joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400073f0
Capabilities:
Create thread
Get disk information

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x14004e010]
xor rax, rsp
mov qword [rsp + 0x70], rax
or rbx, 0xffffffffffffffff
xor r9d, r9d
mov rcx, rbx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov qword [0x140050b18], rax
test rax, rax
je 0x1400075a3
and dword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x34], 0xa
call fcn.1400155c0
mov r14d, eax
mov edi, eax
lea eax, [rbx + 9]
mul r14
cmovo rax, rbx
mov rcx, rax
call fcn.140022440
lea r12d, [rbx + 2]
mov rsi, rax
test r14d, r14d
je 0x1400074af
mov rbx, rax
mov ebp, r14d
and qword [rsp + 0x28], 0
lea r8, [0x1400072e0]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx], rax
lea rbx, [rbx + 8]
sub rbp, r12
jne 0x140007484
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebp, eax
mov ebx, 0x41
test r12b, bpl
je 0x140007516
movzx r15d, bx
lea r8, str._c:_
mov r9d, r15d
lea rcx, [rsp + 0x38]
mov edx, 0x19
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
add eax, 0xfffffffe
cmp eax, 2
ja 0x140007516
mov r9d, r15d
lea r8, str.._c:
mov edx, 0x19
lea rcx, [rsp + 0x38]
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
lea rcx, [rsp + 0x38]
call fcn.140007060
add bx, r12w
shr ebp, 1
cmp bx, 0x5a
jbe 0x1400074bc
jmp 0x14000752f
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x140050b10]
mov eax, dword [0x140050b20]
cmp eax, ecx
jne 0x140007524
test r14d, r14d
je 0x140007561
mov rbx, r14
mov rcx, qword [0x140050b18]
xor r9d, r9d
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
sub rbx, r12
jne 0x140007547
or r9d, 0xffffffff
mov r8d, r12d
mov rdx, rsi
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test r14d, r14d
je 0x14000758e
mov rbx, rsi
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rbx, [rbx + 8]
sub rdi, r12
jne 0x14000757c
mov rcx, rsi
call fcn.140021f18
mov rcx, qword [0x140050b18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140016280
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140007b70
Capabilities:
Encode data using xor

Disassembly:
push rbx
xor r10d, r10d
mov rbx, rdx
mov r11, rcx
test r9, r9
je 0x140007cc4
cmp r9, 8
jb 0x140007c99
lea rcx, [r9 - 1]
lea rax, [r8 - 1]
add rcx, r11
add rax, r9
cmp r11, rax
ja 0x140007baa
cmp rcx, r8
jae 0x140007c99
lea rax, [r9 - 1]
add rax, rbx
cmp r11, rax
ja 0x140007bbf
cmp rcx, rbx
jae 0x140007c99
mov rcx, rbx
mov qword [rsp + 0x18], rdi
sub rcx, r8
mov rdx, r11
cmp r9, 0x40
jb 0x140007c59
mov rdi, r9
mov qword [rsp + 0x10], rsi
and edi, 0x3f
mov rsi, r9
sub rsi, rdi
lea rax, [r8 + 0x10]
sub rdx, r8
nop
movdqu xmm0, xmmword [rax - 0x10]
add r10, 0x40
movdqu xmm1, xmmword [rcx + rax - 0x10]
movdqu xmm2, xmmword [rcx + rax]
lea rax, [rax + 0x40]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rdx + rax - 0x50], xmm1
xorps xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rcx + rax - 0x30]
movdqu xmmword [rdx + rax - 0x40], xmm2
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [rcx + rax - 0x20]
movdqu xmmword [rdx + rax - 0x30], xmm1
xorps xmm2, xmm0
movdqu xmmword [rdx + rax - 0x20], xmm2
cmp r10, rsi
jb 0x140007bf0
mov rsi, qword [rsp + 0x10]
cmp rdi, 8
jb 0x140007c8f
jmp 0x140007c5c
sub rdx, r8
mov rdi, r9
and rdi, 0xfffffffffffffff8
lea rax, [r10 + r8]
nop word [rax + rax]
movq xmm1, qword [rcx + rax]
add r10, 8
movq xmm0, qword [rax]
lea rax, [rax + 8]
xorps xmm1, xmm0
movq qword [rdx + rax - 8], xmm1
cmp r10, rdi
jb 0x140007c70
mov rdi, qword [rsp + 0x18]
cmp r10, r9
jae 0x140007cc4
sub rbx, r8
lea rax, [r10 + r8]
sub r11, r8
sub r9, r10
nop word [rax + rax]
movzx ecx, byte [rax + rbx]
xor cl, byte [rax]
mov byte [rax + r11], cl
lea rax, [rax + 1]
sub r9, 1
jne 0x140007cb0
pop rbx
ret
Function at 0x140007cd0
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x50
mov rax, qword [0x14004e010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov rdi, rcx
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x38]
movups xmmword [rsp + 0x38], xmm0
call fcn.140008e30
test eax, eax
jne 0x140007e6e
mov r8d, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x3c]
mov r9d, dword [rsp + 0x40]
bswap ecx
mov ecx, ecx
bswap r8d
bswap r9d
mov r8d, r8d
shl r8, 0x20
or r8, rcx
mov r9d, r9d
mov ecx, dword [rsp + 0x44]
shl r9, 0x20
bswap ecx
mov ecx, ecx
or r9, rcx
mov qword [rsp + 0x68], rbx
cmp dword [0x140050b30], eax
mov qword [rdi + 0xa0], r9
mov qword [rdi + 0x120], r8
jne 0x140007d9c
mov eax, 1
mov dword [0x140050b30], 1
xor ecx, ecx
cpuid
mov dword [0x140050b38], eax
mov dword [0x140050b3c], ebx
mov dword [0x140050b40], ecx
mov dword [0x140050b44], edx
mov dword [0x140050b34], ecx
jmp 0x140007da2
mov ecx, dword [0x140050b34]
test cl, 2
jne 0x140007e67
mov qword [rdi + 0xe0], 0
mov qword [rdi + 0x60], 0
mov ebx, 4
mov eax, r9d
mov rcx, r8
and eax, 1
shl rcx, 0x3f
imul edx, eax, 0xe1000000
mov rax, r9
shr rax, 1
mov r9, rcx
or r9, rax
mov rax, r8
shr rax, 1
mov qword [rdi + rbx*8 + 0x60], r9
mov ecx, edx
shl rcx, 0x20
mov r8, rcx
xor r8, rax
mov qword [rdi + rbx*8 + 0xe0], r8
shr ebx, 1
jne 0x140007dc3
mov r10d, 2
mov ebx, r10d
nop
mov r8, qword [rdi + rbx*8 + 0xe0]
mov r9, qword [rdi + rbx*8 + 0x60]
cmp rbx, 1
jle 0x140007e58
lea rax, [rdi + 0x68]
lea rdx, [rbx - 1]
nop dword [rax + rax]
mov rcx, r8
xor rcx, qword [rax + 0x80]
mov qword [rax + rbx*8 + 0x80], rcx
lea rax, [rax + 8]
mov rcx, r9
xor rcx, qword [rax - 8]
mov qword [rax + rbx*8 - 8], rcx
sub rdx, 1
jne 0x140007e30
lea eax, [r10 + r10]
add rbx, rbx
mov r10d, eax
cmp eax, 8
jle 0x140007e10
mov rbx, qword [rsp + 0x68]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140016280
add rsp, 0x50
pop rdi
ret
Function at 0x1400095a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm1, xmmword [rdx]
aeskeygenassist xmm0, xmm1, 1
pshufd xmm3, xmm0, 0xff
xorps xmm3, xmm1
movups xmmword [rcx], xmm1
pslldq xmm1, 4
xorps xmm3, xmm1
pslldq xmm1, 4
xorps xmm3, xmm1
pslldq xmm1, 4
xorps xmm3, xmm1
aeskeygenassist xmm0, xmm3, 2
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x10], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 4
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x20], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
xorps xmm0, xmm1
movdqa xmm3, xmm2
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 8
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x30], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 0x10
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x40], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
xorps xmm0, xmm1
movdqa xmm3, xmm2
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 0x20
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x50], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 0x40
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x60], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
movdqa xmm3, xmm2
xorps xmm0, xmm1
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 0x80
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x70], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 0x1b
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x80], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
xorps xmm0, xmm1
movdqa xmm3, xmm2
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 0x36
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x90], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm1, xmm3
xorps xmm1, xmm0
pslldq xmm3, 4
xorps xmm1, xmm3
movdqu xmmword [rcx + 0xa0], xmm1
ret
Function at 0x1400107d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
movzx eax, r9b
mov rdi, r8
movzx r11d, al
mov rbx, rdx
and r11b, 0x1f
shr eax, 5
mov r10, rcx
and eax, 0x80000003
jge 0x14001080a
dec eax
or eax, 0xfffffffc
inc eax
movzx ecx, al
movzx ebp, r11b
mov r9d, dword [r8 + rcx*4]
mov ecx, 0x20
sub cl, r11b
movzx edx, cl
xor ecx, ecx
test r11b, r11b
bswap r9d
cmove edx, ecx
sub rbx, r10
movzx esi, dl
lea r11d, [rcx + 4]
nop word [rax + rax]
inc al
lea r10, [r10 + 4]
and al, 3
movzx ecx, al
mov r8d, dword [rdi + rcx*4]
mov ecx, esi
bswap r8d
mov edx, r8d
shr edx, cl
mov ecx, ebp
shl r9d, cl
or edx, r9d
mov r9d, r8d
bswap edx
xor edx, dword [rbx + r10 - 4]
mov dword [r10 - 4], edx
sub r11, 1
jne 0x140010840
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x140014ad0
Capabilities:
Get file size
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rsi, rdx
mov rbx, rcx
mov byte [rcx + 8], 1
xor r12d, r12d
mov dword [rcx + 0x41c], r12d
mov byte [rcx + 8], 1
xor edx, edx
mov r8d, 0x410
add rcx, 0xa
call fcn.140019250
lea rax, vtable.FileWrapper.0
mov qword [rbx], rax
lea rdi, [rbx + 0x420]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], r12
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rsi + r8*2], r12w
jne 0x140014b40
mov rdx, rsi
mov rcx, rdi
call fcn.140005da0
nop
mov qword [rbx + 0x440], 0xffffffffffffffff
mov dword [rbx + 0x448], 1
mov qword [rbx + 0x450], r12
mov qword [rbx + 0x458], r12
mov ebp, r12d
nop dword [rax]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x8000080
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 0x440], rax
cmp rax, 0xffffffffffffffff
jne 0x140014c5f
call qword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 5
je 0x140014bef
sub eax, 0x1b
je 0x140014bcf
cmp eax, 1
jne 0x140014c37
mov dword [rbx + 0x448], 3
mov r8, rdi
cmp qword [rdi + 0x18], 8
jb 0x140014be6
mov r8, qword [rdi]
lea rdx, str.In_use_another_process:__s
jmp 0x140014c23
mov edx, 0x80
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rsi
call fcn.140015f20
mov dword [rbx + 0x448], 2
mov r8, rdi
cmp qword [rdi + 0x18], 8
jb 0x140014c1c
mov r8, qword [rdi]
lea rdx, str.No_permission:__s
mov rcx, rbx
call fcn.1400015d8
inc ebp
cmp ebp, 2
jge 0x140014c7b
jmp 0x140014b80
cmp qword [rdi + 0x18], 8
jb 0x140014c41
mov rdi, qword [rdi]
mov r8, rdi
lea rdx, str.Cant_open:__s
mov rcx, rbx
call fcn.1400015d8
mov dword [rbx + 0x448], 1
jmp 0x140014c7b
mov dword [rbx + 0x448], r12d
mov byte [rbx + 8], 1
xor edx, edx
mov r8d, 0x410
lea rcx, [rbx + 0xa]
call fcn.140019250
cmp dword [rbx + 0x448], 0
jne 0x140014c99
lea rdx, [rbx + 0x450]
mov rcx, qword [rbx + 0x440]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop
mov rax, rbx
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140014f00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push r14
push r15
sub rsp, 0x30
cmp qword [rcx + 0x440], 0xffffffffffffffff
mov rbp, r9
mov r14d, r8d
mov r15, rdx
mov rbx, rcx
jne 0x140014f35
xor al, al
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r12
xor r12d, r12d
mov edi, r12d
nop word [rax + rax]
mov rcx, qword [rbx + 0x440]
mov r9, rbp
mov r8d, r14d
mov qword [rsp + 0x20], r12
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x140014fae
lea r8, [rbx + 0x420]
cmp qword [r8 + 0x18], 8
jb 0x140014f88
mov r8, qword [r8]
mov r9d, eax
lea rdx, str._s:_ReadFile_code:__lu
mov rcx, rbx
call fcn.140014480
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x32
jl 0x140014f50
test esi, esi
mov r12, qword [rsp + 0x60]
setne al
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
Function at 0x140014fd0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov rax, qword [0x14004e010]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor r15d, r15d
mov qword [rsp + 0x38], r9
mov r12, r9
mov dword [rsp + 0x30], r8d
mov ebp, r8d
mov qword [rsp + 0x40], r15
mov r14, rdx
lea r9, [rsp + 0x48]
lea r8d, [r15 + 1]
mov edx, r15d
mov rsi, rcx
call fcn.140015460
test al, al
je 0x1400150c5
mov rbx, qword [rsp + 0x48]
mov dword [r12], r15d
mov rdi, rbx
mov r13, qword [r14]
mov dword [rsp + 0x40], r15d
test ebp, ebp
je 0x14001519d
mov eax, r15d
nop word [rax + rax]
mov r12d, ebp
sub r12d, eax
cmp qword [rsi + 0x440], 0xffffffffffffffff
je 0x1400150c5
mov ebp, r15d
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rsi + 0x440]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1400150e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rsi + 0x420]
cmp qword [r8 + 0x18], 8
jb 0x1400150a1
mov r8, qword [r8]
mov r9d, eax
lea rdx, str._s:_SetPos_code:__lu
mov rcx, rsi
call fcn.140014480
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebp
cmp ebp, 0x32
jl 0x140015070
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140016280
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp qword [rsi + 0x440], 0xffffffffffffffff
je 0x1400150c5
mov ebp, r15d
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rsi + 0x440]
lea r9, [rsp + 0x40]
mov r8d, r12d
mov qword [rsp + 0x20], r15
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test r14d, r14d
jne 0x140015170
cmp qword [rsi + 0x438], 8
lea r8, [rsi + 0x420]
jb 0x140015143
mov r8, qword [rsi + 0x420]
mov r9d, eax
lea rdx, str._s:_ReadFile_code:__lu
mov rcx, rsi
call fcn.140014480
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebp
cmp ebp, 0x32
jl 0x140015100
test r14d, r14d
je 0x1400150c5
mov ecx, dword [rsp + 0x40]
add qword [rsi + 0x458], rcx
add r13, rcx
mov r8, qword [rsp + 0x38]
mov ebp, dword [rsp + 0x30]
mov eax, dword [r8]
add eax, ecx
mov dword [r8], eax
cmp eax, ebp
jae 0x14001519d
mov rbx, qword [rsp + 0x48]
jmp 0x140015050
cmp qword [rsi + 0x440], 0xffffffffffffffff
je 0x1400150c5
nop dword [rax + rax]
mov rcx, qword [rsi + 0x440]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov ebx, eax
test eax, eax
jne 0x140015209
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rsi + 0x420]
cmp qword [r8 + 0x18], 8
jb 0x1400151e3
mov r8, qword [r8]
mov r9d, eax
lea rdx, str._s:_SetPos_code:__lu
mov rcx, rsi
call fcn.140014480
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
inc r15d
cmp r15d, 0x32
jl 0x1400151b0
test ebx, ebx
setne al
jmp 0x1400150c7
Function at 0x140015220
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov rax, qword [0x14004e010]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor r15d, r15d
mov qword [rsp + 0x38], r9
mov r12, r9
mov dword [rsp + 0x30], r8d
mov ebp, r8d
mov qword [rsp + 0x40], r15
mov r14, rdx
lea r9, [rsp + 0x48]
lea r8d, [r15 + 1]
mov edx, r15d
mov rsi, rcx
call fcn.140015460
test al, al
je 0x140015440
mov rbx, qword [rsp + 0x48]
mov dword [r12], r15d
mov rdi, rbx
mov r13, qword [r14]
mov dword [rsp + 0x40], r15d
test ebp, ebp
je 0x1400153d3
mov eax, r15d
nop word [rax + rax]
mov r12d, ebp
sub r12d, eax
cmp qword [rsi + 0x440], 0xffffffffffffffff
je 0x140015440
mov ebp, r15d
nop word [rax + rax]
mov rcx, qword [rsi + 0x440]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov r14d, eax
test eax, eax
jne 0x140015318
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rsi + 0x420]
cmp qword [r8 + 0x18], 8
jb 0x1400152f4
mov r8, qword [r8]
mov r9d, eax
lea rdx, str._s:_SetPos_code:__lu
mov rcx, rsi
call fcn.140014480
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebp
cmp ebp, 0x32
jl 0x1400152c0
test r14d, r14d
je 0x140015440
cmp qword [rsi + 0x440], 0xffffffffffffffff
je 0x140015440
test r13, r13
je 0x140015440
mov ebx, r15d
nop dword [rax + rax]
mov rcx, qword [rsi + 0x440]
lea r9, [rsp + 0x40]
mov r8d, r12d
mov qword [rsp + 0x20], r15
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebp, eax
test eax, eax
jne 0x14001539e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rsi + 0x420]
cmp qword [r8 + 0x18], 8
jb 0x14001537a
mov r8, qword [r8]
mov r9d, eax
lea rdx, str._s:_WriteFile_code:__lu
mov rcx, rsi
call fcn.140014480
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x32
jl 0x140015340
test ebp, ebp
je 0x140015440
mov ecx, dword [rsp + 0x40]
add qword [rsi + 0x458], rcx
add r13, rcx
mov r8, qword [rsp + 0x38]
mov ebp, dword [rsp + 0x30]
mov eax, dword [r8]
add eax, ecx
mov dword [r8], eax
cmp eax, ebp
jae 0x1400153d3
mov rbx, qword [rsp + 0x48]
jmp 0x1400152a0
cmp qword [rsi + 0x440], 0xffffffffffffffff
je 0x140015440
nop dword [rax]
mov rcx, qword [rsi + 0x440]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov ebx, eax
test eax, eax
jne 0x140015439
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rsi + 0x420]
cmp qword [r8 + 0x18], 8
jb 0x140015413
mov r8, qword [r8]
mov r9d, eax
lea rdx, str._s:_SetPos_code:__lu
mov rcx, rsi
call fcn.140014480
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
inc r15d
cmp r15d, 0x32
jl 0x1400153e0
test ebx, ebx
setne al
jmp 0x140015442
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140016280
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400155c0
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14004e010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov eax, dword [rcx]
mov rbx, rcx
test eax, eax
jne 0x140015607
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rsp + 0x40]
mov dword [rbx], ecx
cmp ecx, 1
ja 0x1400155fb
mov eax, 2
jmp 0x140015605
mov eax, dword [rbx + 4]
cmp ecx, eax
ja 0x140015605
lea eax, [rcx - 1]
mov dword [rbx], eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140016280
add rsp, 0x60
pop rbx
ret

Function at 0x140015890
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xb0
mov rax, qword [0x14004e010]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140052d9c], eax
jle 0x140015a33
lea rcx, [0x140052d9c]
call fcn.140016348
cmp dword [0x140052d9c], 0xffffffff
jne 0x140015a33
mov ecx, 0x40
call fcn.1400163c0
mov rbx, rax
mov qword [rsp + 0x20], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
lea ecx, [rax + 0x30]
call fcn.1400163c0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
lea rcx, [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x90]
cmp edi, 1
ja 0x140015959
mov edi, 2
jmp 0x140015967
cmp edi, 0xa
jbe 0x140015965
mov edi, 0xa
jmp 0x140015967
dec edi
mov dword [rsp + 0x30], 0x40
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rcx, qword [rsp + 0x40]
mov edx, 0x100000
test eax, eax
cmove rcx, rdx
mov qword [rbx + 0x10], 0xa000000
xorps xmm1, xmm1
test rcx, rcx
js 0x1400159a1
cvtsi2sd xmm1, rcx
jmp 0x1400159b6
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm1, rax
addsd xmm1, xmm1
mulsd xmm1, qword [str.ffffff]
mov eax, edi
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm1, xmm0
xor ecx, ecx
movsd xmm0, qword [0x140047d88]
comisd xmm1, xmm0
jb 0x1400159f3
subsd xmm1, xmm0
comisd xmm1, xmm0
jae 0x1400159f3
movabs rax, 0x8000000000000000
mov rcx, rax
cvttsd2si rax, xmm1
add rax, rcx
and rax, 0xffffffffff800000
cmp rax, 0x800000
jae 0x140015a10
mov eax, 0x1800000
jmp 0x140015a1c
mov edx, 0xff800000
cmp rax, rdx
cmova rax, rdx
mov qword [rbx + 0x10], rax
mov qword [0x140052da0], rbx
lea rcx, [0x140052d9c]
call fcn.1400162dc
mov rax, qword [0x140052da0]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140016280
mov rbx, qword [rsp + 0xc0]
add rsp, 0xb0
pop rdi
ret
Function at 0x140016e78
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140016ec2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140016ec2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140016ec2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140016ec2
cmp dword [rcx + 0x84], 0xe
jbe 0x140016ec2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140016ec4
xor al, al
add rsp, 0x28
ret

Function at 0x14002327c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140023078