joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b5180
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x5b5198
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x5b5198
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x5b51a0
xor eax, eax
ret
cmp rbx, 3
je 0x5b51ac
cmp rbx, 4
jne 0x5b51d9
cmp al, 0x2c
ja 0x5b51c6
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x5b51d6
cmp al, 0x24
je 0x5b51d6
nop dword [rax]
cmp al, 0x26
jae 0x5b51d6
jmp 0x5b51d9
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x5b51d6
cmp al, 0x5b
je 0x5b51d6
cmp al, 0x5d
jne 0x5b51d9
xor eax, eax
ret
cmp al, 0x2f
ja 0x5b5212
nop dword [rax]
cmp al, 0x26
ja 0x5b51f1
cmp al, 0x24
je 0x5b5231
cmp al, 0x26
je 0x5b5231
jmp 0x5b52ab
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x5b5231
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x5b52a8
cmp al, 0x2f
je 0x5b5231
jmp 0x5b52ab
cmp al, 0x3d
ja 0x5b5229
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x5b5231
nop
cmp al, 0x3d
je 0x5b5231
jmp 0x5b52ab
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x5b52a0
cmp rbx, 2
jg 0x5b5267
cmp rbx, 1
je 0x5b5261
nop dword [rax]
cmp rbx, 2
jne 0x5b52ab
cmp al, 0x2f
je 0x5b5252
cmp al, 0x3b
je 0x5b5252
cmp al, 0x2c
jne 0x5b5259
mov ecx, 1
jmp 0x5b525e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x5b528a
cmp al, 0x40
je 0x5b5279
cmp al, 0x2f
je 0x5b5279
cmp al, 0x3f
jne 0x5b5282
mov ecx, 1
nop
jmp 0x5b5287
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x5b5299
cmp rbx, 7
jne 0x5b52ab
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x5b52a8
cmp al, 0x7e
jne 0x5b52ab
xor eax, eax
ret
cmp rbx, 7
jne 0x5b52c1
cmp al, 0x21
je 0x5b52bd
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x5b52c1
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x5bb540
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5bb793
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rsi, qword [rax + 0x50]
test rsi, rsi
jle 0x5bb670
nop dword [rax + rax]
cmp rsi, 0x40
ja 0x5bb785
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea r8, [rsi - 0x40]
mov r9, r8
neg r8
cmp rcx, r8
cmovl r8, rcx
mov qword [rsp + 0x28], r8
sar r9, 0x3f
and r9, rsi
lea rsi, [rax + r9]
lea rsi, [rsi + 0x10]
cmp rbx, rsi
je 0x5bb5e2
mov rax, rsi
mov rcx, r8
call fcn.00464320
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r8, qword [rsp + 0x28]
mov rsi, qword [rax + 0x50]
add rsi, r8
mov qword [rax + 0x50], rsi
cmp rsi, 0x40
jne 0x5bb64c
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.005bba80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r8, qword [rsp + 0x28]
cmp rcx, r8
jb 0x5bb77c
sub rdi, r8
mov rsi, rcx
sub rcx, r8
mov r9, rdi
neg rdi
sar rdi, 0x3f
and r8, rdi
add rbx, r8
jmp 0x5bb680
mov rsi, rcx
mov r9, rdi
nop word [rax + rax]
nop
cmp rcx, 0x40
jl 0x5bb720
mov rdi, rcx
and rcx, 0xffffffffffffffc0
cmp r9, rcx
jb 0x5bb774
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r9
call fcn.005bba80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x20]
cmp rcx, rax
jb 0x5bb76f
mov rdx, qword [rsp + 0x38]
mov rsi, rax
sub rax, rdx
mov rdx, rcx
sub rcx, rsi
sar rax, 0x3f
and rax, rdx
and rax, 0xffffffffffffffc0
mov rdx, qword [rsp + 0x40]
lea rbx, [rdx + rax]
mov rax, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
nop dword [rax]
test rcx, rcx
je 0x5bb75e
cmp rcx, 0x40
mov edx, 0x40
cmovl rdx, rcx
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x5bb75a
mov qword [rsp + 0x38], rdx
mov rax, rdi
mov rcx, rdx
call fcn.00464320
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x68]
mov qword [rax + 0x50], rdx
mov rax, rsi
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.00463a80
mov rdx, r9
call fcn.00463a40
mov rax, r8
nop
call fcn.00463a80
mov rax, rsi
mov ecx, 0x40
call fcn.00463a80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004612e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005bb540
Function at 0x5cf040
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5cf194
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x88], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x28], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x38], xmm0
lea rax, [rsp + 0x20]
nop
call fcn.005ce460
mov qword [rsp + 0x10], 0
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x68], rcx
mov rcx, qword [rsp + 0x88]
xor eax, eax
jmp 0x5cf0e4
inc rax
mov rcx, rbx
cmp rax, 5
jge 0x5cf135
imul rdx, rax, 0x33
mov rsi, rdx
sar rdx, 0x3f
shr rdx, 0x3d
add rdx, rsi
sar rdx, 3
mov rdi, rdx
shl rdx, 3
sub rsi, rdx
cmp rsi, 0x40
sbb rdx, rdx
mov r8, qword [rsp + rax*8 + 0x48]
mov rbx, rcx
mov rcx, rsi
shl r8, cl
and r8, rdx
mov qword [rsp + 0x10], r8
mov rdx, qword [rsp + 0x10]
mov qword [rsp + 0x18], rdx
xor ecx, ecx
jmp 0x5cf160
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
movzx r8d, byte [rbx + rsi]
or r8d, edx
mov byte [rbx + rsi], r8b
inc rcx
nop dword [rax + rax]
cmp rcx, 8
jge 0x5cf0de
movzx edx, byte [rsp + rcx + 0x18]
lea rsi, [rdi + rcx]
cmp rsi, 0x20
jge 0x5cf0de
test byte [rbx], al
nop
cmp rsi, 0x20
jb 0x5cf14c
mov rax, rsi
mov ecx, 0x20
call fcn.004639c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call fcn.004612e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005cf040
Function at 0x6182c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x618395
movdqa xmm0, xmmword [0x007e5680]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x618301
movdqa xmm0, xmmword [0x007e5690]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x618417
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x6183eb
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x007e4e30]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x007e5d40]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x625ce0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x625e8f
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x625d07
inc rcx
cmp rbx, rcx
jle 0x625e81
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x625d04
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call fcn.005a1820
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rsi
test rsi, rsi
mov rdx, qword [rsp + 0x88]
cmovne rbx, rdx
mov rdx, qword [rsp + 0x80]
cmovne rax, rdx
mov rdx, qword [0x009be5d0]
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call fcn.00621d80
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop dword [rax]
test rcx, rcx
jne 0x625e70
test rdx, rdx
je 0x625e61
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.004034e0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x625e2b
xor eax, eax
lea rbx, [0x00755621]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x007556f3]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call fcn.0044d980
jmp 0x625e52
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x00755614]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call fcn.0044d8a0
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
nop
ret
xor ecx, ecx
mov rdi, r9
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rax, r9
mov rbx, rsi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
nop
ret
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004612e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00625ce0
Function at 0x1414dc058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1414dc1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1414dc089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1414dc06f
add dl, dl
jne 0x1414dc096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1414dc0f6
xor eax, eax
add dl, dl
jne 0x1414dc0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1414dc1ad
add dl, dl
jne 0x1414dc0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1414dc0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1414dc0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1414dc0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1414dc0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1414dc07e
mov eax, 1
add dl, dl
jne 0x1414dc106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1414dc113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1414dc0fb
sub eax, ebx
mov ebx, 1
jne 0x1414dc14c
mov ecx, 1
add dl, dl
jne 0x1414dc12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1414dc13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1414dc123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1414dc07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1414dc168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1414dc175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1414dc15d
cmp eax, 0x7d00
jae 0x1414dc19b
cmp eax, 0x500
jb 0x1414dc196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1414dc07e
cmp eax, 0x7f
ja 0x1414dc19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1414dc07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1414dc1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1414dc07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
push rcx
push rsi
mov rdx, qword [rdx + 0x20]
movzx rcx, word [rdx + 0x4a]
xor r9, r9
mov rsi, qword [rdx + 0x50]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
push r9
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov r8d, dword [rax + 0x20]
push rax
mov ecx, dword [rax + 0x18]
add r8, rdx
jrcxz 0x1400040ca
dec rcx
xor r9, r9
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x14000d1d0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x140054010]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
mov dword [rsp + 0x20], esi
lea rcx, vtable.CVolObject.0
mov qword [rdi], rcx
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], rsi
lea rax, vtable.CWString.0
mov qword [rdi], rax
lea rbx, [rdi + 0x20]
mov qword [rsp + 0x30], rbx
mov qword [rbx], rcx
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rsi
lea rax, vtable.CVolMem.0
mov qword [rbx], rax
mov qword [rbx + 0x18], rsi
mov qword [rbx + 0x28], rsi
mov qword [rbx + 0x20], rsi
mov qword [rbx + 0x30], 0x40
mov qword [rdi + 0x18], rsi
mov qword [rdi + 0x50], 0xfe
mov dword [rsp + 0x20], 1
mov word [rsp + 0x40], si
xor r9d, r9d
lea r8d, [rsi + 0x1c]
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x14000d31b
mov rax, qword [rdi + 0x18]
test rax, rax
jne 0x14000d29e
cmp qword [rdi + 0x48], rax
je 0x14000d2a8
cmp qword [rbx + 0x28], rax
je 0x14000d2a8
mov rax, qword [rbx + 0x18]
lea rcx, [rsp + 0x40]
cmp rcx, rax
je 0x14000d313
mov qword [rdi + 0x18], rsi
mov rdx, qword [rbx + 0x18]
test rdx, rdx
je 0x14000d2be
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
mov qword [rbx + 0x18], rsi
mov qword [rbx + 0x28], rsi
mov qword [rbx + 0x20], rsi
movzx eax, word [rsp + 0x40]
test ax, ax
je 0x14000d313
lea rcx, [rsp + 0x40]
mov rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x14000d2e0
lea rsi, [rax*2 + 2]
test rsi, rsi
jle 0x14000d313
mov rdx, rsi
mov rcx, rbx
call fcn.140018bb0
mov r8, rsi
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140025530
mov rcx, rdi
call fcn.14000d4b0
mov rax, rdi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140023490
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400165d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rdi, r8
mov ebx, edx
test r8, r8
je 0x140016736
mov rax, qword [rcx]
call qword [rax]
mov rsi, rax
test ebx, ebx
je 0x14001663d
cmp ebx, 3
je 0x14001663d
sub ebx, 1
je 0x14001662c
cmp ebx, 1
jne 0x140016736
movzx edx, di
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadIconW]
jmp 0x140016738
movzx edx, di
mov rcx, rsi
call qword [sym.imp.USER32.dll_LoadCursorW]
jmp 0x140016738
movzx edx, di
mov r8d, 0xa
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r14, rax
test rax, rax
je 0x140016736
xor r12d, r12d
mov edi, r12d
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
je 0x140016736
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
test rax, rax
je 0x140016705
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov qword [rsp + 0x40], r12
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r8d, eax
mov rdx, r15
lea rcx, [rsp + 0x20]
call fcn.140014410
test rax, rax
je 0x1400166de
mov rdi, qword [rsp + 0x20]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov qword [rsp + 0x40], r12
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140016705
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov qword [rsp + 0x40], r12
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
test rdi, rdi
je 0x140016736
cmp ebx, 3
jne 0x140016731
mov rcx, rdi
call fcn.1400160c0
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, rbx
jmp 0x140016738
mov rax, rdi
jmp 0x140016738
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x1400167f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x20
xor esi, esi
mov r14, r9
mov qword [r8 + 0x28], rsi
mov rbx, r8
mov rbp, rdx
test rdx, rdx
jne 0x140016822
lea eax, [rdx + 1]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
mov rax, qword [rcx]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r15
call qword [rax]
movzx edx, bp
mov r8, r14
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15, rax
test rax, rax
je 0x140016917
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
je 0x140016917
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14001690e
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov qword [rbx + 0x28], rsi
cmp qword [rbx + 0x20], rdi
jl 0x1400168ec
cmp rdi, 1
jne 0x1400168aa
movzx ecx, byte [r14]
mov rax, qword [rbx + 0x18]
mov byte [rax], cl
inc qword [rbx + 0x28]
jmp 0x140016909
cmp rdi, 2
jne 0x1400168c1
movzx ecx, word [r14]
mov rax, qword [rbx + 0x18]
mov word [rax], cx
add qword [rbx + 0x28], rdi
jmp 0x140016909
cmp rdi, 4
jne 0x1400168d6
mov ecx, dword [r14]
mov rax, qword [rbx + 0x18]
mov dword [rax], ecx
add qword [rbx + 0x28], rdi
jmp 0x140016909
cmp rdi, 8
jne 0x1400168ec
mov rcx, qword [r14]
mov rax, qword [rbx + 0x18]
mov qword [rax], rcx
add qword [rbx + 0x28], rdi
jmp 0x140016909
test eax, eax
je 0x140016909
mov rdx, rdi
mov rcx, rbx
call fcn.140018bb0
mov r8, rdi
mov rdx, r14
mov rcx, rax
call fcn.140025530
mov esi, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r15, qword [rsp + 0x48]
mov rax, rsi
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
Function at 0x140017790
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
test rcx, rcx
je 0x1400178cf
cmp word [rcx], 0
je 0x1400178cf
lea rdx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp - 0x60], rdx
lea rsi, vtable.CVolObject.0
mov qword [rbp - 0x60], rsi
xor edi, edi
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x50], rdi
lea rax, vtable.CWString.0
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x40]
mov qword [rbp + 0x20], rax
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x30], rdi
lea r14, vtable.CVolMem.0
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x10], 0x40
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x10], 0xfe
cmp word [rcx], di
je 0x140017886
cmp word [rcx + 2], di
je 0x140017886
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rcx + r8*2], 0
jne 0x140017840
cmp word [rcx + r8*2 - 2], 0x5c
jne 0x140017886
cmp word [rcx + r8*2 - 4], 0x3a
je 0x140017886
dec r8
mov rdx, rcx
lea rcx, [rbp - 0x60]
call fcn.140019de0
mov rcx, qword [rbp - 0x48]
test rcx, rcx
jne 0x140017886
lea rcx, [0x140043b38]
cmp qword [rbp - 0x18], 0
cmovne rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rbx, rdi
cmp eax, 0xffffffff
setne bl
lea rax, [rbp - 0x40]
mov qword [rbp + 0x20], rax
mov qword [rbp - 0x40], r14
mov rdx, qword [rbp - 0x28]
test rdx, rdx
je 0x1400178b6
lea rcx, [rbp - 0x40]
mov r8, qword [rbp - 0x40]
call qword [r8 + 0x18]
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x60], rsi
mov rax, rbx
jmp 0x1400178d1
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400178f0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
test rcx, rcx
je 0x140017a59
cmp word [rcx], 0
je 0x140017a59
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], rax
mov dword [rbp - 0x60], 0x68
psrldq xmm0, 0xc
movd eax, xmm0
or eax, 1
mov dword [rbp - 0x24], eax
xor edi, edi
mov word [rbp - 0x20], di
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [rsp + 0x50], rax
lea rsi, vtable.CVolObject.0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
lea r14, vtable.CVolMem.0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x80], 0x40
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.140018c90
mov rdx, qword [rsp + 0x68]
cmp qword [rsp + 0x78], rdi
cmove rdx, rdi
lea rax, [rbp - 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400179fb
mov ebx, edi
jmp 0x140017a23
mov edx, 0x1f4
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 1
mov qword [rsp + 0x50], r14
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x140017a40
lea rcx, [rsp + 0x50]
mov r8, qword [rsp + 0x50]
call qword [r8 + 0x18]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x50], rsi
mov rax, rbx
jmp 0x140017a5b
xor eax, eax
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret