joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a0b00
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x4a0d5a
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0x60], 0
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x40], xmm15
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xc0]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov byte [rsp + 0x10], 0
call fcn.00403ae0
xorps xmm15, xmm15
mov r14, qword [0x007aa458]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
jne 0x4a0b92
jmp 0x4a0bdd
mov qword [rsp + 0x60], 0
movups xmmword [rsp + 0x68], xmm15
lea rdx, [0x0068fba0]
mov qword [rsp + 0x40], rdx
lea rsi, [0x0068ef18]
mov qword [rsp + 0x48], rsi
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rdx, qword [rsp + 0xc0]
mov qword [rsp + 0x38], rdx
lea rsi, [rdx + 1]
lea rcx, [rdx + rsi]
lea rax, [0x0057b740]
xor ebx, ebx
nop dword [rax + rax]
call fcn.0044f080
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 0
lea rsi, [rdx + 1]
add rdx, rsi
mov qword [rsp + 0x88], rdx
mov rdx, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xc0]
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x30], 0
jmp 0x4a0c4f
mov rdx, qword [rsp + 0x30]
cmp qword [rsp + 0x58], rdx
jg 0x4a0c65
nop dword [rax + rax]
jmp 0x4a0cee
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x50]
add rdx, qword [rsp + 0x30]
movzx edx, byte [rdx]
mov dword [rsp + 0x24], edx
cmp edx, 0x80
jl 0x4a0c8a
jmp 0x4a0c91
inc qword [rsp + 0x30]
jmp 0x4a0cb0
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
call fcn.00462380
mov dword [rsp + 0x24], eax
mov qword [rsp + 0x30], rbx
jmp 0x4a0cb0
mov edi, dword [rsp + 0x24]
mov dword [rsp + 0x20], edi
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
call fcn.0049e6a0
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rcx
jmp 0x4a0ce9
jmp 0x4a0c4f
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
xor edi, edi
call fcn.0049e6a0
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
movups xmmword [rsp + 0x40], xmm15
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004670c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004a0b00
Function at 0x4d1e20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d1e9d
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rcx
mov byte [rsp + 0x60], dil
mov qword [rsp + 0x28], 0
movzx eax, byte [rsp + 0x60]
mov rdx, qword [rsp + 0x48]
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov byte [rsp + 0x18], al
call fcn.00403ac0
xorps xmm15, xmm15
mov r14, qword [0x007aa458]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.004670c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.004d1e20

Function at 0x4d4380
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d44fb
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x48], rdi
test rdi, rdi
je 0x4d43c2
nop
jmp 0x4d43e8
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.00479860
mov qword [rsp + 0x48], rax
inc rax
mov qword [rsp + 0x28], rax
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov qword [rsp + 0x48], rdi
cmp rdi, 1
je 0x4d43f5
jmp 0x4d4453
mov rdx, qword [rsp + 0x70]
test rdi, rdi
ja 0x4d4405
nop
jmp 0x4d44f0
movzx eax, byte [rdx]
mov byte [rsp + 0x27], al
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], al
call fcn.00403460
xorps xmm15, xmm15
mov r14, qword [0x007aa458]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x28], rax
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov qword [rsp + 0x30], 0
jmp 0x4d445e
nop
jmp 0x4d4462
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x68]
call fcn.004d5340
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
je 0x4d4488
jmp 0x4d449c
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
inc qword [rsp + 0x30]
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x48], rdx
add rax, rdx
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
nop dword [rax]
cmp rcx, rax
jae 0x4d44c7
jmp 0x4d44eb
sub rcx, rax
mov rsi, rcx
neg rcx
sar rcx, 0x3f
and rax, rcx
add rdx, rax
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rsi
jmp 0x4d44e6
jmp 0x4d445e
call fcn.004697e0
xor eax, eax
mov rcx, rdi
call fcn.00469720
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004670c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004d4380
Function at 0x4e67c0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x4e6a26
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xc8], r8
mov qword [rsp + 0xd0], r9
mov rdx, qword [rsp + 0xb0]
mov rax, qword [rsp + 0xa0]
cmp r9, rdx
jbe 0x4e6838
jmp 0x4e6a1b
jmp 0x4e683a
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], r9
mov qword [rsp + 0x88], rdx
mov rcx, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xc0]
mov r10, qword [rsp + 0xc8]
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], r10
call fcn.004f66c0
xorps xmm15, xmm15
mov r14, qword [0x007aa458]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x4e68d6
jmp 0x4e69fa
mov rcx, qword [rsp + 0xd0]
sar rcx, 1
add rcx, qword [rsp + 0xd0]
mov qword [rsp + 0x58], rcx
mov rax, qword [rsp + 0xd0]
mov rdx, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xa0]
cmp rdx, rcx
jae 0x4e6910
jmp 0x4e6a16
cmp rax, rcx
jbe 0x4e691a
jmp 0x4e6a11
sub rdx, rax
mov rsi, rdx
neg rdx
mov rdi, rax
shl rax, 3
sar rdx, 0x3f
and rax, rdx
lea rdx, [rbx + rax]
mov qword [rsp + 0x78], rdx
sub rcx, rdi
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rsi
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xb0]
jmp 0x4e696f
cmp rax, rcx
jbe 0x4e6979
jmp 0x4e6a0c
sub rbx, rax
mov rsi, rbx
neg rbx
mov rdi, rax
shl rax, 3
sar rbx, 0x3f
and rax, rbx
add rax, rdx
mov qword [rsp + 0x60], rax
sub rcx, rdi
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rsi
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov r8, qword [rsp + 0x88]
mov qword [rsp], rbx
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rdx
call fcn.004f6800
xorps xmm15, xmm15
mov r14, qword [0x007aa458]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp 0x4e69fc
jmp 0x4e69fc
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
call fcn.004697e0
call fcn.004697e0
call fcn.004697a0
mov rcx, r9
nop
call fcn.004697a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.004670c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.004e67c0
Function at 0x4e6a80
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x4e6ce6
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xc8], r8
mov qword [rsp + 0xd0], r9
mov rdx, qword [rsp + 0xb0]
mov rax, qword [rsp + 0xa0]
cmp r9, rdx
jbe 0x4e6af8
jmp 0x4e6cdb
jmp 0x4e6afa
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], r9
mov qword [rsp + 0x88], rdx
mov rcx, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xc0]
mov r10, qword [rsp + 0xc8]
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], r10
call fcn.004f6760
xorps xmm15, xmm15
mov r14, qword [0x007aa458]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x4e6b96
jmp 0x4e6cba
mov rcx, qword [rsp + 0xd0]
sar rcx, 1
add rcx, qword [rsp + 0xd0]
mov qword [rsp + 0x58], rcx
mov rax, qword [rsp + 0xd0]
mov rdx, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xa0]
cmp rdx, rcx
jae 0x4e6bd0
jmp 0x4e6cd6
cmp rax, rcx
jbe 0x4e6bda
jmp 0x4e6cd1
sub rdx, rax
mov rsi, rdx
neg rdx
mov rdi, rax
shl rax, 3
sar rdx, 0x3f
and rax, rdx
lea rdx, [rbx + rax]
mov qword [rsp + 0x78], rdx
sub rcx, rdi
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rsi
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xb0]
jmp 0x4e6c2f
cmp rax, rcx
jbe 0x4e6c39
jmp 0x4e6ccc
sub rbx, rax
mov rsi, rbx
neg rbx
mov rdi, rax
shl rax, 3
sar rbx, 0x3f
and rax, rbx
add rax, rdx
mov qword [rsp + 0x60], rax
sub rcx, rdi
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rsi
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov r8, qword [rsp + 0x88]
mov qword [rsp], rbx
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rdx
call fcn.004f68a0
xorps xmm15, xmm15
mov r14, qword [0x007aa458]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp 0x4e6cbc
jmp 0x4e6cbc
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
call fcn.004697e0
call fcn.004697e0
call fcn.004697a0
mov rcx, r9
nop
call fcn.004697a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.004670c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.004e6a80
Function at 0x4f7520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f762b
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x18], 0
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rsi
cmp rsi, rdx
jne 0x4f7575
jmp 0x4f758a
mov qword [rsp + 0x18], 0
xor eax, eax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov byte [rsp + 0x17], 0
mov qword [rsp + 0x20], 0
jmp 0x4f759a
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x28], rdx
cmp qword [rsp + 0x20], rdx
jl 0x4f75ad
jmp 0x4f75fe
movzx edx, byte [rsp + 0x17]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
cmp rax, rcx
jb 0x4f75c8
jmp 0x4f7625
add rsi, rax
movzx esi, byte [rsi]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
nop dword [rax]
cmp rax, rcx
jb 0x4f75e7
jmp 0x4f7620
add rdi, rax
movzx edi, byte [rdi]
xor esi, edi
or edx, esi
mov byte [rsp + 0x17], dl
jmp 0x4f75f7
inc qword [rsp + 0x20]
jmp 0x4f759a
movzx eax, byte [rsp + 0x17]
xor ebx, ebx
call fcn.004f7680
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x18], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.00469720
call fcn.00469720
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.004670c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.004f7520
Function at 0x50e800
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rax
test byte [rax], al
cmp byte [rax + 0x70], 0
jne 0x50e80f
jmp 0x50e87b
test byte [rax], al
mov dword [rax], 0xc1059ed8
mov rax, qword [rsp + 8]
test byte [rax], al
mov dword [rax + 4], 0x367cd507
mov rax, qword [rsp + 8]
test byte [rax], al
mov dword [rax + 8], 0x3070dd17
mov rax, qword [rsp + 8]
test byte [rax], al
mov dword [rax + 0xc], 0xf70e5939
mov rax, qword [rsp + 8]
test byte [rax], al
mov dword [rax + 0x10], 0xffc00b31
mov rax, qword [rsp + 8]
test byte [rax], al
mov dword [rax + 0x14], 0x68581511
mov rax, qword [rsp + 8]
test byte [rax], al
mov dword [rax + 0x18], 0x64f98fa7
mov rax, qword [rsp + 8]
test byte [rax], al
mov dword [rax + 0x1c], 0xbefa4fa4
jmp 0x50e8e7
test byte [rax], al
mov dword [rax], 0x6a09e667
mov rax, qword [rsp + 8]
test byte [rax], al
mov dword [rax + 4], 0xbb67ae85
mov rax, qword [rsp + 8]
test byte [rax], al
mov dword [rax + 8], 0x3c6ef372
mov rax, qword [rsp + 8]
test byte [rax], al
mov dword [rax + 0xc], 0xa54ff53a
mov rax, qword [rsp + 8]
test byte [rax], al
mov dword [rax + 0x10], 0x510e527f
mov rax, qword [rsp + 8]
test byte [rax], al
mov dword [rax + 0x14], 0x9b05688c
mov rax, qword [rsp + 8]
test byte [rax], al
mov dword [rax + 0x18], 0x1f83d9ab
mov rax, qword [rsp + 8]
test byte [rax], al
mov dword [rax + 0x1c], 0x5be0cd19
jmp 0x50e8e7
mov rax, qword [rsp + 8]
test byte [rax], al
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 8]
test byte [rax], al
mov qword [rax + 0x68], 0
ret
Function at 0x541340
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x541506
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rdi
movzx eax, byte [0x007aa262]
mov byte [rsp + 0x27], al
test al, al
jne 0x54137d
jmp 0x541394
mov rax, qword [rsp + 0x70]
cmp rax, 0x100
mov qword [rsp + 0x30], rax
setge byte [rsp + 0x27]
jmp 0x541396
jmp 0x541396
cmp byte [rsp + 0x27], 0
jne 0x5413a5
nop dword [rax]
jmp 0x5414ad
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea rbx, [rax - 0x80]
mov qword [rsp + 0x28], rbx
nop dword [rax + rax]
test rbx, 0x7f
jne 0x5413cb
jmp 0x5413d8
add rax, 0xffffffffffffff40
mov qword [rsp + 0x28], rax
jmp 0x5413da
jmp 0x5413da
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x68]
cmp rdx, rcx
jae 0x5413f3
jmp 0x541500
jmp 0x5413f5
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdx
mov rbx, qword [rsp + 0x60]
mov qword [rsp], rbx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdx
nop dword [rax]
call fcn.00542940
xorps xmm15, xmm15
mov r14, qword [0x007aa458]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x78]
jmp 0x54144d
cmp rcx, rax
jae 0x541457
jmp 0x5414f7
sub rbx, rax
mov rsi, rbx
neg rbx
sar rbx, 0x3f
and rbx, rax
add rdx, rbx
mov qword [rsp + 0x38], rdx
sub rcx, rax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rsi
mov rax, qword [rsp + 0x60]
mov qword [rsp], rax
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rsi
call fcn.005415c0
xorps xmm15, xmm15
mov r14, qword [0x007aa458]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp 0x5414ed
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x60]
mov qword [rsp], rbx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdx
call fcn.005415c0
xorps xmm15, xmm15
mov r14, qword [0x007aa458]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp 0x5414ed
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
call fcn.004697e0
nop dword [rax]
call fcn.004697a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004670c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00541340
Function at 0x140001500
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rdi
push r12
push r13
sub rsp, 0x40
mov r13, rcx
mov rbp, r8
mov ecx, 0x39
mov r12, rdx
call fcn.1400bae58
mov rbx, rax
test rax, rax
je 0x1400016fd
xorps xmm0, xmm0
mov qword [rsp + 0x70], rsi
movups xmmword [rbx], xmm0
xor eax, eax
mov qword [rsp + 0x78], r14
movups xmmword [rbx + 0x10], xmm0
mov qword [rsp + 0x80], r15
movups xmmword [rbx + 0x20], xmm0
mov qword [rbx + 0x30], rax
lea ecx, [rax + 0x24]
mov byte [rbx + 0x38], al
call fcn.1400bae58
xor r15d, r15d
lea rsi, [rbx + 8]
mov r14, rax
test rax, rax
je 0x14000164a
mov qword [rax], r15
lea edx, [r15 + 1]
mov qword [rax + 8], r15
xor r9d, r9d
mov qword [rax + 0x18], r15
xor r8d, r8d
mov dword [rax + 0x20], r15d
xor ecx, ecx
mov qword [rsi], rax
mov rax, qword [rbx + 0x20]
mov qword [r14 + 0x10], rax
call qword [sym.imp.KERNEL32.DLL_CreateEventW]
mov qword [r14], rax
test rax, rax
jne 0x1400015ad
mov edi, 0x3f0
jmp 0x14000164f
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov rdx, qword [r14]
mov r9, rbx
mov dword [rsp + 0x30], r15d
mov r8, rax
mov rcx, rax
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.DLL_DuplicateHandle]
test eax, eax
jne 0x1400015e2
mov edi, 0x3f0
jmp 0x14000164f
mov ecx, 0x10
mov edi, r15d
call fcn.1400bae58
mov r15, rax
test rax, rax
jne 0x1400015fe
mov edi, 0x708
jmp 0x140001641
lea rax, [0x140001870]
mov qword [r15 + 8], r14
mov qword [r15], rax
lea r8, [0x140001e60]
xor eax, eax
mov r9, r15
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [r14 + 8], rax
test rax, rax
jne 0x140001641
mov rcx, r15
call fcn.1400bae44
mov edi, 0x3eb
test edi, edi
je 0x140001696
xor r15d, r15d
jmp 0x14000164f
mov edi, 0x708
mov rax, qword [rsi]
test rax, rax
je 0x14000165e
mov dword [rax + 0x20], 1
mov rcx, qword [rbx]
test rcx, rcx
je 0x140001678
call qword [sym.imp.KERNEL32.DLL_SetEvent]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov qword [rbx], r15
test r14, r14
je 0x140001696
mov rcx, qword [r14]
test rcx, rcx
je 0x14000168e
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov qword [r14], r15
mov rcx, r14
call fcn.1400bae44
mov r15, qword [rsp + 0x80]
mov r14, qword [rsp + 0x78]
test edi, edi
jne 0x1400016c6
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r12
mov qword [rbp], rbx
mov rsi, qword [rsp + 0x70]
mov eax, edi
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
mov rax, qword [rsi]
test rax, rax
je 0x1400016d5
mov dword [rax + 0x20], 1
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400016f3
call qword [sym.imp.KERNEL32.DLL_SetEvent]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov qword [rbx], 0
mov rcx, rbx
call fcn.1400bae44
jmp 0x1400016b3
mov eax, 0x708
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x1400053b0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rdi
sub rsp, 0x170
mov rax, qword [0x140214ec8]
xor rax, rsp
mov qword [rsp + 0x160], rax
xorps xmm0, xmm0
mov rdi, rcx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140005423
bt eax, 0xa
jae 0x140005423
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14000540d
test al, 0x10
je 0x14000540d
mov rcx, rdi
call fcn.1400d89e4
jmp 0x140005415
mov rcx, rdi
call fcn.1400bd7ac
test eax, eax
je 0x140005423
mov eax, 0x1f
jmp 0x140005597
mov rcx, rdi
mov qword [rsp + 0x188], rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140005467
bt eax, 0xa
jae 0x140005467
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14000545b
test al, 0x10
je 0x14000545b
mov rcx, rdi
call fcn.1400d89e4
jmp 0x140005463
mov rcx, rdi
call fcn.1400bd7ac
test eax, eax
jne 0x14000547e
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400d849c
mov ebx, eax
test eax, eax
je 0x14000558d
test rdi, rdi
jne 0x140005487
xor ebx, ebx
jmp 0x140005497
mov edx, 0x104
mov rcx, rdi
call fcn.1400d5428
mov rbx, rax
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
call fcn.1400ad180
mov r9, 0xffffffffffffffff
lea rcx, [rsp + 0x50]
mov r8, rdi
mov edx, 0x104
call fcn.1400baf28
lea rcx, [rbx - 2]
cmp rcx, 0x102
ja 0x1400054eb
cmp byte [rsp + rbx + 0x4f], 0x5c
jne 0x1400054eb
dec rbx
cmp rbx, 0x104
jae 0x1400055b0
mov byte [rsp + rbx + 0x50], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14000552f
bt eax, 0xa
jae 0x14000552f
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140005521
test al, 0x10
je 0x140005521
lea rcx, [rsp + 0x50]
call fcn.1400d89e4
jmp 0x14000552b
lea rcx, [rsp + 0x50]
call fcn.1400bd7ac
test eax, eax
jne 0x140005544
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.1400d849c
mov ebx, eax
test eax, eax
je 0x14000558d
lea rcx, [rsp + 0x50]
call fcn.1400d8760
mov ebx, eax
test eax, eax
je 0x14000558d
mov edx, 0x5c
lea rcx, [rsp + 0x50]
call fcn.1400ad888
mov rdi, rax
test rax, rax
je 0x14000558d
lea rcx, [rsp + 0x50]
mov byte [rax], 0
call fcn.1400053b0
mov ebx, eax
test eax, eax
jne 0x14000558d
lea rcx, [rsp + 0x50]
mov byte [rdi], 0x5c
call fcn.1400d8760
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400ab870
add rsp, 0x170
pop rdi
ret
call fcn.1400ab9d4
int3