joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c55e8
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1400a2f10
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400c5672
cmp byte [rbp - 0x21], r15b
je 0x1400c566d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400c56a8
call fcn.1400b7eb4
test eax, eax
jne 0x1400c5694
cmp byte [rbp - 0x21], r15b
je 0x1400c568c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400c56a8
cmp byte [rbp - 0x21], r15b
je 0x1400c56a5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1400a83fc
test eax, eax
jne 0x1400c5748
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400a2f10
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1400c56e7
cmp byte [rbp - 0x21], r15b
je 0x1400c571c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1400c571c
call fcn.1400b7eb4
test eax, eax
jne 0x1400c5708
cmp byte [rbp - 0x21], r15b
je 0x1400c5701
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1400c571c
cmp byte [rbp - 0x21], r15b
je 0x1400c5719
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1400a83fc
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1400c5748
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1400c574b
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1400c5759
mov rcx, rdi
call fcn.1400956d0
cmp byte [rbp + 0x3f], r15b
je 0x1400c5768
mov rcx, qword [rbp + 0x27]
call fcn.1400956d0
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400c6ed0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x14012e028]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov sil, 1
cmp qword [0x140140d28], 0
jne 0x1400c6f90
mov rdi, qword [0x140140d20]
test rdi, rdi
je 0x1400c6fad
cmp byte [rdi + 0x17], 0
jns 0x1400c6f16
mov rdi, qword [rdi]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140140d28], rax
inc rax
cmp rax, 1
ja 0x1400c6f90
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.14009a5c0
mov word [rdi], 0
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x1400c7089
xor esi, esi
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.140098480
mov eax, esi
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
mov ecx, 0x18
call fcn.1400961cc
mov rdi, rax
lea rbx, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.14009a5c0
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movaps xmm0, xmmword [0x1401148f0]
movups xmmword [rdi], xmm0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rdi + 0x10], rax
mov rcx, rdi
mov rdx, rbx
call fcn.140013ae0
movzx eax, byte [rdi + 0x17]
mov edx, eax
and edx, 0x7f
test al, al
cmovs rdx, qword [rdi + 8]
mov rcx, qword [rdi]
mov r8, rdi
cmovs r8, rcx
test rdx, rdx
je 0x1400c7068
lea r10, [rdx + rdx]
test r10, r10
je 0x1400c7068
lea r9, [r10 - 2]
cmp word [r8 + r10 - 2], 0x5c
mov r10, r9
jne 0x1400c7026
cmp r9, 0xfffffffffffffffe
je 0x1400c7068
mov r8, r9
sar r8, 1
cmp rdx, r8
jbe 0x1400c7183
lea rdx, [r8 + 1]
test al, al
jns 0x1400c715f
mov qword [rdi + 8], rdx
mov word [rcx + r8*2 + 2], 0
lea rdx, str.debug.log
mov r8d, 9
mov rcx, rdi
call fcn.14001c560
mov qword [0x140140d20], rdi
jmp 0x1400c6f0d
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.140096928
mov rcx, qword [0x140140d20]
mov rdx, rdi
mov r8, rax
call fcn.140012190
mov rcx, qword [0x140140d20]
movzx eax, byte [rcx + 0x17]
test al, al
jns 0x1400c7170
mov rax, qword [rcx + 8]
test rax, rax
je 0x1400c7180
mov rdx, qword [rcx]
cmp word [rdx + rax*2 - 2], 0x5c
je 0x1400c70ec
lea rdx, [0x14011a1da]
mov r8d, 1
call fcn.14001c560
mov rcx, qword [0x140140d20]
lea rdx, str.debug.log
mov r8d, 9
call fcn.14001c560
mov rcx, qword [0x140140d20]
cmp byte [rcx + 0x17], 0
jns 0x1400c710e
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140140d28], rax
inc rax
cmp rax, 1
ja 0x1400c6f90
mov qword [0x140140d28], 0
jmp 0x1400c6f8e
cmp r9, 0x14
jae 0x1400c717d
mov byte [rdi + 0x17], dl
mov rcx, rdi
jmp 0x1400c7060
test rax, rax
je 0x1400c7180
mov rdx, rcx
jmp 0x1400c70cb
int3
int3
int3
Function at 0x1400c9360
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rdi
mov rdx, qword [rcx]
mov r9, qword [rcx + 8]
mov r8, r9
sub r8, rdx
je 0x140095c27
mov rax, r8
shr rax, 2
mov r10, rdx
not r10
add r10, r9
je 0x140095bfe
mov r10, r8
and r10, 0xfffffffffffffffe
xor r9d, r9d
lea r11, [0x14011f080]
nop dword [rax + rax]
movzx esi, al
movzx edi, byte [rdx + r9]
xor edi, esi
shr eax, 8
xor eax, dword [r11 + rdi*4]
movzx esi, al
movzx edi, byte [rdx + r9 + 1]
xor edi, esi
shr eax, 8
xor eax, dword [r11 + rdi*4]
add r9, 2
cmp r10, r9
jne 0x140095bd0
jmp 0x140095c01
xor r9d, r9d
test r8b, 1
je 0x140095c21
movzx r8d, al
movzx edx, byte [rdx + r9]
xor edx, r8d
lea r8, [0x14011f080]
shr eax, 8
xor eax, dword [r8 + rdx*4]
mov dword [rcx + 0x18], eax
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x140095c21
sub rsp, 0x28
movapd xmmword [rsp + 0x10], xmm7
movapd xmmword [rsp], xmm6
mov r11, qword [r8]
mov r10, qword [r8 + 8]
mov rax, r10
sub rax, r11
sar rax, 2
lea r9, [rax - 1]
cmp r9, 2
jb 0x1400c9438
cvtsi2sd xmm0, ecx
cvtsi2sd xmm1, edx
add rax, 0xfffffffffffffffd
movq xmm2, rax
punpckldq xmm2, xmmword [0x1401185e0]
subpd xmm2, xmmword [0x1401185f0]
haddpd xmm2, xmm2
mov ecx, 1
movdqa xmm3, xmmword [0x1401185e0]
movapd xmm4, xmmword [0x1401185f0]
movsd xmm5, qword [0x1401093d0]
mov rdx, qword [r8]
mov r10, qword [r8 + 8]
sub r10, rdx
sar r10, 2
cmp r10, rcx
jbe 0x1400c945a
movq xmm6, rax
punpckldq xmm6, xmm3
subpd xmm6, xmm4
haddpd xmm6, xmm6
lea r10, [rcx - 1]
movq xmm7, r10
punpckldq xmm7, xmm3
subpd xmm7, xmm4
haddpd xmm7, xmm7
mulsd xmm6, xmm0
mulsd xmm7, xmm1
addsd xmm7, xmm6
divsd xmm7, xmm2
addsd xmm7, xmm5
cvttsd2si r10d, xmm7
mov dword [rdx + rcx*4], r10d
dec rax
inc rcx
cmp rcx, r9
jne 0x1400c93d0
mov r11, qword [r8]
mov r10, qword [r8 + 8]
cmp r10, r11
je 0x1400c945d
mov dword [r10 - 4], 0x7fffffff
mov rcx, r8
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
add rsp, 0x28
jmp 0x140095b90
int3
int3
Function at 0x1400efa80
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rax, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
je 0x1400efaba
test rax, rax
je 0x1400efb6c
mov rcx, qword [rdi]
mov qword [rax], rcx
add rax, 8
mov qword [rsi + 8], rax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
sub rax, qword [rsi]
mov r14, rax
sar r14, 3
lea rcx, [r14 + 1]
mov rdx, rcx
shr rdx, 0x3d
jne 0x1400efb98
movabs rdx, 0x1fffffffffffffff
mov rbx, rax
sar rbx, 2
cmp rbx, rcx
cmovbe rbx, rcx
movabs rcx, 0x7ffffffffffffff8
cmp rax, rcx
cmovae rbx, rdx
test rbx, rbx
jne 0x1400efb62
xor eax, eax
shl r14, 3
add r14, rax
je 0x1400efb6c
lea rax, [rax + rbx*8]
mov rcx, qword [rdi]
mov qword [r14], rcx
lea rdx, [r14 + 8]
mov rcx, qword [rsi]
mov r8, qword [rsi + 8]
cmp r8, rcx
je 0x1400efb40
mov r9, qword [r8 - 8]
add r8, 0xfffffffffffffff8
mov qword [r14 - 8], r9
add r14, 0xfffffffffffffff8
cmp r8, rcx
jne 0x1400efb28
mov rcx, qword [rsi]
mov qword [rsi], r14
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], rax
test rcx, rcx
je 0x1400efab0
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400f0000
mov rcx, rbx
call fcn.1400f05a0
jmp 0x1400efb05
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.1400ca3c0
call fcn.1400cb360
int3

Function at 0x1400fb260
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x14012e028]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, 0xffffffffffffffff
xor edx, edx
div rcx
mov rbx, 0xfffffffffffffffe
sub rbx, rdx
movabs r14, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x28]
mov qword [rsp + 0x28], r14
mov rcx, rdi
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400fb2e2
mov rax, qword [rsp + 0x28]
cmp rax, rbx
ja 0x1400fb2a0
xor edx, edx
div rsi
mov rsi, rdx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140098480
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
int3

Function at 0x1400fb6c0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14012e028]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
add rsi, rdi
xor r15d, r15d
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1400fb70e
mov rdx, rcx
add rdi, rdx
cmp al, 1
je 0x1400fb74c
cmp rdi, rsi
jae 0x1400fb74c
mov dword [rsp + 0x2c], 0
mov r8d, esi
sub r8d, edi
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov rdx, rdi
mov r9, r14
call r12
test eax, eax
sete dl
mov ecx, dword [rsp + 0x2c]
test rcx, rcx
sete al
or al, dl
mov edx, 0
jne 0x1400fb707
jmp 0x1400fb704
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140098480
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140009550
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x14003a010]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
mov dword [rsp + 0x20], esi
lea rcx, vtable.CVolObject.0
mov qword [rdi], rcx
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], rsi
lea rax, vtable.CWString.0
mov qword [rdi], rax
lea rbx, [rdi + 0x20]
mov qword [rsp + 0x30], rbx
mov qword [rbx], rcx
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rsi
lea rax, vtable.CVolMem.0
mov qword [rbx], rax
mov qword [rbx + 0x18], rsi
mov qword [rbx + 0x28], rsi
mov qword [rbx + 0x20], rsi
mov qword [rbx + 0x30], 0x40
mov qword [rdi + 0x18], rsi
mov qword [rdi + 0x50], 0xfe
mov dword [rsp + 0x20], 1
mov word [rsp + 0x40], si
xor r9d, r9d
lea r8d, [rsi + 0x1c]
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x14000969b
mov rax, qword [rdi + 0x18]
test rax, rax
jne 0x14000961e
cmp qword [rdi + 0x48], rax
je 0x140009628
cmp qword [rbx + 0x28], rax
je 0x140009628
mov rax, qword [rbx + 0x18]
lea rcx, [rsp + 0x40]
cmp rcx, rax
je 0x140009693
mov qword [rdi + 0x18], rsi
mov rdx, qword [rbx + 0x18]
test rdx, rdx
je 0x14000963e
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
mov qword [rbx + 0x18], rsi
mov qword [rbx + 0x28], rsi
mov qword [rbx + 0x20], rsi
movzx eax, word [rsp + 0x40]
test ax, ax
je 0x140009693
lea rcx, [rsp + 0x40]
mov rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140009660
lea rsi, [rax*2 + 2]
test rsi, rsi
jle 0x140009693
mov rdx, rsi
mov rcx, rbx
call fcn.140010c50
mov r8, rsi
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140018440
mov rcx, rdi
call fcn.1400096d0
mov rax, rdi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140012790
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000ef00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rdi, r8
mov ebx, edx
test r8, r8
je 0x14000f066
mov rax, qword [rcx]
call qword [rax]
mov rsi, rax
test ebx, ebx
je 0x14000ef6d
cmp ebx, 3
je 0x14000ef6d
sub ebx, 1
je 0x14000ef5c
cmp ebx, 1
jne 0x14000f066
movzx edx, di
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadIconW]
jmp 0x14000f068
movzx edx, di
mov rcx, rsi
call qword [sym.imp.USER32.dll_LoadCursorW]
jmp 0x14000f068
movzx edx, di
mov r8d, 0xa
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r14, rax
test rax, rax
je 0x14000f066
xor r12d, r12d
mov edi, r12d
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
je 0x14000f066
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
test rax, rax
je 0x14000f035
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov qword [rsp + 0x40], r12
