joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140062cb0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400d5040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1400ec178]
mov edi, ecx
cmp byte [rbx + 0x4d4d], 0
jne 0x140062d11
cmp byte [rbx + 0x4d4e], 0
jne 0x140062d11
movsx r9d, word [rbx + 0x5eb8]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140051530
test dil, 2
je 0x140062e3f
jmp 0x140062d9a
movss xmm1, dword [rbx + 0x39bc]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5eb8]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1400b5968]
mulss xmm1, dword [0x1400b5960]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xe40]
addss xmm1, dword [rbx + 0xe44]
mov qword [rbx + 0x4a18], rax
mov dword [rbx + 0x4a04], 1
movss dword [rbx + 0x4a10], xmm0
movss dword [rbx + 0x4a14], xmm1
movss xmm0, dword [rbx + 0x3a18]
mulss xmm0, dword [0x1400b58d4]
or dword [rbx + 0x4a00], 0x41
movss dword [rbx + 0x4a60], xmm0
call fcn.140051530
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140062df0
lea r11, [0x1400ae120]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x140062dd3
cmp byte [r8], r9b
jne 0x140062dd3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140062dc0
not ecx
call fcn.140058f70
test rax, rax
je 0x140062e3f
cmp byte [rax + 0xbe], 0
je 0x140062e3f
mov byte [rax + 0xc3], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xc5], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xe4], 1
mov edx, 0x10
inc word [rbx + 0x5eb8]
movsx r9d, word [rbx + 0x5eb8]
call fcn.140051530
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2030347
call fcn.14005bb40
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400a1650
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140067b40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x6010], 0
lea rbx, [rcx + 0x6018]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140067be7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x140067b9a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14006a2e0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1400520f0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x6010]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x6020]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1400ec0a7]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x140067bef
mov rcx, rbx
call fcn.1400520f0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140067f10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x1400ec178]
xor ebp, ebp
cmp byte [rbx + 0x5f68], bpl
jne 0x140067fef
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140067fe8
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
call fcn.1400519b0
mov rsi, rax
test rax, rax
je 0x140067fe8
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x140067f74
mov rcx, rax
call fcn.140068140
mov r8, qword [0x1400ec178]
test r8, r8
je 0x140067fdf
movsx rdx, word [r8 + 0x60f0]
lea rcx, [r8 + 0x60f4]
mov r9d, dword [r8 + 0x3f58]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x140067fd4
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60f0], cx
movsx rax, cx
lea rcx, [r8 + 0x60f4]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], ebp
inc word [rcx + 6]
inc dword [r8 + 0x60ec]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [rbx + 0x5f68], 1
movss xmm0, dword [rbx + 0x5f6c]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x14006807e
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x5f6c], xmm0
jb 0x14006807e
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x140068071
mov rax, qword [0x1400ec178]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
mov dword [rax + 0x5f6c], ebp
call fcn.1400683a0
lea rdx, [0x1400b4404]
mov rcx, rdi
mov rsi, rax
call fcn.140051800
mov rdi, rax
test rax, rax
je 0x140068078
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x140068078
mov byte [rbx + 0xce], 1
mov dword [rbx + 0x5f6c], ebp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400680a0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1400ec178]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x140068103
mov qword [rsp], rbx
lea rbx, [0x1400ae120]
nop dword [rax]
cmp r9b, 0x23
jne 0x1400680e3
