joyce8/EMBER2024-capa huggingface dataset:
Function at 0x110156a10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x30
mov rdi, qword [rsp + 0x80]
mov eax, ecx
and al, 8
mov rsi, r9
neg al
mov r15, r8
mov ebx, ecx
mov rbp, qword [rdi]
sbb eax, eax
dec dword [r9]
mov r9d, 0xffff
mov dword [rsp + 0x80], eax
cmp r9w, word [r8]
je 0x110156a6d
mov rdx, qword [rsp + 0x90]
movzx ecx, word [r8]
call fcn.11014f0e0
mov r13d, dword [rsp + 0x88]
mov r12d, ebx
and r12d, 1
xor ecx, ecx
test r12d, r12d
je 0x110156a91
mov eax, r13d
dec r13d
test eax, eax
je 0x110156b9d
mov rcx, qword [rsp + 0x90]
inc dword [rsi]
call fcn.11014ce0c
mov r9d, 0xffff
mov word [r15], ax
movzx r8d, ax
cmp r9w, ax
je 0x110156b82
test bl, 0x10
jne 0x110156b0e
test bl, 0x20
je 0x110156ad5
cmp ax, 9
jb 0x110156ace
cmp ax, 0xd
jbe 0x110156ad5
cmp r8w, 0x20
jne 0x110156b0e
test bl, 0x40
je 0x110156b82
movzx ecx, r8w
shr cx, 3
cmp r8w, cx
jb 0x110156b82
movzx eax, cx
mov edx, r8d
mov rcx, qword [rsp + 0x68]
and edx, 7
movsx ecx, byte [rax + rcx]
xor ecx, dword [rsp + 0x80]
bt ecx, edx
jae 0x110156b82
test bl, 4
jne 0x110156b79
mov rdx, qword [rdi]
test bl, 2
je 0x110156b28
mov word [rdx], r8w
add qword [rdi], 2
jmp 0x110156a7c
and dword [rsp + 0x60], 0
lea rcx, [rsp + 0x60]
movzx r9d, r8w
mov r8d, 5
call sym.msvcrt.dll_wctomb_s
xor ecx, ecx
test eax, eax
je 0x110156b6c
cmp eax, 0x16
je 0x110156b55
cmp eax, 0x22
jne 0x110156a7e
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
xor edx, edx
call fcn.11012bbfc
jmp 0x110156a7c
movsxd rax, dword [rsp + 0x60]
add qword [rdi], rax
jmp 0x110156a7e
add rbp, 2
jmp 0x110156a7c
dec dword [rsi]
cmp r9w, word [r15]
je 0x110156b9b
mov rdx, qword [rsp + 0x90]
movzx ecx, word [r15]
call fcn.11014f0e0
xor ecx, ecx
cmp rbp, qword [rdi]
je 0x110156bc9
test bl, 4
jne 0x110156bc5
mov rax, qword [rsp + 0xa0]
inc dword [rax]
test bl, 0x10
jne 0x110156bc5
mov rax, qword [rdi]
test bl, 2
je 0x110156bc3
mov word [rax], cx
jmp 0x110156bc5
mov byte [rax], cl
xor eax, eax
jmp 0x110156bcc
or eax, 0xffffffff
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x110157c3c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rsi, qword [rsp + 0x80]
mov eax, ecx
and al, 8
mov r10d, 0xffff
neg al
mov rbp, r9
mov rbx, r8
mov edi, ecx
mov r14, qword [rsi]
sbb eax, eax
dec dword [r9]
mov dword [rsp + 0x78], eax
cmp r10w, word [r8]
je 0x110157c93
mov rdx, qword [rsp + 0x90]
movzx ecx, word [r8]
call fcn.11014f0e0
mov rax, qword [rsp + 0x98]
xor r9d, r9d
mov r12d, edi
mov ecx, edi
and r12d, 0x10
lea r15, [rax - 1]
cmovne r15, rax
and ecx, 1
mov dword [rsp + 0x60], ecx
test ecx, ecx
je 0x110157cd4
mov ecx, dword [rsp + 0x88]
mov eax, ecx
dec ecx
mov dword [rsp + 0x88], ecx
test eax, eax
je 0x110157e1d
mov rcx, qword [rsp + 0x90]
inc dword [rbp]
call fcn.11014ce0c
mov r10d, 0xffff
mov word [rbx], ax
xor r9d, r9d
