joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800e272c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.1800df240
sub rsp, rax
mov rax, qword [0x180180040]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.1800eee14
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x1800e277b
mov rax, rbp
jmp 0x1800e2887
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x180000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x181ad0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.1800ef0a8
mov r13, rax
lea rax, [0x180000000]
mov rcx, qword [rax + rbx*8 + 0x181ad0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x1800e2883
mov dword [rsp + 0x30], edi
lea r9, [rsp + 0x30]
mov rcx, qword [rcx + r12*8 + 0x28]
lea rdx, [rsp + 0x40]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800e2883
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.1800ef0a8
test rax, rax
js 0x1800e2883
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x1800e2883
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x1800e2875
lea r8, [0x180000000]
cmp rcx, rdx
jae 0x1800e2875
cmp byte [rcx], 0xd
jne 0x1800e285b
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x1800e286a
cmp byte [rcx + 1], 0xa
jne 0x1800e286a
inc rcx
jmp 0x1800e286a
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x180350]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x1800e283d
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x1800e2887
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1800dea20
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800edd34
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1800edda3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800edda3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1800edda3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1800edda3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1800edda3
cmp dword [rcx + 0x84], 0xe
jbe 0x1800edda3
cmp dword [rcx + 0xf8], 0
je 0x1800edda3
mov ecx, ebx
call fcn.1800ede48
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1800edc3c
nop
cmp dword [rbp + 0x20], 0
jne 0x1800ede04
call fcn.1800f60d0
cmp eax, 1
jne 0x1800eddf4
xor dl, dl
jmp 0x1800eddfe
call fcn.1800f609c
test al, al
sete dl
cmp dword [rbp + 0x20], 0
je 0x1800ede0f
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1800ede18
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1800edd34
Function at 0x1800ef834
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
xor edi, edi
mov rax, r15
lea rcx, [0x180181ad0]
and eax, 0x3f
mov r12, r15
sar r12, 6
mov rsi, rdx
lea r9d, [rdi + 0xa]
mov r14, r15
lea rbp, [rax + rax*8]
mov rax, qword [rcx + r12*8]
mov r10, qword [rax + rbp*8 + 0x28]
test r8, r8
je 0x1800ef88a
cmp word [rdx], r9w
jne 0x1800ef88a
or byte [rax + rbp*8 + 0x38], 4
jmp 0x1800ef88f
and byte [rax + rbp*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rax, rsi
mov rbx, rsi
cmp rsi, r8
jae 0x1800efa0e
mov r11d, 0xd
lea r13d, [r11 - 0xb]
movzx edx, word [rax]
cmp dx, 0x1a
je 0x1800ef9d9
lea rcx, [rax + 2]
cmp dx, r11w
jne 0x1800ef8d7
cmp rcx, r8
jae 0x1800ef8f7
cmp word [rcx], r9w
jne 0x1800ef8d7
add rax, 4
mov edx, r9d
jmp 0x1800ef8da
mov rax, rcx
mov word [rbx], dx
mov r9, r13
mov rcx, rbx
mov r9d, 0xa
lea rbx, [rbx + r13]
cmp rax, r8
jb 0x1800ef8ac
jmp 0x1800efa0e
lea r9, [rsp + 0x80]
mov word [rsp + 0x70], di
mov r8d, r13d
mov dword [rsp + 0x80], edi
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x20], rdi
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800ef9d2
cmp dword [rsp + 0x80], edi
je 0x1800ef9d2
lea r9, [0x180181ad0]
mov rax, qword [r9 + r12*8]
test byte [rax + rbp*8 + 0x38], 0x48
mov ebp, 0xa
je 0x1800ef9ac
movzx eax, word [rsp + 0x70]
cmp ax, bp
jne 0x1800ef95f
mov word [rbx], bp
jmp 0x1800efa0b
mov word [rsp + 0x78], ax
mov rdx, r14
mov rax, r14
sar rdx, 6
and eax, 0x3f
mov word [rbx], 0xd
lea r8, [rax + rax*8]
mov rax, qword [r9 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, r13
jl 0x1800ef97a
mov rax, r14
sar rax, 6
and r14d, 0x3f
mov rax, qword [r9 + rax*8]
lea rcx, [r14 + r14*8]
mov byte [rax + rcx*8 + 0x3c], bpl
jmp 0x1800efa0b
cmp word [rsp + 0x70], bp
jne 0x1800ef9b8
cmp rbx, rsi
je 0x1800ef957
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.1800ef0b0
cmp word [rsp + 0x70], bp
je 0x1800efa0e
mov word [rbx], 0xd
jmp 0x1800efa0b
mov rcx, r15
lea r9, [0x180181ad0]
and ecx, 0x3f
mov rax, r15
sar rax, 6
lea r8, [rcx + rcx*8]
mov rcx, qword [r9 + rax*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x1800efa08
or al, r13b
mov byte [rcx + r8*8 + 0x38], al
jmp 0x1800efa0e
mov word [rbx], dx
add rbx, r13
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800f223c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1800f2252
mov al, 1
jmp 0x1800f22be
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1800f2263
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1800f22bc
mov ecx, dword [rcx + 0x18]
nop
call fcn.1800f8c1c
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800f22bc
and qword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
mov r9d, 1
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1800f22bc
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1800f22bc
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1800f22be
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x1800f7b34
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1800f7b64
xor eax, eax
jmp 0x1800f7c27
mov rbp, rbx
cmp word [rax], si
je 0x1800f7b89
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1800f7b70
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1800f7b6c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1800f7a54
movsxd r14, eax
mov rcx, r14
test eax, eax
jne 0x1800f7bca
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1800f7b5d
call fcn.1800f37d0
mov rdi, rax
test rax, rax
jne 0x1800f7be0
xor ecx, ecx
call fcn.1800f0750
jmp 0x1800f7bbf
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1800f7a54
test eax, eax
jne 0x1800f7c11
mov rcx, rdi
call fcn.1800f0750
jmp 0x1800f7c1b
xor ecx, ecx
call fcn.1800f0750
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1800f7c44
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1800f7ccb
mov rsi, rbx
cmp word [rax], bp
je 0x1800f7c8a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1800f7c74
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1800f7c70
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1800f37d0
mov rdi, rax
test rax, rax
je 0x1800f7cb8
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1801039e0
mov rbp, rdi
xor ecx, ecx
call fcn.1800f0750
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800fd2d8
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1800ef0b0
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1800ef0b0
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1800fd425
cmp rax, 0xffffffffffffffff
je 0x1800fd425
xor edi, edi
test rbp, rbp
jle 0x1800fd3d3
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1800f06d0
mov rbx, rax
test rax, rax
jne 0x1800fd360
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1800fd3c9
mov edx, 0x8000
mov ecx, r14d
call fcn.1800fd15c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1800f19f8
cmp eax, 0xffffffff
je 0x1800fd3a9
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1800fd370
mov edx, r15d
mov ecx, r14d
call fcn.1800fd15c
jmp 0x1800fd3c9
cmp byte [rsi + 0x38], dil
je 0x1800fd3c0
cmp dword [rsi + 0x34], 5
jne 0x1800fd3c0
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1800fd3c9
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1800f0750
jmp 0x1800fd437
jns 0x1800fd437
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1800ef0b0
cmp rax, 0xffffffffffffffff
jne 0x1800fd3f1
cmp byte [rsi + 0x30], dil
je 0x1800fd437
jmp 0x1800fd42d
mov ecx, r14d
call fcn.1800f8c1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1800fd437
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1800fd437
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1800fd432
mov edi, dword [rsi + 0x2c]
jmp 0x1800fd437
mov edi, 0x16
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1800ef0b0
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1800fe350
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1800fe378
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1800fe378
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14000fb40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [rdx + 0x10]
lea r9, [rsp + 0x30]
xor esi, esi
mov dword [rsp + 0x34], eax
mov rbx, rdx
mov dword [rsp + 0x30], esi
mov rdi, rcx
mov qword [rsp + 0x20], rsi
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x34]
lea r8d, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 0xf
mov rdx, rbx
jbe 0x14000fb8c
mov rdx, qword [rbx]
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x30]
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14000fbda
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14000fbd5
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000fbf9
mov rcx, r8
call fcn.1400411f0
mov qword [rbx + 0x10], rsi
mov byte [rbx], sil
mov rsi, qword [rsp + 0x68]
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.140047ff4
int3

Function at 0x14000fc00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [rdx + 0x10]
lea r9, [rsp + 0x30]
xor esi, esi
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x30], esi
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x34]
add eax, eax
mov qword [rsp + 0x20], rsi
lea r8d, [rsi + 4]
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 7
mov rdx, rbx
mov r8, qword [rbx + 0x10]
jbe 0x14000fc52
mov rdx, qword [rbx]
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x30]
add r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 7
jbe 0x14000fca4
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000fc9f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000fcc3
mov rcx, r8
call fcn.1400411f0
mov qword [rbx + 0x10], rsi
mov word [rbx], si
mov rsi, qword [rsp + 0x68]
mov qword [rbx + 0x18], 7
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.140047ff4
int3
Function at 0x140011ba0
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x14008a040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r12, r9
mov r13, r8
mov rbp, rdx
mov qword [rsp + 0x38], rdx
mov r14, rcx
mov qword [rsp + 0x40], rdx
mov rbx, qword [rsp + 0xe0]
xor edi, edi
cmp qword [rcx + 0x18], 7
jbe 0x140011bea
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140011c1e
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x18], rdi
mov r8d, 0x19
lea rdx, str.Error:_Ini_File_Not_Exist
mov rcx, rbp
call fcn.140004a40
jmp 0x140011d54
mov ebp, 1
mov ecx, 0x208
call fcn.1400414a0
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], di
mov rdi, 0xffffffffffffffff
mov r15d, 0x104
nop dword [rax + rax]
mov rax, r14
cmp qword [r14 + 0x18], 7
jbe 0x140011c6d
mov rax, qword [r14]
mov r8, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140011c7a
mov r8, qword [rbx]
mov rdx, r12
cmp qword [r12 + 0x18], 7
jbe 0x140011c89
mov rdx, qword [r12]
mov rcx, r13
cmp qword [r13 + 0x18], 7
jbe 0x140011c97
mov rcx, qword [r13]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [r15 - 1]
cmp eax, ecx
jb 0x140011d18
mov r8, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140011cbf
mov r8, qword [rbx]
mov rax, rsi
sub r8, rsi
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140011ce4
add rax, 2
test ecx, ecx
jne 0x140011cd0
test edx, edx
je 0x140011d18
mov rcx, rsi
call fcn.1400411f0
inc ebp
imul r15d, ebp, 0x104
mov ecx, r15d
mov eax, 2
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.1400414a0
mov rsi, rax
jmp 0x140011c60
mov rbp, qword [rsp + 0x38]
nop dword [rax]
inc rdi
cmp word [rsi + rdi*2], 0
jne 0x140011d20
mov r8, rdi
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.140004640
mov rcx, rsi
call fcn.1400411f0
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rbp + 0x10], xmm1
mov rax, rbp
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400411d0
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140012810
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rbx, rcx
xor ebp, ebp
add rcx, 0x70
call fcn.14003dd80
test eax, eax
setne dl
mov byte [rbx + 0xf8], dl
test eax, eax
je 0x140012857
cmp qword [rbx + 0xb8], 0x10000
jae 0x140012857
lea rcx, [rbx + 0x70]
call fcn.14003e140
mov eax, dword [rbx + 0x2d0]
cmp byte [rbx + 0xf8], bpl
je 0x140012962
cmp eax, 1
je 0x14001293f
mov dword [rbx + 0x2d0], 1
call fcn.140010ee0
test al, al
je 0x1400129be
lea rcx, [rbx + 0x10]
call fcn.140037280
test al, al
je 0x1400129be
lea rcx, [rbx + 0x10]
call fcn.140037470
mov rcx, rbx
call fcn.1400143f0
add rbx, 0x808
cmp byte [rbx + 8], bpl
jne 0x1400129a9
cmp qword [rbx + 0x18], rbp
je 0x1400129a9
mov word [rbx + 8], 0x101
mov dword [rbx + 0x20], 0x32
mov ecx, 8
call fcn.140041224
mov qword [rax], rbx
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x140016a30]
xor edx, edx
xor ecx, ecx
call fcn.14004c628
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400129d1
cmp dword [rsp + 0x38], 0
je 0x1400129c6
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140040954
test eax, eax
jne 0x1400129c6
jmp 0x1400129a9
mov eax, dword [0x14008d350]
inc eax
mov dword [0x14008d350], eax
cmp eax, 5
jle 0x1400129a9
mov dword [0x14008d350], ebp
mov rcx, rbx
call fcn.140012550
jmp 0x1400129a9
test eax, eax
je 0x1400129a9
mov dword [rbx + 0x2d0], ebp
mov rcx, rbx
call fcn.1400143f0
mov byte [rbx + 0x810], bpl
mov edi, 0x1388
cmp byte [rbx + 0x811], bpl
je 0x1400129a9
nop dword [rax]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
sub edi, 0x32
js 0x1400129a9
cmp byte [rbx + 0x811], bpl
jne 0x140012990
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
xor ecx, ecx
call fcn.14004c19c
nop
mov ecx, 1
call fcn.1400408b8
nop
mov dword [rsp + 0x38], ebp
mov ecx, 6
call fcn.1400408b8
int3
Function at 0x1400143f0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
lea rcx, [0x14008d8b0]
call fcn.1400409f4
test eax, eax
jne 0x14001449f
cmp dword [0x14008d8fc], 0x7fffffff
je 0x14001448a
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x40], rdi
lea r8d, [rax + 4]
xor edi, edi
mov dword [rsp + 0x50], 2
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rbx + 0xb0]
lea r9, [rsp + 0x48]
mov rcx, qword [rbx + 8]
lea r8d, [rdi + 4]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [0x14008d8b0]
mov rdi, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
jmp fcn.1400409fc
mov ecx, 6
mov dword [0x14008d8fc], 0x7ffffffe
call fcn.1400408b8
int3
mov ecx, 5
call fcn.1400408b8
int3
Function at 0x140015b60
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rsi, r8
mov rbx, rdx
mov qword [rsp + 0x50], rdx
xor ebp, ebp
mov dword [rsp + 0x40], ebp
mov rdi, qword [0x14008d368]
lea r14, [0x14008d8b0]
mov qword [rsp + 0x58], r14
mov rcx, r14
call fcn.1400409f4
test eax, eax
jne 0x140015cb8
cmp dword [0x14008d8fc], 0x7fffffff
je 0x140015ca3
mov dword [rsp + 0x38], 8
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x30]
lea r8d, [rbp + 4]
lea rdx, [rsp + 0x38]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.1400042e0
mov rdx, rax
mov rcx, rdi
call fcn.14000fb40
nop
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x38]
lea r8d, [rbp + 4]
lea rdx, [rsp + 0x30]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rsi, dword [rsp + 0x30]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rbx], bpl
mov dword [rsp + 0x40], 2
mov rdx, rsi
cmp rsi, 0xf
jbe 0x140015c5b
mov rcx, rbx
call fcn.14000d740
mov qword [rbx + 0x10], rbp
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140015c68
mov rdx, qword [rbx]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x48]
mov r8d, esi
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop
mov rcx, r14
call fcn.1400409fc
mov rax, rbx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov dword [0x14008d8fc], 0x7ffffffe
mov ecx, 6
call fcn.1400408b8
int3
mov ecx, 5
call fcn.1400408b8
int3
Function at 0x140016a80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov ebx, ecx
mov rsi, r8
xor ecx, ecx
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx edx, bx
mov r8, rdi
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x140016bac
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdx, rdi
mov rcx, r14
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test rbx, rbx
je 0x140016bac
test eax, eax
je 0x140016bac
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x140016bac
mov rcx, qword [rsi]
mov dword [rbp - 0x20], 0xdb65d8b9
mov dword [rbp - 0x1c], 0xb82a3365
mov dword [rbp - 0x18], 0x1c5abe2e
mov dword [rbp - 0x14], 0x9011b0b7
mov dword [rbp - 0x10], 0x7a65aeb6
mov dword [rbp - 0xc], 0x93cb4508
mov dword [rbp - 8], 0x206d931d
mov dword [rbp - 4], 0x9ca061e4
cmp rcx, qword [rsi + 8]
je 0x140016b4b
mov qword [rsi + 8], rcx
mov rax, qword [rsi + 0x10]
sub rax, rcx
mov qword [rbp + 0x38], rdi
cmp rdi, rax
jbe 0x140016b67
lea rdx, [rbp + 0x38]
mov rcx, rsi
call fcn.140016bd0
xor ebx, ebx
test rdi, rdi
je 0x140016ba8
nop
mov rdx, qword [rsi + 8]
mov rax, rbx
and eax, 0x1f
movzx ecx, byte [rbp + rax - 0x20]
xor cl, byte [r14 + rbx]
mov byte [rbp + 0x20], cl
cmp rdx, qword [rsi + 0x10]
je 0x140016b94
mov byte [rdx], cl
inc qword [rsi + 8]
jmp 0x140016ba0
lea r8, [rbp + 0x20]
mov rcx, rsi
call fcn.140016cc0
inc rbx
cmp rbx, rdi
jb 0x140016b70
mov al, 1
jmp 0x140016bae
xor al, al
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
Function at 0x1400173b0
Capabilities:
Load windows common language runtime

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
cmp qword [0x14008d370], 0
jne 0x1400174a2
xor ebx, ebx
lea r8, [rsp + 0x48]
lea rdx, [0x140077dd8]
mov qword [rsp + 0x48], rbx
lea rcx, [0x140077dc8]
call qword [sym.imp.mscoree.dll_CLRCreateInstance]
lea rdi, [0x14008d370]
test eax, eax
js 0x140017465
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x40], rbx
lea r8, [0x140077db8]
lea rdx, [0x1400776d0]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov ebx, eax
test eax, eax
js 0x140017456
mov rcx, qword [rsp + 0x40]
lea r8, [0x140074050]
mov r9, rdi
lea rdx, [0x140074060]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov ebx, eax
test eax, eax
js 0x14001744b
mov rcx, qword [0x14008d370]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
test ebx, ebx
jns 0x1400174a2
cmp qword [0x14008d370], 0
jne 0x1400174a2
lea r9, [0x140074050]
mov qword [rsp + 0x20], rdi
lea r8, [0x140074060]
xor edx, edx
lea rcx, str.v2.0.50727
call qword [sym.imp.mscoree.dll_CorBindToRuntime]
test eax, eax
js 0x1400174af
mov rcx, qword [0x14008d370]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov al, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
xor r9d, r9d
lea r8, [0x140077700]
lea rdx, [0x140077720]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rbx, qword [rsp + 0x50]
xor al, al
add rsp, 0x30
pop rdi
ret