joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019ee4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140019f6b
mov rsi, rbx
cmp word [rax], bp
je 0x140019f2a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140019f14
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140019f10
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140015484
mov rdi, rax
test rax, rax
je 0x140019f58
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140020cb0
mov rbp, rdi
xor ecx, ecx
call fcn.140015448
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001c534
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001c54a
mov al, 1
jmp 0x14001c5aa
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001c55b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001c5a8
mov ecx, dword [rcx + 0x18]
nop
call fcn.14001a688
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001c5a8
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001c5a8
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001c5a8
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001c5aa
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1400209c0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400209e8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400209e8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
je 0x140001066
lea rcx, str.Windows_original_main_args:_n
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
xor ebx, ebx
cmp dword [rax], ebx
jle 0x140001066
xor edi, edi
mov rax, qword [sym.imp.MSVCR100.dll___argv]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
inc ebx
add rdi, 8
cmp ebx, dword [rax]
jl 0x140001038
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010b2
mov r9d, edi
mov rcx, qword [rax]
add rax, 0x10
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x14000109f
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010c9
mov rcx, qword [rbx]
mov rax, qword [str.java]
test rax, rax
jne 0x1400010d8
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x140002240]
mov r8d, 2
lea r9, str._J_ms8m
mov qword [rsp + 0x38], rax
lea rax, [0x140002230]
mov rdx, rbx
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov ecx, edi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r8d
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x14003bb00
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14003bb4c
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14003bb44
cmp dword [rcx + 0x3c], edx
jl 0x14003bb44
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14003bb44
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14003bb4c
mov rax, rdx
add rsp, 0x18
ret

Function at 0x1400d933e
Capabilities:
Encode data using xor

Disassembly:
invalid
jge 0x1400d92f0
lodsd eax, dword [rsi]
xor byte [rsi + 0x6e], bh
sbb eax, 0x9a3317a7
mov ch, 0x3d
pop rcx
stosd dword [rdi], eax
xor ebx, dword [rdx - 0x54a6c24b]
push 0xffffffffda92440e
xchg edx, eax
je 0x1400d9347
mov ah, 0x9a
nop
sbb eax, 0x97698ec7
hlt
Function at 0x1400110fa
Capabilities:
Write file on windows

Disassembly:
jmp 0x14001f5a0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x14003a278]
call fcn.1400119dd
nop
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x14001f5f8
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14001f70a
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14001f6a3
cmp qword [rbp + 0x28], 0
jle 0x14001f6a3
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14001f641
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.14001193d
nop
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rbp + 0x130], 0
jle 0x14001f6f9
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x14001f6f9
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x14001117c
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001a6b0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rcx, [0x14003a27c]
call fcn.1400119dd
nop
mov rax, qword [rbp + 0x160]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
add rax, 0x108
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 8]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x14001a71e
mov rax, qword [rbp + 0x28]
cmp dword [rax], 0x4550
je 0x14001a732
lea rcx, str.GetSectionBase___failed__invalid_header_n
call fcn.14001146f
nop
xor eax, eax
jmp 0x14001a7b4
mov dword [rbp + 0x64], 0
jmp 0x14001a743
mov eax, dword [rbp + 0x64]
inc eax
mov dword [rbp + 0x64], eax
mov rax, qword [rbp + 0x28]
movzx eax, word [rax + 6]
cmp dword [rbp + 0x64], eax
jge 0x14001a7a5
mov rcx, qword [rbp + 0x168]
call fcn.14001174e
movsxd rcx, dword [rbp + 0x64]
imul rcx, rcx, 0x28
mov rdx, qword [rbp + 0x48]
add rdx, rcx
mov rcx, rdx
mov r8, rax
mov rdx, rcx
mov rcx, qword [rbp + 0x168]
call fcn.14001189d
test eax, eax
jne 0x14001a7a3
movsxd rax, dword [rbp + 0x64]
imul rax, rax, 0x28
mov rcx, qword [rbp + 0x48]
mov eax, dword [rcx + rax + 0xc]
mov rcx, qword [rbp + 0x160]
add rcx, rax
mov rax, rcx
jmp 0x14001a7b4
jmp 0x14001a73b
lea rcx, str.GetSectionBase___failed__section_not_found_n
call fcn.14001146f
nop
xor eax, eax
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret

Function at 0x140011569
Capabilities:
Terminate process

Disassembly:
jmp 0x140022920
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x1400116cc
Capabilities:
Parse pe header

Disassembly:
jmp 0x140023c60
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140023c80
xor al, al
jmp 0x140023d01
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140023c93
xor al, al
jmp 0x140023d01
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140023cbd
xor al, al
jmp 0x140023d01
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140023cd1
xor al, al
jmp 0x140023d01
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140023ce3
xor al, al
jmp 0x140023d01
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140023cff
xor al, al
jmp 0x140023d01
mov al, 1
add rsp, 0x38
ret
Function at 0x1400119ba
Capabilities:
Write file on windows

Disassembly:
jmp 0x14001b5b0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x1400322c0]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x14003a278]
call fcn.1400119dd
nop
mov rax, qword [rbp + 0x190]
cmp qword [rax + 0x68], 0
je 0x14001b617
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14001b61e
mov al, 1
jmp 0x14001b76e
call fcn.140011294
mov rcx, qword [rbp + 0x190]
mov rcx, qword [rcx]
mov qword [rbp + 0x158], rcx
mov edx, eax
mov rcx, qword [rbp + 0x190]
mov rax, qword [rbp + 0x158]
call qword [rax + 0x18]
mov dword [rbp + 0x160], eax
call fcn.140011294
mov ecx, dword [rbp + 0x160]
mov edx, ecx
mov ecx, eax
call fcn.1400117bc
movzx eax, al
test eax, eax
je 0x14001b66f
xor al, al
jmp 0x14001b76e
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x190]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x190]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0
je 0x14001b6d4
cmp dword [rbp + 0x154], 1
je 0x14001b6df
cmp dword [rbp + 0x154], 3
je 0x14001b75d
jmp 0x14001b76c
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x14001b72f
mov rax, qword [rbp + 0x190]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x14001b72f
xor al, al
jmp 0x14001b76e
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14001b74a
mov dword [rbp + 0x154], 1
jmp 0x14001b754
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x14001b76e
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14001b76e
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14002bb90]
call fcn.140011825
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.140011497
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x140021410
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140011a1e
movzx eax, al
test eax, eax
jne 0x140021430
mov ecx, 7
call fcn.140011839
nop
mov byte [rsp + 0x20], 0
call fcn.14001187f
mov byte [rsp + 0x21], al
cmp dword [0x140033098], 1
jne 0x140021454
mov ecx, 7
call fcn.140011839
nop
jmp 0x1400214ac
cmp dword [0x140033098], 0
jne 0x1400214a7
mov dword [0x140033098], 1
lea rdx, [0x14002a770]
lea rcx, [0x14002a440]
call fcn.140011474
test eax, eax
je 0x140021488
mov eax, 0xff
jmp 0x1400215b1
lea rdx, [0x14002a330]
lea rcx, [section..rdata]
call fcn.140011866
mov dword [0x140033098], 2
jmp 0x1400214ac
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011816
call fcn.140011708
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140021509
mov rcx, qword [rsp + 0x30]
call fcn.14001138e
movzx eax, al
test eax, eax
je 0x140021509
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x14003b020]
nop
call fcn.140011785
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14002153d
mov rcx, qword [rsp + 0x38]
call fcn.14001138e
movzx eax, al
test eax, eax
je 0x14002153d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011988
nop
call fcn.140021660
mov dword [rsp + 0x28], eax
call fcn.1400116cc
movzx eax, al
test eax, eax
jne 0x14002155c
mov ecx, dword [rsp + 0x28]
call fcn.1400110be
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14002156b
call fcn.1400119a1
nop
xor edx, edx
mov cl, 1
call fcn.140011348
mov eax, dword [rsp + 0x28]
jmp 0x1400215b1
add rsp, 0x68
ret
Function at 0x1411b2058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1411b21df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1411b2089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1411b206f
add dl, dl
jne 0x1411b2096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1411b20f6
xor eax, eax
add dl, dl
jne 0x1411b20a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1411b21ad
add dl, dl
jne 0x1411b20b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1411b20c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1411b20d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1411b20dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1411b20ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1411b207e
mov eax, 1
add dl, dl
jne 0x1411b2106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1411b2113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1411b20fb
sub eax, ebx
mov ebx, 1
jne 0x1411b214c
mov ecx, 1
add dl, dl
jne 0x1411b212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1411b213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1411b2123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1411b207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1411b2168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1411b2175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1411b215d
cmp eax, 0x7d00
jae 0x1411b219b
cmp eax, 0x500
jb 0x1411b2196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1411b207e
cmp eax, 0x7f
ja 0x1411b219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1411b207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1411b21d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1411b207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400014f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140001523
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rbx, rax
je 0x140001567
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x140001562
cmp rbx, r11
jae 0x140001567
add edi, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x140001550
cmp rbx, r11
jb 0x14000156b
xor eax, eax
jmp 0x140001577
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140001a50
Capabilities:
Shutdown system

Disassembly:
push rbx
sub rsp, 0x40
cmp dword [rcx + 0xeebc], 0
mov rbx, rcx
jne 0x140001b18
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
lea r8, str.Attention
lea rdx, str.You_must_restart_your_computer_before_the_new_settings_will_take_effect._nDo_you_want_to_restart_your_computer_now__
mov r9d, 0x34
mov rcx, rbx
call fcn.140001730
cmp eax, 6
jne 0x140001b18
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140001aba
xor eax, eax
add rsp, 0x40
pop rbx
ret
lea r8, [rsp + 0x34]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rsp + 0x50]
xor eax, eax
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x30]
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 2
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140001ab2
lea ecx, [rax + 6]
xor edx, edx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x140001ab2
mov eax, 1
add rsp, 0x40
pop rbx
ret
Function at 0x140001e60
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x140
mov rax, qword [0x140076bc8]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
mov esi, edx
lea rcx, [rsp + 0x20]
mov edx, 0x104
mov r12, r9
mov rbp, r8
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp dword [0x14007867c], 0
je 0x140001eb6
lea rdx, str.System32
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.DIFxAPI.dll
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
je 0x140001ef9
lea rdx, str.DriverPackageUninstallA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001efe
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
or eax, 0xffffffff
jmp 0x140001f18
mov r9, r12
mov r8, rbp
mov edx, esi
mov rcx, rbx
call rax
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14003bc70
add rsp, 0x140
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140001f40
Capabilities:
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x140076bc8]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov r8, rdx
movzx edx, cx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rbx
xor ecx, ecx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test rbx, rbx
mov ebp, eax
je 0x140002044
test rdi, rdi
je 0x140002044
test rsi, rsi
je 0x140002044
test eax, eax
je 0x140002044
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rdx, str.DIFxAPI.dll
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
xor ebx, ebx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x14000203c
lea r9, [rsp + 0x40]
mov r8d, ebp
mov rdx, rsi
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x140002046
mov ebx, dword [rsp + 0x40]
mov eax, ebx
jmp 0x140002046
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14003bc70
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x170
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002070
Capabilities:
Check os version
Identify system language via api

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x140076bc8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, rcx
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebp, ebp
test rax, rax
mov rdi, rax
mov dword [rbx + 0x20], ebp
je 0x1400020d5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rbx + 0x20]
mov rcx, rax
call rdi
lea rcx, [rsp + 0x20]
mov dword [rbx], ebp
mov dword [rbx + 4], ebp
mov dword [rbx + 8], ebp
mov dword [rbx + 0xc], ebp
mov dword [rbx + 0x10], ebp
mov dword [rbx + 0x14], ebp
mov dword [rbx + 0x18], ebp
mov dword [rbx + 0x1c], ebp
mov dword [rbx + 0x24], ebp
mov dword [rbx + 0x28], ebp
mov dword [rbx + 0x2c], ebp
mov dword [rbx + 0x30], ebp
mov dword [rsp + 0x20], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
jne 0x1400021e2
mov edx, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
cmp edx, 5
mov dword [rbx], edx
mov dword [rbx + 4], ecx
mov dword [rbx + 8], eax
jne 0x140002158
test ecx, ecx
jne 0x14000213c
mov dword [rbx + 0xc], 1
jmp 0x140002173
cmp ecx, 1
jne 0x140002146
mov dword [rbx + 0x10], ecx
jmp 0x140002173
cmp ecx, 2
jne 0x1400021e2
mov dword [rbx + 0x14], 1
jmp 0x140002173
cmp edx, 6
jne 0x14000216a
test ecx, ecx
jne 0x14000216c
mov dword [rbx + 0x18], 1
jmp 0x140002173
jbe 0x1400021e2
mov dword [rbx + 0x1c], 1
movzx eax, byte [rsp + 0xba]
cmp al, 3
je 0x140002183
cmp al, 2
jne 0x14000218a
mov dword [rbx + 0x24], 1
cmp dword [rbx + 0x14], ebp
je 0x1400021a3
cmp dword [rbx + 0x24], ebp
jne 0x1400021a3
cmp dword [rbx + 0x20], ebp
je 0x1400021a3
mov dword [rbx + 0x14], ebp
mov dword [rbx + 0x10], 1
movzx ecx, word [rsp + 0xb4]
mov dword [rbx + 0x2c], ecx
movzx ecx, word [rsp + 0xb6]
mov dword [rbx + 0x30], ecx
mov ecx, 0x57
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbx + 0x28], eax
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov word [rbx + 0x34], ax
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [rbx + 0x36], ax
mov eax, 1
jmp 0x1400021e4
xor eax, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14003bc70
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret