joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005af50
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
lea ebp, [rdx + 0x26a]
mov r14, r8
mov esi, edx
mov rdi, rcx
cmp edx, ebp
jae 0x18005b00e
xor r15d, r15d
nop dword [rax]
cmp esi, 0x10d
ja 0x18005b000
je 0x18005b00e
mov eax, esi
sub eax, 0x39
je 0x18005afbf
sub eax, 0x6d
je 0x18005afb0
cmp eax, 0x34
jne 0x18005b03a
mov qword [rdi + 0x30], r15
mov qword [rdi + 0x18], r15
jmp 0x18005b03a
mov rcx, rdi
call qword [0x18007ce40]
mov byte [rsp + 0x68], al
jmp 0x18005b03a
mov rbx, r15
cmp qword [rdi + 0x60], rbx
jbe 0x18005b03a
nop dword [rax + rax]
mov qword [rsp + 0x28], r15
lea rdx, [rsp + 0x78]
mov r9d, 0xe7
mov qword [rsp + 0x20], r15
xor r8d, r8d
mov qword [rsp + 0x78], rbx
mov rcx, rdi
call fcn.180044720
inc rbx
cmp rbx, qword [rdi + 0x60]
jb 0x18005afd0
jmp 0x18005b03a
mov eax, esi
sub eax, 0x129
je 0x18005b023
cmp eax, 0x67
jne 0x18005b03a
mov eax, dword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
jne 0x18005b047
mov dword [rsp + 0x68], 1
add esi, 0x67
cmp esi, ebp
jb 0x18005af80
jmp 0x18005b00e
mov rbx, qword [rsp + 0x60]
mov eax, r15d
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18005c730
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
lea ebp, [rcx + 7]
mov r12, r9
mov r13, r8
mov r14, rdx
mov ebx, ecx
cmp ecx, ebp
jae case.0x18005c797.1
mov r15, qword [rsp + 0x90]
lea edi, [rcx - 0x87]
mov rsi, qword [rsp + 0x30]
lea rdx, [0x180000000]
nop dword [rax]
cmp edi, 0x1c
ja case.0x18005c797.7
movzx eax, byte [rdx + rdi + 0x5c904]
mov ecx, dword [rdx + rax*4 + 0x5c8e4]
add rcx, rdx
jmp rcx
lea r8, [rsp + 0x28]
mov qword [rsp + 0x30], 0x28
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x28], 1
mov ecx, 0x12b
call fcn.1800531b0
mov rsi, rax
jmp 0x18005c7f9
mov eax, 0x76
nop dword [rax]
cmp eax, 0x76
je 0x18005c811
add eax, 0x5196
cmp eax, 0x5196
jbe 0x18005c7d0
mov r8, qword [r12]
mov r9, r13
mov rdx, qword [r14]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x20], rax
lea rdx, [0x180000000]
inc ebx
inc edi
cmp ebx, ebp
jb 0x18005c780
jmp case.0x18005c797.1
test r14, r14
je 0x18005c84e
mov rdx, qword [r14]
test rdx, rdx
je 0x18005c84e
mov r8, qword [r15 + 8]
xor ecx, ecx
test r8, r8
je 0x18005c845
mov rax, qword [rdx]
mov r9, qword [rax + 0x20]
mov rax, qword [rdx + 8]
cmp qword [rax], r9
jb 0x18005c855
inc rcx
add rax, 8
cmp rcx, r8
jb 0x18005c834
mov rdx, qword [rdx + 0x18]
test rdx, rdx
jne 0x18005c822
mov byte [rsp + 0x20], 1
jmp case.0x18005c797.1
mov byte [rsp + 0x20], 0
jmp case.0x18005c797.1
test rsi, rsi
jne 0x18005c865
xor eax, eax
jmp 0x18005c8c3
mov edx, 0x400
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
je 0x18005c87c
mov rax, rsi
jmp 0x18005c8c3
xor edx, edx
mov r8d, 0xeb
mov rcx, rsi
call fcn.18005e5f0
jmp 0x18005c8c3
lea r8, [rsp + 0x30]
mov qword [rsp + 0x28], SHSetInstanceExplorer
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x30], 1
mov ecx, 0x12b
call fcn.1800531b0
jmp 0x18005c8c3
mov eax, dword [r15 + 0x40]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18005e410
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
imul ebp, r9d, 0x184
mov esi, r9d
mov r14, r8
mov r15, rdx
mov r12, rcx
mov ebx, r9d
cmp r9d, ebp
ja 0x18005e5a8
mov rdi, qword [rsp + 0x38]
xor r13d, r13d
cmp ebx, 0x21
je 0x18005e5cd
cmp ebx, 0x106
je 0x18005e581
cmp ebx, 0x644c
je 0x18005e4cd
cmp ebx, 0xc792
jne 0x18005e59b
mov r8, qword [rsp + 0x30]
lea rcx, [rsp + 0x38]
mov r9, rdi
mov qword [rsp + 0x38], 1
mov edx, 0x7f
call fcn.180062810
mov r8, rax
xor edx, edx
mov ecx, 0xa9
call fcn.18004c030
lea r8, [rsp + 0x88]
mov byte [rsp + 0x88], 1
mov rdx, rdi
mov ecx, 0x91
call fcn.18006b1e0
jmp 0x18005e598
mov edx, 0x23
mov qword [rsp + 0x30], r13
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], 2
mov r9, rdi
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x38]
lea ecx, [rdx - 0x21]
call fcn.180062560
mov edx, 0x23
mov qword [rsp + 0x38], 3
lea rax, [rsp + 0x30]
mov r9, rdi
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea ecx, [rdx - 0x20]
call fcn.180062560
mov edx, 0x23
mov qword [rsp + 0x38], 1
lea rax, [rsp + 0x30]
mov r9, rdi
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea ecx, [rdx - 0x22]
call fcn.180062560
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x18005e55b
cmp qword [rax + 8], 2
je 0x18005e59b
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Olemasolul_kasutatakse_CD_teksti
call fcn.18006e7b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r9d, 0xef
mov qword [rsp + 0x20], r13
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180042520
mov rdi, rax
imul eax, esi, 0x61
add ebx, eax
cmp ebx, ebp
jbe 0x18005e453
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r9, qword [rsp + 0x90]
mov rcx, r12
mov r8, qword [r14]
mov rdx, qword [r15]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
jmp 0x18005e5ad
Function at 0x18006e2f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
lea ebp, [r9 + 7]
mov r14, r8
mov r15, rdx
mov r12, rcx
cmp r9d, ebp
jae case.0x18006e354.1
mov esi, dword [rsp + 0x88]
lea ebx, [r9 - 0xb9]
lea r13, [0x180000000]
cmp ebx, 0x16
ja case.0x18006e354.6
movzx eax, byte [rbx + r13 + 0x6e460]
mov ecx, dword [r13 + rax*4 + 0x6e444]
add rcx, r13
jmp rcx
mov rdx, r15
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_setbuf]
jmp case.0x18006e354.6
mov r8, qword [r15]
mov r9, r12
mov qword [rsp + 0x28], 0
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x30], rax
jmp case.0x18006e354.6
mov rax, qword [r14]
movzx esi, byte [rax]
shl esi, 8
inc rax
mov qword [r14], rax
jmp case.0x18006e354.6
mov r8, qword [r14 + 0xa0]
mov r9d, 0x46
xor edx, edx
xor ecx, ecx
call fcn.18005dee0
mov rax, qword [r12]
lea rcx, [rsp + 0x30]
mov r9, r15
mov qword [rsp + 0x30], rax
mov r8, r14
mov edx, 0xa6
call fcn.180056610
mov r8, qword [r14 + 0xa0]
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], SHSetInstanceExplorer
xor ecx, ecx
mov rdi, rax
call fcn.18004aac0
mov qword [rsp + 0x30], rdi
inc ebx
lea eax, [rbx + 0xb9]
cmp eax, ebp
jb 0x18006e337
jmp case.0x18006e354.1
mov rcx, qword [r14]
movzx eax, byte [rcx]
or esi, eax
lea rax, [rcx + 1]
mov qword [r14], rax
mov word [rsp + 0x30], si
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x18006e720
Capabilities:
Terminate process

Disassembly:
mov r9, rdx
mov r8, rcx
mov edx, 0xbd
xor ecx, ecx
jmp fcn.180053660

Function at 0x18006e740
Capabilities:
Create thread
Enumerate services

Disassembly:
mov rax, rdx
mov r9, r8
mov rdx, rcx
mov r8d, 0x18
mov rcx, rax
jmp fcn.1800456e0
Function at 0x140005150
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rbp, rdx
mov rdi, rcx
mov rbx, r8
je 0x1400051e8
test r8, r8
jle 0x1400051e0
nop word [rax + rax]
mov rcx, rdi
call fcn.140008b90
test rax, rax
jle 0x1400051be
cmp rbx, rax
mov rsi, rbx
mov rdx, rbp
cmovge rsi, rax
mov rax, qword [rdi + 0x40]
mov r8, rsi
mov rcx, qword [rax]
call fcn.140016860
mov rax, qword [rdi + 0x58]
sub rbx, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
jmp 0x1400051d8
mov rax, qword [rdi]
mov rcx, rdi
movzx edx, byte [rbp]
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400051e0
dec rbx
mov esi, 1
add rbp, rsi
test rbx, rbx
jg 0x140005180
sub r14, rbx
mov rax, r14
jmp 0x140005266
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], r15
mov r9, qword [rax]
test r9, r9
je 0x140005201
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140005203
xor ecx, ecx
movsxd rsi, ecx
test r14, r14
jle 0x14000525b
test ecx, ecx
jle 0x14000523c
cmp r14, rsi
mov rcx, r9
cmovl rsi, r14
mov r8, rsi
call fcn.140016860
mov rax, qword [rdi + 0x58]
add rbp, rsi
sub r14, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
test r14, r14
jle 0x14000525b
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14000525b
mov r8, r14
mov edx, 1
mov rcx, rbp
call fcn.14002d400
sub r14, rax
mov r15, qword [rsp + 0x40]
sub rbx, r14
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140005280
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x1400052a2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14000531c
mov rdi, r14
mov rcx, rbx
call fcn.140008bb0
test rax, rax
jle 0x1400052f4
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.140016860
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14000530c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140005314
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x1400052b6
sub r14, rdi
jmp 0x1400053ff
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140005333
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140005335
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140005367
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.140016860
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1400053fc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400053a2
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x1400053dd
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.14002ee20
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x1400053fc
cmp rbp, rax
ja 0x1400053b0
test rbp, rbp
je 0x1400053fc
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.14002ee20
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x1400058d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140091090]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400058fd
xor eax, eax
jmp 0x140005a43
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140005937
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140005937
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140005a43
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140005a36
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000597a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140005989
movsx ecx, dil
jmp 0x1400059dd
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
je 0x1400059f7
sub eax, 1
je 0x1400059f7
cmp eax, 2
jne 0x140005a36
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.14001f0a0
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140005a3b
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140005a24
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.14002d400
cmp rsi, rax
jne 0x140005a36
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x140005a3b
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140012fc0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret

Function at 0x14000d1f0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14000d238
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x20], eax
ja 0x14000d238
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x24]
jmp 0x14000d24f
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x2c], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x2c]
add rsp, 0x48
ret
Function at 0x14000d6f0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14000d72d
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.14000d690
add rsp, 0x58
ret

Function at 0x14000f3c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x140091090]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x14000f3fd
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x72]
test eax, eax
jne 0x14000f404
mov al, 1
jmp 0x14000f571
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x48], rax
call fcn.14000cdc0
mov word [rsp + 0x30], ax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
movzx edx, word [rsp + 0x30]
mov rcx, qword [rsp + 0xb0]
mov rax, qword [rsp + 0x50]
call qword [0x14006e350]
mov word [rsp + 0x32], ax
call fcn.14000cdc0
mov word [rsp + 0x34], ax
lea rdx, [rsp + 0x32]
lea rcx, [rsp + 0x34]
call fcn.14000cdd0
movzx eax, al
test eax, eax
je 0x14000f470
xor al, al
jmp 0x14000f571
mov qword [rsp + 0x68], 0x20
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call fcn.1400113f0
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x14000f4df
cmp dword [rsp + 0x38], 1
je 0x14000f4eb
cmp dword [rsp + 0x38], 3
je 0x14000f55f
jmp 0x14000f56f
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x72], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jbe 0x14000f536
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x40]
mov edx, 1
lea rcx, [rsp + 0x70]
call fcn.14002d400
cmp qword [rsp + 0x40], rax
je 0x14000f536
xor al, al
jmp 0x14000f571
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x72]
test eax, eax
jne 0x14000f550
mov dword [rsp + 0x3c], 1
jmp 0x14000f558
mov dword [rsp + 0x3c], 0
movzx eax, byte [rsp + 0x3c]
jmp 0x14000f571
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x72], 0
mov al, 1
jmp 0x14000f571
xor al, al
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140012fc0
add rsp, 0xa8
ret
Function at 0x1400105c0
Capabilities:
Write file on windows

Disassembly:
mov word [rsp + 0x10], dx
mov qword [rsp + 8], rcx
sub rsp, 0xc8
mov rax, qword [0x140091090]
xor rax, rsp
mov qword [rsp + 0xb8], rax
call fcn.14000cdc0
mov word [rsp + 0x48], ax
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x48]
call fcn.14000cdd0
movzx eax, al
test eax, eax
je 0x140010618
lea rcx, [rsp + 0xd8]
call fcn.1400104b0
jmp 0x140010888
mov rcx, qword [rsp + 0xd0]
call fcn.140010aa0
test rax, rax
je 0x140010687
mov rcx, qword [rsp + 0xd0]
call fcn.140010aa0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0xd0]
call fcn.1400102a0
mov rcx, qword [rsp + 0x60]
cmp rcx, rax
jae 0x140010687
lea rcx, [rsp + 0xd8]
call fcn.140010ee0
mov word [rsp + 0x4a], ax
mov rcx, qword [rsp + 0xd0]
call fcn.14000cde0
movzx ecx, word [rsp + 0x4a]
mov word [rax], cx
movzx eax, word [rsp + 0xd8]
jmp 0x140010888
mov rax, qword [rsp + 0xd0]
cmp qword [rax + 0x80], 0
jne 0x1400106a3
call fcn.14000cdc0
jmp 0x140010888
mov rcx, qword [rsp + 0xd0]
call fcn.14000fab0
mov rax, qword [rsp + 0xd0]
cmp qword [rax + 0x68], 0
jne 0x14001071e
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax + 0x80]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0xd8]
call fcn.140010ee0
mov word [rsp + 0x4c], ax
mov rdx, qword [rsp + 0x68]
movzx ecx, word [rsp + 0x4c]
call fcn.14000ec20
movzx eax, al
test eax, eax
je 0x14001070a
movzx eax, word [rsp + 0xd8]
mov word [rsp + 0x44], ax
jmp 0x140010714
call fcn.14000cdc0
mov word [rsp + 0x44], ax
movzx eax, word [rsp + 0x44]
jmp 0x140010888
mov qword [rsp + 0x88], 0x20
lea rcx, [rsp + 0xd8]
call fcn.140010ee0
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0xb0]
lea rcx, [rsp + 0x42]
mov rdx, qword [rsp + 0xd0]
add rdx, 0x74
lea r8, [rsp + 0x78]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9, rcx
lea r8, [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
call fcn.140010520
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x1400107c3
cmp dword [rsp + 0x50], 1
je 0x1400107c3
cmp dword [rsp + 0x50], 3
je 0x140010843
jmp 0x140010883
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jbe 0x140010817
mov rax, qword [rsp + 0xd0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x58]
mov edx, 1
lea rcx, [rsp + 0x90]
call fcn.14002d400
cmp qword [rsp + 0x58], rax
je 0x140010817
call fcn.14000cdc0
jmp 0x140010888
mov rax, qword [rsp + 0xd0]
mov byte [rax + 0x72], 1
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x80], rax
je 0x14001083c
movzx eax, word [rsp + 0xd8]
jmp 0x140010888
call fcn.14000cdc0
jmp 0x140010888
mov rax, qword [rsp + 0xd0]
mov rdx, qword [rax + 0x80]
movzx ecx, word [rsp + 0x40]
call fcn.14000ec20
movzx eax, al
test eax, eax
je 0x140010872
movzx eax, word [rsp + 0xd8]
mov word [rsp + 0x46], ax
jmp 0x14001087c
call fcn.14000cdc0
mov word [rsp + 0x46], ax
movzx eax, word [rsp + 0x46]
jmp 0x140010888
call fcn.14000cdc0
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.140012fc0
add rsp, 0xc8
ret
Function at 0x14001da30
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.14001d510
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14001da6f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x14006e350]
jmp 0x14001da79
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret

Function at 0x140041c50
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x180002440
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rbp, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1800024e7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1800024e7
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
mov r8d, 0x610c32cd
lea rdx, [r11 + r9*4]
mov ecx, dword [rdx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1800024e2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1800024c0
cmp r8d, 0xa3b2cf1f
je 0x1800024ec
test r9d, r9d
jne 0x1800024a0
mov rax, qword [rax]
jmp 0x180002470
mov ecx, dword [rbx + 0x24]
mov edx, dword [rbx + 0x1c]
add rcx, r10
add rdx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
mov rcx, rbp
add rax, r10
call rax
mov rcx, 0xffffffffffffffff
lea rsi, [rax + 1]
mov eax, 2
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.180010d20
mov rcx, qword gs:[0x60]
mov rdi, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov r11d, dword [rdx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x1800025b5
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x1800025b5
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0x5dfd238a
add r8, r10
movzx eax, byte [r8]
inc r8
test al, al
je 0x1800025b0
nop
movsx eax, al
lea r8, [r8 + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [r8 - 1]
test al, al
jne 0x180002590
cmp edx, 0xec7ca0fe
je 0x1800025ba
test r9d, r9d
jne 0x180002570
mov rcx, qword [rcx]
jmp 0x180002540
mov ecx, dword [r11 + 0x24]
mov r8, rsi
add rcx, r10
mov rdx, rbp
movzx r9d, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + r9*4]
mov rcx, rdi
add rax, r10
call rax
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret