joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001e08
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140002fec
nop
cmp dword [0x14000c130], 1
je 0x140001db4
mov dword [0x14000c12c], 1
mov byte [0x14000c128], r12b
test ebx, ebx
jne 0x140001da0
mov rcx, qword [0x14000d480]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140001d8d
mov rcx, qword [0x14000d478]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x140001d2c
call fcn.1400024b8
cmp qword [rdi], rax
jne 0x140001d2c
jmp 0x140001d12
cmp rdi, rsi
jb 0x140001d8d
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.1400024b8
mov qword [rdi], rax
call rbx
mov rcx, qword [0x14000d480]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x14000d478]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x140001d6b
cmp r13, rax
je 0x140001d8b
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x140001d12
lea rdx, [0x1400082d8]
lea rcx, [0x1400082d0]
call fcn.140001b5c
lea rdx, [0x1400082e8]
lea rcx, [0x1400082e0]
call fcn.140001b5c
nop
test r12d, r12d
je 0x140001dc3
mov ecx, 8
call fcn.140002eec
test r12d, r12d
jne 0x140001dee
mov dword [0x14000c130], 1
lea ecx, [r12 + 8]
call fcn.140002eec
mov ecx, r15d
call fcn.140001af0
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x140001c7c

Function at 0x140001e14
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x140001c7c
Function at 0x14000213b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14000b068]
jne 0x14000184a
rol rcx, 0x10
test cx, 0xffff
jne 0x140001846
repz ret
ror rcx, 0x10
jmp 0x140002094
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14000c1f0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x14000c2e8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140002119
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14000c1f0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14000213b
mov rax, qword [rsp + 0x88]
mov qword [0x14000c2e8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14000c288], rax
mov rax, qword [0x14000c2e8]
mov qword [0x14000c160], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14000c270], rax
mov dword [0x14000c150], 0xc0000409
mov dword [0x14000c154], 1
mov rax, qword [0x14000b068]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14000b070]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14000c1e8], eax
mov ecx, 1
call fcn.1400041c4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140008360]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14000c1e8], 0
jne 0x1400021c2
mov ecx, 1
call fcn.1400041c4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140005644
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.1400024b8
xor ebx, ebx
mov rdi, rax
cmp qword [0x14000cef0], rbx
jne 0x14000574a
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14000581f
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000581f
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14000cef0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14000cef8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x14000cf00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x14000cf10], rax
test rax, rax
je 0x140005741
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x14000cf08], rax
jmp 0x140005751
mov rax, qword [0x14000cf08]
jmp 0x140005758
mov rax, qword [0x14000cf08]
mov r11, qword [0x14000cf10]
cmp rax, rdi
je 0x1400057c0
cmp r11, rdi
je 0x1400057c0
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x14000cf10]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x1400057c0
test rax, rax
je 0x1400057c0
call rsi
test rax, rax
je 0x1400057ba
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400057ba
test byte [rsp + 0x38], 1
jne 0x1400057c0
bts ebp, 0x15
jmp 0x1400057fe
mov rcx, qword [0x14000cef8]
cmp rcx, rdi
je 0x1400057fe
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400057fe
call rax
mov rbx, rax
test rax, rax
je 0x1400057fe
mov rcx, qword [0x14000cf00]
cmp rcx, rdi
je 0x1400057fe
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400057fe
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14000cef0]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14000581f
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140005821
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14000d500
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14000d50d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14000d51d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14000d505
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14000d535
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14000d522
sub eax, 3
jb 0x14000d54f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14000d586
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14000d576
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14000d574
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14000d563
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14000d4c2
jmp 0x14000d50d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x4000
mov dl, 2
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14000d5d2
cmp rsi, rcx
jae 0x14000d5da
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14000d5b9
cmp al, 0x8f
ja 0x14000d5b9
cmp byte [rsi - 2], 0xf
je 0x14000d5bf
sub al, 0xe8
cmp al, 1
ja 0x14000d5a3
cmp rsi, rcx
jae 0x14000d5da
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14000d5a9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14000d5da
lodsb al, byte [rsi]
jmp 0x14000d5b9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xb000]
mov eax, dword [rdi]
or eax, eax
je 0x14000d637
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xd1dc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14000d5e7
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14000d631
mov qword [rbx], rax
add rbx, 8
jmp 0x14000d607
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14000d671
cmp al, 0xef
ja 0x14000d663
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14000d643
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14000d652
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x227]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.14000d6f0], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.14000d6f0
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14000d6e0
sub rsp, 0xffffffffffffff80
jmp 0x140003f04
Function at 0x140014da0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [rdx + 0x10]
lea r9, [rsp + 0x30]
xor esi, esi
mov dword [rsp + 0x34], eax
mov rbx, rdx
mov dword [rsp + 0x30], esi
mov rdi, rcx
mov qword [rsp + 0x20], rsi
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x34]
lea r8d, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x140014dec
mov rdx, qword [rbx]
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x30]
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140014e3a
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140014e35
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140014e59
mov rcx, r8
call fcn.14003ad80
mov qword [rbx + 0x10], rsi
mov byte [rbx], sil
mov rsi, qword [rsp + 0x68]
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.1400419ac
int3

Function at 0x140014e60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [rdx + 0x10]
lea r9, [rsp + 0x30]
xor esi, esi
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x30], esi
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x34]
add eax, eax
mov qword [rsp + 0x20], rsi
lea r8d, [rsi + 4]
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 8
mov rdx, rbx
mov r8, qword [rbx + 0x10]
jb 0x140014eb2
mov rdx, qword [rbx]
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x30]
add r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140014f04
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140014eff
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140014f23
mov rcx, r8
call fcn.14003ad80
mov qword [rbx + 0x10], rsi
mov word [rbx], si
mov rsi, qword [rsp + 0x68]
mov qword [rbx + 0x18], 7
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.1400419ac
int3
Function at 0x140016e20
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x140081048]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r12, r9
mov r13, r8
mov rbp, rdx
mov qword [rsp + 0x38], rdx
mov r14, rcx
mov qword [rsp + 0x40], rdx
mov rdi, qword [rsp + 0xe0]
xor ebx, ebx
cmp qword [rcx + 0x18], 8
jb 0x140016e6a
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140016e9e
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rbx
mov qword [rbp + 0x18], rbx
mov r8d, 0x19
lea rdx, str.Error:_Ini_File_Not_Exist
mov rcx, rbp
call fcn.140007610
jmp 0x14001700d
mov ebp, 1
mov ecx, 0x208
call fcn.14003b040
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], bx
mov rbx, 0xffffffffffffffff
mov r15d, 0x104
nop dword [rax + rax]
mov rax, r14
cmp qword [r14 + 0x18], 8
jb 0x140016eed
mov rax, qword [r14]
mov r8, rdi
cmp qword [rdi + 0x18], 8
jb 0x140016efa
mov r8, qword [rdi]
mov rdx, r12
cmp qword [r12 + 0x18], 8
jb 0x140016f09
mov rdx, qword [r12]
mov rcx, r13
cmp qword [r13 + 0x18], 8
jb 0x140016f17
mov rcx, qword [r13]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [r15 - 1]
cmp eax, ecx
jb 0x140016f98
mov r8, rdi
cmp qword [rdi + 0x18], 8
jb 0x140016f3f
mov r8, qword [rdi]
mov rax, rsi
sub r8, rsi
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140016f64
add rax, 2
test ecx, ecx
jne 0x140016f50
test edx, edx
je 0x140016f98
mov rcx, rsi
call fcn.14003ad80
inc ebp
imul r15d, ebp, 0x104
mov ecx, r15d
mov eax, 2
mul rcx
cmovo rax, rbx
mov rcx, rax
call fcn.14003b040
mov rsi, rax
jmp 0x140016ee0
mov rbp, qword [rsp + 0x38]
nop dword [rax]
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x140016fa0
mov rax, qword [rsp + 0x60]
cmp rbx, rax
ja 0x140016fe3
lea rdi, [rsp + 0x48]
cmp rax, 8
cmovae rdi, qword [rsp + 0x48]
mov qword [rsp + 0x58], rbx
add rbx, rbx
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.14003d2b0
xor r14d, r14d
mov word [rbx + rdi], r14w
jmp 0x140016ff3
mov r9, rsi
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140007c60
mov rcx, rsi
call fcn.14003ad80
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rbp + 0x10], xmm1
mov rax, rbp
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14003ad60
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400180b0
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x140081048]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor ebp, ebp
mov dword [rsp + 0x24], ebp
lea rdx, [0x140084880]
lea rcx, [0x1400844c0]
call fcn.140014fa0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rbp
xor r8d, r8d
lea rdx, [0x14006ee48]
lea rcx, [rsp + 0x40]
call fcn.140007610
mov dword [rsp + 0x24], 1
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.14003cef0
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1400181e7
cmp eax, 0x104
je 0x1400181e7
mov dword [rsp + 0x20], ebp
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test eax, eax
je 0x1400181e7
mov ecx, esi
call fcn.14003b040
mov rdi, rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov r8d, esi
xor edx, edx
mov rcx, rax
call fcn.14003cef0
mov dword [rsp + 0x28], ebp
mov r9, rdi
mov r8d, esi
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x1400181df
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x30]
lea rdx, str.StringFileInfo000004b0ProductVersion
mov rcx, rdi
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x1400181df
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140006c80
nop
mov rcx, rdi
call fcn.14003ad80
lea rdx, [rsp + 0x40]
lea rcx, [0x1400847e0]
call fcn.140006d70
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140018237
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018232
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018260
call fcn.14003ad80
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14003ad60
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.1400419ac
int3
Function at 0x1400194d0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
lea rcx, [0x1400848f0]
call fcn.14003a5f8
test eax, eax
jne 0x14001957f
cmp dword [0x14008493c], 0x7fffffff
je 0x14001956a
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x40], rdi
lea r8d, [rax + 4]
xor edi, edi
mov dword [rsp + 0x50], 2
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rbx + 0xb0]
lea r9, [rsp + 0x48]
mov rcx, qword [rbx + 8]
lea r8d, [rdi + 4]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [0x1400848f0]
mov rdi, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
jmp fcn.14003a600
mov ecx, 6
mov dword [0x14008493c], 0x7ffffffe
call fcn.14003a2c0
int3
mov ecx, 5
call fcn.14003a2c0
int3
Function at 0x14001aac0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rsi, r8
mov rbx, rdx
mov qword [rsp + 0x50], rdx
xor ebp, ebp
mov dword [rsp + 0x40], ebp
mov rdi, qword [0x1400843a0]
lea r14, [0x1400848f0]
mov qword [rsp + 0x58], r14
mov rcx, r14
call fcn.14003a5f8
test eax, eax
jne 0x14001ac18
cmp dword [0x14008493c], 0x7fffffff
je 0x14001ac03
mov dword [rsp + 0x38], 8
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x30]
lea r8d, [rbp + 4]
lea rdx, [rsp + 0x38]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.140006ee0
mov rdx, rax
mov rcx, rdi
call fcn.140014da0
nop
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x38]
lea r8d, [rbp + 4]
lea rdx, [rsp + 0x30]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rsi, dword [rsp + 0x30]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rbx], bpl
mov dword [rsp + 0x40], 2
mov rdx, rsi
cmp rsi, 0xf
jbe 0x14001abbb
mov rcx, rbx
call fcn.140011a80
mov qword [rbx + 0x10], rbp
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14001abc8
mov rdx, qword [rbx]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x48]
mov r8d, esi
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop
mov rcx, r14
call fcn.14003a600
mov rax, rbx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov dword [0x14008493c], 0x7ffffffe
mov ecx, 6
call fcn.14003a2c0
int3
mov ecx, 5
call fcn.14003a2c0
int3
Function at 0x14001b990
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140081048]
xor rax, rsp
mov qword [rbp - 8], rax
mov ebx, ecx
mov rsi, r8
xor ecx, ecx
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx edx, bx
mov r8, rdi
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x14001babc
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdx, rdi
mov rcx, r14
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test rbx, rbx
je 0x14001babc
test eax, eax
je 0x14001babc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14001babc
mov rcx, qword [rsi]
mov dword [rbp - 0x28], 0x225f92ec
mov dword [rbp - 0x24], 0x632676d9
mov dword [rbp - 0x20], 0xd4da0d26
mov dword [rbp - 0x1c], 0xb0b5c1f4
mov dword [rbp - 0x18], 0xee420bc6
mov dword [rbp - 0x14], 0x8955ac54
mov dword [rbp - 0x10], 0x727ac57f
mov dword [rbp - 0xc], 0x8235601
cmp rcx, qword [rsi + 8]
je 0x14001ba62
mov qword [rsi + 8], rcx
mov rax, qword [rsi + 0x10]
sub rax, rcx
cmp rdi, rax
jbe 0x14001ba79
mov rdx, rdi
mov rcx, rsi
call fcn.14001bae0
xor ebx, ebx
test rdi, rdi
je 0x14001bab8
mov rdx, qword [rsi + 8]
mov rax, rbx
and eax, 0x1f
movzx ecx, byte [rbp + rax - 0x28]
xor cl, byte [rbx + r14]
mov byte [rbp - 0x30], cl
cmp rdx, qword [rsi + 0x10]
je 0x14001baa4
mov byte [rdx], cl
inc qword [rsi + 8]
jmp 0x14001bab0
lea r8, [rbp - 0x30]
mov rcx, rsi
call fcn.14001bbd0
inc rbx
cmp rbx, rdi
jb 0x14001ba80
mov al, 1
jmp 0x14001babe
xor al, al
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14003ad60
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14001c2c0
Capabilities:
Load windows common language runtime

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
cmp qword [0x1400843a8], 0
jne 0x14001c3b2
xor ebx, ebx
lea r8, [rsp + 0x48]
lea rdx, [0x140072b88]
mov qword [rsp + 0x48], rbx
lea rcx, [0x140072b78]
call qword [sym.imp.mscoree.dll_CLRCreateInstance]
lea rdi, [0x1400843a8]
test eax, eax
js 0x14001c375
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x40], rbx
lea r8, [0x140072b68]
lea rdx, str.v4.0.30319
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov ebx, eax
test eax, eax
js 0x14001c366
mov rcx, qword [rsp + 0x40]
lea r8, [0x14006ee28]
mov r9, rdi
lea rdx, [0x14006ee38]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov ebx, eax
test eax, eax
js 0x14001c35b
mov rcx, qword [0x1400843a8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
test ebx, ebx
jns 0x14001c3b2
cmp qword [0x1400843a8], 0
jne 0x14001c3b2
lea r9, [0x14006ee28]
mov qword [rsp + 0x20], rdi
lea r8, [0x14006ee38]
xor edx, edx
lea rcx, str.v2.0.50727
call qword [sym.imp.mscoree.dll_CorBindToRuntime]
test eax, eax
js 0x14001c3bf
mov rcx, qword [0x1400843a8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov al, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
xor r9d, r9d
lea r8, [0x1400724b0]
lea rdx, [0x1400724d0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rbx, qword [rsp + 0x50]
xor al, al
add rsp, 0x30
pop rdi
ret
Function at 0x14001e950
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x140081048]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1c]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14001e9c0
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140007610
mov dword [rsp + 0x30], 1
mov r8d, SafeArrayDestroy
lea rdx, [0x140073d70]
mov rcx, rbx
call fcn.140007240
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14003ad60
add rsp, 0x260
pop rbx
ret
Function at 0x140022040
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
movabs rax, 0xcbf29ce484222325
sar r8, 1
mov r9d, 0
add r8, r8
je 0x140022084
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140022070
ret