joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140044f70
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140070040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140045043
cmp byte [rcx + 0x71], 0
je 0x140045043
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14004503f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140045004
sub eax, 1
je 0x140045008
cmp eax, 2
jne 0x14004503f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140052720
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140045036
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14004503f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140044fec
xor al, al
jmp 0x140044fec
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140052720
add rsp, 0x60
pop rbx
ret

Function at 0x1400486d0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, 0x5a4d
mov r8, rdx
cmp word [rcx], ax
jne 0x140048776
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x140048776
test rax, rax
je 0x140048776
mov edx, dword [rax + 0xd8]
test edx, edx
je 0x140048769
mov rdi, qword [rdx + rcx + 0x58]
test rdi, rdi
je 0x140048769
sub rcx, r8
movabs rsi, 0x2b992ddfa232
add rdi, rcx
cmp qword [rdi], rsi
jne 0x140048776
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
movabs rax, 0x2b992ddfa233
xor rcx, rbx
mov rbx, qword [rsp + 0x30]
xor rcx, rsi
cmp rcx, rsi
cmove rcx, rax
mov al, 1
mov qword [rdi], rcx
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov al, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rsi, qword [rsp + 0x38]
xor al, al
add rsp, 0x20
pop rdi
ret
Function at 0x140048ec0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140070040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbp, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x140048fe6
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x140048fe6
test rax, rax
je 0x140048fe6
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov qword [rsp + 0x58], r8
mov ecx, dword [rax + 0xb0]
test ecx, ecx
jne 0x140048f43
mov qword [rdi], r8
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r8
jmp 0x140048ff1
lea rbx, [rcx + rdx]
mov esi, dword [rax + 0xb4]
add rsi, rbx
mov rcx, qword [rsp + 0x50]
cmp rbx, rsi
jae 0x140048fd4
nop word [rax + rax]
mov edx, dword [rbx + 4]
test edx, edx
je 0x140048fd4
mov eax, dword [rbx]
add rax, rbp
mov qword [rsp + 0x28], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
lea rax, [rdx - 8]
shr rax, 1
mov dword [rsp + 0x38], eax
cmp rcx, r8
je 0x140048fad
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x38]
movsd qword [rcx + 0x10], xmm1
mov rcx, qword [rsp + 0x50]
add rcx, 0x18
mov qword [rsp + 0x50], rcx
jmp 0x140048fc4
lea r8, [rsp + 0x28]
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.140049880
mov rcx, qword [rsp + 0x50]
mov eax, dword [rbx + 4]
add rbx, rax
mov r8, qword [rsp + 0x58]
cmp rbx, rsi
jb 0x140048f60
mov rax, qword [rsp + 0x48]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], r8
jmp 0x140048ff1
mov qword [rcx], r8
mov qword [rcx + 8], r8
mov qword [rcx + 0x10], r8
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140052720
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14004a770
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x50
mov rax, qword [0x140070040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, rcx
lea r9, [rsp + 0x20]
xor r14d, r14d
mov ecx, 0xb
xor r8d, r8d
mov dword [rsp + 0x20], r14d
xor edx, edx
mov ebx, r14d
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14004a802
test rbx, rbx
je 0x14004a7c8
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14004a7b2
test eax, eax
jns 0x14004a823
test rbx, rbx
je 0x14004a828
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x14004a927
test rbx, rbx
jne 0x14004a82f
xor eax, eax
jmp 0x14004a927
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rdi
mov edi, r14d
cmp dword [rbx], r14d
jbe 0x14004a907
nop dword [rax + rax]
mov eax, edi
xorps xmm0, xmm0
imul rcx, rax, 0x128
movups xmmword [rsp + 0x28], xmm0
movzx edx, word [rcx + rbx + 0x2e]
lea rbp, [rcx + rbx]
add rdx, 0x30
mov qword [rsp + 0x38], r14
add rdx, rcx
mov qword [rsp + 0x40], r14
add rdx, rbx
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r14b
jne 0x14004a885
lea rcx, [rsp + 0x28]
call fcn.140041250
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x14004a8a5
mov rdx, qword [rsi]
cmp qword [rsp + 0x40], 0xf
lea rcx, [rsp + 0x28]
cmova rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14004a93d
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x14004a8fd
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a8f8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a986
call fcn.140052a44
inc edi
cmp edi, dword [rbx]
jb 0x14004a850
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rbp, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140052720
add rsp, 0x50
pop r14
pop rsi
pop rbx
ret
mov rdi, qword [rbp + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x14004a992
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a98d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004a98d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052a44
mov rax, rdi
jmp 0x14004a91a
Function at 0x14004b930
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x13e0
call fcn.140053a90
sub rsp, rax
mov rax, qword [0x140070040]
xor rax, rsp
mov qword [rsp + 0x13d0], rax
mov rdi, qword [0x140071738]
mov ecx, 0x20
call fcn.140052e1c
mov rbx, rax
xor eax, eax
mov qword [rsp + 0x30], rbx
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov ecx, 1
mov qword [rsp + 0x48], rdx
movabs r8, 0x5851f42d4c957f2d
movabs rax, 0x5555555555555555
mov qword [rsp + 0x13c8], rax
nop dword [rax]
mov rax, rdx
shr rax, 0x3e
xor rdx, rax
imul rdx, r8
add rdx, rcx
mov qword [rsp + rcx*8 + 0x48], rdx
inc rcx
cmp rcx, 0x138
jb 0x14004b9b0
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x138
call fcn.1400523b0
mov rcx, rax
mov eax, 0x989680
mul rcx
cmp rax, 0x989680
jae 0x14004ba1d
cmp rax, 0x91bf00
jae 0x14004ba1d
nop
lea rcx, [rsp + 0x40]
call fcn.1400523b0
mov rcx, rax
mov eax, 0x989680
mul rcx
cmp rax, 0x91bf00
jb 0x14004ba00
mov ecx, 0x40
and ecx, 0x3f
shr rdx, cl
lea ecx, [rdx - 0x7fffffff]
movsxd rdx, ecx
lea rcx, [rdi + 0x90]
xor rdx, 0xffffffff80000000
mov qword [rbx], rdx
mov rdx, qword [rdi + 0x98]
cmp rdx, qword [rdi + 0xa0]
je 0x14004ba62
mov qword [rdx], rbx
add qword [rdi + 0x98], 8
mov rax, qword [rbx]
jmp 0x14004ba74
lea r8, [rsp + 0x30]
call fcn.140051e20
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x13d0]
xor rcx, rsp
call fcn.140052720
mov rbx, qword [rsp + 0x13f0]
add rsp, 0x13e0
pop rdi
ret
Function at 0x14004e680
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
lea rdx, [0x1400717b7]
lea rcx, str.Transparent
call fcn.140031130
lea rdx, [0x1400717b8]
lea rcx, str.Menu_Colors
call fcn.140031130
cmp byte [0x1400717b8], 0
je 0x14004e716
mov r8d, 0x20
mov qword [rsp + 0x20], rbx
lea rdx, [0x140070110]
lea rcx, str.Text_Color
call fcn.140039f00
mov r8d, 0x20
lea rdx, [0x140070100]
lea rcx, str.Background_Color
movzx ebx, al
call fcn.140039f00
mov r8d, 0x20
lea rdx, [0x1400700f0]
lea rcx, str.Accent_Color
or bl, al
call fcn.140039f00
or al, bl
mov rbx, qword [rsp + 0x20]
je 0x14004e716
call fcn.14004d260
mov rcx, qword [0x140070e18]
xor edx, edx
cmp byte [0x1400717b7], dl
je 0x14004e732
mov r9d, 1
xor r8d, r8d
jmp 0x14004e73b
mov r9d, 2
mov r8b, 0xff
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov rcx, qword [0x140070bf0]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x42f00000
mov dword [rsp + 0x34], 0x41a00000
movss xmm1, dword [rcx + 0x3818]
movss xmm0, dword [rcx + 0x3808]
mov rax, qword [rcx + 0x3ed8]
addss xmm0, xmm0
movss xmm2, dword [rax + 0x2c]
addss xmm0, dword [rcx + 0x3c10]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ed8]
addss xmm0, xmm1
mov byte [rax + 0x141], 1
subss xmm2, xmm0
movss xmm0, dword [rax + 0x24]
subss xmm0, dword [rax + 0x88]
subss xmm2, xmm1
addss xmm0, xmm2
movss dword [rax + 0x104], xmm0
mov rax, qword [rcx + 0x3ed8]
movss xmm1, dword [rax + 0x28]
subss xmm1, dword [0x140065d04]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ed8]
lea rcx, str.Close
movss xmm0, dword [rax + 0x20]
subss xmm0, dword [rax + 0x84]
mov byte [rax + 0x141], 1
addss xmm0, xmm1
movss dword [rax + 0x100], xmm0
call fcn.140030160
test al, al
je 0x14004e81a
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [0x140070bf0]
movss xmm0, dword [rcx + 0x3808]
movss xmm1, dword [rcx + 0x3818]
addss xmm0, xmm0
mov rax, qword [rcx + 0x3ed8]
addss xmm0, dword [rcx + 0x3c10]
movss xmm2, dword [rax + 0x2c]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ed8]
addss xmm0, xmm1
mov byte [rax + 0x141], 1
subss xmm2, xmm0
movss xmm0, dword [rax + 0x24]
subss xmm0, dword [rax + 0x88]
subss xmm2, xmm1
addss xmm0, xmm2
movss dword [rax + 0x104], xmm0
mov rax, qword [rcx + 0x3ed8]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ed8]
movss xmm0, dword [rax + 0x20]
subss xmm0, dword [rax + 0x84]
mov byte [rax + 0x141], 1
addss xmm0, dword [0x140065ccc]
movss dword [rax + 0x100], xmm0
add rsp, 0x28
ret
Function at 0x140051840
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140070040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.140052e1c
mov qword [rax], rbx
mov qword [rsp + 0x30], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140052380]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x1400518b9
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140052720
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x1400523b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x138
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x140052417
lea r8, [r10 + 0x10]
movabs r11, 0xb5026f5aa96619e9
mov rdx, qword [r8]
xor rdx, qword [r8 - 8]
lea r8, [r8 + 8]
and rdx, 0xffffffff80000000
xor rdx, qword [r8 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x1400523d2
mov ecx, dword [r10]
jmp 0x140052538
cmp ecx, 0x270
jb 0x140052538
mov qword [rsp + 0x10], rbx
movabs r11, 0xb5026f5aa96619e9
lea rbx, [r10 + 0x9c8]
mov qword [rsp], rdi
mov rax, qword [rbx]
mov edi, 0x9c
nop word [rax + rax]
mov r9, qword [rbx + 8]
mov r8, rbx
add rbx, 8
mov rdx, r9
xor rdx, rax
and rdx, 0xffffffff80000000
xor rdx, r9
movzx eax, dl
and al, 1
neg al
mov rax, r9
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4e0]
xor rcx, rdx
mov qword [r8 - 0x9c0], rcx
sub rdi, 1
jne 0x140052450
lea rbx, [r10 + 0xea8]
mov edi, 0x9b
mov r9, qword [rbx]
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx + 8]
mov rdx, rbx
xor r9, r8
add rbx, 8
and r9, 0xffffffff80000000
xor r9, r8
movzx eax, r9b
and al, 1
neg al
sbb rcx, rcx
shr r9, 1
and rcx, r11
xor rcx, qword [rdx - 0xea0]
xor rcx, r9
mov r9, r8
mov qword [rdx - 0x9c0], rcx
sub rdi, 1
jne 0x1400524b0
mov rdx, qword [r10 + 8]
xor rdx, qword [r10 + 0x1380]
mov rdi, qword [rsp]
and rdx, 0xffffffff80000000
xor rdx, qword [r10 + 8]
mov rbx, qword [rsp + 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 + 0x9c0], rcx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov rdx, qword [r10 + rax*8 + 8]
lea eax, [rcx + 1]
mov dword [r10], eax
mov rcx, rdx
mov rax, qword [r10 + 0x1388]
shr rcx, 0x1d
and rax, rcx
movabs rcx, 0x38eb3ffff6d3
xor rdx, rax
mov rax, rdx
and rax, rcx
shl rax, 0x11
xor rdx, rax
mov rax, rdx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rdx, rax
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
add rsp, 8
ret
Function at 0x1400525a0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub rsp, 0x58
mov rax, qword [0x140070040]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [0x140070ed8], 0
ja 0x1400525d4
mov eax, 0xffffdcd8
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140052720
add rsp, 0x58
ret
inc dword [0x140070ee8]
mov dword [0x140070eec], 0x9823ae8d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movups xmm1, xmmword [0x140070eb0]
and dword [0x140070ea0], 0xfffffffe
lea rdx, [0x140070ee0]
movups xmm0, xmmword [0x140070ea0]
mov rcx, qword [0x140070ed8]
xor r9d, r9d
mov dword [0x140070ee4], eax
mov r8d, 0x48
movaps xmmword [0x140070ef0], xmm0
lea rax, [0x140071720]
movups xmm0, xmmword [0x140070ec0]
mov dword [rsp + 0x28], recvfrom
movaps xmmword [0x140070f00], xmm1
movsd xmm1, qword [0x140070ed0]
movaps xmmword [0x140070f10], xmm0
movsd qword [0x140070f20], xmm1
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
mov rcx, qword [0x140070ed8]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [0x140071300]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], recvfrom
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov r8d, 0x400
call qword [sym.imp.WS2_32.dll_recvfrom]
test eax, eax
jns 0x1400526b6
mov eax, 0xffffdcdb
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140052720
add rsp, 0x58
ret
mov eax, dword [0x140070eec]
cmp dword [0x14007130c], eax
je 0x1400526db
mov eax, 0xffffdcdc
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140052720
add rsp, 0x58
ret
mov ecx, dword [0x140070ee8]
xor eax, eax
cmp dword [0x140071308], ecx
mov edx, 0xffffdcdd
cmovne eax, edx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140052720
add rsp, 0x58
ret

Function at 0x1400535ac
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400535f6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400535f6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400535f6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400535f6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400535f6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400535f8
xor al, al
add rsp, 0x28
ret
Function at 0x14000bac0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [rdx + 0x10]
lea r9, [rsp + 0x30]
xor esi, esi
mov dword [rsp + 0x34], eax
mov rbx, rdx
mov dword [rsp + 0x30], esi
mov rdi, rcx
mov qword [rsp + 0x20], rsi
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x34]
lea r8d, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 0xf
mov rdx, rbx
jbe 0x14000bb0c
mov rdx, qword [rbx]
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x30]
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14000bb5a
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14000bb55
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000bb79
mov rcx, r8
call fcn.140035720
mov qword [rbx + 0x10], rsi
mov byte [rbx], sil
mov rsi, qword [rsp + 0x68]
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.14003c54c
int3

Function at 0x14000bb80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [rdx + 0x10]
lea r9, [rsp + 0x30]
xor esi, esi
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x30], esi
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x34]
add eax, eax
mov qword [rsp + 0x20], rsi
lea r8d, [rsi + 4]
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 7
mov rdx, rbx
mov r8, qword [rbx + 0x10]
jbe 0x14000bbd2
mov rdx, qword [rbx]
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x30]
add r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 7
jbe 0x14000bc24
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000bc1f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000bc43
mov rcx, r8
call fcn.140035720
mov qword [rbx + 0x10], rsi
mov word [rbx], si
mov rsi, qword [rsp + 0x68]
mov qword [rbx + 0x18], 7
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.14003c54c
int3
Function at 0x14000db90
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x14007b040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r12, r9
mov r13, r8
mov rbp, rdx
mov qword [rsp + 0x38], rdx
mov r14, rcx
mov qword [rsp + 0x40], rdx
mov rbx, qword [rsp + 0xe0]
xor edi, edi
cmp qword [rcx + 0x18], 7
jbe 0x14000dbda
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000dc0e
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x18], rdi
mov r8d, 0x19
lea rdx, str.Error:_Ini_File_Not_Exist
mov rcx, rbp
call fcn.140002750
jmp 0x14000dd44
mov ebp, 1
mov ecx, 0x208
call fcn.1400359d0
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], di
mov rdi, 0xffffffffffffffff
mov r15d, 0x104
nop dword [rax + rax]
mov rax, r14
cmp qword [r14 + 0x18], 7
jbe 0x14000dc5d
mov rax, qword [r14]
mov r8, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14000dc6a
mov r8, qword [rbx]
mov rdx, r12
cmp qword [r12 + 0x18], 7
jbe 0x14000dc79
mov rdx, qword [r12]
mov rcx, r13
cmp qword [r13 + 0x18], 7
jbe 0x14000dc87
mov rcx, qword [r13]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [r15 - 1]
cmp eax, ecx
jb 0x14000dd08
mov r8, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14000dcaf
mov r8, qword [rbx]
mov rax, rsi
sub r8, rsi
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000dcd4
add rax, 2
test ecx, ecx
jne 0x14000dcc0
test edx, edx
je 0x14000dd08
mov rcx, rsi
call fcn.140035720
inc ebp
imul r15d, ebp, 0x104
mov ecx, r15d
mov eax, 2
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.1400359d0
mov rsi, rax
jmp 0x14000dc50
mov rbp, qword [rsp + 0x38]
nop dword [rax]
inc rdi
cmp word [rsi + rdi*2], 0
jne 0x14000dd10
mov r8, rdi
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.1400022b0
mov rcx, rsi
call fcn.140035720
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rbp + 0x10], xmm1
mov rax, rbp
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140035700
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000e800
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rbx, rcx
xor ebp, ebp
sub rcx, 0xffffffffffffff80
call fcn.1400323b0
test eax, eax
setne dl
mov byte [rbx + 0x108], dl
test eax, eax
je 0x14000e853
cmp qword [rbx + 0xc8], 0x10000
jae 0x14000e84a
lea rcx, [rbx + 0x80]
call fcn.140032770
lea rcx, [rbx + 0x10]
call fcn.14002e100
mov eax, dword [rbx + 0x2e4]
cmp byte [rbx + 0x108], bpl
je 0x14000e95e
cmp eax, 1
je 0x14000e93b
mov dword [rbx + 0x2e4], 1
call fcn.14000ced0
test al, al
je 0x14000e9b3
lea rcx, [rbx + 0x10]
call fcn.14002cdd0
test al, al
je 0x14000e9b3
lea rcx, [rbx + 0x10]
call fcn.14002cfc0
mov rcx, rbx
call fcn.140010420
add rbx, 0x4f8
cmp byte [rbx + 8], bpl
jne 0x14000e99e
cmp qword [rbx + 0x18], rbp
je 0x14000e99e
mov word [rbx + 8], 0x101
mov dword [rbx + 0x20], 0x32
mov ecx, 8
call fcn.140035754
mov qword [rax], rbx
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x140012a60]
xor edx, edx
xor ecx, ecx
call fcn.140040b48
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000e9c6
cmp dword [rsp + 0x38], 0
je 0x14000e9bb
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140034e84
test eax, eax
jne 0x14000e9bb
jmp 0x14000e99e
mov eax, dword [0x14007ff28]
inc eax
mov dword [0x14007ff28], eax
cmp eax, 5
jle 0x14000e99e
mov dword [0x14007ff28], ebp
mov rcx, rbx
call fcn.14000e540
jmp 0x14000e99e
test eax, eax
je 0x14000e99e
mov dword [rbx + 0x2e4], ebp
mov rcx, rbx
call fcn.140010420
mov byte [rbx + 0x500], bpl
mov edi, 0x1388
cmp byte [rbx + 0x501], bpl
je 0x14000e99e
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
sub edi, 0x32
js 0x14000e99e
cmp byte [rbx + 0x501], bpl
jne 0x14000e985
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
xor ecx, ecx
call fcn.1400406bc
nop
mov ecx, 1
call fcn.140034de8
nop
mov dword [rsp + 0x38], ebp
mov ecx, 6
call fcn.140034de8
int3
Function at 0x140010420
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
lea rcx, [0x1400804c0]
call fcn.140034f24
test eax, eax
jne 0x1400104cf
cmp dword [0x14008050c], 0x7fffffff
je 0x1400104ba
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x40], rdi
lea r8d, [rax + 4]
xor edi, edi
mov dword [rsp + 0x50], 2
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rbx + 0xc0]
lea r9, [rsp + 0x48]
mov rcx, qword [rbx + 8]
lea r8d, [rdi + 4]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [0x1400804c0]
mov rdi, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
jmp fcn.140034f2c
mov ecx, 6
mov dword [0x14008050c], 0x7ffffffe
call fcn.140034de8
int3
mov ecx, 5
call fcn.140034de8
int3