joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140030474
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rsi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x1400304a4
cvtsi2ss xmm0, rdx
jmp 0x1400304b9
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call fcn.1400a93d8
movss xmm1, dword [0x1400f6a7c]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x1400304e7
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1400304e7
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x140030515
cmp rbx, 0x200
jae 0x140030512
shl rbx, 3
cmp rbx, rcx
jae 0x140030515
mov rbx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rbx, rax
ja 0x140030683
lea rax, [rbx - 1]
mov edi, 1
mov rbx, qword [rsi + 8]
or rax, 1
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.14002fda0
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x140030647
mov rcx, qword [rcx]
movabs r8, 0xcbf29ce484222325
xor r9d, r9d
movzx edx, byte [rax + r9 + 0x10]
movabs r10, 0x100000001b3
xor r8, rdx
inc r9
imul r8, r10
cmp r9, 8
jb 0x14003058d
mov r11, qword [rsi + 0x30]
mov rdi, qword [rsi + 0x18]
and r11, r8
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x1400305cc
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x14003063b
mov r10, qword [rdi + r11*8 + 8]
mov rdx, qword [rax + 0x10]
cmp rdx, qword [r10 + 0x10]
jne 0x140030610
mov r10, qword [r10]
cmp r10, rax
je 0x1400305c5
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1400305c5
mov r10, qword [r10 + 8]
cmp rdx, qword [r10 + 0x10]
je 0x14003065d
cmp qword [rdi + r11*8], r10
jne 0x140030606
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [rdi + r11*8], rax
mov rax, rcx
cmp rcx, rbx
jne 0x14003057d
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov r10, qword [r10]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14003063b
lea rcx, str.invalid_hash_bucket_count
call fcn.14007e6d0
int3

Function at 0x140034d5c
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
test r8, r8
je 0x140034d88
movsx rax, byte [rdx]
movabs r9, 0x100000001b3
imul rcx, r9
dec r8
xor rcx, rax
inc rdx
call fcn.140034d5c
mov rcx, rax
mov rax, rcx
add rsp, 0x28
ret
Function at 0x14003c5fc
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x14003c62a
xor eax, eax
jmp 0x14003c710
cmp qword [rcx + 0x68], 0
je 0x14003c63b
call fcn.140016f00
jmp 0x14003c710
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14003c652
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14003c654
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14003c686
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1400a95b0
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x14003c70a
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x14003c6bd
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x14003c6e6
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.140093dd0
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x14003c70a
cmp rsi, rbx
ja 0x14003c6c4
test rsi, rsi
je 0x14003c70a
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.140093dd0
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14003fcfc
Capabilities:
Load windows common language runtime

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
cmp qword [0x14011a380], rbx
jne 0x14003fda8
and qword [rsp + 0x38], rbx
lea r8, [rsp + 0x38]
lea rdx, [0x1400f2208]
lea rcx, [0x1400f21f8]
call qword [sym.imp.mscoree.dll_CLRCreateInstance]
mov ebx, eax
test eax, eax
js 0x14003fda8
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
and qword [rsp + 0x30], 0
lea r8, [0x1400f21e8]
lea rdx, str.v4.0.30319
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov ebx, eax
test eax, eax
js 0x14003fd9d
mov rcx, qword [rsp + 0x30]
lea r9, [0x14011a380]
lea r8, [0x1400f21d8]
lea rdx, [0x1400f21c8]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov ebx, eax
test eax, eax
js 0x14003fd92
mov rcx, qword [0x14011a380]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x14003fdb0
Capabilities:
Load windows common language runtime

Disassembly:
sub rsp, 0x38
cmp qword [0x14011a380], 0
jne 0x14003fe0b
call fcn.14003fcfc
test eax, eax
jns 0x14003fe0b
cmp qword [0x14011a380], 0
jne 0x14003fe0b
lea rax, [0x14011a380]
xor edx, edx
lea r9, [0x1400f21d8]
mov qword [rsp + 0x20], rax
lea r8, [0x1400f21c8]
lea rcx, str.v2.0.50727
call qword [sym.imp.mscoree.dll_CorBindToRuntime]
test eax, eax
js 0x14003fe12
