joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006e00
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x280
mov rax, qword [0x140035040]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbx, rcx
mov eax, dword [rcx]
test eax, eax
jne 0x140006f1e
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
mov qword [rsp + 0x20], rax
mov ecx, 4
call fcn.140012d48
test rax, rax
je 0x140006e5c
mov dword [rax], 1
mov qword [rsp + 0x28], rax
jmp 0x140006e65
mov qword [rsp + 0x28], 0
cmp rdi, 0xffffffffffffffff
jne 0x140006e97
mov dword [0x140036030], 0x400002
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140036034], eax
mov dword [0x140036038], 0
lea rcx, [0x140036030]
call fcn.1400078a0
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x34]
call fcn.140023250
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, rdi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140006f11
nop dword [rax]
nop word [rax + rax]
lea rax, [rsp + 0x5c]
mov r8, qword [rbx + 0x30]
sub r8, rax
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140006ef4
add rax, 2
test ecx, ecx
jne 0x140006ee0
test edx, edx
je 0x140006f0b
lea rdx, [rsp + 0x30]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140006ed0
jmp 0x140006f11
mov eax, dword [rsp + 0x38]
mov dword [rbx], eax
lea rcx, [rsp + 0x20]
call fcn.1400039b0
nop
mov eax, dword [rbx]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140012ea0
mov rbx, qword [rsp + 0x290]
add rsp, 0x280
pop rdi
ret
Function at 0x140007210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140035040]
xor rax, rsp
mov qword [rbp - 0x10], rax
movzx edi, dl
mov r14, rcx
mov rbx, 0xffffffffffffffff
mov qword [rbp - 0x60], rbx
movdqa xmm0, xmmword [0x140026720]
movdqu xmmword [rbp - 0x28], xmm0
mov word [rbp - 0x18], 0x7463
mov byte [rbp - 0x16], 0
lea rcx, [rbp - 0x27]
call fcn.140007600
test eax, eax
je 0x1400073f1
mov dword gs:[0x16b4], eax
xor r8d, r8d
mov edx, 0x2000000
lea rcx, [rbp - 0x60]
call fcn.1400077b0
test eax, eax
js 0x1400073f1
test dil, dil
je 0x14000732f
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x28], 1
mov byte [rbp - 0x24], 1
movdqa xmm0, xmmword [0x140026750]
movdqu xmmword [rbp - 0x48], xmm0
mov dword [rbp - 0x38], 0x626f4a6e
mov dword [rbp - 0x34], 0x656a624f
mov word [rbp - 0x30], 0x7463
mov byte [rbp - 0x2e], 0
lea rcx, [rbp - 0x47]
call fcn.140007600
test eax, eax
je 0x140007305
mov dword gs:[0x16b4], eax
mov r9d, 0x10
lea r8, [rbp - 0x28]
mov edx, 0x12
mov rcx, qword [rbp - 0x60]
call fcn.1400077b0
mov edi, eax
test eax, eax
jns 0x14000732f
jmp 0x140007307
mov edi, ebx
mov dword [0x140036030], 0x40000b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140036034], eax
mov dword [0x140036038], edi
lea rcx, [0x140036030]
call fcn.1400078a0
mov r8d, 0x1fffff
lea rdx, [rbp - 0x28]
mov rcx, r14
call fcn.1400057e0
mov rdi, rax
movdqa xmm0, xmmword [0x140026780]
movdqu xmmword [rbp - 0x48], xmm0
mov dword [rbp - 0x38], 0x6f4a6f54
mov dword [rbp - 0x34], 0x6a624f62
mov dword [rbp - 0x30], 0x746365
lea rcx, [rbp - 0x47]
call fcn.140007600
test eax, eax
je 0x140007389
mov dword gs:[0x16b4], eax
mov rdx, qword [rdi]
mov rcx, qword [rbp - 0x60]
call fcn.1400077b0
mov ebx, eax
lea rcx, [rbp - 0x28]
call fcn.1400039b0
nop
test ebx, ebx
js 0x1400073f1
mov rsi, qword [rbp - 0x60]
mov qword [rbp - 0x58], rsi
mov ecx, 4
call fcn.140012d48
mov rbx, rax
test rax, rax
je 0x1400073bd
mov dword [rax], 1
mov qword [rbp - 0x50], rax
jmp 0x1400073c3
xor ebx, ebx
mov qword [rbp - 0x50], rbx
lea rdi, [r14 + 0x18]
lea rax, [rbp - 0x58]
cmp rdi, rax
je 0x1400073e7
mov rcx, rdi
call fcn.1400039b0
mov qword [rdi], rsi
mov qword [rdi + 8], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x58], xmm0
lea rcx, [rbp - 0x58]
call fcn.1400039b0
nop
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140012ea0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140007520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140035040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, qword [rcx + 0x18]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x21]
mov dword [rsp + 0x40], 1
movdqa xmm0, xmmword [0x140026760]
movdqu xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x44], 0
mov dword [rsp + 0x30], 0x626f4a6e
mov dword [rsp + 0x34], 0x656a624f
mov word [rsp + 0x38], 0x7463
mov byte [rsp + 0x3a], 0
call fcn.140007600
test eax, eax
je 0x1400075ae
mov r9d, 0x10
mov dword gs:[0x16b4], eax
lea r8, [rsp + 0x40]
mov edx, 0x12
mov rcx, rbx
call fcn.1400077b0
mov ebx, eax
test eax, eax
jns 0x1400075db
jmp 0x1400075b3
mov ebx, 0xffffffff
mov dword [0x140036030], 0x40000b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140036030]
mov dword [0x140036038], ebx
mov dword [0x140036034], eax
call fcn.1400078a0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140012ea0
add rsp, 0x60
pop rbx
ret

Function at 0x140007600
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rax, qword gs:[0x30]
mov r12, rcx
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
add rax, 0x10
mov qword [rsp + 0x58], rax
mov r8, qword [rax]
cmp r8, rax
je 0x14000777c
nop dword [rax]
mov rbp, qword [r8 + 0x30]
mov r8, qword [r8]
mov qword [rsp + 0x50], r8
movsxd r8, dword [rbp + 0x3c]
mov eax, dword [r8 + rbp + 0x88]
test eax, eax
je 0x14000776c
cmp dword [rax + rbp + 0x18], 0
lea rcx, [rax + rbp]
je 0x14000776c
mov edx, dword [rcx + 0xc]
mov eax, dword [rdx + rbp]
or eax, 0x20202020
cmp eax, 0x6c64746e
jne 0x14000776c
mov eax, dword [rdx + rbp + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
jne 0x14000776c
movzx eax, word [rdx + rbp + 8]
or ax, 0x20
cmp ax, 0x6c
jne 0x14000776c
mov eax, dword [r8 + rbp + 0xa0]
test eax, eax
je 0x14000777c
mov r15d, dword [rcx + 0x1c]
lea r14, [rax + rbp]
mov eax, dword [rcx + 0x24]
add r15, rbp
mov r13d, dword [rcx + 0x20]
add rax, rbp
add r13, rbp
mov qword [rsp + 0x48], rax
xor ebx, ebx
cmp dword [r14], ebx
je 0x14000776c
mov edi, dword [rcx + 0x14]
xor r10d, r10d
test edi, edi
je 0x14000775e
mov esi, dword [r14]
mov r11, r13
mov r9, rax
nop word [rax + rax]
movzx eax, word [r9]
cmp dword [r15 + rax*4], esi
jne 0x140007749
mov r8d, dword [r11]
mov rcx, r12
add r8, rbp
mov rdx, r8
movzx eax, byte [r8]
test al, al
je 0x140007732
nop
cmp al, byte [rcx]
jne 0x140007732
movzx eax, byte [rdx + 1]
inc rdx
inc rcx
test al, al
jne 0x140007720
movzx ecx, byte [rcx]
movzx eax, byte [rdx]
cmp eax, ecx
je 0x140007792
mov eax, 0x775a
cmp word [r8], ax
jne 0x140007749
inc ebx
inc r10d
add r9, 2
add r11, 4
cmp r10d, edi
jb 0x140007700
mov rax, qword [rsp + 0x48]
add r14, 0xc
cmp dword [r14], 0
jne 0x1400076e7
mov r8, qword [rsp + 0x50]
cmp r8, qword [rsp + 0x58]
jne 0x140007640
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, ebx
mov rbx, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400077b0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, dword gs:[0x16b4]
syscall
ret
Function at 0x14000c130
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rdi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x14000c155
cvtsi2ss xmm0, rdx
jmp 0x14000c16a
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call fcn.140019680
movss xmm1, dword [0x14002691c]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x14000c198
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x14000c198
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x14000c1ca
cmp rbx, 0x200
jae 0x14000c1c7
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x14000c1ca
mov rbx, rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14000beb0
Function at 0x140012c20
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140012c5a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140012c5f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140012ca8
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140026a80]
cmp byte [rcx + rax], 0
je 0x140012ca8
dec r8
sub rdx, 1
jne 0x140012c8e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140013c68
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140013cb2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140013cb2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140013cb2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140013cb2
cmp dword [rcx + 0x84], 0xe
jbe 0x140013cb2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140013cb4
xor al, al
add rsp, 0x28
ret

Function at 0x140018fb8
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140019027
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140019027
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140019027
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140019027
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140019027
cmp dword [rcx + 0x84], 0xe
jbe 0x140019027
cmp dword [rcx + 0xf8], 0
je 0x140019027
mov ecx, ebx
call fcn.1400190d8
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140018eb4
nop
cmp dword [rbp + 0x20], 0
je 0x140019075
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140019080
int3
xor r8d, r8d
xor edx, edx
jmp 0x140018fb8
Function at 0x1400191bc
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140019027
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140019027
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140019027
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140019027
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140019027
cmp dword [rcx + 0x84], 0xe
jbe 0x140019027
cmp dword [rcx + 0xf8], 0
je 0x140019027
mov ecx, ebx
call fcn.1400190d8
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140018eb4
nop
cmp dword [rbp + 0x20], 0
je 0x140019075
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140019080
int3
xor r8d, r8d
xor edx, edx
jmp 0x140018fb8
Function at 0x14001df04
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14001df34
xor eax, eax
jmp 0x14001dff7
mov rbp, rbx
cmp word [rax], si
je 0x14001df59
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14001df40
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14001df3c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14001de24
movsxd r14, eax
test eax, eax
jne 0x14001df97
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14001df2d
mov rcx, r14
call fcn.14001b888
mov rdi, rax
test rax, rax
jne 0x14001dfb0
xor ecx, ecx
call fcn.14001b84c
jmp 0x14001df8c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14001de24
test eax, eax
jne 0x14001dfe1
mov rcx, rdi
call fcn.14001b84c
jmp 0x14001dfeb
xor ecx, ecx
call fcn.14001b84c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400229c0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400229e8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400229e8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140005464
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0x18], 7
mov rdi, rdx
mov rbx, rcx
jbe 0x140005483
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140005549
cmp qword [rbx + 0x18], 7
jbe 0x14000549c
mov rbx, qword [rbx]
and qword [rsp + 0x30], 0
mov esi, 2
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0xc0000000
mov dword [rsp + 0x20], esi
mov rcx, rbx
lea r8d, [rsi - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005549
and dword [rsp + 0x60], 0
lea r9, [rsp + 0x60]
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x50]
mov eax, 0xfeff
mov r8d, esi
mov rcx, rbx
mov word [rsp + 0x50], ax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne sil
test eax, eax
je 0x14000553b
cmp qword [rdi + 0x10], 0
jbe 0x14000553b
mov r8d, dword [rdi + 0x10]
add r8d, r8d
cmp qword [rdi + 0x18], 7
jbe 0x14000551e
mov rdi, qword [rdi]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne sil
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, sil
jmp 0x14000554b
xor al, al
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x140021f98
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
jmp 0x14002200a
cmp ecx, 0x7c
je 0x14002200f
cmp ecx, 0x29
jne 0x14002201a
cmp dword [rbx + 0x1c], 0
jne 0x14002200f
test dword [rbx + 0x80], 0x10000000
je 0x140022155
cmp ecx, 0x5d
jne 0x140021fe1
test dword [rbx + 0x80], 0x10000000
je 0x14002211e
mov dl, byte [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.140023390
mov dil, 1
mov rcx, rbx
call fcn.140021f4c
test dil, dil
je 0x140022005
mov rcx, rbx
call fcn.140023248
mov ecx, dword [rbx + 0x7c]
mov al, 1
cmp ecx, 0xffffffff
jne 0x140021fac
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp ecx, 0x2e
jne 0x140022037
lea rcx, [rbx + 0x40]
mov edx, 5
call fcn.140022254
mov rcx, rbx
call fcn.140021f4c
jmp 0x140021ffd
cmp ecx, 0x5c
jne 0x140022095
mov rcx, rbx
call fcn.140021f4c
test byte [rbx + 0x80], 0x80
je 0x140022088
mov al, byte [rbx + 0x78]
cmp al, 0x62
jne 0x14002206c
mov edx, 4
lea rcx, [rbx + 0x40]
call fcn.140022254
mov rcx, rbx
call fcn.140021f4c
jmp 0x140022005
cmp al, 0x42
jne 0x140022088
lea rcx, [rbx + 0x40]
mov edx, 4
call fcn.140022254
mov rax, qword [rbx + 0x48]
xor dword [rax + 0xc], 1
jmp 0x140022062
mov rcx, rbx
call fcn.140023004
jmp 0x140021ffd
cmp ecx, 0x5b
jne 0x1400220b5
mov rcx, rbx
call fcn.140021f4c
mov rcx, rbx
call fcn.140022ea4
cmp dword [rbx + 0x7c], 0x5d
jne 0x140022129
jmp 0x14002202d
cmp ecx, 0x28
jne 0x1400220d8
mov rcx, rbx
call fcn.140021f4c
mov rcx, rbx
call fcn.14002314c
cmp dword [rbx + 0x7c], 0x29
mov dil, al
jne 0x140022134
jmp 0x140021ff0
cmp ecx, 0x5e
jne 0x1400220e5
lea edx, [rcx - 0x5c]
jmp 0x140022059
cmp ecx, 0x24
jne 0x1400220f2
lea edx, [rcx - 0x21]
jmp 0x140022059
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x14002214a
cmp ecx, 0x3f
je 0x14002214a
cmp ecx, 0x7b
je 0x14002214a
cmp ecx, 0x7d
jne 0x140021fcc
test dword [rbx + 0x80], 0x10000000
je 0x14002213f
jmp 0x140021fe1
mov edx, 4
call fcn.1400209a0
int3
mov edx, 4
call fcn.1400209a0
int3
mov edx, 5
call fcn.1400209a0
int3
mov edx, 6
call fcn.1400209a0
int3
mov edx, 0xa
call fcn.1400209a0
int3
mov edx, 5
call fcn.1400209a0
int3
Function at 0x140026068
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140026097
call fcn.14001980c
jmp 0x14002610e
mov rax, qword [rcx + 0x40]
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x1400260ae
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400260b0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140026108
test ecx, ecx
jle 0x1400260e9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call fcn.1400a6c90
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140026108
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140026108
mov r8, rbx
mov edx, 1
mov rcx, r15
call fcn.140091c50
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x140026128
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x140026156
xor eax, eax
jmp 0x14002623c
cmp qword [rcx + 0x68], 0
je 0x140026167
call fcn.1400198d0
jmp 0x14002623c
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14002617e
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140026180
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400261b2
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1400a6c90
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x140026236
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x1400261e9
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x140026212
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.140091f34
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x140026236
cmp rsi, rbx
ja 0x1400261f0
test rsi, rsi
je 0x140026236
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.140091f34
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140026624
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401040c0]
xor rax, rsp
mov qword [rbp - 8], rax
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x14002665d
xor eax, eax
jmp 0x14002677b
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x140026697
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
mov rcx, r8
add rcx, qword [rax]
cmp qword [rax], rcx
jae 0x140026697
lea ecx, [r8 - 1]
mov eax, esi
mov dword [rdx], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], sil
jmp 0x14002677b
cmp qword [rbx + 0x80], 0
je 0x140026779
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400266d2
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400266f2
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call fcn.140090fac
cmp eax, edi
jmp 0x140026776
lea r8, [rbp - 0x38]
mov byte [rbp - 0x40], sil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp - 0x3f]
lea r8, [rbp - 8]
mov qword [rsp + 0x30], r8
lea r8, [rbp - 0x28]
mov qword [rsp + 0x28], r8
lea r8, [rbp - 0x30]
mov qword [rsp + 0x20], r8
lea r8, [rbp - 0x40]
call qword [rax + 0x38]
test eax, eax
je 0x140026740
sub eax, 1
je 0x140026740
cmp eax, 2
jne 0x140026779
movsx ecx, byte [rbp - 0x40]
jmp 0x1400266df
mov r14, qword [rbp - 0x38]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x14002676a
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call fcn.140091c50
cmp r14, rax
jne 0x140026779
lea rax, [rbp - 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rbp - 0x30], rax
cmovne edi, esi
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400810c0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140026a50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1401040c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140026abf
cmp byte [rcx + 0x71], 0
je 0x140026abf
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
cmp eax, 0xffffffff
je 0x140026b13
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x140026ad9
sub eax, 1
je 0x140026add
cmp eax, 2
jne 0x140026b13
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400810c0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140026b0a
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.140091c50
cmp rdi, rax
jne 0x140026b13
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140026ac1
xor al, al
jmp 0x140026ac1