joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a7c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x1401970d0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov r15, r8
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x78], r8
xor ebx, ebx
mov rcx, qword [rcx + 0x10]
mov rdx, qword [rdx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, rdx
jb 0x14001a94d
mov r9, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x14001a829
mov r9, qword [rsi]
mov rax, r14
cmp qword [r14 + 0x18], 0x10
jb 0x14001a836
mov rax, qword [r14]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x48]
call fcn.14001f690
nop
mov rdx, r15
cmp qword [r15 + 0x18], 0x10
jb 0x14001a85d
mov rdx, qword [r15]
mov r8, qword [r15 + 0x10]
lea rcx, [rsp + 0x48]
call fcn.14000e820
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0xa0], xmm0
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x48]
call fcn.14000e730
lea rdx, [rsp + 0x90]
movups xmm1, xmmword [rsp + 0x68]
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0x10
cmovae rdx, qword [rsp + 0x78]
movabs rdi, 0xcbf29ce484222325
movq rcx, xmm1
test rcx, rcx
je 0x14001a903
movabs r8, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [rbx + rdx]
xor rdi, rax
imul rdi, r8
inc rbx
cmp rbx, rcx
jb 0x14001a8f0
lea rcx, [rsp + 0x90]
call fcn.14000e730
nop
mov rcx, rsi
call fcn.14000e730
nop
mov rcx, r14
call fcn.14000e730
nop
mov rcx, r15
call fcn.14000e730
mov rax, rdi
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14010a950
add rsp, 0xc0
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
call fcn.14000e0c0
nop
int3
Function at 0x14001aa70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x58]
xor r15d, r15d
mov r11, qword [rsp + 0x70]
mov r13, rdx
mov rax, qword [rsp + 0x60]
mov qword [r14], r8
mov qword [r11], rax
mov rdi, qword [r14]
cmp rdi, r9
je 0x14001ac03
mov r12, qword [rsp + 0x68]
lea r8d, [r15 + 1]
mov rsi, qword [r11]
mov r9d, 0x3ff
mov r10d, 0x2400
mov ebx, 0x2800
cmp rsi, r12
je 0x14001ac03
movzx edx, word [r13]
xor bpl, bpl
movzx ecx, word [rdi]
cmp r8w, dx
jae 0x14001ab09
lea eax, [r10 + rcx]
cmp ax, r9w
ja 0x14001ac27
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x14001ab1f
mov eax, ecx
add cx, bx
cmp cx, r9w
ja 0x14001ab1f
shl eax, 0xa
mov bpl, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x14001ab32
movzx r9d, al
mov r10d, r15d
mov ebx, r15d
jmp 0x14001ab7d
mov r9d, eax
cmp eax, 0x800
jae 0x14001ab4c
shr r9d, 6
mov r10d, r8d
or r9b, 0xc0
mov ebx, r8d
jmp 0x14001ab7d
cmp eax, 0x10000
jae 0x14001ab66
shr r9d, 0xc
mov r10d, 2
or r9b, 0xe0
mov ebx, r10d
jmp 0x14001ab7d
shr r9d, 0x12
mov r10d, 3
movzx ebx, bpl
or r9b, 0xf0
xor ebx, 1
add ebx, ebx
lea r8d, [rbx + 1]
mov rdx, r12
sub rdx, rsi
mov ecx, r8d
cmp rdx, rcx
jl 0x14001ac03
lea rcx, [rdi + 2]
mov qword [r14], rcx
test bpl, bpl
jne 0x14001aba1
cmp r10d, 3
jae 0x14001abad
mov rcx, qword [r11]
mov r8d, ebx
mov byte [rcx], r9b
inc qword [r11]
mov r9, qword [r11]
test r8d, r8d
jle 0x14001abde
lea ecx, [r10 + r10*2]
add ecx, ecx
nop dword [rax + rax]
sub ecx, 6
mov edx, eax
shr edx, cl
dec r8d
and dl, 0x3f
or dl, 0x80
mov byte [r9], dl
inc qword [r11]
mov r9, qword [r11]
test r8d, r8d
jg 0x14001abc0
shr eax, 0xa
mov r8d, 1
test bpl, bpl
mov ecx, r8d
cmovne ecx, eax
mov word [r13], cx
mov rdi, qword [r14]
cmp rdi, qword [rsp + 0x50]
jne 0x14001aabe
mov rax, qword [rsp + 0x48]
cmp rax, qword [r14]
sete r15b
mov eax, r15d
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov eax, 2
jmp 0x14001ac12
Function at 0x14002e320
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x14002e342
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14002e3bc
mov rdi, r14
mov rcx, rbx
call fcn.140030df0
test rax, rax
jle 0x14002e394
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.14010e4d0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14002e3ac
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14002e3b4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x14002e356
sub r14, rdi
jmp 0x14002e49f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14002e3d3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14002e3d5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14002e407
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.14010e4d0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14002e49c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14002e442
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14002e47d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.14011f8d4
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14002e49c
cmp rbp, rax
ja 0x14002e450
test rbp, rbp
je 0x14002e49c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.14011f8d4
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x14003d9b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1401970d0]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov dword [rsp + 0x3c], 4
cmp qword [rcx + 0x18], 8
mov rdi, rdx
mov rsi, rcx
mov dword [rsp + 0x38], ebx
mov rdx, rcx
jb 0x14003d9ef
mov rdx, qword [rcx]
lea rax, [rsp + 0x30]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003da5b
cmp qword [rdi + 0x18], 8
mov rdx, rdi
jb 0x14003da20
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003da5b
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x30], rbx
jmp 0x14003da60
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [rsp + 0x38]
mov rcx, rsi
call fcn.14000e6a0
mov rcx, rdi
call fcn.14000e6a0
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14010a950
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14005d6e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x4a0
mov rax, qword [0x1401970d0]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov rbx, rcx
mov qword [rsp + 0x50], rcx
xor edi, edi
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 7
mov word [rcx], di
add rcx, 0x20
lea edx, [rdi + 2]
call fcn.1400e91b0
nop
mov dword [rbx + 0x70], 0x409
mov qword [rbx + 0x78], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movdqa xmm1, xmmword [0x14016f780]
movdqu xmmword [rsp + 0x78], xmm1
mov word [rsp + 0x68], di
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
xor r8d, r8d
lea rdx, str.SOFTWAREASUSArmouryDevice
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005d7f5
mov dword [rsp + 0x60], 0x400
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Installation_location
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14005d7f5
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea rax, [rsp + 0x90]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14005d7e0
lea rdx, [rsp + 0x90]
jmp 0x14005d82a
call fcn.1400647c0
mov rcx, rax
mov r8b, 1
lea rdx, str._LanguageManager__Get_dll_install_path_fail._rerun_default_path.
call fcn.140063fc0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, 0x29
lea rdx, str.C:Program_Files__x86_ASUSArmouryDevice
lea rcx, [rsp + 0x30]
call fcn.14001e400
nop
lea rcx, [rsp + 0x68]
call fcn.14000e6a0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14001be40
lea rcx, [rsp + 0x30]
call fcn.14000e6a0
mov rcx, rbx
call fcn.14005df70
mov rcx, rbx
call fcn.14005d890
nop
mov rax, rbx
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.14010a950
mov rbx, qword [rsp + 0x4b8]
add rsp, 0x4a0
pop rdi
ret
Function at 0x14005edf0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, rdx
mov rbx, rcx
test rdi, rdi
je 0x14005eea5
cmp qword [rdi], 0
mov rbx, qword [rcx]
je 0x14005ee71
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005ee90
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005ee90
mov rdx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rcx, rbx
mov rdx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rdi + 8], 0
je 0x14005ee90
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp byte [0x1401a5dd8], 0
jne 0x14005eef0
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005eee0
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401a5dd0], rax
mov byte [0x1401a5dd8], 1
jmp 0x14005eef7
mov rax, qword [0x1401a5dd0]
mov byte [0x1401a5dd8], 1
jmp 0x14005eef7
mov rax, qword [0x1401a5dd0]
mov rcx, qword [rbx]
mov rdx, rsi
test rax, rax
je 0x14005ee7a
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp rax
Function at 0x14005f020
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1401970d0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r9d, dword [rcx + 8]
xor ebp, ebp
mov rsi, rdx
mov qword [rsp + 0x48], rbp
mov r8, rdx
mov qword [rsp + 0x40], rbp
mov rdx, qword [rcx]
mov rdi, rcx
or r9d, 0x2001f
mov qword [rsp + 0x50], rbp
lea rcx, [rsp + 0x40]
call fcn.14005ef20
mov ebx, eax
test eax, eax
jne 0x14005f137
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x58]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x58], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14005f111
nop dword [rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.14005f020
mov ebx, eax
test eax, eax
jne 0x14005f137
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x58]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x58], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14005f0c0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14005f126
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
mov rdx, rsi
mov dword [rsp + 0x48], ebp
mov rcx, rdi
call fcn.14005edf0
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14005f147
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14010a950
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005f6b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x1401970d0]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
xor edx, edx
mov r8d, 0x408
lea rcx, [rsp + 0x60]
call fcn.14010eb70
mov qword [rsp + 0x60], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14005f747
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14005f747
call fcn.14005ebb0
mov ebx, eax
jmp 0x14005f86c
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x14005f768
call fcn.14005ebb0
jmp 0x14005f85b
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x14005f78b
call fcn.14005ebb0
jmp 0x14005f85b
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x14005f7ad
mov ebx, 0x8007000e
jmp 0x14005f85d
mov ecx, eax
test eax, eax
je 0x14005f7e2
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x14005f8a4
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x14005f7e2
lea rcx, [rsp + 0x60]
call fcn.140063270
jmp 0x14005f7ec
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
jmp 0x14005f7ff
cmp qword [rsp + 0x60], 0
jne 0x14005f80e
mov ebx, 0x8007000e
jmp 0x14005f85d
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x14005f838
call fcn.14005ebb0
jmp 0x14005f85b
mov ecx, eax
mov rax, qword [rsp + 0x60]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.1400605d0
mov ebx, eax
test rdi, rdi
je 0x14005f86c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x60], rax
je 0x14005f883
lea rcx, [rsp + 0x60]
call fcn.140063260
nop
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.14010a950
add rsp, 0x480
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80070216
call fcn.140016430
int3
Function at 0x1400635d0
Capabilities:
Create directory
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1401970d0]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx esi, dl
mov rbx, rcx
mov qword [rsp + 0x68], rcx
cmp qword [rcx + 0x18], 8
jb 0x140063606
mov rcx, qword [rcx]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
setne dil
test eax, eax
jne 0x1400636cd
test sil, sil
je 0x1400636cd
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140063630
mov rdx, qword [rbx]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
sete dil
test eax, eax
je 0x1400636cd
mov edx, eax
lea rcx, [rsp + 0x48]
call fcn.140014900
nop
mov r9d, Ordinal_63
lea r8, str._ArmourySocketServer___Logger__IsFolderExisted___errCode_
mov rcx, rax
call fcn.14001f910
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x38], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x28]
call fcn.14000e730
nop
lea rcx, [rsp + 0x48]
call fcn.14000e730
nop
mov rcx, rbx
call fcn.14000e6a0
movzx eax, dil
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14010a950
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140063fc0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x1401970d0]
xor rax, rsp
mov qword [rsp + 0x88], rax
movzx esi, r8b
mov rdi, rdx
mov rbp, rcx
lea r14, [0x1401a5a00]
mov qword [rsp + 0x20], r14
mov rcx, r14
call fcn.1400e91cc
test eax, eax
jne 0x140064183
mov eax, dword [0x1401a5a4c]
cmp eax, 0x7fffffff
je 0x140064170
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rdi + r8], 0
jne 0x140064040
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.14000e8b0
nop
lea rdx, [rsp + 0x28]
mov rcx, rbp
call fcn.140065730
nop
lea r9, [rsp + 0x48]
mov r8, rax
lea rcx, [rsp + 0x68]
call fcn.14001f4a0
nop
lea rcx, [rsp + 0x28]
call fcn.14000e730
nop
lea rcx, [rsp + 0x48]
call fcn.14000e730
test sil, sil
je 0x14006410a
lea rdi, [rsp + 0x68]
cmp qword [rsp + 0x80], 0x10
cmovae rdi, qword [rsp + 0x68]
call fcn.1400647c0
mov eax, dword [reloc.WS2_32.dll_closesocket]
test eax, eax
jle 0x14006410a
cmp eax, 3
jl 0x14006410a
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
nop dword [rax]
inc rbx
cmp byte [rdi + rbx], 0
jne 0x1400640d0
mov r8, rbx
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.14000e8b0
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x48]
call fcn.14000e730
lea rbx, [rsp + 0x68]
cmp qword [rsp + 0x80], 0x10
cmovae rbx, qword [rsp + 0x68]
call fcn.1400647c0
mov rcx, rax
mov r8d, 3
mov rdx, rbx
call fcn.140065af0
nop
lea rcx, [rsp + 0x68]
call fcn.14000e730
nop
mov rcx, r14
call fcn.1400e91f0
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14010a950
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
dec eax
mov dword [0x1401a5a4c], eax
mov ecx, 6
call fcn.1400e80d8
int3
mov ecx, 5
call fcn.1400e80d8
int3
Function at 0x140064190
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x1401970d0]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rdi, rdx
mov rsi, rcx
lea r15, [0x1401a5a00]
mov qword [rbp - 0x59], r15
mov rcx, r15
call fcn.1400e91cc
test eax, eax
jne 0x140064369
mov eax, dword [0x1401a5a4c]
cmp eax, 0x7fffffff
je 0x140064356
xorps xmm0, xmm0
movups xmmword [rbp - 0x51], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x41], xmm1
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rdi + r8*2], 0
jne 0x140064201
mov rdx, rdi
lea rcx, [rbp - 0x51]
call fcn.14001e400
nop
lea rdx, [rbp - 0x11]
mov rcx, rsi
call fcn.140065730
nop
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 0x10
cmovae rdx, qword [rbp - 0x11]
mov r8, qword [rbp - 1]
add r8, rdx
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 0x10
cmovae rdx, qword [rbp - 0x11]
lea rcx, [rbp - 0x31]
call fcn.140067710
nop
lea rcx, [rbp - 0x11]
call fcn.14000e730
nop
lea r9, [rbp - 0x51]
lea r8, [rbp - 0x31]
lea rcx, [rbp + 0xf]
call fcn.14001f2f0
nop
lea rcx, [rbp - 0x31]
call fcn.14000e6a0
nop
lea rcx, [rbp - 0x51]
call fcn.14000e6a0
lea rdi, [rbp + 0xf]
mov rsi, qword [rbp + 0xf]
mov r14, qword [rbp + 0x27]
cmp r14, 8
cmovae rdi, rsi
call fcn.1400647c0
mov eax, dword [reloc.WS2_32.dll_closesocket]
test eax, eax
jle 0x1400642fe
cmp eax, 3
jl 0x1400642fe
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 1], xmm1
nop dword [rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1400642c0
mov r8, rbx
mov rdx, rdi
lea rcx, [rbp - 0x11]
call fcn.14001e400
lea rcx, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae rcx, qword [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [rbp - 0x11]
call fcn.14000e6a0
mov r14, qword [rbp + 0x27]
mov rsi, qword [rbp + 0xf]
lea rbx, [rbp + 0xf]
cmp r14, 8
cmovae rbx, rsi
call fcn.1400647c0
mov rcx, rax
mov r8d, 3
mov rdx, rbx
call fcn.140066210
nop
lea rcx, [rbp + 0xf]
call fcn.14000e6a0
nop
mov rcx, r15
call fcn.1400e91f0
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14010a950
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
dec eax
mov dword [0x1401a5a4c], eax
mov ecx, 6
call fcn.1400e80d8
int3
mov ecx, 5
call fcn.1400e80d8
int3
Function at 0x140064380
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xb0
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rax, qword [0x1401970d0]
xor rax, rsp
mov qword [rsp + 0x88], rax
movzx esi, r8b
mov rbx, rdx
mov rdi, rcx
mov ebp, dword [reloc.WS2_32.dll_closesocket]
test ebp, ebp
jg 0x1400643d7
call fcn.1400648e0
cmp al, 1
jne 0x1400643d7
mov dword [reloc.WS2_32.dll_closesocket], 6
lea r14, [0x1401a5a00]
mov qword [rsp + 0x20], r14
mov rcx, r14
call fcn.1400e91cc
test eax, eax
jne 0x140064576
mov eax, dword [0x1401a5a4c]
cmp eax, 0x7fffffff
je 0x140064563
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.140065730
nop
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14006441f
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.14000e820
movups xmm7, xmmword [rax]
movups xmmword [rsp + 0x48], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm6
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x28]
call fcn.14000e730
test sil, sil
je 0x1400644eb
lea rbx, [rsp + 0x48]
movq rdi, xmm7
psrldq xmm6, 8
movq rsi, xmm6
cmp rsi, 0x10
cmovae rbx, rdi
call fcn.1400647c0
mov eax, dword [reloc.WS2_32.dll_closesocket]
test eax, eax
jle 0x1400644f5
cmp eax, 3
jl 0x1400644f5
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x1400644b0
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14000e8b0
lea rcx, [rsp + 0x68]
cmp qword [rsp + 0x80], 0x10
cmovae rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x68]
call fcn.14000e730
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x60]
lea rbx, [rsp + 0x48]
cmp rsi, 0x10
cmovae rbx, rdi
call fcn.1400647c0
mov rcx, rax
mov r8d, 3
mov rdx, rbx
call fcn.140065af0
mov dword [reloc.WS2_32.dll_closesocket], ebp
lea rcx, [rsp + 0x48]
call fcn.14000e730
nop
mov rcx, r14
call fcn.1400e91f0
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14010a950
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
dec eax
mov dword [0x1401a5a4c], eax
mov ecx, 6
call fcn.1400e80d8
int3
mov ecx, 5
call fcn.1400e80d8
int3