joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180004d70
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x110
movaps xmmword [rax - 0x18], xmm6
mov r14, r8
movaps xmmword [rax - 0x28], xmm7
mov rsi, rdx
movaps xmmword [rax - 0x38], xmm8
mov rbp, rcx
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd r9, dword [r10 + 0x3c]
mov edi, dword [r9 + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180004e47
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180004e47
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x6b72f0e7
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180004e42
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180004e20
cmp r8d, 0x410fb745
je 0x180004e4c
test r9d, r9d
jne 0x180004e00
mov rax, qword [rax]
jmp 0x180004dd0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, rbp
add rax, r10
call rax
movsd xmm7, qword [rsi]
mov rcx, rbp
movsd xmm8, qword [rsi + 8]
addsd xmm7, qword [0x180014bc8]
addsd xmm8, qword [0x180014bc8]
movups xmm9, xmmword [0x180014640]
movups xmm10, xmmword [0x18001b338]
movaps xmm11, xmmword [r14]
movaps xmm6, xmmword [rsi]
call fcn.180004720
cmp word [rax], 0
je 0x180004ec6
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp word [rax + rcx*2], 0
jne 0x180004eb0
xor edx, edx
add ecx, 1
je 0x180004eca
mov rdx, rax
jmp 0x180004eca
xor edx, edx
mov ecx, edx
mov rax, qword [0x1800177d8]
movaps xmm0, xmmword [0x180014e80]
mov rbx, qword [0x180017830]
mov qword [rsp + 0x20], rax
mov rax, qword [0x18001b7f0]
movsd qword [rsp + 0x38], xmm6
unpckhpd xmm6, xmm6
movsd qword [rsp + 0x40], xmm6
movsd qword [rsp + 0x80], xmm7
movsd qword [rsp + 0x88], xmm8
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x68], 0
mov word [rsp + 0x90], 0x100
mov byte [rsp + 0x92], 1
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm11
movups xmmword [rsp + 0x6c], xmm10
movups xmmword [rsp + 0x94], xmm9
test rax, rax
jne 0x180004f78
mov rax, qword [0x180017950]
lea r8, str.Canvas.K2_DrawText
add rax, 0x12933d0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x18001b7f0], rax
mov r9, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rbx
call qword [r9 + 0x260]
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r14
ret
Function at 0x180004fd0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x110
movaps xmmword [rax - 0x18], xmm6
mov r14, r8
movaps xmmword [rax - 0x28], xmm7
mov rsi, rdx
movaps xmmword [rax - 0x38], xmm8
mov rbp, rcx
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd r9, dword [r10 + 0x3c]
mov edi, dword [r9 + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1800050a7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1800050a7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xde7a61b5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1800050a2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180005080
cmp r8d, 0x4d3cec27
je 0x1800050ac
test r9d, r9d
jne 0x180005060
mov rax, qword [rax]
jmp 0x180005030
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, rbp
add rax, r10
call rax
movsd xmm7, qword [rsi]
mov rcx, rbp
movsd xmm8, qword [rsi + 8]
addsd xmm7, qword [0x180014bc8]
addsd xmm8, qword [0x180014bc8]
movups xmm9, xmmword [0x180014640]
movups xmm10, xmmword [0x18001b338]
movaps xmm11, xmmword [r14]
movaps xmm6, xmmword [rsi]
call fcn.180004720
cmp word [rax], 0
je 0x180005126
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp word [rax + rcx*2], 0
jne 0x180005110
xor edx, edx
add ecx, 1
je 0x18000512a
mov rdx, rax
jmp 0x18000512a
xor edx, edx
mov ecx, edx
mov rax, qword [0x1800177d8]
movaps xmm0, xmmword [0x180014e80]
mov rbx, qword [0x180017830]
mov qword [rsp + 0x20], rax
mov rax, qword [0x18001b7f0]
movsd qword [rsp + 0x38], xmm6
unpckhpd xmm6, xmm6
movsd qword [rsp + 0x40], xmm6
movsd qword [rsp + 0x80], xmm7
movsd qword [rsp + 0x88], xmm8
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x68], 0
mov word [rsp + 0x90], 0x101
mov byte [rsp + 0x92], 1
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm11
movups xmmword [rsp + 0x6c], xmm10
movups xmmword [rsp + 0x94], xmm9
test rax, rax
jne 0x1800051d8
mov rax, qword [0x180017950]
lea r8, str.Canvas.K2_DrawText
add rax, 0x12933d0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x18001b7f0], rax
mov r9, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rbx
call qword [r9 + 0x260]
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r14
ret
Function at 0x140026aa0
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x140026b6c
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x140026b6c
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x140026b85
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x140026b5c
cmp byte [rax], 0x5c
jne 0x140026b56
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x140026b56
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x140026b42
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x140026b53
test r8b, 0x10
jne 0x140026b56
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x140026b56
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.14002a0c0
test edi, edi
jne 0x140026ac0
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
mov rcx, rbx
call fcn.140027c50
int3

Function at 0x14002ae10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x14002ae44
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x14002ae30
ret
Function at 0x14002d960
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400e3b88]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14002d98d
xor eax, eax
jmp 0x14002dadb
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14002d9c7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14002d9c7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14002dadb
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14002dace
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14002da0a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14002da19
movsx ecx, dil
jmp 0x14002da6d
lea r8, [rsp + 0x48]
mov byte [rsp + 0x40], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x41]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x40]
call qword [rax + 0x38]
test eax, eax
je 0x14002da87
sub eax, 1
je 0x14002da87
cmp eax, 2
jne 0x14002dace
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call fcn.140088444
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14002dad3
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14002dab4
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.140088d30
cmp rsi, rax
jne 0x14002dace
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14002dad3
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400799e0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14002e190
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x14002e1c1
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x14002e23b
mov rdi, r14
mov rcx, rbx
call fcn.140028650
test rax, rax
jle 0x14002e213
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.14007b860
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14002e22b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14002e233
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x14002e1d5
sub r14, rdi
jmp 0x14002e31f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14002e252
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14002e254
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14002e286
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.14007b860
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14002e31c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14002e2c1
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14002e2fd
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1400887c8
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14002e31c
cmp rbp, rax
ja 0x14002e2d0
test rbp, rbp
je 0x14002e31c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1400887c8
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14002e340
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rbp, rdx
mov rdi, rcx
mov rbx, r8
je 0x14002e3d8
test r8, r8
jle 0x14002e3d0
nop word [rax + rax]
mov rcx, rdi
call fcn.1400298f0
test rax, rax
jle 0x14002e3ae
cmp rbx, rax
mov rsi, rbx
mov rdx, rbp
cmovge rsi, rax
mov rax, qword [rdi + 0x40]
mov r8, rsi
mov rcx, qword [rax]
call fcn.14007b860
mov rax, qword [rdi + 0x58]
sub rbx, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
jmp 0x14002e3c8
mov rax, qword [rdi]
mov rcx, rdi
movzx edx, byte [rbp]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
cmp eax, 0xffffffff
je 0x14002e3d0
dec rbx
mov esi, 1
add rbp, rsi
test rbx, rbx
jg 0x14002e370
sub r14, rbx
mov rax, r14
jmp 0x14002e456
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], r15
mov r9, qword [rax]
test r9, r9
je 0x14002e3f1
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14002e3f3
xor ecx, ecx
movsxd rsi, ecx
test r14, r14
jle 0x14002e44b
test ecx, ecx
jle 0x14002e42c
cmp r14, rsi
mov rcx, r9
cmovl rsi, r14
mov r8, rsi
call fcn.14007b860
mov rax, qword [rdi + 0x58]
add rbp, rsi
sub r14, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
test r14, r14
jle 0x14002e44b
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14002e44b
mov r8, r14
mov edx, 1
mov rcx, rbp
call fcn.140088d30
sub r14, rax
mov r15, qword [rsp + 0x40]
sub rbx, r14
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140031610
Capabilities:
Load windows common language runtime

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
cmp qword [0x1400e61d0], 0
jne 0x140031700
xor ebx, ebx
lea r8, [rsp + 0x48]
lea rdx, [0x1400a90c8]
mov qword [rsp + 0x48], rbx
lea rcx, [0x1400a90d8]
call sub.mscoree.dll_CLRCreateInstance
lea rdi, [0x1400e61d0]
test eax, eax
js 0x1400316c4
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x40], rbx
lea r8, [0x1400a90e8]
lea rdx, str.v4.0.30319
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov ebx, eax
test eax, eax
js 0x1400316b5
mov rcx, qword [rsp + 0x40]
lea r8, [0x1400a9118]
mov r9, rdi
lea rdx, [0x1400a9108]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov ebx, eax
test eax, eax
js 0x1400316aa
mov rcx, qword [0x1400e61d0]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
test ebx, ebx
jns 0x140031700
cmp qword [0x1400e61d0], 0
jne 0x140031700
lea r9, [0x1400a9118]
mov qword [rsp + 0x20], rdi
lea r8, [0x1400a9108]
xor edx, edx
lea rcx, str.v2.0.50727
call sub.mscoree.dll_CorBindToRuntime
test eax, eax
js 0x14003170d
mov rcx, qword [0x1400e61d0]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov al, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
xor r9d, r9d
lea r8, [0x1400a91f8]
lea rdx, [0x1400a9210]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rbx, qword [rsp + 0x50]
xor al, al
add rsp, 0x30
pop rdi
ret
Function at 0x1400361e0
Capabilities:
Create thread
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbx, rcx
xor esi, esi
add rcx, 0x10
call fcn.14004cc40
mov ecx, dword [rbx + 0x310]
test al, al
je 0x140036324
cmp ecx, 1
je 0x14003630c
mov dword [rbx + 0x310], 1
xor edx, edx
mov rcx, rbx
call fcn.140039920
mov rcx, rbx
call fcn.140039130
lea rcx, [0x1400e5c80]
call fcn.14003a950
test al, al
je 0x140036389
lea rcx, [rbx + 0x10]
call fcn.14004cb40
test al, al
je 0x140036389
lea rcx, [rbx + 0x10]
call fcn.14004d220
lea rdi, [rbx + 0x530]
cmp byte [rdi + 8], sil
jne 0x1400362f3
cmp qword [rdi + 0x18], rsi
je 0x1400362f3
mov word [rdi + 8], 0x101
mov dword [rdi + 0x20], 0x32
lea ecx, [rsi + 8]
call fcn.14007951c
test rax, rax
je 0x140036294
mov qword [rax], rdi
jmp 0x140036297
mov rax, rsi
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x1400322d0]
xor edx, edx
xor ecx, ecx
call fcn.14008936c
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14003639c
cmp dword [rsp + 0x38], 0
je 0x140036391
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140078718
test eax, eax
jne 0x140036391
mov dl, 1
mov rcx, rbx
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
jmp fcn.140039920
lea rcx, [rbx + 0x10]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
jmp fcn.140004400
test ecx, ecx
je 0x140036379
cmp ecx, 1
jne 0x140036336
lea rcx, [rbx + 0x10]
call fcn.140004400
mov dword [rbx + 0x310], esi
mov rcx, rbx
call fcn.140039130
mov byte [rbx + 0x538], sil
mov edi, 0x1388
cmp byte [rbx + 0x539], sil
je 0x140036379
nop dword [rax]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
sub edi, 0x32
js 0x140036379
cmp byte [rbx + 0x539], sil
jne 0x140036360
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
xor ecx, ecx
call fcn.140089934
nop
mov ecx, 1
call fcn.140077af4
nop
mov dword [rsp + 0x38], esi
mov ecx, 6
call fcn.140077af4
int3
Function at 0x140038f60
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1400e3b88]
xor rax, rsp
mov qword [rsp + 0x88], rax
movzx edi, r8b
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x50], rdx
xor ebp, ebp
lea rcx, [rsp + 0x58]
call fcn.140009100
mov byte [rsp + 0x78], dil
mov qword [rsp + 0x80], rsi
lea ecx, [rbp + 0x30]
call fcn.14007951c
test rax, rax
je 0x140038fec
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rax + 0x10], xmm1
movdqa xmm0, xmmword [0x1400a5d20]
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], bpl
mov byte [rax + 0x20], dil
mov qword [rax + 0x28], rsi
jmp 0x140038fef
mov rax, rbp
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x140032140]
xor edx, edx
xor ecx, ecx
call fcn.14008936c
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140039106
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140039060
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003905b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140039115
call fcn.140079558
cmp dword [rsp + 0x38], 0
je 0x1400390fb
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140078718
test eax, eax
jne 0x1400390fb
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400390c3
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400390be
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003911b
mov rcx, r8
call fcn.140079558
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rbx], 0
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400799e0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov ecx, 1
call fcn.140077af4
nop
mov dword [rsp + 0x38], ebp
mov ecx, 6
call fcn.140077af4
nop
call fcn.14007febc
nop
call fcn.14007febc
int3

Function at 0x140039130
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
lea rdi, [0x1400e6260]
mov qword [rsp + 0x48], rdi
mov rcx, rdi
call fcn.14007799c
test eax, eax
jne 0x1400391c1
cmp dword [0x1400e62ac], 0x7fffffff
je 0x1400391ac
lea edx, [rax + 2]
mov rcx, rbx
call fcn.140041a70
mov eax, dword [rbx + 0xc0]
mov dword [rsp + 0x50], eax
xor eax, eax
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
lea r8d, [rax + 4]
lea rdx, [rsp + 0x50]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400779a4
mov dword [0x1400e62ac], 0x7ffffffe
mov ecx, 6
call fcn.140077af4
int3
mov ecx, 5
call fcn.140077af4
int3
Function at 0x140039620
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
movzx edi, dl
mov rbx, rcx
lea rsi, [0x1400e6260]
mov qword [rsp + 0x50], rsi
mov rcx, rsi
call fcn.14007799c
test eax, eax
jne 0x1400396b8
cmp dword [0x1400e62ac], 0x7fffffff
je 0x1400396a3
lea edx, [rax + 7]
mov rcx, rbx
call fcn.140041a70
mov dword [rsp + 0x58], edi
xor eax, eax
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8d, [rax + 4]
lea rdx, [rsp + 0x58]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.1400779a4
mov dword [0x1400e62ac], 0x7ffffffe
mov ecx, 6
call fcn.140077af4
int3
mov ecx, 5
call fcn.140077af4
int3

Function at 0x1400397e0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rdx
xor ebp, ebp
mov dword [rsp + 0x3c], ebp
lea r14, [0x1400e6260]
mov qword [rsp + 0x50], r14
mov rcx, r14
call fcn.14007799c
test eax, eax
jne 0x14003990a
cmp dword [0x1400e62ac], 0x7fffffff
je 0x1400398f5
lea edx, [rbp + 8]
mov rcx, rdi
call fcn.140041a70
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.140009100
mov rdx, rax
mov rcx, rdi
call fcn.14003d120
nop
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x34], ebp
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x38]
lea r8d, [rbp + 4]
lea rdx, [rsp + 0x34]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rsi, dword [rsp + 0x34]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rbx], bpl
mov dword [rsp + 0x3c], 2
mov rdx, rsi
cmp esi, 0xf
jbe 0x1400398b7
movzx r8d, byte [rsp + 0x30]
mov rcx, rbx
call fcn.140032cd0
mov qword [rbx + 0x10], rbp
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1400398c4
mov rdx, qword [rbx]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
mov r8d, esi
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop
mov rcx, r14
call fcn.1400779a4
mov rax, rbx
add rsp, 0x80
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov dword [0x1400e62ac], 0x7ffffffe
mov ecx, 6
call fcn.140077af4
int3
mov ecx, 5
call fcn.140077af4
int3