joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473fa0
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
je 0x47403d
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
lea eax, [rcx - 3]
xor ebx, ebx
xor r9d, r9d
movsxd r10, eax
mov r13, rdx
mov r11, qword [r8 + r10*8 + 8]
mov rsi, qword [r8 + r10*8 + 0x10]
lea r14, [r10 - 1]
sub r11, rsi
test r14, r14
mov rax, qword [r8 + r10*8]
mov r12, r14
mov edi, dword [r9 + rax]
mov ebp, edi
js 0x47401a
mov rax, qword [r8 + r12*8]
mov ecx, ebp
and ebp, 0xff7f7f7f
mov edx, dword [r9 + rax]
and ecx, 0x80808080
mov eax, ecx
add ecx, ecx
xor edi, edx
shr eax, 7
sub ecx, eax
mov eax, ebp
and ecx, 0x1d1d1d1d
add eax, eax
mov ebp, ecx
xor ebp, eax
xor ebp, edx
dec r12
jns 0x473fe4
lea rax, [r9 + rsi]
add ebx, 4
add r9, 4
mov dword [r11 + rax], edi
mov dword [rax], ebp
movsxd rax, ebx
cmp rax, r13
jb 0x473fd2
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x474040
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x20
test rdx, rdx
movsxd rsi, r8d
mov rdi, r9
mov rbp, qword [r9 + rsi*8]
movsxd rbx, ecx
je 0x47411b
mov r12d, 0x10000
cmp rdx, r12
jne 0x47411b
cmp r8d, ebx
jge 0x47411b
cmp ebx, 2
jl 0x47411b
mov r8, r12
mov rcx, rbp
jne 0x47409f
mov rax, rsi
shl rax, 3
sub rdi, rax
mov rdx, qword [rdi + 8]
call fcn.00553680
jmp 0x474117
xor edx, edx
call fcn.00553530
xor r11d, r11d
test ebx, ebx
jle 0x474117
cmp r11, rsi
je 0x47410f
mov r8, qword [rdi + r11*8]
mov rcx, rbp
mov rdx, r12
test cl, 4
je 0x4740d1
mov al, byte [r8]
inc r8
xor byte [rcx], al
inc rcx
dec rdx
jne 0x4740bc
cmp rdx, 4
jb 0x4740fa
mov r9, rdx
shr r9, 2
mov rax, r9
imul rax, rax, 0xfffffffffffffffc
add rdx, rax
mov eax, dword [r8]
add r8, 4
xor dword [rcx], eax
add rcx, 4
dec r9
jne 0x4740e8
test rdx, rdx
je 0x47410f
mov al, byte [r8]
inc r8
xor byte [rcx], al
inc rcx
dec rdx
jne 0x4740ff
inc r11
cmp r11, rbx
jl 0x4740ad
xor eax, eax
jmp 0x474120
mov eax, 0xffffffea
add rsp, 0x20
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x47412c
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 8], ecx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
test r8d, r8d
movsxd rdi, r9d
movsxd rsi, r8d
mov rbp, rdx
movsxd rbx, ecx
js 0x4742ba
lea eax, [rbx - 2]
cmp esi, eax
jge 0x4742ba
test r9d, r9d
js 0x4742ba
cmp edi, eax
jge 0x4742ba
cmp esi, edi
jge 0x4742ba
mov r12d, 1
mov rcx, r12
call fcn.00556cf0
mov rdx, rbp
mov rcx, r12
mov r13, rax
call fcn.00556cf0
test r13, r13
mov r12, rax
je 0x4742a3
test rax, rax
je 0x4742a3
mov r8, qword [rsp + 0xa0]
mov ecx, dword [rsp + 0x80]
mov rdx, rbp
mov rax, qword [r8 + rbx*8 - 0x10]
mov r14, qword [r8 + rsi*8]
mov qword [rsp + 0x20], rax
mov rax, qword [r8 + rbx*8 - 8]
mov qword [r8 + rsi*8], r13
mov qword [r8 + rbx*8 - 0x10], r14
mov r15, qword [r8 + rdi*8]
mov qword [r8 + rdi*8], r12
mov qword [r8 + rbx*8 - 8], r15
mov qword [rsp + 0x28], rax
call fcn.00473fa0
mov r9, qword [rsp + 0x20]
mov r10, qword [rsp + 0x28]
mov qword [r8 + rsi*8], r14
mov qword [r8 + rdi*8], r15
mov qword [r8 + rbx*8 - 0x10], r9
mov qword [r8 + rbx*8 - 8], r10
lea r8, [0x00400000]
lea rdx, [0x0074cec0]
mov rax, rdi
movzx ecx, byte [rdi + r8 + 0x35cec0]
sub rax, rsi
movzx r11d, byte [rax + r8 + 0x35d0c0]
movzx eax, byte [rsi + r8 + 0x35cec0]
xor rcx, rax
shl r11, 8
movzx ebx, byte [rcx + r8 + 0x35cfc0]
add r11, rdx
shl rbx, 8
add rbx, rdx
test rbp, rbp
je 0x47428f
movzx eax, byte [r10]
mov r8b, byte [r14]
movzx ecx, byte [r15]
xor r8b, byte [r9]
xor rcx, rax
inc r10
mov dl, byte [rcx + rbx]
movzx eax, r8b
inc r9
xor dl, byte [rax + r11]
mov byte [r15], dl
xor dl, r8b
inc r15
mov byte [r14], dl
inc r14
dec rbp
jne 0x474259
mov rcx, r13
call fcn.00556590
mov rcx, r12
call fcn.00556590
xor eax, eax
jmp 0x4742bf
mov rcx, r13
call fcn.00556590
mov rcx, r12
call fcn.00556590
mov eax, 0xfffffff4
jmp 0x4742bf
mov eax, 0xffffffea
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x4742d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x28
movsxd r15, ecx
mov ecx, 1
mov r13, r9
mov rdi, qword [r9 + r15*8 - 0x10]
mov r12, qword [r9 + r15*8 - 8]
movsxd rbx, r8d
mov rsi, rdx
call fcn.00556cf0
test rax, rax
jne 0x47430d
mov eax, 0xfffffff4
jmp 0x474382
mov rbp, qword [r13 + rbx*8]
mov qword [r13 + rbx*8], rax
mov r8, r13
mov rdx, rsi
mov ecx, r15d
mov qword [r13 + r15*8 - 8], rbp
call fcn.00473fa0
mov qword [r13 + rbx*8], rbp
lea rcx, [0x00400000]
mov qword [r13 + r15*8 - 8], r12
movzx eax, byte [rbx + rcx + 0x35cec0]
movzx edx, byte [rax + rcx + 0x35cfc0]
lea rax, [0x0074cec0]
shl rdx, 8
add rdx, rax
test rsi, rsi
je 0x474380
movzx eax, byte [rbp]
movzx ecx, byte [r12]
inc r12
xor rcx, rax
mov al, byte [rcx + rdx]
mov byte [rbp], al
xor byte [rdi], al
inc rdi
inc rbp
dec rsi
jne 0x47435e
xor eax, eax
add rsp, 0x28
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x477b5c
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x20
mov r12, rcx
mov rcx, qword [0x007cf790]
mov ebx, r8d
mov rdi, rdx
mov r8d, 0x1000
xor edx, edx
mov rbp, r9
xor esi, esi
call fcn.00553530
mov rdx, qword [0x007cf790]
mov r8d, ebx
mov rcx, rdi
call fcn.0044ff70
movsxd rbx, eax
cmp ebx, esi
jle 0x477bfd
mov rax, qword [0x007cf790]
mov dl, byte [0x007cf750]
lea ecx, [rsi + 4]
cmp rcx, rbx
mov byte [rax + 3], dl
jge 0x477bd5
mov rax, qword [0x007cf790]
xor byte [rcx + rax], dl
inc rcx
add dl, 0x11
cmp rcx, rbx
jl 0x477bba
mov byte [0x007cf750], dl
mov rdx, qword [0x007cf790]
mov rcx, qword [0x007cf780]
lea r9d, [rbx + 8]
mov r8, r12
call fcn.004afe18
cmp eax, esi
je 0x477bfd
mov dword [rbp], ebx
mov esi, 1
jmp 0x477c02
call fcn.00477b18
mov eax, esi
add rsp, 0x20
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x545484
Capabilities:
Parse pe header

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x38
movsxd rax, dword [rcx + 0x3c]
mov r12, r9
mov r13, r8
add rax, rcx
cmp word [rcx], 0x5a4d
mov rbp, rdx
mov rsi, rcx
jne 0x545525
cmp dword [rax], 0x4550
jne 0x545525
cmp word [rax + 0x18], 0x20b
jne 0x545525
mov ecx, dword [rax + 0x90]
test ecx, ecx
je 0x545525
cmp dword [rax + 0x94], 0
je 0x545525
lea rbx, [rsi + rcx]
lea rax, [rbx + 0xc]
cmp dword [rax], 0
je 0x545525
mov rdi, rax
mov ecx, dword [rax]
mov rdx, rbp
add rcx, rsi
call fcn.0055a650
test eax, eax
jne 0x545515
cmp dword [rbx + 0x10], eax
je 0x545525
mov edx, dword [rbx]
mov r8d, dword [rbx + 0x10]
mov r9, r13
mov rcx, rsi
add rdx, rsi
add r8, rsi
mov qword [rsp + 0x20], r12
call fcn.00545404
test rax, rax
jne 0x545527
add rdi, 0x14
mov rax, rdi
cmp dword [rdi], 0
lea rbx, [rdi - 0xc]
jne 0x5454de
xor eax, eax
add rsp, 0x38
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x545534
Capabilities:
Parse pe header

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x38
movsxd rax, dword [rcx + 0x3c]
mov r12, r9
mov r13, r8
add rax, rcx
cmp word [rcx], 0x5a4d
mov rbp, rdx
mov rsi, rcx
jne 0x5455d1
cmp dword [rax], 0x4550
jne 0x5455d1
cmp word [rax + 0x18], 0x20b
jne 0x5455d1
mov ecx, dword [rax + 0xf0]
test ecx, ecx
je 0x5455d1
cmp dword [rax + 0xf4], 0
je 0x5455d1
lea rdi, [rsi + rcx]
lea rax, [rdi + 4]
cmp dword [rax], 0
je 0x5455d1
mov rbx, rax
mov ecx, dword [rax]
mov rdx, rbp
add rcx, rsi
call fcn.0055a650
test eax, eax
jne 0x5455c1
mov edx, dword [rdi + 0x10]
mov r8d, dword [rdi + 0xc]
mov r9, r13
mov rcx, rsi
add rdx, rsi
add r8, rsi
mov qword [rsp + 0x20], r12
call fcn.00545404
test rax, rax
jne 0x5455d3
add rbx, 0x20
mov rax, rbx
cmp dword [rbx], 0
lea rdi, [rbx - 4]
jne 0x54558e
xor eax, eax
add rsp, 0x38
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x8f08b2
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x30]
call fcn.00930e2a

Function at 0xc15f37
Capabilities:
Encode data using xor

Disassembly:
je 0xc15f96
jb 0xc15f8d
invalid
call 0xbb8204
push 0x263ea465
pop rbp
shl byte [rax + r10], 1
stosd dword [rdi], eax
xchg dword [rdi - 0x55f51a30], ebx
wait
or al, 0xdd
jrcxz 0xc15f20
pop rbx
pop rax
sub ebx, ebp
invalid
imul edx, ebx, 0xffffffff
add al, 0xbb
jbe 0xc15f53
out 0xb6, al
test eax, 0x6ddf5f8
mov cl, 0xdc
inc byte [rsi]
outsb dx, byte [rsi]
xchg r11d, eax
xor al, 0xff
jge 0xc15f9f
clc
pop r9
stc
cli
jno 0xc16011
test eax, 0x8faeeccd
xchg edx, eax
and ecx, dword [rbp + riz*8 - 0x7834a603]
sti
jns 0xc15f53
invalid
mov word [rdi + 0x7d41fb18], gs
fst dword [r14 + r8*2 - 0x6b25de32]
not byte [rsi + 0x425578fe]
push qword [rbx + 0x2812e439]
retf
Function at 0x140027db0
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001b754
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001b754
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140027f00
cmp rax, 0xffffffffffffffff
je 0x140027f00
xor edi, edi
test rbp, rbp
jle 0x140027eab
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001dd40
mov rbx, rax
test rax, rax
jne 0x140027e38
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140027ea1
mov edx, 0x8000
mov ecx, r14d
call fcn.1400158f8
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001c430
cmp eax, 0xffffffff
je 0x140027e81
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140027e48
mov edx, r15d
mov ecx, r14d
call fcn.1400158f8
jmp 0x140027ea1
cmp byte [rsi + 0x38], dil
je 0x140027e98
cmp dword [rsi + 0x34], 5
jne 0x140027e98
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140027ea1
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140019e18
jmp 0x140027f14
jns 0x140027f14
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001b754
cmp rax, 0xffffffffffffffff
jne 0x140027ecc
cmp byte [rsi + 0x30], dil
je 0x140027f14
mov edi, dword [rsi + 0x2c]
jmp 0x140027f14
mov ecx, r14d
call fcn.140016ef8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140027f14
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140027f14
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140027f0d
mov eax, dword [rsi + 0x2c]
jmp 0x140027f12
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001b754
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14135d53c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14135d546
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x14135d56f
pop rbp
sub rbp, 0x33
sub rbp, 0x135d53c
sub rsp, 0x20
jmp 0x14135d58e
mov rax, 0x135d53c
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffff9e1c1d0b
xor byte [rax], dl
inc rax
dec rcx
jne 0x14135d5ad
jmp 0x14135d5c4
invalid
Function at 0x1400181b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [rdx + 0x10]
lea r9, [rsp + 0x30]
xor esi, esi
mov dword [rsp + 0x34], eax
mov rbx, rdx
mov dword [rsp + 0x30], esi
mov rdi, rcx
mov qword [rsp + 0x20], rsi
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x34]
lea r8d, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x1400181fc
mov rdx, qword [rbx]
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x30]
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14001824a
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140018245
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140018269
mov rcx, r8
call fcn.1400411c0
mov qword [rbx + 0x10], rsi
mov byte [rbx], sil
mov rsi, qword [rsp + 0x68]
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.140047c14
int3

Function at 0x140018270
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [rdx + 0x10]
lea r9, [rsp + 0x30]
xor esi, esi
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x30], esi
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x34]
add eax, eax
mov qword [rsp + 0x20], rsi
lea r8d, [rsi + 4]
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 8
mov rdx, rbx
mov r8, qword [rbx + 0x10]
jb 0x1400182c2
mov rdx, qword [rbx]
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x30]
add r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140018314
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001830f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140018333
mov rcx, r8
call fcn.1400411c0
mov qword [rbx + 0x10], rsi
mov word [rbx], si
mov rsi, qword [rsp + 0x68]
mov qword [rbx + 0x18], 7
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.140047c14
int3
Function at 0x14001a240
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x140087048]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r12, r9
mov r13, r8
mov rbp, rdx
mov qword [rsp + 0x38], rdx
mov r14, rcx
mov qword [rsp + 0x40], rdx
mov rdi, qword [rsp + 0xe0]
xor ebx, ebx
cmp qword [rcx + 0x18], 8
jb 0x14001a28a
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001a2be
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rbx
mov qword [rbp + 0x18], rbx
mov r8d, 0x19
lea rdx, str.Error:_Ini_File_Not_Exist
mov rcx, rbp
call fcn.1400076b0
jmp 0x14001a42d
mov ebp, 1
mov ecx, 0x208
call fcn.140041480
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], bx
mov rbx, 0xffffffffffffffff
mov r15d, 0x104
nop dword [rax + rax]
mov rax, r14
cmp qword [r14 + 0x18], 8
jb 0x14001a30d
mov rax, qword [r14]
mov r8, rdi
cmp qword [rdi + 0x18], 8
jb 0x14001a31a
mov r8, qword [rdi]
mov rdx, r12
cmp qword [r12 + 0x18], 8
jb 0x14001a329
mov rdx, qword [r12]
mov rcx, r13
cmp qword [r13 + 0x18], 8
jb 0x14001a337
mov rcx, qword [r13]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [r15 - 1]
cmp eax, ecx
jb 0x14001a3b8
mov r8, rdi
cmp qword [rdi + 0x18], 8
jb 0x14001a35f
mov r8, qword [rdi]
mov rax, rsi
sub r8, rsi
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14001a384
add rax, 2
test ecx, ecx
jne 0x14001a370
test edx, edx
je 0x14001a3b8
mov rcx, rsi
call fcn.1400411c0
inc ebp
imul r15d, ebp, 0x104
mov ecx, r15d
mov eax, 2
mul rcx
cmovo rax, rbx
mov rcx, rax
call fcn.140041480
mov rsi, rax
jmp 0x14001a300
mov rbp, qword [rsp + 0x38]
nop dword [rax]
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x14001a3c0
mov rax, qword [rsp + 0x60]
cmp rbx, rax
ja 0x14001a403
lea rdi, [rsp + 0x48]
cmp rax, 8
cmovae rdi, qword [rsp + 0x48]
mov qword [rsp + 0x58], rbx
add rbx, rbx
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.1400436f0
xor r14d, r14d
mov word [rbx + rdi], r14w
jmp 0x14001a413
mov r9, rsi
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140007d00
mov rcx, rsi
call fcn.1400411c0
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rbp + 0x10], xmm1
mov rax, rbp
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400411a0
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001aec0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rbx, rcx
xor ebp, ebp
sub rcx, 0xffffffffffffff80
call fcn.14003daa0
test eax, eax
setne dl
mov byte [rbx + 0x108], dl
test eax, eax
je 0x14001af0a
cmp qword [rbx + 0xc8], 0x10000
jae 0x14001af0a
lea rcx, [rbx + 0x80]
call fcn.14003dea0
mov eax, dword [rbx + 0x2f4]
cmp byte [rbx + 0x108], bpl
je 0x14001b015
cmp eax, 1
je 0x14001aff2
mov dword [rbx + 0x2f4], 1
call fcn.140019570
test al, al
je 0x14001b06e
lea rcx, [rbx + 0x10]
call fcn.1400383e0
test al, al
je 0x14001b06e
lea rcx, [rbx + 0x10]
call fcn.1400385d0
mov rcx, rbx
call fcn.14001c750
add rbx, 0x5c0
cmp byte [rbx + 8], bpl
jne 0x14001b059
cmp qword [rbx + 0x18], rbp
je 0x14001b059
mov word [rbx + 8], 0x101
mov dword [rbx + 0x20], 0x32
mov ecx, 8
call fcn.1400411f4
mov qword [rax], rbx
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x14001eb50]
xor edx, edx
xor ecx, ecx
call fcn.14004d0a8
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14001b081
cmp dword [rsp + 0x38], 0
je 0x14001b076
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.14004079c
test eax, eax
jne 0x14001b076
jmp 0x14001b059
mov eax, dword [0x14008a2b8]
inc eax
mov dword [0x14008a2b8], eax
cmp eax, 5
jle 0x14001b059
mov dword [0x14008a2b8], ebp
mov rcx, rbx
call fcn.14001ac00
jmp 0x14001b059
test eax, eax
je 0x14001b059
mov dword [rbx + 0x2f4], ebp
mov rcx, rbx
call fcn.14001c750
mov byte [rbx + 0x5c8], bpl
mov edi, 0x1388
cmp byte [rbx + 0x5c9], bpl
je 0x14001b059
nop dword [rax]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
sub edi, 0x32
js 0x14001b059
cmp byte [rbx + 0x5c9], bpl
jne 0x14001b040
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
xor ecx, ecx
call fcn.14004cc1c
nop
mov ecx, 1
call fcn.140040700
nop
mov dword [rsp + 0x38], ebp
mov ecx, 6
call fcn.140040700
int3
Function at 0x14001b330
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x140087048]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor ebp, ebp
mov dword [rsp + 0x24], ebp
lea rdx, [0x14008a8a0]
lea rcx, [0x14008a4e0]
call fcn.1400183b0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rbp
xor r8d, r8d
lea rdx, [0x140073074]
lea rcx, [rsp + 0x40]
call fcn.1400076b0
mov dword [rsp + 0x24], 1
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.140043330
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14001b467
cmp eax, 0x104
je 0x14001b467
mov dword [rsp + 0x20], ebp
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test eax, eax
je 0x14001b467
mov ecx, esi
call fcn.140041480
mov rdi, rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov r8d, esi
xor edx, edx
mov rcx, rax
call fcn.140043330
mov dword [rsp + 0x28], ebp
mov r9, rdi
mov r8d, esi
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x14001b45f
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x30]
lea rdx, str.StringFileInfo000004b0ProductVersion
mov rcx, rdi
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x14001b45f
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140006d30
nop
mov rcx, rdi
call fcn.1400411c0
lea rdx, [rsp + 0x40]
lea rcx, [0x14008a800]
call fcn.140006e20
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14001b4b7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b4b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b4e0
call fcn.1400411c0
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400411a0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.140047c14
int3
Function at 0x14001c750
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
lea rcx, [0x14008a930]
call fcn.140040a38
test eax, eax
jne 0x14001c7ff
cmp dword [0x14008a97c], 0x7fffffff
je 0x14001c7ea
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x40], rdi
lea r8d, [rax + 4]
xor edi, edi
mov dword [rsp + 0x50], 2
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rbx + 0xc0]
lea r9, [rsp + 0x48]
mov rcx, qword [rbx + 8]
lea r8d, [rdi + 4]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [0x14008a930]
mov rdi, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
jmp fcn.140040a40
mov ecx, 6
mov dword [0x14008a97c], 0x7ffffffe
call fcn.140040700
int3
mov ecx, 5
call fcn.140040700
int3
Function at 0x14001dd40
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rsi, r8
mov rbx, rdx
mov qword [rsp + 0x50], rdx
xor ebp, ebp
mov dword [rsp + 0x40], ebp
mov rdi, qword [0x14008a3a0]
lea r14, [0x14008a930]
mov qword [rsp + 0x58], r14
mov rcx, r14
call fcn.140040a38
test eax, eax
jne 0x14001de98
cmp dword [0x14008a97c], 0x7fffffff
je 0x14001de83
mov dword [rsp + 0x38], 8
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x30]
lea r8d, [rbp + 4]
lea rdx, [rsp + 0x38]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.140006f90
mov rdx, rax
mov rcx, rdi
call fcn.1400181b0
nop
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x38]
lea r8d, [rbp + 4]
lea rdx, [rsp + 0x30]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rsi, dword [rsp + 0x30]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rbx], bpl
mov dword [rsp + 0x40], 2
mov rdx, rsi
cmp rsi, 0xf
jbe 0x14001de3b
mov rcx, rbx
call fcn.140010e40
mov qword [rbx + 0x10], rbp
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14001de48
mov rdx, qword [rbx]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x48]
mov r8d, esi
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop
mov rcx, r14
call fcn.140040a40
mov rax, rbx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov dword [0x14008a97c], 0x7ffffffe
mov ecx, 6
call fcn.140040700
int3
mov ecx, 5
call fcn.140040700
int3