joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005fd10
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14007e040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14005fde3
cmp byte [rcx + 0x71], 0
je 0x14005fde3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14005fddf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14005fda4
sub eax, 1
je 0x14005fda8
cmp eax, 2
jne 0x14005fddf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140061da0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14005fdd6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14005fddf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14005fd8c
xor al, al
jmp 0x14005fd8c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140061da0
add rsp, 0x60
pop rbx
ret

Function at 0x1400613b8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400613f2
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400613f7
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140061440
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140069c40]
cmp byte [rcx + rax], 0
je 0x140061440
dec r8
sub rdx, 1
jne 0x140061426
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140062aa4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140062aee
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140062aee
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140062aee
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140062aee
cmp dword [rcx + 0x84], 0xe
jbe 0x140062aee
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140062af0
xor al, al
add rsp, 0x28
ret
Function at 0x141048058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1410481df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141048089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14104806f
add dl, dl
jne 0x141048096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410480f6
xor eax, eax
add dl, dl
jne 0x1410480a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410481ad
add dl, dl
jne 0x1410480b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410480c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410480d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410480dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1410480ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14104807e
mov eax, 1
add dl, dl
jne 0x141048106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141048113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410480fb
sub eax, ebx
mov ebx, 1
jne 0x14104814c
mov ecx, 1
add dl, dl
jne 0x14104812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14104813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141048123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14104807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141048168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141048175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14104815d
cmp eax, 0x7d00
jae 0x14104819b
cmp eax, 0x500
jb 0x141048196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14104807e
cmp eax, 0x7f
ja 0x14104819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14104807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1410481d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14104807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140002e34
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x168]
sub rsp, 0x250
mov rax, qword [0x140025328]
xor rax, rsp
mov qword [rbp + 0x140], rax
xor r15d, r15d
lea rax, [rsp + 0x30]
mov qword [r8], r15
lea rdx, [rsp + 0x30]
sub rcx, rax
mov r14, r8
mov r9d, 0x104
lea rax, [r9 + 0x7ffffefa]
test rax, rax
je 0x140002ea5
movzx eax, word [rcx + rdx]
test ax, ax
je 0x140002ea5
mov word [rdx], ax
add rdx, 2
sub r9, 1
jne 0x140002e83
test r9, r9
lea rax, [rdx - 2]
lea r8, [0x14001c528]
cmovne rax, rdx
lea rcx, [rsp + 0x30]
mov word [rax], r15w
call fcn.140001564
mov ebx, 0x1f0003
lea r8, [rsp + 0x30]
mov ecx, ebx
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
mov rdi, rax
test rax, rax
jne 0x140002f0f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
je 0x140002fcb
mov edx, 0xc8
mov rcx, qword [rbp + 0x168]
lea r8, [0x14001c4b0]
call fcn.140002a70
mov esi, eax
jmp 0x140002fce
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], r15d
mov rcx, rdi
mov dword [rsp + 0x20], r15d
call fcn.140002cf0
mov esi, eax
test eax, eax
jns 0x140002f45
mov rcx, qword [rbp + 0x168]
mov r9d, eax
mov edx, 0xce
call fcn.140002a38
jmp 0x140002fce
lea r8, [0x14001c530]
lea rcx, [rsp + 0x30]
call fcn.140001564
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
mov rbx, rax
test rax, rax
jne 0x140002f74
mov edx, 0xd4
jmp 0x140002ef5
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140002cf0
mov esi, eax
test eax, eax
jns 0x140002faa
mov rcx, qword [rbp + 0x168]
mov r9d, eax
mov edx, 0xd6
call fcn.140002a38
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test eax, eax
je 0x14000300e
jmp 0x140002fce
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test eax, eax
je 0x140003020
movsxd rcx, dword [rsp + 0x20]
movsxd rax, dword [rsp + 0x24]
shl rcx, 0x1f
or rax, rcx
mov qword [r14], rax
mov esi, r15d
test rdi, rdi
je 0x140002fe0
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test eax, eax
je 0x140003032
mov eax, esi
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.140018a70
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov rcx, qword [rbp + 0x168]
mov edx, 0x879
call fcn.140002a88
int3
mov rcx, qword [rbp + 0x168]
mov edx, 0x879
call fcn.140002a88
int3
mov rcx, qword [rbp + 0x168]
mov edx, 0x879
call fcn.140002a88
int3
Function at 0x14000eba8
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], r15
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x140025328]
xor rax, rsp
mov qword [rbp + 0x47], rax
lea rcx, [0x140025c18]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_AcquireSRWLockExclusive]
mov rcx, qword [0x140025c60]
test rcx, rcx
jne 0x14000ebee
and dword [rbp - 0x29], ecx
jmp 0x14000eda4
xor edx, edx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetThreadPriority]
lea r15, str.HostWrapper::LeaveReducedPriority
movabs rdi, 0x400000000000
test eax, eax
jne 0x14000ecc5
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [rbp - 0x29], ecx
call fcn.14000af24
cmp dword [rax], 3
jbe 0x14000ecc9
test qword [rax + 0x10], rdi
je 0x14000ecc9
mov rcx, qword [rax + 0x18]
and rcx, rdi
cmp rcx, qword [rax + 0x18]
jne 0x14000ecc9
and dword [rbp + 0x13], 0
lea rcx, [rbp - 0x25]
and dword [rbp + 0x23], 0
and dword [rbp + 0x33], 0
and dword [rbp + 0x43], 0
mov qword [rbp + 0x17], rcx
lea rcx, str.LeaveReducedPriority:_Failed_to_leave_low_priority_n
mov qword [rbp + 0x27], rcx
lea rcx, [rbp - 0x29]
mov qword [rbp + 0x37], rcx
mov qword [rbp + 7], r15
mov dword [rbp + 0xf], 0x22
mov dword [rbp - 0x25], 0xd8
mov dword [rbp + 0x1f], 4
mov dword [rbp + 0x2f], 0x34
mov dword [rbp + 0x3f], 4
lea rcx, [rbp - 0x19]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
lea rdx, [0x14002013a]
mov rcx, rax
mov dword [rsp + 0x20], 6
xor r8d, r8d
call fcn.140001078
jmp 0x14000ecc9
and dword [rbp - 0x29], 0
mov rcx, qword [0x140025c60]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test eax, eax
jne 0x14000ed9c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [rbp - 0x29], ecx
call fcn.14000af24
cmp dword [rax], 2
jbe 0x14000ed92
test qword [rax + 0x10], rdi
je 0x14000ed92
mov rcx, qword [rax + 0x18]
and rcx, rdi
cmp rcx, qword [rax + 0x18]
jne 0x14000ed92
and dword [rbp + 0x13], 0
lea rcx, [rbp - 0x25]
and dword [rbp + 0x23], 0
and dword [rbp + 0x33], 0
and dword [rbp + 0x43], 0
mov qword [rbp + 0x17], rcx
lea rcx, str.DispatchBackground:_Failed_to_close_thread_handle_n
mov qword [rbp + 0x27], rcx
lea rcx, [rbp - 0x29]
mov qword [rbp + 0x37], rcx
mov qword [rbp + 7], r15
mov dword [rbp + 0xf], 0x22
mov dword [rbp - 0x25], 0xe9
mov dword [rbp + 0x1f], 4
mov dword [rbp + 0x2f], 0x33
mov dword [rbp + 0x3f], 4
lea rcx, [rbp - 0x19]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
lea rdx, [0x14001fefd]
mov rcx, rax
mov dword [rsp + 0x20], 6
xor r8d, r8d
call fcn.140001078
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
int 0x29
and qword [0x140025c60], 0
lea rcx, [0x140025c18]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockExclusive]
mov eax, dword [rbp - 0x29]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140018a70
lea r11, [rsp + 0xb0]
mov rdi, qword [r11 + 0x10]
mov r15, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140013cf4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov r10, rdx
mov rbx, rcx
movabs r8, 0xcbf29ce484222325
xor r9d, r9d
movzx eax, byte [r9 + rdx]
movabs rcx, 0x100000001b3
xor r8, rax
inc r9
imul r8, rcx
cmp r9, 4
jb 0x140013d16
mov rcx, qword [rbx + 0x30]
mov rdx, qword [rbx + 8]
and rcx, r8
mov r8, qword [rbx + 0x18]
mov rax, rcx
add rax, rax
lea r9, [rcx + rcx]
mov rax, qword [r8 + rax*8]
cmp qword [r8 + r9*8], rdx
jne 0x140013d5d
