joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140020104
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x140059010]
xor rax, rsp
mov qword [rsp + 0x260], rax
cmp dword [0x14005c468], 0
mov rsi, rdx
mov rdi, rcx
mov ebx, 1
jne 0x140020206
and qword [rcx + 0x12f8], 0
cmp dword [rcx + 0x66e], 0
jne 0x140020206
add rcx, 0x12f0
call fcn.140014f14
mov rcx, rax
lea r8, [rsp + 0x50]
xor edx, edx
call fcn.140003c88
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_CharUpperW]
lea r8, [rsp + 0x50]
xor edx, edx
xor ecx, ecx
call qword [0x14003d258]
mov qword [rdi + 0x12f8], rax
test rax, rax
je 0x14002022d
call qword [0x14003d038]
cmp eax, 0xb7
je 0x14002022d
lea r9, [rdi + 0x1300]
mov ecx, ebx
lea r8, [rsp + 0x50]
call fcn.14001ca08
mov qword [rdi + 0x1308], rax
test rax, rax
je 0x140020206
mov rcx, qword [rdi + 0x12f8]
or edx, 0xffffffff
call qword [0x14003d248]
call qword [0x14003d0d0]
mov rcx, qword [rdi + 0x1308]
lea r8d, [rbx + 3]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], eax
call fcn.1400235e0
mov rcx, qword [rdi + 0x12f8]
call qword [0x14003d250]
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140021c40
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
lea r9, [rdi + 0x1300]
xor ecx, ecx
lea r8, [rsp + 0x50]
call fcn.14001ca08
mov qword [rdi + 0x1308], rax
test rax, rax
je 0x1400202d1
mov rcx, qword [rdi + 0x12f8]
or edx, 0xffffffff
call qword [0x14003d248]
mov rax, qword [rdi + 0x1308]
mov rcx, qword [rdi + 0x12f8]
mov ebx, dword [rax]
call qword [0x14003d250]
mov rcx, rdi
call fcn.14001f100
mov edx, ebx
call fcn.14001ff60
mov rbx, rax
test rax, rax
je 0x1400202d1
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [rsp + 0x30], 3
xor r9d, r9d
and dword [rsp + 0x28], 0
xor r8d, r8d
and dword [rsp + 0x20], 0
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowPos]
mov edx, 9
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
or dword [rsi], 0xffffffff
xor eax, eax
jmp 0x140020208
mov rcx, qword [rdi + 0x12f8]
test rcx, rcx
je 0x1400202e3
call qword [0x14003d098]
mov rax, qword [rdi]
lea rdx, str.Cette_application_ne_peut_pas
mov rcx, rdi
call qword [rax + 8]
jmp 0x1400202c7

Function at 0x14002e560
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14002e38c
Function at 0x18000d0f0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
movzx r11d, byte [rdx]
test r9b, r9b
je 0x18000d110
lea r10d, [r11 - 0x41]
lea eax, [r11 + 0x20]
cmp r10b, 0x19
movzx ebx, al
cmova ebx, r11d
jmp 0x18000d114
movzx ebx, r11b
test r8, r8
jne 0x18000d11e
mov rax, rcx
pop rbx
ret
movabs rax, 0x100000001b3
dec r8
imul rcx, rax
movsx rax, bl
inc rdx
xor rcx, rax
pop rbx
jmp fcn.18000d0f0