cmp byte [r8], r9b
jne 0x1400680e3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x1400680d0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5f80]
not eax
mov r8, qword [r10 + 0x5f88]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x14006812f
cmp dword [r8 + 8], eax
je 0x140068136
add r8, 0x48
cmp r8, rcx
jne 0x140068120
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret
Function at 0x14007b1d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1400ec178]
mov rcx, qword [rax + 0x4e18]
mov r9, qword [rax + 0x4000]
movups xmm0, xmmword [r9 + 0x248]
movups xmmword [rcx + 0x170], xmm0
mov rax, qword [r9 + 0x2a8]
movups xmm0, xmmword [rcx + 0x150]
movss xmm4, dword [rcx + 0x150]
movss xmm3, dword [rcx + 0x154]
movss xmm2, dword [rcx + 0x158]
movss xmm1, dword [rcx + 0x15c]
movups xmmword [r9 + 0x248], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x2a8]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, word [rcx + 0x232]
mov rcx, qword [rcx + 0x1a0]
mov rdx, qword [r9 + 0x2a8]
add rsp, 0x38
jmp fcn.1400760f0

Function at 0x14007b2b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1400ec178]
mov rcx, qword [rax + 0x4e18]
mov r10, qword [rax + 0x4000]
movsxd rax, dword [rcx + 0x74]
movups xmm0, xmmword [rcx + 0x170]
movss xmm4, dword [rcx + 0x170]
movss xmm3, dword [rcx + 0x174]
movss xmm2, dword [rcx + 0x178]
movss xmm1, dword [rcx + 0x17c]
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
imul r9, rax, 0x70
mov rax, qword [r10 + 0x2a8]
add r9, qword [rcx + 0x18]
movups xmmword [r10 + 0x248], xmm0
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r10 + 0x2a8]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, word [r9 + 0x5c]
mov rdx, qword [r10 + 0x2a8]
mov rcx, qword [rcx + 0x1a0]
add rsp, 0x38
jmp fcn.1400760f0
Function at 0x14008fd40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rcx + 0x10]
mov r10d, ecx
and r10d, 7
je 0x14008fd74
cmp ecx, r10d
jge 0x14008fd62
mov rcx, rbx
call fcn.14008f4e0
mov eax, dword [rbx + 0x18]
mov ecx, r10d
shr eax, cl
sub dword [rbx + 0x10], r10d
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x18], eax
xor r8d, r8d
mov eax, ecx
test ecx, ecx
jle 0x14008fdae
mov ecx, dword [rbx + 0x18]
lea rdx, [rsp + 0x30]
movzx r9d, cl
nop dword [rax]
shr ecx, 8
inc r8d
mov byte [rdx], r9b
lea rdx, [rdx + 1]
sub eax, 8
mov dword [rbx + 0x18], ecx
movzx r9d, cl
test eax, eax
jg 0x14008fd90
mov dword [rbx + 0x10], eax
test eax, eax
jns 0x14008fdd6
mov rax, qword gs:[0x58]
mov edx, 0x28
mov rcx, qword [rax]
lea rax, str.zlib_corrupt
mov qword [rdx + rcx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x14008fe05
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r8
jb 0x14008fdef
xor dl, dl
jmp 0x14008fdf8
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x14008fde6
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x14008fdb2
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x14008fe6f
mov rax, qword gs:[0x58]
mov edx, 0x28
mov rcx, qword [rax]
lea rax, str.read_past_buffer
mov qword [rdx + rcx], rax
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x20]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x30]
jbe 0x14008fe89
mov rcx, rbx
call fcn.14008f620
test eax, eax
je 0x14008fe62
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x20]
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x20], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x14009f2e0
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
sub rsp, 0x68
test dl, dl
je 0x14009c541
add rsp, 0x68
jmp 0x14009abc0
cmp byte [0x1400b55b9], 0
movups xmm0, xmmword [str.zZCW_Q_]
movzx eax, word [0x1400b55b8]
mov qword [rsp + 0x70], rbx
movups xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x48], ax
movsd xmm0, qword [0x1400b55b0]
movsd qword [rsp + 0x40], xmm0
je 0x14009c70d
xor ecx, ecx
cmp dword [0x1400d5088], 2
jl 0x14009c6c9
movdqa xmm0, xmmword [str.33333333333333337777777777777777]
lea rdx, [rsp + 0x34]
movdqa xmm5, xmmword [0x1400b5aa0]
movdqa xmm4, xmmword [0x1400b5c90]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [str.44445555]
nop dword [rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400b5b60]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400b5b60]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x18
