joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140162620
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rsp + 0x110], rbx
mov rbx, rcx
call fcn.140162d40
mov qword [rbp - 0x19], rax
test rax, rax
je 0x14016265f
cmp byte [rax + 8], 0
jne 0x14016265f
xor bl, bl
jmp 0x1401627c4
lea rdx, [rbx + 0xb0]
lea rcx, [rbp - 0x11]
call fcn.14015b6c0
nop
mov r8d, 0x4000
lea rdx, [rbp - 0x11]
lea rcx, [rbp - 0x79]
call fcn.14015be40
nop
mov rax, qword [rbp - 0x59]
cmp byte [rax], 0
jne 0x1401627af
mov rax, qword [rbp - 0x79]
mov r8d, 4
lea rcx, [rbp - 0x79]
cmp dword [rbx + 0xe0], 1
jne 0x1401627ec
mov dword [rbp + 0x6f], 0x50525043
lea rdx, [rbp + 0x6f]
call qword [rax + 0x20]
lea r14, [0x1402be068]
mov edi, 0xffffffff
mov rax, qword [rbp - 0x41]
mov rcx, qword [rbp - 0x61]
test rax, rax
je 0x140162741
mov dword [rbp + 0x77], 0
test rcx, rcx
je 0x140162739
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x77]
mov r8d, eax
mov rdx, qword [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140162735
lea rcx, [rbp - 0x29]
call fcn.140137280
nop
mov rdx, qword [rbp - 0x59]
mov rcx, qword [rax]
mov qword [rbp + 7], rcx
mov qword [rbp - 0x59], rcx
mov qword [rax], rdx
mov rcx, qword [rbp - 0x29]
add rcx, 0xfffffffffffffff0
cmp rcx, r14
je 0x140162735
mov eax, edi
lock xadd dword [rcx], eax
test eax, eax
jne 0x140162735
call fcn.14010a370
mov rcx, qword [rbp - 0x61]
mov qword [rbp - 0x41], 0
test rcx, rcx
je 0x140162786
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x140162786
lea rcx, [rbp - 0x21]
call fcn.140137280
nop
mov rdx, qword [rbp - 0x59]
mov rcx, qword [rax]
mov qword [rbp + 0xf], rcx
mov qword [rbp - 0x59], rcx
mov qword [rax], rdx
mov rcx, qword [rbp - 0x21]
add rcx, 0xfffffffffffffff0
cmp rcx, r14
je 0x140162786
lock xadd dword [rcx], edi
test edi, edi
jne 0x140162786
call fcn.14010a370
lea rdx, [rbp - 0x79]
lea rcx, [rbp + 0x17]
call fcn.140137f60
nop
lea rdx, [rbp + 0x17]
mov rcx, rbx
call fcn.1401624d0
nop
lea rcx, [rbp + 0x17]
test al, al
jne 0x1401627e4
call fcn.140137da0
nop
lea rcx, [rbp - 0x79]
call fcn.14015bd50
xor bl, bl
lea rcx, [rbp - 0x11]
call fcn.14015b610
nop
lea rcx, [rbp - 0x19]
call fcn.14001ed00
movzx eax, bl
mov rbx, qword [rsp + 0x110]
add rsp, 0xf0
pop r14
pop rdi
pop rbp
ret
call fcn.140137da0
nop
jmp 0x14016280a
mov dword [rbp + 0x7f], 0x504f5250
lea rdx, [rbp + 0x7f]
call qword [rax + 0x20]
lea rdx, [rbp - 0x79]
mov rcx, rbx
call fcn.1401624d0
test al, al
je 0x1401627af
lea rcx, [rbp - 0x79]
call fcn.14015bd50
lea rcx, [rbp - 0x11]
call fcn.14015b580
test al, al
je 0x1401627b8
mov byte [rbx + 0xf1], 0
mov bl, 1
jmp 0x1401627ba
Function at 0x140162af0
Capabilities:
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x58
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rdi, rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea r14, [rcx + 0x38]
mov qword [rsp + 0x38], r14
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rcx, [rdi + 0x98]
call fcn.14016aa10
cmp byte [rdi + 0xda], bl
jne 0x140162bef
lea rcx, [0x1402be078]
mov qword [rsp + 0x28], rcx
mov ebx, 1
mov dword [rsp + 0x20], ebx
mov rax, qword [rdi + 0xb0]
cmp rax, rcx
je 0x140162bef
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rax
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x98]
call fcn.14001abc0
test eax, eax
je 0x140162bef
lea rdx, [rdi + 0xb0]
lea rcx, [rsp + 0x40]
call fcn.140018b20
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x140162bab
cmp eax, 0xffffffff
jne 0x140162bef
lea rdx, [rsp + 0xa8]
lea rcx, [rdi + 0xb0]
call fcn.14015e860
nop
mov dword [rsp + 0x20], 3
lea rdx, [rsp + 0xa0]
mov rcx, rax
call fcn.14015d980
nop
mov ebx, 7
mov dword [rsp + 0x20], ebx
mov rax, qword [rax]
cmp byte [rax], 0
jne 0x140162bef
xor bpl, bpl
jmp 0x140162bf2
mov bpl, 1
mov esi, 0xffffffff
lea r15, [0x1402be068]
test bl, 4
je 0x140162c2e
and ebx, 0xfffffffb
mov dword [rsp + 0x20], ebx
mov rcx, qword [rsp + 0xa0]
add rcx, 0xfffffffffffffff0
cmp rcx, r15
je 0x140162c2e
mov eax, esi
lock xadd dword [rcx], eax
test eax, eax
jne 0x140162c2a
call fcn.14010a370
mov ebx, dword [rsp + 0x20]
test bl, 2
je 0x140162c5e
and ebx, 0xfffffffd
mov dword [rsp + 0x20], ebx
mov rcx, qword [rsp + 0xa8]
add rcx, 0xfffffffffffffff0
cmp rcx, r15
je 0x140162c5e
mov eax, esi
lock xadd dword [rcx], eax
test eax, eax
jne 0x140162c5a
call fcn.14010a370
mov ebx, dword [rsp + 0x20]
test bl, 1
je 0x140162c85
and ebx, 0xfffffffe
mov dword [rsp + 0x20], ebx
mov rcx, qword [rsp + 0x28]
add rcx, 0xfffffffffffffff0
cmp rcx, r15
je 0x140162c85
lock xadd dword [rcx], esi
test esi, esi
jne 0x140162c85
call fcn.14010a370
test bpl, bpl
je 0x140162c8e
xor bl, bl
jmp 0x140162ca9
mov rcx, rdi
cmp dword [rdi + 0xe0], 2
jne 0x140162ca1
call fcn.140162840
jmp 0x140162ca6
call fcn.140162620
movzx ebx, al
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, bl
add rsp, 0x58
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140165c20
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rbx
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x78
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov rax, qword [rcx]
mov qword [rbp + 0x28], rax
lea rcx, [rax - 0x10]
lea rsi, [0x1402be068]
cmp rcx, rsi
je 0x140165c54
mov eax, 1
lock xadd dword [rcx], eax
lea rax, [rbp - 0x30]
mov qword [rbp + 0x38], rax
xor edi, edi
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], rdi
lea rdx, [rbp - 0x30]
lea rcx, [0x1401662b0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [rbp - 0x24]
sub eax, 1
movsxd rbx, eax
js 0x140165d3c
nop word [rax + rax]
mov qword [rbp - 0x20], 0xc403
mov rax, qword [rbp + 0x28]
mov rdx, rdi
nop
movzx ecx, byte [rax]
inc rax
test cl, cl
jns 0x140165cd3
movzx ecx, byte [rax]
and cl, 0xc0
cmp cl, 0x80
jne 0x140165cd7
nop word [rax + rax]
inc rax
movzx ecx, byte [rax]
and cl, 0xc0
cmp cl, 0x80
je 0x140165cc0
inc rdx
jmp 0x140165ca0
test ecx, ecx
je 0x140165cdc
inc rdx
jmp 0x140165ca0
lea eax, [rdx*4 + 4]
mov dword [rbp - 0x18], eax
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x30]
call fcn.1400189c0
mov rax, qword [rbp + 0x30]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x30]
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x1f40
mov dword [rsp + 0x20], 3
lea r9, [rbp - 0x20]
mov r8, qword [0x14047d0a8]
mov edx, 0x4a
mov rcx, qword [rax + rbx*8]
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
sub rbx, 1
jns 0x140165c90
lea rax, [rbp - 0x30]
mov qword [rbp + 0x38], rax
mov dword [rbp - 0x24], edi
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
mov rcx, qword [rbp + 0x28]
add rcx, 0xfffffffffffffff0
cmp rcx, rsi
je 0x140165d71
mov eax, 0xffffffff
lock xadd dword [rcx], eax
test eax, eax
jne 0x140165d71
call fcn.14010a370
add rsp, 0x78
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140166bd0
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3a8]
sub rsp, 0x480
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1404716f0]
xor rax, rsp
mov qword [rbp + 0x370], rax
mov rsi, rcx
mov dword [rsp + 0x24], 0
lea r12, [0x1402be078]
lea r13, [0x1402be068]
nop dword [rax]
mov eax, dword [rsi + 0x78]
test eax, eax
jne 0x140166e02
lea rbx, [rsi + 0x110]
mov eax, dword [rbx]
lea rdi, [rbx + 0x28]
test eax, eax
jns 0x140166c53
mov eax, 0xffffffff
jmp 0x140166c64
mov r9d, 0xc8
mov rdx, rdi
mov rcx, rbx
call fcn.140156a00
cmp eax, 1
jne 0x140166df5
mov eax, dword [rbx]
test eax, eax
js 0x140166df5
cmp byte [rbx + 4], 0
je 0x140166df5
mov byte [rsp + 0x20], 1
movsxd rcx, dword [rbx]
mov dword [rsp + 0x28], 1
lea r8, [rsp + 0x28]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
movsxd r15, dword [rbx]
mov ebx, 0xffffffff
mov qword [rsp + 0x60], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
setne r14b
mov byte [rsp + 0x68], r14b
test r14b, r14b
je 0x140166ce0
xor r9d, r9d
mov r8d, 0x3ff
lea rdx, [rsp + 0x70]
mov rcx, r15
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
test r14b, r14b
je 0x140166cee
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
jle 0x140166df5
movzx ecx, byte [rsp + 0x20]
test cl, cl
je 0x140166df5
cmp ebx, 0xa
jle 0x140166df5
movsxd rax, ebx
lea r14, [rsp + 0x70]
add r14, rax
cmp byte [rsp + 0x70], 0
je 0x140166d5f
lea rax, [rsp + 0x70]
sub r14, rax
lea rbx, [r14 + 4]
and rbx, 0xfffffffffffffffc
lea rcx, [rbx + 0x17]
call fcn.14010aa90
xor ecx, ecx
xchg dword [rax], ecx
mov qword [rax + 8], rbx
lea rdi, [rax + 0x10]
mov r8, r14
lea rdx, [rsp + 0x70]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov qword [rsp + 0x30], rdi
jmp 0x140166d67
mov qword [rsp + 0x30], r12
mov rdi, r12
lea rcx, [rsp + 0x30]
call fcn.140145850
mov rbx, rax
mov qword [rsp + 0x50], rax
or dword [rsp + 0x24], 2
lea rcx, [rdi - 0x10]
cmp rcx, r13
je 0x140166d99
mov eax, 0xffffffff
lock xadd dword [rcx], eax
test eax, eax
jne 0x140166d99
call fcn.14010a370
test rbx, rbx
je 0x140166dd6
mov rax, qword [rsi + 0x168]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x40]
call fcn.14001abc0
test eax, eax
jne 0x140166dd6
mov rdx, rbx
mov rcx, rsi
call fcn.140166940
and dword [rsp + 0x24], 0xfffffffd
test rbx, rbx
je 0x140166df5
mov rcx, rbx
call fcn.140140dc0
mov edx, 0x20
mov rcx, rbx
call fcn.14010a370
mov rcx, rsi
call fcn.140166480
jmp 0x140166c30
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.14010a310
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140167ae0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xa8], rbx
mov r13d, r8d
mov qword [rsp + 0x28], rdx
mov r14, qword [rcx + 0x38]
test r14, r14
je 0x140167bd1
movzx eax, byte [r14 + 0x10]
test al, al
je 0x140167bc8
cmp byte [r14 + 0x11], 0
jne 0x140167bc8
movsxd rax, dword [r14 + 0xc]
lea rcx, [r14 + 0x12]
mov qword [rsp + 0x20], rax
xor ebx, ebx
test r8d, r8d
jle 0x140167bcd
mov esi, 0xffffffff
nop dword [rax + rax]
mov edi, esi
movsxd r15, ebx
add r15, rdx
mov r12d, r13d
sub r12d, ebx
mov qword [rsp + 0x38], rcx
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
setne bpl
mov byte [rsp + 0x40], bpl
test bpl, bpl
je 0x140167b8f
xor r9d, r9d
mov r8d, r12d
mov rdx, r15
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test bpl, bpl
je 0x140167b9e
lea rcx, [r14 + 0x12]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jle 0x140167bbf
movzx eax, byte [r14 + 0x10]
test al, al
je 0x140167bbf
add ebx, edi
cmp ebx, r13d
lea rcx, [r14 + 0x12]
mov rdx, qword [rsp + 0x28]
jl 0x140167b50
mov eax, ebx
jmp 0x140167bed
test ebx, ebx
cmove ebx, esi
mov eax, ebx
jmp 0x140167bed
mov ebx, 0xffffffff
mov eax, ebx
jmp 0x140167bed
mov rax, qword [rcx + 0x40]
test rax, rax
je 0x140167be8
mov r9d, dword [rcx + 0x50]
mov rcx, rax
call fcn.140135a80
jmp 0x140167bed
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa8]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140167ee0
Capabilities:
Send data
Send data on socket

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov r15, rdx
mov r14, rcx
mov eax, dword [rcx + 0x4c]
mov dword [r11 + 8], eax
mov rax, qword [rdx + 8]
mov dword [r11 + 0xc], eax
lea rbx, [rax + 8]
xor edi, edi
mov esi, edi
mov qword [r11 - 0x50], rdi
mov qword [r11 - 0x48], rdi
test rbx, rbx
je 0x140167f5b
mov qword [r11 - 0x48], rbx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x140168062
mov r9, rbx
mov rax, rbx
mov rcx, rbx
mov rbp, rbx
mov rdx, rbx
jmp 0x140167f72
mov rbx, rdi
mov qword [rsp + 0x30], rbx
mov r9, rdi
mov rax, rdi
mov rcx, rdi
mov rbp, rdi
mov rdx, rdi
mov r8d, 8
cmp r9, r8
jae 0x140167f88
mov r8, rax
mov rbp, rdx
test rax, rax
je 0x140167f9b
lea rdx, [rsp + 0x80]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rbp
mov r8, qword [r15 + 8]
lea rax, [r8 + 8]
cmp rax, rcx
jbe 0x140167fac
lea r8, [rbx - 8]
test r8, r8
je 0x140167fbd
lea rcx, [rsi + 8]
mov rdx, qword [r15]
call sub.VCRUNTIME140.dll_memcpy
lea rbp, [r14 + 8]
mov qword [rsp + 0x88], rbp
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rcx, qword [r14 + 0x38]
test rcx, rcx
je 0x14016801a
cmp byte [rcx + 0x11], 0
jne 0x140168013
movzx eax, byte [rcx + 0x10]
test al, al
je 0x140168009
movsxd rcx, dword [rcx + 0xc]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
mov r8d, ebx
mov rsi, qword [rsp + 0x28]
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_send]
jmp 0x140168032
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov edi, 0xffffffff
jmp 0x140168034
mov rcx, qword [r14 + 0x40]
test rcx, rcx
je 0x140168034
mov r9d, dword [r14 + 0x50]
mov r8d, ebx
mov rdx, rsi
call fcn.140135810
mov edi, eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp edi, ebx
sete bl
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movzx eax, bl
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rsp + 0x38]
call fcn.140005c40
lea rdx, [0x1404565a8]
lea rcx, [rsp + 0x38]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x14016a650
Capabilities:
Accept command line arguments

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x48
mov qword [r11 - 0x50], 0xfffffffffffffffe
mov rsi, rcx
mov dword [rsp + 0x20], 0
lea rax, str._w_w
mov qword [r11 + 0x10], rax
lea rax, [0x1402c0d48]
mov qword [r11 + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x98], rax
lea r9, [rsp + 0x88]
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x30]
call fcn.140021bb0
mov rbx, qword [rax]
mov ebp, 0xdc00
mov r15d, 0xd800
mov r14d, 0xdfff
mov rcx, rbx
movzx eax, word [rbx]
lea edx, [rax - 0xd800]
mov rdi, rcx
cmp edx, 0x7ff
ja 0x14016a702
movzx r8d, word [rbx + 2]
cmp r8w, bp
jb 0x14016a702
movzx eax, r8w
sub eax, ebp
shl edx, 0xa
or eax, edx
add eax, 0x10000
movzx ecx, ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x14016a730
movzx eax, word [rbx]
lea rbx, [rdi + 2]
mov rcx, rbx
cmp ax, r15w
jb 0x14016a6d3
cmp ax, r14w
ja 0x14016a6d3
cmp word [rbx], bp
jb 0x14016a6d3
add rbx, 2
jmp 0x14016a6d0
mov qword [rsp + 0x88], rbx
lea rdx, [rsp + 0x88]
mov rcx, rsi
call fcn.14001ba80
nop
mov dword [rsp + 0x20], 1
mov rax, rsi
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140192a70
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rdi
push r13
push r15
sub rsp, 0x30
mov r13d, dword [rcx + 0x64]
mov r8d, 0x2fe
mov rbx, qword [rcx + 0x250]
cmp r13d, 1
mov edx, 1
mov qword [rsp + 0x68], rbx
sete al
mov rdi, rcx
mov byte [rbx + 0x38], al
mov rax, qword [rcx + 8]
mov r9d, dword [rcx + 0x7c]
mov r10, qword [rax + 0x10]
mov eax, 0x100
cmovne r8d, eax
call r10
mov ebp, dword [rbx + 0x28]
xor r15d, r15d
mov qword [rbx + 0x30], rax
cmp dword [rdi + 0x7c], r15d
jle 0x140192bf1
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x28], r12
lea r12, [rbx + 0x3c]
mov qword [rsp + 0x20], r14
xor r14d, r14d
nop word [rax + rax]
mov esi, dword [r12]
mov eax, ebp
cdq
idiv esi
mov ebp, eax
cmp r13d, 1
jne 0x140192b0d
mov rax, qword [rbx + 0x30]
add qword [r14 + rax], 0xff
mov rax, qword [rbx + 0x30]
lea r11d, [rsi*2 - 2]
xor r8d, r8d
xor r10d, r10d
mov rdi, qword [r14 + rax]
lea eax, [rsi + 0xfe]
cdq
idiv r11d
xor ebx, ebx
mov r9d, eax
cmp r10d, r9d
jle 0x140192b67
imul eax, r8d, 0x1fe
lea ecx, [rsi + 0xfe]
add ecx, eax
nop word [rax + rax]
add ecx, 0x1fe
inc r8d
mov eax, ecx
cdq
idiv r11d
mov r9d, eax
cmp r10d, eax
jg 0x140192b50
movzx eax, bpl
inc r10d
movzx ecx, r8b
imul ecx, eax
mov byte [rbx + rdi], cl
inc rbx
cmp rbx, 0xff
jle 0x140192b32
cmp r13d, 1
jne 0x140192bc3
mov ecx, r13d
lea rdx, [rdi - 1]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi]
mov byte [rdx], al
lea rdx, [rdx - 1]
movzx eax, byte [rdi + 0xff]
mov byte [rdi + rcx + 0xff], al
inc rcx
cmp rcx, 0xff
jle 0x140192ba0
mov rax, qword [rsp + 0x60]
inc r15d
mov rbx, qword [rsp + 0x68]
add r12, 4
add r14, 8
cmp r15d, dword [rax + 0x7c]
jl 0x140192af0
mov r14, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r13
pop rdi
pop rbp
pop rbx
ret
Function at 0x1401930a0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, rcx
mov qword [rcx + 8], rsi
mov ecx, 0x98
mov dword [rsp + 0x38], esi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x1401930e7
mov rdx, qword [rdi]
mov dword [rdx + 0x28], 0x36
mov rcx, qword [rdi]
mov dword [rcx + 0x2c], esi
mov rcx, rdi
mov rdx, qword [rdi]
call qword [rdx]
mov dword [rbx + 0x5c], 0x3b9aca00
lea rax, [fcn.140194130]
mov qword [rbx], rax
lea rcx, str.JPEGMEM
lea rax, [fcn.140194030]
mov qword [rbx + 8], rax
lea rax, [fcn.140193f40]
mov qword [rbx + 0x10], rax
lea rax, [fcn.140193e50]
mov qword [rbx + 0x18], rax
lea rax, [0x140193da0]
mov qword [rbx + 0x20], rax
lea rax, [0x140193cf0]
mov qword [rbx + 0x28], rax
lea rax, [0x140193b40]
mov qword [rbx + 0x30], rax
lea rax, [0x140193750]
mov qword [rbx + 0x38], rax
lea rax, [0x1401934d0]
mov qword [rbx + 0x40], rax
lea rax, [0x140193390]
mov qword [rbx + 0x48], rax
lea rax, [0x140193210]
mov qword [rbx + 0x50], rax
mov eax, dword [rsp + 0x38]
mov dword [rbx + 0x58], eax
mov qword [rbx + 0x68], rsi
mov qword [rbx + 0x78], rsi
mov qword [rbx + 0x60], rsi
mov qword [rbx + 0x70], rsi
mov qword [rbx + 0x80], rsi
mov qword [rbx + 0x88], rsi
mov dword [rbx + 0x90], 0x98
mov qword [rdi + 8], rbx
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1401931ef
lea r9, [rsp + 0x30]
mov byte [rsp + 0x30], 0x78
lea r8, [rsp + 0x38]
mov rcx, rax
lea rdx, str._ld_c
call fcn.140023c10
test eax, eax
jle 0x1401931ef
movzx eax, byte [rsp + 0x30]
sub al, 0x4d
test al, 0xdf
jne 0x1401931e2
imul eax, dword [rsp + 0x38], 0x3e8
jmp 0x1401931e6
mov eax, dword [rsp + 0x38]
imul eax, eax, 0x3e8
mov dword [rbx + 0x58], eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1401a2600
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x20
xor ebp, ebp
mov rbx, rcx
cmp dword [rcx + 0x24], 0xcc
je 0x1401a262e
mov rax, qword [rcx + 0x200]
call qword [rax]
mov dword [rbx + 0x98], ebp
mov dword [rbx + 0x24], 0xcc
mov rax, qword [rbx + 0x200]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
cmp byte [rax + 0x10], bpl
je 0x1401a26d5
mov ecx, dword [rbx + 0x98]
nop
cmp ecx, dword [rbx + 0x78]
jae 0x1401a26a4
mov rax, qword [rbx + 0x10]
mov edi, ecx
test rax, rax
je 0x1401a267c
mov dword [rax + 8], ecx
mov rcx, qword [rbx + 0x10]
mov eax, dword [rbx + 0x78]
mov dword [rcx + 0xc], eax
mov rcx, rbx
mov rax, qword [rbx + 0x10]
call qword [rax]
mov edi, dword [rbx + 0x98]
mov rax, qword [rbx + 0x208]
lea r8, [rbx + 0x98]
xor r9d, r9d
xor edx, edx
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ecx, dword [rbx + 0x98]
cmp ecx, edi
je 0x1401a26fd
cmp ecx, dword [rbx + 0x78]
jb 0x1401a2655
mov rax, qword [rbx + 0x200]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx + 0x200]
mov rcx, rbx
call qword [rax]
mov dword [rbx + 0x98], ebp
mov ecx, ebp
mov rax, qword [rbx + 0x200]
cmp byte [rax + 0x10], cl
jne 0x1401a2650
cmp byte [rbx + 0x59], bpl
mov al, 1
setne bpl
add ebp, 0xcd
mov dword [rbx + 0x24], ebp
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret
xor al, al
jmp 0x1401a26e8
Function at 0x1401aecf0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x30], 0xfffffffffffffffe
movaps xmmword [rsp + 0x60], xmm6
movaps xmm6, xmm1
mov rax, qword [rcx]
test rax, rax
jne 0x1401aed11
xor edx, edx
jmp 0x1401aed17
mov edx, dword [rax + 0x18]
mov eax, dword [rax + 0x14]
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x50], edx
mov qword [rsp + 0x58], 0
mov rcx, qword [rcx]
mov rax, qword [rcx]
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x38]
call qword [rax + 0x20]
nop
mov ecx, dword [rsp + 0x40]
sub ecx, 1
je 0x1401aee8e
sub ecx, 1
je 0x1401aedda
cmp ecx, 1
jne 0x1401aee8e
xor r9d, r9d
mov r10d, dword [rsp + 0x50]
test r10d, r10d
jle 0x1401aee8e
mov r8d, dword [rsp + 0x4c]
nop word [rax + rax]
mov eax, dword [rsp + 0x44]
imul eax, r9d
movsxd rcx, eax
add rcx, qword [rsp + 0x38]
xor edx, edx
test r8d, r8d
jle 0x1401aedcd
nop word [rax + rax]
movzx eax, byte [rcx]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm6
cvttss2si eax, xmm0
mov byte [rcx], al
movsxd rax, dword [rsp + 0x48]
add rcx, rax
inc edx
mov r8d, dword [rsp + 0x4c]
cmp edx, r8d
jl 0x1401aeda0
mov r10d, dword [rsp + 0x50]
inc r9d
cmp r9d, r10d
jl 0x1401aed80
jmp 0x1401aee8e
xor r10d, r10d
mov ecx, dword [rsp + 0x50]
test ecx, ecx
jle 0x1401aee8e
movss xmm1, dword [0x1403a8e34]
mov edx, dword [rsp + 0x4c]
nop word [rax + rax]
mov eax, dword [rsp + 0x44]
imul eax, r10d
movsxd r8, eax
add r8, qword [rsp + 0x38]
xor r11d, r11d
test edx, edx
jle 0x1401aee82
movaps xmm0, xmm6
mulss xmm0, xmm1
cvttss2si eax, xmm0
mov r9d, 1
sub r9d, eax
nop dword [rax + rax]
mov ecx, dword [r8]
mov edx, ecx
and edx, 0xff00ff
imul edx, r9d
shr edx, 8
mov eax, ecx
shr eax, 8
and eax, 0xffff00ff
imul eax, r9d
xor edx, eax
and edx, 0xff00ff
shr ecx, 8
and ecx, 0xff00ff
imul ecx, r9d
xor edx, ecx
mov dword [r8], edx
movsxd rax, dword [rsp + 0x48]
add r8, rax
inc r11d
mov edx, dword [rsp + 0x4c]
cmp r11d, edx
jl 0x1401aee30
mov ecx, dword [rsp + 0x50]
inc r10d
cmp r10d, ecx
jl 0x1401aee00
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1401aeea2
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
ret