joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a860
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [0x00970c60]
mov rcx, qword [rsp + 8]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x10]
lea rax, [rdx + rax*8]
xor rcx, rax
movabs rax, 0xea38ec9079f01541
imul rax, rcx
rol rax, 0x1f
movabs rcx, 0x2723a30d96da1399
imul rcx, rax
mov rax, rcx
shr rcx, 0x1d
xor rax, rcx
movabs rcx, 0x83cf8eadf876d2d7
imul rcx, rax
mov rax, rcx
shr rcx, 0x20
xor rax, rcx
mov qword [rsp + 0x18], rax
ret
cmp byte [0x00970822], 0
je 0x46a89d
mov rax, qword [rsp + 8]
movq xmm0, qword [rsp + 0x10]
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00970f00]
aesenc xmm0, xmmword [0x00970f10]
aesenc xmm0, xmmword [0x00970f20]
movq qword [rsp + 0x18], xmm0
ret
jmp 0x40a4a0

Function at 0x4869e0
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rdx + 8]
lea rsi, [rbx + 0x2e]
imul rsi, rsi, 0xffffffffffffffe4
movabs rax, 0x5816058160581606
mov rcx, rdx
imul rsi
sar rdx, 5
sar rsi, 0x3f
sub rdx, rsi
lea rsi, [rdx + 0x15c]
sar rsi, 0x3f
shr rsi, 0x3d
lea rdx, [rsi + rdx]
lea rdx, [rdx + 0x15c]
sar rdx, 3
cmp rdx, 0x57
jae 0x486ab9
lea rsi, [rdx + rdx*2]
lea rdi, [0x008f3d40]
mov r8, qword [rdi + rsi*8 + 8]
lea r9, [r8 + rbx]
lea r9, [r9 + 0x40]
cmp r9, 0xffffffffffffffc4
jge 0x486a62
inc rdx
nop
jmp 0x486a38
cmp r9, 0xffffffffffffffe0
jle 0x486a6d
dec rdx
jmp 0x486a38
mov rbx, qword [rdi + rsi*8]
mov rax, qword [rcx]
mov rsi, rdx
mul rbx
shr rax, 0x3f
add rdx, rax
mov qword [rcx], rdx
mov rdx, qword [rcx + 8]
lea rdx, [rdx + r8]
lea rdx, [rdx + 0x40]
mov qword [rcx + 8], rdx
mov rcx, rsi
shl rsi, 3
lea rdx, [rsi - 0x15c]
neg rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, rdx
mov ecx, 0x57
call fcn.0046adc0
nop
int3
Function at 0x493ee0
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov edx, dword [rsp + 8]
xor ebx, ebx
jmp 0x493f01
movzx esi, byte [rax + rbx]
inc rbx
imul edx, edx, 0x1000193
xor edx, esi
cmp rbx, rcx
jl 0x493ef2
mov dword [rsp + 0x28], edx
ret

Function at 0x554c00
Capabilities:
Parse credit card information

Disassembly:
movzx eax, byte [rsp + 8]
lea ecx, [rax - 0x61]
cmp cl, 0x19
ja 0x554c13
mov byte [rsp + 0x18], 0
ret
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x554c0d
lea ecx, [rax - 0x30]
nop
cmp cl, 9
jbe 0x554c0d
mov rcx, qword [rsp + 0x10]
cmp rcx, 3
jne 0x554da0
cmp al, 0x2c
ja 0x554d76
lea edx, [rax - 0x21]
nop
cmp dl, 1
ja 0x554c4b
mov byte [rsp + 0x18], 0
ret
cmp al, 0x24
je 0x554c45
cmp al, 0x26
jae 0x554c45
cmp al, 0x2f
ja 0x554d38
nop dword [rax + rax]
cmp al, 0x26
ja 0x554d11
cmp al, 0x24
jne 0x554d07
cmp rcx, 2
jg 0x554cc9
cmp rcx, 1
je 0x554cc1
nop dword [rax]
cmp rcx, 2
jne 0x554ca3
cmp al, 0x2f
jne 0x554c94
mov eax, 1
mov byte [rsp + 0x18], al
ret
cmp al, 0x3b
je 0x554c8a
cmp al, 0x2c
je 0x554c8a
cmp al, 0x3f
sete al
jmp 0x554c8f
cmp rcx, 7
jne 0x554cba
cmp al, 0x21
jne 0x554cb3
mov byte [rsp + 0x18], 0
ret
add eax, 0xffffffd8
cmp al, 2
jbe 0x554cad
mov byte [rsp + 0x18], 1
nop
ret
cmp al, 0x3f
sete byte [rsp + 0x18]
ret
cmp rcx, 5
jne 0x554cef
cmp al, 0x40
jne 0x554ce0
mov eax, 1
mov byte [rsp + 0x18], al
ret
cmp al, 0x2f
je 0x554cd3
cmp al, 0x3f
je 0x554cd3
cmp al, 0x3a
sete al
jmp 0x554cd8
cmp rcx, 6
je 0x554d01
cmp rcx, 7
jne 0x554ca3
mov byte [rsp + 0x18], 0
ret
mov byte [rsp + 0x18], 1
ret
cmp al, 0x26
je 0x554c70
jmp 0x554ca3
lea edx, [rax - 0x2b]
cmp dl, 1
jbe 0x554c70
lea edx, [rax - 0x2d]
cmp dl, 1
ja 0x554d2b
mov byte [rsp + 0x18], 0
ret
cmp al, 0x2f
je 0x554c70
jmp 0x554ca3
cmp al, 0x3d
ja 0x554d56
lea edx, [rax - 0x3a]
nop
cmp dl, 1
jbe 0x554c70
cmp al, 0x3d
je 0x554c70
jmp 0x554ca3
lea edx, [rax - 0x3f]
nop dword [rax]
cmp dl, 1
jbe 0x554c70
cmp al, 0x5f
je 0x554d25
cmp al, 0x7e
je 0x554d25
jmp 0x554ca3
lea edx, [rax - 0x3a]
nop dword [rax]
cmp dl, 4
jbe 0x554c45
cmp al, 0x5b
je 0x554c45
cmp al, 0x5d
je 0x554c45
jmp 0x554c53
cmp rcx, 4
je 0x554c34
jmp 0x554c53
Function at 0x690cc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x690e06
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rdx, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
xor eax, eax
xor ecx, ecx
jmp 0x690d0f
add rax, 2
lea ecx, [r9 + 1]
cmp rax, rdx
jge 0x690d93
lea r9, [rax + 1]
nop dword [rax + rax]
cmp r9, rdx
jae 0x690df5
mov r9d, dword [rbx + rax*4 + 4]
cmp rax, rdx
jae 0x690ded
mov r10d, dword [rbx + rax*4]
dec r10d
nop
cmp r10d, ecx
jl 0x690d07
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], r9d
mov qword [rsp], rsi
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], r8
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], r10d
call fcn.00690680
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r9d, dword [rsp + 0x3c]
jmp 0x690d07
cmp ecx, 0x10ffff
jle 0x690dbd
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], r8
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp], rsi
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], r8
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], 0x10ffff
call fcn.00690680
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp 0x690d9b
mov rcx, rdx
call fcn.0046adc0
mov rax, r9
mov rcx, rdx
nop dword [rax + rax]
call fcn.0046adc0
nop
call fcn.00468cc0
jmp fcn.00690cc0
Function at 0x690e20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x691099
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax + 8]
mov rdx, qword [rax]
nop word [rax + rax]
test rcx, rcx
jle 0x69107c
mov qword [rsp + 0x58], rcx
mov rbx, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
xor r8d, r8d
jmp 0x690ef6
mov dword [rsp + 0x3c], r11d
mov qword [rsp], rbx
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r11d
mov dword [rsp + 0x1c], r11d
call fcn.00690680
mov eax, dword [rsp + 0x3c]
mov r10d, dword [rsp + 0x48]
lea r11d, [r10 + rax]
mov rbx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x50]
mov r9d, dword [rsp + 0x4c]
cmp r9d, r11d
jge 0x690e8b
inc r8
cmp r8, rcx
jge 0x690f24
add rdx, 6
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x50], r8
movzx r9d, word [rdx + 2]
movzx r10d, word [rdx + 4]
movzx r11d, word [rdx]
cmp r10d, 1
je 0x691034
mov dword [rsp + 0x4c], r9d
mov dword [rsp + 0x48], r10d
jmp 0x690ee5
mov rcx, qword [rax + 0x20]
mov rax, qword [rax + 0x18]
test rcx, rcx
jle 0x690fd2
mov qword [rsp + 0x58], rcx
xor edx, edx
jmp 0x690fa9
mov dword [rsp + 0x38], r10d
mov qword [rsp], rbx
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r10d
mov dword [rsp + 0x1c], r10d
nop dword [rax + rax]
call fcn.00690680
mov eax, dword [rsp + 0x38]
mov r9d, dword [rsp + 0x44]
lea r10d, [r9 + rax]
mov rbx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x40]
cmp r10d, r8d
jle 0x690f3e
inc rdx
nop dword [rax]
cmp rdx, rcx
jge 0x690fd2
add rax, 0xc
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rdx
mov r8d, dword [rax + 4]
mov r9d, dword [rax + 8]
mov r10d, dword [rax]
nop
cmp r9d, 1
je 0x690ff4
mov dword [rsp + 0x44], r9d
mov dword [rsp + 0x40], r8d
jmp 0x690f95
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb0], rsi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp], rbx
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r10d
mov dword [rsp + 0x1c], r8d
call fcn.00690680
mov rbx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
jmp 0x690f9a
mov qword [rsp], rbx
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r11d
mov dword [rsp + 0x1c], r9d
call fcn.00690680
mov rbx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x50]
jmp 0x690eea
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x80]
jmp 0x690f24
call fcn.00468cc0
nop
jmp fcn.00690e20
Function at 0x14000b720
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [rdx + 0x10]
lea r9, [rsp + 0x30]
xor esi, esi
mov dword [rsp + 0x34], eax
mov rbx, rdx
mov dword [rsp + 0x30], esi
mov rdi, rcx
mov qword [rsp + 0x20], rsi
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x34]
lea r8d, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 0xf
mov rdx, rbx
jbe 0x14000b76c
mov rdx, qword [rbx]
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x30]
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14000b7ba
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14000b7b5
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000b7d9
mov rcx, r8
call fcn.1400322b0
mov qword [rbx + 0x10], rsi
mov byte [rbx], sil
mov rsi, qword [rsp + 0x68]
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.1400390dc
int3

Function at 0x14000b7e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [rdx + 0x10]
lea r9, [rsp + 0x30]
xor esi, esi
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x30], esi
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x34]
add eax, eax
mov qword [rsp + 0x20], rsi
lea r8d, [rsi + 4]
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 7
mov rdx, rbx
mov r8, qword [rbx + 0x10]
jbe 0x14000b832
mov rdx, qword [rbx]
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x30]
add r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 7
jbe 0x14000b884
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000b87f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000b8a3
mov rcx, r8
call fcn.1400322b0
mov qword [rbx + 0x10], rsi
mov word [rbx], si
mov rsi, qword [rsp + 0x68]
mov qword [rbx + 0x18], 7
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.1400390dc
int3
Function at 0x14000d7d0
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x140075040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r12, r9
mov r13, r8
mov rbp, rdx
mov qword [rsp + 0x38], rdx
mov r14, rcx
mov qword [rsp + 0x40], rdx
mov rbx, qword [rsp + 0xe0]
xor edi, edi
cmp qword [rcx + 0x18], 7
jbe 0x14000d81a
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000d84e
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x18], rdi
mov r8d, 0x19
lea rdx, str.Error:_Ini_File_Not_Exist
mov rcx, rbp
call fcn.140002750
jmp 0x14000d984
mov ebp, 1
mov ecx, 0x208
call fcn.140032560
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], di
mov rdi, 0xffffffffffffffff
mov r15d, 0x104
nop dword [rax + rax]
mov rax, r14
cmp qword [r14 + 0x18], 7
jbe 0x14000d89d
mov rax, qword [r14]
mov r8, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14000d8aa
mov r8, qword [rbx]
mov rdx, r12
cmp qword [r12 + 0x18], 7
jbe 0x14000d8b9
mov rdx, qword [r12]
mov rcx, r13
cmp qword [r13 + 0x18], 7
jbe 0x14000d8c7
mov rcx, qword [r13]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [r15 - 1]
cmp eax, ecx
jb 0x14000d948
mov r8, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14000d8ef
mov r8, qword [rbx]
mov rax, rsi
sub r8, rsi
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000d914
add rax, 2
test ecx, ecx
jne 0x14000d900
test edx, edx
je 0x14000d948
mov rcx, rsi
call fcn.1400322b0
inc ebp
imul r15d, ebp, 0x104
mov ecx, r15d
mov eax, 2
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.140032560
mov rsi, rax
jmp 0x14000d890
mov rbp, qword [rsp + 0x38]
nop dword [rax]
inc rdi
cmp word [rsi + rdi*2], 0
jne 0x14000d950
mov r8, rdi
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.1400022b0
mov rcx, rsi
call fcn.1400322b0
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rbp + 0x10], xmm1
mov rax, rbp
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140032290
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000e440
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rbx, rcx
xor ebp, ebp
add rcx, 0x70
call fcn.14002ed70
test eax, eax
setne dl
mov byte [rbx + 0xf8], dl
test eax, eax
je 0x14000e487
cmp qword [rbx + 0xb8], 0x10000
jae 0x14000e487
lea rcx, [rbx + 0x70]
call fcn.14002f130
mov eax, dword [rbx + 0x2d4]
cmp byte [rbx + 0xf8], bpl
je 0x14000e592
cmp eax, 1
je 0x14000e56f
mov dword [rbx + 0x2d4], 1
call fcn.14000cb10
test al, al
je 0x14000e5ee
lea rcx, [rbx + 0x10]
call fcn.140029e10
test al, al
je 0x14000e5ee
lea rcx, [rbx + 0x10]
call fcn.14002a000
mov rcx, rbx
call fcn.140010050
add rbx, 0x4d0
cmp byte [rbx + 8], bpl
jne 0x14000e5d9
cmp qword [rbx + 0x18], rbp
je 0x14000e5d9
mov word [rbx + 8], 0x101
mov dword [rbx + 0x20], 0x32
mov ecx, 8
call fcn.1400322e4
mov qword [rax], rbx
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x1400126f0]
xor edx, edx
xor ecx, ecx
call fcn.14003d6d8
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000e601
cmp dword [rsp + 0x38], 0
je 0x14000e5f6
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140031a14
test eax, eax
jne 0x14000e5f6
jmp 0x14000e5d9
mov eax, dword [0x1400782c8]
inc eax
mov dword [0x1400782c8], eax
cmp eax, 5
jle 0x14000e5d9
mov dword [0x1400782c8], ebp
mov rcx, rbx
call fcn.14000e180
jmp 0x14000e5d9
test eax, eax
je 0x14000e5d9
mov dword [rbx + 0x2d4], ebp
mov rcx, rbx
call fcn.140010050
mov byte [rbx + 0x4d8], bpl
mov edi, 0x1388
cmp byte [rbx + 0x4d9], bpl
je 0x14000e5d9
nop dword [rax]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
sub edi, 0x32
js 0x14000e5d9
cmp byte [rbx + 0x4d9], bpl
jne 0x14000e5c0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
xor ecx, ecx
call fcn.14003d24c
nop
mov ecx, 1
call fcn.140031978
nop
mov dword [rsp + 0x38], ebp
mov ecx, 6
call fcn.140031978
int3
Function at 0x140010050
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
lea rcx, [0x140078860]
call fcn.140031ab4
test eax, eax
jne 0x1400100ff
cmp dword [0x1400788ac], 0x7fffffff
je 0x1400100ea
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x40], rdi
lea r8d, [rax + 4]
xor edi, edi
mov dword [rsp + 0x50], 2
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rbx + 0xb0]
lea r9, [rsp + 0x48]
mov rcx, qword [rbx + 8]
lea r8d, [rdi + 4]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [0x140078860]
mov rdi, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
jmp fcn.140031abc
mov ecx, 6
mov dword [0x1400788ac], 0x7ffffffe
call fcn.140031978
int3
mov ecx, 5
call fcn.140031978
int3
Function at 0x1400118a0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rsi, r8
mov rbx, rdx
mov qword [rsp + 0x50], rdx
xor ebp, ebp
mov dword [rsp + 0x40], ebp
mov rdi, qword [0x1400782c0]
lea r14, [0x140078860]
mov qword [rsp + 0x58], r14
mov rcx, r14
call fcn.140031ab4
test eax, eax
jne 0x1400119f8
cmp dword [0x1400788ac], 0x7fffffff
je 0x1400119e3
mov dword [rsp + 0x38], 8
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x30]
lea r8d, [rbp + 4]
lea rdx, [rsp + 0x38]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.140001fa0
mov rdx, rax
mov rcx, rdi
call fcn.14000b720
nop
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x38]
lea r8d, [rbp + 4]
lea rdx, [rsp + 0x30]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rsi, dword [rsp + 0x30]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rbx], bpl
mov dword [rsp + 0x40], 2
mov rdx, rsi
cmp rsi, 0xf
jbe 0x14001199b
mov rcx, rbx
call fcn.140005ba0
mov qword [rbx + 0x10], rbp
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400119a8
mov rdx, qword [rbx]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x48]
mov r8d, esi
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop
mov rcx, r14
call fcn.140031abc
mov rax, rbx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov dword [0x1400788ac], 0x7ffffffe
mov ecx, 6
call fcn.140031978
int3
mov ecx, 5
call fcn.140031978
int3
Function at 0x140012740
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov ebx, ecx
mov rsi, r8
xor ecx, ecx
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx edx, bx
mov r8, rdi
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x14001286c
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdx, rdi
mov rcx, r14
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test rbx, rbx
je 0x14001286c
test eax, eax
je 0x14001286c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14001286c
mov rcx, qword [rsi]
mov dword [rbp - 0x20], 0x520dfd22
mov dword [rbp - 0x1c], 0xba1cfd49
mov dword [rbp - 0x18], 0x7a32c116
mov dword [rbp - 0x14], 0xce783263
mov dword [rbp - 0x10], 0x229a2d7d
mov dword [rbp - 0xc], 0x322018b2
mov dword [rbp - 8], 0xc6f2e05
mov dword [rbp - 4], 0x466312a3
cmp rcx, qword [rsi + 8]
je 0x14001280b
mov qword [rsi + 8], rcx
mov rax, qword [rsi + 0x10]
sub rax, rcx
mov qword [rbp + 0x38], rdi
cmp rdi, rax
jbe 0x140012827
lea rdx, [rbp + 0x38]
mov rcx, rsi
call fcn.1400128b0
xor ebx, ebx
test rdi, rdi
je 0x140012868
nop
mov rdx, qword [rsi + 8]
mov rax, rbx
and eax, 0x1f
movzx ecx, byte [rbp + rax - 0x20]
xor cl, byte [r14 + rbx]
mov byte [rbp + 0x20], cl
cmp rdx, qword [rsi + 0x10]
je 0x140012854
mov byte [rdx], cl
inc qword [rsi + 8]
jmp 0x140012860
lea r8, [rbp + 0x20]
mov rcx, rsi
call fcn.1400129a0
inc rbx
cmp rbx, rdi
jb 0x140012830
mov al, 1
jmp 0x14001286e
xor al, al
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
Function at 0x140013090
Capabilities:
Load windows common language runtime

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
cmp qword [0x1400782e0], 0
jne 0x140013182
xor ebx, ebx
lea r8, [rsp + 0x48]
lea rdx, [0x140067d18]
mov qword [rsp + 0x48], rbx
lea rcx, [0x140067d08]
call qword [sym.imp.mscoree.dll_CLRCreateInstance]
lea rdi, [0x1400782e0]
test eax, eax
js 0x140013145
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x40], rbx
lea r8, [0x140067cf8]
lea rdx, str.v4.0.30319
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov ebx, eax
test eax, eax
js 0x140013136
mov rcx, qword [rsp + 0x40]
lea r8, [0x140063f78]
mov r9, rdi
lea rdx, [0x140063f88]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov ebx, eax
test eax, eax
js 0x14001312b
mov rcx, qword [0x1400782e0]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
test ebx, ebx
jns 0x140013182
cmp qword [0x1400782e0], 0
jne 0x140013182
lea r9, [0x140063f78]
mov qword [rsp + 0x20], rdi
lea r8, [0x140063f88]
xor edx, edx
lea rcx, str.v2.0.50727
call qword [sym.imp.mscoree.dll_CorBindToRuntime]
test eax, eax
js 0x14001318f
mov rcx, qword [0x1400782e0]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov al, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
xor r9d, r9d
lea r8, [0x140067648]
lea rdx, [0x140067660]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rbx, qword [rsp + 0x50]
xor al, al
add rsp, 0x30
pop rdi
ret
Function at 0x140015130
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x140075040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov edi, r9d
mov rbx, rdx
test r8b, r8b
jne 0x140015222
mov rdx, rcx
lea rcx, [rsp + 0x60]
call fcn.140012020
mov rdx, rbx
lea rcx, [rsp + 0x80]
call fcn.140012020
mov dword [rsp + 0xa0], edi
mov ecx, 0x48
call fcn.1400322e4
mov rbx, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.140012020
nop
lea rcx, [rbx + 0x20]
lea rdx, [rsp + 0x80]
call fcn.140012020
mov ecx, dword [rsp + 0xa0]
mov dword [rbx + 0x40], ecx
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x14001a390]
xor edx, edx
xor ecx, ecx
call fcn.14003d6d8
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140015265
lea rcx, [rsp + 0x60]
call fcn.140015290
cmp dword [rsp + 0x38], 0
je 0x140015278
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140031a14
test eax, eax
jne 0x140015278
jmp 0x140015244
cmp qword [rdx + 0x18], 7
jbe 0x14001522c
mov rbx, qword [rdx]
cmp qword [rcx + 0x18], 7
jbe 0x140015236
mov rcx, qword [rcx]
mov r8, rbx
mov rdx, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140032290
mov rbx, qword [rsp + 0xe0]
add rsp, 0xc0
pop rdi
ret
mov dword [rsp + 0x38], 0
mov ecx, 6
call fcn.140031978
nop
mov ecx, 1
call fcn.140031978
int3

Function at 0x140015350
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x140075040]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1c]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400153c0
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140002750
mov dword [rsp + 0x30], 1
mov r8d, SafeArrayDestroy
lea rdx, [0x140069010]
mov rcx, rbx
call fcn.140003130
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140032290
add rsp, 0x260
pop rbx
ret