jl 0x14009c5c0
movaps xmm6, xmmword [rsp + 0x50]
cmp ecx, 0x1a
jge 0x14009c70d
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
inc ecx
sub al, dl
add al, 0x33
xor byte [r8 - 1], al
cmp ecx, 0x1a
jl 0x14009c6e0
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14009c720
mov rax, qword [0x1400d5160]
mov qword [rsp + 0x60], rdi
cmp rbx, rax
ja 0x14009c777
cmp rax, 0xf
mov qword [0x1400d5158], rbx
lea rdi, [0x1400d5148]
mov r8, rbx
cmova rdi, qword [0x1400d5148]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rbx], 0
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
lea r9, [rsp + 0x30]
mov rdx, rbx
lea rcx, [0x1400d5148]
call fcn.14002fac0
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
movzx edx, byte [rdx]
jmp 0x14009c530
Function at 0x14009f360
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov rbp, rcx
mov rax, r8
lea rcx, [r8 - 1]
mov qword [rsp + 0x20], rax
mov r15, rcx
mov qword [rsp + 0x28], rcx
sar r15, 1
mov r14, r9
mov r13, rdx
mov r12, rdx
mov rsi, rdx
cmp rdx, r15
jge 0x14009f42f
lea rbx, [rsi + rsi]
lea rax, [rbx + 2]
imul rdx, rax, 0x88
add rdx, rbp
lea r8, [rdx - 0x88]
call fcn.14009d4a0
movzx eax, al
lea rsi, [rbx + 1]
xor rax, 1
add rsi, rax
imul rdi, rsi, 0x88
imul rbx, r13, 0x88
add rdi, rbp
mov eax, dword [rdi]
lea rdx, [rdi + 8]
add rbx, rbp
mov dword [rbx], eax
lea rcx, [rbx + 8]
mov eax, dword [rdi + 4]
mov dword [rbx + 4], eax
call fcn.14000e640
lea rdx, [rdi + 0x28]
lea rcx, [rbx + 0x28]
call fcn.14000e640
lea rdx, [rdi + 0x48]
lea rcx, [rbx + 0x48]
call fcn.14000e640
lea rdx, [rdi + 0x68]
lea rcx, [rbx + 0x68]
call fcn.14000e640
mov r13, rsi
cmp rsi, r15
jl 0x14009f3a0
mov rax, qword [rsp + 0x20]
mov rdi, rsi
cmp rsi, r15
jne 0x14009f499
test al, 1
jne 0x14009f499
imul rbx, rax, 0x88
imul rdi, rsi, 0x88
add rbx, 0xffffffffffffff78
add rbx, rbp
mov eax, dword [rbx]
lea rdx, [rbx + 8]
add rdi, rbp
mov dword [rdi], eax
lea rcx, [rdi + 8]
mov eax, dword [rbx + 4]
mov dword [rdi + 4], eax
call fcn.14000e640
lea rdx, [rbx + 0x28]
lea rcx, [rdi + 0x28]
call fcn.14000e640
lea rdx, [rbx + 0x48]
lea rcx, [rdi + 0x48]
call fcn.14000e640
lea rdx, [rbx + 0x68]
lea rcx, [rdi + 0x68]
call fcn.14000e640
mov rdi, qword [rsp + 0x28]
cmp r12, rdi
jge 0x14009f510
nop
lea rsi, [rdi - 1]
mov r8, r14
sar rsi, 1
imul rbx, rsi, 0x88
add rbx, rbp
mov rdx, rbx
call fcn.14009d4a0
test al, al
je 0x14009f510
mov eax, dword [rbx]
lea rdx, [rbx + 8]
imul rdi, rdi, 0x88
add rdi, rbp
mov dword [rdi], eax
lea rcx, [rdi + 8]
mov eax, dword [rbx + 4]
mov dword [rdi + 4], eax
call fcn.14000e640
lea rdx, [rbx + 0x28]
lea rcx, [rdi + 0x28]
call fcn.14000e640
lea rdx, [rbx + 0x48]
lea rcx, [rdi + 0x48]
call fcn.14000e640
lea rdx, [rbx + 0x68]
lea rcx, [rdi + 0x68]
call fcn.14000e640
mov rdi, rsi
cmp r12, rsi
jl 0x14009f4a0
mov eax, dword [r14]
lea rdx, [r14 + 8]
imul rbx, rdi, 0x88
add rbx, rbp
mov dword [rbx], eax
lea rcx, [rbx + 8]
mov eax, dword [r14 + 4]
mov dword [rbx + 4], eax
call fcn.14000e640
lea rdx, [r14 + 0x28]
lea rcx, [rbx + 0x28]
call fcn.14000e640
lea rdx, [r14 + 0x48]
lea rcx, [rbx + 0x48]
call fcn.14000e640
lea rdx, [r14 + 0x68]
lea rcx, [rbx + 0x68]
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
jmp fcn.14000e640
Function at 0x1400a0110
Capabilities:
Get storage device properties

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1400d5040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r15 + 3]
lea rcx, str..PhysicalDrive0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
xorps xmm0, xmm0
cmp rax, 0xffffffffffffffff
jne 0x1400a0190
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r15b
jmp 0x1400a02eb
movups xmmword [rsp + 0x60], xmm0
lea rax, [0x1400a0320]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x54], r15
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x44], r15d
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 8
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0xc
lea r8, [rsp + 0x50]
mov edx, 0x2d1400
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1400a0211
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], al
jmp 0x1400a02dc
mov esi, dword [rsp + 0x4c]
mov ecx, esi
call fcn.1400a1aec
mov r14, rax
mov r8d, esi
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r14
mov r9d, 0xc
lea r8, [rsp + 0x50]
mov edx, 0x2d1400
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
xorps xmm0, xmm0
test eax, eax
jne 0x1400a0285
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], al
mov rcx, r14
call fcn.1400a1ae4
nop
jmp 0x1400a02dc
mov eax, dword [r14 + 0x18]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r15
test eax, eax
jne 0x1400a02a9
mov qword [rbx + 0x18], 0xf
mov byte [rbx], al
mov rcx, r14
call fcn.1400a1ae4
nop
jmp 0x1400a02dc
lea rdx, [r14 + rax]
mov qword [rbx + 0x18], r15
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400a02c0
mov rcx, rbx
call fcn.14001e3f0
nop
mov rcx, r14
call fcn.1400a1ae4
nop
test rbp, rbp
je 0x1400a02eb
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, rbx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400a1650
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400a05f0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [0x1400d5040]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rbp - 9], rcx
xor esi, esi
mov qword [rbp - 9], rsi
lea r9, [rbp - 9]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1400a9c80]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x1400a077a
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], rsi
mov qword [rbp + 0x17], rsi
mov rdx, qword [rbp - 9]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], si
jne 0x1400a0660
lea rcx, [rbp - 1]
call fcn.140006650
nop
mov rcx, qword [rbp - 9]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rdi + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 1
jb 0x1400a07ed
cmp qword [rdi + 0x18], 7
jbe 0x1400a06a3
mov rdi, qword [rdi]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 1
lea r9, [0x1400aa620]
lea rcx, [rbp - 0x31]
call fcn.140025040
nop
lea rdx, [rbp - 0x31]
cmp qword [rbp - 0x19], 7
cmova rdx, qword [rbp - 0x31]
mov r8, qword [rbp - 0x21]
lea rcx, [rbp - 1]
call fcn.14000f480
nop
lea rcx, [rbp - 0x31]
call fcn.14000f410
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 7
cmova rdx, qword [rbp - 1]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f], xmm0
mov qword [rbp + 0x2f], rsi
mov qword [rbp + 0x37], rsi
mov r8, qword [rbp + 0xf]
lea rcx, [rbp + 0x1f]
call fcn.140006650
nop
lea rcx, [rbp + 0x1f]
call fcn.140049900
test al, al
jne 0x1400a0746
lea rcx, [rbp + 0x1f]
cmp qword [rbp + 0x37], 7
cmova rcx, qword [rbp + 0x1f]
call fcn.1400a1204
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x1400a07df
movups xmm0, xmmword [rbp - 1]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0xf]
movups xmmword [rbx + 0x10], xmm1
mov qword [rbp + 0xf], rsi
mov qword [rbp + 0x17], 7
mov word [rbp - 1], si
lea rcx, [rbp + 0x1f]
call fcn.14000f410
nop
lea rcx, [rbp - 1]
call fcn.14000f410
jmp 0x1400a07bd
lea rdx, str.Unable_to_get_the_AppData_folder_path.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140017250
lea rdx, [0x14001a6f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], rsi
xor r8d, r8d
lea rdx, [0x1400b5744]
mov rcx, rbx
call fcn.140006650
mov rax, rbx
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1400a1650
mov rbx, qword [rsp + 0xf0]
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret
shr rdx, 0x20
lea r8, [rbp + 0x1f]
call fcn.14009fb50
nop
call fcn.1400013f0
int3
Function at 0x1400a1028
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400a1062
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400a1067
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400a10b0
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400a9c90]
cmp byte [rcx + rax], 0
je 0x1400a10b0
dec r8
sub rdx, 1
jne 0x1400a1096
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1400a2318
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400a2362
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400a2362
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400a2362
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400a2362
cmp dword [rcx + 0x84], 0xe
jbe 0x1400a2362
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400a2364
xor al, al
add rsp, 0x28
ret