Function at 0x18000d2d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push r13
push r14
sub rsp, 0x40
mov r14, rcx
xor ecx, ecx
call fcn.18000d520
movabs rbx, 0x7ffffffdfffe
mov r13, rax
lea r8, [rax - 0x10000]
cmp r8, rbx
ja 0x18000d459
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r15
test r14, r14
je 0x18000d431
mov rcx, rax
call fcn.18000d950
lea rcx, [rax - 0x10000]
cmp rcx, rbx
ja 0x18000d431
movzx r12d, word [rax + 0x14]
xor ebx, ebx
movzx ebp, word [rax + 6]
add r12, rax
movzx edi, bx
cmp bx, bp
jae 0x18000d433
movabs r10, 0xcbf29ce484222325
movabs r11, 0xaf63bd4c8601b7df
nop dword [rax]
movzx eax, di
lea rcx, [rax + rax*4]
mov esi, dword [r12 + rcx*8 + 0x20]
cmp dword [r12 + rcx*8 + 0x28], esi
mov r15d, dword [r12 + rcx*8 + 0x24]
cmovb esi, dword [r12 + rcx*8 + 0x28]
test r15d, r15d
je 0x18000d408
test esi, esi
je 0x18000d408
mov rax, qword [r12 + rcx*8 + 0x18]
mov r8, rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
test al, al
je 0x18000d3ba
nop dword [rax + rax]
inc r8
cmp byte [rsp + r8 + 0x20], bl
jne 0x18000d3b0
lea ecx, [rax + 0x20]
movzx r9d, cl
lea edx, [rax - 0x41]
cmp dl, 0x19
movzx ecx, al
cmova r9d, ecx
test r8, r8
jne 0x18000d3d8
mov rax, r10
jmp 0x18000d403
movsx rcx, r9b
lea rdx, [rsp + 0x21]
xor rcx, r11
dec r8
mov r9b, 1
call fcn.18000d0f0
movabs r10, 0xcbf29ce484222325
movabs r11, 0xaf63bd4c8601b7df
cmp rax, r14
je 0x18000d416
inc di
cmp di, bp
jb 0x18000d370
jmp 0x18000d433
mov r8, qword [rsp + 0x68]
lea rcx, [r15 + r13]
mov edx, esi
add rdx, r15
add rdx, r13
call fcn.18000d1a0
mov rbx, rax
jmp 0x18000d433
xor ebx, ebx
mov r15, qword [rsp + 0x30]
mov rax, rbx
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop r14
pop r13
pop rbx
ret
xor eax, eax
add rsp, 0x40
pop r14
pop r13
pop rbx
ret

Function at 0x18000d950
Capabilities:
Parse pe header

Disassembly:
lea rax, [rcx - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rax, rdx
ja 0x18000d983
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18000d983
mov eax, dword [rcx + 0x3c]
add rax, rcx
xor ecx, ecx
cmp dword [rax], 0x4550
cmovne rax, rcx
ret
xor eax, eax
ret
Function at 0x18001139d
Capabilities:
Terminate process

Disassembly:
jmp 0x180019660
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x1800114fb
Capabilities:
Enumerate processes

Disassembly:
jmp 0x1800158d0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x448
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x468]
mov rax, qword [0x180025040]
xor rax, rbp
mov qword [rbp + 0x418], rax
lea rcx, [0x18002b05f]
call fcn.180011681
nop
mov dword [rbp + 4], 0
xor edx, edx
mov ecx, 2
call fcn.18001130c
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0xffffffffffffffff
jne 0x180015941
xor eax, eax
jmp 0x1800159a7
lea rax, [rbp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
mov dword [rbp + 0x50], 0x238
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call fcn.1800113fc
test eax, eax
je 0x180015999
lea rdx, [rbp + 0x7c]
mov rcx, qword [rbp + 0x448]
call fcn.180011230
movzx eax, al
test eax, eax
je 0x180015988
mov eax, dword [rbp + 0x58]
mov dword [rbp + 4], eax
jmp 0x180015999
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call fcn.1800115dc
test eax, eax
jne 0x180015969
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 4]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x180020b50]
call fcn.180011596
mov rax, rdi
mov rcx, qword [rbp + 0x418]
xor rcx, rbp
call fcn.180011320
lea rsp, [rbp + 0x428]
pop rdi
pop rbp
ret
Function at 0x14000fd70
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get process filename

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, 0xf8b7108d
mov dword [rbp - 0x20], 0x72657375
mov dword [rbp - 0x1c], 0x642e3233
mov word [rbp - 0x18], 0x6c6c
mov byte [rbp - 0x16], 0
mov dword [rbp - 0x10], 0x6376736d
mov dword [rbp - 0xc], 0x642e7472
mov word [rbp - 8], 0x6c6c
mov byte [rbp - 6], 0
call fcn.14000fe40
mov ecx, 0x9e5a8833
mov rbx, rax
call fcn.14000fe40
lea rcx, [rbp - 0x20]
mov r14, rax
call rbx
lea rcx, [rbp - 0x10]
call rbx
mov ecx, 0xcef82575
call fcn.14000fe40
mov rcx, qword gs:[0x60]
mov edx, 0x53000
mov r8d, 0x3000
mov rsi, rax
mov rdi, qword [rcx + 0x10]
xor ecx, ecx
lea r9d, [rcx + 0x40]
call r14
mov r8d, 0x53000
lea rdx, [rdi + 0x131000]
mov rcx, rax
mov rbx, rax
call rsi
call rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x14000fe40
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
push r15
mov rax, qword gs:[0x60]
mov r15d, ecx
mov rdx, qword [rax + 0x18]
mov r14, qword [rdx + 0x20]
mov r8, r14

Function at 0x14000fe70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r9, qword [r8 + 0x20]
mov r8, qword [r8]
test r9, r9
je 0x14000ff07
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x14000ff07
lea r10, [r9 + rcx]
mov edx, dword [r10 + 0xc]
add rdx, r9
xor edi, edi
jmp 0x14000feb3
ror edi, 0xd
movsx ecx, r11b
cmp r11b, 0x61
lea eax, [rcx - 0x20]
cmovl eax, ecx
add edi, eax
inc rdx
mov r11b, byte [rdx]
test r11b, r11b
jne 0x14000fe9d
mov edx, dword [r10 + 0x20]
xor r11d, r11d
add rdx, r9
cmp dword [r10 + 0x18], r11d
jbe 0x14000ff07
mov ebx, dword [rdx]
add rbx, r9
xor esi, esi
jmp 0x14000feea
ror esi, 0xd
movsx ecx, bpl
cmp bpl, 0x61
lea eax, [rcx - 0x20]
cmovl eax, ecx
add esi, eax
inc rbx
mov bpl, byte [rbx]
test bpl, bpl
jne 0x14000fed4
lea eax, [rsi + rdi]
cmp r15d, eax
je 0x14000ff2b
inc r11d
add rdx, 4
cmp r11d, dword [r10 + 0x18]
jb 0x14000fecb
cmp r8, r14
jne 0x14000fe6e
xor eax, eax
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r15
pop r14
ret
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx r8d, word [rcx + r11*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + r8*4]
add rax, r9
jmp 0x14000ff12
Function at 0x14000fea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r9, qword [r8 + 0x20]
mov r8, qword [r8]
test r9, r9
je 0x14000ff07
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x14000ff07
lea r10, [r9 + rcx]
mov edx, dword [r10 + 0xc]
add rdx, r9
xor edi, edi
jmp 0x14000feb3
ror edi, 0xd
movsx ecx, r11b
cmp r11b, 0x61
lea eax, [rcx - 0x20]
cmovl eax, ecx
add edi, eax
inc rdx
mov r11b, byte [rdx]
test r11b, r11b
jne 0x14000fe9d
mov edx, dword [r10 + 0x20]
xor r11d, r11d
add rdx, r9
cmp dword [r10 + 0x18], r11d
jbe 0x14000ff07
mov ebx, dword [rdx]
add rbx, r9
xor esi, esi
jmp 0x14000feea
ror esi, 0xd
movsx ecx, bpl
cmp bpl, 0x61
lea eax, [rcx - 0x20]
cmovl eax, ecx
add esi, eax
inc rbx
mov bpl, byte [rbx]
test bpl, bpl
jne 0x14000fed4
lea eax, [rsi + rdi]
cmp r15d, eax
je 0x14000ff2b
inc r11d
add rdx, 4
cmp r11d, dword [r10 + 0x18]
jb 0x14000fecb
cmp r8, r14
jne 0x14000fe6e
xor eax, eax
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r15
pop r14
ret
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx r8d, word [rcx + r11*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + r8*4]
add rax, r9
jmp 0x14000ff12

Function at 0x14000fef0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r9, qword [r8 + 0x20]
mov r8, qword [r8]
test r9, r9
je 0x14000ff07
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x14000ff07
lea r10, [r9 + rcx]
mov edx, dword [r10 + 0xc]
add rdx, r9
xor edi, edi
jmp 0x14000feb3
ror edi, 0xd
movsx ecx, r11b
cmp r11b, 0x61
lea eax, [rcx - 0x20]
cmovl eax, ecx
add edi, eax
inc rdx
mov r11b, byte [rdx]
test r11b, r11b
jne 0x14000fe9d
mov edx, dword [r10 + 0x20]
xor r11d, r11d
add rdx, r9
cmp dword [r10 + 0x18], r11d
jbe 0x14000ff07
mov ebx, dword [rdx]
add rbx, r9
xor esi, esi
jmp 0x14000feea
ror esi, 0xd
movsx ecx, bpl
cmp bpl, 0x61
lea eax, [rcx - 0x20]
cmovl eax, ecx
add esi, eax
inc rbx
mov bpl, byte [rbx]
test bpl, bpl
jne 0x14000fed4
lea eax, [rsi + rdi]
cmp r15d, eax
je 0x14000ff2b
inc r11d
add rdx, 4
cmp r11d, dword [r10 + 0x18]
jb 0x14000fecb
cmp r8, r14
jne 0x14000fe6e
xor eax, eax
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r15
pop r14
ret
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx r8d, word [rcx + r11*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + r8*4]
add rax, r9
jmp 0x14000ff12
Function at 0x140014900
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r12
push r13
push r15
sub rsp, 0x40
mov dword [rcx + 8], 0x4b
lea rax, [0x14008572c]
mov qword [rcx + 0x18], 1
xor edi, edi
mov qword [rcx], rdi
movzx r13d, r9b
mov qword [rcx + 0x10], rdi
mov r12d, r8d
mov dword [rcx + 0x34], edi
mov ebp, edx
mov dword [rcx + 0x38], 0x4c
mov rbx, rcx
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, ebp
lea ecx, [rdi + 4]
cmp ebp, eax
cmove edx, edi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
movzx ecx, byte [rsp + 0x90]
mov byte [rbx + 0x4d], cl
mov qword [rbx + 0x40], rax
mov dword [rbx + 0x48], ebp
mov byte [rbx + 0x4c], dil
cmp rax, 0xffffffffffffffff
je 0x140014ab7
mov qword [rsp + 0x78], r14
test ebp, ebp
je 0x14001499b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp ebp, eax
je 0x14001499b
xor r14b, r14b
jmp 0x14001499e
mov r14b, 1
mov rcx, qword [rbx + 0x40]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x140014a6a
mov qword [rsp + 0x70], rsi
cmp dword [rsp + 0x20], 0x10
jb 0x140014a47
cmp dword [rsp + 0x2c], ebp
jne 0x140014a47
test r14b, r14b
je 0x1400149e9
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, dword [rsp + 0x28]
cmp r8d, eax
je 0x140014a47
jmp 0x1400149ee
mov r8d, dword [rsp + 0x28]
mov ecx, r12d
xor edx, edx
or ecx, 2
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x140014a47
mov rdi, qword [rbx + 0x10]
mov rcx, qword [rbx + 0x18]
inc rdi
shr rcx, 1
cmp rdi, rcx
jbe 0x140014a1f
mov rcx, rbx
call fcn.140010b10
mov rcx, qword [rbx]
add rcx, 0xfffffffffffffff8
mov qword [rbx + 0x10], rdi
lea rcx, [rcx + rdi*8]
test rcx, rcx
je 0x140014a36
mov qword [rcx], rsi
lea rdx, [rsp + 0x28]
lea rcx, [rbx + 0x20]
call fcn.140014ba0
mov qword [rax], rsi
mov rcx, qword [rbx + 0x40]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1400149c1
mov rsi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
test r13b, r13b
je 0x140014ab7
cmp qword [rbx + 0x40], 0xffffffffffffffff
je 0x140014ab7
cmp byte [rbx + 0x4c], 0
jne 0x140014ab7
mov rdi, qword [rbx]
mov rax, qword [rbx + 0x10]
lea rcx, [rdi + rax*8]
cmp rdi, rcx
je 0x140014ab7
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
setne al
add rdi, 8
or byte [rbx + 0x4c], al
mov rcx, qword [rbx + 0x10]
mov rax, qword [rbx]
lea rcx, [rax + rcx*8]
cmp rdi, rcx
jne 0x140014a91
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret
Function at 0x140014ad0
Capabilities:
Resume thread

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x40], 0xffffffffffffffff
mov rbx, rcx
je 0x140014b6e
cmp byte [rcx + 0x4c], 0
mov qword [rsp + 0x30], rdi
je 0x140014b32
cmp byte [rcx + 0x4d], 0
je 0x140014b32
mov rdi, qword [rcx]
mov rax, qword [rcx + 0x10]
lea rcx, [rdi + rax*8]
cmp rdi, rcx
je 0x140014b2b
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
sete al
add rdi, 8
or byte [rbx + 0x4c], al
mov rcx, qword [rbx + 0x10]
mov rax, qword [rbx]
lea rcx, [rax + rcx*8]
cmp rdi, rcx
jne 0x140014b05
movzx eax, byte [rbx + 0x4c]
mov byte [rbx + 0x4d], al
mov rdi, qword [rbx]
mov rax, qword [rbx + 0x10]
lea rcx, [rdi + rax*8]
cmp rdi, rcx
je 0x140014b5f
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x10]
add rdi, 8
mov rax, qword [rbx]
lea rcx, [rax + rcx*8]
cmp rdi, rcx
jne 0x140014b42
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rbx + 0x20]
lea rax, [0x14008572c]
cmp rcx, rax
je 0x140014b93
mov edx, dword [rbx + 0x38]
lea r8, str.D:landun_DDZEngineEditorBuildwindowil2cppErrRuntime_Core_Containers_hash_set.h
mov r9d, 0x424
call fcn.1400028d0
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400078b0
Function at 0x14001f780
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
cmp qword [rdx + 0x18], 8
mov r14, r8
mov rbx, rdx
mov rsi, rcx
jb 0x14001f7b7
mov r8, qword [rdx]
mov r9, qword [rdx + 0x10]
lea rax, [r8 + r9*2]
jmp 0x14001f7c2
mov rax, qword [rdx + 0x10]
mov r8, rbx
lea rax, [rdx + rax*2]
mov edx, 0x5c
cmp r8, rax
je 0x14001f7e4
nop dword [rax]
cmp word [r8], 0x2f
jne 0x14001f7db
mov word [r8], dx
add r8, 2
cmp r8, rax
jne 0x14001f7d0
cmp qword [rbx + 0x18], 8
mov rbp, rbx
jb 0x14001f7f1
mov rbp, qword [rbx]
mov rcx, rbp
call fcn.140043ac0
mov rdi, rax
test rax, rax
je 0x14001f807
add rdi, 2
jmp 0x14001f80a
mov rdi, rbp
mov rdx, qword [r14 + 0x10]
lea rcx, [rsp + 0x20]
xor ebp, ebp
mov qword [rsp + 0x38], 7
inc rdx
mov qword [rsp + 0x30], rbp
mov word [rsp + 0x20], bp
call fcn.140014620
cmp qword [r14 + 0x18], 8
mov r8, qword [r14 + 0x10]
jb 0x14001f83e
mov r14, qword [r14]
mov rdx, r14
lea rcx, [rsp + 0x20]
call fcn.1400142d0
mov r8d, 1
lea rdx, [0x1400859a4]
lea rcx, [rsp + 0x20]
call fcn.1400142d0
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdi + r8*2], bp
jne 0x14001f870
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400142d0
mov qword [rsi + 0x10], rbp
mov qword [rsi + 0x18], rbp
movups xmm0, xmmword [rax]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsi + 0x10], xmm1
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], 7
mov word [rax], bp
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14001f8ea
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001f8e5
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001f934
mov rcx, r8
call fcn.14003e23c
cmp qword [rsi + 0x18], 8
mov rcx, rsi
jb 0x14001f8f7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001f90e
test al, 0x10
jne 0x14001f90e
mov rcx, rsi
call fcn.14001f940
mov rcx, rbx
call fcn.140011d90
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
call fcn.14004bd18
int3
Function at 0x140020870
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x40
mov rdi, rdx
xor r14d, r14d
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14002094f
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x60], rbp
mov rcx, rbx
mov dword [rsp + 0x70], r14d
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp dword [rsp + 0x70], r14d
je 0x1400208db
xor dil, dil
jmp 0x140020934
mov qword [rsp + 0x68], rsi
mov rcx, rdi
mov rsi, qword [rdi + 8]
sub rsi, qword [rdi]
lea rdx, [rsi + rbp]
call fcn.14002cc80
mov rdx, qword [rdi]
lea r9, [rsp + 0x78]
add rdx, rsi
mov dword [rsp + 0x78], r14d
mov r8d, ebp
mov qword [rsp + 0x20], r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002092c
mov edx, dword [rsp + 0x78]
mov rcx, rdi
add rdx, rsi
call fcn.14002cc80
xor dil, dil
jmp 0x14002092f
mov dil, 1
mov rsi, qword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x60]
movzx eax, dil
add rsp, 0x40
pop r14
pop rdi
pop rbx
ret
xor al, al
add rsp, 0x40
pop r14
pop rdi
pop rbx
ret
Function at 0x14002b620
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x14002b654
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x14002b640
ret

Function at 0x14002b660
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
movabs rax, 0xcbf29ce484222325
sar r8, 1
mov r9d, 0
add r8, r8
je 0x14002b6a4
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x14002b690
ret
Function at 0x14002f940
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rcx], rdx
mov rbx, rcx
mov qword [rcx + 8], 0
mov qword [rcx + 0x10], r8
mov byte [rcx + 0x40], 0
add rcx, 0x18
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov r9, rbx
mov qword [rsp + 0x28], 0
lea r8, [0x140031660]
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 8], rax
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140031900
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
sub rsp, 0x460
mov r14, rcx
mov qword [rax + 0x10], rbx
add rcx, 8
movaps xmmword [rax - 0x38], xmm6
call fcn.140011870
mov rcx, qword [r14 + 0xa0]
call fcn.140032490
cmp qword [r14 + 0x58], 8
lea rcx, [r14 + 0x40]
movaps xmm6, xmm0
jb 0x14003193f
mov rcx, qword [rcx]
xor edx, edx
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x140031962
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ebp, ebp
jmp 0x140031ae8
xor ebp, ebp
lea r9, [rsp + 0x480]
lea r8, [0x1400326a0]
mov qword [rsp + 0x480], rbp
mov rcx, rbx
lea edx, [rbp + 0xe]
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
mov rdx, qword [rsp + 0x480]
mov rcx, rbx
test rdx, rdx
jne 0x1400319a2
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140031ae8
mov r8d, 0xe
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rbx
test rax, rax
jne 0x1400319c1
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140031ae8
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x1400319dd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140031ae8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
jne 0x1400319f9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140031ae8
mov r9d, 0x100
mov qword [rsp + 0x458], r12
mov r8d, r9d
mov dword [rsp + 0x20], ebp
mov edx, 1
mov rcx, rax
call qword [sym.imp.USER32.dll_LookupIconIdFromDirectoryEx]
movzx edx, ax
mov r8d, 3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r12, rax
mov rcx, rbx
test rax, rax
jne 0x140031a44
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140031ae0
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140031a60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140031ae0
mov rcx, rax
mov qword [rsp + 0x450], r15
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
mov rcx, rbx
test rax, rax
jne 0x140031a84
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140031ad8
mulss xmm6, dword [0x1400882a4]
mov rdx, r12
mov qword [rsp + 0x490], rsi
cvttss2si esi, xmm6
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x30], ebp
mov r9d, 0x30000
mov edx, eax
mov dword [rsp + 0x28], esi
mov r8d, 1
mov dword [rsp + 0x20], esi
mov rcx, r15
call qword [sym.imp.USER32.dll_CreateIconFromResourceEx]
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x490]
mov r15, qword [rsp + 0x450]
mov r12, qword [rsp + 0x458]
movaps xmm6, xmmword [rsp + 0x440]
lea rax, [r14 + 0x80]
cmp qword [rax + 0x18], 8
mov rbx, qword [rsp + 0x488]
jb 0x140031b09
mov rax, qword [rax]
cmp qword [r14 + 0x78], 8
lea r9, [r14 + 0x60]
jb 0x140031b17
mov r9, qword [r9]
lea r8, str._s____s
mov qword [rsp + 0x20], rax
mov edx, 0x200
lea rcx, [rsp + 0x40]
call fcn.140014840
mov rcx, qword [r14 + 0xa0]
lea r9, [rsp + 0x40]
mov r8, rbp
mov edx, 0x501
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [r14 + 8]
call fcn.140011880
add rsp, 0x460
pop r14
pop rdi
pop rbp
ret