnt r8, rcx
pmovmskb eax, xmm0
shr r8, 2
movzx ecx, ax
popcnt rax, rcx
shr rax, 2
sub rdx, rax
pmovmskb eax, xmm2
add rdx, rdx
movzx ecx, ax
popcnt rax, rcx
shr rax, 2
lea rax, [rax + rax*2]
sub rdx, rax
sub rdx, r8
add rdi, rdx
cmp r11, r10
jbe 0x14002b771
lea r11, [r9 + rbx*4]
xor r9d, r9d
mov eax, r9d
sub r10, rbx
je 0x14002b848
nop word [rax + rax]
mov edx, dword [r11 + rax*4]
xor r8d, r8d
cmp edx, 0x7ff
seta r8b
xor ecx, ecx
cmp edx, 0x7f
seta cl
add r8, rcx
xor ecx, ecx
cmp edx, 0xffff
seta cl
inc rax
inc rcx
add r9, rcx
add r9, r8
cmp rax, r10
jb 0x14002b810
mov rbx, qword [rsp + 0x20]
lea rax, [r9 + rdi]
movaps xmm6, xmmword [rsp]
add rsp, 0x10
pop rdi
ret

Function at 0x140040a50
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140040a9a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140040a9a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140040a9a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140040a9a
cmp dword [rcx + 0x84], 0xe
jbe 0x140040a9a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140040a9c
xor al, al
add rsp, 0x28
ret

Function at 0x1400450dc
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140044f6f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140044f6f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140044f6f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140044f6f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140044f6f
cmp dword [rcx + 0x84], 0xe
jbe 0x140044f6f
cmp dword [rcx + 0xf8], 0
je 0x140044f6f
mov ecx, ebx
call fcn.140045010
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140044e00
cmp dword [rbp + 0x20], 0
je 0x140044fbc
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140044fc4
int3
xor r8d, r8d
xor edx, edx
jmp 0x140044f08
Function at 0x140053720
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140053748
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140053748
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret