joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005eb20
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x1800906d0]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x18005eb7e
cmp word [rdx], r12w
jne 0x18005eb7e
or byte [rax + r8*8 + 0x38], cl
jmp 0x18005eb84
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x18005ecdf
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x18005ecba
lea r9, [rcx + 2]
cmp ax, r13w
je 0x18005ebbd
mov rcx, r9
jmp 0x18005ebe0
cmp r9, rdx
jae 0x18005ebf7
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x18005eba1
jmp 0x18005ecdf
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18005ecb4
cmp dword [rsp + 0x80], edi
je 0x18005ecb4
mov rdx, r14
lea r11, [0x1800906d0]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x18005ec8d
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x18005ec60
mov word [rbx], r12w
jmp 0x18005ecdb
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x18005ec69
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x18005ecdb
cmp word [rsp + 0x70], r12w
jne 0x18005ec9a
cmp rbx, rsi
je 0x18005ec5a
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.18005f7ac
cmp word [rsp + 0x70], r12w
je 0x18005ecdf
mov word [rbx], r13w
jmp 0x18005ecdb
lea r11, [0x1800906d0]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x18005ecd7
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x18005ecdf
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180062d88
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180062db8
xor eax, eax
jmp 0x180062e7b
mov rbp, rbx
cmp word [rax], si
je 0x180062ddd
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180062dc4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180062dc0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18006150c
movsxd r14, eax
test eax, eax
jne 0x180062e1b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180062db1
mov rcx, r14
call fcn.18005c9cc
mov rdi, rax
test rax, rax
jne 0x180062e34
xor ecx, ecx
call fcn.18005ba78
jmp 0x180062e10
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18006150c
test eax, eax
jne 0x180062e65
mov rcx, rdi
call fcn.18005ba78
jmp 0x180062e6f
xor ecx, ecx
call fcn.18005ba78
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x18006a570
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.18005f7ac
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.18005f7ac
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x18006a6c0
cmp rax, 0xffffffffffffffff
je 0x18006a6c0
xor edi, edi
test rbp, rbp
jle 0x18006a66b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.18005a994
mov rbx, rax
test rax, rax
jne 0x18006a5f8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x18006a661
mov edx, 0x8000
mov ecx, r14d
call fcn.18006a3f8
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.18005b768
cmp eax, 0xffffffff
je 0x18006a641
cdqe
sub rbp, rax
test rbp, rbp
jg 0x18006a608
mov edx, r15d
mov ecx, r14d
call fcn.18006a3f8
jmp 0x18006a661
cmp byte [rsi + 0x38], dil
je 0x18006a658
cmp dword [rsi + 0x34], 5
jne 0x18006a658
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x18006a661
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.18005ba78
jmp 0x18006a6d4
jns 0x18006a6d4
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.18005f7ac
cmp rax, 0xffffffffffffffff
jne 0x18006a68c
cmp byte [rsi + 0x30], dil
je 0x18006a6d4
mov edi, dword [rsi + 0x2c]
jmp 0x18006a6d4
mov ecx, r14d
call fcn.180063540
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x18006a6d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x18006a6d4
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x18006a6cd
mov eax, dword [rsi + 0x2c]
jmp 0x18006a6d2
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.18005f7ac
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x14001413d
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0

Function at 0x140014140
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
Function at 0x1400104dd
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x1400104fb
je 0x140010506
call 0x140010555
mov bl, 0xc7
lahf
pop rsi
jne 0x1400104e6
call 0x1400104fe
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x1400104e6
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x140010534
je 0x140010572
invalid
je 0x140010583
jne 0x1400104e6
lea rax, [0x14001040c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14000c16d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140010624
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14001067d
je 0x140010683
call 0x140010674
fild qword [rdi - 0x7c]
jmp 0x174f4cdf6
jne 0x140010646
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x140010606
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x1400104e8
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x1400104fb
je 0x140010506
call 0x140010555
mov bl, 0xc7
lahf
pop rsi
jne 0x1400104e6
call 0x1400104fe
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x1400104e6
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x140010534
je 0x140010572
invalid
je 0x140010583
jne 0x1400104e6
lea rax, [0x14001040c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14000c16d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140010624
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14001067d
je 0x140010683
call 0x140010674
fild qword [rdi - 0x7c]
jmp 0x174f4cdf6
jne 0x140010646
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x140010606
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x1400104f8
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x1400104fb
je 0x140010506
call 0x140010555
mov bl, 0xc7
lahf
pop rsi
jne 0x1400104e6
call 0x1400104fe
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x1400104e6
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x140010534
je 0x140010572
invalid
je 0x140010583
jne 0x1400104e6
lea rax, [0x14001040c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14000c16d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140010624
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14001067d
je 0x140010683
call 0x140010674
fild qword [rdi - 0x7c]
jmp 0x174f4cdf6
jne 0x140010646
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x140010606
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x140010514
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x1400104fb
je 0x140010506
call 0x140010555
mov bl, 0xc7
lahf
pop rsi
jne 0x1400104e6
call 0x1400104fe
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x1400104e6
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x140010534
je 0x140010572
invalid
je 0x140010583
jne 0x1400104e6
lea rax, [0x14001040c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14000c16d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140010624
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14001067d
je 0x140010683
call 0x140010674
fild qword [rdi - 0x7c]
jmp 0x174f4cdf6
jne 0x140010646
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x140010606
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x140010555
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x1400104fb
je 0x140010506
call 0x140010555
mov bl, 0xc7
lahf
pop rsi
jne 0x1400104e6
call 0x1400104fe
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x1400104e6
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x140010534
je 0x140010572
invalid
je 0x140010583
jne 0x1400104e6
lea rax, [0x14001040c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14000c16d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140010624
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14001067d
je 0x140010683
call 0x140010674
fild qword [rdi - 0x7c]
jmp 0x174f4cdf6
jne 0x140010646
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x140010606
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x140019b6c
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140190028]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rcx, rdx
call fcn.140065470
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp ebp, eax
je 0x140019bbb
mov rcx, rdi
call fcn.140018f9a
mov ebp, 0x100000
test al, al
je 0x140019bc0
mov ebp, 0x101000
lea r14, [rsp + 0x50]
mov r8d, 0xa0
mov rcx, r14
mov dl, 0xaa
call fcn.1400a7ec0
mov rcx, r14
call fcn.140067740
mov byte [r14 + 0x22], 1
lea rcx, [rsp + 0x58]
call fcn.1400663b0
movaps xmm0, xmmword [0x140163e40]
lea r15, [rsp + 0x40]
movaps xmmword [r15], xmm0
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.1400654e0
mov rcx, r15
call fcn.140036d00
test al, al
je 0x140019ca2
lea rbx, [rsp + 0x38]
mov qword [rbx], 0
mov rcx, rdi
call fcn.140065450
mov r14, rax
lea rcx, [rsp + 0x40]
call fcn.140065450
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edi, edi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebp
mov rcx, rax
mov rdx, r15
mov r8, r14
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x140019ca2
mov r14, qword [rsp + 0x38]
cmp qword [rsi], r14
je 0x140019cbe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140019cf4
lea rax, [r14 + 1]
cmp rax, 2
jb 0x140019c98
mov qword [rsi], r14
call fcn.14003af80
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140019cbe
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov edi, 0x80004005
cmovne edi, ecx
lea rcx, [rsp + 0x40]
call fcn.140036cd0
lea rcx, [rsp + 0x50]
call fcn.1400677b0
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1400a5d70
mov eax, edi
add rsp, 0xf8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.14003af80
mov rcx, qword [rsi]
call fcn.140036b30
mov qword [rsi], 0
jmp 0x140019c86
Function at 0x14001a74c
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x110
movaps xmmword [rsp + 0x100], xmm6
mov rbx, r9
mov r14, r8
mov rdi, rdx
mov r15, rcx
mov esi, dword [rsp + 0x180]
mov rax, qword [0x140190028]
xor rax, rsp
mov qword [rsp + 0xf8], rax
movaps xmm6, xmmword [0x140163e40]
lea rcx, [rsp + 0xe0]
movaps xmmword [rcx], xmm6
xor edx, edx
call fcn.1400a28e0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, esi
je 0x14001a7c8
lea rdx, [rsp + 0xe0]
mov ecx, esi
call fcn.140019338
test eax, eax
jns 0x14001a7ed
mov esi, eax
jmp 0x14001a947
lea rsi, [rsp + 0x50]
mov rcx, rsi
call fcn.14009fad0
lea rcx, [rsp + 0xe0]
mov rdx, rsi
call fcn.140065400
mov rcx, rsi
call fcn.140036cd0
mov rsi, qword [rsp + 0x170]
movabs r13, 0xaaaaaaaaaaaaaaaa
lea r12, [rsp + 0xc0]
mov qword [r12 + 0x10], r13
movaps xmmword [r12], xmm6
mov rcx, r12
call fcn.140113310
mov qword [rsp + 0x20], r12
mov rcx, r15
mov rdx, r14
mov r8, rbx
mov r9, rsi
call fcn.140019779
test eax, eax
js 0x14001a988
mov rsi, qword [rsp + 0x178]
lea rbx, [rsp + 0xa0]
mov qword [rbx + 0x10], r13
movaps xmmword [rbx], xmm6
lea rcx, [rsp + 0xc0]
call fcn.1400e41b0
mov rcx, rax
mov rdx, rbx
mov r8, rsi
call fcn.140069c40
lea rsi, [rsp + 0x50]
movaps xmmword [rsi + 0x40], xmm6
movaps xmmword [rsi + 0x30], xmm6
movaps xmmword [rsi + 0x20], xmm6
movaps xmmword [rsi + 0x10], xmm6
movaps xmmword [rsi], xmm6
mov rcx, rsi
mov rdx, rbx
call fcn.14006a850
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
call fcn.140114280
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea rdx, [rsp + 0xe0]
mov rcx, rsi
call fcn.140019b6c
mov esi, eax
test eax, eax
js 0x14001a981
mov rbx, qword [rsp + 0x188]
lea rcx, [rsp + 0xc0]
lea rdi, [rsp + 0x30]
mov rdx, rdi
call fcn.140113320
mov rcx, rdi
call fcn.140019fe3
mov rcx, rdi
call fcn.14003b370
mov r14, qword [rsp + 0x48]
lea r15, [r14 + 1]
cmp r15, 2
jb 0x14001a901
call fcn.14003af80
cmp qword [rbx], r14
jne 0x14001a98c
xor edi, edi
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14001a923
call fcn.14003af80
mov rcx, rdi
call fcn.140036b30
lea rcx, [rsp + 0x50]
call fcn.14006aa90
lea rcx, [rsp + 0xa0]
call fcn.14003b370
lea rcx, [rsp + 0xc0]
call fcn.140113400
lea rcx, [rsp + 0xe0]
call fcn.140036cd0
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.1400a5d70
mov eax, esi
movaps xmm6, xmmword [rsp + 0x100]
add rsp, 0x110
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rdi, qword [rsp + 0x48]
jmp 0x14001a90c
mov esi, eax
jmp 0x14001a93a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rbx]
inc rax
cmp rax, 2
jae 0x14001a9bb
cmp r15, 2
jb 0x14001a9ae
mov qword [rbx], r14
call fcn.14003af80
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14001a90a
call fcn.14003af80
mov rcx, qword [rbx]
call fcn.140036b30
mov qword [rbx], 0
jmp 0x14001a9a0
Function at 0x140036b60
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
jne 0x140036b74
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x140036bb0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x140036ba0
mov qword [rdi], rsi
call fcn.14003af80
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.14003af80
mov rcx, qword [rdi]
call fcn.140036b30
mov qword [rdi], 0
jmp 0x140036b8e
Function at 0x14003d9a0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.140036e90
mov qword [rsi], 0
test rax, rax
jne 0x14003d9f6
lea rcx, [rsi + 8]
lea rdx, [rdi + 8]
call fcn.14003b110
lea rcx, [rsi + 0x20]
call fcn.140042d90
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
mov al, byte [rdi + 0x28]
mov byte [rsi + 0x28], al
mov al, byte [rdi + 0x29]
mov byte [rsi + 0x29], al
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14003da29
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14003da1f
mov qword [rsi], rbx
call fcn.14003af80
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14003d9c2
call fcn.14003af80
mov rcx, qword [rsi]
call fcn.140036b30
mov qword [rsi], 0
jmp 0x14003da0d