joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001c4f0
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x1a8]
sub rsp, 0x290
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14006c100]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rsi, rcx
xor r15d, r15d
mov qword [rsp + 0x30], r15
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionWindowsUpdatePLUG_
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
cmp eax, 2
je 0x14001c6a6
test eax, eax
je 0x14001c593
mov rcx, qword [rbp + 0x1a8]
mov r9d, eax
lea r8, str.onecoreenduserwindowsupdate_ruximplugliblibonesettings.cpp
mov edx, 0x318
call fcn.14000dee8
mov ebx, eax
jmp 0x14001c6a9
lea rdx, str._OneSettings__DeleteSpecsWithOneSettingsSource_:_RecurseToFindKeys_call
xor ecx, ecx
call fcn.14000972c
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r15w
lea rdx, [0x140053e28]
lea rcx, [rsp + 0x48]
call fcn.140007e74
lea r8, [rsp + 0x48]
mov rdx, qword [rsp + 0x30]
mov rcx, rsi
call fcn.14001c748
mov ebx, eax
test eax, eax
jns 0x14001c5fe
mov rcx, qword [rbp + 0x1a8]
mov r9d, eax
lea r8, str.onecoreenduserwindowsupdate_ruximplugliblibonesettings.cpp
mov edx, 0x31a
call fcn.140003c18
jmp 0x14001c6a9
mov rdi, qword [rsi + 0x1d8]
mov rsi, qword [rsi + 0x1e0]
jmp 0x14001c69d
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.140007bd8
lea r14, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r14, qword [rsp + 0x48]
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionWindowsUpdatePLUG_
lea rcx, [rsp + 0x70]
call fcn.140013ee8
mov ebx, eax
test eax, eax
js 0x14001c714
mov r8, r14
lea rcx, [rsp + 0x70]
call fcn.140013ee8
mov ebx, eax
test eax, eax
js 0x14001c70d
lea rdx, [rsp + 0x70]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegDeleteKeyW]
nop dword [rax + rax]
test eax, eax
jne 0x14001c6ee
lea rcx, [rsp + 0x48]
call fcn.140007d04
add rdi, 0x20
cmp rdi, rsi
jne 0x14001c611
mov ebx, r15d
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14001c6bf
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.14004b180
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov rcx, qword [rbp + 0x1a8]
mov r9d, eax
lea r8, str.onecoreenduserwindowsupdate_ruximplugliblibonesettings.cpp
mov edx, 0x32e
call fcn.14000dee8
mov ebx, eax
jmp 0x14001c72f
mov edx, 0x32d
jmp 0x14001c719
mov edx, 0x327
mov r9d, eax
lea r8, str.onecoreenduserwindowsupdate_ruximplugliblibonesettings.cpp
mov rcx, qword [rbp + 0x1a8]
call fcn.140003c18
lea rcx, [rsp + 0x48]
call fcn.140007d04
jmp 0x14001c6a9
Function at 0x14002c550
Capabilities:
Create http request

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor edi, edi
xor ebx, ebx
mov rsi, r9
mov r14, r8
mov r15d, edx
mov rbp, rcx
test rcx, rcx
je 0x14002c5f8
test r8, r8
je 0x14002c5f8
test r9, r9
je 0x14002c5f8
and dword [rax - 0x28], ebx
lea rcx, str.RUXIMCABAgent
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WININET.dll_InternetOpenW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x14002c5d4
and qword [rsp + 0x28], rdi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], r15d
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
nop dword [rax + rax]
test rax, rax
jne 0x14002c5f0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x14002c5fd
mov qword [r14], rbx
mov qword [rsi], rax
jmp 0x14002c611
mov edi, 0x80004003
test rbx, rbx
je 0x14002c611
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x50]
mov eax, edi
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x14003b024
Capabilities:
Get geographical location

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rsi, rdx
mov rbx, rcx
and dword [rcx + 8], 0
lea rax, vtable.std::time_get_unsigned_short_int__class_std::istreambuf_iterator_unsigned_short_int__struct_std::char_traits_unsigned_short_int___.0
mov qword [rcx], rax
and qword [rcx + 0x10], 0
and qword [rcx + 0x18], 0
and qword [rcx + 0x20], 0
mov qword [r11 + 0x10], rcx
lea rcx, [r11 - 0x50]
call fcn.140032f84
lea rbp, [rbx + 0x2c]
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
movsd xmm0, qword [rax + 0x20]
movsd qword [rbp + 0x20], xmm0
mov eax, dword [rax + 0x28]
mov dword [rbp + 0x28], eax
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__Getdays]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x14003b0c4
lea rcx, [rsi + 8]
mov rdx, rax
call fcn.14000cd34
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_free]
nop dword [rax + rax]
lea rcx, [0x140059bf0]
cmp qword [rsi + 8], 0
cmovne rcx, qword [rsi + 8]
mov r8, rbp
call fcn.1400384cc
mov qword [rbx + 0x10], rax
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__Getmonths]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x14003b110
lea rcx, [rsi + 0x18]
mov rdx, rax
call fcn.14000cd34
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_free]
nop dword [rax + rax]
lea rcx, str.:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December
cmp qword [rsi + 0x18], 0
cmovne rcx, qword [rsi + 0x18]
mov r8, rbp
call fcn.1400384cc
mov qword [rbx + 0x18], rax
mov r8, rbp
lea rcx, [0x140059ec8]
call fcn.1400384cc
mov qword [rbx + 0x20], rax
and dword [rsp + 0x90], 0
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o____lc_locale_name_func]
nop dword [rax + rax]
mov edi, 2
mov r9d, edi
lea r8, [rsp + 0x90]
lea edx, [rdi + 0x20]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoEx]
nop dword [rax + rax]
mov eax, dword [rsp + 0x90]
cmp ax, 0x30
je 0x14003b19d
cmp ax, 0x31
jne 0x14003b191
mov edi, 1
jmp 0x14003b19d
xor edi, edi
lea ecx, [rdi + 3]
cmp ax, 0x32
cmove edi, ecx
mov dword [rbx + 0x28], edi
mov rax, rbx
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003e734
Capabilities:
Get geographical location

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x60
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov rsi, rdx
mov rbx, rcx
and dword [rcx + 8], 0
lea rax, vtable.std::time_get_wchar_t__class_std::istreambuf_iterator_wchar_t__struct_std::char_traits_wchar_t___.0
mov qword [rcx], rax
and qword [rcx + 0x10], 0
and qword [rcx + 0x18], 0
and qword [rcx + 0x20], 0
mov qword [r11 + 0x10], rcx
lea rcx, [r11 - 0x50]
call fcn.140032f84
movups xmm0, xmmword [rax]
movups xmmword [rbx + 0x2c], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x3c], xmm1
movsd xmm0, qword [rax + 0x20]
movsd qword [rbx + 0x4c], xmm0
mov eax, dword [rax + 0x28]
mov dword [rbx + 0x54], eax
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__W_Getdays]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x14003e7cc
lea rcx, [rsi + 0x28]
mov rdx, rax
call fcn.140035b04
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_free]
nop dword [rax + rax]
lea rcx, str.:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
cmp qword [rsi + 0x28], 0
cmovne rcx, qword [rsi + 0x28]
call fcn.140033448
mov qword [rbx + 0x10], rax
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__W_Getmonths]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x14003e815
lea rcx, [rsi + 0x38]
mov rdx, rax
call fcn.140035b04
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_free]
nop dword [rax + rax]
lea rcx, [0x140059c50]
cmp qword [rsi + 0x38], 0
cmovne rcx, qword [rsi + 0x38]
call fcn.140033448
mov qword [rbx + 0x18], rax
lea rcx, str.:AM:am:PM:pm
call fcn.140033448
mov qword [rbx + 0x20], rax
and dword [rsp + 0x90], 0
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o____lc_locale_name_func]
nop dword [rax + rax]
mov edi, 2
mov r9d, edi
lea r8, [rsp + 0x90]
lea edx, [rdi + 0x20]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoEx]
nop dword [rax + rax]
mov eax, dword [rsp + 0x90]
cmp ax, 0x30
je 0x14003e89c
cmp ax, 0x31
jne 0x14003e890
mov edi, 1
jmp 0x14003e89c
xor edi, edi
lea ecx, [rdi + 3]
cmp ax, 0x32
cmove edi, ecx
mov dword [rbx + 0x28], edi
mov rax, rbx
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x14004ac6c
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r15
mov rbp, rsp
sub rsp, 0x20
xor esi, esi
lea r8, [rbp + 0x30]
mov qword [rbp + 0x28], rsi
mov qword [rbp + 0x30], rsi
lea edx, [rsi + 1]
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathAllocCanonicalize]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x14004ad78
mov rcx, qword [rbp + 0x30]
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rcx + rdx*2], si
jne 0x14004acb0
inc rdx
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchRemoveBackslash]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x14004ad78
mov rcx, qword [rbp + 0x30]
lea rdx, [rbp + 0x28]
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchSkipRoot]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x14004ad78
mov rax, qword [rbp + 0x28]
mov edi, esi
cmp si, word [rax]
sete dil
je 0x14004ad78
mov r15d, 0x5c
cmp si, word [rax]
jne 0x14004ad11
mov edi, 1
jmp 0x14004ad1e
cmp r15w, word [rax]
jne 0x14004ad1e
mov word [rax], si
mov rax, qword [rbp + 0x28]
cmp si, word [rax]
jne 0x14004add2
mov rcx, qword [rbp + 0x30]
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
nop dword [rax + rax]
test eax, eax
jne 0x14004adc2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp ebx, 0x800700b7
je 0x14004ada3
cmp ebx, 0x80070005
je 0x14004ada3
cmp ebx, 0x80070003
jne 0x14004adbe
mov ebx, 0x800700b7
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x14004ad8d
call qword [sym.imp.api_ms_win_core_heap_obsolete_l1_1_0.dll_LocalFree]
nop dword [rax + rax]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop rdi
pop rbp
ret
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14004adbc
test al, 0x10
je 0x14004adbe
mov ebx, esi
test ebx, ebx
js 0x14004ad78
mov rax, qword [rbp + 0x28]
test edi, edi
jne 0x14004add2
mov word [rax], r15w
mov rax, qword [rbp + 0x28]
add rax, 2
mov qword [rbp + 0x28], rax
test edi, edi
jne 0x14004ad78
jmp 0x14004ad05

