joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004eb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
xor ecx, ecx
xor esi, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x1400050bd
mov rcx, rdi
call fcn.1400024b0
test eax, eax
jne 0x1400050bd
mov rcx, rdi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
call fcn.140004bf0
mov rbp, rax
test rax, rax
je 0x140004fce
mov qword [rsp + 0x50], r12
call fcn.140002670
mov r12, rax
test rax, rax
je 0x140004fbb
mov rcx, rbp
call fcn.1400024b0
test eax, eax
je 0x140004fa4
lea rax, str.system32_
lea rbx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
lea rax, str.SystemRoot_system32_
mov qword [rsp + 0x28], rax
mov rdx, qword [rbx]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdi, [rcx - 1]
mov rcx, rbp
call fcn.1400c3ad4
test eax, eax
je 0x140004f77
lea rax, [rsp + 0x30]
add rbx, 8
cmp rbx, rax
jb 0x140004f41
jmp 0x140004f87
lea rdx, [rbp + rdi*2]
mov rcx, r12
call fcn.140004920
mov rsi, rax
lea rax, [rsp + 0x30]
cmp rbx, rax
jne 0x140004fb2
mov rcx, rbp
call fcn.140002510
test eax, eax
je 0x140004fb2
mov rsi, rbp
xor ebp, ebp
jmp 0x140004fb2
mov rdx, rbp
mov rcx, r12
call fcn.140004920
mov rsi, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r12, qword [rsp + 0x50]
jmp 0x14000506d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7e
jne 0x140005092
mov rcx, rdi
call fcn.140003bc0
mov rbx, rax
test rax, rax
je 0x140005092
mov ecx, 0x37e4
call fcn.1400037a0
test eax, eax
je 0x14000500b
xor ecx, ecx
call fcn.140004650
mov rdi, rax
jmp 0x140005013
call fcn.140002670
mov rdi, rax
test rdi, rdi
je 0x140005064
mov rdx, rbx
mov rcx, rdi
call fcn.140004920
mov rsi, rax
test rax, rax
je 0x14000505b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000503d
test al, 0x50
je 0x14000505b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140005050
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor esi, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rsi, rsi
je 0x140005092
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400050a5
lea ecx, [rax + 0x7e]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rsi, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x14000ce30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push r14
mov eax, 0x1090
call fcn.14009b900
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x10c0], rbx
mov qword [rsp + 0x10c8], rbp
mov rax, qword [0x14013f130]
xor rax, rsp
mov qword [rsp + 0x1080], rax
mov rbp, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0x1014
lea rcx, [rsp + 0x60]
call fcn.1400b93c0
mov dword [rsp + 0x60], 0x11014
xor r14d, r14d
mov dword [rsp + 0x1068], r14d
lea r8, [rsp + 0x60]
mov rdx, rbp
mov rcx, rsi
call fcn.140001a70
test eax, eax
jne 0x14000cfce
mov eax, dword [rsp + 0x106c]
test eax, eax
je 0x14000cfce
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.14000e560
mov eax, dword [rsp + 0x106c]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x40]
mov dword [rax], 0x4500c
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, rbp
mov rcx, rsi
call fcn.140001ee0
test eax, eax
jne 0x14000cf71
mov ebx, r14d
cmp dword [rsp + 0x38], r14d
jbe 0x14000cf71
nop word [rax + rax]
mov eax, ebx
imul rdi, rax, 0x500c
mov rax, qword [rsp + 0x40]
mov word [rdi + rax + 0x1006], r14w
mov rcx, qword [rsp + 0x40]
add rcx, 8
add rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000cf52
test al, 0x10
je 0x14000cf69
mov r8, qword [rsp + 0x40]
add r8, 8
add r8, rdi
mov rdx, rbp
mov rcx, rsi
call fcn.140001d10
inc ebx
cmp ebx, dword [rsp + 0x38]
jb 0x14000cf20
mov r8, qword [rsp + 0x40]
test r8, r8
je 0x14000cfce
mov rcx, qword [rsp + 0x50]
sub rcx, r8
movabs rax, 0x66570c8aeb298693
imul rcx
sar rdx, 0xd
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x500c
mov rax, r8
cmp rdx, 0x1000
jb 0x14000cfc6
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cff6
mov rcx, r8
call fcn.14009ab24
mov rcx, qword [rsp + 0x1080]
xor rcx, rsp
call fcn.14009ab00
lea r11, [rsp + 0x1090]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.1400bcf00
int3
Function at 0x14000f110
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea rcx, [0x1400ff7b0]
call fcn.140010db0
xor ecx, ecx
call fcn.140036000
cmp byte [0x14014e0e0], 0
lea rbp, [0x14014e0c0]
mov byte [0x14014dab9], 0
je 0x14000f174
mov rcx, qword [0x14014e100]
test rcx, rcx
je 0x14000f160
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [0x14014e0e8]
test rcx, rcx
je 0x14000f1b4
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x14000f1b4
xor ebx, ebx
mov rcx, qword [rbp + rbx*8 + 0x60]
test rcx, rcx
je 0x14000f19b
cmp byte [rbx + rbp + 0x98], 0
je 0x14000f195
mov rax, qword [rcx]
call qword [rax + 0x70]
mov rcx, qword [rbp + rbx*8 + 0x60]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + rbx*8 + 0x78]
test rcx, rcx
je 0x14000f1ab
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
inc rbx
cmp rbx, 3
jb 0x14000f176
mov rbx, qword [0x14014e0f0]
xor edx, edx
mov rdi, qword [0x14014e0f8]
mov r8d, 0xb0
mov rsi, qword [0x14014e0c0]
mov rcx, rbp
call fcn.1400b93c0
lea rcx, str.d3d9_capture_freed
mov qword [0x14014e0f0], rbx
mov qword [0x14014e0f8], rdi
mov qword [0x14014e0c0], rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.140010db0
Function at 0x14000f410
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov r11, rsp
push rbx
push rbp
sub rsp, 0x78
mov rax, qword [0x14013f130]
xor rax, rsp
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [0x14014db08]
mov edx, dword [0x14014db18]
xor ebx, ebx
mov qword [r11 + 8], rsi
xor esi, esi
mov qword [r11 + 0x10], rdi
xor edi, edi
psrldq xmm0, 8
movq rax, xmm0
mov qword [r11 + 0x18], r14
shr rax, 0x20
xor r14d, r14d
test eax, eax
je 0x14000f484
test edx, edx
je 0x14000f484
mov rcx, rax
mov ebx, edx
mov rax, qword [0x14014e0c8]
add rbx, qword [rcx + rax]
je 0x14000f508
mov r14d, dword [rbx]
mov dword [rbx], 1
jmp 0x14000f508
movsxd rax, dword [0x14014e118]
cmp eax, 0xffffffff
je 0x14000f508
mov rdi, qword [0x14014e0c0]
mov rdx, rax
mov qword [rsp + 0x70], r15
add rdi, 0xd
lea r15, [0x140000000]
add rdi, qword [r15 + rax*8 + 0xfe790]
je 0x14000f503
add rdx, rdx
lea r9, [rsp + 0x5c]
mov r8d, 0x40
mov rcx, rdi
mov rsi, qword [r15 + rdx*8 + 0xfe680]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8, rsi
lea rcx, [rsp + 0x58]
mov rdx, rdi
call fcn.1400b8f60
movsxd rdx, dword [0x14014e118]
mov r8, rsi
add rdx, rdx
mov rcx, rdi
mov rdx, qword [r15 + rdx*8 + 0xfe688]
call fcn.1400b8f60
mov r15, qword [rsp + 0x70]
mov rcx, qword [0x14014e0c8]
lea rax, [0x14014e110]
mov r8d, dword [0x14014e0d4]
mov r9d, 1
mov edx, dword [0x14014e0d0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov r10, qword [rcx]
mov qword [rsp + 0x38], rax
mov eax, dword [0x14014e0d8]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 1
call qword [r10 + 0xb8]
mov ebp, eax
test rbx, rbx
je 0x14000f568
mov dword [rbx], r14d
jmp 0x14000f598
test rdi, rdi
je 0x14000f598
test rsi, rsi
je 0x14000f598
mov r8, rsi
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.1400b8f60
mov r8d, dword [rsp + 0x5c]
lea r9, [rsp + 0x5c]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r14, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
test ebp, ebp
jns 0x14000f5c6
mov edx, ebp
lea rcx, str.d3d9_shtex_init_copytex:_Failed_to_create_shared_texture
call fcn.140010e80
xor al, al
jmp 0x14000f602
mov rcx, qword [rsp + 0x50]
lea r8, [0x14014e0e8]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x90]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
test ebx, ebx
jns 0x14000f600
mov edx, ebx
lea rcx, str.d3d9_shtex_init_copytex:_Failed_to_get_surface_level
call fcn.140010e80
xor al, al
jmp 0x14000f602
mov al, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14009ab00
add rsp, 0x78
pop rbp
pop rbx
ret
Function at 0x140010b80
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
cmp byte [0x14014e221], 0
jne 0x140010bd8
cmp dword [0x14014db08], 0
je 0x140010bc4
cmp dword [0x14014db0c], 0
je 0x140010bc4
cmp dword [0x14014db10], 0
je 0x140010bc4
lea rdx, [0x14014db08]
call fcn.140010490
mov byte [0x14014e221], al
test al, al
jne 0x140010d8e
jmp 0x140010bd8
lea rcx, str._OBS__no_D3D9_hook_address_found__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [0x14014e221], 1
cmp byte [0x14014e222], 0
jne 0x140010da9
cmp dword [0x14014db1c], 0
je 0x140010d95
cmp dword [0x14014db20], 0
je 0x140010d95
lea rcx, str.dxgi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x140010c1c
mov byte [0x14014e222], al
add rsp, 0x28
ret
mov ecx, dword [0x14014db24]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov ebp, dword [0x14014db20]
mov qword [rsp + 0x40], rsi
add rbp, rax
mov esi, dword [0x14014db1c]
mov qword [rsp + 0x48], rdi
add rsi, rax
mov qword [rsp + 0x20], r14
xor r14d, r14d
mov edi, r14d
test ecx, ecx
je 0x140010c5b
lea rdi, [rax + rcx]
mov ecx, dword [0x14014db48]
mov rbx, r14
test ecx, ecx
je 0x140010c6c
lea rbx, [rax + rcx]
call fcn.140095a70
lea rdx, [0x1400109d0]
mov qword [0x14014da58], rsi
lea rcx, [0x14014da58]
call fcn.140095270
lea rdx, [0x140010810]
mov qword [0x14014da60], rbp
lea rcx, [0x14014da60]
call fcn.140095270
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
test rdi, rdi
je 0x140010cce
lea rdx, [0x140010aa0]
mov qword [0x14014dab0], rdi
lea rcx, [0x14014dab0]
call fcn.140095270
mov rdi, qword [rsp + 0x48]
test rbx, rbx
je 0x140010cf2
lea rdx, [0x140010780]
mov qword [0x14014da68], rbx
lea rcx, [0x14014da68]
call fcn.140095270
call fcn.140095ae0
test eax, eax
sete bl
test eax, eax
jne 0x140010d50
lea rcx, str.Hooked_IDXGISwapChain::Present
call fcn.140010db0
lea rcx, str.Hooked_IDXGISwapChain::ResizeBuffers
call fcn.140010db0
cmp qword [0x14014dab0], r14
je 0x140010d2d
lea rcx, str.Hooked_IDXGISwapChain1::Present1
call fcn.140010db0
cmp qword [0x14014da68], r14
je 0x140010d42
lea rcx, str.Hooked_IDXGISwapChain::Release
call fcn.140010db0
lea rcx, str.Hooked_DXGI
call fcn.140010db0
jmp 0x140010d7a
mov edx, eax
mov qword [0x14014da58], r14
lea rcx, str.Failed_to_attach_Detours_hook:__ld
mov qword [0x14014da60], r14
mov qword [0x14014dab0], r14
mov qword [0x14014da68], r14
call fcn.140010db0
mov r14, qword [rsp + 0x20]
test bl, bl
mov byte [0x14014e222], bl
mov rbx, qword [rsp + 0x30]
je 0x140010da9
mov al, 1
add rsp, 0x28
ret
lea rcx, str._OBS__no_DXGI_hook_address_found__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [0x14014e222], 1
xor al, al
add rsp, 0x28
ret
Function at 0x140010db0
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rdi
sub rsp, 0x448
mov rax, qword [0x14013f130]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rbx, rcx
lea rdi, [r11 + 0x10]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x400
call fcn.1400b93c0
call fcn.140007e40
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], 0
mov r8d, 0x400
mov rcx, qword [rax]
call fcn.1400c1850
mov edx, eax
mov eax, 0xffffffff
test edx, edx
cmovs edx, eax
test edx, edx
jle 0x140010e58
mov rax, qword [0x14014e190]
lea rcx, [rsp + 0x30]
test rax, rax
je 0x140010e45
call rax
jmp 0x140010e58
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, reloc.WS2_32.dll_ioctlsocket
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.14009ab00