mov rcx, rdx
jmp 0x140013d65
mov rcx, qword [r8 + r9*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140013d7c
mov ecx, dword [r10]
cmp dword [rax + 0x10], ecx
je 0x140013d77
mov rax, qword [rax]
jmp 0x140013d52
mov rcx, rax
jmp 0x140013d82
mov rax, rdx
mov rcx, rdx
cmp rcx, rdx
jne 0x140013dfb
mov rdi, qword [rdx]
lea rax, [rsp + 0x50]
mov rdx, rdi
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x20], rax
mov rsi, qword [rdi + 8]
mov r8, rsi
call fcn.140014190
mov rdx, rax
movabs rcx, 0x7fffffffffffffe
mov rax, qword [rbx + 0x10]
sub rcx, rax
cmp rcx, 1
jae 0x140013dd0
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov rcx, rbx
mov qword [rbx + 0x10], rax
mov qword [rdi + 8], rdx
mov qword [rsi], rdx
lea rdx, [rsp + 0x30]
mov r9, qword [rbx + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.140013eb4
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x58]
add rax, 0x18
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140013eb4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rbx, r9
mov r10, r8
mov r9, rdx
mov rsi, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r10]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 4
jb 0x140013eec
mov r8, qword [rsi + 0x30]
and r8, rcx
mov rdi, qword [rsi + 8]
add r8, r8
mov rax, qword [rsi + 0x18]
cmp rdi, qword [rax + r8*8]
je 0x140013f77
mov rdi, qword [rax + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rax + r8*8]
je 0x140013f77
mov ecx, dword [r10]
mov rdi, qword [rdi + 8]
cmp ecx, dword [rdi + 0x10]
je 0x140013f45
cmp rdi, qword [rax + r8*8]
jne 0x140013f34
jmp 0x140013f77
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
mov rcx, rbx
call fcn.140019784
mov rax, qword [rsp + 0x68]
mov qword [rax], rdi
mov byte [rax + 8], 0
jmp 0x1400140a5
mov qword [rsp + 0x28], rbx
mov rax, qword [rbx]
cmp rdi, rax
je 0x140013fb1
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x140013fce
mov qword [rdx + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x140013ffd
cmp rax, rdi
jne 0x140013fd9
mov qword [rdx + r8*8], rbx
jmp 0x140013ffd
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x140013ffd
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x14001eb58]
test rax, rax
jns 0x14001401e
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x14001402f
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x14001409a
cmp rdx, 0x200
jae 0x140014047
shl rdx, 3
jmp 0x140014059
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x140014059
add rdx, rdx
mov rcx, rsi
call fcn.1400106cc
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x140014095
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
lea r8, [rdi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.140013eb4
cmp rdi, qword [rsp + 0x20]
jne 0x140014073
mov r9, qword [rsp + 0x68]
mov qword [r9], rbx
mov byte [r9 + 8], 1
mov rax, r9
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400140dc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, rcx
mov rdi, rdx
movabs rcx, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r10 + r8 + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r10
imul rcx, rdx
cmp r10, 4
jb 0x1400140f9
mov rdx, qword [r9 + 0x30]
and rdx, rcx
mov rcx, qword [r9 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x140014151
cmp qword [rcx + rdx*8], r8
jne 0x140014146
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x14001414a
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14001415e
cmp qword [rcx + rdx*8], r8
jne 0x14001415e
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
mov rax, qword [r8 + 8]
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r9 + 0x10]
call fcn.140019784
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140017788
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], r12
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov rax, qword [0x140025328]
xor rax, rsp
mov qword [rbp + 0x47], rax
and dword [rbp - 0x29], 0
lea r12, str.BrokerAssistHelper::CancelTimerAssist
mov rbx, rcx
movabs rsi, 0x400000000000
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x1400178a8
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_UnregisterWait]
test eax, eax
jne 0x1400178a3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x3e5
je 0x1400178a3
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [rbp - 0x29], ecx
call fcn.14000af24
cmp dword [rax], 2
jbe 0x1400178a3
test qword [rax + 0x10], rsi
je 0x1400178a3
mov rcx, qword [rax + 0x18]
and rcx, rsi
cmp rcx, qword [rax + 0x18]
jne 0x1400178a3
and dword [rbp + 0x13], 0
lea rcx, [rbp - 0x25]
and dword [rbp + 0x23], 0
and dword [rbp + 0x33], 0
and dword [rbp + 0x43], 0
mov qword [rbp + 0x17], rcx
lea rcx, str.Failed_to_unregister_wait_object
mov qword [rbp + 0x27], rcx
lea rcx, [rbp - 0x29]
mov qword [rbp + 0x37], rcx
mov qword [rbp + 7], r12
mov dword [rbp + 0xf], 0x26
mov dword [rbp - 0x25], 0xce
mov dword [rbp + 0x1f], 4
mov dword [rbp + 0x2f], 0x21
mov dword [rbp + 0x3f], 4
lea rcx, [rbp - 0x19]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
lea rdx, [0x14001fefd]
mov rcx, rax
mov dword [rsp + 0x20], 6
xor r8d, r8d
call fcn.140001078
and qword [rbx + 8], 0
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001797a
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test eax, eax
jne 0x140017976
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [rbp - 0x29], ecx
call fcn.14000af24
cmp dword [rax], 2
jbe 0x140017976
test qword [rax + 0x10], rsi
je 0x140017976
mov rcx, qword [rax + 0x18]
and rcx, rsi
cmp rcx, qword [rax + 0x18]
jne 0x140017976
and dword [rbp + 0x13], 0
lea rcx, [rbp - 0x25]
and dword [rbp + 0x23], 0
and dword [rbp + 0x33], 0
and dword [rbp + 0x43], 0
mov qword [rbp + 0x17], rcx
lea rcx, str.Unable_to_close_timer_handle
mov qword [rbp + 0x27], rcx
lea rcx, [rbp - 0x29]
mov qword [rbp + 0x37], rcx
mov qword [rbp + 7], r12
mov dword [rbp + 0xf], 0x26
mov dword [rbp - 0x25], 0xda
mov dword [rbp + 0x1f], 4
mov dword [rbp + 0x2f], 0x1d
mov dword [rbp + 0x3f], 4
lea rcx, [rbp - 0x19]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
lea rdx, [0x14001fefd]
mov rcx, rax
mov dword [rsp + 0x20], 6
xor r8d, r8d
call fcn.140001078
and qword [rbx], 0
mov eax, dword [rbp - 0x29]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140018a70
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140018a94
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400258e0], eax
call fcn.140019344
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x1400258e0], 0
jne case.default.0x140018aea
mov ecx, 1
call fcn.140019344
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
Function at 0x140033bb8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140076b90], eax
call fcn.140033ee0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140076b90], 0
jne case.default.0x140033c0e
mov ecx, 1
call fcn.140033ee0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp eax, 0xaf0698d3
invalid
Function at 0x14085b000
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
movabs rbp, 0xea4c5005749a3dd7
lea rsi, section..vmbb
mov ebx, 0x8595bc
jmp 0x14085b01e
xor byte [rsi], bpl
rol rbp, 1
inc rsi
dec ebx
jne 0x14085b01e
jmp 0x14085b035
pop rsi
pop rbx
pop rbp
jmp loc.140858121
Function at 0x14071d0b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14071d237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14071d0e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14071d0c7
add dl, dl
jne 0x14071d0ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14071d14e
xor eax, eax
add dl, dl
jne 0x14071d0fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14071d205
add dl, dl
jne 0x14071d10e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14071d11b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14071d128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14071d135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14071d142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14071d0d6
mov eax, 1
add dl, dl
jne 0x14071d15e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14071d16b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14071d153
sub eax, ebx
mov ebx, 1
jne 0x14071d1a4
mov ecx, 1
add dl, dl
jne 0x14071d186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14071d193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14071d17b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14071d0d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14071d1c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14071d1cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14071d1b5
cmp eax, 0x7d00
jae 0x14071d1f3
cmp eax, 0x500
jb 0x14071d1ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14071d0d6
cmp eax, 0x7f
ja 0x14071d1f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14071d0d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14071d22a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14071d0d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20