joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400196a4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14001972b
mov rsi, rbx
cmp word [rax], bp
je 0x1400196ea
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400196d4
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400196d0
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140016d80
mov rdi, rax
test rax, rax
je 0x140019718
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14000d8e0
mov rbp, rdi
xor ecx, ecx
call fcn.140015da4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001bcf4
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001bd0a
mov al, 1
jmp 0x14001bd6a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001bd1b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001bd68
mov ecx, dword [rcx + 0x18]
nop
call fcn.140019e48
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001bd68
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001bd68
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001bd68
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001bd6a
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140001000
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140232230]
xor rax, rsp
mov qword [rbp - 8], rax
mov r14, rcx
mov qword [0x1402391c0], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
lea r8, [0x1401b58f0]
mov edx, 0x79
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor edi, edi
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x30], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x38], rdi
mov byte [rbp - 0x48], dil
mov r8d, esi
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.140001750
nop
lea r8, [rbp - 0x48]
lea rdx, str.PeerBlock_1.2
lea rcx, [rbp - 0x28]
call fcn.140001270
mov rbx, rax
lea rax, [rbp - 0x48]
cmp rax, rbx
je 0x1400010f3
cmp qword [rbp - 0x30], 0x10
jb 0x1400010d6
mov rcx, qword [rbp - 0x48]
call fcn.1401669a0
mov qword [rbp - 0x30], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x38], rdi
mov byte [rbp - 0x48], 0
mov rdx, rbx
lea rcx, [rbp - 0x48]
call fcn.1400021f0
nop
cmp qword [rbp - 0x10], 0x10
jb 0x140001103
mov rcx, qword [rbp - 0x28]
call fcn.1401669a0
mov qword [rbp - 0x10], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x18], rdi
mov byte [rbp - 0x28], 0
lea r8, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae r8, qword [rbp - 0x48]
mov edx, 0x422
mov rcx, r14
call qword [sym.imp.USER32.dll_SetDlgItemTextA]
mov rcx, r14
call fcn.140001890
nop
cmp qword [rbp - 0x30], 0x10
jb 0x140001148
mov rcx, qword [rbp - 0x48]
call fcn.1401669a0
mov qword [rbp - 0x30], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x38], rdi
mov byte [rbp - 0x48], 0
mov eax, 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140166980
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x1400018d8
Capabilities:
Link many functions at runtime
Terminate process

Disassembly:
sub rsp, 0xe8
lea rax, [0x140231a18]
mov qword [rsp + 0x38], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0xc8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x8c]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rsp + 0x38]
Function at 0x140001940
Capabilities:
Link function at runtime on windows
Link many functions at runtime
Terminate process

Disassembly:
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xd0], 0
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x5c]
mov eax, eax
mov qword [rsp + 0xa0], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, qword [rsp + 0xa0]
mov r8, rcx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x58], rax
mov r8d, 0x104
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, qword [rsp + 0x58]
call qword [rsp + 0xa8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x24]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
cmp dword [rax], 0
je 0x140001a98
mov rcx, qword [rsp + 0x58]
call fcn.140001838
mov byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
movzx ecx, byte [rcx]
cmp eax, ecx
je 0x140001a26
movzx eax, byte [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
movzx ecx, byte [rcx + 1]
cmp eax, ecx
je 0x140001a26
mov r9d, reloc.WS2_32.dll_recv
mov rax, qword [rsp + 0x38]
mov r8, qword [rax + 0x68]
invalid
invalid
invalid
Function at 0x14003b5d0
Capabilities:
Create directory

Disassembly:
push rbp
lea rbp, [rsp - 0xfa0]
mov eax, 0x10a0
call fcn.14017fcc0
sub rsp, rax
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x10b8], rbx
mov qword [rsp + 0x10c0], rsi
mov qword [rsp + 0x10c8], rdi
mov rax, qword [0x140232230]
xor rax, rsp
mov qword [rbp + 0xf90], rax
mov rbx, rcx
lea rdx, [rsp + 0x68]
call fcn.140021230
nop
cmp qword [rax + 0x18], 8
jb 0x14003b631
mov rax, qword [rax]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
sete dil
cmp qword [rbp - 0x80], 8
jb 0x14003b653
mov rcx, qword [rsp + 0x68]
call fcn.1401669a0
mov qword [rbp - 0x80], 7
xor esi, esi
mov qword [rsp + 0x78], rsi
mov word [rsp + 0x68], si
test dil, dil
je 0x14003b76f
mov r9, rbx
lea r8, [0x1401c3e48]
mov edx, 0x800
lea rcx, [rbp - 0x70]
call fcn.140167410
lea rax, [rsp + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov qword [rbp - 0x80], 7
mov qword [rsp + 0x78], rsi
mov word [rsp + 0x68], si
cmp word [rbp - 0x70], si
jne 0x14003b6b9
mov r8d, esi
jmp 0x14003b6cb
lea rax, [rbp - 0x70]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], si
jne 0x14003b6c1
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x68]
call fcn.14000dc20
nop
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], rsi
mov word [rsp + 0x20], si
mov r8d, 0x19
lea rdx, str._path___create_directory_
lea rcx, [rsp + 0x20]
call fcn.14000dc20
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x20]
call fcn.140078b90
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rcx, [rsp + 0x20]
call fcn.1401670f4
nop
lea rax, vtable.win32_error.0
mov qword [rsp + 0x20], rax
lea rax, str.CreateDirectory
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], ebx
lea rax, vtable.path_error.0
mov qword [rsp + 0x20], rax
lea rdx, [0x14022d858]
lea rcx, [rsp + 0x20]
call fcn.140170da8
int3
mov rcx, qword [rbp + 0xf90]
xor rcx, rsp
call fcn.140166980
lea r11, [rsp + 0x10a0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140144370
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov ecx, 0xd8
mov esi, r8d
mov rdi, rdx
call qword [fcn.140167bc0]
mov rbx, rax
test rax, rax
jne 0x1401443ad
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
lea rax, [0x1401c2ca8]
lea rcx, [rbx + 0x18]
mov qword [rsp + 0x38], rbp
mov qword [rbx], rax
lea rax, [rcx + 0x58]
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rax
cmp esi, 0x40
jbe 0x140144401
call qword [0x1401c2ca8]
mov rcx, qword [rbx + 8]
mov r8d, esi
mov rdx, rdi
call qword [fcn.140142190]
mov rdi, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
add rdi, 0x58
mov rcx, rdi
call qword [fcn.140142260]
mov esi, reloc.WS2_32.dll_recv
mov rcx, qword [rbx + 8]
call qword [0x1401c2ca8]
mov rcx, qword [rbx + 0x10]
call qword [0x1401c2ca8]
xor ebp, ebp
test rsi, rsi
je 0x14014446b
mov rbp, rsi
nop
movzx eax, byte [rdi]
lea rdx, [rsp + 0x30]
mov r8d, 1
xor al, 0x36
mov byte [rsp + 0x30], al
mov rcx, qword [rbx + 8]
call qword [fcn.140142190]
movzx eax, byte [rdi]
lea rdx, [rsp + 0x30]
xor al, 0x5c
mov r8d, 1
lea rdi, [rdi + 1]
mov byte [rsp + 0x30], al
mov rcx, qword [rbx + 0x10]
call qword [fcn.140142190]
dec rsi
jne 0x140144420
cmp rbp, 0x40
jae 0x1401444a6
mov edi, 0x40
sub rdi, rbp
mov rcx, qword [rbx + 8]
lea rdx, [0x1401bb0a3]
mov r8d, 1
call qword [fcn.140142190]
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1401bb0b1]
mov r8d, 1
call qword [fcn.140142190]
dec rdi
jne 0x140144473
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140175b64
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1401759cc

Function at 0x140180b74
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
jne 0x140180ba0
call fcn.14016a3d4
mov dword [rax], socket
call fcn.140175f10
jmp 0x140180ca6
mov eax, dword [rcx + 0x18]
test al, 0x83
je 0x140180ca6
test al, 0x40
jne 0x140180ca6
test al, 2
je 0x140180bc2
or eax, 0x20
mov dword [rcx + 0x18], eax
jmp 0x140180ca6
or eax, 1
mov dword [rcx + 0x18], eax
test eax, 0x10c
jne 0x140180bd6
call fcn.14017c66c
jmp 0x140180bdd
mov rax, qword [rcx + 0x10]
mov qword [rcx], rax
mov rcx, rdi
call fcn.14017b5b4
mov r8d, dword [rdi + 0x24]
mov rdx, qword [rdi + 0x10]
mov ecx, eax
call fcn.14017dbf8
mov dword [rdi + 8], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x140180c95
test byte [rdi + 0x18], 0x82
jne 0x140180c63
mov rcx, rdi
call fcn.14017b5b4
cmp eax, 0xffffffff
je 0x140180c4e
mov rcx, rdi
call fcn.14017b5b4
cmp eax, 0xfffffffe
je 0x140180c4e
mov rcx, rdi
call fcn.14017b5b4
mov rcx, rdi
lea rsi, [0x140238b90]
movsxd rbx, eax
sar rbx, 5
call fcn.14017b5b4
and eax, 0x1f
imul rax, rax, 0x58
add rax, qword [rsi + rbx*8]
jmp 0x140180c55
lea rax, [0x140232e80]
mov al, byte [rax + 8]
and al, 0x82
cmp al, 0x82
jne 0x140180c63
bts dword [rdi + 0x18], 0xd
cmp dword [rdi + 0x24], 0x200
jne 0x140180c82
test byte [rdi + 0x18], 8
je 0x140180c82
test dword [rdi + 0x18], 0x400
jne 0x140180c82
mov dword [rdi + 0x24], 0x1000
mov rcx, qword [rdi]
add dword [rdi + 8], 0xfffffffe
movzx eax, word [rcx]
add rcx, 2
mov qword [rdi], rcx
jmp 0x140180cab
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [rdi + 0x18], eax
and dword [rdi + 8], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140024690
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14002469d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400246ad
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140024695
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x1400246c5
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1400246b2
sub eax, 3
jb 0x1400246df
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140024716
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140024706
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140024704
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1400246f3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.140024652
jmp 0x14002469d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x16200
mov dl, 5
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140024762
cmp rsi, rcx
jae 0x14002476a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140024749
cmp al, 0x8f
ja 0x140024749
cmp byte [rsi - 2], 0xf
je 0x14002474f
sub al, 0xe8
cmp al, 1
ja 0x140024733
cmp rsi, rcx
jae 0x14002476a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140024739
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14002476a
lodsb al, byte [rsi]
jmp 0x140024749
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x22000]
mov eax, dword [rdi]
or eax, eax
je 0x1400247c7
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x24488]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140024777
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1400247c1
mov qword [rbx], rax
add rbx, 8
jmp 0x140024797
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14002481f
sub rsp, 0xffffffffffffff80
jmp section.UPX0
Function at 0x14000ecbc
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm13
movdqa xmmword [rsp + 0x60], xmm12
movdqa xmmword [rsp + 0x50], xmm11
movdqa xmmword [rsp + 0x40], xmm10
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
movdqu xmm4, xmmword [rcx]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [rcx + 0x30]
movd xmm0, r8d
pxor xmm0, xmm4
lea r8, [rdx - 0x40]
lea r11, [rcx + 0x40]
mov eax, 0x40
cmp r8, rax
jb 0x14000ee09
add rdx, 0xffffffffffffff80
mov r9, rdx
and r9, 0xffffffffffffffc0
mov r10, r9
sub r10, 0xffffffffffffff80
movabs rax, 0x154442bd4
movq xmm9, rax
movdqa xmm8, xmmword [0x140145800]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm9, 0
movdqa xmm12, xmm3
pclmulqdq xmm12, xmm9, 0
movdqa xmm11, xmm2
pclmulqdq xmm11, xmm9, 0
movdqa xmm10, xmm1
pclmulqdq xmm10, xmm9, 0
movdqa xmm4, xmm0
pclmulqdq xmm4, xmm8, 0x11
movdqa xmm5, xmm3
pclmulqdq xmm5, xmm8, 0x11
movdqa xmm7, xmm2
pclmulqdq xmm7, xmm8, 0x11
movdqa xmm13, xmm1
pclmulqdq xmm13, xmm8, 0x11
movdqu xmm0, xmmword [r11]
pxor xmm0, xmm6
pxor xmm0, xmm4
movdqu xmm3, xmmword [r11 + 0x10]
pxor xmm3, xmm12
pxor xmm3, xmm5
movdqu xmm2, xmmword [r11 + 0x20]
pxor xmm2, xmm11
pxor xmm2, xmm7
movdqu xmm1, xmmword [r11 + 0x30]
pxor xmm1, xmm10
pxor xmm1, xmm13
add r8, 0xffffffffffffffc0
add r11, 0x40
cmp r8, 0x3f
ja 0x14000ed54
sub rdx, r9
add rcx, r10
mov r8, rdx
mov r11, rcx
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm3
movdqa xmm3, xmmword [0x140145810]
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm2
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
cmp r8, 0x10
jb 0x14000ee99
movdqu xmm1, xmmword [r11]
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm1
pxor xmm0, xmm2
add r11, 0x10
add r8, 0xfffffffffffffff0
cmp r8, 0xf
ja 0x14000ee6e
movdqa xmm1, xmmword [0x140145810]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pmovzxdq xmm1, xmm0
psrldq xmm0, 4
movabs rax, 0x163cd6124
movq xmm2, rax
pclmulqdq xmm2, xmm1, 0
pxor xmm2, xmm0
pmovzxdq xmm0, xmm2
pclmulqdq xmm0, xmmword [0x140145820], 0x10
pmovzxdq xmm0, xmm0
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
add rsp, 0x88
ret
Function at 0x14000f188
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rdx
mov ebx, ecx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r8d, 0x20
call fcn.14012903c
mov edi, 6
cmp eax, 0x20
jne 0x14000f24c
mov ecx, dword [rsi + 8]
mov rdi, qword [sym.imp.WS2_32.dll_ntohl]
call rdi
mov dword [rsi + 8], eax
mov ecx, dword [rsi + 0xc]
call rdi
mov dword [rsi + 0xc], eax
mov ecx, dword [rsi + 0x10]
call rdi
mov dword [rsi + 0x10], eax
mov ecx, dword [rsi + 0x14]
call rdi
mov dword [rsi + 0x14], eax
mov ecx, dword [rsi + 0x18]
call rdi
mov dword [rsi + 0x18], eax
mov ecx, dword [rsi + 0x1c]
call rdi
mov dword [rsi + 0x1c], eax
lea rdx, [rsp + 0x28]
mov ecx, ebx
call fcn.1401273a4
mov edi, 6
test eax, eax
jne 0x14000f24c
movabs rax, 0x303146464944424d
cmp qword [rsi], rax
mov edi, 8
jne 0x14000f24c
movsxd rax, dword [rsp + 0x3c]
cmp rax, 0x20
jb 0x14000f24c
add rax, 0xffffffffffffffe0
mov ecx, dword [rsi + 0x14]
sub rax, rcx
jb 0x14000f24c
mov ecx, dword [rsi + 0x18]
sub rax, rcx
jb 0x14000f24c
mov ecx, dword [rsi + 0x1c]
cmp rax, rcx
jb 0x14000f24c
setne al
movzx edi, al
shl edi, 3
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14011a890
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x14000f263
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r15d, r9d
mov r12, r8
mov ebx, edx
mov rdi, rcx
mov r13d, dword [rcx + 8]
mov ebp, dword [rcx + 0x18]
add ebp, dword [rcx + 0x14]
add ebp, dword [rcx + 0x1c]
mov rcx, rbp
call fcn.14004c120
mov r14, rax
test rax, rax
je 0x14000f2c8
add r13, r12
mov rsi, r14
test ebp, ebp
je 0x14000f2cf
mov ecx, ebx
mov rdx, rsi
mov r8d, ebp
call fcn.14012903c
test eax, eax
js 0x14000f2f0
sub ebp, eax
movsxd rcx, eax
add rsi, rcx
test eax, eax
jne 0x14000f2a1
test ebp, ebp
je 0x14000f2a1
jmp 0x14000f2e9
mov ebx, 1
jmp 0x14000f2fd
mov eax, dword [rdi + 0x14]
mov ecx, 0xaaaaaaab
imul rcx, rax
shr rcx, 0x23
shl ecx, 2
lea ecx, [rcx + rcx*2]
cmp eax, ecx
je 0x14000f310
mov ebx, 8
jmp 0x14000f2f5
mov ebx, 6
mov rcx, r14
call fcn.14004c180
mov eax, ebx
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test eax, eax
je 0x14000f450
mov dword [rsp + 0x24], r15d
mov rbp, r14
add rbp, rax
mov eax, dword [rdi + 0x18]
add rax, rbp
mov edx, dword [rdi + 0x1c]
add rdx, rax
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], r12
mov r15, r12
mov qword [rsp + 0x40], rax
mov rdi, rax
mov qword [rsp + 0x28], rbp
mov r12, r14
mov ecx, dword [r12]
mov rax, qword [sym.imp.WS2_32.dll_ntohl]
mov rsi, rax
call rax
mov dword [r12], eax
mov ecx, dword [r12 + 4]
call rsi
mov dword [r12 + 4], eax
mov ecx, dword [r12 + 8]
call rsi
mov dword [r12 + 8], eax
mov eax, dword [r12]
mov rcx, r13
sub rcx, r15
cmp rcx, rax
jb 0x14000f2e9
mov rcx, qword [rsp + 0x40]
sub rcx, rbp
cmp rcx, rax
jb 0x14000f2e9
test eax, eax
je 0x14000f3b8
xor eax, eax
mov cl, byte [r15 + rax]
add byte [rbp + rax], cl
inc rax
mov r8d, dword [r12]
cmp rax, r8
jb 0x14000f3a2
jmp 0x14000f3bb
xor r8d, r8d
mov ecx, dword [rsp + 0x24]
mov rdx, rbp
call fcn.14012c004
mov ebx, 7
cmp eax, dword [r12]
jne 0x14000f2f5
mov esi, eax
mov r8d, dword [r12 + 4]
mov rax, qword [rsp + 0x38]
sub rax, rdi
cmp rax, r8
jb 0x14000f2e9
mov ecx, dword [rsp + 0x24]
mov rdx, rdi
call fcn.14012c004
cmp eax, dword [r12 + 4]
jne 0x14000f2f5
mov edx, esi
add r15, rdx
movsxd rcx, dword [r12 + 8]
mov rbx, qword [rsp + 0x30]
sub rbx, r15
cmp rbx, rcx
jg 0x14000f2e9
mov rbx, r13
sub rbx, r15
cmp rbx, rcx
jl 0x14000f2e9
add rbp, rdx
mov eax, eax
add rdi, rax
add r15, rcx
add r12, 0xc
xor ebx, ebx
cmp r12, qword [rsp + 0x28]
jb 0x14000f34c
jmp 0x14000f2f5
xor ebx, ebx
jmp 0x14000f2f5
Function at 0x14000f457
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov r15, r8
mov rax, rdx
mov rbp, rcx
mov rcx, qword [0x14017b750]
xor rcx, rsp
mov qword [rsp + 0x90], rcx
lea rbx, [rsp + 0x38]
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 0
mov edx, 0x8000
mov r8d, 0x40
xor r9d, r9d
mov rcx, rax
call fcn.14012c9ac
cmp eax, 1
sbb esi, esi
not esi
or esi, dword [rbx]
js 0x14000f4dd
lea rdx, [rsp + 0x70]
mov ecx, esi
call fcn.14000f188
mov edi, eax
mov r12d, 0xffffffff
test eax, eax
je 0x14000f4e7
xor r14d, r14d
mov ebp, 0xffffffff
jmp 0x14000f5fc
mov edi, 6
jmp 0x14000f623
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 0
xor r14d, r14d
mov edx, 0x8000
mov r8d, 0x40
xor r9d, r9d
mov rcx, rbp
call fcn.14012c9ac
mov ebp, dword [rsp + 0x38]
cmp eax, 1
sbb ebx, ebx
not ebx
or ebx, ebp
js 0x14000f5e4
lea rdx, [rsp + 0x38]
mov ecx, ebx
call fcn.1401273a4
mov r12d, 0xffffffff
mov edi, 6
test eax, eax
jne 0x14000f5f9
mov r13d, dword [rsp + 0x4c]
cmp r13d, dword [rsp + 0x78]
jne 0x14000f5ed
mov rcx, r13
call fcn.14004c120
mov r14, rax
test rax, rax
je 0x14000f5f4
mov ecx, ebx
mov rdx, r14
mov r8d, r13d
call fcn.14012903c
cmp eax, dword [rsp + 0x78]
jne 0x14000f5fc
mov ebx, eax
call fcn.14006243e
movsxd rdx, ebx
mov rcx, r14
call fcn.140062418
not eax
cmp dword [rsp + 0x7c], eax
jne 0x14000f649
lea rbx, [rsp + 0x6c]
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 0
mov edx, 0x8301
mov r8d, 0x40
xor r9d, r9d
mov rcx, r15
call fcn.14012c9ac
mov r12d, dword [rbx]
cmp eax, 1
sbb r9d, r9d
not r9d
or r9d, r12d
js 0x14000f650
lea rcx, [rsp + 0x70]
mov edx, esi
mov r8, r14
call fcn.14000f263
mov edi, eax
jmp 0x14000f5fc
mov edi, 6
mov ebp, ebx
jmp 0x14000f5fc
mov edi, 8
jmp 0x14000f5f9
mov edi, 1
xor r14d, r14d
mov rcx, r14
call fcn.14004c180
mov ecx, esi
call fcn.140124d4c
test ebp, ebp
js 0x14000f616
mov ecx, ebp
call fcn.140124d4c
test r12d, r12d
js 0x14000f623
mov ecx, r12d
call fcn.140124d4c
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14011a890
mov eax, edi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov edi, 4
jmp 0x14000f5fc
mov r12d, r9d
jmp 0x14000f5fc

Function at 0x14000ff90
Capabilities:
Check mutex on windows

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov byte [rcx], 0
mov qword [rcx + 8], 0
lea r8, str.A946A6A9_917E_4949_B9BC_6BADA8C7FD63
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsi + 8], rax
test rax, rax
je 0x14000ffd0
mov edx, 0x1388
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
sete byte [rsi]
mov rax, rsi
add rsp, 0x20
pop rsi
ret
Function at 0x1400100ce
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
cmp qword [rcx], rdx
je 0x140010125
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call fcn.14001012e
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140010115
mov qword [rsi], rdi
call fcn.140036ff0
mov r8, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
mov r9, rax
call fcn.14004b1e0
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret