joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140028500
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
movsxd rdi, r8d
mov edx, 0x2e
call fcn.140049038
test rax, rax
je 0x140028583
movzx r9d, byte [rax]
lea r11, [rax + 1]
mov r10d, 0x1505
test r9d, r9d
je 0x140028564
nop dword [rax]
nop word [rax + rax]
lea eax, [r9 - 0x41]
cmp eax, 0x1a
lea ecx, [r9 + 0x20]
lea r11, [r11 + 1]
cmovb r9d, ecx
imul r10d, r10d, 0x21
add r10d, r9d
movzx r9d, byte [r11 - 1]
test r9d, r9d
jne 0x140028540
test r10d, r10d
mov ecx, 1
cmovne ecx, r10d
test edi, edi
jle 0x140028583
xor eax, eax
cmp dword [rbx + rax*4], ecx
je 0x140028590
inc rax
cmp rax, rdi
jl 0x140028576
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov al, 1
add rsp, 0x20
pop rdi
ret

Function at 0x140028dc0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
lea rcx, [0x1400b4c20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x14008e8a8]
lea rdx, [0x14007ef20]
lea rcx, [0x14008e8b0]
mov qword [rsp + 0x60], rax
call fcn.1400147a0
mov rbx, rax
test rax, rax
je 0x140028e5a
mov edx, 8
lea rcx, [rsp + 0x60]
mov r9, rax
lea r8d, [rdx - 7]
call fcn.1400529c8
mov rcx, rbx
call fcn.140052714
lea rdx, [0x14008e8b0]
lea rcx, [rsp + 0x38]
call fcn.140026540
lea rcx, [0x1400b4c20]
movsd xmm1, qword [rax + 0x10]
movsd qword [rsp + 0x30], xmm1
mov rax, qword [rsp + 0x30]
mov qword [0x14008e8a8], rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [0x14008e8a8]
add rsp, 0x50
pop rbx
ret
xor edx, edx
lea rcx, str.Unable_to_create_timestamp_file__s
call fcn.1400139a0
int3
Function at 0x1400343b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rbx, qword [rcx + 0x28]
mov rbp, rdx
mov rsi, qword [rcx + 8]
test rbx, rbx
je 0x140034410
mov qword [rsp + 0x30], rdi
nop dword [rax]
nop dword [rax + rax]
mov edi, 0x3f8
mov r9, rbp
cmp rbx, rdi
mov edx, 1
mov rcx, rsi
cmovb rdi, rbx
mov r8, rdi
call fcn.1400529c8
mov rsi, qword [rsi + 0x3f8]
sub rbx, rdi
jne 0x1400343e0
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x1400363b0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x14003656f
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140035e20
mov qword [rsi + 0x38], rdi
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x140036539
mov qword [rsp + 0x38], rbp
movabs rbp, 0x100000001b3
mov qword [rsp + 0x40], r14
movabs r14, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r8, qword [rsi + 0x30]
xor r9, r14
mov rdx, qword [rdx]
imul r9, rbp
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rbp
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rbp
xor r9, rax
mov rax, qword [rsi + 0x18]
imul r9, rbp
and r8, r9
add r8, r8
lea r11, [rax + r8*8]
lea rdi, [rax + r8*8]
cmp qword [r11], rbx
jne 0x1400364a4
mov qword [r11], rcx
mov qword [rdi + 8], rcx
jmp 0x140036523
mov rax, qword [rdi + 8]
mov r8d, dword [rax + 0x10]
cmp dword [rcx + 0x10], r8d
jne 0x1400364e1
mov r8, qword [rax]
cmp r8, rcx
je 0x1400364db
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov rax, qword [rdx + 8]
mov qword [rax], r8
mov r9, qword [r8 + 8]
mov qword [r9], rcx
mov qword [r8 + 8], rax
mov qword [rdx + 8], r10
mov qword [rcx + 8], r9
mov qword [rdi + 8], rcx
jmp 0x140036523
cmp qword [r11], rax
je 0x1400364ff
mov r9d, dword [rcx + 0x10]
mov r8, qword [r11]
nop dword [rax]
mov rax, qword [rax + 8]
cmp r9d, dword [rax + 0x10]
je 0x140036549
cmp r8, rax
jne 0x1400364f0
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov qword [rax + 8], r8
mov qword [rdx + 8], r10
mov qword [rcx + 8], r9
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x140036450
mov r14, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r9, qword [rax]
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov rax, qword [rdx + 8]
mov qword [rax], r9
mov r8, qword [r9 + 8]
mov qword [r8], rcx
mov qword [r9 + 8], rax
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
jmp 0x140036523
lea rcx, str.invalid_hash_bucket_count
call fcn.140046a9c
int3
Function at 0x140038bd0
Capabilities:
Check for time delay via queryperformancecounter
Get file size
Read file via mapping

Disassembly:
push rbx
push rdi
sub rsp, 0x78
mov rdi, rcx
mov rbx, rdx
lea rcx, [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140038e0a
mov rax, qword [rsp + 0xa8]
lea rcx, [rsp + 0x48]
sub rax, qword [0x14008eac8]
xor edx, edx
imul rax, rax, 0xf4240
mov qword [rsp + 0x90], rbp
div qword [0x14008eac0]
mov qword [rsp + 0x70], r14
mov rdx, rbx
mov r14, rax
add r14, qword [0x14008ead0]
call fcn.140013c40
cmp qword [rax + 0x18], 7
jbe 0x140038c40
mov rax, qword [rax]
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov rcx, rax
mov dword [rsp + 0x20], 3
lea r8d, [rbp + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdx, qword [rsp + 0x60]
mov rbx, rax
cmp rdx, 7
jbe 0x140038cb1
mov rcx, qword [rsp + 0x48]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140038cac
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140038e17
mov rcx, r8
call fcn.140048124
movdqa xmm0, xmmword [0x140083230]
mov word [rsp + 0x48], bp
movdqu xmmword [rsp + 0x58], xmm0
cmp rbx, 0xffffffffffffffff
je 0x140038da5
lea rdx, [rsp + 0xa0]
mov qword [rsp + 0x98], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [rsp + 0xa0]
xor edx, edx
mov eax, eax
mov rcx, rbx
shl rsi, 0x20
or rsi, rax
mov qword [rsp + 0x28], rbp
mov r9, rsi
mov dword [rsp + 0x20], esi
shr r9, 0x20
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rbp, rax
test rax, rax
jne 0x140038d41
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.CreateFileMapping___failed:__u
lea ecx, [rbp + 1]
call fcn.140013a20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140038d9d
xor r9d, r9d
mov eax, esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbp
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
jne 0x140038d8e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.MapViewOfFile___failed:__u
mov ecx, 1
mov r8d, eax
call fcn.140013a20
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140038d9d
mov qword [rdi], rax
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], rbp
mov rsi, qword [rsp + 0x98]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140038dfd
mov rax, qword [rsp + 0x40]
xor edx, edx
sub rax, qword [0x14008eac8]
imul rax, rax, 0xf4240
div qword [0x14008eac0]
sub rax, r14
add rax, qword [0x14008ead0]
lock inc dword [0x14008e7b0]
lock add qword [0x14008e7b8], rax
mov rbp, qword [rsp + 0x90]
mov r14, qword [rsp + 0x70]
add rsp, 0x78
pop rdi
pop rbx
ret
lea rcx, str.QueryPerformanceCounter_failed
call fcn.1400139a0
int3
lea rcx, str.QueryPerformanceCounter_failed
call fcn.1400139a0
int3
call fcn.140052424
int3
Function at 0x140038e20
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140038f0c
mov rax, qword [rsp + 0x38]
xor edx, edx
sub rax, qword [0x14008eac8]
imul rax, rax, 0xf4240
mov qword [rsp + 0x48], rsi
div qword [0x14008eac0]
mov rsi, rax
add rsi, qword [0x14008ead0]
cmp qword [rdi], 0
je 0x140038e9f
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
je 0x140038f19
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x30]
xor eax, eax
lea rcx, [rsp + 0x40]
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140038eff
mov rax, qword [rsp + 0x40]
xor edx, edx
sub rax, qword [0x14008eac8]
imul rax, rax, 0xf4240
div qword [0x14008eac0]
sub rax, rsi
add rax, qword [0x14008ead0]
lock inc dword [0x14008e7b0]
lock add qword [0x14008e7b8], rax
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
lea rcx, str.QueryPerformanceCounter_failed
call fcn.1400139a0
int3
lea rcx, str.QueryPerformanceCounter_failed
call fcn.1400139a0
int3
lea rcx, str.UnMapViewOfFile___failed
call fcn.1400139a0
int3
Function at 0x14003f5b0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x4b0
mov r15, rcx
lea rcx, [rsp + 0x220]
call fcn.14003d630
mov r12d, 0xffff
nop word [rax + rax]
movzx eax, word [rsp + 0x224]
movzx ecx, word [rsp + 0x226]
shr ax, 1
and ax, 1
cmp cx, ax
jbe 0x14003f7b1
add cx, r12w
mov word [rsp + 0x226], cx
je 0x14003f7b1
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x20]
call fcn.14003d9a0
movzx eax, byte [rsp + 0x20]
lea r9, [rsp + 0x21]
mov r8d, 0x1505
test eax, eax
je 0x14003f670
nop dword [rax + rax]
lea ecx, [rax - 0x41]
cmp ecx, 0x1a
lea edx, [rax + 0x20]
lea r9, [r9 + 1]
cmovb eax, edx
imul r8d, r8d, 0x21
add r8d, eax
movzx eax, byte [r9 - 1]
test eax, eax
jne 0x14003f650
mov rax, qword [r15]
test r8d, r8d
mov edi, 1
cmovne edi, r8d
mov edx, dword [rax + 0x10]
test edx, edx
je 0x14003f6d8
mov rsi, qword [rax]
lea ebx, [rdx - 1]
mov r14, qword [rax + 8]
and ebx, edi
mov ecx, dword [rsi + rbx*4]
test ecx, ecx
je 0x14003f6d8
mov eax, ebx
lea ebp, [rdx - 1]
nop
cmp edi, ecx
jne 0x14003f6c0
mov rcx, qword [r14 + rax*8]
lea rax, [rsp + 0x20]
cmp rcx, rax
je 0x14003f6cf
lea rdx, [rsp + 0x20]
call fcn.1400078f0
test eax, eax
je 0x14003f6cf
inc ebx
and ebx, ebp
mov eax, ebx
mov ecx, dword [rsi + rbx*4]
test ecx, ecx
jne 0x14003f6a0
jmp 0x14003f6d8
cmp ebx, 0xffffffff
jne 0x14003f5f0
mov rax, qword [r15 + 8]
mov rbx, 0xffffffffffffffff
mov rsi, qword [rax]
lea rax, [rsp + 0x20]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14003f6f0
mov rax, qword [rsi + 8]
inc rbx
mov rdx, qword [rax + 0x18]
lea rcx, [rdx + rbx]
cmp rcx, qword [rax + 0x10]
jbe 0x14003f71b
mov rdx, rbx
mov rcx, rsi
call fcn.140038a30
xor edx, edx
mov rax, qword [rsi + 8]
lea rcx, [rdx + rbx]
lea r8, [rbx - 1]
mov rbp, qword [rax + 0x28]
mov qword [rax + 0x18], rcx
add rbp, rdx
mov rax, qword [rsi + 8]
mov rcx, rbp
mov rdx, qword [rax + 0x20]
add rdx, qword [rax + 0x18]
mov qword [rsi + 0x10], rdx
lea rdx, [rsp + 0x20]
call fcn.1400700e0
mov byte [rbx + rbp - 1], 0
mov rbx, qword [r15]
mov esi, dword [rbx + 0x18]
mov ecx, dword [rbx + 0x14]
mov r8d, dword [rbx + 0x10]
lea edx, [rsi + 1]
shl rdx, 8
shr rdx, cl
cmp rdx, 0x50
jbe 0x14003f77d
mov rcx, rbx
call fcn.140010b00
mov r8d, dword [rbx + 0x10]
mov rdx, qword [rbx]
lea ecx, [r8 - 1]
and ecx, edi
cmp dword [rdx + rcx*4], 0
je 0x14003f79b
dec r8d
nop
inc ecx
and ecx, r8d
cmp dword [rdx + rcx*4], 0
jne 0x14003f790
mov dword [rdx + rcx*4], edi
mov rax, qword [rbx + 8]
mov qword [rax + rcx*8], rbp
lea eax, [rsi + 1]
mov dword [rbx + 0x18], eax
jmp 0x14003f5f0
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14003ffe0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov r12d, dword [rsp + 0xa0]
mov rbp, r9
mov r14, qword [rsp + 0xb0]
mov edi, r8d
mov rsi, rdx
mov r15, rcx
test r12d, r12d
jne 0x140040036
mov r8, rdx
mov rcx, r14
mov edx, edi
call fcn.140015f50
cmp eax, 0xffffffff
jne 0x140040036
mov r8, rsi
mov edx, edi
mov rcx, r14
call fcn.140018640
mov rbx, qword [rsp + 0xa8]
mov r8, rsi
mov rcx, rbx
mov edx, edi
call fcn.140015f50
cmp eax, 0xffffffff
je 0x140040060
cdqe
shl rax, 4
add rax, qword [rbx + 0x28]
jne 0x140040220
mov ecx, dword [rbx + 0x14]
mov r8d, dword [rbx + 0x10]
mov qword [rsp + 0x80], r13
mov r13d, dword [rbx + 0x18]
lea edx, [r13 + 1]
shl rdx, 8
shr rdx, cl
cmp rdx, 0x50
jbe 0x140040090
mov rcx, rbx
call fcn.14001d250
mov r8d, dword [rbx + 0x10]
mov rcx, qword [rbx]
lea edx, [r8 - 1]
and edx, edi
cmp dword [rcx + rdx*4], 0
je 0x1400400ad
dec r8d
inc edx
and edx, r8d
cmp dword [rcx + rdx*4], 0
jne 0x1400400a2
mov dword [rcx + rdx*4], edi
lea r8, [rsi + 1]
mov rax, qword [rbx + 8]
mov r9d, 0x1505
movsxd rcx, edx
add rcx, rcx
mov qword [rax + rdx*8], rsi
lea eax, [r13 + 1]
mov dword [rbx + 0x18], eax
mov rax, qword [rbx + 0x28]
movups xmm0, xmmword [r15]
movups xmmword [rax + rcx*8], xmm0
movzx edx, byte [rsi]
test edx, edx
je 0x140040112
nop dword [rax]
nop word [rax + rax]
lea eax, [rdx - 0x41]
lea ecx, [rdx + 0x20]
cmp eax, 0x1a
lea r8, [r8 + 1]
cmovb edx, ecx
imul r9, r9, 0x21
mov ecx, edx
movzx edx, byte [r8 - 1]
add r9, rcx
test edx, edx
jne 0x1400400f0
movsxd rcx, dword [rbp + 8]
lea rdx, [rbp + 8]
test r9, r9
lea r8, [rsp + 0x40]
mov eax, 1
cmovne rax, r9
add rcx, rdx
xor rax, qword [r15]
mov qword [rsp + 0x40], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x48], rax
xor eax, eax
sub eax, dword [rdx]
mov edx, dword [rbp + 4]
neg eax
sbb rax, rax
and rcx, rax
call fcn.140006240
test rax, rax
je 0x140040218
movsxd r8, dword [rbp + 8]
lea rdx, [rbp + 8]
xor ecx, ecx
lea r9, [rbp + 0xc]
sub ecx, dword [rdx]
add r8, rdx
neg ecx
sbb rcx, rcx
and r8, rcx
movsxd rcx, dword [r9]
sub rax, r8
add rcx, r9
sar rax, 4
movsxd rdi, eax
xor eax, eax
sub eax, dword [r9]
shl rdi, 4
neg eax
sbb rax, rax
and rcx, rax
add rdi, rcx
movsxd r13, dword [rdi + 8]
test r13, r13
jle 0x140040218
xor esi, esi
add rdi, 0xc
inc r12d
nop dword [rax]
movsxd rcx, dword [rdi]
lea r10, [rsi*8]
movsxd r8, dword [rdi]
xor eax, eax
sub eax, dword [rdi]
add rcx, rdi
neg eax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rbx
mov r9, rbp
sbb rax, rax
mov dword [rsp + 0x20], r12d
and rcx, rax
add r8, rdi
xor eax, eax
add rcx, r10
sub eax, dword [rdi]
neg eax
movsxd rdx, dword [rcx]
sbb rax, rax
and r8, rax
add rdx, rcx
xor eax, eax
sub eax, dword [rcx]
mov rcx, r15
neg eax
mov r8d, dword [r8 + r10 + 4]
sbb rax, rax
and rdx, rax
call fcn.14003ffe0
inc rsi
cmp rsi, r13
jl 0x1400401b0
mov r13, qword [rsp + 0x80]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140044ac0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x560
mov rsi, rdx
mov r15, rcx
mov rdx, r9
lea rcx, [rsp + 0x2d0]
mov rdi, r8
call fcn.14003d630
mov rbx, qword [rsp + 0x5a8]
lea rcx, [rsp + 0x40]
mov rdx, qword [rbx]
call fcn.14003d630
cmp byte [rbx + 0x10], 0
jne 0x140044c28
mov rdx, rsi
lea rcx, [rsp + 0x2d0]
mov eax, 5
nop dword [rax]
nop word [rax + rax]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub rax, 1
jne 0x140044b30
mov rax, qword [rcx]
mov qword [rdx], rax
mov eax, dword [rcx + 8]
mov dword [rdx + 8], eax
movzx eax, word [rsi + 4]
movzx ecx, word [rsi + 6]
shr ax, 1
and ax, 1
cmp cx, ax
jbe 0x140044baa
dec cx
mov word [rsi + 6], cx
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14003d830
mov rdx, rsi
mov rcx, rdi
call fcn.14003d9a0
movzx edx, byte [rdi]
lea r9, [rdi + 1]
mov r8d, 0x1505
test edx, edx
je 0x140044c00
nop dword [rax]
nop word [rax + rax]
lea eax, [rdx - 0x41]
cmp eax, 0x1a
lea ecx, [rdx + 0x20]
lea r9, [r9 + 1]
cmovb edx, ecx
imul r8d, r8d, 0x21
add r8d, edx
movzx edx, byte [r9 - 1]
test edx, edx
jne 0x140044be0
test r8d, r8d
lea rcx, [rsp + 0x20]
mov r9d, 1
mov rdx, r15
cmovne r9d, r8d
mov r8, rdi
call fcn.140045a80
test byte [rsp + 0x20], 1
jne 0x140044d30
mov r8, qword [rsp + 0x5a0]
xor eax, eax
sub eax, dword [r8 + 8]
lea rcx, [r8 + 8]
movsxd rbx, dword [rcx]
movsxd rdx, dword [r8 + 8]
add rbx, rcx
neg eax
lea rcx, [r8 + 8]
sbb rax, rax
add rdx, rcx
and rbx, rax
xor eax, eax
sub eax, dword [rcx]
neg eax
sbb rax, rax
and rdx, rax
movsxd rax, dword [r8 + 4]
lea rbp, [rdx + rax*4]
cmp rbx, rbp
je 0x140044d11
movsxd rdx, dword [rbx]
xor eax, eax
sub eax, dword [rbx]
add rdx, rbx
neg eax
mov rcx, rsi
sbb rax, rax
and rdx, rax
call fcn.14003d630
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14003d830
mov rdx, rsi
mov rcx, rdi
call fcn.14003d9a0
movzx eax, byte [rdi]
lea r9, [rdi + 1]
mov r8d, 0x1505
test eax, eax
je 0x140044ce0
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax - 0x41]
cmp ecx, 0x1a
lea edx, [rax + 0x20]
lea r9, [r9 + 1]
cmovb eax, edx
imul r8d, r8d, 0x21
add r8d, eax
movzx eax, byte [r9 - 1]
test eax, eax
jne 0x140044cc0
test r8d, r8d
lea rcx, [rsp + 0x20]
mov r9d, 1
mov rdx, r15
cmovne r9d, r8d
mov r8, rdi
call fcn.140045a80
test byte [rsp + 0x20], 1
jne 0x140044d30
add rbx, 4
cmp rbx, rbp
jne 0x140044c70
xor al, al
lea r11, [rsp + 0x560]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov al, 1
jmp 0x140044d13
Function at 0x140046b24
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140046b5e
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140046b63
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140046bac
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400726e0]
cmp byte [rcx + rax], 0
je 0x140046bac
dec r8
sub rdx, 1
jne 0x140046b92
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140048bd0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140048c1a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140048c1a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140048c1a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140048c1a
cmp dword [rcx + 0x84], 0xe
jbe 0x140048c1a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140048c1c
xor al, al
add rsp, 0x28
ret

Function at 0x140052f24
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140052db7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140052db7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140052db7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140052db7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140052db7
cmp dword [rcx + 0x84], 0xe
jbe 0x140052db7
cmp dword [rcx + 0xf8], 0
je 0x140052db7
mov ecx, ebx
call fcn.140052e58
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140052c48
cmp dword [rbp + 0x20], 0
je 0x140052e04
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140052e0c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140052d50
Function at 0x14006f7d0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14006f7f8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14006f7f8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x2fc4d52d0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d63b0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d5cd2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f8108]
test eax, eax
je 0x2fc4d5d6a
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f8110]
mov qword [rbp - 8], rax
jmp 0x2fc4d5d4e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d5d42
cmp qword [rbp - 0x10], 0
je 0x2fc4d5d42
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d5d08
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d5d6b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d5e70
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d5e98
mov eax, 0
jmp 0x2fc4d5ee6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d5ec1
mov eax, 0
jmp 0x2fc4d5ee6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d5ee1
mov eax, 0
jmp 0x2fc4d5ee6
mov eax, 1
add rsp, 0x20
pop rbp
ret