joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140121e70
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x80
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140121e80
test al, 1
je 0x140121f4b
test al, 2
jne 0x140121f63
test al, 8
jne 0x140121eba
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x28], 2
lea rdx, [rsp + 0x28]
call fcn.140120bc0
jmp 0x140121ed2
test al, 0x10
je 0x140121ed2
mov rax, qword [rsi + 0x60]
test rax, rax
je 0x140121fe7
mov rcx, qword [rsi + 0x68]
call qword [rax + 0x10]
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x140121f03
mov r8, qword [rsi + 0x78]
mov rcx, qword [r8 + 0x10]
dec rcx
and rcx, 0xfffffffffffffff0
add rcx, rax
add rcx, 0x10
mov rax, qword [rsi + 0x28]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x28]
call qword [r8 + 0x28]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401b9380
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x140121f7b
jne 0x140121f41
mov rcx, rsi
call fcn.140121da0
nop
add rsp, 0x80
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140290708]
mov edx, 0x23
call fcn.1401d1740
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140290748]
mov edx, 0x25
call fcn.1401d1740
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x60], rax
lea rax, [fcn.140047120]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
lea rax, str.current:___sub:___a__
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 2
lea rdx, [0x140290790]
lea rcx, [rsp + 0x28]
call fcn.1401d16a0
lea rax, str.waker_missing
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x38], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea rdx, str.C:UsersUser.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.41.1_src_runtime_taskcore.rsX
lea rcx, [rsp + 0x28]
call fcn.1401d16a0
int3

Function at 0x140124760
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x158
movaps xmmword [rsp + 0x140], xmm6
mov rbx, qword [rdx + 0x10]
test rbx, rbx
js 0x1401251ec
mov rdi, rdx
mov rsi, rcx
je 0x140124842
add byte [rax], al
mov qword [rsp + 0xa8], 1
xorps xmm0, xmm0
movups xmmword [rsp + 0xb0], xmm0
lea rax, [0x1401e4818]
add byte [rax - 0x77], cl
test byte [rax + riz*4], ah
add byte [rax], al
add byte [rax - 0x4b], al
add eax, dword [rcx - 0x4b]
or dword [rcx - 0x41], eax
add dword [rax], eax
add byte [rax], al
Function at 0x1401338b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov rsi, rdx
mov qword [rsp + 0x38], rcx
mov rcx, qword [rdx + 0x20]
mov rdx, qword [rdx + 0x28]
mov qword [rsp + 0x28], r8
call fcn.140133630
push rbx
std
invalid
dec dword [rax - 0x75]
invalid
mov qword [rsp + 0x40], rsi
mov r8, qword [rsi + 8]
mov qword [rsp + 0x30], r8
and r8, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
xor edx, edx
pcmpeqd xmm1, xmm1

Function at 0x14013e890
Capabilities:
Check for software breakpoints
Encode data using xor
Encrypt data using speck
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x2298
call fcn.1401cfd40
sub rsp, rax
movdqa xmmword [rsp + 0x2280], xmm15
and al, byte [rax]
add byte [rsi + 0x44], ah
movq qword [rsp + 0x2270], mm6
Function at 0x1401702a0
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
lea rcx, [rdx + 0x1f0]
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x28]
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
test eax, eax
je 0x1401702de
movabs rdi, 0x8000000000000000
jmp 0x140170327
mov r14, qword [rsp + 0x28]
mov r15, qword [r14 + 8]
mov edi, dword [r14 + 0x10]
test rdi, rdi
je 0x14017030b
movzx eax, byte [0x1402a5340]
xor ecx, ecx
mov rdx, rdi
call fcn.1401af7e0
test rax, rax
je 0x14017033e
mov rbx, rax
jmp 0x140170310
mov ebx, 1
mov rcx, rbx
mov rdx, r15
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, r14
call qword [sym.imp.crypt32.dll_CertFreeCertificateContext]
mov qword [rsi], rdi
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rdi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
mov rdx, rdi
call fcn.1401d11bf
int3

Function at 0x140170620
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
movaps xmmword [rsp + 0x180], xmm6
mov rdi, rdx
mov qword [rsp + 0x70], rcx
lea rax, [rdx + 0x1d4]
mov qword [rsp + 0x138], rax
lea r13, [rdx + 0x10]
lea r15, [rdx + 0x1f0]
lea r12, [rsp + 0x98]
xorps xmm6, xmm6
mov qword [rsp + 0xe0], r13
mov qword [rsp + 0x78], r15
movzx eax, byte [rdi + 0x1d0]
test eax, eax
je 0x1401706c6

Function at 0x140172c60
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x188
add byte [rdi], cl
sub dword [rsp + 0x170], esi

Function at 0x140173f20
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
invalid
Function at 0x140001000
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Contain obfuscated stackstrings
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x14000a008]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov ecx, 0x3f56
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, str.37.0.11.171
mov dword [rbp + 0xf0], 0x30b65c2b
xor edx, edx
mov dword [rbp + 0xf4], 0x11540527
xor ecx, ecx
mov dword [rbp + 0xf8], 0x25523a26
mov dword [rbp + 0xfc], 0x550902b7
mov dword [rbp + 0x100], 0x6a5c354a
mov dword [rbp + 0x104], 0x5e011c5e
mov dword [rbp + 0x108], 0x2bd75c3a
mov dword [rbp + 0x10c], 0x630a5e0b
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400010a4
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rsp + 0x20]
call fcn.1400010d0
lea r9, [rbp + 0xf0]
lea rcx, [rsp + 0x20]
call fcn.140003f70
lea rcx, [rsp + 0x20]
call fcn.140004d30
int3
Function at 0x140003f70
Capabilities:
Enumerate pe sections
Initialize winsock library
Resolve dns
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, r9
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbx], rax
lea rdx, [rbx + 0x10]
xor eax, eax
mov ecx, 0x202
mov dword [rbx + 8], eax
mov qword [rbx + 0x1a8], rax
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x140003fb6
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.37.0.11.171
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx]
mov ecx, dword [rax]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov qword [rbx], rax
movzx eax, byte [rdi]
mov dword [rbx + 8], 0xc0d7
mov byte [rbx + 0x1b0], al
movzx eax, byte [rdi + 1]
mov byte [rbx + 0x1b1], al
movzx eax, byte [rdi + 2]
mov byte [rbx + 0x1b2], al
movzx eax, byte [rdi + 3]
mov byte [rbx + 0x1b3], al
movzx eax, byte [rdi + 4]
mov byte [rbx + 0x1b4], al
movzx eax, byte [rdi + 5]
mov byte [rbx + 0x1b5], al
movzx eax, byte [rdi + 6]
mov byte [rbx + 0x1b6], al
movzx eax, byte [rdi + 7]
mov byte [rbx + 0x1b7], al
movzx eax, byte [rdi + 8]
mov byte [rbx + 0x1b8], al
movzx eax, byte [rdi + 9]
mov byte [rbx + 0x1b9], al
movzx eax, byte [rdi + 0xa]
mov byte [rbx + 0x1ba], al
movzx eax, byte [rdi + 0xb]
mov byte [rbx + 0x1bb], al
movzx eax, byte [rdi + 0xc]
mov byte [rbx + 0x1bc], al
movzx eax, byte [rdi + 0xd]
mov byte [rbx + 0x1bd], al
movzx eax, byte [rdi + 0xe]
mov byte [rbx + 0x1be], al
movzx eax, byte [rdi + 0xf]
mov byte [rbx + 0x1bf], al
movzx eax, byte [rdi + 0x10]
mov byte [rbx + 0x1c0], al
movzx eax, byte [rdi + 0x11]
mov byte [rbx + 0x1c1], al
movzx eax, byte [rdi + 0x12]
mov byte [rbx + 0x1c2], al
movzx eax, byte [rdi + 0x13]
mov byte [rbx + 0x1c3], al
movzx eax, byte [rdi + 0x14]
mov byte [rbx + 0x1c4], al
movzx eax, byte [rdi + 0x15]
mov byte [rbx + 0x1c5], al
movzx eax, byte [rdi + 0x16]
mov byte [rbx + 0x1c6], al
movzx eax, byte [rdi + 0x17]
mov byte [rbx + 0x1c7], al
movzx eax, byte [rdi + 0x18]
mov byte [rbx + 0x1c8], al
movzx eax, byte [rdi + 0x19]
mov byte [rbx + 0x1c9], al
movzx eax, byte [rdi + 0x1a]
mov byte [rbx + 0x1ca], al
movzx eax, byte [rdi + 0x1b]
mov byte [rbx + 0x1cb], al
movzx eax, byte [rdi + 0x1c]
mov byte [rbx + 0x1cc], al
movzx eax, byte [rdi + 0x1d]
mov byte [rbx + 0x1cd], al
movzx eax, byte [rdi + 0x1e]
mov byte [rbx + 0x1ce], al
movzx eax, byte [rdi + 0x1f]
mov byte [rbx + 0x1cf], al
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140015800
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x80
xor edx, edx
movaps xmmword [rax - 0x28], xmm7
lea rcx, [rax + 8]
mov dword [rax + 8], 0x43c80000
mov dword [rax + 0xc], 0x43c08000
call fcn.1400247a0
lea r8, [rsp + 0x90]
mov qword [rsp + 0x90], rdx
lea rcx, [rsp + 0x98]
mov qword [rsp + 0x98], rdx
xorps xmm7, xmm7
call fcn.140024760
mov r8d, Ordinal_50
lea rcx, str.goodbye
call fcn.140021f20
call fcn.140014480
call fcn.14001cfa0
mov rbx, rax
call fcn.140024830
cmp byte [0x140477991], 0
mov rdi, rax
jne 0x1400159e8
movss xmm0, dword [0x140477984]
addss xmm0, dword [rbx + 0x10]
mov qword [rsp + 0xa0], rsi
movaps xmmword [rsp + 0x70], xmm6
movss xmm6, dword [0x14016df70]
movss dword [0x140477984], xmm0
divss xmm0, dword [0x14016dfa0]
comiss xmm7, xmm0
jbe 0x1400158c8
xorps xmm6, xmm6
jmp 0x1400158cc
minss xmm6, xmm0
movss xmm0, dword [0x14016e090]
lea rsi, str.Good_Bye_
mov rdx, rsi
movss dword [0x140477994], xmm6
xor r9d, r9d
movss dword [rsp + 0x20], xmm0
xor r8d, r8d
lea rcx, [rsp + 0x90]
call fcn.14001f150
call fcn.1400244a0
subss xmm0, dword [0x14016e04c]
lea rcx, [rsp + 0x90]
mov dword [rsp + 0x94], 0x43400000
movss dword [rsp + 0x90], xmm0
call fcn.140027710
mulss xmm6, dword [0x14016e050]
mov dword [rsp + 0x50], 0x3f800000
mov dword [rsp + 0x54], 0x3f800000
mov dword [rsp + 0x58], 0x3f800000
cvttss2si eax, xmm6
movzx ecx, al
movd xmm0, ecx
lea rcx, [rsp + 0x90]
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [0x14016df08]
movss dword [rsp + 0x5c], xmm0
call fcn.1400276c0
lea rcx, [rsp + 0x50]
mov r9, rax
call fcn.14001a0d0
mov rcx, qword [rbx + 0x30]
movss xmm2, dword [0x14016dff8]
mov rdx, qword [rcx + 0x60]
xor ecx, ecx
mov qword [rsp + 0x40], rcx
movss dword [rsp + 0x38], xmm7
mov qword [rsp + 0x30], rcx
mov rcx, rdi
mov rdx, qword [rdx + 8]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
call fcn.140039410
movss xmm0, dword [0x140477984]
comiss xmm0, dword [0x14016dfa0]
mov rsi, qword [rsp + 0xa0]
movaps xmm6, xmmword [rsp + 0x70]
jb 0x1400159e8
xor ecx, ecx
mov byte [0x140477991], 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.1400156c0
mov rbx, qword [rsp + 0xa8]
movaps xmm7, xmmword [rsp + 0x60]
add rsp, 0x80
pop rdi
jmp fcn.140023c20
Function at 0x140017160
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.140014cf0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x140019890
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
not r8d
lea r10, [0x140168060]
nop word [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
movzx r9d, r8b
xor r9, rax
shr r8d, 8
xor r8d, dword [r10 + r9*4]
sub rdx, 1
jne 0x1400198a0
not r8d
mov eax, r8d
ret

Function at 0x1400198d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14001992d
lea rbx, [0x140168060]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140019914
cmp r10, 2
jb 0x140019914
cmp byte [r9], r8b
jne 0x140019914
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400198f0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14001996f
lea rbx, [0x140168060]
cmp r8b, 0x23
jne 0x140019953
cmp byte [r9], r8b
jne 0x140019953
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140019940
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x14003dc10
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
mov r10, rdx
mov eax, 0x5e6ea9af
mul r8d
mov ebx, r8d
xor r9d, r9d
shr edx, 0xb
mov esi, r8d
imul eax, edx, 0x15b0
mov ecx, 1
sub ebx, eax
test r8d, r8d
je 0x14003dd5c
mov qword [rsp + 0x20], rdi
xor r11d, r11d
cmp ebx, 7
jbe 0x14003dcbe
mov edx, 7
nop word [rax + rax]
movzx eax, byte [r10]
add r11d, 8
add ecx, eax
add edx, 8
movzx eax, byte [r10 + 1]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 2]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 3]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 4]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 5]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 6]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 7]
add r9d, ecx
add ecx, eax
add r10, 8
add r9d, ecx
cmp edx, ebx
jb 0x14003dc60
xor edx, edx
xor r8d, r8d
cmp r11d, ebx
jae 0x14003dd24
mov eax, ebx
sub eax, r11d
cmp eax, 2
jb 0x14003dd11
mov eax, ebx
sub eax, r11d
sub eax, 2
shr eax, 1
inc eax
mov edi, eax
lea r11d, [r11 + rax*2]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r10]
add ecx, eax
movzx eax, byte [r10 + 1]
add edx, ecx
add r10, 2
add ecx, eax
add r8d, ecx
sub rdi, 1
jne 0x14003dcf0
cmp r11d, ebx
jae 0x14003dd1d
movzx eax, byte [r10]
add ecx, eax
add r9d, ecx
inc r10
lea eax, [r8 + rdx]
add r9d, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul edx, edx, 0xffff000f
add r9d, edx
sub esi, ebx
mov ebx, 0x15b0
jne 0x14003dc48
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
shl r9d, 0x10
lea eax, [rcx + r9]
pop rsi
ret
Function at 0x14003f910
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret
Function at 0x14005a8f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x50
mov rax, qword [rcx + 8]
mov ebp, r8d
mov ecx, 0x3e80000
mov rbx, qword [rax + 0x2f0]
mov rax, qword [rdx + 0x80]
movzx edx, word [rdx + 0x68]
movzx edi, word [rax + 0x18]
mov eax, 0x40000
shl edi, 0x10
cmp edi, eax
cmovl edi, eax
shl edx, 0x10
call fcn.1400499b0
mov dword [rsp + 0x24], eax
mov ecx, eax
cmp eax, 0x28f
jge 0x14005a946
xor eax, eax
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
mov eax, dword [rbx + 0x24]
mov qword [rsp + 0x80], rsi
mov esi, dword [rbx + 0x28]
mov qword [rsp + 0x48], r12
mov r12d, dword [rbx + 0x3c]
mov qword [rsp + 0x40], r13
mov r13d, dword [rbx + 0x38]
mov dword [rsp + 0x88], eax
mov eax, dword [rbx + 0x2c]
mov qword [rsp + 0x38], r14
mov r14d, dword [rbx + 0x40]
mov dword [rsp + 0x70], eax
mov eax, dword [rbx + 0x34]
mov qword [rsp + 0x30], r15
mov r15d, dword [rbx + 0x30]
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x20], r12d
test ebp, ebp
jg 0x14005a99d
mov ebp, 0x4b0000
jmp 0x14005a9ab
shl ebp, 0x10
mov edx, ecx
mov ecx, ebp
call fcn.14004bdf0
mov ebp, eax
bsr ecx, ebp
bsr eax, edi
shl r12d, 0x10
add eax, ecx
cmp eax, 0x2e
jl 0x14005a9c1
mov eax, r12d
jmp 0x14005a9ca
mov edx, edi
mov ecx, ebp
call fcn.14004bdf0
mov r9d, dword [rsp + 0x88]
mov ecx, r9d
shl ecx, 0x10
cmp eax, ecx
jge 0x14005a9e6
shl esi, 0x10
mov ecx, esi
jmp 0x14005aad5
mov r8d, dword [rsp + 0x70]
mov edx, r8d
shl edx, 0x10
mov dword [rsp + 0x88], edx
cmp eax, edx
jge 0x14005aa44
mov ebx, r8d
mov edx, edi
sub ebx, r9d
call fcn.1400499b0
mov ecx, ebp
sub ecx, eax
test ebx, ebx
je 0x14005aa34
sub r15d, esi
mov r8d, ebx
mov edx, r15d
call fcn.14004bcc0
shl esi, 0x10
mov edx, edi
mov ecx, esi
mov ebx, eax
call fcn.1400499b0
add ebx, eax
jmp 0x14005aade
mov esi, dword [rsp + 0x78]
mov ebx, esi
mov r8d, dword [rsp + 0x70]
shl ebx, 0x10
jmp 0x14005aa51
mov esi, dword [rsp + 0x78]
mov ebx, esi
shl ebx, 0x10
cmp eax, ebx
jge 0x14005aa90
mov ecx, dword [rsp + 0x88]
mov r12d, esi
mov edx, edi
sub r12d, r8d
call fcn.1400499b0
mov ecx, ebp
sub ecx, eax
test r12d, r12d
je 0x14005aa95
sub r13d, r15d
mov r8d, r12d
mov edx, r13d
call fcn.14004bcc0
shl r15d, 0x10
mov edx, edi
mov ecx, r15d
mov ebx, eax
call fcn.1400499b0
add ebx, eax
jmp 0x14005aade
cmp eax, r12d
jge 0x14005aace
mov r15d, dword [rsp + 0x20]
mov edx, edi
mov ecx, ebx
call fcn.1400499b0
sub ebp, eax
sub r15d, esi
je 0x14005aace
sub r14d, r13d
mov r8d, r15d
mov edx, r14d
mov ecx, ebp
call fcn.14004bcc0
shl r13d, 0x10
mov edx, edi
mov ecx, r13d
mov ebx, eax
call fcn.1400499b0
add ebx, eax
jmp 0x14005aade
shl r14d, 0x10
mov ecx, r14d
mov edx, edi
call fcn.1400499b0
mov ebx, eax
mov edx, dword [rsp + 0x24]
mov ecx, ebx
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rbp
pop rbx
jmp fcn.1400499b0
Function at 0x1400a6b20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x250
mov rax, qword [0x1401857c0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov eax, dword [rcx + 0x58]
lea rbx, [rsp + 0x30]
mov dword [rsp + 0x40], eax
mov ebp, r9d
mov eax, dword [rcx + 0x5c]
mov rsi, rcx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x3c], r8d
mov dword [rsp + 0x30], r9d
mov qword [rsp + 0x278], rdi
nop dword [rax]
mov r10d, dword [rbx + 0x14]
mov eax, r10d
mov r14d, dword [rbx + 4]
cmp r10d, r14d
mov r9d, dword [rbx + 0xc]
cmovg eax, r14d
cmp r9d, eax
jl 0x1400a6cbc
cmp r10d, r14d
mov eax, r14d
cmovg eax, r10d
cmp r9d, eax
jg 0x1400a6cbc
cmp r10d, r14d
jne 0x1400a6bc0
sub rbx, 0x10
jmp 0x1400a6d04
mov edx, dword [rsi + 0x88]
xor r9d, r9d
cmp r10d, r14d
setge r9b
inc r9d
cmp edx, r9d
je 0x1400a6c32
mov eax, dword [rsi + 4]
mov ecx, eax
mov r8d, dword [rsi + 8]
neg ecx
cmp r10d, r14d
jge 0x1400a6bf4
dec eax
add eax, r10d
and eax, ecx
sub eax, r10d
jmp 0x1400a6bfc
and ecx, r10d
mov eax, r10d
sub eax, ecx
cmp eax, r8d
setge r11b
test edx, edx
je 0x1400a6c1b
movzx edx, r11b
mov rcx, rsi
call fcn.1400a7cd0
test al, al
jne 0x1400a6d15
movzx r8d, r11b
mov edx, r9d
mov rcx, rsi
call fcn.1400a8340
test al, al
jne 0x1400a6d15
mov edx, dword [rsi + 0x64]
lea r9, [0x1400a86a0]
mov ecx, dword [rsi + 0x60]
mov r8, rbx
cmp r10d, r14d
jge 0x1400a6c5e
mov dword [rsp + 0x28], edx
mov edx, 2
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call fcn.1400a69a0
jmp 0x1400a6cb2
mov eax, dword [rbx + 4]
neg ecx
movzx edi, byte [rsi + 0x6a]
neg eax
mov dword [rbx + 4], eax
neg edx
mov eax, dword [rbx + 0xc]
neg eax
mov dword [rsp + 0x28], ecx
mov dword [rbx + 0xc], eax
mov rcx, rsi
mov eax, dword [rbx + 0x14]
neg eax
mov dword [rsp + 0x20], edx
mov edx, 2
mov dword [rbx + 0x14], eax
call fcn.1400a69a0
test dil, dil
je 0x1400a6caa
cmp byte [rsi + 0x6a], 0
jne 0x1400a6caa
mov rdx, qword [rsi + 0x70]
mov ecx, dword [rdx + 0x20]
neg ecx
mov dword [rdx + 0x20], ecx
mov ecx, dword [rbx + 4]
neg ecx
mov dword [rbx + 4], ecx
test al, al
jne 0x1400a6d15
sub rbx, 0x10
jmp 0x1400a6d04
mov eax, dword [rbx + 8]
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x20], ecx
add ecx, eax
mov dword [rbx + 0x24], r10d
lea edx, [rax + rbp]
mov eax, ecx
sar eax, 1
mov dword [rbx + 0x18], eax
lea eax, [rcx + rdx]
sar eax, 2
lea ecx, [r10 + r9]
mov dword [rbx + 0x10], eax
mov eax, ecx
sar edx, 1
sar eax, 1
mov dword [rbx + 8], edx
lea edx, [r14 + r9]
mov dword [rbx + 0x1c], eax
lea eax, [rcx + rdx]
sar eax, 2
sar edx, 1
mov dword [rbx + 0x14], eax
mov dword [rbx + 0xc], edx
add rbx, 0x10
lea rax, [rsp + 0x30]
cmp rbx, rax
jb 0x1400a6d19
mov ebp, dword [rbx]
jmp 0x1400a6b80
mov al, 1
jmp 0x1400a6d22
mov dword [rsi + 0x58], ebp
xor al, al
mov dword [rsi + 0x5c], r14d
mov rdi, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401133d0
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop r14
pop rsi
pop rbp
ret
Function at 0x1400ad070
Capabilities:
Get file size
Read file on windows
Read file via mapping

Disassembly:
push rbx
push rbp
sub rsp, 0x48
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
jne 0x1400ad08c
lea eax, [rcx + 0x28]
add rsp, 0x48
pop rbp
pop rbx
ret
mov qword [rsp + 0x68], rsi
xor r9d, r9d
mov qword [rsp + 0x40], r14
mov edx, 0x80000000
xor r14d, r14d
mov rcx, rbp
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r14 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400ad0e0
mov r14, qword [rsp + 0x40]
lea eax, [rsi + 2]
mov rsi, qword [rsp + 0x68]
add rsp, 0x48
pop rbp
pop rbx
ret
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x78], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400ad205
mov rax, qword [rsp + 0x70]
cmp rax, 0x7fffffff
jg 0x1400ad205
test rax, rax
je 0x1400ad205
xor r9d, r9d
mov qword [rsp + 0x28], r14
xor edx, edx
mov dword [rsp + 0x20], r14d
mov rcx, rsi
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
test rax, rax
je 0x1400ad205
mov ecx, dword [rsp + 0x70]
xor r9d, r9d
mov dword [rbx + 8], ecx
xor r8d, r8d
mov rcx, rax
mov dword [rbx + 0xc], r14d
mov qword [rsp + 0x20], r14
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rdi
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx], r14
je 0x1400ad17a
lea rax, [0x1400ad260]
jmp 0x1400ad1d3
mov rcx, qword [rbx + 0x30]
xor edx, edx
movsxd r8, dword [rbx + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
test rax, rax
je 0x1400ad205
mov edi, r14d
nop dword [rax + rax]
mov r8d, dword [rbx + 8]
lea r9, [rsp + 0x60]
mov edx, edi
sub r8d, edi
add rdx, qword [rbx]
mov rcx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400ad1f3
add edi, dword [rsp + 0x60]
cmp edi, dword [rbx + 8]
jne 0x1400ad1a0
lea rax, [0x1400ad230]
mov rcx, rsi
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx]
mov qword [rbx + 0x10], rax
xor eax, eax
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x20], r14
jmp 0x1400ad21a
mov rcx, qword [rbx + 0x30]
xor edx, edx
mov r8, qword [rbx]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x51
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop rbp
pop rbx
ret