mov rcx, qword [0x14011a380]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov al, 1
add rsp, 0x38
ret
xor r9d, r9d
lea r8, [0x1400f1b18]
lea rdx, [0x1400f1b30]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor al, al
jmp 0x14003fe0d
Function at 0x140040b4c
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x1401060c0]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov esi, r8d
mov rbx, rdx
mov r14, rcx
mov qword [rsp + 0x48], rdx
xor r15d, r15d
mov edi, 0x2710
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140040b97
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x80
lea rcx, [rbp - 0x70]
call fcn.1400a9c50
mov r8d, esi
lea rdx, [0x1400ee728]
lea rcx, [rbp - 0x70]
call fcn.14003d180
mov rcx, qword [rbx + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 9
jb 0x140040d64
mov rax, rbx
mov esi, 7
cmp qword [rbx + 0x18], rsi
jbe 0x140040be7
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str..pipe_
lea rcx, [rsp + 0x70]
call fcn.14003d6e0
nop
lea rax, [rbp - 0x70]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r15w
jne 0x140040c14
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x70]
call fcn.14003d7f8
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], rsi
mov word [rax], r15w
lea rcx, [rsp + 0x70]
call fcn.140018728
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
sub edi, 0xa
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], rsi
cmova rcx, qword [rsp + 0x50]
mov edx, 0xa
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
jne 0x140040ca1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140040ca1
test edi, edi
jg 0x140040c65
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], rsi
cmova rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [r14 + 8], rax
cmp rax, 0xffffffffffffffff
setne dil
mov rdx, qword [rsp + 0x68]
cmp rdx, rsi
jbe 0x140040d20
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040d1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140040d5e
call fcn.1400807d0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], rsi
mov word [rsp + 0x50], r15w
mov rcx, rbx
call fcn.140018728
mov al, dil
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1400807b0
mov rbx, qword [rsp + 0x168]
add rsp, 0x120
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1400878c0
nop
call fcn.140001844
int3
Function at 0x140040d6c
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rdi
sub rsp, 0x40
mov eax, dword [rdx + 0x10]
lea r9, [r11 - 0x18]
and dword [rsp + 0x30], 0
mov rbx, rdx
and qword [r11 - 0x28], 0
lea rdx, [r11 - 0x14]
mov rdi, rcx
mov dword [rsp + 0x34], eax
mov rcx, qword [rcx + 8]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 0xf
mov rdx, rbx
jbe 0x140040db4
mov rdx, qword [rbx]
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x30]
mov rcx, qword [rdi + 8]
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140040e03
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140040dfe
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140040e1e
mov rcx, r8
call fcn.1400807d0
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rbx], 0
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.1400878c0
int3

Function at 0x140040e24
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rdi
sub rsp, 0x40
mov eax, dword [rdx + 0x10]
lea r9, [r11 - 0x18]
and dword [rsp + 0x30], 0
add eax, eax
and qword [r11 - 0x28], 0
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x34], eax
mov rcx, qword [rcx + 8]
lea rdx, [r11 - 0x14]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8d, dword [rbx + 0x10]
mov rdx, rbx
add r8d, r8d
cmp qword [rbx + 0x18], 7
jbe 0x140040e75
mov rdx, qword [rbx]
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x30]
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call fcn.140018728
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140040f10
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0xc8]
sub rsp, 0x1c0
mov rax, qword [0x1401060c0]
xor rax, rsp
mov qword [rbp + 0xb0], rax
xor esi, esi
mov edi, esi
mov dword [rsp + 0x30], esi
lea rcx, [rbp + 0x70]
call fcn.14004fe3c
nop
lea r8d, [rsi + 0xe]
lea rdx, str.debug_log.txt
mov rcx, rax
call fcn.14003d7f8
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x60], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
or edi, 2
lea rcx, [rbp + 0x70]
call fcn.140018728
lea rdx, [rbp + 0x90]
lea rcx, [0x14011ad70]
call fcn.140049458
mov rbx, rax
or edi, 1
mov dword [rsp + 0x30], edi
lea rdx, [rbp + 0x50]