movzx r8d, ax
cmp r10w, ax
je 0x110157e01
test r12d, r12d
jne 0x110157d57
test dil, 0x20
je 0x110157d1c
cmp ax, 9
jb 0x110157d15
cmp ax, 0xd
jbe 0x110157d1c
cmp r8w, 0x20
jne 0x110157d57
test dil, 0x40
je 0x110157e01
movzx ecx, r8w
shr cx, 3
cmp r8w, cx
jb 0x110157e01
movzx eax, cx
mov edx, r8d
mov rcx, qword [rsp + 0x68]
and edx, 7
movsx ecx, byte [rax + rcx]
xor ecx, dword [rsp + 0x78]
bt ecx, edx
jae 0x110157e01
test dil, 4
jne 0x110157dc8
mov ebx, edi
and ebx, 2
test r15, r15
je 0x110157dd5
mov rdx, qword [rsi]
test ebx, ebx
je 0x110157d80
mov rbx, qword [rsp + 0x70]
mov word [rdx], r8w
add qword [rsi], 2
dec r15
jmp 0x110157dcc
mov dword [rsp + 0x80], r9d
lea rcx, [rsp + 0x80]
movzx r9d, r8w
mov r8, r15
call sym.msvcrt.dll_wctomb_s
cmp eax, 0x22
je 0x110157dd5
movsxd rax, dword [rsp + 0x80]
xor r9d, r9d
mov rbx, qword [rsp + 0x70]
mov ecx, dword [rsp + 0x60]
test eax, eax
jle 0x110157cb6
add qword [rsi], rax
sub r15, rax
jmp 0x110157cb6
add r14, 2
mov ecx, dword [rsp + 0x60]
jmp 0x110157cb6
call sym.msvcrt.dll__errno
mov dword [rax], 0xc
xor eax, eax
test ebx, ebx
je 0x110157dfc
mov word [r14], ax
or eax, 0xffffffff
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov byte [r14], al
jmp 0x110157dea
dec dword [rbp]
cmp r10w, word [rbx]
je 0x110157e1d
mov rdx, qword [rsp + 0x90]
movzx ecx, word [rbx]
call fcn.11014f0e0
xor r9d, r9d
cmp r14, qword [rsi]
je 0x110157dea
test dil, 4
jne 0x110157e49
mov rax, qword [rsp + 0xa8]
inc dword [rax]
test r12d, r12d
jne 0x110157e49
mov rax, qword [rsi]
test dil, 2
je 0x110157e46
mov word [rax], r9w
jmp 0x110157e49
mov byte [rax], r9b
xor eax, eax
jmp 0x110157ded
Function at 0x110161b20
Capabilities:
Timestomp file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x110190928]
xor rax, rsp
mov qword [rbp + 0x3f], rax
movsxd rbx, ecx
mov rdi, rdx
cmp ebx, 0xfffffffe
jne 0x110161b63
call sym.msvcrt.dll__errno
mov dword [rax], 9
jmp 0x110161cfe
xor esi, esi
test ecx, ecx
js 0x110161cdf
cmp ebx, dword [0x110195924]
jae 0x110161cdf
mov rcx, rbx
lea rdx, [sym.msvcrt.dll___pioinfo]
and ecx, 0x1f
mov rax, rbx
sar rax, 5
imul rcx, rcx, 0x38
mov rax, qword [rdx + rax*8]
test byte [rax + rcx + 8], 1
je 0x110161cdf
test rdi, rdi
jne 0x110161bb8
lea rcx, [rbp - 0x15]
call sym.msvcrt.dll__time32
mov eax, dword [rbp - 0x15]
lea rdi, [rbp - 0x19]
mov dword [rbp - 0x19], eax
lea rdx, [rdi + 4]
lea rcx, [rbp + 0x17]
call sym.msvcrt.dll__localtime32_s
test eax, eax
je 0x110161bd9
call sym.msvcrt.dll__errno
mov dword [rax], 0x16
jmp 0x110161cfe
movzx eax, word [rbp + 0x2b]
lea rdx, [rbp - 0x11]
mov r14d, 0x76c
mov word [rbp + 0x15], si
add ax, r14w
lea rcx, [rbp + 7]
mov word [rbp + 7], ax
movzx eax, word [rbp + 0x27]
inc ax
mov word [rbp + 9], ax
movzx eax, word [rbp + 0x23]
mov word [rbp + 0xd], ax
movzx eax, word [rbp + 0x1f]
mov word [rbp + 0xf], ax
movzx eax, word [rbp + 0x1b]
mov word [rbp + 0x11], ax
movzx eax, word [rbp + 0x17]
mov word [rbp + 0x13], ax
call qword [sym.imp.KERNELBASE.dll_SystemTimeToFileTime]
test eax, eax
je 0x110161bc9
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x11]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x110161bc9
mov rdx, rdi
lea rcx, [rbp + 0x17]
call sym.msvcrt.dll__localtime32_s
test eax, eax
jne 0x110161bc9
movzx eax, word [rbp + 0x2b]
lea rdx, [rbp - 0x11]
add ax, r14w
mov word [rbp + 0x15], si
mov word [rbp + 7], ax
lea rcx, [rbp + 7]
movzx eax, word [rbp + 0x27]
inc ax
mov word [rbp + 9], ax
movzx eax, word [rbp + 0x23]
mov word [rbp + 0xd], ax
movzx eax, word [rbp + 0x1f]
mov word [rbp + 0xf], ax
movzx eax, word [rbp + 0x1b]
mov word [rbp + 0x11], ax
movzx eax, word [rbp + 0x17]
mov word [rbp + 0x13], ax
call qword [sym.imp.KERNELBASE.dll_SystemTimeToFileTime]
test eax, eax
je 0x110161bc9
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x11]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x110161bc9
mov ecx, ebx
call sym.msvcrt.dll__get_osfhandle
mov rcx, rax
lea r9, [rbp - 9]
lea r8, [rbp - 1]
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileTime]
test eax, eax
je 0x110161bc9
xor eax, eax
jmp 0x110161d01
call sym.msvcrt.dll__errno
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 9
call sym.msvcrt.dll__invalid_parameter
or eax, 0xffffffff
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1101303f0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x110170310
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov ebx, edx
mov rsi, rcx
cmp edx, 1
jne 0x110107871
call fcn.110130780
mov r8, rdi
mov edx, ebx
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x110107894
push rbx
sub rsp, 0x20
mov rbx, r8
cmp edx, 1
jne 0x110107915
call fcn.110107b00
test eax, eax
je 0x1101078be
call fcn.11011a214
test eax, eax
jns 0x1101078c5
call fcn.11013abe8
call fcn.1101197f4
xor eax, eax
jmp 0x1101079c1
call fcn.1101308e4
mov qword [0x1101945a0], rax
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineA]
mov qword [sym.msvcrt.dll__acmdln], rax
call sub.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineW
mov qword [sym.msvcrt.dll__wcmdln], rax
call fcn.110120aa0
call fcn.11013c020
test eax, eax
js 0x11010790e
xor ecx, ecx
call fcn.11013a224
test eax, eax
jne 0x11010790e
inc dword [0x11019459c]
jmp 0x1101079bc
call fcn.11011a4b0
jmp 0x1101078b4
test edx, edx
jne 0x110107953
mov eax, dword [0x11019459c]
test eax, eax
jle 0x1101078be
dec eax
cmp dword [0x110194d1c], edx
mov dword [0x11019459c], eax
jne 0x110107938
call sym.msvcrt.dll__cexit
call fcn.11013a15c
test rbx, rbx
jne 0x1101079bc
call fcn.11011a4b0
call fcn.11013abe8
call fcn.1101197f4
jmp 0x1101079bc
cmp edx, 2
jne 0x1101079b0
call sym.msvcrt.dll__CrtDbgReport
mov ecx, dword [0x110190c30]
call qword [sym.imp.api_ms_win_core_fibers_l1_1_0.dll_FlsGetValue]
test rax, rax
jne 0x1101079bc
mov edx, 0x2d8
lea ecx, [rax + 1]
call fcn.110119e8c
mov rbx, rax
test rax, rax
je 0x1101078be
mov ecx, dword [0x110190c30]
mov rdx, rax
call qword [sym.imp.api_ms_win_core_fibers_l1_1_0.dll_FlsSetValue]
mov rcx, rbx
test eax, eax
je 0x1101079a6
xor edx, edx
call fcn.11013aa90
jmp 0x1101079bc
call sym.msvcrt.dll_free
jmp 0x1101078be
cmp edx, 3
jne 0x1101079bc
xor ecx, ecx
call fcn.11013a99c
mov eax, 1
add rsp, 0x20
pop rbx
ret
cmp dword [rsp + 8], 1
jne 0x110170330
push 0
push 0
push 0x776b387e
push 0x76e00bd0
push 0
push 0
mov eax, 0x76e00f10
call rax
jmp 0x110107850
Function at 0x140001008
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call fcn.14000f008
test rax, rax
je 0x140001065
lea rcx, str.Windows_original_main_args:_n
call fcn.14000114c
xor ebx, ebx
call fcn.14000ed74
cmp dword [rax], ebx
jle 0x140001065
xor edi, edi
call fcn.14000ed7c
mov edx, ebx
lea rcx, str.wwwd_args__d____s_n
mov r8, qword [rax]
mov r8, qword [rdi + r8]
call fcn.14000114c
inc ebx
lea rdi, [rdi + 8]
call fcn.14000ed74
cmp ebx, dword [rax]
jl 0x14000103c
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call fcn.1400012f4
call fcn.140001398
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call fcn.1400011a8
mov rbx, rax
call fcn.1400013a0
xor r9d, r9d
test edi, edi
jle 0x1400010b1
xor edx, edx
mov r9d, edi
mov rcx, qword [rax]
lea rax, [rax + 0x10]
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x14000109e
mov rdx, qword [0x14003a008]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rdx, rdx
jne 0x1400010c8
mov rdx, qword [rbx]
mov rcx, qword [section..data]
test rcx, rcx
jne 0x1400010d7
mov rcx, qword [rbx]
mov r9, qword [0x14003ac80]
mov r8d, 1
test r9, r9
setne al
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 1
mov byte [rsp + 0x50], al
lea rax, [0x1400294a4]
mov qword [rsp + 0x48], rdx
mov rdx, rbx
mov qword [rsp + 0x40], rcx
mov ecx, edi
mov qword [rsp + 0x38], rax
lea rax, [0x1400294a8]
mov qword [rsp + 0x30], rax
mov rax, qword [0x14003ac88]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
call fcn.140001d94
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x1400047f4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x330]
sub rsp, 0x430
mov rax, qword [0x14003a060]
xor rax, rsp
mov qword [rbp + 0x320], rax
mov rbx, rdx
mov edi, ecx
call fcn.140004aac
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140004a84
movzx ecx, byte [rbx + 0xf]
shl rcx, 8
cmp byte [0x14003ad40], 0
je 0x140004a25
movzx eax, byte [rbx + 0xa]
movzx edx, byte [rbx + 0xb]
shl rdx, 8
or rdx, rax
movzx eax, byte [rbx + 9]
shl rdx, 8
or rdx, rax
movzx eax, byte [rbx + 8]
shl rdx, 8
or rdx, rax
movzx eax, byte [rbx + 0xe]
or rcx, rax
movzx eax, byte [rbx + 0xd]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 0xc]
shl rcx, 8
or rcx, rax
shl rcx, 0x20
or rdx, rcx
jl 0x140004a84
xor r8d, r8d
mov ecx, edi
call fcn.140016154
test rax, rax
js 0x140004a84
mov r8d, 0x400
lea rdx, [rsp + 0x20]
mov ecx, edi
call fcn.140019db0
test eax, eax
js 0x140004a84
movzx eax, byte [rsp + 0x22]
movzx ecx, byte [rsp + 0x23]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x21]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x20]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6064b50
jne 0x140004a84
movzx eax, byte [rsp + 0x56]
movzx edx, byte [rsp + 0x57]
movzx r8d, byte [rsp + 0x53]
shl edx, 8
or edx, eax
shl r8d, 8
movzx eax, byte [rsp + 0x55]
shl edx, 8
or edx, eax
movzx eax, byte [rsp + 0x54]
shl edx, 8
or rdx, rax
movzx eax, byte [rsp + 0x52]
or r8d, eax
shl rdx, 0x20
movzx eax, byte [rsp + 0x51]
shl r8d, 8
or r8d, eax
movzx eax, byte [rsp + 0x50]
shl r8d, 8
or r8, rax
or rdx, r8
jl 0x140004a84
xor r8d, r8d
mov ecx, edi
call fcn.140016154
test rax, rax
js 0x140004a84
movzx eax, byte [rsp + 0x4e]
mov r8, 0xffffffffffffffc8
movzx edx, byte [rsp + 0x4f]
movzx ecx, byte [rsp + 0x4b]
shl rdx, 8
or rdx, rax
shl rcx, 8
movzx eax, byte [rsp + 0x4d]
shl rdx, 8
or rdx, rax
movzx eax, byte [rsp + 0x4c]
shl rdx, 8
or rdx, rax
movzx eax, byte [rsp + 0x4a]
or rcx, rax
shl rdx, 0x20
movzx eax, byte [rsp + 0x49]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsp + 0x48]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsp + 0x56]
or rdx, rcx
movzx ecx, byte [rsp + 0x53]
sub r8, rdx
shl rcx, 8
movzx edx, byte [rsp + 0x57]
shl rdx, 8
or rdx, rax
movzx eax, byte [rsp + 0x55]
shl rdx, 8
or rdx, rax
movzx eax, byte [rsp + 0x54]
shl rdx, 8
or rdx, rax
movzx eax, byte [rsp + 0x52]
or rcx, rax
shl rdx, 0x20
movzx eax, byte [rsp + 0x51]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsp + 0x50]
shl rcx, 8
or rcx, rax
or rdx, rcx
sub r8, rdx
add rsi, r8
jmp 0x140004a7f
movzx eax, byte [rbx + 0x12]
xor r8d, r8d
movzx edx, byte [rbx + 0x13]
shl rdx, 8
or rdx, rax
movzx eax, byte [rbx + 0x11]
shl rdx, 8
or rdx, rax
movzx eax, byte [rbx + 0x10]
shl rdx, 8
or rdx, rax
movzx eax, byte [rbx + 0xe]
or rcx, rax
movzx eax, byte [rbx + 0xd]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 0xc]
shl rcx, 8
or rcx, rax
add rcx, rdx
sub rsi, rcx
mov ecx, edi
add rdx, rsi
call fcn.140016154
test rax, rax
js 0x140004a84
mov rax, rsi
jmp 0x140004a88
or rax, 0xffffffffffffffff
mov rcx, qword [rbp + 0x320]
xor rcx, rsp
call fcn.14000ac50
mov rbx, qword [rsp + 0x460]
add rsp, 0x430
pop rdi
pop rsi
pop rbp
ret
Function at 0x140004aac
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rsi, rdx
mov edi, 2
mov r8d, edi
mov rdx, 0xffffffffffffffea
mov ebp, ecx
call fcn.140016154
mov rbx, rax
test rax, rax
js 0x140004c3c
lea r8d, [rdi + 0x14]
mov rdx, rsi
mov ecx, ebp
call fcn.140019db0
test eax, eax
js 0x140004c3c
movzx eax, byte [rsi + 2]
movzx ecx, byte [rsi + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
jne 0x140004b49
mov rcx, rsi
call fcn.140005030
test eax, eax
je 0x140004b41
mov r8, rbx
mov rdx, rsi
mov ecx, ebp
call fcn.140004c5c
mov rbx, rax
mov rax, rbx
jmp 0x140004c40
mov r8d, edi
xor edx, edx
mov ecx, ebp
call fcn.140016154
mov r15, rax
test rax, rax
js 0x140004c3c
mov r14d, 0x10015
mov r8d, edi
cmp rax, r14
mov ebx, r14d
mov ecx, ebp
cmovl rbx, rax
mov rdx, rbx
neg rdx
call fcn.140016154
test rax, rax
js 0x140004c3c
mov ecx, r14d
call fcn.14000f284
mov rdi, rax
test rax, rax
je 0x140004c3c
mov r8d, ebx
mov rdx, rax
mov ecx, ebp
call fcn.140019db0
test eax, eax
js 0x140004c34
movsxd r14, eax
add eax, 0xffffffea
movsxd rbx, eax
add r14, rdi
add rbx, rdi
cmp rbx, rdi
jb 0x140004c34
cmp byte [rbx], 0x50
jne 0x140004c0b
movzx eax, byte [rbx + 2]
movzx ecx, byte [rbx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 1]
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, 0x50
cmp ecx, 0x6054b50
jne 0x140004c0b
movzx eax, byte [rbx + 0x14]
movzx ecx, byte [rbx + 0x15]
shl rcx, 8
or rcx, rax
lea rax, [rbx + 0x16]
add rax, rcx
cmp rax, r14
je 0x140004c10
dec rbx
jmp 0x140004bc2
mov r8d, 0x16
mov rdx, rbx
mov rcx, rsi
call fcn.14000b450
mov rcx, rdi
call fcn.14000f270
sub rbx, r14
add rbx, r15
jmp 0x140004b25
mov rcx, rdi
call fcn.14000f270
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x140004c5c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov edi, ecx
lea rdx, [r8 - 0x14]
xor r8d, r8d
call fcn.140016154
mov rsi, rax
test rax, rax
js 0x140004cc6
mov r8d, 0x14
mov rdx, rbx
mov ecx, edi
call fcn.140019db0
test eax, eax
js 0x140004cc6
movzx eax, byte [rbx + 2]
movzx ecx, byte [rbx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx]
shl ecx, 8
or ecx, eax
or rax, 0xffffffffffffffff
cmp ecx, 0x7064b50
cmove rax, rsi
jmp 0x140004cca
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400050ac
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x80
cmp qword [rdx + 8], 0xffffffffffffffff
mov r14, r8
mov rbx, rdx
mov esi, ecx
je 0x1400051fc
cmp qword [rdx], 0xffffffffffffffff
je 0x1400051fc
mov rdx, qword [rdx + 0x10]
xor r8d, r8d
call fcn.140016154
test rax, rax
js 0x1400051fc
mov rcx, qword [rbx + 8]
inc rcx
call fcn.14000f284
mov rdi, rax
test rax, rax
je 0x1400051fc
mov r8d, dword [rbx + 8]
mov rdx, rax
mov ecx, esi
call fcn.140019db0
movsxd rcx, eax
mov rax, qword [rbx + 8]
cmp rcx, rax
jne 0x1400051f4
cmp dword [rbx + 0x18], 0
jne 0x140005149
mov byte [rax + rdi], 0
test r14, r14
je 0x140005141
mov eax, dword [rbx + 8]
mov dword [r14], eax
mov rax, rdi
jmp 0x1400051fe
cmp dword [rbx + 0x18], 8
jne 0x1400051f4
and qword [rsp + 0x50], 0
lea r8, str.1.2.13
and qword [rsp + 0x58], 0
lea rcx, [rsp + 0x20]
and qword [rsp + 0x60], 0
mov r9d, 0x58
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], eax
lea edx, [r9 - 0x67]
call fcn.14000945c
test eax, eax
js 0x1400051f4
mov rcx, qword [rbx]
inc rcx
call fcn.14000f284
mov rsi, rax
test rax, rax
je 0x1400051f4
mov ecx, dword [rbx]
mov edx, 1
mov dword [rsp + 0x38], ecx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
call fcn.140007df0
mov rcx, rdi
test eax, eax
jns 0x1400051cb
call fcn.14000f270
mov rcx, rsi
jmp 0x1400051f7
mov rax, qword [rbx]
mov byte [rsi + rax], 0
call fcn.14000f270
lea rcx, [rsp + 0x20]
call fcn.140009404
test eax, eax
js 0x1400051c6
test r14, r14
je 0x1400051ef
mov eax, dword [rbx]
mov dword [r14], eax
mov rax, rsi
jmp 0x1400051fe
mov rcx, rdi
call fcn.14000f270
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret
Function at 0x1400054a4
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
and dword [rax + 0x20], 0
lea rax, [rax - 0x18]
mov rsi, r8
mov qword [rsp + 0x28], rax
mov r9, r8
mov dword [rsp + 0x20], 0x10000
mov rbp, rcx
mov r8, rcx
xor ecx, ecx
mov rdi, rdx
call fcn.1400166bc
mov rbx, rax
test rax, rax
jne 0x14000550b
lea rax, [rsp + 0x30]
mov r9, rsi
mov qword [rsp + 0x28], rax
mov r8, rbp
and dword [rsp + 0x20], ebx
mov edx, edi
xor ecx, ecx
call fcn.1400166bc
mov rbx, rax
cmp dword [0x14003a040], 0
je 0x1400055c2
lea rcx, str.J2D_D3D
call fcn.14000f008
test rax, rax
je 0x140005542
lea rdx, str.false
mov rcx, rax
call fcn.140018970
neg eax
sbb ecx, ecx
and dword [0x14003a040], ecx
lea rcx, str.J2D_D3D_PRELOAD
call fcn.14000f008
mov rdi, rax
test rax, rax
je 0x140005577
lea rdx, str.false
mov rcx, rax
call fcn.140018970
neg eax
sbb ecx, ecx
and ecx, dword [0x14003a040]
mov dword [0x14003a040], ecx
jmp 0x14000557d
mov ecx, dword [0x14003a040]
test ecx, ecx
jns 0x1400055b4
and dword [0x14003a040], 0
test rdi, rdi
je 0x1400055c2
lea rdx, str.true
mov rcx, rdi
call fcn.140018970
mov ecx, dword [0x14003a040]
test eax, eax
mov edx, 1
cmove ecx, edx
mov dword [0x14003a040], ecx
test ecx, ecx
je 0x1400055c2
lea rcx, str.preloadD3D
call fcn.14000532c
test rbx, rbx
je 0x1400055ec
or edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400055f5
mov rcx, rsi
call rbp
mov dword [rsp + 0x68], eax
cmp dword [0x14003ad48], 0
je 0x14000560c
mov rax, qword [0x14003ad70]
test rax, rax
je 0x14000560c
call rax
mov eax, dword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140006550
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x40
lea rax, [r11 - 0x18]
mov ebx, r9d
mov rbp, r8
mov qword [r11 - 0x20], rax
and qword [r11 - 0x28], 0
lea r9, [r11 - 0x14]
xor r8d, r8d
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400065c3
cmp dword [rsp + 0x34], 1
jne 0x1400065c3
cmp dword [rsp + 0x30], ebx
jae 0x1400065c3
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbp
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete al
jmp 0x1400065c5
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret