joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140146716
Capabilities:
Authenticate hmac

Disassembly:
push rax
pushf
mov eax, 0xb64a4155
pushf
not eax
add eax, 0x38118b22
xor eax, 0x48abf27c
rol eax, 0x36
popf
pushf
not eax
add eax, 0x4f4d0350
xor eax, 0xa40a928
rol eax, 0xc4
popf
pushf
not eax
add eax, 0x79873aca
xor eax, 0x714ea47f
rol eax, 0xf4
popf
pushf
not eax
add eax, 0x42fe6c1d
xor eax, 0x5e354184
rol eax, 0x94
popf
cmp eax, 2
jne 0x140146779
popf
pop rax
jmp 0x14014690e
cmp eax, 1
jne 0x140146788
popf
pop rax
jmp 0x14014687a
cmp eax, 4
jne 0x140146797
popf
pop rax
jmp 0x140146a48
cmp eax, 3
jne 0x1401467a6
popf
pop rax
jmp 0x140146a07
cmp eax, 0
jne 0x1401467b5
popf
pop rax
jmp 0x1401467b5
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.14010a427
lea rdi, [rax + 0x90]
mov ecx, dword [rax + 0x3a8]
mov eax, dword [0x14003ea90]
test eax, ecx
je 0x140146821
push rax
pushf
mov eax, 0x4ec7882e
pushf
not eax
add eax, 0x1673284e
xor eax, 0x999e80d
rol eax, 0xa6
popf
pushf
not eax
add eax, 0x4238015c
xor eax, 0x4ec2bd8d
rol eax, 0x85
popf
pushf
not eax
add eax, 0x5f7226a5
xor eax, 0x728a01e5
rol eax, 0x21
popf
jmp 0x14014676a
push rax
pushf
mov eax, 0xf4adbc29
pushf
not eax
add eax, 0xd400f4b
xor eax, 0x3c09d73d
rol eax, 0x64
popf
pushf
not eax
add eax, 0x1aa09697
xor eax, 0x59dcd8a8
rol eax, 0xc6
popf
pushf
not eax
add eax, 0x4a4201eb
xor eax, 0x419fcff5
rol eax, 0x7d
popf
pushf
not eax
add eax, 0xcd55711
xor eax, 0x554d3169
rol eax, 0xae
popf
jmp 0x14014676a
mov rbx, qword [rdi]
test rbx, rbx
jne 0x1401468db
push rax
pushf
mov eax, 0x8956a0d6
pushf
not eax
add eax, 0x1e6278c8
xor eax, 0x17ddd5d6
rol eax, 0xf5
popf
pushf
not eax
add eax, 0x565b8c9b
xor eax, 0x5fceb141
rol eax, 0xc9
popf
pushf
not eax
add eax, 0x340d6ce5
xor eax, 0x5a02a91a
rol eax, 0x53
popf
pushf
not eax
add eax, 0x4ba4a420
xor eax, 0x50b72bab
rol eax, 0x54
popf
jmp 0x14014676a
push rax
pushf
mov eax, 0xbd1344ee
pushf
not eax
add eax, 0x5646e125
xor eax, 0x6d9edead
rol eax, 0x54
popf
pushf
not eax
add eax, 0x681c1eb9
xor eax, 0x3e9cd3e4
rol eax, 0xca
popf
jmp 0x14014676a
mov ecx, 0xe75e3e40
pushf
not ecx
add ecx, 0x4178780d
xor ecx, 0xf518b44
rol ecx, 0xa4
popf
pushf
not ecx
add ecx, 0x6ad748df
xor ecx, 0x161d2059
rol ecx, 0xb2
popf
call fcn.140131753
nop
mov rdx, qword [0x140042a28]
mov rcx, rdi
call fcn.140146a4d
mov rbx, rax
mov ecx, 0x1a3e62b2
pushf
not ecx
add ecx, 0x7a1853ee
xor ecx, 0x50d0f4e7
rol ecx, 0xbb
popf
pushf
not ecx
add ecx, 0x3f978d34
xor ecx, 0x7f1f4505
rol ecx, 0x65
popf
call fcn.1401319c3
test rbx, rbx
je 0x1401469c1
push rax
pushf
mov eax, 0x2e71bc7f
pushf
not eax
add eax, 0xea5ef99
xor eax, 0x4f28b617
rol eax, 0xd2
popf
pushf
not eax
add eax, 0x34942835
xor eax, 0x20696bc2
rol eax, 0x8c
popf
jmp 0x14014676a
push rax
pushf
mov eax, 0x6650c61b
pushf
not eax
add eax, 0x3df29c26
xor eax, 0x4985d85e
rol eax, 0xff
popf
pushf
not eax
add eax, 0x2200832b
xor eax, 0x5fefe89b
rol eax, 0xf1
popf
pushf
not eax
add eax, 0x5ad29a02
xor eax, 0x319bfffe
rol eax, 0xf3
popf
jmp 0x14014676a
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call fcn.140105718
Function at 0x140153154
Capabilities:
Authenticate hmac

Disassembly:
push rax
pushf
mov eax, 0xe60993df
pushf
not eax
add eax, 0x7dd9b487
xor eax, 0x8715d8b
rol eax, 0xc0
popf
pushf
not eax
add eax, 0xccb7c5c
xor eax, 0x6d29ff2f
rol eax, 0x8e
popf
cmp eax, 2
jne 0x140153191
popf
pop rax
jmp 0x140153333
cmp eax, 1
jne 0x1401531a0
popf
pop rax
jmp 0x1401532a3
cmp eax, 0
jne 0x1401531af
popf
pop rax
jmp 0x1401531af
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rax, rdx
mov edi, r9d
mov r9d, 0xdca541c
pushf
not r9d
add r9d, 0x18bc033b
xor r9d, 0x4bc38584
rol r9d, 0x4a
popf
pushf
not r9d
add r9d, 0x38677f4e
xor r9d, 0x6fbc1649
rol r9d, 0x95
popf
mov rsi, r8
mov rbx, rcx
mov r8, rcx
mov rcx, rax
lea edx, [r9 + 0x20]
call fcn.140138c02
xor ecx, ecx
test eax, eax
jne 0x14015324a
push rax
pushf
mov eax, 0xfa9739aa
pushf
not eax
add eax, 0x678c6aa1
xor eax, 0x1c63f246
rol eax, 0x21
popf
pushf
not eax
add eax, 0x21c3e5b8
xor eax, 0x966057
rol eax, 0x22
popf
jmp 0x140153182
push rax
pushf
mov eax, 0x87934fd9
pushf
not eax
add eax, 0x49273fbf
xor eax, 0x1683db05
rol eax, 0x40
popf
pushf
not eax
add eax, 0x7a180916
xor eax, 0x7bf91e30
rol eax, 0xbf
popf
pushf
not eax
add eax, 0x657b83a
xor eax, 0x49a6b5cc
rol eax, 0xb
popf
pushf
not eax
add eax, 0xf13e631
xor eax, 0x179c0bad
rol eax, 0xcb
popf
jmp 0x140153182
mov qword [rsp + 0x38], rcx
or r9d, 0xffffffff
mov qword [rsp + 0x30], rcx
mov r8, rbx
mov dword [rsp + 0x28], 0x40
mov ecx, edi
xor edx, edx
mov qword [rsp + 0x20], rsi
call fcn.140134307
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
xor edx, edx
call fcn.1401071a8
Function at 0x14016f4f7
Capabilities:
Clear file content

Disassembly:
push rax
pushf
mov eax, 0x9cae436
pushf
not eax
add eax, 0x2722a3f0
xor eax, 0x20b63e86
rol eax, 0xba
popf
pushf
not eax
add eax, 0x7bb5f531
xor eax, 0x3c70005c
rol eax, 8
popf
pushf
not eax
add eax, 0x4393480e
xor eax, 0x7523d7cb
rol eax, 0x33
popf

Function at 0x1401709ad
Capabilities:
Authenticate hmac
Encrypt data using chaskey
Parse credit card information

Disassembly:
push rax
pushf
mov eax, 0x3373f9af
pushf
not eax
add eax, 0x16921112
xor eax, 0x778ccd8a
rol eax, 0x91
popf
pushf
not eax
add eax, 0x54f17bd9
xor eax, 0x60cd568c
rol eax, 0x71
popf
pushf
not eax
add eax, 0x210b79df
xor eax, 0x6908ae00
rol eax, 0x97
popf
pushf
not eax
add eax, 0x8a76de8
xor eax, 0x66eabfd
rol eax, 9
popf

Function at 0x140173995
Capabilities:
Encrypt data using speck

Disassembly:
push rax
pushf
mov eax, 0x3a29a60
pushf
not eax
add eax, 0x6f8ab514
xor eax, 0x617f305c
rol eax, 0xe4
popf
pushf
not eax
add eax, 0x744c4a29
xor eax, 0x730783e7
rol eax, 0xc
popf
pushf
not eax
add eax, 0x23a2e893
xor eax, 0x25767d2b
rol eax, 0x86
popf
pushf
not eax
add eax, 0x183f2163
xor eax, 0x3f9aa9c9
rol eax, 0xfb
popf
Function at 0x1400047e4
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1400128b8]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea r14, str.en_US
mov rsi, rcx
mov qword [rcx], r14
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov word [rsp + 0x30], ax
mov ebx, 0x10
mov r9d, ebx
lea rdx, [0x140008110]
lea rax, [0x140004df0]
mov r8d, 0x1b3
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call sub.api_ms_win_crt_private_l1_1_0.dll__o_bsearch
xor ebp, ebp
test rax, rax
jne 0x14000485f
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400048e5
cmp dword [rax + 0xc], 0x7c
jne 0x14000486c
cmp word [rax + 8], 0x7f
jne 0x14000484f
mov r8, qword [rax]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [r8 + rcx*2], bp
jne 0x140004873
inc rcx
cmp rcx, 0x7ffffffe
jbe 0x140004890
mov word [rsp + 0x38], bp
jmp 0x1400048d7
lea rax, [rsp + 0x38]
mov r9d, ebp
sub r8, rax
lea rdx, [rsp + 0x38]
lea rax, [rbx - 0x10]
add rax, rcx
je 0x1400048c0
movzx eax, word [r8 + rdx]
test ax, ax
je 0x1400048c0
mov word [rdx], ax
add rdx, 2
sub rbx, 1
jne 0x1400048a0
test rbx, rbx
jne 0x1400048cf
sub rdx, 2
mov r9d, 0x8007007a
mov word [rdx], bp
test r9d, r9d
jns 0x1400048e1
mov ecx, 0x7a
jmp 0x140004854
test ecx, ecx
jne 0x1400048f1
mov rcx, qword [rsp + 0x78]
call fcn.14000494c
jmp 0x14000492a
mov rbx, rbp
mov rdi, rbp
mov rdx, qword [rdi + r14]
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
test eax, eax
je 0x14000491c
inc rbx
add rdi, 0x30
cmp rdi, 0x750
jb 0x1400048f7
jmp 0x14000492a
lea rax, [rbx + rbx*2]
shl rax, 4
add rax, r14
mov qword [rsi], rax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400050e0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x140005104
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140012e60], eax
call fcn.1400056f0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140012e60], 0
jne case.default.0x14000515a
mov ecx, 1
call fcn.1400056f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
cmc
or al, 0x99
invalid
mov ds, word [0x19d6ea0af]
jg 0x14001acaa
movabs al, byte [0xf0ebca3d7365f1be]
invalid
Function at 0x1400019e0
Capabilities:
Check if file exists
Create directory
Query environment variable

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x490
mov qword [rsp + 0x478], 0xfffffffffffffffe
mov rax, qword [0x140042dd0]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rcx, qword [rsp + 0x4a0]
add rcx, 8
mov r8d, 0x3ec
lea rdx, [rsp + 0x468]
call fcn.140002e80
mov rcx, rax
call fcn.14000a6a0
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14001a720
lea rcx, [rsp + 0x20]
call fcn.140002590
mov edx, eax
mov rax, qword [rsp + 0x4a0]
mov dword [rax + 0x44], edx
mov rax, qword [rsp + 0x4a0]
cmp dword [rax + 0x44], 0xffffffff
jne 0x140001ac4
lea rcx, [rsp + 0x28]
call fcn.140002ff0
nop
mov edx, 0x27e1
lea rcx, [rsp + 0x28]
call fcn.140003c90
lea rcx, [rsp + 0x28]
call fcn.14000a6a0
mov rcx, qword [rsp + 0x4a0]
add rcx, 8
xor r9d, r9d
lea r8, [0x140034944]
mov rdx, rax
call fcn.140002ec0
nop
lea rcx, [rsp + 0x28]
call fcn.1400040d0
jmp 0x140001c31
mov rcx, qword [rsp + 0x4a0]
add rcx, 8
mov edx, 0x3ff
call fcn.140002e50
mov edx, eax
mov rax, qword [rsp + 0x4a0]
mov dword [rax + 0x54], edx
mov rcx, qword [rsp + 0x4a0]
add rcx, 8
mov r8d, 0x3ff
lea rdx, [rsp + 0x470]
call fcn.140002e80
mov rcx, rax
call fcn.140002db0
test eax, eax
je 0x140001c1d
xor eax, eax
mov word [rsp + 0x250], ax
lea rdi, [rsp + 0x252]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov r8d, 0x104
lea rdx, [rsp + 0x250]
lea rcx, [0x140034998]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [rsp + 0x250]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140001b6e
xor edx, edx
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
mov word [rsp + 0x40], ax
lea rdi, [rsp + 0x42]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
lea r8, [rsp + 0x250]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.140022658
lea rdx, [0x1400349c0]
lea rcx, [rsp + 0x40]
call fcn.140002ac0
lea rcx, [rsp + 0x460]
call fcn.140002ff0
nop
mov rcx, qword [rsp + 0x4a0]
add rcx, 8
mov edx, 0x3ff
call fcn.140002e50
mov r8d, eax
lea rdx, [0x1400349dc]
lea rcx, [rsp + 0x460]
call fcn.140003010
lea rcx, [rsp + 0x460]
call fcn.14000a6a0
lea r9, [rsp + 0x40]
mov r8, rax
lea rdx, str.DiskReadOnly
lea rcx, [0x140034a08]
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
nop
lea rcx, [rsp + 0x460]
call fcn.1400040d0
mov edx, dword [rsp + 0x4b0]
mov rcx, qword [rsp + 0x4a0]
call fcn.140002380
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1400226f0
add rsp, 0x490
pop rdi
ret
Function at 0x140005030
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0xd8], 0x80004004
jne 0x140005072
mov rax, qword [rsp + 0x40]
mov dword [rax + 0xd8], 0
mov eax, 0x80004004
jmp 0x14000518a
mov rcx, qword [rsp + 0x40]
add rcx, 0x88
call fcn.14000bec0
test eax, eax
jne 0x14000511c
mov rax, qword [rsp + 0x40]
mov dword [rax + 0xd8], 0
mov rcx, qword [rsp + 0x40]
add rcx, 0xd0
mov rdx, qword [rsp + 0x58]
call fcn.14000a040
mov r11, qword [rsp + 0x40]
mov dword [r11 + 0xe8], 1
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0xe0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov r9, qword [rsp + 0x40]
sub r9, 0x50
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400051a0]
xor edx, edx
xor ecx, ecx
call fcn.14002355c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0xe0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
imul rax, rax, 0x64
xor edx, edx
mov rcx, qword [rsp + 0x50]
div qword [rcx]
mov rcx, qword [rsp + 0x40]
add rcx, 0x80
mov r9d, 0x64
mov r8d, eax
xor edx, edx
call fcn.14001ce90
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
cmp qword [rcx], rax
jb 0x14000517f
mov rcx, qword [rsp + 0x40]
add rcx, 0x88
xor r9d, r9d
mov r8d, 1
mov edx, VarUI4FromDisp
call fcn.14000bd80
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xd8]
add rsp, 0x38
ret

Function at 0x140005840
Capabilities:
Query environment variable
Read .ini file

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x460
mov rax, qword [0x140042dd0]
xor rax, rsp
mov qword [rsp + 0x450], rax
xor eax, eax
mov word [rsp + 0x30], ax
lea rdi, [rsp + 0x32]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov r8d, 0x104
lea rdx, [rsp + 0x30]
lea rcx, [0x140034c60]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor edx, edx
mov word [rsp + 0x240], dx
lea rdi, [rsp + 0x242]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
lea r8, [rsp + 0x30]
mov edx, 0x104
lea rcx, [rsp + 0x240]
call fcn.140022658
lea rdx, [0x140034c88]
lea rcx, [rsp + 0x240]
call fcn.140002ac0
lea r9, [rsp + 0x240]
xor r8d, r8d
lea rdx, [0x140034ca8]
lea rcx, [0x140034cd0]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x1400058fc
mov eax, 1
jmp 0x1400058fe
xor eax, eax
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400226f0
add rsp, 0x460
pop rdi
ret
Function at 0x1400066f0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x60
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140006935
cmp dword [rsp + 0x20], 1
jle 0x140006935
mov rdx, qword [rsp + 0x28]
mov rdx, qword [rdx + 8]
lea rcx, [rsp + 0x38]
call fcn.14000c070
nop
lea rdx, [0x140034de8]
lea rcx, [rsp + 0x38]
call fcn.14000c1a0
test eax, eax
je 0x140006779
lea rdx, [0x140034e00]
lea rcx, [rsp + 0x38]
call fcn.14000c1a0
test eax, eax
jne 0x1400067ae
cmp dword [rsp + 0x20], 3
jne 0x140006793
mov rdx, qword [rsp + 0x28]
mov rdx, qword [rdx + 0x10]
mov rcx, qword [rsp + 0x70]
call fcn.140009070
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
lea rcx, [rsp + 0x38]
call fcn.1400040d0
jmp 0x140006935
mov rdx, qword [rsp + 0x28]
mov rdx, qword [rdx + 8]
lea rcx, [rsp + 0x30]
call fcn.14000c070
nop
lea rcx, [rsp + 0x30]
call fcn.14000c120
mov edx, eax
sub edx, 1
lea rcx, [rsp + 0x30]
call fcn.14000c140
movzx eax, ax
cmp eax, 0x22
jne 0x140006801
lea rcx, [rsp + 0x30]
call fcn.14000c120
mov edx, eax
sub edx, 1
mov r8w, 0x5c
lea rcx, [rsp + 0x30]
call fcn.14000c160
cmp dword [rsp + 0x20], 2
jne 0x140006825
lea rcx, [rsp + 0x30]
call fcn.14000a6a0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x70]
call fcn.140008640
cmp dword [rsp + 0x20], 2
jle 0x140006914
mov rdx, qword [rsp + 0x28]
mov rdx, qword [rdx + 0x10]
lea rcx, [rsp + 0x48]
call fcn.14000c070
nop
lea rcx, [rsp + 0x48]
call fcn.14000c120
mov edx, eax
sub edx, 1
lea rcx, [rsp + 0x48]
call fcn.14000c140
movzx eax, ax
cmp eax, 0x22
jne 0x140006883
lea rcx, [rsp + 0x48]
call fcn.14000c120
mov edx, eax
sub edx, 1
mov r8w, 0x5c
lea rcx, [rsp + 0x48]
call fcn.14000c160
mov byte [rsp + 0x40], 0
cmp dword [rsp + 0x20], 3
jle 0x1400068dc
mov rdx, qword [rsp + 0x28]
mov rdx, qword [rdx + 0x18]
lea rcx, [rsp + 0x50]
call fcn.14000c070
nop
lea rdx, [0x140034e18]
lea rcx, [rsp + 0x50]
call fcn.14000c1a0
test eax, eax
je 0x1400068cd
lea rdx, [0x140034e28]
lea rcx, [rsp + 0x50]
call fcn.14000c1a0
test eax, eax
jne 0x1400068d2
mov byte [rsp + 0x40], 1
lea rcx, [rsp + 0x50]
call fcn.1400040d0
lea rcx, [rsp + 0x48]
call fcn.14000a6a0
mov rbx, rax
lea rcx, [rsp + 0x30]
call fcn.14000a6a0
movzx r9d, byte [rsp + 0x40]
mov r8, rbx
mov rdx, rax
mov rcx, qword [rsp + 0x70]
call fcn.140008640
nop
lea rcx, [rsp + 0x48]
call fcn.1400040d0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
lea rcx, [rsp + 0x30]
call fcn.1400040d0
nop
lea rcx, [rsp + 0x38]
call fcn.1400040d0
add rsp, 0x60
pop rbx
ret
Function at 0x140006d50
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
cmp qword [rsp + 0x70], 0x80
je 0x140006d81
movabs rax, 1
jmp 0x140006e8d
mov rax, qword [rsp + 0x60]
movzx eax, byte [rax + 0x84]
movzx eax, al
test eax, eax
jne 0x140006da2
mov rax, qword [rsp + 0x60]
cmp dword [rax + 0x88], 0
je 0x140006db1
movabs rax, 1
jmp 0x140006e8d
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0x202
je 0x140006dd6
cmp qword [rsp + 0x40], 0x205
je 0x140006e33
jmp 0x140006e8b
mov rcx, qword [rsp + 0x60]
call fcn.140007510
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rcx, qword [rsp + 0x60]
add rcx, 0x1b0
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x34]
mov r8d, dword [rsp + 0x30]
mov edx, 8
call fcn.14000a6f0
jmp 0x140006e8b
mov rcx, qword [rsp + 0x60]
call fcn.140007510
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rcx, qword [rsp + 0x60]
add rcx, 0x1b8
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x3c]
mov r8d, dword [rsp + 0x38]
xor edx, edx
call fcn.14000a6f0
xor eax, eax
add rsp, 0x58
ret
Function at 0x140008640
Capabilities:
Create thread

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rcx, qword [rsp + 0x50]
add rcx, 0xb8
mov rdx, qword [rsp + 0x58]
call fcn.140003df0
mov rcx, qword [rsp + 0x50]
add rcx, 0xc0
mov rdx, qword [rsp + 0x60]
call fcn.140003df0
mov r11, qword [rsp + 0x50]
movzx eax, byte [rsp + 0x68]
mov byte [r11 + 0xc8], al
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x50]
lea r8, [0x140007ec0]
xor edx, edx
xor ecx, ecx
call fcn.14002355c
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14001ec20
lea rcx, [rsp + 0x30]
call fcn.14000b160
add rsp, 0x48
ret
Function at 0x140008ff0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x38], 0xfffffffffffffffe
lea rcx, [rsp + 0x30]
call fcn.140002ff0
nop
mov edx, 0x2794
lea rcx, [rsp + 0x30]
call fcn.140003c90
lea rcx, [rsp + 0x30]
call fcn.14000a6a0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x30]
call fcn.1400040d0
add rsp, 0x48
ret

Function at 0x140009070
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x140042dd0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x38]
call fcn.14000c070
nop
lea rcx, [rsp + 0x38]
call fcn.14000c120
mov edx, eax
sub edx, 1
lea rcx, [rsp + 0x38]
call fcn.14000c140
movzx eax, ax
cmp eax, 0x22
jne 0x1400090e5
lea rcx, [rsp + 0x38]
call fcn.14000c120
mov edx, eax
sub edx, 1
mov r8w, 0x5c
lea rcx, [rsp + 0x38]
call fcn.14000c160
mov rax, qword [0x140035248]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x40], 0x5a
jmp 0x140009106
mov eax, dword [rsp + 0x40]
sub eax, 1
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0x41
jl 0x140009163
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jne 0x140009161
lea rcx, [rsp + 0x38]
call fcn.14000a6a0
xor r9d, r9d
lea r8, [rsp + 0x30]
mov rdx, rax
mov rcx, qword [rsp + 0x70]
call fcn.140008640
mov dword [rsp + 0x44], 1
lea rcx, [rsp + 0x38]
call fcn.1400040d0
mov eax, dword [rsp + 0x44]
jmp 0x1400091e8
jmp 0x1400090fb
lea rcx, [rsp + 0x20]
call fcn.14001ad70
nop
mov edx, 0x27f6
lea rcx, [rsp + 0x20]
call fcn.140002af0
lea rdx, [0x140034d44]
lea rcx, [rsp + 0x20]
call fcn.14000a460
lea rcx, [rsp + 0x38]
call fcn.14000a6a0
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14000a460
lea rcx, [rsp + 0x20]
call fcn.14000a6a0
mov r9, rax
mov r8d, 0x281f
mov edx, 0x27dd
mov rcx, qword [rsp + 0x70]
call fcn.140007230
mov dword [rsp + 0x48], 1
lea rcx, [rsp + 0x20]
call fcn.140002d80
nop
lea rcx, [rsp + 0x38]
call fcn.1400040d0
mov eax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400226f0
add rsp, 0x68
ret
Function at 0x14000b660
Capabilities:
Check os version

Disassembly:
push rdi
sub rsp, 0x160
mov rax, qword [0x140042dd0]
xor rax, rsp
mov qword [rsp + 0x158], rax
mov dword [rsp + 0x30], 0
lea rdi, [rsp + 0x34]
xor eax, eax
mov ecx, 0x110
rep stosb byte [rdi], al
mov dword [rsp + 0x30], VarUI4FromDisp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x150], eax
cmp dword [rsp + 0x150], 0
je 0x14000b6d7
cmp dword [rsp + 0x34], 5
jae 0x14000b6ca
cmp dword [rsp + 0x34], 4
jne 0x14000b6d7
cmp dword [rsp + 0x38], 0x5a
jb 0x14000b6d7
mov dword [rsp + 0x154], 0
jmp 0x14000b6e2
mov dword [rsp + 0x154], 1
mov al, byte [rsp + 0x154]
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.1400226f0
add rsp, 0x160
pop rdi
ret

Function at 0x14000d370
Capabilities:
Copy file
Get common file path

Disassembly:
push rdi
sub rsp, 0x470
mov rax, qword [0x140042dd0]
xor rax, rsp
mov qword [rsp + 0x460], rax
xor eax, eax
mov word [rsp + 0x250], ax
lea rdi, [rsp + 0x252]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov r8d, 0x104
lea rdx, [rsp + 0x250]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x14000d3ca
mov eax, 0x80004005
jmp 0x14000d495
lea rcx, [rsp + 0x250]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea rdx, [0x140035830]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov dword [rsp + 0x244], 0
mov dword [rsp + 0x240], 0
lea r8, [rsp + 0x240]
lea rdx, [rsp + 0x244]
lea rcx, [rsp + 0x250]
call qword [sym.imp.imagehlp.dll_MapFileAndCheckSumW]
test eax, eax
je 0x14000d427
mov eax, 0x80004005
jmp 0x14000d495
mov eax, dword [rsp + 0x240]
cmp dword [rsp + 0x244], eax
je 0x14000d43e
mov eax, 0x80004005
jmp 0x14000d495
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, str.drivers
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, str.KuaiZipDrive.sys
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x14000d493
mov eax, 0x80004005
jmp 0x14000d495
xor eax, eax
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1400226f0
add rsp, 0x470
pop rdi
ret