joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001d547
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
call fcn.140001066
cmp qword [rsi], 0
jle 0x14001d5b6
mov r14, rax
mov edi, 0x18
xor ebx, ebx
lea r15, [0x1400a4b48]
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rdi]
mov rdx, r15
call fcn.14000ddcb
test al, al
je 0x14001d5aa
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rdi]
call fcn.14000a731
cmp byte [r14], 0
jne 0x14001d5e1
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rdi]
mov edx, 8
call fcn.140001c2a
inc rbx
add rdi, 0x18
cmp rbx, qword [rsi]
jl 0x14001d571
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14001d5e1
mov rax, qword [rcx]
mov edx, eax
not edx
lea edx, [rdx + rdx*2]
mov ebx, 0xfffffffe
sub ebx, eax
lea edx, [rdx + rax*2]
inc edx
xor edx, ebx
bts rdx, 0x3e
test rax, rdx
je 0x14001d5ed
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov edx, 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.1400011a3
Function at 0x14001e665
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.140001066
mov rdi, rax
mov rcx, qword [rsi + 0x10]
lea rdx, [0x1400a72e8]
call fcn.14000ddcb
test al, al
je 0x14001e698
mov rcx, qword [rsi + 0x10]
call fcn.14000d914
cmp byte [rdi], 0
je 0x14001e69f
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, qword [rsi + 0x10]
mov edx, 8
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140001c2a

Function at 0x14001e6b3
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov rdi, rcx
call fcn.140001066
mov r14, rax
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
mov rsi, qword [rdi + 0x10]
mov rax, qword [rbx + 0x10]
mov qword [rdi + 0x10], rax
lea rdx, [0x1400a72e8]
mov rcx, rsi
call fcn.14000ddcb
test al, al
je 0x14001e6fd
mov rcx, rsi
call fcn.14000d914
cmp byte [r14], 0
je 0x14001e707
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edx, 8
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140001c2a

Function at 0x14001e780
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov rdi, rcx
call fcn.140001066
mov r14, rax
mov rsi, qword [rdi]
mov qword [rdi], rbx
mov rcx, rsi
call fcn.14000e246
test al, al
je 0x14001e7b7
mov rcx, rsi
call fcn.14000d914
cmp byte [r14], 0
je 0x14001e7c1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edx, 8
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140001c2a
Function at 0x14001fe6a
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
call fcn.140001208
mov rdi, rax
call fcn.140001066
mov rsi, rax
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x14001fe8e
call fcn.14001feb2
cmp byte [rsi], 0
je 0x14001fea7
mov byte [rsi], 0
call fcn.140013124
cmp byte [rsi], 0
je 0x14001fea7
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3

Function at 0x140020052
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.140001066
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x140020074
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x14002009e
push rsi
sub rsp, 0x20
mov rax, rdx
mov rsi, rcx
mov edx, 1
mov rcx, rax
mov r9, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp fcn.140091350

Function at 0x140020074
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.140001066
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x140020074
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x14002009e
push rsi
sub rsp, 0x20
mov rax, rdx
mov rsi, rcx
mov edx, 1
mov rcx, rax
mov r9, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp fcn.140091350

Function at 0x14002009e
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.140001066
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x140020074
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x14002009e
push rsi
sub rsp, 0x20
mov rax, rdx
mov rsi, rcx
mov edx, 1
mov rcx, rax
mov r9, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp fcn.140091350

Function at 0x140020186
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.140004303
test al, al
je 0x1400201a4
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp fcn.140001be7
nop
add rsp, 0x20
pop rsi
ret

Function at 0x14002085a
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.140001066
mov rdi, rax
mov rcx, rsi
call fcn.140004303
test al, al
je 0x140020884
mov rcx, rsi
call fcn.140004340
cmp byte [rdi], 0
je 0x14002088b
add rsp, 0x28
pop rdi
pop rsi
ret
mov edx, 8
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140001c2a
Function at 0x1400244c5
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
lea rdx, [0x14009ce00]
mov rcx, rax
call fcn.140001ada
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.1400132b3
mov rsi, rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rdx, rsi
call fcn.140001ada
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xc1
jne 0x140024530
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
lea rdx, [0x14009ce20]
mov rcx, rax
call fcn.140001ada
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
lea rdx, [0x14009ce60]
mov rcx, rax
call fcn.140001ada
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
Function at 0x14002487e
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
lea rdx, [0x14009ce80]
mov rcx, rax
call fcn.140001ada
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rdx, rsi
call fcn.140001ada
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
lea rdx, [0x14009ce60]
mov rcx, rax
call fcn.140001ada
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
Function at 0x140024f19
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov r13, rdx
mov rsi, rcx
call fcn.140001066
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
movups xmm0, xmmword [r13]
lea rcx, [rsp + 0x20]
movaps xmmword [rcx], xmm0
lea rdx, [0x140092f70]
call fcn.140022b34
cmp byte [rbx], 0
je 0x140024f6c
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test al, al
je 0x140024f81
movups xmm0, xmmword [0x140092f40]
movups xmmword [rsi], xmm0
movaps xmmword [rsp + 0x20], xmm0
jmp 0x140024f9d
mov rbp, qword [r13]
movups xmm0, xmmword [0x140092f40]
movups xmmword [rsi], xmm0
movaps xmmword [rsp + 0x20], xmm0
test rbp, rbp
je 0x140024f9d
xor ebx, ebx
jmp 0x140024fc7
mov edx, 1
mov rcx, rsi
call fcn.14001021a
movups xmm0, xmmword [0x140092f30]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
mov rcx, rsi
call fcn.1400102ba
mov rbp, qword [r13]
mov bl, 1
test rbp, rbp
jle 0x1400250cd
mov dword [rsp + 0x3c], ebx
xor edi, edi
mov r12d, 1
lea r15, [rsp + 0x20]
lea r14, [rsp + 0x40]
mov rax, qword [r13 + 8]
mov bl, byte [rax + rdi + 8]
cmp bl, 0x22
je 0x140025002
cmp bl, 0x5c
jne 0x140025056
mov rcx, r15
mov dl, 0x5c
jmp 0x14002508c
mov rbx, qword [rsp + 0x20]
test rbx, rbx
jle 0x140025026
add rbx, rbx
cmp rbx, 2
cmovl rbx, r12
mov rcx, rsi
mov dl, 0x5c
call fcn.1400105a5
dec rbx
jne 0x140025017
mov rcx, r15
xor edx, edx
call fcn.14001250f
mov edx, 2
mov rcx, rsi
call fcn.14001021a
movups xmm0, xmmword [0x140092f20]
movaps xmmword [rsp + 0x40], xmm0
mov rcx, rsi
mov rdx, r14
call fcn.1400102ba
jmp 0x140025091
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x140025087
mov rcx, rsi
call fcn.14001021a
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x40], xmm0
mov rcx, rsi
mov rdx, r14
call fcn.1400102ba
mov rcx, r15
xor edx, edx
call fcn.14001250f
mov rcx, rsi
mov edx, ebx
call fcn.1400105a5
inc rdi
cmp rdi, rbp
jne 0x140024fe6
mov rdi, qword [rsp + 0x20]
test rdi, rdi
mov ebx, dword [rsp + 0x3c]
jle 0x1400250cf
mov rcx, rsi
mov rdx, rdi
call fcn.14001021a
movaps xmm0, xmmword [rsp + 0x20]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
mov rcx, rsi
call fcn.1400102ba
jmp 0x1400250cf
xor edi, edi
test bl, bl
je 0x14002511a
mov rcx, rsi
mov rdx, rdi
call fcn.14001021a
movaps xmm0, xmmword [rsp + 0x20]
lea rdi, [rsp + 0x40]
movaps xmmword [rdi], xmm0
mov rcx, rsi
mov rdx, rdi
call fcn.1400102ba
mov edx, 1
mov rcx, rsi
call fcn.14001021a
movups xmm0, xmmword [0x140092f30]
movaps xmmword [rdi], xmm0
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1400102ba
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140024f5b
test byte [rcx + 7], 0x40
jne 0x140024f5b
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400011e0
Function at 0x140027aac
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
movabs rdi, 0x4000000000000000
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140027ad2
test qword [rcx], rdi
jne 0x140027ad2
call fcn.1400011e0
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x140027aeb
test qword [rcx], rdi
jne 0x140027aeb
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400011e0
nop
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x140028c09
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rsi, r8
mov rbx, rdx
mov r14, rcx
call fcn.140001066
mov r15, rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rdi, [rsp + 0x58]
mov rcx, rdi
call fcn.14002875a
movups xmm0, xmmword [rsi]
lea rcx, [rsp + 0x40]
movaps xmmword [rcx], xmm0
mov rdx, rdi
call fcn.140028562
cmp byte [r15], 0
je 0x140028c89
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140028c79
test byte [rcx + 7], 0x40
jne 0x140028c79
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.1400011e0
nop
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
movups xmm0, xmmword [rbx]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rcx, [rsp + 0x30]
call fcn.140011be7
mov al, byte [rsp + 0x70]
test al, al
je 0x140028cae
cmp al, 0x73
jne 0x140028d80
mov rbx, qword [rsp + 0x68]
cmp rbx, 0xffffffffffffffff
je 0x140028d02
movaps xmm0, xmmword [rsp + 0x30]
lea rcx, [rsp + 0x40]
movaps xmmword [rcx], xmm0
call fcn.140028a03
cmp byte [r15], 0
jne 0x140028c56
cmp rbx, rax
jge 0x140028d02
movaps xmm0, xmmword [rsp + 0x30]
lea rcx, [rsp + 0x40]
movaps xmmword [rcx], xmm0
mov rdx, rbx
call fcn.140028dd6
cmp byte [r15], 0
jne 0x140028c56
lea rcx, [rsp + 0x30]
mov rdx, rax
call fcn.14001250f
mov al, byte [rsp + 0x58]
mov r9b, byte [rsp + 0x59]
mov r8, qword [rsp + 0x60]
movaps xmm0, xmmword [rsp + 0x30]
lea rdx, [rsp + 0x80]
movaps xmmword [rdx], xmm0
mov byte [rsp + 0x20], al
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.140028774
mov rbx, qword [rsi + 8]
cmp byte [r15], 0
jne 0x140028d60
lea rsi, [rsp + 0x40]
mov rdi, qword [rsi]
mov rcx, r14
mov rdx, rdi
call fcn.14001021a
mov qword [rsi], rdi
mov qword [rsi + 8], rbx
mov rcx, r14
mov rdx, rsi
call fcn.1400102ba
test rbx, rbx
je 0x140028c56
test byte [rbx + 7], 0x40
jne 0x140028c56
mov rcx, rbx
call fcn.1400011e0
jmp 0x140028c56
mov ecx, 0x40
call fcn.14000ed36
lea rcx, [0x14009dfc8]
mov qword [rax], rcx
lea rdx, [0x14009e000]
mov qword [rax + 0x10], rdx
movups xmm0, xmmword [0x140093160]
movups xmmword [rax + 0x18], xmm0
mov qword [rax + 8], 0
mov qword [rsp + 0x20], 0x232
lea r8, [0x14009b780]
lea r9, str.cNpiRZylvPUPa
mov rcx, rax
call fcn.14000ed74
jmp 0x140028c56
Function at 0x140028ec8
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov r15, r8
mov rsi, rdx
mov r14, rcx
call fcn.140001066
mov rdi, rax
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov rdx, rsi
call fcn.140028f93
mov rsi, qword [rbx + 8]
cmp byte [rdi], 0
jne 0x140028f21
lea rdx, [rsp + 0x20]
mov rax, qword [rdx]
mov qword [rdx], rax
mov qword [rdx + 8], rsi
movups xmm0, xmmword [r15]
lea r8, [rsp + 0x30]
movaps xmmword [r8], xmm0
mov rcx, r14
call fcn.140028c09
test rsi, rsi
je 0x140028f74
mov rax, qword [rsi]
mov ecx, eax
not ecx
lea ecx, [rcx + rcx*2]
lea edx, [rax + rax]
add ecx, eax
inc ecx
xor ecx, edx
mov edi, 0xfffffffe
xor rdi, rcx
lea ecx, [rdi + rax]
mov ebx, edi
xor ebx, eax
sub ecx, ebx
mov edx, edi
and edx, eax
add edx, edx
xor edx, ecx
movabs rcx, 0xec89ee9974f628ab
xor rcx, rdx
add rcx, rdi
movabs rdx, 0x537611668b09d755
add rdx, rcx
test rax, rdx
je 0x140028f80
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.1400011e0

Function at 0x140029a32
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rdi, rdx
mov rsi, rcx
call fcn.140001066
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
cmp qword [rdi], 0
je 0x140029af0
cmp byte [rax], 0
jne 0x140029afa
mov rax, qword [rdi + 8]
mov cl, byte [rax + 8]
call fcn.140027f3f
mov r14d, eax
movups xmm0, xmmword [rdi]
lea r15, [rsp + 0x20]
movaps xmmword [r15], xmm0
lea rdi, [rsp + 0x38]
mov r8d, 1
mov rcx, rdi
mov rdx, r15
call fcn.140029b07
mov rbx, qword [rdi]
mov rdi, qword [rdi + 8]
lea rdx, [rbx + 1]
lea rbp, [rsp + 0x38]
mov rcx, rbp
call fcn.14001053f
mov rcx, rbp
mov edx, r14d
call fcn.140029b27
mov qword [r15], rbx
mov qword [r15 + 8], rdi
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.1400102ba
movups xmm0, xmmword [rbp]
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x140029afa
test byte [rdi + 7], 0x40
jne 0x140029afa
mov rcx, rdi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.1400011e0
movups xmm0, xmmword [0x140093180]
movups xmmword [rsi], xmm0
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140029dcc
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, rdx
mov r12, rcx
call fcn.140001066
mov qword [r12], 0
mov edx, 0x10
mov r8d, 8
xor ecx, ecx
call fcn.14000f052
mov qword [r12 + 8], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov rax, qword [rsi]
test rax, rax
js 0x140029f19
mov r14d, 2
xor r8d, r8d
lea r13, [rsp + 0x20]
lea r15, [0x140096300]
cmp rax, r8
mov rcx, r8
cmovg rcx, rax
lea rbp, [r8 - 1]
mov rdx, rcx
neg rdx
lea rbx, [rdx + rbp]
cmp rbx, 0xffffffffffffffff
je 0x140029e74
mov rbx, qword [rsi + 8]
movzx edi, byte [rbx + rbp + 9]
mov rbx, rdi
shr rbx, 3
movzx ebx, byte [rbx + r15]
and dil, 7
movzx edi, dil
inc rbp
bt ebx, edi
jae 0x140029e43
jmp 0x140029e77
mov rbp, rcx
mov rbx, r14
sub rbx, 1
cmovb rbp, rax
lea r9, [rbp - 1]
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x40], xmm0
mov rcx, r13
lea rdx, [rsp + 0x40]
call fcn.140027b26
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov rdx, r13
call fcn.1400102f9
movaps xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm0
mov rcx, rdi
call fcn.14000ed6d
movaps xmm0, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x20], xmm0
mov rcx, r12
mov rdx, r13
call fcn.1400242c8
test r14, r14
je 0x140029ef4
lea r8, [rbp + 1]
mov rax, qword [rsi]
mov r14, rbx
cmp rbp, rax
jl 0x140029e2f
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140029f19
test byte [rcx + 7], 0x40
jne 0x140029f19
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400011e0
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14002a1cc
Capabilities:
Encode data using xor

Disassembly:
test rcx, rcx
jle 0x14002a201
xor r8d, r8d
xor eax, eax
movzx r9d, byte [rdx + r8 + 8]
add r9, rax
mov r10, r9
shl r10, 0xa
add r10, r9
mov rax, r10
shr rax, 6
xor rax, r10
inc r8
cmp rcx, r8
jne 0x14002a1d6
lea rax, [rax + rax*8]
jmp 0x14002a203
xor eax, eax
mov rcx, rax
shr rcx, 0xb
xor rcx, rax
mov rax, rcx
shl rax, 0xf
add rax, rcx
ret

Function at 0x14002dfcd
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.140001066
mov rdi, rax
mov rcx, rsi
call fcn.14000cc65
test al, al
je 0x14002dff7
mov rcx, rsi
call fcn.14000ccb6
cmp byte [rdi], 0
je 0x14002dffe
add rsp, 0x28
pop rdi
pop rsi
ret
mov edx, 8
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140001c2a
Function at 0x14002e643
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
movabs rdi, 0x4000000000000000
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x14002e669
test qword [rcx], rdi
jne 0x14002e669
call fcn.1400011e0
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x14002e67c
test qword [rcx], rdi
jne 0x14002e67c
call fcn.1400011e0
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x14002e68f
test qword [rcx], rdi
jne 0x14002e68f
call fcn.1400011e0
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x14002e6a2
test qword [rcx], rdi
jne 0x14002e6a2
call fcn.1400011e0
mov rcx, qword [rsi + 0x48]
test rcx, rcx
je 0x14002e6b5
test qword [rcx], rdi
jne 0x14002e6b5
call fcn.1400011e0
mov rcx, qword [rsi + 0x58]
test rcx, rcx
je 0x14002e6c8
test qword [rcx], rdi
jne 0x14002e6c8
call fcn.1400011e0
mov rcx, qword [rsi + 0x68]
test rcx, rcx
je 0x14002e6db
test qword [rcx], rdi
jne 0x14002e6db
call fcn.1400011e0
mov rcx, qword [rsi + 0x78]
test rcx, rcx
je 0x14002e6f4
test qword [rcx], rdi
jne 0x14002e6f4
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400011e0
nop
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x14002f13b
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rcx
call fcn.140001066
mov rbx, qword [rsi]
test rbx, rbx
je 0x14002f172
mov r14, rax
mov rax, qword [rsi + 8]
lea rcx, [rax + 8]
test rax, rax
cmove rcx, rax
mov rdx, rbx
call fcn.14002e817
test al, al
je 0x14002f1ce
mov ecx, 0x48
call fcn.14000ed36
lea rcx, [0x14009df80]
mov qword [rax], rcx
lea rdx, [0x14009dfc0]
mov qword [rax + 0x10], rdx
movups xmm0, xmmword [0x140093710]
movups xmmword [rax + 0x18], xmm0
mov qword [rax + 8], 0
mov qword [rsp + 0x20], 0x97
lea r8, [0x14009c5e0]
lea r9, str.oHtCmM4mKjT
mov rcx, rax
call fcn.14000ed74
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rbx
lea rdi, [rsp + 0x48]
mov rcx, rdi
mov rdx, rbx
call fcn.14001053f
movups xmm0, xmmword [rsi]
lea rbx, [rsp + 0x30]
movaps xmmword [rbx], xmm0
mov rcx, rdi
mov rdx, rbx
call fcn.1400102ba
movups xmm0, xmmword [0x140093720]
movaps xmmword [rbx], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400102ba
mov rcx, qword [rdi]
mov rbx, qword [rdi + 8]
mov rdx, rbx
call fcn.1400132b3
mov rcx, rax
call sub.api_ms_win_crt_environment_l1_1_0.dll__putenv
test eax, eax
je 0x14002f246
call fcn.14000ffc0
cmp byte [r14], 0
jne 0x14002f246
movups xmm0, xmmword [rsi]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
mov ecx, eax
call fcn.14000ffc7
test rbx, rbx
je 0x14002f1c3
test byte [rbx + 7], 0x40
jne 0x14002f1c3
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400011e0

Function at 0x14002f332
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rdi, rdx
mov rsi, rcx
lea rbx, [rsp + 0x20]
mov edx, 0x18
mov rcx, rbx
call fcn.1400018bc
mov rax, qword [rsi + 0x10]
mov qword [rbx + 0x10], rax
movups xmm0, xmmword [rsi]
movaps xmmword [rbx], xmm0
mov edx, 0x18
mov rcx, rsi
call fcn.1400018bc
mov al, byte [rdi]
mov byte [rsi], al
cmp al, 1
je 0x14002f390
test al, al
jne 0x14002f3bc
mov rbx, qword [rsi + 0x10]
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14002f39a
call fcn.140010d4f
mov rax, qword [rdi + 0x10]
jmp 0x14002f39c
mov rax, qword [rdi + 8]
mov qword [rsi + 8], rax
jmp 0x14002f3bc
xor eax, eax
mov qword [rsi + 0x10], rax
mov rax, qword [rdi + 8]
mov qword [rsi + 8], rax
mov rcx, rbx
call fcn.140002cdd
test al, al
je 0x14002f3bc
mov rcx, rbx
call fcn.140001be7
cmp byte [rsp + 0x20], 0
jne 0x14002f3e3
mov rsi, qword [rsp + 0x30]
mov rcx, rsi
call fcn.140002cdd
test al, al
je 0x14002f3e3
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp fcn.140001be7
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x14002f3ec
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
cmp byte [rcx], 0
jne 0x14002f414
mov rsi, rcx
mov rcx, qword [rcx + 0x10]
call fcn.140002cdd
test al, al
je 0x14002f414
mov rcx, qword [rsi + 0x10]
add rsp, 0x20
pop rsi
jmp fcn.140001be7
nop
add rsp, 0x20
pop rsi
ret
Function at 0x14002f6d5
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15, rcx
call fcn.140001066
mov rdi, rax
call fcn.14002f55a
cmp byte [rdi], 0
jne 0x14002f78c
cmp qword [0x1400fdce8], 0
jne 0x14002f710
lea rcx, [0x14002f477]
call fcn.14008f444
lea rbx, [rsp + 0x50]
mov edx, 0x18
mov rcx, rbx
call fcn.1400018bc
mov edx, 0x18
mov rcx, rbx
call fcn.1400018bc
xor r14d, r14d
mov byte [rbx], r14b
lea rcx, [rsp + 0x20]
mov edx, 0x10
call fcn.1400018bc
mov rbp, qword [r15]
mov rsi, qword [r15 + 8]
mov rcx, r15
call fcn.140010a7c
mov qword [rbx + 0x10], rsi
mov qword [rbx + 8], rbp
lea rcx, [rsp + 0x30]
mov qword [rcx + 0x10], rsi
mov rax, qword [rbx]
mov qword [rcx], rax
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
call fcn.14002f7ad
mov bl, byte [rdi]
mov byte [rdi], r14b
call fcn.14002f658
cmp byte [rdi], r14b
jne 0x14002f78c
mov byte [rdi], bl
test bl, bl
je 0x14002f799
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, r15
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.140010bd4

Function at 0x14002fb58
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rdx
mov rbx, rcx
call fcn.140001066
mov rdi, rax
movups xmm0, xmmword [rsi]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea rcx, [rsp + 0x20]
call fcn.14002fcb1
cmp byte [rdi], 0
je 0x14002fb93
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rsi, [rsp + 0x20]
mov rdi, qword [rsi]
mov r14, qword [rsi + 8]
mov rcx, rbx
mov rdx, rdi
call fcn.14001021a
mov qword [rsi], rdi
mov qword [rsi + 8], r14
mov rcx, rbx
mov rdx, rsi
call fcn.1400102ba
test r14, r14
je 0x14002fb89
mov eax, 0xfffffffe
xor eax, edi
add eax, edi
add eax, 2
add edi, edi
and edi, 2
xor rax, rdi
movabs rcx, 0x5558d827224bce69
xor rcx, rax
mov edx, eax
not edx
lea edx, [rdx + rdx*2]
add edx, eax
inc edx
add eax, eax
xor edx, eax
movabs rax, 0xeaa727d8224bce69
xor rax, rdx
add rax, rcx
test qword [r14], rax
jne 0x14002fb89
mov rcx, r14
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400011e0

Function at 0x14002fc17
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov r14d, edx
mov rdi, rcx
lea rbx, [rsp + 0x20]
mov rcx, rbx
call fcn.14002409a
mov rbp, qword [rbx]
mov rsi, qword [rbx + 8]
mov rcx, rdi
mov rdx, rbp
call fcn.14001021a
mov qword [rbx], rbp
mov qword [rbx + 8], rsi
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400102ba
test rsi, rsi
je 0x14002fc8f
mov rax, qword [rsi]
movzx ebp, r14b
mov edx, eax
not edx
or edx, ebp
mov ecx, ebp
or ecx, eax
not ecx
lea ecx, [rcx + rcx*2]
mov ebx, ebp
not ebx
add ebx, ebx
sub ebx, eax
xor ebp, eax
sub ebp, edx
add ebp, ecx
xor ebp, ebx
bts rbp, 0x3e
test rax, rbp
je 0x14002fc9a
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov rcx, rsi
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
jmp fcn.1400011e0