joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b4520
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [0x140130d00]
mov r10, rcx
mov r9, qword [rcx + 0x188]
movsxd rax, edx
imul rbx, rax, 0x70
add rbx, qword [rcx + 0x18]
mov dword [rcx + 0x74], edx
test dword [rbx], 0x10000
movss xmm2, dword [rbx + 0x34]
je 0x1400b4563
addss xmm2, dword [rcx + 0x90]
movaps xmm0, xmm2
lea rsi, [r9 + 0x140]
subss xmm0, dword [r9 + 0x58]
movss dword [rsi], xmm2
movss xmm1, dword [rcx + 0x88]
addss xmm1, dword [rcx + 0x7c]
movss dword [r9 + 0x158], xmm2
subss xmm0, dword [r9 + 0x184]
movss dword [r9 + 0x148], xmm2
movss dword [r9 + 0x144], xmm1
movss dword [r9 + 0x188], xmm0
mov eax, dword [rcx + 0x8c]
mov dword [r9 + 0x178], eax
movsx eax, byte [rbx + 0x6a]
mov dword [r9 + 0x198], eax
movss dword [r9 + 0x25c], xmm1
mov eax, dword [rbx + 0x34]
mov dword [r9 + 0x258], eax
mov eax, dword [rbx + 0x38]
mov dword [r9 + 0x260], eax
mov eax, dword [rbx + 0x3c]
mov dword [r9 + 0x1fc], eax
movzx eax, byte [rbx + 0x68]
mov byte [r9 + 0xf8], al
cmp byte [rbx + 0x68], 0
je 0x1400b460f
xor eax, eax
mov dword [rdi + 0x4af0], eax
mov dword [rdi + 0x4af8], eax
test dword [rcx + 4], 0x100000
je 0x1400b4623
mov r8d, 2
jmp 0x1400b46a3
movups xmm0, xmmword [rbx + 0x20]
mov rax, qword [r9 + 0x2e0]
movss xmm4, dword [rbx + 0x20]
movss xmm3, dword [rbx + 0x24]
movss xmm2, dword [rbx + 0x28]
movss xmm1, dword [rbx + 0x2c]
movups xmmword [r9 + 0x278], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x2e0]
movups xmm0, xmmword [rsp + 0x20]
movsxd rdx, dword [rax + 0x58]
mov rcx, qword [rax + 0x60]
add rdx, rdx
movups xmmword [rcx + rdx*8 - 0x10], xmm0
movzx r8d, word [rbx + 0x5c]
mov rdx, qword [r9 + 0x2e0]
mov rcx, qword [r10 + 0x1a0]
call fcn.1400a4f90
cmp byte [rdi + 0x6230], 0
je 0x1400b46e1
cmp byte [rbx + 0x68], 0
jne 0x1400b46e1
xor r8d, r8d
lea rdx, [0x140112348]
mov rcx, rsi
call fcn.1400540f0
mov dword [rdi + 0x6260], 0x7f7fffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400b4b30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140130d00]
mov rcx, qword [rax + 0x4ff0]
mov r9, qword [rax + 0x4140]
movups xmm0, xmmword [r9 + 0x278]
movups xmmword [rcx + 0x170], xmm0
mov rax, qword [r9 + 0x2e0]
movups xmm0, xmmword [rcx + 0x150]
movss xmm4, dword [rcx + 0x150]
movss xmm3, dword [rcx + 0x154]
movss xmm2, dword [rcx + 0x158]
movss xmm1, dword [rcx + 0x15c]
movups xmmword [r9 + 0x278], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x2e0]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, word [rcx + 0x232]
mov rcx, qword [rcx + 0x1a0]
mov rdx, qword [r9 + 0x2e0]
add rsp, 0x38
jmp fcn.1400a4f90

Function at 0x1400b4c10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140130d00]
mov rcx, qword [rax + 0x4ff0]
mov r10, qword [rax + 0x4140]
movsxd rax, dword [rcx + 0x74]
movups xmm0, xmmword [rcx + 0x170]
movss xmm4, dword [rcx + 0x170]
movss xmm3, dword [rcx + 0x174]
movss xmm2, dword [rcx + 0x178]
movss xmm1, dword [rcx + 0x17c]
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
imul r9, rax, 0x70
mov rax, qword [r10 + 0x2e0]
add r9, qword [rcx + 0x18]
movups xmmword [r10 + 0x278], xmm0
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r10 + 0x2e0]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, word [r9 + 0x5c]
mov rdx, qword [r10 + 0x2e0]
mov rcx, qword [rcx + 0x1a0]
add rsp, 0x38
jmp fcn.1400a4f90

Function at 0x1400b7c30
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [0x140130d00]
mov rdx, qword [rax + 0x4ff0]
cmp ecx, 0xffffffff
jne 0x1400b7c4a
cmp dword [rdx + 0x74], ecx
cmovne ecx, dword [rdx + 0x74]
cmp ecx, dword [rdx + 0x6c]
mov eax, 0xffffffff
cmove ecx, eax
test byte [rdx + 4], 7
je 0x1400b7cc9
mov r10d, dword [rdx]
lea r8, [0x140112391]
movzx eax, word [rdx + 0x78]
lea r11, [0x1400f0a50]
not r10d
mov word [rdx + 0x224], cx
mov ecx, r10d
mov byte [rdx + 0x23b], 1
mov word [rdx + 0x7a], ax
mov r9b, 0x23
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x1400b7ca3
cmp byte [r8], r9b
jne 0x1400b7ca3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400b7c90
not ecx
xor edx, edx
jmp fcn.14004e0d0
ret
Function at 0x1400d58d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov r11, qword [0x140130d00]
movaps xmmword [rsp + 0x30], xmm6
mov rdi, r11
mov rax, qword [r11 + 0x4c88]
mov rbx, qword [rax]
test rbx, rbx
je 0x1400d5907
mov eax, dword [r11 + 0x4098]
mov dword [rbx + 0x6c], eax
cmp qword [r11 + 0x4c98], rbx
je 0x1400d5952
test rbx, rbx
je 0x1400d5940
mov eax, dword [rbx + 0x28]
mov dword [r11 + 0x4c90], eax
mov rax, qword [r11 + 0x39a0]
mov qword [r11 + 0x4c98], rbx
test rax, rax
je 0x1400d5952
mov rcx, rbx
call rax
mov r11, qword [0x140130d00]
jmp 0x1400d5952
mov dword [r11 + 0x4c90], 0x3f800000
mov qword [r11 + 0x4c98], rbx
movss xmm1, dword [rdi + 0x3ac8]
lea r8, [0x1400fd641]
subss xmm1, dword [rdi + 0x3a38]
movss xmm0, dword [rdi + 0x3ac4]
lea rsi, [0x1400f0a50]
movss dword [rdi + 0x4bd4], xmm0
xorps xmm6, xmm6
mov r10d, 0xffffffff
mov r9b, 0x23
mov edx, r10d
maxss xmm1, xmm6
movss dword [rdi + 0x4bd8], xmm1
movss xmm5, dword [r11 + 0x3a38]
addss xmm5, xmm5
addss xmm5, dword [r11 + 0x3e78]
cmp r9b, 0x23
jne 0x1400d59c4
cmp byte [r8], r9b
jne 0x1400d59c4
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [rsi + rcx*4]
test r9b, r9b
jne 0x1400d59b1
not edx
lea rcx, [r11 + 0x4120]
call fcn.140037320
mov rcx, rax
test rbx, rbx
jne 0x1400d5a00
mov rax, qword [r11 + 0x4c88]
mov rbx, qword [rax]
xor esi, esi
test rcx, rcx
je 0x1400d5a14
cmp word [rcx + 0x100], si
jne 0x1400d5ab2
movss xmm1, dword [rbx + 0x130]
movaps xmm3, xmm6
movss xmm0, dword [rbx + 0x10]
movaps xmm4, xmm1
addss xmm4, dword [rbx + 8]
movss xmm2, dword [rbx + 0x134]
subss xmm0, xmm1
addss xmm2, dword [rbx + 0xc]
addss xmm0, dword [rbx + 0x138]
or dword [r11 + 0x4b40], 3
movss dword [r11 + 0x4b54], xmm4
movss dword [r11 + 0x4b58], xmm2
movss dword [r11 + 0x4b68], xmm5
maxss xmm3, xmm0
mov qword [r11 + 0x4b5c], rsi
mov dword [r11 + 0x4b44], 1
mov byte [r11 + 0x4b80], 1
mov dword [r11 + 0x4b48], 1
addss xmm3, xmm4
subss xmm3, xmm4
movss dword [r11 + 0x4b64], xmm3
addss xmm5, dword [rbx + 0x134]
movss dword [rbx + 0x134], xmm5
mov eax, dword [rbx]
movaps xmm1, xmm6
or dword [r11 + 0x4b40], 0x200
mov ecx, 3
mov dword [r11 + 0x4bac], eax
call fcn.140038d90
mov rbx, qword [0x140130d00]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 5
movss xmm1, dword [rbx + 0x3a10]
lea rcx, [rbx + 0x4bf8]
movss xmm0, dword [rbx + 0x3a14]
movss dword [rsp + 0x24], xmm1
movss dword [rsp + 0x28], xmm0
call fcn.14006c850
xor edx, edx
mov qword [rbx + 0x3a10], rsi
mov r8d, 0x8050f
lea rcx, str.MainMenuBar
call fcn.140044fa0
mov ecx, 2
movzx ebx, al
call fcn.140038ea0
mov qword [rdi + 0x4bd4], rsi
test bl, bl
je 0x1400d5b49
call fcn.1400d5440
jmp 0x1400d5b4e
call fcn.140047f90
mov rsi, qword [rsp + 0x58]
movzx eax, bl
mov rbx, qword [rsp + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rdi
ret
Function at 0x1400e924c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400e92d0
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400ef9f0]
cmp byte [rcx + rax], 0
je 0x1400e92d0
dec r8
sub rdx, 1
jne 0x1400e92b6
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1400ea748
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400ea792
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400ea792
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400ea792
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400ea792
cmp dword [rcx + 0x84], 0xe
jbe 0x1400ea792
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400ea794
xor al, al
add rsp, 0x28
ret
Function at 0x140002060
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov eax, dword [rcx + 0x48]
lea rbx, [rcx + 0x28]
mov rdi, qword [rcx]
lea r11, [rcx + 0x28]
add rbx, rax
mov r9, rcx
movabs rbp, 0xc2b2ae3d27d4eb4f
movabs rsi, 0x9e3779b185ebca87
movabs r14, 0x27d4eb2f165667c5
movabs r15, 0x7a1435883d4d519d
cmp rdi, 0x20
jb 0x140002159
mov r8, qword [r9 + 0x18]
mov rdx, qword [rcx + 8]
mov rax, r8
mov r9, qword [r9 + 0x20]
mov rcx, qword [rcx + 0x10]
mov r10, r9
rol r10, 0x12
rol rax, 0xc
add r10, rax
mov rax, rcx
rol rax, 7
add r10, rax
mov rax, rdx
rol rax, 1
add r10, rax
movabs rax, 0x85ebca77c2b2ae63
imul rdx, rbp
imul rcx, rbp
imul r8, rbp
imul r9, rbp
rol rdx, 0x1f
imul rdx, rsi
rol rcx, 0x1f
xor r10, rdx
rol r8, 0x1f
imul r10, rsi
imul rcx, rsi
imul r8, rsi
sub r10, r15
rol r9, 0x1f
xor r10, rcx
imul r10, rsi
imul r9, rsi
sub r10, r15
xor r10, r8
imul r10, rsi
sub r10, r15
xor r10, r9
imul r10, rsi
add rax, r10
add rax, rdi
jmp 0x140002161
lea rax, [rdi + r14]
add rax, qword [rcx + 0x18]
lea rdx, [r11 + 8]
cmp rdx, rbx
ja 0x14000219a
nop word [rax + rax]
mov rcx, qword [r11]
add rdx, 8
imul rcx, rbp
add r11, 8
rol rcx, 0x1f
imul rcx, rsi
xor rax, rcx
rol rax, 0x1b
imul rax, rsi
sub rax, r15
cmp rdx, rbx
jbe 0x140002170
lea rdx, [r11 + 4]
movabs r8, 0x165667b19e3779f9
cmp rdx, rbx
ja 0x1400021c5
mov ecx, dword [r11]
mov r11, rdx
imul rcx, rsi
xor rax, rcx
rol rax, 0x17
imul rax, rbp
add rax, r8
cmp r11, rbx
jae 0x1400021eb
nop word [rax + rax]
movzx ecx, byte [r11]
inc r11
imul rcx, r14
xor rax, rcx
rol rax, 0xb
imul rax, rsi
cmp r11, rbx
jb 0x1400021d0
mov rbx, qword [rsp + 0x18]
mov rcx, rax
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
shr rcx, 0x21
xor rcx, rax
imul rcx, rbp
mov rbp, qword [rsp + 0x20]
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
ret

Function at 0x14000a500
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
mov edi, 0x28
test al, al
je 0x14000a5b1
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.1400109b0
cmp rax, 1
jne 0x14000a5e7
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x14000a58d
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x14000a580
cmp rcx, 1
jb 0x14000a5e7
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x14000a550
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14000ce90
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.140010674
int3
Function at 0x14000a670
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, r8
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000a6b5
xor al, al
jmp 0x14000a702
cmp word [rbx], 0
je 0x14000a6cd
nop dword [rax + rax]
add rbx, 2
dec rdi
cmp word [rbx], 0
jne 0x14000a6c0
cmp word [rsp + 0x30], 0
je 0x14000a6fb
lea rcx, [rsp + 0x30]
sub rcx, rbx
nop dword [rax]
cmp rdi, 1
jb 0x14000a723
movzx eax, word [rcx + rbx]
dec rdi
mov word [rbx], ax
add rbx, 2
cmp word [rcx + rbx], 0
jne 0x14000a6e0
xor eax, eax
mov word [rbx], ax
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000ce90
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
call fcn.140010674
int3
Function at 0x14000b580
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
mov rcx, qword [0x140030dd8]
test rcx, rcx
je 0x14000b5bb
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000b5ae
mov rcx, qword [0x140030dd8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x140030dd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x140049e18], 0
je 0x14000b6ae
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x14002a9c8]
mov qword [rsp + 0x80], rsi
lea rsi, [0x140043610]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000b68f
test al, 0x10
je 0x14000b68f
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000b635
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x14000d750
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000d79a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000d79a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000d79a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000d79a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000d79a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000d79c
xor al, al
add rsp, 0x28
ret

Function at 0x140010464
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400104d3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400104d3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400104d3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400104d3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400104d3
cmp dword [rcx + 0x84], 0xe
jbe 0x1400104d3
cmp dword [rcx + 0xf8], 0
je 0x1400104d3
mov ecx, ebx
call fcn.140010584
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140010360
nop
cmp dword [rbp + 0x20], 0
je 0x140010521
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14001052c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140010464

Function at 0x140010668
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400104d3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400104d3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400104d3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400104d3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400104d3
cmp dword [rcx + 0x84], 0xe
jbe 0x1400104d3
cmp dword [rcx + 0xf8], 0
je 0x1400104d3
mov ecx, ebx
call fcn.140010584
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140010360
nop
cmp dword [rbp + 0x20], 0
je 0x140010521
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14001052c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140010464
Function at 0x140019c54
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140019cdb
mov rsi, rbx
cmp word [rax], bp
je 0x140019c9a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140019c84
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140019c80
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140017484
mov rdi, rax
test rax, rax
je 0x140019cc8
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140020ec0
mov rbp, rdi
xor ecx, ecx
call fcn.1400164a8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001c2a4
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001c2ba
mov al, 1
jmp 0x14001c31a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001c2cb
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001c318
mov ecx, dword [rcx + 0x18]
nop
call fcn.14001a3f8
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001c318
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001c318
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001c318
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001c31a
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x140020730
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140020758
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140020758
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140668058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1406681df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140668089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14066806f
add dl, dl
jne 0x140668096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406680f6
xor eax, eax
add dl, dl
jne 0x1406680a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406681ad
add dl, dl
jne 0x1406680b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406680c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406680d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406680dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406680ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14066807e
mov eax, 1
add dl, dl
jne 0x140668106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140668113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406680fb
sub eax, ebx
mov ebx, 1
jne 0x14066814c
mov ecx, 1
add dl, dl
jne 0x14066812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14066813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140668123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14066807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140668168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140668175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14066815d
cmp eax, 0x7d00
jae 0x14066819b
cmp eax, 0x500
jb 0x140668196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14066807e
cmp eax, 0x7f
ja 0x14066819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14066807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406681d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14066807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400035a0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x1400114e0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov edi, edx
mov rbx, rcx
call sub.LIBPQ.dll_Ordinal_16
mov rcx, rbx
test eax, eax
jns 0x14000360c
call sub.LIBPQ.dll_Ordinal_15
lea rcx, str._s:_invalid_socket:__s
mov rdi, rax
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov r8, qword [0x1400123d8]
lea rcx, [rax + 0x60]
mov r9, rdi
mov rdx, rbx
call fcn.140007ec0
or eax, 0xffffffff
jmp 0x1400036bb
mov qword [rsp + 0x280], rsi
xor esi, esi
mov dword [rsp + 0x40], esi
call sub.LIBPQ.dll_Ordinal_16
inc dword [rsp + 0x40]
movsxd rcx, eax
mov qword [rsp + 0x48], rcx
test edi, edi
js 0x14000365b
mov eax, 0x10624dd3
lea rsi, [rsp + 0x30]
imul edi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [rsp + 0x30], edx
imul eax, edx, 0x3e8
sub edi, eax
imul eax, edi, 0x3e8
mov dword [rsp + 0x34], eax
mov rcx, rbx
call sub.LIBPQ.dll_Ordinal_16
lea rdx, [rsp + 0x40]
xor r9d, r9d
lea ecx, [rax + 1]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.WS2_32.dll_select]
mov rsi, qword [rsp + 0x280]
test eax, eax
je 0x1400036b9
jns 0x1400036b2
call qword [sym.imp.MSVCR120.dll__errno]
cmp dword [rax], 0x2714
je 0x1400036b9
call qword [sym.imp.MSVCR120.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.MSVCR120.dll_strerror]
lea rcx, str._s:_select___failed:__s_n
jmp 0x1400035dc
mov eax, 1
jmp 0x1400036bb
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14000adb0
mov rbx, qword [rsp + 0x288]
add rsp, 0x260
pop rdi
ret