joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005a70
Capabilities:
Hash data using murmur3

Disassembly:
push rbx
sub rsp, 0x20
mov r8d, 4
xor r9d, r9d
xor r11d, r11d
mov rax, rdx
mov r10, rcx
mov rcx, rdx
cqo
mov rbx, rcx
idiv r8
mov rax, qword [0x140014320]
sub rbx, rdx
mov r8b, byte [rax]
cmp rbx, r9
jg 0x140005ab5
mov rax, rcx
mov ebx, 4
cqo
idiv rbx
xor eax, eax
jmp 0x140005b05
cmp r9, rcx
jb 0x140005ac6
lea rdx, [rcx - 1]
mov rcx, r9
jmp 0x140005b6a
mov eax, dword [r10 + r9]
add r9, 4
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
test r8b, r8b
je 0x140005ae3
xor eax, eax
jmp 0x140005b74
imul eax, eax, 0x1b873593
xor eax, r11d
rol eax, 0xd
lea eax, [rax + rax*4]
lea r11d, [rax - 0x19ab949c]
jmp 0x140005a9f
movzx ebx, byte [r10 + rbx]
shl eax, 8
or eax, ebx
test rdx, rdx
jg 0x140005b47
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
test r8b, r8b
jne 0x140005adc
imul eax, eax, 0x1b873593
xor r11d, ecx
xor eax, r11d
mov edx, eax
shr edx, 0x10
xor eax, edx
imul eax, eax, 0x85ebca6b
mov edx, eax
shr edx, 0xd
xor edx, eax
imul edx, edx, 0xc2b2ae35
mov eax, edx
shr eax, 0x10
xor eax, edx
jmp 0x140005b74
dec rdx
mov rbx, rdx
add rbx, r9
jo 0x140005b60
cmp rbx, rcx
jb 0x140005afb
lea rdx, [rcx - 1]
mov rcx, rbx
jmp 0x140005b6a
call fcn.140003ba1
jmp 0x140005adc
call fcn.140004961
jmp 0x140005adc
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rcx]
mov rcx, qword [rcx + 8]
add rcx, 8
jmp 0x140005a70

Function at 0x140005b7a
Capabilities:
Hash data using murmur3

Disassembly:
push rbx
sub rsp, 0x20
mov r8d, 4
xor r9d, r9d
xor r11d, r11d
mov rax, rdx
mov r10, rcx
mov rcx, rdx
cqo
mov rbx, rcx
idiv r8
mov rax, qword [0x140014320]
sub rbx, rdx
mov r8b, byte [rax]
cmp rbx, r9
jg 0x140005ab5
mov rax, rcx
mov ebx, 4
cqo
idiv rbx
xor eax, eax
jmp 0x140005b05
cmp r9, rcx
jb 0x140005ac6
lea rdx, [rcx - 1]
mov rcx, r9
jmp 0x140005b6a
mov eax, dword [r10 + r9]
add r9, 4
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
test r8b, r8b
je 0x140005ae3
xor eax, eax
jmp 0x140005b74
imul eax, eax, 0x1b873593
xor eax, r11d
rol eax, 0xd
lea eax, [rax + rax*4]
lea r11d, [rax - 0x19ab949c]
jmp 0x140005a9f
movzx ebx, byte [r10 + rbx]
shl eax, 8
or eax, ebx
test rdx, rdx
jg 0x140005b47
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
test r8b, r8b
jne 0x140005adc
imul eax, eax, 0x1b873593
xor r11d, ecx
xor eax, r11d
mov edx, eax
shr edx, 0x10
xor eax, edx
imul eax, eax, 0x85ebca6b
mov edx, eax
shr edx, 0xd
xor edx, eax
imul edx, edx, 0xc2b2ae35
mov eax, edx
shr eax, 0x10
xor eax, edx
jmp 0x140005b74
dec rdx
mov rbx, rdx
add rbx, r9
jo 0x140005b60
cmp rbx, rcx
jb 0x140005afb
lea rdx, [rcx - 1]
mov rcx, rbx
jmp 0x140005b6a
call fcn.140003ba1
jmp 0x140005adc
call fcn.140004961
jmp 0x140005adc
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rcx]
mov rcx, qword [rcx + 8]
add rcx, 8
jmp 0x140005a70

Function at 0x14000956f
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
sub rsp, 0x148
xor eax, eax
lea rsi, [rsp + 8]
mov r9, rcx
mov ecx, 0x4e
mov rdi, rsi
rep stosd dword [rdi], eax
xor eax, eax
mov cl, byte [r9 + rax]
xor ecx, edx
mov byte [rsi + rax], cl
inc rax
cmp rax, 0x138
jne 0x14000958e
mov rdi, r8
mov ecx, 0x4e
rep movsd dword [rdi], dword [rsi]
add rsp, 0x148
pop rsi
pop rdi
ret
Function at 0x140009f70
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call fcn.14000fbe0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
nop dword [rax]

Function at 0x140009fe0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14001a174]
test esi, esi
mov rbx, rcx
jle 0x14000a110
mov rax, qword [0x14001a178]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14000a02b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x14000a0b5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x14000a010
mov rcx, rbx
call fcn.14000aa50
test rax, rax
mov rdi, rax
je 0x14000a132
mov rax, qword [0x14001a178]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.14000ab90
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14001a178]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000a117
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14000a0ae
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x14000a0c0
add dword [0x14001a174], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov r8d, 0x40
mov eax, 4
mov rcx, qword [rsp + 0x20]
cmove r8d, eax
mov rdx, qword [rsp + 0x38]
add rbx, qword [0x14001a178]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000a0ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140009f70
nop dword [rax]
xor esi, esi
jmp 0x14000a038
mov rax, qword [0x14001a178]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [rdi + 8]
mov r8, qword [rax + rbx + 0x18]
call fcn.140009f70
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.140009f70
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x14000a6a0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14001a1e0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14001a1c0]
test rbx, rbx
je 0x14000a6fc
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x14000a6f3
test rsi, rsi
je 0x14000a6f3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14000a6d8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x14000a910
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x14000a948
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x14000a950
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x14000a920
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x14000a948
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x14000a950
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x14000a930
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x14000a948
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x14000a950
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x14000aa50
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140014140]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14000aa70
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14000aa78
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14000aa70
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000aacd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x14000aac4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14000aa70
add rax, 0x28
cmp rax, r9
jne 0x14000aab0
xor eax, eax
ret

Function at 0x14000aad0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140014140]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000aaef
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x14000aaf8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000aaef
movzx ecx, word [rax + 6]
mov eax, ecx
ret
Function at 0x14000ab90
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140014140]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000abaf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x14000abb8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x14003ca00
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14003ca0d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14003ca1d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14003ca05
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14003ca35
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14003ca22
sub eax, 3
jb 0x14003ca4f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14003ca86
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14003ca76
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14003ca74
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14003ca63
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14003c9c2
jmp 0x14003ca0d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x23e00
mov dl, reloc.COMCTL32.dll_InitCommonControls
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14003cad2
cmp rsi, rcx
jae 0x14003cada
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14003cab9
cmp al, 0x8f
ja 0x14003cab9
cmp byte [rsi - 2], 0xf
je 0x14003cabf
sub al, 0xe8
cmp al, 1
ja 0x14003caa3
cmp rsi, rcx
jae 0x14003cada
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14003caa9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14003cada
lodsb al, byte [rsi]
jmp 0x14003cab9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x39000]
mov eax, dword [rdi]
or eax, eax
je 0x14003cb43
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x40f0c]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14003cae7
jns 0x14003cb1c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14003cb26
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14003cb3d
mov qword [rbx], rax
add rbx, 8
jmp 0x14003cb07
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x18f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14003cb9b
sub rsp, 0xffffffffffffff80
jmp 0x1400242ac
Function at 0x140028ca0
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x140028d6c
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x140028d6c
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x140028d85
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x140028d5c
cmp byte [rax], 0x5c
jne 0x140028d56
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x140028d56
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x140028d42
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x140028d53
test r8b, 0x10
jne 0x140028d56
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x140028d56
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.14002cda0
test edi, edi
jne 0x140028cc0
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
mov rcx, rbx
call fcn.14002a290
int3

Function at 0x14002dba0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x14002dbd4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [rdx + r9]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x14002dbc0
ret
Function at 0x1400385e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400fa480]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14003860d
xor eax, eax
jmp 0x14003875b
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140038647
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140038647
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14003875b
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14003874e
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14003868a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140038699
movsx ecx, dil
jmp 0x1400386ed
lea r8, [rsp + 0x48]
mov byte [rsp + 0x40], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x41]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x40]
call qword [rax + 0x38]
test eax, eax
je 0x140038707
sub eax, 1
je 0x140038707
cmp eax, 2
jne 0x14003874e
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call fcn.14009e9e4
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140038753
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140038734
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.14009f2d0
cmp rsi, rax
jne 0x14003874e
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140038753
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14008fab0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140038e10
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140038e41
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x140038ebb
mov rdi, r14
mov rcx, rbx
call fcn.14002ad60
test rax, rax
jle 0x140038e93
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.1400b3c20
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x140038eab
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140038eb3
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140038e55
sub r14, rdi
jmp 0x140038f9f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140038ed2
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140038ed4
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140038f06
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1400b3c20
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x140038f9c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140038f41
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x140038f7d
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.14009ed68
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x140038f9c
cmp rbp, rax
ja 0x140038f50
test rbp, rbp
je 0x140038f9c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.14009ed68
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140038fc0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rbp, rdx
mov rdi, rcx
mov rbx, r8
je 0x140039058
test r8, r8
jle 0x140039050
nop word [rax + rax]
mov rcx, rdi
call fcn.14002c150
test rax, rax
jle 0x14003902e
cmp rbx, rax
mov rsi, rbx
mov rdx, rbp
cmovge rsi, rax
mov rax, qword [rdi + 0x40]
mov r8, rsi
mov rcx, qword [rax]
call fcn.1400b3c20
mov rax, qword [rdi + 0x58]
sub rbx, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
jmp 0x140039048
mov rax, qword [rdi]
mov rcx, rdi
movzx edx, byte [rbp]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
cmp eax, 0xffffffff
je 0x140039050
dec rbx
mov esi, 1
add rbp, rsi
test rbx, rbx
jg 0x140038ff0
sub r14, rbx
mov rax, r14
jmp 0x1400390d6
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], r15
mov r9, qword [rax]
test r9, r9
je 0x140039071
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140039073
xor ecx, ecx
movsxd rsi, ecx
test r14, r14
jle 0x1400390cb
test ecx, ecx
jle 0x1400390ac
cmp r14, rsi
mov rcx, r9
cmovl rsi, r14
mov r8, rsi
call fcn.1400b3c20
mov rax, qword [rdi + 0x58]
add rbp, rsi
sub r14, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
test r14, r14
jle 0x1400390cb
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400390cb
mov r8, r14
mov edx, 1
mov rcx, rbp
call fcn.14009f2d0
sub r14, rax
mov r15, qword [rsp + 0x40]
sub rbx, r14
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14003c520
Capabilities:
Load windows common language runtime

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
cmp qword [0x1400fce40], 0
jne 0x14003c610
xor ebx, ebx
lea r8, [rsp + 0x48]
lea rdx, [0x1400c1438]
mov qword [rsp + 0x48], rbx
lea rcx, [0x1400c1448]
call sub.mscoree.dll_CLRCreateInstance
lea rdi, [0x1400fce40]
test eax, eax
js 0x14003c5d4
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x40], rbx
lea r8, [0x1400c1458]
lea rdx, str.v4.0.30319
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov ebx, eax
test eax, eax
js 0x14003c5c5
mov rcx, qword [rsp + 0x40]
lea r8, [0x1400c1488]
mov r9, rdi
lea rdx, [0x1400c1478]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov ebx, eax
test eax, eax
js 0x14003c5ba
mov rcx, qword [0x1400fce40]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
test ebx, ebx
jns 0x14003c610
cmp qword [0x1400fce40], 0
jne 0x14003c610
lea r9, [0x1400c1488]
mov qword [rsp + 0x20], rdi
lea r8, [0x1400c1478]
xor edx, edx
lea rcx, str.v2.0.50727
call sub.mscoree.dll_CorBindToRuntime
test eax, eax
js 0x14003c61d
mov rcx, qword [0x1400fce40]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov al, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
xor r9d, r9d
lea r8, [0x1400c1560]
lea rdx, [0x1400c1580]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rbx, qword [rsp + 0x50]
xor al, al
add rsp, 0x30
pop rdi
ret
Function at 0x140041ab0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rdi, rcx
xor ebp, ebp
add rcx, 0x10
call fcn.1400595b0
mov ecx, dword [rdi + 0x340]
test al, al
je 0x140041c30
cmp ecx, 1
je 0x140041c25
mov dword [rdi + 0x340], 1
lea rcx, [0x1400fc8f0]
call fcn.1400473c0
test al, al
je 0x140041c93
cmp byte [rdi + 0x598], bpl
jne 0x140041c9b
mov byte [rdi + 0x598], 1
cmp qword [0x1400fc528], rbp
je 0x140041b52
lea rcx, [rdi + 0x80]
call fcn.140065110
lea rcx, [rdi + 0x80]
call fcn.140064f60
mov rcx, qword [0x1400fc528]
test rcx, rcx
je 0x140041ca1
mov rax, qword [rcx]
call qword [rax + 0x10]
xor edx, edx
mov rcx, rdi
call fcn.1400463f0
mov rcx, rdi
call fcn.140044940
lea rcx, [rdi + 0x10]
call fcn.1400594c0
test al, al
je 0x140041c93
lea rcx, [rdi + 0x10]
call fcn.140059ca0
lea rbx, [rdi + 0x630]
cmp byte [rbx + 8], bpl
jne 0x140041c19
cmp qword [rbx + 0x18], rbp
je 0x140041c19
mov word [rbx + 8], 0x101
mov dword [rbx + 0x20], 0x32
mov ecx, 8
call fcn.14008f5fc
test rax, rax
je 0x140041bba
mov qword [rax], rbx
jmp 0x140041bbd
mov rax, rbp
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x14003d450]
xor edx, edx
xor ecx, ecx
call fcn.14009f95c
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140041cb2
cmp dword [rsp + 0x38], 0
je 0x140041ca7
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.14008e8a8
test eax, eax
jne 0x140041ca7
mov dl, 1
mov rcx, rdi
call fcn.1400463f0
jmp 0x140041c7e
lea rcx, [rdi + 0x10]
call fcn.1400025e0
jmp 0x140041c7e
test ecx, ecx
je 0x140041c7e
cmp ecx, 1
jne 0x140041c42
lea rcx, [rdi + 0x10]
call fcn.1400025e0
mov dword [rdi + 0x340], ebp
mov rcx, rdi
call fcn.140044940
mov byte [rdi + 0x638], bpl
mov ebx, 0x1388
cmp byte [rdi + 0x639], bpl
je 0x140041c7e
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, 0x32
js 0x140041c7e
cmp byte [rdi + 0x639], bpl
jne 0x140041c65
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
xor ecx, ecx
call fcn.14009ffd8
int3
call fcn.1400462f0
int3
call fcn.14008d3ac
nop
mov ecx, 1
call fcn.14008d718
nop
mov dword [rsp + 0x38], ebp
mov ecx, 6
call fcn.14008d718
int3