joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400695b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140044120
sub rsp, rax
mov rax, qword [0x1401d92c0]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.140060724
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x1400695ff
mov rax, rbp
jmp 0x14006970b
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x1def50]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.14006a798
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x1def50]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x140069707
mov dword [rsp + 0x30], edi
lea r9, [rsp + 0x30]
mov rcx, qword [rcx + r12*8 + 0x28]
lea rdx, [rsp + 0x40]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140069707
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.14006a798
test rax, rax
js 0x140069707
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x140069707
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x1400696f9
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x1400696f9
cmp byte [rcx], 0xd
jne 0x1400696df
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x1400696ee
cmp byte [rcx + 1], 0xa
jne 0x1400696ee
inc rcx
jmp 0x1400696ee
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x1d9c50]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x1400696c1
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x14006970b
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400444f0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x14006992c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140069942
mov al, 1
jmp 0x1400699ae
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140069953
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400699ac
mov ecx, dword [rcx + 0x18]
nop
call fcn.14006c8f0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400699ac
and qword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
mov r9d, 1
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400699ac
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400699ac
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400699ae
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140069a80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
xor edi, edi
mov rax, r15
lea rcx, [0x1401def50]
and eax, 0x3f
mov r12, r15
sar r12, 6
mov rsi, rdx
lea r9d, [rdi + 0xa]
mov r14, r15
lea rbp, [rax + rax*8]
mov rax, qword [rcx + r12*8]
mov r10, qword [rax + rbp*8 + 0x28]
test r8, r8
je 0x140069ad6
cmp word [rdx], r9w
jne 0x140069ad6
or byte [rax + rbp*8 + 0x38], 4
jmp 0x140069adb
and byte [rax + rbp*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rax, rsi
mov rbx, rsi
cmp rsi, r8
jae 0x140069c5a
mov r11d, 0xd
lea r13d, [r11 - 0xb]
movzx edx, word [rax]
cmp dx, 0x1a
je 0x140069c25
lea rcx, [rax + 2]
cmp dx, r11w
jne 0x140069b23
cmp rcx, r8
jae 0x140069b43
cmp word [rcx], r9w
jne 0x140069b23
add rax, 4
mov edx, r9d
jmp 0x140069b26
mov rax, rcx
mov word [rbx], dx
mov r9, r13
mov rcx, rbx
mov r9d, 0xa
lea rbx, [rbx + r13]
cmp rax, r8
jb 0x140069af8
jmp 0x140069c5a
lea r9, [rsp + 0x80]
mov word [rsp + 0x70], di
mov r8d, r13d
mov dword [rsp + 0x80], edi
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x20], rdi
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140069c1e
cmp dword [rsp + 0x80], edi
je 0x140069c1e
lea r9, [0x1401def50]
mov rax, qword [r9 + r12*8]
test byte [rax + rbp*8 + 0x38], 0x48
mov ebp, 0xa
je 0x140069bf8
movzx eax, word [rsp + 0x70]
cmp ax, bp
jne 0x140069bab
mov word [rbx], bp
jmp 0x140069c57
mov word [rsp + 0x78], ax
mov rdx, r14
mov rax, r14
sar rdx, 6
and eax, 0x3f
mov word [rbx], 0xd
lea r8, [rax + rax*8]
mov rax, qword [r9 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, r13
jl 0x140069bc6
mov rax, r14
sar rax, 6
and r14d, 0x3f
mov rax, qword [r9 + rax*8]
lea rcx, [r14 + r14*8]
mov byte [rax + rcx*8 + 0x3c], bpl
jmp 0x140069c57
cmp word [rsp + 0x70], bp
jne 0x140069c04
cmp rbx, rsi
je 0x140069ba3
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.14006a7a0
cmp word [rsp + 0x70], bp
je 0x140069c5a
mov word [rbx], 0xd
jmp 0x140069c57
mov rcx, r15
lea r9, [0x1401def50]
and ecx, 0x3f
mov rax, r15
sar rax, 6
lea r8, [rcx + rcx*8]
mov rcx, qword [r9 + rax*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x140069c54
or al, r13b
mov byte [rcx + r8*8 + 0x38], al
jmp 0x140069c5a
mov word [rbx], dx
add rbx, r13
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006be64
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14006be94
xor eax, eax
jmp 0x14006bf57
mov rbp, rbx
cmp word [rax], si
je 0x14006beb9
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14006bea0
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14006be9c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400673d4
movsxd r14, eax
mov rcx, r14
test eax, eax
jne 0x14006befa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14006be8d
call fcn.14005f1e0
mov rdi, rax
test rax, rax
jne 0x14006bf10
xor ecx, ecx
call fcn.14005f180
jmp 0x14006beef
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400673d4
test eax, eax
jne 0x14006bf41
mov rcx, rdi
call fcn.14005f180
jmp 0x14006bf4b
xor ecx, ecx
call fcn.14005f180
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x14006bf74
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14006bffb
mov rsi, rbx
cmp word [rax], bp
je 0x14006bfba
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14006bfa4
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14006bfa0
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14005f1e0
mov rdi, rax
test rax, rax
je 0x14006bfe8
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140070210
mov rbp, rdi
xor ecx, ecx
call fcn.14005f180
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14006fe20
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14006fe48
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14006fe48
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140002890
Capabilities:
Check mutex on windows
Inspect load icon resource

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x340
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1402e3910]
xor rax, rsp
mov qword [rsp + 0x330], rax
mov rsi, rcx
lea r8, str.ASUSAacVgaUserAppInstance_x64
mov ebp, 1
mov edx, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0xb7
cmove ebx, ebp
test rdi, rdi
je 0x1400028fc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
test ebx, ebx
jne 0x140002a1b
mov dword [rsp + 0x30], 8
mov dword [rsp + 0x34], 0xff
lea rcx, [rsp + 0x30]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov rcx, rsi
call fcn.140016d08
xor ecx, ecx
call fcn.140018220
lea ecx, [rbx + 0x18]
call fcn.140015c44
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14000295a
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov rcx, rax
call fcn.1400193c8
mov rbx, rax
jmp 0x14000295c
xor ebx, ebx
lea rcx, str.CMFCVisualManagerWindows
call fcn.1400258ec
lea rdx, str.Local_AppWizard_Generated_Applications
mov rcx, rsi
call fcn.14002ac38
xor edx, edx
mov r8d, 0x2e8
lea rcx, [rsp + 0x40]
call fcn.1401cfe90
xor r8d, r8d
lea edx, [r8 + 0x66]
lea rcx, [rsp + 0x40]
call fcn.14002afe0
nop
lea rax, vtable.CAacVgaUserAppDlg.0
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x170], 0
mov qword [rsp + 0x178], 0
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x180], xmm0
call fcn.140035330
call fcn.140035330
mov edx, 0x80
mov rcx, qword [rax + 0x18]
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rsp + 0x320], rax
lea rax, [rsp + 0x40]
mov qword [rsi + 0x40], rax
lea rcx, [rsp + 0x40]
call fcn.14002b8bc
test rbx, rbx
je 0x140002a0b
mov rax, qword [rbx]
mov edx, ebp
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.14002cc14
nop
lea rcx, [rsp + 0x40]
call fcn.14002b0bc
xor eax, eax
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.1401cb100
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400057e0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1402e3910]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], 0
lea rdx, str.SoftwareASUSAacVgaHal_x64
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x14000582d
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401cb100
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x28], 4
lea rdx, str.UserAppStatus
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401cb100
add rsp, 0x48
ret

Function at 0x140005e70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140005ea3
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140005eea
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140005ee5
nop
cmp rbx, rcx
jae 0x140005eea
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140005ed0
cmp rbx, rcx
jb 0x140005eee
xor eax, eax
jmp 0x140005efa
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140005f10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov eax, r8d
mov rsi, rdx
shr eax, 4
mov edi, r8d
inc ax
mov r14, rcx
movzx edx, ax
mov r8d, 6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x140006031
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140006031
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140006031
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140005fb9
nop word [rax + rax]
cmp rbx, rcx
jae 0x140006031
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140005fa0
cmp rbx, rcx
jae 0x140006031
movzx edi, word [rbx]
test di, di
je 0x140006031
mov rax, qword [r14]
mov ecx, 1
movzx esi, di
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, esi
or ecx, eax
jge 0x140005fe7
mov edx, esi
mov rcx, r14
call fcn.140006330
movzx r9d, word [rbx]
lea r8, [rbx + 2]
mov rcx, qword [r14]
movzx edx, di
call fcn.1401d2230
test eax, eax
je 0x140006012
cmp eax, 0xc
je 0x14000605a
cmp eax, 0x16
je 0x140006054
cmp eax, 0x22
je 0x140006054
cmp eax, 0x50
jne 0x14000604e
mov rcx, qword [r14]
cmp esi, dword [rcx - 0xc]
jg 0x140006060
mov dword [rcx - 0x10], esi
xor r8d, r8d
mov rcx, qword [r14]
movzx edx, di
lea eax, [r8 + 1]
mov word [rcx + rdx*2], r8w
jmp 0x140006033
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
call fcn.140032120
int3
call fcn.140032120
int3
call fcn.140032144
int3
mov ecx, 0x80070057
call fcn.1400063a0
int3
Function at 0x14000bab0
Capabilities:
Create directory
Print debug messages

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1402e3910]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx esi, dl
mov rbx, rcx
mov qword [r11 - 0x20], rcx
cmp qword [rcx + 0x18], 8
jb 0x14000baee
mov rcx, qword [rcx]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
setne dil
test eax, eax
jne 0x14000bc37
test sil, sil
je 0x14000bc37
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14000bb18
mov rdx, qword [rbx]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
sete dil
test eax, eax
je 0x14000bc37
mov edx, eax
lea rcx, [rsp + 0x48]
call fcn.14000b2f0
nop
mov r9d, 0x31
lea r8, str._AacVgaHal___Logger__IsFolderExisted___errCode_
mov rcx, rax
call fcn.140014610
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], SafeArrayGetDim
mov byte [rax], 0
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rax, qword [rsp + 0x38]
cmp rax, 0x10
jb 0x14000bbdd
inc rax
mov rcx, qword [rsp + 0x20]
cmp rax, 0x1000
jb 0x14000bbd8
test cl, 0x1f
jne 0x14000bbd2
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000bbd2
sub rcx, rax
sub rcx, 8
cmp rcx, 0x1f
ja 0x14000bbd2
mov rcx, rax
jmp 0x14000bbd8
call fcn.1401d24e0
int3
call fcn.140015ca0
movdqa xmm0, xmmword [0x14029a950]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
mov rax, qword [rsp + 0x60]
cmp rax, 0x10
jb 0x14000bc37
inc rax
mov rcx, qword [rsp + 0x48]
cmp rax, 0x1000
jb 0x14000bc31
test cl, 0x1f
jne 0x14000bc2b
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000bc2b
sub rcx, rax
sub rcx, 8
cmp rcx, 0x1f
ja 0x14000bc2b
mov rcx, rax
jmp 0x14000bc31
call fcn.1401d24e0
int3
call fcn.140015ca0
nop
mov rcx, rbx
call fcn.140012270
movzx eax, dil
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401cb100
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000cb20
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1402e3910]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rdi, rdx
lea rsi, [0x1402f7520]
mov qword [r11 - 0x80], rsi
mov rcx, rsi
call fcn.1401cd944
test eax, eax
je 0x14000cb74
mov ecx, eax
call fcn.1401cd56c
nop
movdqa xmm0, xmmword [0x14029a940]
movdqu xmmword [rsp + 0x30], xmm0
xor ebp, ebp
mov word [rsp + 0x20], bp
or rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rdi + r8*2], bp
jne 0x14000cb90
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400122f0
nop
lea rdx, [rsp + 0x50]
call fcn.14000ee80
nop
lea r8, [rsp + 0x20]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140012fc0
nop
lea rcx, [rsp + 0x50]
call fcn.140012270
nop
lea rcx, [rsp + 0x20]
call fcn.140012270
lea rdi, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae rdi, qword [rsp + 0x70]
call fcn.14000ccd0
cmp dword [0x1402e45d0], 3
jl 0x14000cc60
movdqa xmm0, xmmword [0x14029a940]
movdqu xmmword [rsp + 0xa0], xmm0
mov word [rsp + 0x90], bp
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x14000cc16
mov r8, rbx
mov rdx, rdi
lea rcx, [rsp + 0x90]
call fcn.1400122f0
lea rcx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 8
cmovae rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [rsp + 0x90]
call fcn.140012270
lea rbx, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae rbx, qword [rsp + 0x70]
call fcn.14000ccd0
mov rcx, rax
mov rdx, rbx
call fcn.14000fce0
nop
lea rcx, [rsp + 0x70]
call fcn.140012270
nop
mov rcx, rsi
call fcn.1401cd968
test eax, eax
je 0x14000cca4
mov ecx, eax
call fcn.1401cd56c
nop
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401cb100
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14000ccd0
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov rax, qword [0x1402f7348]
test rax, rax
jne 0x14000cdb2
lea rdi, [0x1402f74d0]
mov qword [rsp + 0x50], rdi
mov rcx, rdi
call fcn.1401cd944
test eax, eax
je 0x14000cd14
mov ecx, eax
call fcn.1401cd56c
nop
mov rbx, qword [0x1402f7348]
test rbx, rbx
jne 0x14000cd9b
lea ecx, [rbx + 4]
call fcn.140015c44
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14000cd92
mov rcx, rax
call fcn.14000ce60
call fcn.14000cdc0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1402f72e8], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rax, [0x1402f7194]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x14000c870]
xor edx, edx
xor ecx, ecx
call fcn.1401d533c
mov qword [0x1402f72f0], rax
jmp 0x14000cd94
xor ebx, ebx
mov qword [0x1402f7348], rbx
mov rcx, rdi
call fcn.1401cd968
test eax, eax
je 0x14000cdaf
mov ecx, eax
call fcn.1401cd56c
nop
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14000ef80
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1402e3910]
xor rax, rsp
mov qword [rsp + 0x40], rax
cmp dword [0x1402e45d0], 3
jl 0x14000f04d
movdqa xmm0, xmmword [0x14029a950]
mov qword [rsp + 0x50], rbx
or rbx, 0xffffffffffffffff
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
nop dword [rax]
inc rbx
cmp byte [rdx + rbx], 0
jne 0x14000efc0
lea rcx, [rsp + 0x20]
cmp rbx, 0xf
ja 0x14000efe8
mov r8, rbx
mov qword [rsp + 0x30], rbx
call fcn.1401cf720
mov byte [rsp + rbx + 0x20], 0
jmp 0x14000eff3
mov r9, rdx
mov rdx, rbx
call fcn.1400139f0
cmp qword [rsp + 0x38], 0x10
lea rcx, [rsp + 0x20]
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x50]
cmp rax, 0x10
jb 0x14000f04d
mov rcx, qword [rsp + 0x20]
inc rax
cmp rax, 0x1000
jb 0x14000f048
test cl, 0x1f
jne 0x14000f05f
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000f05f
sub rcx, rax
sub rcx, 8
cmp rcx, 0x1f
ja 0x14000f05f
mov rcx, rax
call fcn.140015ca0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401cb100
add rsp, 0x58
ret
call fcn.1401d24e0
int3
Function at 0x140012680
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1402e3910]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
cmp qword [rcx + 0x68], 0
je 0x14001285a
cmp byte [rcx + 0x71], 0
je 0x14001285a
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
jne 0x1400126da
xor al, al
jmp 0x14001285c
mov r9d, SafeArrayGetDim
mov qword [rbp - 0x18], r9
mov byte [rbp - 0x30], 0
mov qword [rbp - 0x20], 8
xor ecx, ecx
mov qword [rbp - 0x30], rcx
mov byte [rbp - 0x28], cl
nop dword [rax]
lea rdx, [rbp - 0x30]
cmp r9, 0x10
cmovae rdx, rcx
lea r8, [rbp - 0x30]
cmovae r8, rcx
mov rcx, qword [rdi + 0x68]
mov r10, qword [rcx]
mov r9, qword [rbp - 0x20]
add r9, rdx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x74]
call qword [r10 + 0x40]
test eax, eax
je 0x140012742
sub eax, 1
jne 0x140012804
jmp 0x140012746
mov byte [rdi + 0x71], 0
lea rax, [rbp - 0x30]
mov rcx, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
cmp r9, 0x10
cmovae rax, rcx
mov rbx, qword [rbp - 0x38]
sub rbx, rax
je 0x140012793
lea rax, [rbp - 0x30]
cmp r9, 0x10
cmovae rax, rcx
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, rax
call fcn.1401d5e38
mov r9, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
cmp rbx, rax
jne 0x140012811
cmp byte [rdi + 0x71], 0
je 0x140012815
test rbx, rbx
jne 0x140012700
mov rdx, qword [rbp - 0x20]
mov r8, rdx
mov rax, r9
sub rax, rdx
cmp rax, 8
jb 0x1400127e1
add rdx, 8
mov qword [rbp - 0x20], rdx
lea rax, [rbp - 0x30]
cmp r9, 0x10
cmovae rax, rcx
xor ecx, ecx
mov qword [rax + r8], rcx
mov byte [rax + r8 + 8], cl
mov r9, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
jmp 0x140012700
mov byte [rsp + 0x20], 0
mov edx, 8
mov r9d, edx
lea rcx, [rbp - 0x30]
call fcn.140013b40
mov r9, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
jmp 0x140012700
sub eax, 2
mov r9, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
je 0x140012815
xor bl, bl
jmp 0x140012817
mov bl, 1
cmp r9, 0x10
jb 0x140012855
lea rax, [r9 + 1]
cmp rax, 0x1000
jb 0x140012850
test byte [rbp - 0x30], 0x1f
jne 0x14001284a
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14001284a
sub rcx, rax
sub rcx, 8
cmp rcx, 0x1f
ja 0x14001284a
mov rcx, rax
jmp 0x140012850
call fcn.1401d24e0
int3
call fcn.140015ca0
movzx eax, bl
jmp 0x14001285c
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1401cb100
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret