joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001f850
Capabilities:
Create directory
Get disk size

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rdi, rcx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop dword [rax + rax]
xor ebp, ebp
test eax, eax
jne 0x14001f891
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0xb7
je 0x14001f891
xor al, al
jmp 0x14001f98d
mov rsi, qword [rdi + 8]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rsi + rbx*2], bp
jne 0x14001f899
lea r8, [rbx + 0x10]
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.14000e2e4
lea rdx, [rbx + 0x10]
mov r9, rsi
mov rbx, qword [rsp + 0x60]
lea rax, str.probe.autosave
mov rcx, rbx
mov qword [rsp + 0x20], rax
lea r8, str._s_s
call fcn.1400018a0
test eax, eax
js 0x14001f973
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x82
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
cmp rax, 0xffffffffffffffff
je 0x14001f973
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
nop dword [rax + rax]
test eax, eax
je 0x14001f973
mov rcx, qword [0x140032588]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xe]
call qword [sym.imp.USER32.dll_SendMessageW]
nop dword [rax + rax]
mov edi, 1
lea ecx, [rdi + rax]
add rcx, rcx
cmp rcx, qword [rsp + 0x68]
jbe 0x14001f976
mov dil, bpl
test rbx, rbx
je 0x14001f98a
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov al, dil
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140023ee8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140031200], eax
call fcn.140024610
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140031200], 0
jne case.default.0x140023f3e
mov ecx, 1
call fcn.140024610
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
add byte [rax], dl
add byte [rcx + 0x16], al
adc eax, 0x4c001000
invalid
Function at 0x14009d1be
Capabilities:
Authenticate hmac

Disassembly:
add rsi, 4
xadd dx, bp
mov qword [rsp], rbp
imul rdx, qword [rsp]
xor ebx, edi
lea rcx, [rdx + rbp + 0x1f0a70a9]
bswap ebx
movsx r9d, cx
dec ebx
movzx r10d, r9w
add byte [rsp + r9*2 - 0xf8c5], cl
jg 0x14018c6bf
rol r9d, 3
cqo
movzx r10d, cx
mul edx
lea r9d, [rax + r9 + 0x2d2dbca9]
adc dword [rsp + rax], 0x82bff895
inc al
call fcn.1401fdf80
neg r9b
mov edx, dword [r9 + r10 - 0xf8a3478]
adc r9d, dword [rsp + r9 - 0xf8a3478]
mov ebp, esi
movsx ecx, byte [rsp + r9 - 0x1f1468fe]
lea r10, [r10 + r9*4 - 0x7c51a400]
sal r9w, cl
xor edx, r8d
shl r9d, 0x17
je 0x1400c34c8
sub r9, 4
mov ebp, 0x5ab1f712
lea rax, [rbp + rbp*4 + 0xa23cd3b]
cbw
mov ebp, dword [rbp + r9 - 0x5ab1f712]
mov r11d, eax
cdqe
movzx ecx, r11b
xor ebp, edi
rol ebp, 1
movsx r8d, r11b
inc ebp
jmp 0x14009e168
movsx ebx, cl
cdqe
bswap ebp
shr cl, 0xa3
ror ax, 0x83
xor r11w, r8w
rol ebp, 2
cqo
sal ax, 0xb
bswap ebp
jnp 0x1401e3717
lea ebp, [rbp + rax*4 - 0x12a66a03]
neg ax
push rdi
add r8d, edx
xor dword [rsp + rcx*4 - 0x48], ebp
and eax, edx
bts r8d, edx
shl dx, 0x45
pop rdi
sar r8w, 0x22
movsxd rbp, ebp
adc rsi, rbp
mov rbx, qword [r10 + rcx*2 - 0x24]
mul r8
mov rcx, qword [r10 + rcx*2 - 0x1c]
and r8d, 0xbdb16f04
lea r10, [rdx + r10 + 8]
xchg r11w, ax
adc rbx, rcx
sub r8, rax
mov qword [rdx + r10], rbx
mov ebp, edx
btc r8d, 0x90
movzx ecx, r11w
add rdx, rsi
jmp rdx
lea edx, [rdx + r9 + 0x759324a0]
movzx ebx, word [rsp + r9 + 2]
sub r9b, bpl
rol edx, 3
rol si, 0xa7
bswap edx
movsx eax, bp
sar bl, 0xc6
ror edx, 3
dec edx
and si, r9w
lea rax, [rcx - 0x4452faec]
neg edx
or ecx, ecx
pop rbp
sar r9, 0xb1
lea edx, [r9 + rdx - 0x3bb52405]
add rsi, rax
ror edx, 1
and ax, cx
bts eax, ebx
sbb ebp, 0x581d69b4
lea edx, [rdx + r9 - 0x3cbfcd38]
cbw
push r8
not ecx
xor dword [rsp + r9], edx
push rbx
shr qword [rsp + r9*8], cl
lea r8, [rax*8 + 0x53946b26]
mov r8, qword [rsp + r9*2 + 8]
add al, sil
movsxd rdx, edx
push rbp
imul rbp, rcx
add r11, rdx
imul cl
mov qword [rsp + r9*4 + 0x10], rax
sbb ax, word [rsp + r9 + 0x15]
mov qword [rsp + r9*4], r11
ret 0x10
xor ebx, 0xb4b9f7a5
xor r10d, r10d
push rdx
lea ebx, [rbx + r10 - 0x3208d290]
lea rbp, [r9*2 + 0x5b2f5da6]
mov qword [rsp + rbp - 0x5b305668], rdi
shr word [rsp + rbp - 0x5b30566c], cl
xor dword [rsp + rbp - 0x5b305668], ebx
push r10
neg edx
mov byte [rsp + rdx - 0x3361c8da], ch
mov rdi, qword [rsp + rbp - 0x5b305660]
call fcn.1400b9230
neg ecx
sal word [rsp + rsi - 0x626a], 0xeb
shl sil, 3
movzx eax, si
bswap ecx
sbb rdx, rax
neg ecx
sub r10w, r11w
sal qword [rsp + rsi - 0x61f9], 0x69
lea r11, [rsi*4 - 0x7cd5ed3]
dec ecx
xor rbp, qword [rsp + rsi*8 - 0x30ff0]
xadd r10w, dx
xor al, dil
add al, 0x32
neg rbp
or word [rsp + rcx*2 - 0x25fffc], 0x35a7
xor al, 8
sub ebp, r8d
sal ecx, 0xb4
mov edx, dword [rsp + rcx + 5]
sbb al, 3
xor al, bpl
pop rcx
xor cl, byte [rsp + rbx - 0x659700b7]
sbb al, 0xbf
inc rcx
xor dil, al
xor bpl, 0x25
inc rcx
Function at 0x1400aa0ae
Capabilities:
Authenticate hmac

Disassembly:
dec esi
jg 0x14024ba62
xor ebp, ebx
imul ax, cx
movsx edx, byte [rsp + rax + 9]
mov qword [rsp + rax*2], rcx
ror ebp, 1
and cl, al
not r8d
btc si, 0x9c
bswap ebp
rol al, 0xe7
neg cl
neg ebp
btr r8d, eax
mul esi
shl word [rsp + rax + 3], 0xaf
not ebp
inc r9w
jp 0x1401cd1f7

Function at 0x1400bdfdf
Capabilities:
Authenticate hmac

Disassembly:
sub r10b, r11b
cbw
dec cl
xor bl, cl
neg eax
lea rcx, [rsp + rcx + 8]
ror byte [rsp + r11*2 - 0x747fa94e], 0x62
add ax, word [rcx + r11*2 - 0x747fa952]
movsx edx, r10w
lea r8, [r8 + r11 - 0x3a3fd4ab]
or qword [rsp + r11*2 - 0x747fa952], r10
mov word [r8 + r11*2 - 0x747fa952], ax
movsx eax, bp
pop r10
jne fcn.1401129ac
lea rsi, [r11 + r11*4 - 0x1c62c057]
movzx eax, sil
ror r10d, 1
dec r10d
neg r10d
mov qword [rsp + r11*2 - 0x747fa952], 0xffffffff928271a6
bswap r10d
lea rbp, [rsi*4 + 0x4bb8baa]
shr word [rsp + rax - 0xf0], 0x44
movsx ecx, byte [rsp + r11 - 0x3a3fd4a9]
ror r10d, 2
bswap ecx
sub word [rsp + r11*2 - 0x747fa94c], r11w
mov qword [rsp + r11 - 0x3a3fd4a9], rbx
xor dword [rsp + r11 - 0x3a3fd4a9], r10d
inc bpl
imul esi, esi
pop rbx
movsxd r10, r10d
dec ax
add rdi, r10
not ax
btr rsi, rax
movzx ecx, byte [r11 + r9 - 0x3a3fd4a9]
lea r9, [r11 + r9 - 0x3a3fd4a8]
setae al
btc esi, eax
xor cl, bl
inc sil
rol cl, 1
push rsi
lea r10, [r11 + r11*4 - 0x2ada837b]
sub cl, 0xbc
xor cl, 0x99
jmp 0x14009d174

Function at 0x1400c52dc
Capabilities:
Authenticate hmac

Disassembly:
cld
mov qword [rsp], 0xffffffff8197182e
rep movsb byte [rdi], byte [rsi]
call fcn.14023cee6

Function at 0x1400e20e7
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rcx*4 - 0x5748], rdi
xor dword [rsp + rcx*4 - 0x5748], ebp
mov qword [rsp + rcx*8 - 0xaea0], rcx
xor cx, word [rsp + rcx*8 - 0xae9f]
mov eax, 0xd12796aa
mov rdi, qword [rsp + rcx*4 - 0x56fc]
not eax
cbw
movsxd rbp, ebp
mov qword [rsp + rbx - 0x6f8a], 0xffffffffca2e0481
add word [rsp + rcx*4 - 0x56f7], 0xd908
add rsi, rbp
cqo
shr ebx, cl
mov ebp, r10d
pop r10
pop rax
ja fcn.140166422

Function at 0x1400ea6e9
Capabilities:
Authenticate hmac
Parse pe header

Disassembly:
not dx
lea r9, [rdx + r9 - 0x56f6f5e2]
push rbp
xor byte [rsp + rdx - 0x56f6f5e2], ch
mov qword [rsp + rdx - 0x56f6f5de], rcx
xor eax, ebx
ror eax, 1
bts r10, 0x3b
not eax
lea rcx, [r10 - 0x66ca7fd4]
or cl, 9
btr r10, r11
inc eax
bswap eax
shl bp, 0x4d
xchg dword [rsp + rdx - 0x56f6f5e2], ebp
neg eax
xchg r10w, bp
ror word [rsp + rbp - 0x91f8], cl
mov qword [rsp + rbp*2 - 0x123f8], rbx
shr r11b, 6
sar r10d, 0x13
lea r11, [r10 + r11*8 - 0x5fe24ad9]
xor dword [rsp + rbp - 0x91f8], eax
rol word [rsp + rbp - 0x91fe], cl
jb 0x1401bfda1
mov rbx, qword [rsp + rbp - 0x91f8]
bswap rcx
bts rcx, 0x17
sar byte [rsp + rbp - 0x91fc], 0x27
movsxd rax, eax
dec r11w
adc rdi, rax
add r10b, 0x3c
jns 0x1400f1a94
pop rax
pop r11
jnp fcn.1401129ac
movzx r10d, byte [rsi + riz]
movsx r9d, cx
not r9d
add rsi, 1
lea rax, [rbp + r9*8 + 0x193b72b8]

Function at 0x140139c51
Capabilities:
Authenticate hmac

Disassembly:
lea r10, [rbp + r10 - 0xfa1239b]
xor ebx, r8d
or ebp, 0xf347c09
inc ebx
call fcn.14014ede9
Function at 0x1401eb9eb
Capabilities:
Authenticate hmac

Disassembly:
push r10
pop r10
pop rdx
pop rcx
js fcn.140210613
neg rdx
lea r11, [r11 + rdx + 0xf987f]
mov word [rdx + r11 + 0xf9881], bx
xchg rdx, rax
jnp 0x14012fc5e
add ebp, r9d
or r9d, dword [rsp + rcx*4 - 0x5752fff]
rol rcx, 0x74
neg r9b
xor ebp, 0xa333cb92
rol ebp, 2
call fcn.1400e20e7
xor r8w, ax
call fcn.1402598d8

Function at 0x14024a81c
Capabilities:
Authenticate hmac

Disassembly:
inc cl
movzx r9d, cl
lea r8, [r8 + rcx - 0x31a8ea78]
imul cx, cx
pop r9
mov qword [r10 + rcx*2 - 0x6351d080], rbx
lea r11, [rcx + r11 - 0x31a8e844]
jno fcn.1401079b4
mov r9d, dword [r11 + rcx*2 - 0x6351d080]
movsx r10d, cl
xor r9d, edi
movzx eax, cl
mul r10
cmovb r10, rax
not r9d
neg r9d
xor r9d, 0xfa34d630
sub edx, 0x5cb26780
mov ebx, ecx
lea r9d, [rcx + r9 - 0x38c6ef52]
and ebx, r10d
movsx ebp, bx
push rdi
rol bpl, 5
dec ebp
xor dword [rsp + rcx - 0x31a8e840], r9d
mov edi, 0x68bcb41e
shl edx, 0xc7
pop rdi
sbb cx, dx
and edx, ebp
movsxd r9, r9d
jno 0x1401f1446

Function at 0x14024a8a8
Capabilities:
Authenticate hmac

Disassembly:
push 0xffffffffe30afea2
call fcn.1400bc62a
push r11
call fcn.1401ed4e9
lea rdi, [rdi + rbp*4 - 0x11064]
rol ax, cl
adc qword [rsp + rdx + 8], r9
imul ebp
inc ecx
shr dl, 0x63
push qword [rsp + 8]
popfq
or qword [rsp + rdx - 0x1d05], r11
ret 8
lea rsp, [rsp + 0x18]
ja 0x140112808
mov eax, 0x5c0c63bd
movzx ebx, al
rol bl, 0x87
mov rax, rsp
shl ebx, 0x23
movzx esi, bl
mov ecx, ebx
lea ecx, [rsi + 0x60]
lea rbx, [rsi + rbp - 0x170]
adc sil, sil
and rbx, 0xfffffffffffffff0
shl rsi, 0x6f
sbb rbx, rcx
bswap esi
mov rsp, rbx
push rsi
not esi
call fcn.1400ab636
mov ebp, dword [r8]
mov edx, 0xff22723d
mov cl, byte [r8 + riz + 4]
movzx r11d, dx
lea r8, [r8 + r11*2 - 0xe478]
sal ebp, cl
lea rdx, [rdx + rdx*2 - 0xe68b149]
mov dword [r8 + r11*8 - 0x391e8], ebp
imul rdx, rdx
movsx eax, r11w
mov eax, dword [r9 + r11 - 0x723d]
jo 0x1401a8e3c
Function at 0x140177c60
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140177c6d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140177c7d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140177c65
lea eax, [rcx + 1]
jmp 0x140177c8b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140177c9e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140177c84
sub eax, 3
jb 0x140177cbe
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140177d0d
sar eax, 1
movsxd rbp, eax
jb 0x140177cf4
jmp 0x140177ccc
add ebx, ebx
jne 0x140177cca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140177cf4
inc ecx
add ebx, ebx
jne 0x140177cda
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140177cf4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140177ced
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140177cdc
add ecx, 2
jmp 0x140177cf9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140177c22
jmp 0x140177c6d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xe9c00
mov dl, 0x19
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140177d59
cmp rsi, rcx
jae 0x140177d61
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140177d40
cmp al, 0x8f
ja 0x140177d40
cmp byte [rsi - 2], 0xf
je 0x140177d46
sub al, 0xe8
cmp al, 1
ja 0x140177d2a
cmp rsi, rcx
jae 0x140177d61
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140177d30
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140177d61
lodsb al, byte [rsi]
jmp 0x140177d40
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x172000]
mov eax, dword [rdi]
or eax, eax
je 0x140177dca
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1775bc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140177d6e
jns 0x140177da3
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140177dad
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140177dc4
mov qword [rbx], rax
add rbx, 8
jmp 0x140177d8e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140177e04
cmp al, 0xef
ja 0x140177df6
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140177dd6
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140177de5
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x25f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140177e58
sub rsp, 0xffffffffffffff80
jmp 0x1400c4b78
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00404440]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x00404450]
mov dword [rax], 1
mov rax, qword [0x00404460]
mov dword [rax], 1
mov rax, qword [0x00404430]
mov dword [rax], 1
mov rax, qword [0x004042f0]
cmp word [rax], 0x5a4d
je 0x4010d0
mov rax, qword [0x00404420]
mov dword [0x00407008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010c2
mov ecx, 2
call sym.__set_app_type
mov rcx, 0xffffffffffffffff
call dbg._encode_pointer
mov rdx, qword [0x00404380]
mov qword [rdx], rax
mov rdx, qword [0x00404370]
mov qword [rdx], rax
mov rax, qword [0x004043e0]
mov edx, dword [rax]
mov rax, qword [sym.imp.msvcrt.dll__fmode]
mov rax, qword [rax]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x004042a0]
cmp dword [rax], 1
je 0x401120
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401133
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058
Function at 0x401780
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x00407054]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x40189a
mov rax, qword [0x00407058]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x4017ce
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x401880
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x4017b2
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x4018d2
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x00407058]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call dbg._GetPEImageBase
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x00407058]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4018b5
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x401879
sub eax, 0x40
and eax, 0xffffffbf
je 0x401879
mov r9, rbp
add r9, qword [0x00407058]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4018a1
add dword [0x00407054], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.memcpy
xor ebp, ebp
jmp 0x4017db
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
mov rax, qword [0x00407058]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbp + 8]
call dbg.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call dbg.__report_error
nop
nop word cs:[rax + rax]

Function at 0x4024b0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x4024c0
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x4024d0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x402511
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x402508
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x402513
add rax, 0x28
cmp rax, r9
jne 0x4024f4
xor eax, eax
repz ret

Function at 0x4025c0
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x004042f0]
cmp word [rbx], 0x5a4d
je 0x4025e0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, rcx
mov rcx, rbx
call sym._ValidateImageBase.part.0
test eax, eax
je 0x4025d4
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp dbg._FindPESection
Function at 0x402830
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004079c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004079a0]
test rbx, rbx
je 0x402884
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x40287b
test rsi, rsi
je 0x40287b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x402860
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x004079c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
Function at 0x140005270
Capabilities:
Start service

Disassembly:
push rbx
sub rsp, 0x20
mov r8d, 0xf01ff
lea rdx, str.PiaWFPCallout
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
je 0x1400052cf
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x1400052bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x1400052cf
mov eax, 1
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400052e0
Capabilities:
Print debug messages

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x140021010]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
xor eax, eax
mov dword [rsp + 0x38], 0x20
mov rbx, r8
mov qword [rsp + 0x3c], rax
mov edi, ecx
mov qword [rsp + 0x44], rax
mov rcx, rbx
mov qword [rsp + 0x4c], rax
lea r8, [rsp + 0x38]
mov dword [rsp + 0x54], eax
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x14000534c
lea rcx, str.SetupDiEnumDeviceInfo_FAILED
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
jmp 0x14000544c
mov r9d, 0x14
mov dword [rsp + 0x20], 8
lea r8, [rsp + 0x20]
mov dword [rsp + 0x24], 0x12
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x2c], 1
mov rcx, rbx
mov dword [rsp + 0x28], edi
call qword [sym.imp.SETUPAPI.dll_SetupDiSetClassInstallParamsW]
test eax, eax
jne 0x14000539a
lea rcx, str.SetupDiSetClassInstallParams_FAILED
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
jmp 0x14000544c
mov r9d, 0x14
mov dword [rsp + 0x20], 8
lea r8, [rsp + 0x20]
mov dword [rsp + 0x24], 0x12
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x2c], 1
mov rcx, rbx
mov dword [rsp + 0x28], edi
call qword [sym.imp.SETUPAPI.dll_SetupDiSetClassInstallParamsW]
test eax, eax
je 0x14000543a
lea r8, [rsp + 0x38]
mov rdx, rbx
mov ecx, 0x12
call qword [sym.imp.SETUPAPI.dll_SetupDiCallClassInstaller]
test eax, eax
je 0x14000543a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rsp + 0x60]
mov dword [rsp + 0x60], 0x248
lea rdx, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstallParamsW]
test eax, eax
jne 0x140005421
lea rcx, str.SetupDiGetDeviceInstallParams_FAILED
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
jmp 0x14000544c
call qword [sym.imp.KERNEL32.dll_GetLastError]
test dword [rsp + 0x64], 0x180
je 0x140005447
lea rcx, str.Need_Restart_Computer
jmp 0x140005441
lea rcx, str.SetupDiSetClassInstallParams_or_SetupDiCallClassInstaller_FAILED
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.140006c50
add rsp, 0x2c0
pop rdi
pop rbx
pop rbp
ret
Function at 0x140005470
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140021010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
mov dword [rsp + 0x28], 0x20
mov rdi, rdx
mov qword [rsp + 0x2c], rax
mov edx, ecx
mov qword [rsp + 0x34], rax
mov ebx, ecx
mov qword [rsp + 0x3c], rax
mov rcx, rdi
mov dword [rsp + 0x44], eax
lea r8, [rsp + 0x28]
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x1400054f3
lea rcx, str.SetupDiEnumDeviceInfo_FAILED
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, 1
mov r8, rdi
mov edx, ebx
call fcn.1400052e0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140006c50
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov r8d, dword [rsp + 0x3c]
lea rdx, [rsp + 0x24]
xor r9d, r9d
lea rcx, [rsp + 0x20]
call qword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Status]
test eax, eax
je 0x140005518
lea rcx, str.CM_GET_DevNode_Status_FAILED
jmp 0x1400054c6
test dword [rsp + 0x20], 0x2000
je 0x1400054cc
cmp dword [rsp + 0x24], 0x1d
je 0x1400054cc
xor eax, eax
mov dword [rsp + 0x28], 0x20
lea r8, [rsp + 0x28]
mov qword [rsp + 0x2c], rax
mov edx, ebx
mov qword [rsp + 0x34], rax
mov rcx, rdi
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], eax
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x140005571
lea rcx, str.SetupDiEnumDeviceInfo_FAILED
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, 2
jmp 0x1400054d1
mov r8d, dword [rsp + 0x3c]
lea rdx, [rsp + 0x20]
xor r9d, r9d
lea rcx, [rsp + 0x24]
call qword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Status]
test eax, eax
je 0x1400055a4
lea rcx, str.CM_GET_DevNode_Status_FAILED
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, 2
jmp 0x1400054d1
test dword [rsp + 0x24], 0x400
je 0x1400055b9
cmp dword [rsp + 0x20], 0x16
je 0x1400054cc
mov ecx, 2
jmp 0x1400054d1