cmp qword [rbp + 0x68], 7
cmova rdx, qword [rbp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.1400495f8
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x40], rax
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x3c], edx
cmp qword [rbp - 0x38], rsi
jne 0x140041021
lea rcx, [rbp - 0x18]
call fcn.14003cd50
nop
lea rax, vtable.std::ios_base.0
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x18]
call fcn.14007f4b8
nop
jmp 0x14004108a
lea rcx, [rsp + 0x40]
call fcn.14003d238
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140041050
lea r8, [rax + rax]
cmp qword [rbx + 0x18], 7
jbe 0x140041042
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.14004930c
nop
lea rcx, [rbp - 0x18]
call fcn.14003cd50
nop
lea rax, vtable.std::ios_base.0
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x18]
call fcn.14007f4b8
nop
lea rcx, [rbp + 0x50]
cmp qword [rbp + 0x68], 7
cmova rcx, qword [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov bl, 1
jne 0x14004108d
mov bl, sil
test dil, 1
je 0x14004109f
lea rcx, [rbp + 0x90]
call fcn.140018728
test bl, bl
je 0x1400410d1
lea r8, [rbp + 0x50]
cmp qword [rbp + 0x68], 7
cmova r8, qword [rbp + 0x50]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 7
jbe 0x14004110d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041108
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041135
call fcn.1400807d0
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.1400807b0
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.1400878c0
int3
Function at 0x140042e18
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x1401060c0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, r9
mov r15, r8
mov rbx, rdx
mov r14, rcx
mov qword [rsp + 0x38], rdx
xor r12d, r12d
mov rdi, qword [rcx]
mov rcx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x140042e5c
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140042e8f
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r12
mov r8d, 0x19
lea rdx, str.Error:_Ini_File_Not_Exist
mov rcx, rbx
call fcn.140003dfc
jmp 0x140042fa4
mov ecx, 0x208
mov r13d, 1
call fcn.140080e24
mov rbp, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r12w
lea r12, [r14 + 8]
mov r14d, 0x104
mov rax, rdi
cmp qword [rdi + 0x18], 7
jbe 0x140042ed5
mov rax, qword [rdi]
mov r8, rsi
cmp qword [rsi + 0x18], 7
jbe 0x140042ee2
mov r8, qword [rsi]
mov rdx, r15
cmp qword [r15 + 0x18], 7
jbe 0x140042eef
mov rdx, qword [r15]
mov rcx, r12
cmp qword [r12 + 0x18], 7
jbe 0x140042efe
mov rcx, qword [r12]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
mov r9, rbp
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [r14 - 1]
cmp eax, ecx
jb 0x140042f7e
mov rcx, rsi
cmp qword [rsi + 0x18], 7
jbe 0x140042f26
mov rcx, qword [rsi]
mov rax, rbp
sub rcx, rbp
movzx edx, word [rax]
movzx r8d, word [rax + rcx]
sub edx, r8d
jne 0x140042f42
add rax, 2
test r8d, r8d
jne 0x140042f2c
test edx, edx
je 0x140042f7e
mov rcx, rbp
call fcn.1400807d0
inc r13d
imul r14d, r13d, 0x104
mov ecx, r14d
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140080e24
mov rbp, rax
jmp 0x140042ec8
mov rdx, rbp
lea rcx, [rsp + 0x40]
call fcn.140017ca8
mov rcx, rbp
call fcn.1400807d0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rbx + 0x10], xmm1
mov rax, rbx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400807b0
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400431a4
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x8f8
mov rax, qword [0x1401060c0]
xor rax, rsp
mov qword [rsp + 0x8e0], rax
call fcn.14005c2f8
xor edx, edx
lea rcx, [rsp + 0xe0]
mov r8d, 0x800
call fcn.1400a9c50
mov r8d, 0x400
lea rdx, [rsp + 0xe0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
lea rcx, [rsp + 0x74]
xorps xmm0, xmm0
mov qword [rsp + 0x60], rax
xor edx, edx
movups xmmword [rsp + 0x50], xmm0
lea r8d, [rax + 0x64]
call fcn.1400a9c50
lea rax, [rsp + 0x50]
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0xe0]
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
and qword [rsp + 0x38], 0
xor edx, edx
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14004326e
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call fcn.140094e2c
int3
Function at 0x140044220
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rdi, rcx
xor ebp, ebp
lea rbx, [rcx + 0x80]
mov rcx, rbx
call fcn.14005e39c
mov ecx, dword [rbx + 0x60]
test ecx, ecx
je 0x14004426c
cmp dword [0x14011ad58], ecx
je 0x14004426a
mov dword [0x14011ad58], ecx
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14004428e
test ecx, ecx
setne al
mov byte [rbx + 0xa8], al
test ecx, ecx
je 0x14004428e
cmp qword [rdi + 0xe8], 0x10000
jae 0x14004428e
mov rcx, rbx
call fcn.14005e8fc
mov eax, dword [rdi + 0x330]
cmp byte [rdi + 0x128], bpl
je 0x1400443c7
cmp eax, 1
je 0x140044400
mov dword [rdi + 0x330], 1
call fcn.140042278
test al, al
je 0x140044415
cmp byte [rdi + 0x4b8], bpl
jne 0x14004441d
mov byte [rdi + 0x4b8], 1
cmp qword [0x14011af48], rbp
je 0x14004430b
lea rbx, [rdi + 0x80]
mov rcx, rbx
call fcn.14005e8bc
mov rcx, rbx
call fcn.14005e8fc
mov rcx, qword [0x14011af48]
test rcx, rcx
je 0x140044423
mov rax, qword [rcx]
call qword [rax + 0x10]
xor edx, edx
mov rcx, rdi
call fcn.140047a00
mov rcx, rdi
call fcn.140047358
lea rcx, [rdi + 0x10]
call fcn.14005b9d4
test al, al
je 0x140044415
lea rcx, [rdi + 0x10]
call fcn.14005ba9c
lea rbx, [rdi + 0x550]
cmp byte [rbx + 8], bpl
jne 0x1400443bb
cmp qword [rbx + 0x18], rbp
je 0x1400443bb
mov word [rbx + 8], 0x101
mov dword [rbx + 0x20], 0x32
mov ecx, 8
call fcn.140080804
mov qword [rax], rbx
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x14004afc4]
xor edx, edx
xor ecx, ecx
call fcn.140094824
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140044434
cmp dword [rsp + 0x38], ebp
je 0x140044429
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.14007fb40
test eax, eax
jne 0x140044429
mov dl, 1
mov rcx, rdi
call fcn.140047a00
jmp 0x140044400
test eax, eax
je 0x140044400
mov dword [rdi + 0x330], ebp
mov rcx, rdi
call fcn.140047358
mov byte [rdi + 0x558], bpl
mov ebx, 0x1388
jmp 0x1400443f7
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, 0x32
js 0x140044400
cmp byte [rdi + 0x559], bpl
jne 0x1400443e7
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
xor ecx, ecx
call fcn.140094e2c
int3
call fcn.1400431a4
int3
call fcn.14007e68c
nop
mov ecx, 1
call fcn.14007f6d0
nop
mov dword [rsp + 0x38], ebp
mov ecx, 6
call fcn.14007f6d0
int3
Function at 0x140047154
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
lea rbx, [rcx + 0x578]
mov rdi, rcx
mov r8, rbx
lea rdx, str.Cover
mov ecx, 0x75
call fcn.14004e454
mov rax, qword [rbx + 8]
cmp rax, qword [rbx]
je 0x14004721b
lea rcx, [0x14011aaa0]
call fcn.14007f780
test eax, eax
jne 0x14004723b
cmp dword [0x14011aaec], 0x7fffffff
je 0x140047226
lea edx, [rax + 3]
mov rcx, rdi
call fcn.14004e5d8
mov eax, dword [rbx + 8]
lea r9, [rsp + 0x40]
sub eax, dword [rbx]
lea rdx, [rsp + 0x48]
mov rcx, qword [rdi + 8]
mov r8d, 4
and dword [rsp + 0x40], 0
and qword [rsp + 0x20], 0
mov dword [rsp + 0x48], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, qword [rbx]
lea r9, [rsp + 0x40]
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x48]
and dword [rsp + 0x40], 0
mov r8d, 8
and qword [rsp + 0x20], 0
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [0x14011aaa0]
call fcn.14007f788
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov ecx, 6
mov dword [0x14011aaec], 0x7ffffffe
call fcn.14007f6d0
int3
mov ecx, 5
call fcn.14007f6d0
int3

Function at 0x140047358
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
lea rcx, [0x14011aaa0]
call fcn.14007f780
test eax, eax
jne 0x1400473dd
cmp dword [0x14011aaec], 0x7fffffff
je 0x1400473c8
lea edx, [rax + 2]
mov rcx, rbx
call fcn.14004e5d8
mov eax, dword [rbx + 0xe0]
lea r9, [rsp + 0x48]
mov rcx, qword [rbx + 8]
lea rdx, [rsp + 0x50]
and dword [rsp + 0x48], 0
mov r8d, 4
and qword [rsp + 0x20], 0
mov dword [rsp + 0x50], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [0x14011aaa0]
add rsp, 0x30
pop rbx
jmp fcn.14007f788
mov ecx, 6
mov dword [0x14011aaec], 0x7ffffffe
call fcn.14007f6d0
int3
mov ecx, 5
call fcn.14007f6d0
int3

Function at 0x140047898
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
movzx edi, dl
lea rcx, [0x14011aaa0]
call fcn.14007f780
test eax, eax
jne 0x140047923
cmp dword [0x14011aaec], 0x7fffffff
je 0x14004790e
lea edx, [rax + 7]
mov rcx, rbx
call fcn.14004e5d8
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x50]
and dword [rsp + 0x50], 0
lea rdx, [rsp + 0x58]
and qword [rsp + 0x20], 0
mov r8d, 4
mov dword [rsp + 0x58], edi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [0x14011aaa0]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.14007f788
mov ecx, 6
mov dword [0x14011aaec], 0x7ffffffe
call fcn.14007f6d0
int3
mov ecx, 5
call fcn.14007f6d0
int3