joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400839e8
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x1400837bc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400837bc
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400837bc
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400837bc
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400837bc
cmp dword [rcx + 0x84], 0xe
jbe 0x1400837bc
cmp dword [rcx + 0xf8], esi
je 0x1400837bc
mov ecx, r14d
call fcn.140083904
mov ecx, 2
call fcn.14008b60c
nop
cmp byte [0x1400e4430], 0
jne 0x140083886
mov r15d, 1
mov eax, r15d
xchg dword [0x1400e4424], eax
test ebx, ebx
jne 0x14008382f
mov rdi, qword [0x1400e00c0]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x1400e4428]
cmp rcx, rax
je 0x140083826
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140013c00]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x1400e4890]
jmp 0x14008383b
cmp ebx, r15d
jne 0x140083841
lea rcx, [0x1400e48a8]
call fcn.14008f4f0
nop
test ebx, ebx
jne 0x140083858
lea rdx, [0x1400abcc8]
lea rcx, [0x1400abca8]
call fcn.14008f808
lea rdx, [0x1400abcd8]
lea rcx, [0x1400abcd0]
call fcn.14008f808
movzx eax, byte [0x1400e4430]
test esi, esi
cmove eax, r15d
mov byte [0x1400e4430], al
jmp 0x140083886
mov ecx, 2
call fcn.14008b660
test esi, esi
jne 0x14008389d
mov ecx, r14d
call fcn.1400838b8
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x14008374c
Function at 0x1400984e8
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1400981a4
call fcn.140085cf8
mov dword [rax], 0x16
call fcn.14007d0dc
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14009818c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x14009818c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1400981d6
lock or dword [rax + 0x14], 0x10
jmp 0x14009818c
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1400981f3
mov rcx, qword [rbp + 0x10]
call fcn.140097af4
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140092454
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.140096e68
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x14009824a
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x14009818c
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1400982b6
mov rcx, qword [rbp + 0x10]
call fcn.140092454
cmp eax, 0xffffffff
je 0x14009829d
mov rcx, qword [rbp + 0x10]
call fcn.140092454
cmp eax, 0xfffffffe
je 0x14009829d
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140092454
movsxd rdi, eax
lea rsi, [0x1400e4900]
mov rcx, rbx
sar rdi, 6
call fcn.140092454
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1400982a4
lea rax, [0x1400e0480]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400982b6
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1400982ec
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1400982e8
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1400982e8
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x14009818f
jmp 0x14009815c
Function at 0x1400984f0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x140098356
call fcn.140085cf8
mov dword [rax], 0x16
call fcn.14007d0dc
mov eax, 0xffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140098338
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x140098338
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x20]
shr ecx, 1
test cl, 1
je 0x140098388
lock or dword [rax + 0x14], 0x10
jmp 0x140098338
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1400983a5
mov rcx, qword [rbp + 0x20]
call fcn.140097af4
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x10], 1
jne 0x1400983ba
mov rcx, qword [rax]
mov sil, 1
mov r14b, byte [rcx]
jmp 0x1400983c0
xor sil, sil
xor r14b, r14b
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.140092454
mov rdx, qword [rbp + 0x20]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.140096e68
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x20]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 2
ja 0x140098413
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x20]
and dword [rax + 0x10], 0
jmp 0x140098338
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x14009847f
mov rcx, qword [rbp + 0x20]
call fcn.140092454
cmp eax, 0xffffffff
je 0x140098466
mov rcx, qword [rbp + 0x20]
call fcn.140092454
cmp eax, 0xfffffffe
je 0x140098466
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.140092454
movsxd rdi, eax
lea r15, [0x1400e4900]
mov rcx, rbx
sar rdi, 6
call fcn.140092454
and eax, 0x3f
shl rax, 6
add rax, qword [r15 + rdi*8]
jmp 0x14009846d
lea rax, [0x1400e0480]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14009847f
mov rax, qword [rbp + 0x20]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x20], 0x200
jne 0x1400984b5
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1400984b1
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1400984b1
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
test sil, sil
je 0x1400984d3
movzx edx, byte [rcx]
dec dword [rax + 0x10]
shl dx, 8
movzx ecx, r14b
or dx, cx
inc qword [rax]
jmp 0x1400984de
movzx edx, word [rcx]
add dword [rax + 0x10], 0xfffffffe
add qword [rax], 2
movzx eax, dx
jmp 0x14009833d
jmp 0x140098304
Function at 0x140002c00
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002c4a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002c4a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002c4a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002c4a
cmp dword [rcx + 0x84], 0xe
jbe 0x140002c4a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002c4c
xor al, al
add rsp, 0x28
ret
Function at 0x140003560
Capabilities:
Check for time delay via gettickcount
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x140112090]
xor rax, rsp
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x3e8
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x3e8
jl 0x1400035ac
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0x58], 2
jge 0x1400035c4
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14003cde0
add rsp, 0x80
pop rbx
ret
mov ecx, 0xbebc200
call fcn.1400a4e04
mov rbx, rax
test rax, rax
je 0x1400035ee
xor edx, edx
mov r8d, 0xbebc200
mov rcx, rax
call fcn.14006fc70
mov rcx, rbx
call fcn.140092b14
lea rcx, str.ZZZZZZ
call fcn.14007ac40
call fcn.1400029f0
mov rcx, rax
call fcn.140002a24
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], 2
lea rcx, [rsp + 0x28]
call fcn.140004ce8
lea rcx, [rsp + 0x68]
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x68], xmm0
call fcn.140011584
jmp 0x1400035fa
Function at 0x140043a78
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140043a8b
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.140044c30
lea rdx, [0x140110458]
lea rcx, [rsp + 0x20]
call fcn.140071bf8
int3

Function at 0x14005296c
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x140116bdc]
xor edx, edx
jmp fcn.140043a78

Function at 0x14005447c
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x140116bdc]
jmp fcn.140043a78

Function at 0x140073604
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, [0x1400e40a8]
xor ecx, ecx
lea r8, [0x1400e40a0]
lea rdx, str.FlsAlloc
call fcn.140073180
mov rbx, rax
test rax, rax
je 0x140073644
mov rcx, rax
call fcn.14003da14
mov rcx, rdi
call rbx
jmp 0x14007364a
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400736ac
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x1400e40b8]
mov ecx, 2
lea r8, [0x1400e40b0]
lea rdx, str.FlsGetValue
call fcn.140073180
mov rdi, rax
test rax, rax
je 0x1400736ed
mov rcx, rax
call fcn.14003da14
mov ecx, ebx
call rdi
jmp 0x1400736f5
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140073700
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x1400e40c0]
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 3
lea r8, [0x1400e40b8]
call fcn.140073180
mov rsi, rax
test rax, rax
je 0x14007374c
mov rcx, rax
call fcn.14003da14
mov rdx, rbx
mov ecx, edi
call rsi
jmp 0x140073757
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b128c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1400b1073
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400b1073
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400b1073
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400b1073
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400b1073
cmp dword [rcx + 0x84], 0xe
jbe 0x1400b1073
cmp dword [rcx + 0xf8], 0
je 0x1400b1073
mov ecx, ebx
call fcn.1400b11a4
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1400b0dec
cmp dword [rbp + 0x20], 0
je 0x1400b10c0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400b10c8
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400b100c
Function at 0x1400c4844
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, r8d
mov rbp, rdx
mov rbx, rcx
call fcn.1400bf48c
cmp eax, 2
sete dil
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400c4891
test rbx, rbx
je 0x1400c4885
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test dil, dil
je 0x1400c48c8
mov eax, 4
jmp 0x1400c48d7
test dil, dil
je 0x1400c48c8
call fcn.1400bcbe8
test al, al
je 0x1400c48c8
call fcn.1400bcec8
test al, al
jne 0x1400c48be
bts esi, 0x15
xor ecx, ecx
mov rdx, rbx
mov r8, rbp
mov r9d, esi
call fcn.1400bca6c
jmp 0x1400c48d7
call fcn.1400bce14
mov rcx, rax
jmp 0x1400c48ae
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
neg eax
sbb eax, eax
neg eax
add eax, 3
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400cb920
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1400cb6ee
call fcn.1400a69a4
mov dword [rax], 0x16
call fcn.1400a4d10
mov eax, 0xffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1400cb6d0
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1400cb6d0
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x20]
shr ecx, 1
test cl, 1
je 0x1400cb720
lock or dword [rax + 0x14], 0x10
jmp 0x1400cb6d0
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1400cb73d
mov rcx, qword [rbp + 0x20]
call fcn.1400cb928
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x10], 1
jne 0x1400cb752
mov rcx, qword [rax]
mov sil, 1
mov r14b, byte [rcx]
jmp 0x1400cb758
xor sil, sil
xor r14b, r14b
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.1400ba4ac
mov rdx, qword [rbp + 0x20]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1400cf3f8
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x20]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 2
ja 0x1400cb7ab
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x20]
and dword [rax + 0x10], 0
jmp 0x1400cb6d0
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1400cb81a
mov rcx, qword [rbp + 0x20]
call fcn.1400ba4ac
cmp eax, 0xffffffff
je 0x1400cb801
mov rcx, qword [rbp + 0x20]
call fcn.1400ba4ac
cmp eax, 0xfffffffe
je 0x1400cb801
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.1400ba4ac
movsxd rdi, eax
lea r15, [0x140117b60]
mov rcx, rbx
sar rdi, 6
call fcn.1400ba4ac
mov rdx, qword [r15 + rdi*8]
and eax, 0x3f
shl rax, 6
add rdx, rax
jmp 0x1400cb808
lea rdx, [0x140112580]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400cb81a
mov rax, qword [rbp + 0x20]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x20], 0x200
jne 0x1400cb850
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1400cb84c
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1400cb84c
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
test sil, sil
je 0x1400cb86e
movzx edx, byte [rcx]
dec dword [rax + 0x10]
shl dx, 8
movzx ecx, r14b
or dx, cx
inc qword [rax]
jmp 0x1400cb879
movzx edx, word [rcx]
add dword [rax + 0x10], 0xfffffffe
add qword [rax], 2
movzx eax, dx
jmp 0x1400cb6d5
jmp 0x1400cb69c
Function at 0x1400cedd0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
movsxd r13, ecx
lea r10, [0x140117b60]
mov rdi, r13
mov r15, r13
sar r15, 6
and edi, 0x3f
shl rdi, 6
mov r14, rdx
mov r9d, 0xa
mov rax, qword [r10 + r15*8]
mov rcx, qword [rax + rdi + 0x28]
mov qword [rsp + 0x98], rcx
test r8, r8
je 0x1400cee28
cmp word [rdx], r9w
jne 0x1400cee28
or byte [rax + rdi + 0x38], 4
jmp 0x1400cee2d
and byte [rax + rdi + 0x38], 0xfb
lea r12, [rdx + r8*2]
mov rsi, rdx
mov rbx, rdx
cmp rdx, r12
jae 0x1400cefe3
lea rbp, [rdx + 2]
mov edx, 0xd
movzx eax, word [rsi]
cmp ax, 0x1a
je 0x1400cefc5
cmp ax, dx
je 0x1400cee6f
mov word [rbx], ax
add rbx, 2
add rsi, 2
add rbp, 2
jmp 0x1400cef10
cmp rbp, r12
jae 0x1400cee95
cmp word [rbp], r9w
jne 0x1400cee90
add rsi, 4
mov word [rbx], r9w
add rbp, 4
add rbx, 2
jmp 0x1400cef10
mov word [rbx], dx
jmp 0x1400cee5e
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x90]
mov r8d, 2
lea rdx, [rsp + 0x80]
add rsi, 2
add rbp, 2
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400cefa9
cmp dword [rsp + 0x90], 0
je 0x1400cefa9
lea r10, [0x140117b60]
mov r9d, 0xa
mov rax, qword [r10 + r15*8]
test byte [rax + rdi + 0x38], 0x48
je 0x1400cef5a
movzx eax, word [rsp + 0x80]
cmp ax, r9w
jne 0x1400cef1e
mov word [rbx], r9w
add rbx, 2
mov edx, 0xd
mov rcx, qword [rsp + 0x98]
cmp rsi, r12
jb 0x1400cee49
jmp 0x1400cefe3
mov ecx, 0xd
mov word [rsp + 0x88], ax
mov word [rbx], cx
add rbx, 2
xor edx, edx
mov rcx, qword [r10 + r15*8]
mov al, byte [rsp + rdx + 0x88]
add rcx, rdi
mov byte [rcx + rdx + 0x3a], al
inc rdx
cmp rdx, 2
jl 0x1400cef34
mov rax, qword [r10 + r15*8]
mov byte [rax + rdi + 0x3c], r9b
jmp 0x1400cef03
cmp word [rsp + 0x80], r9w
jne 0x1400cef6a
cmp rbx, r14
je 0x1400ceefb
mov rdx, 0xfffffffffffffffe
mov ecx, r13d
lea r8d, [rdx + 3]
call fcn.1400cc338
mov r9d, 0xa
lea r10, [0x140117b60]
cmp word [rsp + 0x80], r9w
je 0x1400cef03
lea edx, [r9 + 3]
mov word [rbx], dx
add rbx, 2
jmp 0x1400cef08
mov edx, 0xd
lea r10, [0x140117b60]
mov word [rbx], dx
add rbx, 2
lea r9d, [rdx - 3]
jmp 0x1400cef08
mov rcx, qword [r10 + r15*8]
mov al, byte [rcx + rdi + 0x38]
test al, 0x40
jne 0x1400cefd9
or al, 2
mov byte [rcx + rdi + 0x38], al
jmp 0x1400cefe3
movzx ecx, word [rsi]
mov word [rbx], cx
add rbx, 2
sub rbx, r14
sar rbx, 1
lea rax, [rbx + rbx]
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1634058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x16341df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1634089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x163406f
add dl, dl
jne 0x1634096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x16340f6
xor eax, eax
add dl, dl
jne 0x16340a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x16341ad
add dl, dl
jne 0x16340b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x16340c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x16340d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x16340dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x16340ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x163407e
mov eax, 1
add dl, dl
jne 0x1634106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1634113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x16340fb
sub eax, ebx
mov ebx, 1
jne 0x163414c
mov ecx, 1
add dl, dl
jne 0x163412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x163413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1634123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x163407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1634168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1634175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x163415d
cmp eax, 0x7d00
jae 0x163419b
cmp eax, 0x500
jb 0x1634196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x163407e
cmp eax, 0x7f
ja 0x163419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x163407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x16341d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x163407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140008270
Capabilities:
Get file size

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rbx, rcx
mov rax, qword [0x14012f028]
xor rax, rsp
mov qword [rsp + 0x80], rax
movaps xmm0, xmmword [0x140114ca0]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.GetLength
lea r8, str....._base_files_file_win.cc
lea r14, [rsp + 0x20]
mov rcx, r14
mov r9d, 0xac
call fcn.140072460
xor edi, edi
mov rcx, rsi
mov rdx, r14
xor r8d, r8d
call fcn.140076ee0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [r14], rax
mov rcx, qword [rbx]
lea rbx, [rsp + 0x20]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 1
sbb rdi, rdi
or rdi, qword [rbx]
mov rcx, rsi
call fcn.140058c10
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140095f80
mov rax, rdi
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1400091b0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x14012f028]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov eax, dword [0x140147378]
mov ecx, dword [0x14013e9b0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140009210
lea rsi, [0x140147370]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140095f80
mov rax, rsi
add rsp, 0x158
pop rdi
pop rsi
ret
lea rcx, [0x140147378]
call fcn.140093f10
cmp dword [0x140147378], 0xffffffff
jne 0x1400091ec
lea rsi, [rsp + 0x38]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.1400980c0
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x34]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x30]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.140093d8c
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x1401473c0]
mov ecx, dword [0x14013e9b0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400092d0
lea r8, [0x140147390]
lea rdx, [rsp + 0x34]
mov rcx, rsi
mov r9d, edi
call fcn.140019a00
mov qword [0x140147370], rsi
lea rcx, [0x140147378]
call fcn.140093f78
jmp 0x1400091ec
lea rcx, [0x1401473c0]
call fcn.140093f10
cmp dword [0x1401473c0], 0xffffffff
jne 0x1400092a1
xorps xmm0, xmm0
movups xmmword [0x1401473b0], xmm0
movups xmmword [0x1401473a0], xmm0
movups xmmword [0x140147390], xmm0
lea rcx, [0x140147390]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x1401473c0]
call fcn.140093f78
jmp 0x1400092a1