joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140060ae0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140060b08
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140060b2e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140060b30
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140060b89
test ecx, ecx
jle 0x140060b69
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140060b89
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140060b89
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140060bb0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140060bd2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140060be8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140060c04
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140060c06
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140060c42
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140060cde
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140060c7d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140060cbe
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140060cde
cmp rbx, rax
ja 0x140060c90
test rbx, rbx
je 0x140060cde
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140061140
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400ae0c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14006116d
xor eax, eax
jmp 0x1400612d9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400611a7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400611a7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400612d9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400612cc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400611ea
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140061215
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400612d1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140061284
sub eax, 1
je 0x140061284
cmp eax, 2
jne 0x1400612cc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400612d1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400612b2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400612cc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400612d1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140088880
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret

Function at 0x140061d80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140061db4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [rdx + r9]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140061da0
ret
Function at 0x140064090
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400ae0c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140064163
cmp byte [rcx + 0x71], 0
je 0x140064163
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14006415f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140064124
sub eax, 1
je 0x140064128
cmp eax, 2
jne 0x14006415f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140088880
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140064156
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14006415f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14006410c
xor al, al
jmp 0x14006410c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140088880
add rsp, 0x60
pop rbx
ret
Function at 0x140080a80
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x140080b45
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x140080b45
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x140080b5e
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx + 0x10]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx]
cmp rcx, rax
je 0x140080b35
cmp byte [rcx], 0x5c
jne 0x140080b2e
lea rdx, [rcx + 1]
cmp rdx, rax
je 0x140080b2e
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x140080b1c
movzx eax, byte [rdx]
sub al, 0x28
cmp al, 1
jbe 0x140080b2b
test r8b, 0x10
jne 0x140080b2e
movzx eax, byte [rdx]
sub al, 0x7b
test al, 0xfd
jne 0x140080b2e
mov rcx, rdx
lea rax, [rcx + 1]
mov qword [rbx], rax
mov rcx, rbx
call fcn.14007a3a0
test edi, edi
jne 0x140080aa0
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.14007a390
int3

Function at 0x1400859a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x1400ae0c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rcx
mov rcx, qword [0x1400e07f0]
mov rax, qword [rcx + 8]
cmp byte [rax + 0x19], 0
jne 0x1400859e8
nop dword [rax]
cmp dword [rax + 0x20], 4
jge 0x1400859dc
mov rax, qword [rax + 0x10]
jmp 0x1400859e2
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1400859d0
cmp byte [rcx + 0x19], 0
jne 0x140085ac4
cmp dword [rcx + 0x20], 4
jg 0x140085ac4
lea r8, [rcx + 0x28]
mov r10, qword [r8 + 0x10]
mov rdx, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x140085a11
mov rdx, qword [r8]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r10, r10
je 0x140085a43
movabs r11, 0x100000001b3
nop dword [rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r11
inc rcx
cmp rcx, r10
jb 0x140085a30
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140085370
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140085a7e
cmp rcx, qword [rbx + 8]
je 0x140085a7e
cmp qword [rbx + 0x10], 1
jne 0x140085a82
mov al, 1
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140088880
add rsp, 0x80
pop rbx
ret
xor al, al
jmp 0x140085a68
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.140085af0
nop
mov r8, rax
lea rdx, str.AcceptEncoding_does_not_accept_any_other_values_if_disabled_is_present._You_set_the_following_encodings:
lea rcx, [rsp + 0x58]
call fcn.140067c20
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140085940
lea rdx, [0x1400aa0b0]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea rcx, str.invalid_map_K__T__key
call sub.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_
int3
Function at 0x140089874
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400898be
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400898be
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400898be
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400898be
cmp dword [rcx + 0x84], 0xe
jbe 0x1400898be
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400898c0
xor al, al
add rsp, 0x28
ret
Function at 0x14008a788
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.140089ca0
mov ebx, eax
test eax, eax
jne 0x14008a7b8
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x14008a81b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14008a812
test al, 0x10
je 0x14008a812
bt eax, 0xa
jae 0x14008a80b
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.14008a838
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x14008a807
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14008a807
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
test edi, edi
jne 0x14008a812
and dword [rsp + 0x3c], 0
jmp 0x14008a817
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14008abdc
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14008ac16
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14008ac1b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14008ac64
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140092110]
cmp byte [rcx + rax], 0
je 0x14008ac64
dec r8
sub rdx, 1
jne 0x14008ac4a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140008550
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
sub rsp, 0x98
mov rax, qword [0x140041010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rcx, qword [0x140042fb8]
cmp dword [rcx + 0x12cc310], 1
jne 0x140008720
mov r9d, 0xa
mov qword [r11 - 8], rdi
add rcx, 0x12cb2e0
mov qword [r11 + 8], rbx
lea rdx, str.K_0_0_c_c
lea r8d, [r9 + 3]
call fcn.1400010b0
mov rdx, qword [0x140042fb8]
xor edi, edi
cmp dword [rdx + 0x12cc310], 1
jne 0x1400085f8
mov rbx, qword [rdx + 0x1436750]
cmp dword [rbx + 8], 1
je 0x1400085f8
add rdx, 0x12cb2e0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], dil
jne 0x1400085d2
mov rcx, qword [rbx + 0xe00028]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rbx + 0xe00020], edi
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 0x1f4
call fcn.14000b5a0
movsxd r8, eax
test eax, eax
je 0x140008710
mov rbx, qword [0x140042fb8]
mov edx, edi
mov rcx, qword [rbx + 0x1436750]
jle 0x140008659
mov r9d, dword [rcx + 0xe00018]
mov eax, dword [rcx + 0xe0001c]
cmp r9d, eax
je 0x140008659
inc eax
mov dword [rcx + 0xe0001c], eax
cmp eax, 0x700000
jb 0x140008652
mov dword [rcx + 0xe0001c], edi
inc edx
cmp edx, r8d
jl 0x140008632
xorps xmm0, xmm0
mov byte [r8 + rbx + 0xbb12e0], dil
movups xmmword [rsp + 0x60], xmm0
lea r11, [rbx + 0xbb12e6]
mov r10, rdi
movups xmmword [rsp + 0x70], xmm0
nop dword [rax + rax]
mov r8d, edi
mov r9d, edi
mov rax, rdi
nop dword [rax]
movzx edx, byte [rax + r11]
lea ecx, [rdx - 0x30]
cmp cl, 9
ja 0x1400086aa
movsx ecx, cl
lea edx, [r8 + r8*4]
lea r8d, [rcx + rdx*2]
jmp 0x1400086b5
cmp dl, 0x2d
jne 0x1400086c0
mov r9d, 1
inc rax
cmp rax, 0x10
jl 0x140008690
jmp 0x1400086c8
cmp dl, 0x2c
jne 0x1400086c8
inc rax
add r11, rax
mov eax, r8d
neg eax
cmp r9d, 1
movzx ecx, byte [r11]
cmovne eax, r8d
mov dword [rsp + r10*4 + 0x40], eax
lea eax, [rcx - 0x30]
cmp al, 9
jbe 0x1400086f0
sub cl, 0x2c
cmp cl, 1
ja 0x1400086fc
inc r10
cmp r10, 0x1000
jl 0x140008680
cmp dword [rsp + 0x6c], 0x128e0
jl 0x140008710
mov eax, dword [rsp + 0x70]
mov dword [rbx + 0x14366e0], eax
mov rbx, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400137d0
add rsp, 0x98
ret
Function at 0x140009000
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xa0
movaps xmmword [rsp + 0x90], xmm6
mov rax, qword [0x140041010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r9, qword [0x140042fb8]
lea rdx, str.RAMP__d__d_r_n
movsd xmm6, qword [0x14003ccc0]
movsd xmm0, qword [r9 + 0x18]
lea rcx, [r9 + 0x12cb2e0]
mov r9d, dword [r9 + 0x50]
mulsd xmm0, xmm6
cvttsd2si r8d, xmm0
call fcn.1400010b0
mov rdx, qword [0x140042fb8]
xor edi, edi
cmp dword [rdx + 0x12cc310], 1
jne 0x1400090b6
mov rbx, qword [rdx + 0x1436750]
cmp dword [rbx + 8], 1
je 0x1400090b6
add rdx, 0x12cb2e0
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], dil
jne 0x140009090
mov rcx, qword [rbx + 0xe00028]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rbx + 0xe00020], edi
mov r8d, 0x1f4
call fcn.14000b5a0
movsxd r8, eax
test eax, eax
jg 0x1400090d2
mov eax, 0xffffffff
jmp 0x140009200
mov rbx, qword [0x140042fb8]
mov edx, edi
mov byte [r8 + rbx + 0xbb12e0], dil
mov rcx, qword [rbx + 0x1436750]
mov r9d, dword [rcx + 0xe00018]
mov eax, dword [rcx + 0xe0001c]
cmp r9d, eax
je 0x140009118
inc eax
mov dword [rcx + 0xe0001c], eax
cmp eax, 0x700000
jb 0x140009111
mov dword [rcx + 0xe0001c], edi
inc edx
cmp edx, r8d
jl 0x1400090f1
xorps xmm0, xmm0
lea r11, [rbx + 0xbb12e5]
movups xmmword [rsp + 0x40], xmm0
mov r10, rdi
movups xmmword [rsp + 0x50], xmm0
nop
mov r8d, edi
mov r9d, edi
mov rdx, rdi
nop dword [rax]
movzx ecx, byte [rdx + r11]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x140009159
movsx eax, al
lea ecx, [r8 + r8*4]
lea r8d, [rax + rcx*2]
jmp 0x140009164
cmp cl, 0x2d
jne 0x14000916f
mov r9d, 1
inc rdx
cmp rdx, 0x10
jl 0x140009140
jmp 0x140009177
cmp cl, 0x2c
jne 0x140009177
inc rdx
add r11, rdx
mov eax, r8d
neg eax
cmp r9d, 1
movzx ecx, byte [r11]
cmovne eax, r8d
mov dword [rsp + r10*4 + 0x40], eax
lea eax, [rcx - 0x30]
cmp al, 9
jbe 0x14000919f
sub cl, 0x2c
cmp cl, 1
ja 0x1400091ab
inc r10
cmp r10, 0x1000
jl 0x140009130
movd xmm0, dword [rsp + 0x48]
movd xmm1, dword [rsp + 0x58]
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x4c]
cvtdq2pd xmm0, xmm0
mov dword [rbx + 0x10], eax
xor eax, eax
mov dword [rbx + 0x14], ecx
mov dword [rbx + 0x14366e0], ecx
cvtdq2pd xmm1, xmm1
divsd xmm0, xmm6
divsd xmm1, xmm6
movsd qword [rbx + 0x12cc348], xmm0
movd xmm0, dword [rsp + 0x54]
cvtdq2pd xmm0, xmm0
movsd qword [rbx + 0x12cc318], xmm1
divsd xmm0, xmm6
movsd qword [rbx + 8], xmm0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400137d0
mov rbx, qword [rsp + 0xb0]
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa0
pop rdi
ret
Function at 0x140009230
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xd0
mov rax, qword [0x140041010]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r9d, 0xa
lea rdx, str.DELSAMPLE_0_0_c_c
lea rcx, [rsp + 0x80]
lea r8d, [r9 + 3]
call fcn.1400010b0
mov rdi, qword [0x140042fb8]
xor ebx, ebx
cmp dword [rdi + 0x12cc310], 1
jne 0x1400092ce
mov rdi, qword [rdi + 0x1436750]
cmp dword [rdi + 8], 1
je 0x1400092ce
lea rax, [rsp + 0x80]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], bl
jne 0x1400092a0
mov rcx, qword [rdi + 0xe00028]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rdi + 0xe00020], ebx
call fcn.14000ccb0
mov rcx, qword [0x140042fb8]
test eax, eax
jne 0x1400093e2
mov qword [rsp + 0xe0], rsi
add rcx, 0xbb12e0
movabs rsi, 0x100100002401
mov edx, ebx
nop dword [rax]
movzx eax, byte [rcx]
cmp al, 0x2c
ja 0x14000930d
bt rsi, rax
jb 0x14000931a
inc rcx
inc edx
cmp edx, 0x100
jl 0x140009300
lea rdx, [rsp + 0x38]
mov r8d, ebx
lea rdi, [rcx + 1]
movzx ecx, byte [rdi]
cmp cl, 0x2c
ja 0x140009334
bt rsi, rcx
jb 0x14000934a
mov byte [rdx], cl
inc rdi
inc rdx
inc r8d
cmp r8d, 0x100
jl 0x140009326
jmp 0x14000934c
mov byte [rdx], bl
lea rcx, [rsp + 0x38]
call fcn.14001c420
lea rdx, [rsp + 0x38]
inc rdi
mov r8d, ebx
movzx ecx, byte [rdi]
cmp cl, 0x2c
ja 0x14000936f
bt rsi, rcx
jb 0x140009385
mov byte [rdx], cl
inc rdi
inc rdx
inc r8d
cmp r8d, 0x100
jl 0x140009361
jmp 0x140009387
mov byte [rdx], bl
lea rcx, [rsp + 0x38]
call fcn.14001c420
lea rax, [rsp + 0x58]
sub rdi, rax
lea rcx, [rsp + 0x58]
nop
movzx edx, byte [rdi + rcx + 1]
cmp dl, 0x2c
ja 0x1400093b0
bt rsi, rdx
jb 0x1400093c1
mov byte [rcx], dl
inc ebx
inc rcx
cmp ebx, 0x100
jl 0x1400093a0
jmp 0x1400093c4
mov byte [rcx], 0
lea rcx, [rsp + 0x58]
call fcn.14001c420
mov rcx, qword [0x140042fb8]
mov rsi, qword [rsp + 0xe0]
mov dword [rcx + 0x6c], eax
jmp 0x1400093f0
mov eax, dword [rcx + 0x12cc3d4]
test eax, eax
cmovg ebx, eax
mov dword [rcx + 0x6c], ebx
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400137d0
mov rbx, qword [rsp + 0xe8]
add rsp, 0xd0
pop rdi
ret
Function at 0x1400097e0
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x1a0
mov rax, qword [0x140041010]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rax, qword [0x140042fb8]
lea rcx, [rsp + 0x70]
mov dword [rax + 0x12cc38c], 0
call fcn.14001b58c
lea rcx, [rsp + 0x70]
call fcn.14001b8f8
mov r8, qword [0x140042fb8]
mov rbx, rax
movups xmm0, xmmword [rax]
cmp dword [r8 + 0x12cc374], 0
movups xmmword [r8 + 0x14366f0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r8 + 0x1436700], xmm1
mov ecx, dword [rax + 0x20]
mov dword [r8 + 0x1436710], ecx
je 0x1400099ff
add r8, 0xbb0be0
lea rdx, str._sLogFile
lea rcx, [rsp + 0x90]
call fcn.1400010b0
lea rcx, [rsp + 0x90]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
cmp eax, 1
je 0x140009897
xor edx, edx
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rax, qword [0x140042fb8]
cmp dword [rax + 0x12cc3b4], 0
jne 0x140009907
cmp dword [rax + 0x12cc378], 2
jne 0x140009907
mov edx, dword [rbx + 0x10]
lea rcx, [rax + 0xbb0ce0]
mov eax, dword [rbx]
lea r8, [rsp + 0x90]
mov r9d, dword [rbx + 0x14]
inc edx
mov dword [rsp + 0x48], 0x2e
add r9d, 0x76c
mov dword [rsp + 0x40], eax
mov eax, dword [rbx + 4]
mov dword [rsp + 0x38], eax
mov eax, dword [rbx + 8]
mov dword [rsp + 0x30], eax
mov eax, dword [rbx + 0xc]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edx
lea rdx, str._slog__04d__02d_02d__02d_02d_02d_RAW_cbin
call fcn.1400010b0
jmp 0x1400099ac
cmp dword [rax + 0x1436718], 1
lea rcx, [0x14003b7f8]
lea rdx, [0x14003b7f4]
cmovne rdx, rcx
lea rcx, [rsp + 0x78]
call fcn.1400010b0
mov rax, qword [0x140042fb8]
lea r10, [rsp + 0x78]
mov r8d, dword [rbx + 0x10]
mov r9d, dword [rbx + 0x14]
inc r8d
mov dword [rsp + 0x60], 0x2e
add r9d, 0x76c
movsd xmm0, qword [rax + 0x18]
lea rcx, [rax + 0xbb0ce0]
mov eax, dword [rax + 0x5c]
mulsd xmm0, qword [0x14003ccc0]
mov qword [rsp + 0x58], r10
mov dword [rsp + 0x50], eax
mov eax, dword [rbx]
cvttsd2si edx, xmm0
mov dword [rsp + 0x48], edx
lea rdx, str._slog__04d__02d_02d__02d_02d_02d_R_05d_Th_02d__s_ccsv
mov dword [rsp + 0x40], eax
mov eax, dword [rbx + 4]
mov dword [rsp + 0x38], eax
mov eax, dword [rbx + 8]
mov dword [rsp + 0x30], eax
mov eax, dword [rbx + 0xc]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r8d
lea r8, [rsp + 0x90]
call fcn.1400010b0
mov rax, qword [0x140042fb8]
xorps xmm0, xmm0
mov dword [rax + 0x14366ec], 1
movups xmmword [rax + 0xbb0b50], xmm0
movups xmmword [rax + 0xbb0b60], xmm0
movups xmmword [rax + 0xbb0b70], xmm0
movups xmmword [rax + 0xbb0b80], xmm0
movups xmmword [rax + 0xbb0b90], xmm0
movups xmmword [rax + 0xbb0ba0], xmm0
movups xmmword [rax + 0xbb0bb0], xmm0
movups xmmword [rax + 0xbb0bc0], xmm0
movups xmmword [rax + 0xbb0bd0], xmm0
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400137d0
add rsp, 0x1a0
pop rbx
ret
Function at 0x14000cd80
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x48
mov rax, qword [0x140041010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r8, qword [0x140042fb8]
cmp dword [r8 + 0x14367cc], 0
je 0x14000ce44
lea rcx, [r8 + 0x12cb2e0]
mov dword [rsp + 0x20], 0xa
mov r8d, dword [r8 + 0x14367c8]
lea rdx, str.AVERAGE__d_c_c
mov r9d, InitCommonControls
call fcn.1400010b0
mov rdx, qword [0x140042fb8]
cmp dword [rdx + 0x12cc310], 1
jne 0x14000ce34
mov qword [rsp + 0x40], rbx
mov rbx, qword [rdx + 0x1436750]
cmp dword [rbx + 8], 1
je 0x14000ce2f
add rdx, 0x12cb2e0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x14000ce00
mov rcx, qword [rbx + 0xe00028]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rbx + 0xe00020], 0
mov rbx, qword [rsp + 0x40]
call fcn.14000ccb0
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400137d0
add rsp, 0x48
ret