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r8d, eax
mov rdx, r15
lea rcx, [rsp + 0x20]
call fcn.14000cae0
test rax, rax
je 0x14000f00e
mov rdi, qword [rsp + 0x20]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov qword [rsp + 0x40], r12
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14000f035
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov qword [rsp + 0x40], r12
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
test rdi, rdi
je 0x14000f066
cmp ebx, 3
jne 0x14000f061
mov rcx, rdi
call fcn.14000e9f0
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, rbx
jmp 0x14000f068
mov rax, rdi
jmp 0x14000f068
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14000f120
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x20
xor esi, esi
mov r14, r9
mov qword [r8 + 0x28], rsi
mov rbx, r8
mov rbp, rdx
test rdx, rdx
jne 0x14000f152
lea eax, [rdx + 1]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
mov rax, qword [rcx]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r15
call qword [rax]
movzx edx, bp
mov r8, r14
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15, rax
test rax, rax
je 0x14000f247
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
je 0x14000f247
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14000f23e
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov qword [rbx + 0x28], rsi
cmp qword [rbx + 0x20], rdi
jl 0x14000f21c
cmp rdi, 1
jne 0x14000f1da
movzx ecx, byte [r14]
mov rax, qword [rbx + 0x18]
mov byte [rax], cl
inc qword [rbx + 0x28]
jmp 0x14000f239
cmp rdi, 2
jne 0x14000f1f1
movzx ecx, word [r14]
mov rax, qword [rbx + 0x18]
mov word [rax], cx
add qword [rbx + 0x28], rdi
jmp 0x14000f239
cmp rdi, 4
jne 0x14000f206
mov ecx, dword [r14]
mov rax, qword [rbx + 0x18]
mov dword [rax], ecx
add qword [rbx + 0x28], rdi
jmp 0x14000f239
cmp rdi, 8
jne 0x14000f21c
mov rcx, qword [r14]
mov rax, qword [rbx + 0x18]
mov qword [rax], rcx
add qword [rbx + 0x28], rdi
jmp 0x14000f239
test eax, eax
je 0x14000f239
mov rdx, rdi
mov rcx, rbx
call fcn.140010c50
mov r8, rdi
mov rdx, r14
mov rcx, rax
call fcn.140018440
mov esi, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r15, qword [rsp + 0x48]
mov rax, rsi
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
Function at 0x14000fb10
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
test rcx, rcx
je 0x14000fc79
cmp word [rcx], 0
je 0x14000fc79
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], rax
mov dword [rbp - 0x60], 0x68
psrldq xmm0, 0xc
movd eax, xmm0
or eax, 1
mov dword [rbp - 0x24], eax
xor edi, edi
mov word [rbp - 0x20], di
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [rsp + 0x50], rax
lea rsi, vtable.CVolObject.0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
lea r14, vtable.CVolMem.0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x80], 0x40
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.140010da0
mov rdx, qword [rsp + 0x68]
cmp qword [rsp + 0x78], rdi
cmove rdx, rdi
lea rax, [rbp - 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14000fc1b
mov ebx, edi
jmp 0x14000fc43
mov edx, 0x1f4
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 1
mov qword [rsp + 0x50], r14
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x14000fc60
lea rcx, [rsp + 0x50]
mov r8, qword [rsp + 0x50]
call qword [r8 + 0x18]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x50], rsi
mov rax, rbx
jmp 0x14000fc7b
xor eax, eax
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000fcd0
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push r14
sub rsp, 0x28
mov r14, rcx
call fcn.14000be70
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
movzx eax, word [rax]
test ax, ax
je 0x14000fd04
cmp ax, 0x20
ja 0x14000fd04
movzx eax, word [rdx + 2]
add rdx, 2
test ax, ax
jne 0x14000fcf1
movzx r9d, word [rdx]
movzx eax, r9w
cmp r9w, 0x22
jne 0x14000fd17
movzx eax, word [rdx + 2]
mov ecx, 0x20
mov r8d, 0x22
cmovne r8w, cx
lea rcx, [rdx + 2]
cmovne rcx, rdx
cmp ax, r8w
je 0x14000fd51
movzx edx, ax
movzx eax, dx
test dx, dx
je 0x14000fd51
movzx eax, word [rcx + 2]
add rcx, 2
movzx edx, ax
cmp ax, r8w
jne 0x14000fd38
test ax, ax
lea rdx, [rcx + 2]
cmove rdx, rcx
mov rsi, rdx
cmp r9w, 0x22
jne 0x14000fd70
cmp word [rdx], 0x20
jne 0x14000fd70
lea rsi, [rdx + 2]
movzx eax, word [rsi]
test ax, ax
je 0x14000fefe
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x20], r15
xor r15d, r15d
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
cmp ax, 0x22
jne 0x14000fe42
movzx eax, word [rsi + 2]
add rsi, 2
mov rdi, rsi
test ax, ax
je 0x14000fdc3
nop dword [rax]
cmp ax, 0x22
je 0x14000fdc3
movzx eax, word [rdi + 2]
add rdi, 2
test ax, ax
jne 0x14000fdb0
mov rbx, rdi
sub rbx, rsi
sar rbx, 1
test rbx, rbx
jle 0x14000fdf8
mov rax, qword [r14]
add rbx, rbx
mov rcx, r14
lea rdx, [rbx + 2]
call qword [rax]
mov r8, rbx
mov rdx, rsi
mov rcx, rax
mov rbp, rax
call fcn.140018440
mov word [rbx + rbp], r15w
jmp 0x14000fdfb
mov rbp, r15
mov rbx, qword [r14 + 0x30]
lea rcx, [r14 + 8]
mov rax, qword [rcx + 0x20]
sub rax, rbx
cmp rax, 8
jl 0x14000fe1f
mov rax, qword [rcx + 0x18]
mov qword [rbx + rax], rbp
add qword [rcx + 0x28], 8
jmp 0x14000fe2c
lea rdx, [rbx + 8]
call fcn.140010c50
mov qword [rax + rbx], rbp
mov rsi, rdi
cmp word [rdi], r15w
je 0x14000fede
lea rsi, [rdi + 2]
jmp 0x14000fede
cmp ax, 0x20
jbe 0x14000feda
mov rdi, rsi
nop
cmp ax, 0x22
je 0x14000fe69
cmp ax, 0x20
jbe 0x14000fe69
movzx eax, word [rdi + 2]
add rdi, 2
test ax, ax
jne 0x14000fe50
mov rbx, rdi
sub rbx, rsi
sar rbx, 1
test rbx, rbx
jle 0x14000fe9e
mov rax, qword [r14]
add rbx, rbx
mov rcx, r14
lea rdx, [rbx + 2]
call qword [rax]
mov r8, rbx
mov rdx, rsi
mov rcx, rax
mov rbp, rax
call fcn.140018440
mov word [rbx + rbp], r15w
jmp 0x14000fea1
mov rbp, r15
mov rbx, qword [r14 + 0x30]
lea rcx, [r14 + 8]
mov rax, qword [rcx + 0x20]
sub rax, rbx
cmp rax, 8
jl 0x14000fec8
mov rax, qword [rcx + 0x18]
mov rsi, rdi
mov qword [rbx + rax], rbp
add qword [rcx + 0x28], 8
jmp 0x14000fede
lea rdx, [rbx + 8]
call fcn.140010c50
mov rsi, rdi
mov qword [rax + rbx], rbp
jmp 0x14000fede
add rsi, 2
movzx eax, word [rsi]
test ax, ax
jne 0x14000fd93
mov r15, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rax, qword [r14 + 0x30]
shr rax, 3
add rsp, 0x28
pop r14
pop rsi
ret
Function at 0x14001340c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140013456
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140013456
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140013456
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140013456
cmp dword [rcx + 0x84], 0xe
jbe 0x140013456
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140013458
xor al, al
add rsp, 0x28
ret

Function at 0x140018e58
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140018cc3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140018cc3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140018cc3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140018cc3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140018cc3
cmp dword [rcx + 0x84], 0xe
jbe 0x140018cc3
cmp dword [rcx + 0xf8], 0
je 0x140018cc3
mov ecx, ebx
call fcn.140018d74
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140018b50
nop
cmp dword [rbp + 0x20], 0
je 0x140018d11
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140018d1c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140018c54