joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001bca0
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x14001beee
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x14005f040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x1a]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x140051e30]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x1a]
test edx, edx
je 0x14001beb6
mov rcx, rbp
call fcn.14001b2d0
mov r9d, dword [rdi - 0x16]
mov rbx, rax
test r9d, r9d
je 0x14001bd71
movsxd rdx, dword [rbp + 0x3268]
mov r8, qword [rbp + 0x3270]
mov r10, rdx
shl r10, 4
add r10, r8
test rdx, rdx
je 0x14001bd61
nop dword [rax]
mov rcx, rdx
shr rcx, 1
mov rax, rcx
add rax, rax
cmp dword [r8 + rax*8], r9d
jae 0x14001bd59
lea r8, [r8 + rax*8]
mov rax, 0xffffffffffffffff
sub rax, rcx
add r8, 0x10
add rdx, rax
jmp 0x14001bd5c
mov rdx, rcx
test rdx, rdx
jne 0x14001bd30
cmp r8, r10
je 0x14001bd71
cmp dword [r8], r9d
jne 0x14001bd71
mov rcx, qword [r8 + 8]
jmp 0x14001bd73
xor ecx, ecx
mov qword [rbx + 0x18], rcx
movsx eax, word [rdi - 2]
movd xmm1, eax
movsx eax, word [rdi]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 2]
movd xmm1, eax
movsx eax, word [rdi + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x50], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
movsx eax, word [rdi + 6]
movd xmm1, eax
movsx eax, word [rdi + 8]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [rbx + 0xbc]
and eax, 0xfffffe49
movss dword [rbx + 0x58], xmm1
or eax, 0x49
mov dword [rbx + 0xbc], eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x5c], xmm0
test rcx, rcx
je 0x14001be07
cmp qword [rcx + 0x20], 0
jne 0x14001bdfc
mov qword [rcx + 0x20], rbx
jmp 0x14001be07
cmp qword [rcx + 0x28], 0
jne 0x14001be07
mov qword [rcx + 0x28], rbx
mov eax, dword [rdi - 0xe]
mov r9, rbx
mov dword [rbx + 0xb4], eax
movsx eax, byte [rdi - 0xa]
mov dword [rbx + 0x60], eax
mov ecx, dword [rdi - 6]
mov eax, dword [rbx + 0xc]
and ecx, 0xc1fc20
or eax, dword [rbx + 4]
or eax, ecx
mov dword [rbx + 8], ecx
mov dword [rbx + 0x10], eax
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x14001be4c
nop word [rax + rax]
mov r9, rax
mov rax, qword [rax + 0x18]
test rax, rax
jne 0x14001be40
mov r9d, dword [r9]
lea r8, str.DockNode__02X
mov edx, 0x14
lea rcx, [rsp + 0x20]
call fcn.140003160
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov ecx, r14d
test r9b, r9b
je 0x14001bea8
cmp r9b, 0x23
jne 0x14001be8b
cmp byte [r8], r9b
jne 0x14001be8b
cmp byte [r8 + 1], r9b
cmove ecx, r14d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r15 + rdx*4]
test r9b, r9b
jne 0x14001be78
not ecx
call fcn.14000b6b0
mov qword [rbx + 0x80], rax
add rdi, 0x24
sub rsi, 1
jne 0x14001bcf0
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14004e840
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x14004c450
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x14005f040]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
mov ebx, edx
mov r8, rcx
test al, al
je 0x14004c490
cmp al, 0x25
jne 0x14004c484
cmp byte [r8 + 1], al
jne 0x14004c490
inc r8
movzx eax, byte [r8 + 1]
inc r8
test al, al
jne 0x14004c477
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x14004c5ee
cmp byte [r8 + 1], dl
je 0x14004c5ee
lea r11, [rsp + 0x20]
mov r9, r8
nop
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x14004c4cd
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x14004c4f5
sub dl, 0x61
cmp dl, 0x19
ja 0x14004c4e7
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x14004c4f5
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x14004c4b0
jmp 0x14004c4f8
inc r9
cmp r8, r9
jae 0x14004c52f
movabs rdx, 0x800000000000009
nop word [rax + rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x14004c524
bt rdx, rax
jb 0x14004c52a
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x14004c510
xorps xmm3, xmm3
mov byte [r11], 0
cvtss2sd xmm3, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
movq r9, xmm3
call fcn.140003160
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x14004c568
nop
inc rcx
cmp byte [rcx], 0x20
je 0x14004c560
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x14004c5dc
movzx r8d, byte [rcx]
movzx eax, r8b
cmp r8b, 0x2d
jne 0x14004c588
lea rax, [rcx + 1]
mov rcx, rax
movzx eax, byte [rax]
cmp al, 0x2b
lea rdx, [rcx + 1]
xorps xmm1, xmm1
cmovne rdx, rcx
movzx eax, byte [rdx]
cmp al, 0x30
jl 0x14004c5ca
movss xmm2, dword [0x1400563fc]
cmp al, 0x39
ja 0x14004c5ca
movsx eax, byte [rdx]
inc rdx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rdx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x14004c5a4
cmp r8b, 0x2d
jne 0x14004c5e9
xorps xmm1, xmmword [0x1400568e0]
movaps xmm0, xmm1
jmp 0x14004c5f1
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14004c5f1
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14004e840
add rsp, 0x90
pop rbx
ret
Function at 0x14004c610
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x14005f040]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
mov ebx, edx
mov r8, rcx
test al, al
je 0x14004c650
cmp al, 0x25
jne 0x14004c644
cmp byte [r8 + 1], al
jne 0x14004c650
inc r8
movzx eax, byte [r8 + 1]
inc r8
test al, al
jne 0x14004c637
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x14004c7a8
cmp byte [r8 + 1], dl
je 0x14004c7a8
lea r11, [rsp + 0x20]
mov r9, r8
nop
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x14004c68d
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x14004c6b5
sub dl, 0x61
cmp dl, 0x19
ja 0x14004c6a7
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x14004c6b5
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x14004c670
jmp 0x14004c6b8
inc r9
cmp r8, r9
jae 0x14004c6ef
movabs rdx, 0x800000000000009
nop word [rax + rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x14004c6e4
bt rdx, rax
jb 0x14004c6ea
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x14004c6d0
movaps xmm3, xmm2
mov byte [r11], 0
movq r9, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140003160
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x14004c728
nop dword [rax + rax]
inc rcx
cmp byte [rcx], 0x20
je 0x14004c720
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x14004c79a
movzx r8d, byte [rcx]
movzx eax, r8b
cmp r8b, 0x2d
jne 0x14004c748
lea rax, [rcx + 1]
mov rcx, rax
movzx eax, byte [rax]
cmp al, 0x2b
lea rdx, [rcx + 1]
xorps xmm1, xmm1
cmovne rdx, rcx
movzx eax, byte [rdx]
cmp al, 0x30
jl 0x14004c788
movsd xmm2, qword [0x140056398]
cmp al, 0x39
ja 0x14004c788
movsx eax, byte [rdx]
inc rdx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rdx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x14004c764
cmp r8b, 0x2d
jne 0x14004c7a3
xorps xmm1, xmmword [0x1400568d0]
movaps xmm0, xmm1
jmp 0x14004c7ab
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14004c7ab
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14004e840
add rsp, 0x90
pop rbx
ret

Function at 0x14004ca70
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14005f040]
xor rax, rsp
mov qword [rsp + 0x30], rax
movsxd rdi, ecx
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movabs rax, 0x20c49ba5e353f7cf
lea rcx, [rsp + 0x20]
imul qword [rsp + 0x28]
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0x28], rdx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
cqo
mov qword [rsp + 0x20], 0
idiv qword [rsp + 0x28]
add rdi, rax
test rdi, rdi
jle 0x14004cb02
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
cqo
idiv qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
cmp rax, rdi
jl 0x14004cae1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004e840
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14004f568
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004f5b2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004f5b2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004f5b2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004f5b2
cmp dword [rcx + 0x84], 0xe
jbe 0x14004f5b2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004f5b4
xor al, al
add rsp, 0x28
ret
Function at 0x140001aa8
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 8], ecx
mov r11, rsp
push rbx
sub rsp, 0x50
and qword [r11 + 0x10], 0
xor ebx, ebx
lea rax, [r11 + 0x10]
and qword [r11 - 0x18], rbx
mov qword [r11 - 0x20], rax
and qword [r11 - 0x28], rbx
lea rdx, [0x140001190]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x2011f
and dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140001b25
mov rcx, qword [rsp + 0x68]
lea r9d, [rbx + 4]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], r9d
lea rdx, [0x1400011f8]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_RegSetValueExW]
lea ecx, [rbx + 1]
test eax, eax
cmove ebx, ecx
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140001b35
call qword [sym.imp.KERNEL32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x50
pop rbx
ret

Function at 0x140001b44
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x188]
sub rsp, 0x280
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rax, qword [0x140001220]
mov rdi, r8
xor esi, esi
mov qword [rsp + 0x60], rax
mov rax, qword [0x140001228]
lea rcx, [rbp - 0x44]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140001230]
xor edx, edx
mov qword [rsp + 0x70], rax
mov rax, qword [0x140001238]
mov r8d, 0x1ac
mov qword [rsp + 0x78], rax
mov rax, qword [0x140001240]
mov qword [rsp + 0x50], rsi
mov qword [rbp - 0x80], rax
mov rax, qword [0x140001248]
mov ebx, esi
mov qword [rbp - 0x78], rax
mov rax, qword [0x140001250]
mov qword [rbp - 0x70], rax
mov rax, qword [0x140001258]
mov qword [rbp - 0x68], rax
mov rax, qword [0x140001260]
mov qword [rbp - 0x60], rax
mov rax, qword [0x140001268]
mov qword [rbp - 0x58], rax
mov rax, qword [0x140001270]
mov qword [rbp - 0x50], rax
mov eax, dword [0x140001278]
mov dword [rbp - 0x48], eax
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x60]
call fcn.140001658
test eax, eax
js 0x140001c9f
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20106
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140001c9f
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], si
jne 0x140001c64
mov rcx, qword [rsp + 0x50]
lea eax, [rax*2 + 2]
lea rdx, [0x140001140]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov edi, 1
mov r9d, edi
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RegSetValueExW]
test eax, eax
cmove ebx, edi
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140001caf
call qword [sym.imp.KERNEL32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140003d00
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140001ce0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x160], rax
mov rax, qword [0x140001220]
and qword [rsp + 0x38], 0
lea rcx, [rbp - 0x54]
mov qword [rsp + 0x50], rax
mov rax, qword [0x140001228]
xor edx, edx
mov qword [rsp + 0x58], rax
mov rax, qword [0x140001230]
mov r8d, 0x1ac
mov qword [rsp + 0x60], rax
mov rax, qword [0x140001238]
xor ebx, ebx
mov qword [rsp + 0x68], rax
mov rax, qword [0x140001240]
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x70], rax
mov rax, qword [0x140001248]
mov qword [rsp + 0x78], rax
mov rax, qword [0x140001250]
mov qword [rbp - 0x80], rax
mov rax, qword [0x140001258]
mov qword [rbp - 0x78], rax
mov rax, qword [0x140001260]
mov qword [rbp - 0x70], rax
mov rax, qword [0x140001268]
mov qword [rbp - 0x68], rax
mov rax, qword [0x140001270]
mov qword [rbp - 0x60], rax
mov eax, dword [0x140001278]
mov dword [rbp - 0x58], eax
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x50]
call fcn.140001658
test eax, eax
js 0x140001e23
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001e23
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
lea rdx, [0x140001140]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
test eax, eax
jne 0x140001e23
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcrt.dll__wtoi]
mov ebx, eax
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140001e33
call qword [sym.imp.KERNEL32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.140003d00
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rbp
ret
Function at 0x1400024ec
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
jmp 0x1400025d2
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
mov rax, qword gs:[0x60]
xor r14d, r14d
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x20]
test rdx, rdx
je 0x140002655
movzx eax, word [rdx + 0x48]
mov r8d, r14d
shr eax, 1
mov r9, qword [rdx + 0x50]
je 0x14000264a
mov r10d, eax
movzx ecx, word [r9]
lea r9, [r9 + 2]
cmp cx, 0x61
lea eax, [rcx - 0x20]
cmovb ax, cx
imul r8d, r8d, 0x83
movzx ecx, ax
add r8d, ecx
sub r10, 1
jne 0x140002616
btr r8d, 0x1f
cmp r8d, 0x1cca9ce6
je 0x14000264f
mov rdx, qword [rdx]
jmp 0x1400025ff
mov r15, qword [rdx + 0x20]
jmp 0x140002658
mov r15, r14
xor r8d, r8d
mov edx, 0x1ab9b854
mov rcx, r15
call fcn.1400024fe
mov r8, rax
mov edx, 0x7f201f78
mov rcx, r15
mov rdi, rax
call fcn.1400024fe
mov r8, rdi
mov edx, 0x5e893462
mov rcx, r15
mov rbx, rax
call fcn.1400024fe
mov r8, rdi
mov edx, 0x6488073
mov rcx, r15
mov rsi, rax
call fcn.1400024fe
lea rcx, [rbp + 0x30]
mov dword [rbp + 0x30], 0x6c64746e
mov r15, rax
mov word [rbp + 0x34], 0x6c
call rbx
mov r8, rdi
mov edx, 0xdb579cb
mov rcx, rax
mov rbx, rax
call fcn.1400024fe
mov r8, rdi
mov edx, 0x1518e9c0
mov rcx, rbx
call fcn.1400024fe
xor ecx, ecx
lea r12, [0x1400027a2]
mov edx, dword [r12 + 8]
mov r8d, 0x3000
mov rdi, rax
lea r9d, [rcx + 0x40]
call rsi
mov r8d, dword [r12 + 8]
lea rdx, [r12 + 0xc]
mov rcx, rax
mov rsi, rax
call rdi
mov rdx, qword [r12]
mov rax, rdx
mov byte [rbp + 0x38], dl
shr rax, 0x18
mov rcx, rdx
mov byte [rbp + 0x3b], al
mov rax, rdx
shr rax, 0x20
mov byte [rbp + 0x3c], al
mov rax, rdx
shr rax, 0x28
shr rcx, 8
mov byte [rbp + 0x3d], al
mov rax, rdx
mov byte [rbp + 0x39], cl
mov rcx, rdx
shr rax, 0x30
shr rcx, 0x10
shr rdx, 0x38
mov byte [rbp + 0x3a], cl
mov byte [rbp + 0x3e], al
mov byte [rbp + 0x3f], dl
cmp dword [r12 + 8], r14d
jbe 0x14000277a
mov edx, dword [r12 + 8]
mov rcx, rsi
mov rax, r14
inc r14
and eax, 7
mov al, byte [rbp + rax + 0x38]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x140002762
call rsi
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call r15
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1400024fe
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov r9, rcx
mov rbx, r8
mov ebp, edx
mov ecx, dword [rax + rcx + 0x88]
test ecx, ecx
je 0x140002599
cmp dword [rax + r9 + 0x8c], 0
je 0x140002599
lea rax, [r9 + rcx]
mov r11d, dword [rax + 0x18]
test r11d, r11d
je 0x140002599
mov ecx, dword [rax + 0x20]
xor r8d, r8d
mov edi, dword [rax + 0x1c]
add rcx, r9
mov esi, dword [rax + 0x24]
add rdi, r9
add rsi, r9
test r11d, r11d
je 0x140002599
mov r10d, dword [rcx]
add r10, r9
mov r14, r10
xor edx, edx
mov al, byte [r10]
jmp 0x140002581
imul edx, edx, 0x83
movsx eax, al
add edx, eax
inc r14
mov al, byte [r14]
test al, al
jne 0x140002570
btr edx, 0x1f
cmp edx, ebp
je 0x1400025b6
inc r8d
add rcx, 4
cmp r8d, r11d
jb 0x140002560
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test rbx, rbx
jne 0x1400025c8
movzx ecx, word [rsi + r8*2]
mov eax, dword [rdi + rcx*4]
add rax, r9
jmp 0x14000259b
mov rdx, r10
mov rcx, r9
call rbx
jmp 0x14000259b

Function at 0x1400036b4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x230], rax
or rdi, 0xffffffffffffffff
xor ebx, ebx
mov rax, rdi
inc rax
cmp word [rcx + rax*2], bx
jne 0x1400036dc
mov edx, 0x104
cmp rax, rdx
jbe 0x140003712
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140003d00
mov rbx, qword [rsp + 0x258]
add rsp, 0x240
pop rdi
ret
mov r8, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.msvcrt.dll_wcscpy_s]
lea rax, [rsp + 0x20]
inc rdi
cmp word [rax + rdi*2], bx
jne 0x140003725
lea rax, [rdi + rdi]
sub rax, 2
cmp word [rsp + rax + 0x20], 0x5c
je 0x140003746
cmp word [rsp + rax + 0x20], 0x2f
jne 0x140003755
cmp rax, 0x208
jae 0x14000376a
mov word [rsp + rax + 0x20], bx
jmp 0x140003732
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov eax, ebx
jmp 0x1400036f1
call fcn.140003ed8
int3
Function at 0x140003af0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r14
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor r14d, r14d
xor eax, eax
lock cmpxchg qword [0x1400056c8], rbx
je 0x140003b42
cmp rax, rbx
jne 0x140003b35
mov ebx, 1
mov r14d, ebx
jmp 0x140003b47
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140003b19
mov ebx, 1
mov eax, dword [0x1400056d0]
cmp eax, ebx
jne 0x140003b5d
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x140003bc6
mov eax, dword [0x1400056d0]
test eax, eax
jne 0x140003bc0
mov dword [0x1400056d0], ebx
lea r12, [0x140001030]
lea rdi, [0x140001018]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r12
jae 0x140003bb2
test eax, eax
jne 0x140003bb6
mov rsi, qword [rdi]
test rsi, rsi
je 0x140003ba7
mov rcx, rsi
mov rax, qword [0x140008290]
call rax
call rsi
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x140003b84
test eax, eax
je 0x140003bc6
mov eax, 0xff
jmp 0x140003ca7
mov dword [0x1400050e4], ebx
mov eax, dword [0x1400056d0]
cmp eax, ebx
jne 0x140003bed
lea rdx, [0x140001010]
lea rcx, [section..text]
call sub.msvcrt.dll__initterm
mov dword [0x1400056d0], 2
test r14d, r14d
jne 0x140003bfb
xor eax, eax
xchg qword [0x1400056c8], rax
cmp qword [0x1400056d8], 0
je 0x140003c33
lea rcx, [0x1400056d8]
call fcn.140004160
test eax, eax
je 0x140003c33
mov rbx, qword [0x1400056d8]
mov rcx, rbx
mov rax, qword [0x140008290]
call rax
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call rbx
mov r8, qword [0x1400050f8]
mov rdx, qword [0x1400050f0]
mov ecx, dword [0x1400050e8]
call fcn.1400016f0
mov dword [0x1400050e0], eax
cmp dword [0x140005100], 0
jne 0x140003c63
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400050e4], 0
jne 0x140003c78
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400050e0]
jmp 0x140003ca7
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
sub rsp, 0x28
call fcn.1400041f4
add rsp, 0x28
jmp 0x140003af0

Function at 0x140003d24
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x14000404c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140004098
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140004090
cmp dword [rcx + 0x3c], edx
jl 0x140004090
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140004090
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140004098
mov rax, rdx
add rsp, 0x18
ret