add rsp, 0x448
pop rdi
pop rbx
ret
Function at 0x140011c00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov byte [rsp + 0x38], 0x4d
mov byte [rsp + 0x39], 0x65
mov byte [rsp + 0x3a], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x3b], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x3c], 0x61
mov byte [rsp + 0x3d], 0x67
mov byte [rsp + 0x3e], 0x65
mov byte [rsp + 0x3f], 0x42
mov byte [rsp + 0x40], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x41], 0x78
mov byte [rsp + 0x42], 0x41
mov byte [rsp + 0x43], 0
mov byte [rsp + 0x48], 0x4c
mov byte [rsp + 0x49], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x4a], 0x61
mov byte [rsp + 0x4b], 0x64
mov byte [rsp + 0x4c], 0x4c
mov byte [rsp + 0x4d], 0x69
mov byte [rsp + 0x4e], 0x62
mov byte [rsp + 0x4f], WSACleanup
mov byte [rsp + 0x50], 0x61
mov byte [rsp + 0x51], WSACleanup
mov byte [rsp + 0x52], 0x79
mov byte [rsp + 0x53], 0x41
mov byte [rsp + 0x54], 0
mov byte [rsp + 0x58], 0x47
mov byte [rsp + 0x59], 0x65
mov byte [rsp + 0x5a], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x5b], 0x50
mov byte [rsp + 0x5c], WSACleanup
mov byte [rsp + 0x5d], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x5e], 0x63
mov byte [rsp + 0x5f], 0x41
mov byte [rsp + 0x60], 0x64
mov byte [rsp + 0x61], 0x64
mov byte [rsp + 0x62], WSACleanup
mov byte [rsp + 0x63], 0x65
mov byte [rsp + 0x64], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x65], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x66], 0
mov byte [rsp + 0x20], 0x75
mov byte [rsp + 0x21], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x22], 0x65
mov byte [rsp + 0x23], WSACleanup
mov byte [rsp + 0x24], 0x33
mov byte [rsp + 0x25], 0x32
mov byte [rsp + 0x26], 0
call fcn.140011f67
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
call fcn.140011e10
mov rcx, qword [rsp + 0x80]
mov qword [rcx + 0x10], rax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x80]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x80]
mov qword [rcx + 8], rax
lea rcx, [rsp + 0x20]
mov rax, qword [rsp + 0x80]
call qword [rax + ioctlsocket]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x80]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x80]
mov qword [rcx], rax
add rsp, 0x78
ret
Function at 0x140011e10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x20], 0
jmp 0x140011ec5
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 0x20], eax
jae 0x140011f4b
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x50]
call fcn.140011d80
test eax, eax
jne 0x140011f46
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
movzx eax, word [rcx + rax*2]
mov word [rsp + 0x24], ax
movzx eax, word [rsp + 0x24]
mov rcx, qword [rsp + 0x60]
mov eax, dword [rcx + rax*4]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
jmp 0x140011f4d
jmp 0x140011ebb
xor eax, eax
add rsp, 0x78
ret

Function at 0x140011f67
Capabilities:
Access peb ldr_data

Disassembly:
xor r8, r8
xor rax, rax
xor r10, r10
add r10, 0x60
mov rax, qword gs:[r10]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
ret
Function at 0x140014b90
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14013f130]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, 0xffff
movzx edi, dx
mov rbx, rcx
cmp si, dx
jne 0x140014bcb
xor eax, eax
cmp dx, si
cmove di, ax
movzx eax, di
jmp 0x140014d18
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x140014c07
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x140014c07
lea ecx, [r9 - 1]
mov dword [rax], ecx
movzx eax, di
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], di
jmp 0x140014d18
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x140014d0d
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140014c4e
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140014c77
movzx ecx, di
mov rdx, qword [rbx + 0x80]
call fcn.1400c1e78
cmp ax, si
je 0x140014d0d
movzx esi, di
jmp 0x140014d0d
lea r8, [rsp + 0x40]
mov word [rsp + 0x50], di
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x52]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
js 0x140014d0d
cmp eax, 1
jle 0x140014ccd
cmp eax, 3
jne 0x140014d0d
movzx ecx, word [rsp + 0x50]
jmp 0x140014c5a
mov rbp, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x140014cfa
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call fcn.1400bc658
cmp rbp, rax
jne 0x140014d0d
lea rax, [rsp + 0x50]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x48], rax
movzx eax, di
jne 0x140014d10
movzx eax, si
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14009ab00
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret

Function at 0x140016330
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14013f130]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400163e1
cmp byte [rcx + 0x72], 0
je 0x1400163e1
mov rax, qword [rcx]
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x1400163a3
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x1400163a7
sub eax, 1
je 0x1400163ab
sub eax, 2
je 0x1400163e1
xor al, al
jmp 0x1400163e3
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400163d8
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.1400bc658
cmp rdi, rax
jne 0x1400163a3
cmp byte [rbx + 0x72], 0
sete al
jmp 0x1400163e3
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14009ab00
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140024fa0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp + 0xf], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x14013f130]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rdx
mov dword [rbp - 0x39], 0
lea r9, [rbp + 0x4c]
movabs r10, 0xcccccccccccccccd
nop word [rax + rax]
dec r9
mov rax, r10
mul r8
shr rdx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8, rdx
test rdx, rdx
jne 0x140024ff0
movdqa xmm0, xmmword [0x14010a4e0]
movdqu xmmword [rbp - 1], xmm0
mov byte [rbp - 0x11], dl
lea rax, [rbp + 0x4c]
cmp r9, rax
je 0x140025047
lea r8, [rbp + 0x4c]
sub r8, r9
mov rdx, r9
lea rcx, [rbp - 0x11]
call fcn.140007260
nop
movdqa xmm0, xmmword [0x14010a4e0]
movdqu xmmword [rbp - 0x21], xmm0
mov byte [rbp - 0x31], 0
mov dword [rbp - 0x39], 7
lea rdi, [rbx + 0x10]
mov rdx, qword [rdi]
inc rdx
lea rcx, [rbp - 0x31]
call fcn.140018630
cmp qword [rbx + 0x18], 0x10
jb 0x14002507c
mov rbx, qword [rbx]
mov r8, qword [rdi]
mov rdx, rbx
lea rcx, [rbp - 0x31]
call fcn.1400073c0
mov r8d, 1
lea rdx, [0x1401016d0]
lea rcx, [rbp - 0x31]
call fcn.1400073c0
mov rdx, qword [rbp - 0x19]
mov rax, rdx
mov r9, qword [rbp - 0x21]
sub rax, r9
mov rcx, qword [rbp + 7]
mov r8, qword [rbp - 1]
cmp r8, rax
jbe 0x1400250df
mov rax, rcx
sub rax, r8
cmp rax, r9
jb 0x1400250df
lea r8, [rbp - 0x31]
cmp rdx, 0x10
cmovae r8, qword [rbp - 0x31]
lea rcx, [rbp - 0x11]
call fcn.1400186e0
jmp 0x1400250f5
lea rdx, [rbp - 0x11]
cmp rcx, 0x10
cmovae rdx, qword [rbp - 0x11]
lea rcx, [rbp - 0x31]
call fcn.1400073c0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x17], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x27], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], send
mov byte [rax], 0
lea rcx, [rbp - 0x31]
call fcn.140007080
nop
lea rcx, [rbp - 0x11]
call fcn.140007080
lea rcx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 0x10
cmovae rcx, qword [rbp + 0x17]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rbp + 0x17]
call fcn.140007080
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.14009ab00
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret