joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a800
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x404543
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.0040a540
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00468a00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x404520
cmp byte [0x00a8d46f], 0
je 0x46a815
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x467a40
jmp 0x404520

Function at 0x46a820
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00a8d8a0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x00a8d46f], 0
je 0x46a855
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00a8dbc0]
aesenc xmm0, xmmword [0x00a8dbd0]
aesenc xmm0, xmmword [0x00a8dbe0]
movq rax, xmm0
ret
jmp 0x40a760

Function at 0x46a860
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00a8d8a0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x00a8d46f], 0
je 0x46a896
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00a8dbc0]
aesenc xmm0, xmmword [0x00a8dbd0]
aesenc xmm0, xmmword [0x00a8dbe0]
movq rax, xmm0
ret
jmp 0x40a7c0

Function at 0x46c660
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x46c694
mov rcx, 0x28
jmp 0x46c69f
shl rcx, 3
add rcx, 0x1480
mov qword [0x00a8d728], rcx
pop rbp
ret
Function at 0x4888e0
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x488b1b
push rbp
mov rbp, rsp
sub rsp, 0x78
mov ebx, dword [rax + 0x2c]
test ebx, ebx
jne 0x48897a
mov qword [rsp + 0x88], rax
lea rbx, [0x00562180]
mov rcx, rax
lea rax, [0x00a07d60]
call fcn.00482d60
test cl, cl
jne 0x488963
mov rax, qword [rsp + 0x88]
call fcn.00487fe0
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x28]
lea rbx, [0x005a3348]
call fcn.004527e0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rbx
call fcn.00489bc0
mov rcx, qword [rsp + 0x88]
xor edx, edx
jmp 0x488997
lea rdx, [0x0055ec00]
cmp rax, rdx
jne 0x488985
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
call fcn.00466100
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x0053edc0]
call fcn.0040b5c0
inc rdx
cmp rbx, rdx
jle 0x4889e1
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x488994
lea rax, [0x00a07d60]
lea rbx, [0x00562180]
lea rdi, [0x0055ec00]
nop dword [rax + rax]
call fcn.00482f20
lea rdx, [0x0055ec00]
cmp rax, rdx
jne 0x488b0b
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
nop
ret
lea rcx, [0x005351a0]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], 0
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x58], rcx
lea rax, [0x005476e0]
call fcn.0040e8c0
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
cmp dword [0x00a8d7e0], 0
nop
je 0x488a3b
mov rbx, rax
lea rax, [0x005476e0]
call fcn.00414440
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
mov rbx, qword [rsp + 0x48]
xor ecx, ecx
xor edi, edi
xor esi, esi
mov r8d, esi
mov rax, qword [rsp + 0x50]
call fcn.00401480
call fcn.004661c0
mov rsi, qword [rsp + 0x70]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x88]
mov edx, dword [rcx + 0x10]
xor eax, eax
jmp 0x488aa2
imul edx, edx, 0x1000193
xor edx, 0x2a
mov eax, 1
test rax, rax
jle 0x488a94
mov dword [rsi + 0x10], edx
cmp dword [0x00a8d7e0], 0
je 0x488ac3
call fcn.0046a940
mov qword [r11], rcx
mov rdx, qword [rsi + 0x30]
mov qword [r11 + 8], rdx
mov qword [rsi + 0x30], rcx
lea rax, [0x00a07d60]
lea rbx, [0x00562180]
lea rdi, [0x0055ec00]
nop dword [rax]
call fcn.00482f20
lea rdx, [0x0055ec00]
cmp rax, rdx
jne 0x488afc
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x0053edc0]
call fcn.0040b5c0
mov rbx, rdx
lea rcx, [0x0053edc0]
call fcn.0040b5c0
nop
mov qword [rsp + 8], rax
call fcn.00468a00
mov rax, qword [rsp + 8]
jmp fcn.004888e0
Function at 0x496980
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x496a4a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.004039e0
xorps xmm15, xmm15
mov r14, qword [0x00a8d728]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x496a2f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00539220]
xor ebx, ebx
mov rcx, rdx
call fcn.0044ea20
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.00497ae0
inc rbx
cmp rcx, rbx
jae 0x496a1e
mov edi, 1
lea rsi, [0x00539220]
call fcn.0044eb00
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x005a5748]
lea rsi, [0x005a45b8]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00468a00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00496980
Function at 0x4d0620
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d0d5f
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x4d064d
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x4d08d1
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x4d08fd
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x005a8480]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x00539120]
lea rbx, [0x005a5520]
call fcn.00437d60
inc rax
cmp rax, r8
jge 0x4d0922
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x4d0957
lea rdi, [0x005391a0]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x4d0643
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x4d093b
jmp 0x4d0910
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00468a00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004d0620

Function at 0x4d0f00
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4d0f17
inc rax
cmp rax, 4
jge 0x4d0f2f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4d0f14
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4d0f40
inc rax
cmp rax, 4
jge 0x4d0f4e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4d0f77
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4d0f5b
jmp 0x4d0f3d
Function at 0x50a3a0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x50a475
movdqa xmm0, xmmword [0x005a4b40]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x50a3e1
movdqa xmm0, xmmword [0x005a4b50]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x50a4f7
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x50a4cb
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x005a4598]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x005a4b60]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x5210a0
Capabilities:
Persist via run registry key

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5211fe
push rbp
mov rbp, rsp
sub rsp, 0x78
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x88], rax
mov ecx, 0x31
mov edi, 0xf003f
mov eax, 0x80000001
lea rbx, [0x005768b2]
call fcn.00508e60
mov qword [rsp + 0x30], rax
test rcx, rcx
je 0x52114e
movups xmmword [rsp + 0x48], xmm15
je 0x5210f3
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
lea rdx, [0x00521280]
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x70], 1
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x60], rdx
mov rax, qword [0x00a07268]
xor ebx, ebx
mov ecx, 2
lea rdi, [rsp + 0x58]
call fcn.004c5d40
mov rax, qword [rsp + 0x30]
nop
lea rbx, [0x0056c944]
mov ecx, 0xf
mov edi, 1
mov rsi, qword [rsp + 0x88]
mov r8, qword [rsp + 0x90]
call fcn.00509620
test rax, rax
jne 0x5211f2
mov rax, qword [rsp + 0x30]
nop
call fcn.00498240
test rax, rax
je 0x5211ec
movups xmmword [rsp + 0x38], xmm15
je 0x521196
mov rax, qword [rax + 8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
lea rdx, [0x00521220]
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x70], 1
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x60], rdx
mov rax, qword [0x00a07268]
xor ebx, ebx
mov ecx, 2
lea rdi, [rsp + 0x58]
call fcn.004c5d40
add rsp, 0x78
pop rbp
ret
je 0x5211f8
mov rax, qword [rax + 8]
call fcn.00437d60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00468a00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005210a0
Function at 0x140002d50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rdi
cmp dword [0x1400d99a4], 0
lea rdi, [0x1400d99a0]
mov r11d, r8d
mov r9d, edx
mov r10, rcx
jne 0x140002e28
mov qword [rsp + 0x10], rbx
xor edx, edx
mov rbx, rdi
nop dword [rax]
mov r8d, edx
lea rbx, [rbx + 4]
and r8d, 1
mov eax, edx
shr eax, 1
neg r8d
and r8d, 0xedb88320
inc edx
xor r8d, eax
mov eax, r8d
shr r8d, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, r8d
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rbx - 4], eax
cmp edx, 0x100
jb 0x140002d80
mov rbx, qword [rsp + 0x10]
not r11d
mov eax, r11d
test r9d, r9d
jle 0x140002e5e
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
movzx edx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [rdi + rdx*4]
sub r9d, 1
jne 0x140002e40
not eax
pop rdi
ret
movzx r9d, byte [r10]
lea r8, [r10 + 1]
test r9b, r9b
je 0x140002e9f
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x140002e83
cmp byte [r8], r9b
jne 0x140002e83
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rdi + rdx*4]
test r9b, r9b
jne 0x140002e70
not eax
pop rdi
ret
Function at 0x140003080
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
test r8, r8
je 0x140003099
mov qword [r8], 0
lea rdx, [0x140043a18]
call fcn.140002eb0
mov rbx, rax
test rax, rax
jne 0x1400030b8
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor edx, edx
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003178
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140003178
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003178
mov rax, qword [0x1400d9650]
mov rbp, rsi
test rax, rax
je 0x140003115
inc dword [rax + 0x3c8]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140003178
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rbp
je 0x140003165
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1400d9650]
test rax, rax
je 0x14000315a
dec dword [rax + 0x3c8]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140003181
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x140003173
mov qword [rdi], rbp
mov rax, rsi
jmp 0x140003183
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400137b0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x20
mov rdi, qword [0x1400d9650]
xor esi, esi
mov r15, rcx
mov dword [rdi + 0x2d9c], esi
test rcx, rcx
je 0x1400138ca
mov qword [rsp + 0x40], rbx
lea rbx, [rdi + 0x2da0]
mov dword [rdi + 0x2d9c], esi
mov ecx, dword [rbx + 4]
mov qword [rsp + 0x48], rbp
test ecx, ecx
jns 0x14001380a
mov eax, ecx
cdq
sub eax, edx
mov edx, esi
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.1400148b0
mov dword [rbx], esi
cmp dword [rbx + 4], esi
jne 0x14001381e
mov edx, 8
mov rcx, rbx
call fcn.1400148b0
movsxd rcx, dword [rbx]
mov ebp, esi
mov rax, qword [rbx + 8]
mov byte [rcx + rax], sil
inc dword [rbx]
cmp dword [rdi + 0x2db0], esi
jle 0x14001386a
mov qword [rsp + 0x50], r14
mov r14, rsi
nop dword [rax]
mov r9, qword [rdi + 0x2db8]
mov r8, rbx
add r9, r14
mov rcx, rdi
mov rdx, r9
call qword [r9 + 0x20]
inc ebp
add r14, 0x30
cmp ebp, dword [rdi + 0x2db0]
jl 0x140013840
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
cmp qword [rbx + 8], rsi
je 0x140013879
mov esi, dword [rbx]
dec esi
mov rax, qword [rdi + 0x2da8]
lea rdx, [0x140043a1c]
test rax, rax
movsxd rsi, esi
lea rdi, [0x1400d9648]
mov rcx, r15
cmovne rdi, rax
call fcn.140002eb0
mov rbx, rax
test rax, rax
je 0x1400138c5
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
Function at 0x14001fa40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x14001fbf7
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov esi, r9d
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x14001fad6
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.14001f3b0
mov r8d, dword [rbx + 0x80]
mov r9d, esi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.14001e9e0
mov ecx, dword [rbx + 0x84]
test ecx, ecx
jns 0x14001fac7
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [rbx + 0x80]
test eax, eax
cmovg edx, eax
call fcn.140014450
mov dword [rbx + 0x80], 0
jmp 0x14001fbe3
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.14001d900
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rdi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rdi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], esi
movsd xmm0, qword [rdi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], esi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400399f0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x270
mov rbx, rdx
mov r15, rcx
xor r13d, r13d
mov edx, 0x100
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
lea rax, [rsp + 0x70]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140039a50
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x28]
call fcn.14003fd10
nop
mov r8d, 0x1f
lea rdx, str.SoftwareDistributionDownload_
lea rcx, [rsp + 0x28]
call fcn.14003ea80
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x140039af9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140039af4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140039af4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140040ebc
movdqa xmm0, xmmword [0x1400ae2e0]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], r13w
lea rdi, [rbx + 0x10]
mov rdx, rbx
lea r14, [rbx + 0x18]
cmp qword [rbx + 0x18], 7
jbe 0x140039b28
mov rdx, qword [rbx]
lea rbp, [rbx + 0x10]
jmp 0x140039b2b
mov rbp, rdi
mov r8, qword [rdi]
lea rcx, [rsp + 0x48]
call fcn.14003ea80
xorps xmm0, xmm0
movups xmmword [r15], xmm0
mov qword [r15 + 0x10], r13
mov qword [r15 + 0x18], r13
movups xmm0, xmmword [rax]
movups xmmword [r15], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r15 + 0x10], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea r12, [rbx + 0x18]
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x140039bb6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140039bab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140039bab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140040ebc
mov rdi, rbp
mov r12, r14
mov rdx, qword [rbx + 0x18]
cmp rdx, 7
jbe 0x140039bf1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140039bec
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140039c24
mov rcx, r8
call fcn.140040ebc
mov qword [rdi], r13
mov qword [r12], 7
mov word [rbx], r13w
mov rax, r15
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140039c30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
lea r14, [rcx + 0x18]
cmp qword [r14], 7
mov rdi, rcx
mov dword [rsp + 0x60], r15d
jbe 0x140039c61
mov rcx, qword [rcx]
lea rsi, [rdi + 0x18]
jmp 0x140039c64
mov rsi, r14
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 2
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x140039ce5
mov rdx, qword [r14]
cmp rdx, 7
jbe 0x140039cd9
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140039cd1
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140039ddb
mov rcx, r8
call fcn.140040ebc
mov r14, rsi
mov qword [r14], 7
jmp 0x140039dbd
cmp rbp, 0xffffffffffffffff
jne 0x140039d3b
mov rdx, qword [r14]
cmp rdx, 7
jbe 0x140039d2d
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140039d28
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140039ddb
mov rcx, r8
lea rsi, [rdi + 0x18]
call fcn.140040ebc
mov qword [rsi], 7
xor al, al
jmp 0x140039dbf
lea r9, [rsp + 0x60]
mov qword [rsp + 0x68], rbx
mov r8d, 0x1e00
mov qword [rsp + 0x20], r15
lea rdx, [0x1400b50b0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [r14]
test bl, bl
mov rbx, qword [rsp + 0x68]
je 0x140039cee
cmp rdx, 7
jbe 0x140039db6
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140039db1
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140039ddb
mov rcx, r8
lea rsi, [rdi + 0x18]
call fcn.140040ebc
mov qword [rsi], 7
mov al, 1
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov word [rdi], r15w
mov qword [rdi + 0x10], r15
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3