Function at 0x14004b1a8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x14006c6d0], eax
call fcn.14004b9c0
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x14006c6d0], 0
jne case.default.0x14004b1fe
mov ecx, 1
call fcn.14004b9c0
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
test dword [rdx - 0x5beb041a], 0xcf7c3977
invalid
Function at 0x141383058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1413831df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141383089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14138306f
add dl, dl
jne 0x141383096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1413830f6
xor eax, eax
add dl, dl
jne 0x1413830a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1413831ad
add dl, dl
jne 0x1413830b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1413830c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1413830d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1413830dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1413830ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14138307e
mov eax, 1
add dl, dl
jne 0x141383106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141383113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1413830fb
sub eax, ebx
mov ebx, 1
jne 0x14138314c
mov ecx, 1
add dl, dl
jne 0x14138312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14138313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141383123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14138307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141383168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141383175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14138315d
cmp eax, 0x7d00
jae 0x14138319b
cmp eax, 0x500
jb 0x141383196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14138307e
cmp eax, 0x7f
ja 0x14138319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14138307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1413831d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14138307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400761ea
Capabilities:
Get disk information

Disassembly:
jmp 0x14008ac20
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x418
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x9e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x438]
mov rax, qword [0x1401aa020]
xor rax, rbp
mov qword [rbp + 0x3e8], rax
lea rcx, [0x1402f04b6]
call fcn.140079836
lea r9, [rbp + 0x234]
mov r8d, 0x105
lea rdx, [rbp + 0x10]
mov rax, qword [rbp + 0x410]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
jne 0x14008ac90
jmp 0x14008acde
mov eax, dword [rbp + 0x234]
shl rax, 1
mov qword [rbp + 0x3d8], rax
cmp qword [rbp + 0x3d8], 0x20a
jae 0x14008acaf
jmp 0x14008acb4
call fcn.140078850
xor eax, eax
mov rcx, qword [rbp + 0x3d8]
mov word [rbp + rcx + 0x10], ax
mov eax, dword [rbp + 0x234]
mov edx, eax
lea rcx, [rbp + 0x10]
call fcn.140077c0c
mov rcx, qword [rbp + 0x410]
mov qword [rcx + 0x18], rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1401727b0]
call fcn.140078e40
mov rcx, qword [rbp + 0x3e8]
xor rcx, rbp
call fcn.140077b3a
lea rsp, [rbp + 0x3f8]
pop rdi
pop rbp
ret
Function at 0x140076c71
Capabilities:
Read file on windows
Write file on windows

Disassembly:
jmp 0x14008a1b0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1b8]
lea rcx, [0x1402f04b8]
call fcn.140079836
mov qword [rbp + 8], 0
mov qword [rbp + 0x28], 0
xor eax, eax
cmp eax, 1
je 0x14008a31c
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x190]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0x100000
jbe 0x14008a234
mov qword [rbp + 0x68], 0x100000
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x44]
mov r8d, dword [rbp + 0x68]
lea rdx, [0x1401ab570]
mov rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14008a268
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14008a31c
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x44]
mov r8d, dword [rbp + 0x44]
lea rdx, [0x1401ab570]
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14008a29c
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14008a31c
mov eax, dword [rbp + 0x44]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x190]
cmp qword [rbp + 8], rax
jne 0x14008a2be
xor eax, eax
jmp 0x14008a31c
xor edx, edx
mov rax, qword [rbp + 8]
mov ecx, 0x400
div rcx
xor edx, edx
mov ecx, 0x400
div rcx
xor edx, edx
mov ecx, 0x400
div rcx
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x88], rax
ja 0x14008a2f9
jmp 0x14008a202
mov rdx, qword [rbp + 0x88]
lea rcx, str.Copied__I64u_GB_n
call fcn.140076230
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0x28], rax
jmp 0x14008a202
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140173350]
call fcn.140078e40
mov rax, rdi
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret

Function at 0x140076d39
Capabilities:
Get disk size

Disassembly:
jmp 0x140085580
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
lea rcx, [0x1402f02b3]
call fcn.140079836
mov qword [rsp + 0x38], 0
lea rax, [rbp + 0x24]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 8
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x7405c
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1400855fb
xor eax, eax
jmp 0x1400855ff
mov rax, qword [rbp + 8]
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x140172020]
call fcn.140078e40
mov rax, rdi
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x14007792d
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1401222c0
mov rax, rcx
neg rcx
test rax, 7
je 0x1401222dd
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x140122338
test al, 7
jne 0x1401222d0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1401222f1
mov rdx, qword [rax - 8]
test dl, dl
je 0x140122362
test dh, dh
je 0x14012235c
shr rdx, 0x10
test dl, dl
je 0x140122356
test dh, dh
je 0x140122350
shr rdx, 0x10
test dl, dl
je 0x14012234a
test dh, dh
je 0x140122344
shr edx, 0x10
test dl, dl
je 0x14012233e
test dh, dh
jne 0x1401222f1
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x14007795f
Capabilities:
Query environment variable

Disassembly:
jmp 0x140139020
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140138ba0
lea rcx, [rsp + 0x20]
call fcn.140138bf0
movzx eax, al
test eax, eax
jne 0x140139065
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.140138bd0
mov rax, qword [rsp + 0x40]
jmp 0x14013915f
lea rcx, [rsp + 0x20]
call fcn.140138cf0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.140138c90
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.140077bbc
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.140077536
lea rcx, [rsp + 0x28]
call fcn.140077edc
movzx eax, al
test eax, eax
jne 0x1401390ff
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.140078ca6
lea rcx, [rsp + 0x20]
call fcn.140138bd0
mov rax, qword [rsp + 0x50]
jmp 0x14013915f
lea rcx, [rsp + 0x20]
call fcn.140138cf0
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.14007979b
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.140077b3f
lea rcx, [rsp + 0x28]
call fcn.140079dc7
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.140078ca6
lea rcx, [rsp + 0x20]
call fcn.140138bd0
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret

Function at 0x140077ccf
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1400b3d50
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1400b36d0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400b3d8f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402f1020]
jmp 0x1400b3d99
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x140077e55
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1400b3c80
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1400b3650
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400b3cc1
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402f1020]
jmp 0x1400b3cc7
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret

Function at 0x140077ee6
Capabilities:
Get geographical location

Disassembly:
jmp 0x14012b740
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.14012a670
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14012b7a7
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x1402f1030]
jmp 0x14012b7c9
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.140077644
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x140077efa
Capabilities:
Terminate process

Disassembly:
jmp 0x140090c20
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret