joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004d060
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x18004d082
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x18004d098
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x18004d0b4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18004d0b6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18004d0f2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x18004d18e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x18004d12d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x18004d16e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x18004d18e
cmp rbx, rax
ja 0x18004d140
test rbx, rbx
je 0x18004d18e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x18004d5c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x18007a020]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18004d5ed
xor eax, eax
jmp 0x18004d74a
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x18004d618
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x18004d618
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x18004d74a
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x18004d73d
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x18004d65b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x18004d686
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18004d742
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18004d6f5
sub eax, 1
je 0x18004d6f5
cmp eax, 2
jne 0x18004d73d
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18004d742
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x18004d723
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x18004d73d
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x18004d742
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180060ca0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x18004eb90
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x18007a020]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x18004ec63
cmp byte [rcx + 0x71], 0
je 0x18004ec63
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18004ec5f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18004ec24
sub eax, 1
je 0x18004ec28
cmp eax, 2
jne 0x18004ec5f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180060ca0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x18004ec56
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x18004ec5f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18004ec0c
xor al, al
jmp 0x18004ec0c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180060ca0
add rsp, 0x60
pop rbx
ret

Function at 0x18005ce80
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.18005d0a0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x18005cf87
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x18005cee4
mov rax, qword [0x18007a008]
cmp qword [rsp + 0x20], rax
ja 0x18005cee4
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18005cea6
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18005cf13
jmp 0x18005cf87
cmp dword [rsp + 0x50], 0x10000
jne 0x18005cf6a
cmp qword [rsp + 0x48], 0x10000
jb 0x18005cf6a
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18005cf58
mov rax, qword [rsp + 0x28]
jmp 0x18005cf89
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18005cf82
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.18005d0a0
mov qword [rsp + 0x20], rax
jmp 0x18005cea6
xor eax, eax
add rsp, 0x68
ret
Function at 0x18005cf90
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.18005d0e0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x18005d093
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x18005cfeb
mov rax, qword [0x18007a008]
cmp qword [rsp + 0x20], rax
ja 0x18005cfeb
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18005cfad
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18005d01a
jmp 0x18005d093
cmp dword [rsp + 0x50], 0x10000
jne 0x18005d071
cmp qword [rsp + 0x48], 0x10000
jb 0x18005d071
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18005d05f
mov rax, qword [rsp + 0x28]
jmp 0x18005d095
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18005d08e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.18005d0e0
mov qword [rsp + 0x20], rax
jmp 0x18005cfad
xor eax, eax
add rsp, 0x68
ret
Function at 0x18005d130
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.18005d6c0
mov qword [rsp + 0x28], 0
cmp qword [0x1800a3908], 0
jne 0x18005d178
cmp qword [0x1800a3900], 0
je 0x18005d178
mov rax, qword [0x1800a3900]
mov qword [0x1800a3908], rax
cmp qword [0x1800a3908], 0
je 0x18005d21e
mov rax, qword [0x1800a3908]
cmp qword [rax + 0x10], 0
je 0x18005d21e
mov rax, qword [0x1800a3908]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18005d21e
mov rax, qword [0x1800a3908]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18005d21e
mov rax, qword [0x1800a3908]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x18005d1e4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x18005d1eb
xor eax, eax
jmp 0x18005d399
mov rax, qword [0x1800a3908]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x18005d399
mov rax, qword [0x1800a3900]
mov qword [0x1800a3908], rax
jmp 0x18005d240
mov rax, qword [0x1800a3908]
mov rax, qword [rax + 8]
mov qword [0x1800a3908], rax
cmp qword [0x1800a3908], 0
je 0x18005d28d
cmp qword [0x1800a3908], 0
je 0x18005d28b
mov rax, qword [0x1800a3908]
cmp qword [rax + 0x10], 0
je 0x18005d28b
mov rax, qword [0x1800a3908]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18005d28b
mov rax, qword [0x1800a3908]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18005d28b
jmp 0x18005d1bc
jmp 0x18005d22e
mov rcx, qword [rsp + 0x60]
call fcn.18005f2f0
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.18005d3a0
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x18005d397
mov rax, qword [rsp + 0x48]
mov qword [0x1800a3908], rax
mov rax, qword [0x1800a3908]
mov dword [rax], 0x52727464
mov rax, qword [0x1800a3908]
mov qword [rax + 0x10], 0
mov rax, qword [0x1800a3908]
mov rcx, qword [0x1800a3900]
mov qword [rax + 8], rcx
mov rax, qword [0x1800a3908]
mov qword [0x1800a3900], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x1800a3908]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x18005d348
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x18005d382
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x18005d33e
mov rax, qword [0x1800a3908]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x18005d1bc
xor eax, eax
add rsp, 0x58
ret
Function at 0x1800606ec
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x180060770
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x180065830]
cmp byte [rcx + rax], 0
je 0x180060770
dec r8
sub rdx, 1
jne 0x180060756
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x1400198e3
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140188028]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rcx, rdx
call fcn.140065480
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp ebp, eax
je 0x140019932
mov rcx, rdi
call fcn.14001e466
mov ebp, 0x100000
test al, al
je 0x140019937
mov ebp, 0x101000
lea r14, [rsp + 0x50]
mov r8d, 0xa0
mov rcx, r14
mov dl, 0xaa
call fcn.1400a48c0
mov rcx, r14
call fcn.1400675d0
mov byte [r14 + 0x22], 1
lea rcx, [rsp + 0x58]
call fcn.1400663c0
movaps xmm0, xmmword [0x140158be0]
lea r15, [rsp + 0x40]
movaps xmmword [r15], xmm0
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.1400654f0
mov rcx, r15
call fcn.140041650
test al, al
je 0x140019a19
lea rbx, [rsp + 0x38]
mov qword [rbx], 0
mov rcx, rdi
call fcn.140065460
mov r14, rax
lea rcx, [rsp + 0x40]
call fcn.140065460
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edi, edi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebp
mov rcx, rax
mov rdx, r15
mov r8, r14
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x140019a19
mov r14, qword [rsp + 0x38]
cmp qword [rsi], r14
je 0x140019a35
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140019a6b
lea rax, [r14 + 1]
cmp rax, 2
jb 0x140019a0f
mov qword [rsi], r14
call fcn.140045930
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140019a35
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov edi, 0x80004005
cmovne edi, ecx
lea rcx, [rsp + 0x40]
call fcn.140041620
lea rcx, [rsp + 0x50]
call fcn.140067640
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1400a2770
mov eax, edi
add rsp, 0xf8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140045930
mov rcx, qword [rsi]
call fcn.1400414f0
mov qword [rsi], 0
jmp 0x1400199fd
Function at 0x14001a4c3
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x110
movaps xmmword [rsp + 0x100], xmm6
mov rbx, r9
mov r14, r8
mov rdi, rdx
mov r15, rcx
mov esi, dword [rsp + 0x180]
mov rax, qword [0x140188028]
xor rax, rsp
mov qword [rsp + 0xf8], rax
movaps xmm6, xmmword [0x140158be0]
lea rcx, [rsp + 0xe0]
movaps xmmword [rcx], xmm6
xor edx, edx
call fcn.14009eed0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, esi
je 0x14001a53f
lea rdx, [rsp + 0xe0]
mov ecx, esi
call fcn.140019100
test eax, eax
jns 0x14001a564
mov esi, eax
jmp 0x14001a6e8
lea rsi, [rsp + 0x50]
mov rcx, rsi
call fcn.14009c2e0
lea rcx, [rsp + 0xe0]
mov rdx, rsi
call fcn.140065410
mov rcx, rsi
call fcn.140041620
mov rsi, qword [rsp + 0x170]
movabs r13, 0xaaaaaaaaaaaaaaaa
lea r12, [rsp + 0xc0]
mov qword [r12 + 0x10], r13
movaps xmmword [r12], xmm6
mov rcx, r12
call fcn.14010b3d0
mov qword [rsp + 0x20], r12
mov rcx, r15
mov rdx, r14
mov r8, rbx
mov r9, rsi
call fcn.1400194f0
test eax, eax
js 0x14001a729
mov rsi, qword [rsp + 0x178]
lea rbx, [rsp + 0xa0]
mov qword [rbx + 0x10], r13
movaps xmmword [rbx], xmm6
lea rcx, [rsp + 0xc0]
call fcn.1400e09f0
mov rcx, rax
mov rdx, rbx
mov r8, rsi
call fcn.140069e90
lea rsi, [rsp + 0x50]
movaps xmmword [rsi + 0x40], xmm6
movaps xmmword [rsi + 0x30], xmm6
movaps xmmword [rsi + 0x20], xmm6
movaps xmmword [rsi + 0x10], xmm6
movaps xmmword [rsi], xmm6
mov rcx, rsi
mov rdx, rbx
call fcn.14006a940
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
call fcn.14010bce0
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea rdx, [rsp + 0xe0]
mov rcx, rsi
call fcn.1400198e3
mov esi, eax
test eax, eax
js 0x14001a722
mov rbx, qword [rsp + 0x188]
lea rcx, [rsp + 0xc0]
lea rdi, [rsp + 0x30]
mov rdx, rdi
call fcn.14010b3e0
mov rcx, rdi
call fcn.140019d5a
mov rcx, rdi
call fcn.140045cb0
mov r14, qword [rsp + 0x48]
lea r15, [r14 + 1]
cmp r15, 2
jb 0x14001a678
call fcn.140045930
cmp qword [rbx], r14
je 0x14001a6ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rbx]
inc rax
cmp rax, 2
jae 0x14001a72d
cmp r15, 2
jb 0x14001a6a3
mov qword [rbx], r14
call fcn.140045930
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14001a6c4
call fcn.140045930
mov rcx, rdi
call fcn.1400414f0
lea rcx, [rsp + 0x50]
call fcn.14006ab80
lea rcx, [rsp + 0xa0]
call fcn.140045cb0
lea rcx, [rsp + 0xc0]
call fcn.14010b4c0
lea rcx, [rsp + 0xe0]
call fcn.140041620
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.1400a2770
mov eax, esi
movaps xmm6, xmmword [rsp + 0x100]
add rsp, 0x110
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rdi, qword [rsp + 0x48]
jmp 0x14001a6ad
mov esi, eax
jmp 0x14001a6db
call fcn.140045930
mov rcx, qword [rbx]
call fcn.1400414f0
mov qword [rbx], 0
jmp 0x14001a695
Function at 0x140041480
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x1400414c8
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x1400414d1
lea rax, [rsi + 1]
cmp rax, 2
jb 0x1400414b8
mov qword [rdi], rsi
call fcn.140045930
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.140045930
mov rcx, qword [rdi]
call fcn.1400414f0
mov qword [rdi], 0
jmp 0x1400414a6
Function at 0x140048220
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.1400417d0
mov qword [rsi], 0
test rax, rax
je 0x140048273
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400482a7
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14004826b
mov qword [rsi], rbx
call fcn.140045930
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
lea rdx, [rdi + 8]
call fcn.140045a60
lea rcx, [rsi + 0x20]
call fcn.14004dd10
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
mov al, byte [rdi + 0x28]
mov byte [rsi + 0x28], al
mov al, byte [rdi + 0x29]
mov byte [rsi + 0x29], al
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
call fcn.140045930
mov rcx, qword [rsi]
call fcn.1400414f0
mov qword [rsi], 0
jmp 0x140048259
Function at 0x14004b7a0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
movapd xmmword [rsp + 0x40], xmm6
mov rsi, rcx
mov rax, qword [0x140188028]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
call fcn.14004d800
mov qword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
movsd xmm0, qword [0x1401a13f8]
xorpd xmm6, xmm6
ucomisd xmm0, xmm6
jne 0x14004b7fe
jnp 0x14004b864
ucomisd xmm0, xmm6
jne 0x14004b806
jnp 0x14004b860
movsd xmm1, qword [rsp + 0x28]
unpcklps xmm1, xmmword [0x14015ce80]
subpd xmm1, xmmword [0x14015ce90]
movapd xmm2, xmm1
unpckhpd xmm2, xmm1
addsd xmm2, xmm1
divsd xmm2, xmm0
mulsd xmm2, qword [0x140166be0]
cvttsd2si rax, xmm2
mov qword [rsi], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400a2770
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x14004b838
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov edi, eax
call rbx
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x1401a1408]
mov ecx, dword [0x140197c60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14004b981
mov eax, dword [0x1401a1418]
mov ecx, dword [0x140197c60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14004b9bb
rdtsc
mov rbx, rax
mov r14, rdx
xor r12d, r12d
lea r15, [rsp + 0x30]
mov qword [r15], r12
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r13, qword [r15]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [r15], r12
lea rdi, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub r13, qword [0x1401a1410]
cvtsi2sd xmm1, r13
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rdi]
divsd xmm1, xmm0
xorpd xmm0, xmm0
movsd xmm2, qword [0x140166bd8]
ucomisd xmm2, xmm1
ja 0x14004b7fe
shl r14, 0x20
or rbx, r14
sub rbx, qword [0x1401a1400]
movq xmm2, rbx
punpckldq xmm2, xmmword [0x14015ce80]
subpd xmm2, xmmword [0x14015ce90]
movapd xmm0, xmm2
unpckhpd xmm0, xmm2
addsd xmm0, xmm2
divsd xmm0, xmm1
movsd qword [0x1401a13f8], xmm0
jmp 0x14004b7fe
lea rcx, [0x1401a1408]
call fcn.1400a1410
cmp dword [0x1401a1408], 0xffffffff
jne 0x14004b8ad
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x1401a1400], rdx
lea rcx, [0x1401a1408]
call fcn.1400a14a8
jmp 0x14004b8ad
lea rcx, [0x1401a1418]
call fcn.1400a1410
cmp dword [0x1401a1418], 0xffffffff
jne 0x14004b8d2
lea rbx, [rsp + 0x30]
mov qword [rbx], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
mov qword [0x1401a1410], rax
lea rcx, [0x1401a1418]
call fcn.1400a14a8
jmp 0x14004b8d2