joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000df70
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1400ab088]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r12, r9
mov r13, r8
mov r15, rdx
mov qword [rsp + 0x30], rdx
mov r14, rcx
mov qword [rsp + 0x40], rdx
mov rbx, qword [rsp + 0xe0]
cmp qword [rcx + 0x18], 8
jb 0x14000dfc1
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000dff6
xor eax, eax
mov qword [r15 + 0x10], rax
mov qword [r15 + 0x18], 7
mov word [r15], ax
lea r8d, [rax + 0x19]
lea rdx, str.Error:_Ini_File_Not_Exist
mov rcx, r15
call fcn.1400021b0
jmp 0x14000e115
mov ecx, 0x208
mov r15d, 1
call fcn.140035278
mov rsi, rax
movdqa xmm0, xmmword [0x1400971e0]
movdqu xmmword [rsp + 0x58], xmm0
xor eax, eax
mov word [rsp + 0x48], ax
mov ebp, 0x104
lea rdi, [rax - 1]
nop word [rax + rax]
mov rax, r14
cmp qword [r14 + 0x18], 8
jb 0x14000e03d
mov rax, qword [r14]
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x14000e04a
mov r8, qword [rbx]
mov rdx, r12
cmp qword [r12 + 0x18], 8
jb 0x14000e059
mov rdx, qword [r12]
mov rcx, r13
cmp qword [r13 + 0x18], 8
jb 0x14000e067
mov rcx, qword [r13]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [rbp - 1]
cmp eax, ecx
jb 0x14000e0db
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x14000e08d
mov r8, qword [rbx]
mov rax, rsi
sub r8, rsi
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000e0a7
add rax, 2
test ecx, ecx
jne 0x14000e093
test edx, edx
je 0x14000e0db
mov rcx, rsi
call fcn.140034f54
inc r15d
imul ebp, r15d, 0x104
mov ecx, ebp
mov eax, 2
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.140035278
mov rsi, rax
jmp 0x14000e030
mov r15, qword [rsp + 0x30]
inc rdi
cmp word [rsi + rdi*2], 0
jne 0x14000e0e0
mov r8, rdi
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.1400021b0
mov rcx, rsi
call fcn.140034f54
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [r15], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [r15 + 0x10], xmm1
mov rax, r15
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140034f30
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400104b0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp - 9], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400ab088]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
lea rdi, [0x1400b0c70]
mov qword [rbp - 1], rdi
mov rcx, rdi
call fcn.140033b0c
test eax, eax
je 0x140010503
mov ecx, eax
call fcn.1400335c8
nop
mov dword [rbp - 0x39], 1
xor esi, esi
mov dword [rbp - 0x31], esi
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x31]
lea r8d, [rsi + 4]
lea rdx, [rbp - 0x39]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rdx, [rbx + 0x3f8]
lea rcx, [rbp + 7]
call fcn.140012b00
mov rdx, rax
mov rcx, rbx
call fcn.14000bec0
lea rdx, [rbx + 0x418]
lea rcx, [rbp + 7]
call fcn.140012b00
mov rdx, rax
mov rcx, rbx
call fcn.14000bec0
lea rdx, [rbx + 0x438]
lea rcx, [rbp + 7]
call fcn.140012b00
mov rdx, rax
mov rcx, rbx
call fcn.14000bec0
lea rdx, [rbx + 0x458]
lea rcx, [rbp + 7]
call fcn.140012b00
mov rdx, rax
mov rcx, rbx
call fcn.14000bec0
lea rdx, [rbx + 0x2d8]
lea rcx, [rbp + 7]
call fcn.140012b00
mov rdx, rax
mov rcx, rbx
call fcn.14000bec0
lea r8, [rbx + 0x550]
cmp qword [r8 + 0x10], rsi
jne 0x1400106ca
movdqa xmm0, xmmword [0x1400971f0]
movdqu xmmword [rbp + 0x37], xmm0
mov byte [rbp + 0x27], sil
lea r8d, [rsi + 0xb]
lea rdx, str.Feb_14_2023
lea rcx, [rbp + 0x27]
call fcn.140002360
nop
lea rdx, [rbp + 0x27]
lea rcx, [rbp + 7]
call fcn.140016940
nop
lea r9d, [rsi + 6]
lea r8, str.Build.
mov rcx, rax
call fcn.140006e30
mov qword [rbp - 0x19], rsi
mov qword [rbp - 0x11], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x29], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x19], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rdx, [rbp - 0x29]
mov rcx, rbx
call fcn.14000bec0
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x14001067c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010677
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001074d
call fcn.140034f54
movdqa xmm0, xmmword [0x1400971e0]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], si
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x1400106e5
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400106c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010747
call fcn.140034f54
jmp 0x1400106e5
lea rdx, str.Build.
lea rcx, [rbp + 7]
call fcn.1400025f0
mov rdx, rax
mov rcx, rbx
call fcn.14000bec0
lea rdx, [rbp + 7]
call fcn.140010a40
mov rdx, rax
mov rcx, rbx
call fcn.14000be00
lea rdx, [rbp + 7]
call fcn.140010db0
mov rdx, rax
mov rcx, rbx
call fcn.14000be00
nop
mov rcx, rdi
call fcn.140033b30
test eax, eax
je 0x140010722
mov ecx, eax
call fcn.1400335c8
nop
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140034f30
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.1400566cc
nop
call fcn.1400566cc
int3
Function at 0x140010760
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov rbx, rcx
lea rcx, [0x1400b0c70]
call fcn.140033b0c
test eax, eax
je 0x14001078e
mov ecx, eax
call fcn.1400335c8
mov dword [rsp + 0x58], 2
xor edi, edi
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x50]
lea r8d, [rdi + 4]
lea rdx, [rsp + 0x58]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rbx + 0xb0]
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x50]
lea r8d, [rdi + 4]
lea rdx, [rsp + 0x58]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
lea rcx, [0x1400b0c70]
call fcn.140033b30
test eax, eax
je 0x1400107fd
mov ecx, eax
call fcn.1400335c8
nop
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140012430
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x90
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rbp
mov rsi, r8
mov rbx, rdx
mov qword [rax - 0x50], rdx
xor ebp, ebp
mov dword [rax - 0x68], ebp
mov rdi, qword [0x1400b06e0]
lea r14, [0x1400b0c70]
mov qword [rax - 0x48], r14
mov rcx, r14
call fcn.140033b0c
test eax, eax
je 0x140012483
mov ecx, eax
call fcn.1400335c8
nop
mov dword [rsp + 0x38], 8
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x30]
mov r8d, 4
lea rdx, [rsp + 0x38]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, rsi
lea rcx, [rsp + 0x68]
call fcn.1400020d0
mov rdx, rax
mov rcx, rdi
call fcn.14000be00
nop
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x38]
mov r8d, 4
lea rdx, [rsp + 0x30]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rsi, dword [rsp + 0x30]
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov dword [rsp + 0x40], 2
mov rdx, rsi
mov rcx, rbx
call fcn.1400043e0
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140012526
mov rdx, qword [rbx]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x48]
mov r8d, esi
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop
mov rcx, r14
call fcn.140033b30
test eax, eax
je 0x140012552
mov ecx, eax
call fcn.1400335c8
nop
mov rax, rbx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400134c0
Capabilities:
Write file on windows

Disassembly:
jmp 0x140013650
mov rax, rsp
push rdi
sub rsp, 0x60
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rdi, rcx
mov rbx, qword [rcx + 0x20]
xor esi, esi
mov qword [rcx + 0x20], rsi
mov rcx, qword [rcx + 0x10]
call fcn.140033b0c
nop
test eax, eax
je 0x14001368b
mov ecx, eax
call fcn.1400335c8
nop
mov byte [rdi + 0x18], 1
mov rcx, qword [rdi + 8]
call fcn.140033e24
nop
test eax, eax
je 0x1400136a5
mov ecx, eax
call fcn.1400335c8
nop
mov rcx, qword [rdi + 0x10]
call fcn.140033b30
nop
test eax, eax
je 0x1400136bb
mov ecx, eax
call fcn.1400335c8
nop
lea rcx, [0x1400b0c70]
call fcn.140033b0c
nop
test eax, eax
je 0x1400136d4
mov ecx, eax
call fcn.1400335c8
nop
mov rcx, qword [rbx + 0x28]
mov dword [rsp + 0x78], 6
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x70]
mov r8d, 4
lea rdx, [rsp + 0x78]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.1400020d0
nop
mov rdx, rax
mov rcx, qword [rbx + 0x28]
call fcn.14000be00
nop
mov eax, esi
cmp byte [rbx + 0x20], al
setne al
mov dword [rsp + 0x78], eax
mov rcx, qword [rbx + 0x28]
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x70]
mov r8d, 4
lea rdx, [rsp + 0x78]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
lea rcx, [0x1400b0c70]
call fcn.140033b30
nop
test eax, eax
je 0x14001376c
mov ecx, eax
call fcn.1400335c8
nop
call fcn.140033e44
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400137a9
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400137a3
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400137d6
mov rcx, r8
call fcn.140034f54
nop
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov edx, 0x30
mov rcx, rbx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
jmp fcn.140034f54
call fcn.1400566cc
nop
int3
Function at 0x140013650
Capabilities:
Write file on windows

Disassembly:
jmp 0x140013650
mov rax, rsp
push rdi
sub rsp, 0x60
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rdi, rcx
mov rbx, qword [rcx + 0x20]
xor esi, esi
mov qword [rcx + 0x20], rsi
mov rcx, qword [rcx + 0x10]
call fcn.140033b0c
nop
test eax, eax
je 0x14001368b
mov ecx, eax
call fcn.1400335c8
nop
mov byte [rdi + 0x18], 1
mov rcx, qword [rdi + 8]
call fcn.140033e24
nop
test eax, eax
je 0x1400136a5
mov ecx, eax
call fcn.1400335c8
nop
mov rcx, qword [rdi + 0x10]
call fcn.140033b30
nop
test eax, eax
je 0x1400136bb
mov ecx, eax
call fcn.1400335c8
nop
lea rcx, [0x1400b0c70]
call fcn.140033b0c
nop
test eax, eax
je 0x1400136d4
mov ecx, eax
call fcn.1400335c8
nop
mov rcx, qword [rbx + 0x28]
mov dword [rsp + 0x78], 6
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x70]
mov r8d, 4
lea rdx, [rsp + 0x78]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.1400020d0
nop
mov rdx, rax
mov rcx, qword [rbx + 0x28]
call fcn.14000be00
nop
mov eax, esi
cmp byte [rbx + 0x20], al
setne al
mov dword [rsp + 0x78], eax
mov rcx, qword [rbx + 0x28]
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x70]
mov r8d, 4
lea rdx, [rsp + 0x78]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
lea rcx, [0x1400b0c70]
call fcn.140033b30
nop
test eax, eax
je 0x14001376c
mov ecx, eax
call fcn.1400335c8
nop
call fcn.140033e44
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400137a9
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400137a3
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400137d6
mov rcx, r8
call fcn.140034f54
nop
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov edx, 0x30
mov rcx, rbx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
jmp fcn.140034f54
call fcn.1400566cc
nop
int3
Function at 0x1400137e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400ab088]
xor rax, rsp
mov qword [rbp - 8], rax
mov edi, ecx
mov rbx, r8
xor ecx, ecx
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx edx, di
mov r8, rsi
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x14001390c
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdx, rsi
mov rcx, r14
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test rdi, rdi
je 0x14001390c
test eax, eax
je 0x14001390c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14001390c
mov rax, qword [rbx]
mov qword [rbx + 8], rax
mov rax, qword [rbx + 0x10]
sub rax, qword [rbx]
mov dword [rbp - 0x28], 0x6289bcbc
mov dword [rbp - 0x24], 0xab5a2923
mov dword [rbp - 0x20], 0x6fb75c37
mov dword [rbp - 0x1c], 0xc75628ba
mov dword [rbp - 0x18], 0x468122f9
mov dword [rbp - 0x14], 0xb0a23180
mov dword [rbp - 0x10], 0xd6c201d2
mov dword [rbp - 0xc], 0xfa0849e2
cmp rsi, rax
jbe 0x1400138c2
mov edx, esi
mov rcx, rbx
call fcn.140013950
xor edi, edi
test rsi, rsi
je 0x140013908
nop dword [rax]
mov rdx, qword [rbx + 8]
mov rax, rdi
and eax, 0x1f
movzx ecx, byte [rbp + rax - 0x28]
xor cl, byte [rdi + r14]
mov byte [rbp - 0x30], cl
cmp qword [rbx + 0x10], rdx
je 0x1400138f4
mov byte [rdx], cl
inc qword [rbx + 8]
jmp 0x140013900
lea r8, [rbp - 0x30]
mov rcx, rbx
call fcn.140013a90
inc rdi
cmp rdi, rsi
jb 0x1400138d0
mov al, 1
jmp 0x14001390e
xor al, al
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140034f30
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140015b80
Capabilities:
Get common file path
Get startup folder

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x270
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1400ab088]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rbp + 0x1c]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 7
mov word [rbx], bp
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], bp
jne 0x140015bf6
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1400021b0
mov dword [rsp + 0x30], 1
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0xd
jb 0x140015c59
lea rsi, [rcx + 0xd]
mov qword [rbx + 0x10], rsi
mov rdi, rbx
cmp rdx, 8
jb 0x140015c3d
mov rdi, qword [rbx]
lea rcx, [rdi + rcx*2]
mov r8d, 0x1a
lea rdx, [0x140095730]
call fcn.1400535c0
mov word [rdi + rsi*2], bp
jmp 0x140015c76
mov qword [rsp + 0x20], 0xd
lea r9, [0x140095730]
mov edx, 0xd
mov rcx, rbx
call fcn.1400030c0
mov rax, rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140034f30
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400189a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
movabs rax, 0xcbf29ce484222325
sar r8, 1
mov r9d, 0
add r8, r8
je 0x1400189e4
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1400189d0
ret
Function at 0x140030d50
Capabilities:
Resume thread

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x90
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rax, qword [0x1400ab088]
xor rax, rsp
mov qword [rsp + 0x88], rax
xor edi, edi
mov qword [r11 - 0x68], rdi
mov dword [rsp + 0x28], 4
mov qword [r11 - 0x78], r8
mov r9, rdx
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 0x80]
call qword [0x1400b0618]
mov rbx, rax
test rax, rax
jne 0x140030edc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.1400289c0
nop
lea r8, [0x1400b0a40]
cmp qword [0x1400b0a58], 8
cmovae r8, qword [0x1400b0a40]
mov r9, qword [0x1400b0a50]
mov rcx, rax
call fcn.140006e30
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea r8, [0x1400b0820]
cmp qword [0x1400b0838], 8
cmovae r8, qword [0x1400b0820]
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140030e84
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030e7f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140030f25
call fcn.140034f54
movdqa xmm0, xmmword [0x1400971e0]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], di
mov rdx, qword [rsp + 0x80]
cmp rdx, 8
jb 0x140030ed8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030ed3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140030f1f
call fcn.140034f54
xor al, al
jmp 0x140030efe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140034f30
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
ret
call fcn.1400566cc
nop
call fcn.1400566cc
nop
int3
Function at 0x1400310f0
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0xb0], rbx
mov rax, qword [0x1400ab088]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rdx
mov qword [rsp + 0x58], rdx
mov r14, 0xffffffffffffffff
cmp qword [rdx + 0x10], 0
jne 0x140031154
lea r8, [rcx + 0x60]
cmp rdx, r8
je 0x140031154
mov rdx, r8
cmp qword [r8 + 0x18], 8
jb 0x140031148
mov rdx, qword [r8]
mov r8, qword [r8 + 0x10]
mov rcx, rbx
call fcn.1400021b0
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140031161
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor r15d, r15d
cmp eax, 0xffffffff
je 0x140031237
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140031180
mov rcx, qword [rbx]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, r14
je 0x140031237
xor eax, eax
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x48]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14003122d
mov rbp, qword [rsp + 0x48]
mov rcx, rbp
call fcn.140035278
mov rdi, rax
test rax, rax
je 0x1400311f0
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.140053400
jmp 0x1400311f3
mov rdi, r15
mov dword [rsp + 0x40], r15d
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x48]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140031220
movsxd rax, dword [rdi + 0x3c]
mov r14d, dword [rax + rdi + 8]
test rdi, rdi
je 0x14003122d
mov rcx, rdi
call fcn.140034f54
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140031272
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14003126d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400312a6
mov rcx, r8
call fcn.140034f54
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rax, r14
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140034f30
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1400566cc
int3
Function at 0x1400388c4
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1400388d7
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.140038ee4
lea rdx, [0x1400a8760]
lea rcx, [rsp + 0x20]
call fcn.140053304
int3

Function at 0x140043160
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1400af510]
xor edx, edx
jmp fcn.1400388c4

Function at 0x140043af8
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1400af510]
jmp fcn.1400388c4

Function at 0x14004f748
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x14004f804]
mov r9, qword [r9 + 8]
jmp fcn.140040b18

Function at 0x14004f7dc
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x14004f814]
mov r9, qword [r9 + 8]
jmp fcn.140040b18

Function at 0x14005c0c0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x240
mov rax, qword [0x1400ab088]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rdx, [0x140084fe8]
mov rbp, rcx
call fcn.14006c388
xor edi, edi
test rax, rax
je 0x14005c1a6
mov ebx, edi
call fcn.14005c920
mov r14d, dword [rax]
call fcn.14005c920
mov r8d, 0x104
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov dword [rax], edi
call fcn.14006c2d4
mov rsi, rax
test rax, rax
je 0x14005c137
call fcn.14005c920
mov dword [rax], r14d
jmp 0x14005c161
call fcn.14005c920
cmp dword [rax], 0x22
jne 0x14005c19e
call fcn.14005c920
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], r14d
call fcn.14006c2d4
mov rbx, rax
mov rsi, rax
test rax, rax
je 0x14005c19e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], di
jne 0x14005c165
cmp rax, 3
je 0x14005c180
mov rcx, rsi
call fcn.14005c01c
test al, al
je 0x14005c191
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x14005c191
mov dil, 1
mov rcx, rbx
call fcn.140056744
mov al, dil
jmp 0x14005c1a8
mov rcx, rbx
call fcn.140056744
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140034f30
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14005c4ec
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14005c34b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005c34b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005c34b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005c34b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005c34b
cmp dword [rcx + 0x84], 0xe
jbe 0x14005c34b
cmp dword [rcx + 0xf8], 0
je 0x14005c34b
mov ecx, ebx
call fcn.14005c408
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14005c1d8
nop
cmp dword [rbp + 0x20], 0
je 0x14005c399
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14005c3a4
int3
xor r8d, r8d
xor edx, edx
jmp 0x14005c2dc