joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400347f8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
test r8, r8
je 0x140034818
and qword [r8], 0
lea rdx, [0x14008a028]
call fcn.1400346d4
mov rbx, rax
test rax, rax
je 0x140034909
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140034900
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140034900
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140034900
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140034900
mov rbp, rdi
cmp rdi, 0xffffffffffffffff
je 0x140034900
mov rax, qword [0x140146ae8]
test rax, rax
je 0x14003489d
inc dword [rax + 0xf4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x140034900
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rbp
je 0x1400348ed
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140146ae8]
test rax, rax
je 0x1400348e2
dec dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140034909
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x1400348fb
mov qword [rsi], rbp
mov rax, rdi
jmp 0x14003490b
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400373bc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xe8]
mov r10d, 4
mov rax, qword [rcx + 0xf0]
mov r9d, r10d
mov ebx, dword [rax + r8*4 - 4]
lea r8, [rsp + 0x38]
not ebx
movzx eax, byte [r8]
inc r8
movzx ecx, bl
xor rcx, rax
shr ebx, 8
lea rax, [0x14007b620]
xor ebx, dword [rax + rcx*4]
sub r9, 1
jne 0x1400373e8
mov rcx, qword [0x140146ae8]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x140037426
movsxd r8, edx
mov ecx, ebx
mov edx, r10d
call fcn.140048184
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x140037430
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x18
movss xmm2, dword [rcx + 0x108]
lea r9, [rsp]
movss xmm3, dword [rcx + 0x10c]
mov r10d, 0x10
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
mov rax, qword [rcx + 0xf0]
subss xmm1, xmm3
movsxd rcx, dword [rcx + 0xe8]
movss dword [rsp], xmm0
movss xmm0, dword [rdx + 8]
mov r8d, dword [rax + rcx*4 - 4]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
not r8d
movss xmm1, dword [rdx + 0xc]
subss xmm1, xmm3
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
movzx ecx, byte [r9]
lea rax, [0x14007b620]
movzx edx, r8b
inc r9
xor rdx, rcx
shr r8d, 8
xor r8d, dword [rax + rdx*4]
sub r10, 1
jne 0x14003749e
not r8d
mov eax, r8d
add rsp, 0x18
ret
Function at 0x140046e14
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c50], 0
lea rbx, [rcx + 0x5c58]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140046ead
mov r9d, dword [rbx + 4]
test r9d, r9d
jns 0x140046e65
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.1400490dc
and dword [rbx], 0
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call fcn.1400351a0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c50]
lea ecx, [rax - 1]
neg eax
sbb eax, eax
and eax, ecx
lea rcx, [0x140146acf]
movsxd r8, eax
mov rax, qword [rdi + 0x5c60]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x140046eb5
mov rcx, rbx
call fcn.1400351a0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14004769c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x140146ae8]
mov rbx, rcx
and dword [rax + 0x5bb4], 0
test rcx, rcx
je 0x140047705
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.140047710
lea rdx, [0x14008a024]
mov rcx, rbx
mov rdi, rax
call fcn.1400346d4
mov rbx, rax
test rax, rax
je 0x140047705
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140072780
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x40
mov r14, rdx
lea rdx, [0x140110740]
cmp qword [0x140110758], 0xf
cmova rdx, qword [0x140110740]
movabs rdi, 0xcbf29ce484222325
xor ecx, ecx
mov r8, qword [0x140110750]
test r8, r8
je 0x1400727e4
movzx eax, byte [rdx + rcx]
xor rdi, rax
movabs r9, 0x100000001b3
imul rdi, r9
inc rcx
cmp rcx, r8
jb 0x1400727c7
mov r9, rdi
lea r8, [0x140110740]
lea rdx, [rsp + 0x20]
call fcn.140072ee4
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x14007280f
mov qword [r14], rax
mov byte [r14 + 8], 0
jmp 0x14007295e
movabs rax, 0x3ffffffffffffff
cmp qword [0x1401482f0], rax
jne 0x140072830
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [0x1401482e8]
mov qword [rsp + 0x30], rax
and qword [rsp + 0x38], 0
mov ecx, 0x40
call fcn.140072fd0
mov rsi, rax
mov qword [rsp + 0x38], rax
lea rdx, [0x140110740]
lea rcx, [rax + 0x10]
call fcn.140003dec
xor eax, eax
mov qword [rsi + 0x30], rax
mov dword [rsi + 0x38], eax
mov r8, qword [0x1401482f0]
lea rcx, [r8 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x140072887
cvtsi2ss xmm0, rcx
jmp 0x14007289c
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x140148318]
xorps xmm1, xmm1
test rcx, rcx
js 0x1400728b2
cvtsi2ss xmm1, rcx
jmp 0x1400728c7
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x1401482e0]
jbe 0x1400728fa
call fcn.140072c04
lea r8, [rsi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x30]
call fcn.140072ee4
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x20], xmm0
mov r8, qword [0x1401482f0]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 8]
inc r8
mov qword [0x1401482f0], r8
mov qword [rsi], rcx
mov qword [rsi + 8], rdx
mov qword [rdx], rsi
mov qword [rcx + 8], rsi
and rdi, qword [0x140148310]
add rdi, rdi
mov rax, qword [0x1401482f8]
mov r8, qword [rax + rdi*8]
cmp r8, qword [0x1401482e8]
jne 0x14007293f
mov qword [rax + rdi*8], rsi
jmp 0x140072951
cmp r8, rcx
jne 0x14007294a
mov qword [rax + rdi*8], rsi
jmp 0x140072956
cmp qword [rax + rdi*8 + 8], rdx
jne 0x140072956
mov qword [rax + rdi*8 + 8], rsi
mov qword [r14], rsi
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
Function at 0x140072978
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x40
mov r14, r8
mov rsi, rdx
mov rdx, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x1400729a0
mov rdx, qword [r8]
movabs rbx, 0xcbf29ce484222325
xor ecx, ecx
cmp qword [r8 + 0x10], rcx
jbe 0x1400729d0
movzx eax, byte [rdx + rcx]
xor rbx, rax
movabs r8, 0x100000001b3
imul rbx, r8
inc rcx
cmp rcx, qword [r14 + 0x10]
jb 0x1400729b2
mov r9, rbx
mov r8, r14
lea rdx, [rsp + 0x20]
call fcn.140072ee4
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x1400729f6
mov qword [rsi], rax
mov byte [rsi + 8], 0
jmp 0x140072b67
movabs rax, 0x3ffffffffffffff
cmp qword [0x1401482f0], rax
jne 0x140072a17
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [0x1401482e8]
mov qword [rsp + 0x30], rax
and qword [rsp + 0x38], 0
mov ecx, 0x40
call fcn.140072fd0
mov rdi, rax
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
and qword [rax + 0x20], 0
and qword [rax + 0x28], 0
movups xmm0, xmmword [r14]
movups xmmword [rax + 0x10], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rax + 0x20], xmm1
and qword [r14 + 0x10], 0
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
xor eax, eax
mov qword [rdi + 0x30], rax
mov dword [rdi + 0x38], eax
mov r8, qword [0x1401482f0]
lea rcx, [r8 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x140072a91
cvtsi2ss xmm0, rcx
jmp 0x140072aa6
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x140148318]
xorps xmm1, xmm1
test rcx, rcx
js 0x140072abc
cvtsi2ss xmm1, rcx
jmp 0x140072ad1
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x1401482e0]
jbe 0x140072b04
call fcn.140072c04
lea r8, [rdi + 0x10]
mov r9, rbx
lea rdx, [rsp + 0x30]
call fcn.140072ee4
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x20], xmm0
mov r8, qword [0x1401482f0]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 8]
inc r8
mov qword [0x1401482f0], r8
mov qword [rdi], rcx
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rcx + 8], rdi
and rbx, qword [0x140148310]
add rbx, rbx
mov rax, qword [0x1401482f8]
mov r8, qword [rax + rbx*8]
cmp r8, qword [0x1401482e8]
jne 0x140072b49
mov qword [rax + rbx*8], rdi
jmp 0x140072b5b
cmp r8, rcx
jne 0x140072b54
mov qword [rax + rbx*8], rdi
jmp 0x140072b60
cmp qword [rax + rbx*8 + 8], rdx
jne 0x140072b60
mov qword [rax + rbx*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
Function at 0x140073d58
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140073da2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140073da2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140073da2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140073da2
cmp dword [rcx + 0x84], 0xe
jbe 0x140073da2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140073da4
xor al, al
add rsp, 0x28
ret

Function at 0x140073f90
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140073fca
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140073fcf
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140074018
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140079d50]
cmp byte [rcx + rax], 0
je 0x140074018
dec r8
sub rdx, 1
jne 0x140073ffe
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1400747dc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.1400740a8
mov ebx, eax
test eax, eax
jne 0x14007480c
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x14007486f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140074866
test al, 0x10
je 0x140074866
bt eax, 0xa
jae 0x14007485f
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.140074880
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x14007485b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14007485b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
test edi, edi
jne 0x140074866
and dword [rsp + 0x3c], 0
jmp 0x14007486b
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140003440
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000346d
xor eax, eax
jmp 0x1400035d9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400034a7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400034a7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400035d9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400035cc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400034ea
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140003515
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400035d1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003584
sub eax, 1
je 0x140003584
cmp eax, 2
jne 0x1400035cc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400035d1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400035b2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400035cc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400035d1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140004930
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400038d0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400039a3
cmp byte [rcx + 0x71], 0
je 0x1400039a3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000399f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003964
sub eax, 1
je 0x140003968
cmp eax, 2
jne 0x14000399f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004930
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140003996
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000399f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000394c
xor al, al
jmp 0x14000394c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004930
add rsp, 0x60
pop rbx
ret

Function at 0x1400052b0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400052fa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400052fa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400052fa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400052fa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400052fa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400052fc
xor al, al
add rsp, 0x28
ret
Function at 0x1416b9058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1416b91df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1416b9089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1416b906f
add dl, dl
jne 0x1416b9096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1416b90f6
xor eax, eax
add dl, dl
jne 0x1416b90a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1416b91ad
add dl, dl
jne 0x1416b90b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1416b90c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1416b90d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1416b90dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1416b90ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1416b907e
mov eax, 1
add dl, dl
jne 0x1416b9106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1416b9113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1416b90fb
sub eax, ebx
mov ebx, 1
jne 0x1416b914c
mov ecx, 1
add dl, dl
jne 0x1416b912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1416b913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1416b9123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1416b907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1416b9168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1416b9175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1416b915d
cmp eax, 0x7d00
jae 0x1416b919b
cmp eax, 0x500
jb 0x1416b9196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1416b907e
cmp eax, 0x7f
ja 0x1416b919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1416b907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1416b91d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1416b907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140648b40
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140648b4d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140648b5d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140648b45
lea eax, [rcx + 1]
jmp 0x140648b6b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140648b7e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140648b64
sub eax, 3
jb 0x140648b9e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140648bed
sar eax, 1
movsxd rbp, eax
jb 0x140648bd4
jmp 0x140648bac
add ebx, ebx
jne 0x140648baa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140648bd4
inc ecx
add ebx, ebx
jne 0x140648bba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140648bd4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140648bcd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140648bbc
add ecx, 2
jmp 0x140648bd9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140648b02
jmp 0x140648b4d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0x642000]
mov eax, dword [rdi]
or eax, eax
je 0x140648c4d
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x648000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140648bfd
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140648c47
mov qword [rbx], rax
add rbx, 8
jmp 0x140648c1d
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140648c91
cmp al, 0xef
ja 0x140648c79
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140648c59
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x140648c68
mov eax, dword [rdi]
add rdi, 4
jmp 0x140648c68
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140648d10], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140648d10
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140648d00
sub rsp, 0xffffffffffffff80
jmp 0x1400014f0
Function at 0x18003b564
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x1802ac070]
xor rax, rsp
mov qword [rsp + 0x90], rax
movss xmm6, dword [0x18028c87c]
movss dword [rsp + 0x24], xmm6
mov rdx, qword [rcx]
cmp rdx, 2
jb 0x18003b746
mov ecx, 0x68
mov dword [rsp + 0x20], ecx
mov eax, dword [0x1802decf0]
cmp eax, 0x9f3
jl 0x18003b5ce
mov ecx, 0x70
jmp 0x18003b5e0
add eax, 0xfffff766
mov r8d, 0x40
cmp eax, 0x45
cmovbe ecx, r8d
mov dword [rsp + 0x20], ecx
movsxd rax, ecx
mov rcx, qword [rax + rdx]
test rcx, rcx
jne 0x18003b5f8
movaps xmm0, xmm6
jmp 0x18003b749
mov r14d, dword [rcx + 0x18]
mov rsi, qword [rcx + 0x10]
test rsi, rsi
jne 0x18003b60d
movaps xmm0, xmm6
jmp 0x18003b749
xor ebx, ebx
movabs r15, 0x3d8993201cb6b0d8
mov dword [rsp + 0x28], ebx
cmp ebx, r14d
jge 0x18003b73e
lea eax, [rbx*8]
movsxd rcx, eax
mov rdi, qword [rcx + rsi + 0x20]
and qword [rsp + 0x30], 0
mov qword [rsp + 0x30], rdi
test rdi, rdi
jne 0x18003b64a
jmp 0x18003b737
lea rcx, [rsp + 0x30]
call fcn.18003b320
movsd xmm0, qword [rax]
movsd qword [rsp + 0x38], xmm0
mov eax, dword [rax + 8]
mov dword [rsp + 0x40], eax
mov rax, qword [rdi]
cmp byte [rsp + 0x38], 0
je 0x18003b737
movabs rcx, 0xfc5bc9e22ea2fe39
mov qword [rsp + 0x50], rcx
movabs rcx, 0x4cbe635fa5c7349a
mov qword [rsp + 0x58], rcx
movabs rcx, 0x972872291abf82fe
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], r15
movabs rcx, 0x952faa8744cd8c69
mov qword [rsp + 0x70], rcx
movabs rcx, 0x22d1133ec09051f6
mov qword [rsp + 0x78], rcx
movabs rcx, 0x972872291adbedb3
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], r15
movdqa xmm0, xmmword [rsp + 0x50]
pxor xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [rsp + 0x60]
pxor xmm1, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x60], xmm1
lea rdx, [rsp + 0x50]
mov rcx, qword [rax + 0x10]
call fcn.1801982d0
test rax, rax
je 0x18003b737
movss xmm0, dword [rsp + 0x3c]
comiss xmm0, dword [0x18028c838]
jb 0x18003b73e
comiss xmm6, xmm0
jb 0x18003b73e
mulss xmm6, xmm0
movss dword [rsp + 0x24], xmm6
jmp 0x18003b73e
inc ebx
jmp 0x18003b619
jmp 0x18003b746
movaps xmm0, xmm6
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180195e30
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
ret