joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140079d40
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rsi, r8
mov rbp, rdx
mov r14, rcx
mov qword [rsp + 0x88], rcx
xor r15d, r15d
mov qword [rcx], r15
mov qword [rcx + 8], r15
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], r15
mov qword [rcx + 0x20], r15
mov qword [rcx + 0x28], r15
mov dword [rcx + 0x30], r15d
add rcx, 0x38
xor edx, edx
mov r8d, 0x1a48
call fcn.1400fb270
mov dword [r14 + 0x1a80], r15d
lea rcx, [r14 + 0x1a88]
xor edx, edx
mov r8d, 0x1a48
call fcn.1400fb270
lea rdi, [r14 + 0x3500]
mov qword [r14 + 0x34d0], rdi
mov qword [r14 + 0x34d8], rbp
lea rbx, [r14 + 0x34e0]
mov qword [rsp + 0x90], rbx
mov qword [rbx], r15
mov qword [rbx + 8], r15
lea ecx, [r15 + 0x50]
call fcn.1400f878c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
lea rbx, [r14 + 0x34f0]
mov qword [rsp + 0x90], rbx
mov qword [rbx], r15
mov qword [rbx + 8], r15
lea ecx, [r15 + 0x50]
call fcn.1400f878c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
mov qword [rdi + 8], r15
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r15
mov qword [rdi + 0x20], r15
mov qword [rdi + 0x28], r15
mov qword [rdi + 0x30], r15
mov qword [rdi + 0x38], r15
mov qword [rdi + 0x40], rbp
mov qword [rdi + 0x48], 0xffffffffffffffff
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
mov dword [rdi], eax
mov qword [r14 + 0x3550], rsi
mov qword [r14 + 0x3558], rbp
mov qword [r14 + 0x3560], r15
mov qword [r14 + 0x3568], 0xffffffffffffffff
mov qword [r14 + 0x3570], 0xffffffffffffffff
mov qword [r14 + 0x3578], 0xffffffffffffffff
mov qword [r14 + 0x3580], r15
mov qword [r14 + 0x3588], r15
mov qword [r14 + 0x3598], r15
mov qword [r14 + 0x35a0], 7
mov word [r14 + 0x3588], r15w
mov qword [r14 + 0x35a8], r15
mov word [r14 + 0x35b0], r15w
mov qword [r14 + 0x35b4], r15
mov qword [r14 + 0x35bc], r15
mov qword [r14 + 0x35c8], r15
mov qword [r14 + 0x35d0], r15
mov qword [r14 + 0x35d8], r15
mov qword [r14 + 0x35e0], r15
mov qword [r14 + 0x35e8], r15
mov qword [r14 + 0x35f0], r15
mov qword [r14 + 0x35f8], r15
mov qword [r14 + 0x3600], r15
mov qword [r14 + 0x3608], r15
mov qword [r14 + 0x3610], r15
mov qword [r14 + 0x3618], r15
mov qword [r14 + 0x3620], r15
mov qword [r14 + 0x3628], r15
mov qword [r14 + 0x3630], r15
mov qword [r14 + 0x3638], r15
mov qword [r14 + 0x3640], r15
mov qword [r14 + 0x3648], r15
mov qword [r14 + 0x3650], r15
mov qword [r14 + 0x3658], r15
mov qword [r14 + 0x3660], r15
mov qword [r14 + 0x3668], r15
mov qword [r14 + 0x3670], r15
mov qword [r14 + 0x3678], r15
mov qword [r14 + 0x3680], r15
mov qword [r14 + 0x3688], r15
mov qword [r14 + 0x3690], r15
lea rcx, [r14 + 0x3698]
call fcn.140092620
mov qword [r14 + 0x36e0], r15
mov rax, r14
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14008e330
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1401770a0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, 0xffff
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x14008e361
xor eax, eax
jmp 0x14008e4af
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x14008e39e
mov r9, qword [rcx + 0x58]
movsxd r10, dword [r9]
lea rdx, [r8 + r10*2]
cmp r8, rdx
jae 0x14008e39e
lea ecx, [r10 - 1]
movzx eax, si
mov dword [r9], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x14008e4af
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x14008e4a4
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14008e3e5
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14008e40e
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.14010e60c
cmp ax, di
je 0x14008e4a4
movzx edi, si
jmp 0x14008e4a4
lea r8, [rsp + 0x48]
mov word [rsp + 0x40], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x42]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x40]
call qword [rax + 0x38]
test eax, eax
je 0x14008e464
sub eax, 1
je 0x14008e464
cmp eax, 2
jne 0x14008e4a4
movzx ecx, word [rsp + 0x40]
jmp 0x14008e3f1
mov rbp, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x14008e491
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call fcn.1401049ac
cmp rbp, rax
jne 0x14008e4a4
lea rax, [rsp + 0x40]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x50], rax
movzx eax, si
jne 0x14008e4a7
movzx eax, di
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400f8730
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x14008e6d0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1401770a0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14008e7a4
cmp byte [rcx + 0x72], 0
je 0x14008e7a4
mov rax, qword [rcx]
mov qword [rsp + 0x78], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x14008e7a0
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x14008e766
sub eax, 1
je 0x14008e76a
cmp eax, 2
jne 0x14008e7a0
mov byte [rbx + 0x72], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400f8730
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14008e797
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.1401049ac
cmp rdi, rax
jne 0x14008e7a0
cmp byte [rbx + 0x72], 0
sete al
jmp 0x14008e74e
xor al, al
jmp 0x14008e74e
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400f8730
add rsp, 0x60
pop rbx
ret
Function at 0x140097f90
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140097fec
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140097fec
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140097fd7
mov eax, 0x80004005
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
jle 0x140097ffc
movzx eax, ax
or eax, 0x80070000
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [rsp + 0x30]
shl rcx, 0x20
add rcx, rbx
mov qword [rdi], rcx
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400a3ae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
push r12
push r13
push r15
mov r10d, dword [r9]
xor r12d, r12d
and r10d, 7
mov r13, r9
mov edi, r8d
mov r15, rcx
mov r11d, r12d
cmp rdx, 5
jae 0x1400a3b0e
xor eax, eax
pop r15
pop r13
pop r12
pop rdi
ret
mov qword [rsp + 0x28], rbx
add edi, 5
mov qword [rsp + 0x30], rbp
lea rbx, [rdx - 4]
mov qword [rsp + 0x38], rsi
mov rbp, 0xffffffffffffffff
mov qword [rsp + 0x40], r14
add rbx, r15
mov r14d, dword [rsp + 0x48]
lea r9, [0x140000000]
nop
lea r8, [r11 + r15]
cmp r8, rbx
jae 0x1400a3b62
nop dword [rax]
movzx eax, byte [r8]
and al, 0xfe
cmp al, 0xe8
je 0x1400a3b62
inc r8
cmp r8, rbx
jb 0x1400a3b50
mov r11, r8
sub r11, r15
mov rax, r11
sub rax, rbp
cmp r8, rbx
jae 0x1400a3c87
cmp rax, 3
jbe 0x1400a3b9f
mov r10d, r12d
movzx ecx, byte [r8 + 4]
mov rbp, r11
lea eax, [rcx - 1]
cmp al, 0xfd
ja 0x1400a3be4
and r10d, 3
add r10d, r10d
or r10d, 1
inc r11
jmp 0x1400a3b40
lea ecx, [rax - 1]
shl r10d, cl
and r10d, 7
je 0x1400a3b80
cmp byte [r10 + r9 + 0x14a9f8], r12b
je 0x1400a3bce
movzx eax, byte [r10 + r9 + 0x14aa20]
mov rcx, r8
sub rcx, rax
movzx eax, byte [rcx + 4]
inc al
test al, 0xfe
jne 0x1400a3b80
and r10d, 3
mov rbp, r11
add r10d, r10d
or r10d, 1
inc r11
jmp 0x1400a3b40
movzx eax, byte [r8 + 3]
lea rsi, [r9 + 0x14aa20]
mov edx, ecx
shl edx, 8
or edx, eax
movzx eax, byte [r8 + 2]
shl edx, 8
or edx, eax
movzx eax, byte [r8 + 1]
shl edx, 8
or edx, eax
mov eax, r10d
add rsi, rax
test r14d, r14d
je 0x1400a3c1e
lea eax, [r11 + rdx]
add eax, edi
jmp 0x1400a3c25
mov eax, edx
sub eax, r11d
sub eax, edi
test r10d, r10d
je 0x1400a3c5a
movzx r9d, byte [rsi]
mov ecx, 0x18
shl r9d, 3
mov edx, eax
sub ecx, r9d
shr edx, cl
inc dl
test dl, 0xfe
jne 0x1400a3c5a
mov ecx, 0x20
mov edx, 1
sub ecx, r9d
shl edx, cl
dec edx
xor edx, eax
jmp 0x1400a3c11
mov ecx, eax
mov byte [r8 + 1], al
shr ecx, 0x18
and cl, 1
neg cl
mov byte [r8 + 4], cl
mov ecx, eax
shr ecx, 0x10
mov byte [r8 + 3], cl
mov ecx, eax
shr ecx, 8
mov byte [r8 + 2], cl
add r11, 5
jmp 0x1400a3b38
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
cmp rax, 3
ja 0x1400a3cae
lea ecx, [rax - 1]
shl r10d, cl
and r10d, 7
mov r12d, r10d
mov dword [r13], r12d
mov rax, r11
pop r15
pop r13
pop r12
pop rdi
ret
Function at 0x1400b1530
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
mov byte [rcx + 0x28], 0
mov dword [rcx + 0x42], 1
mov word [rcx + 0x46], 0x100
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
mov dword [rbx], eax
mov dword [rbx + 0x4c], 5
mov byte [rbx + 0x48], 1
mov byte [rbx + 0x50], 0
mov dword [rbx + 4], 4
mov qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 0x38], 0xffffffffffffffff
mov word [rbx + 0x40], 0
add rsp, 0x50
pop rbx
ret

Function at 0x1400b6cc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r11d, r11d
mov rbx, rcx
bts edx, 8
nop
mov ecx, edx
mov eax, edx
shr ecx, 7
add edx, edx
and ecx, 1
shr rax, 8
neg ecx
sar rcx, 4
and ecx, 0x7f
movzx r10d, word [rbx + rax*2]
shr r10, 4
xor r10, rcx
add r11d, dword [r8 + r10*4]
cmp edx, 0x10000
jb 0x1400b6cd0
mov rbx, qword [rsp + 8]
mov eax, r11d
ret

Function at 0x1400b6d10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor ebx, ebx
mov r10d, 0x100
or edx, r10d
mov r11d, r8d
mov rdi, rcx
nop dword [rax + rax]
add r11d, r11d
mov r8d, edx
shr r8d, 8
mov ecx, edx
shr ecx, 7
mov eax, r10d
and ecx, 1
and eax, r11d
neg ecx
add eax, r10d
sar rcx, 4
add r8d, eax
and ecx, 0x7f
add edx, edx
movzx r8d, word [rdi + r8*2]
shr r8, 4
xor r8, rcx
mov ecx, edx
xor ecx, r11d
not ecx
and r10d, ecx
add ebx, dword [r9 + r8*4]
cmp edx, 0x10000
jb 0x1400b6d30
mov rdi, qword [rsp + 0x10]
mov eax, ebx
mov rbx, qword [rsp + 8]
ret
Function at 0x1400b7550
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov r11, qword [rsp + 0x48]
mov ebp, r8d
movzx r10d, word [rcx]
mov r13, r9
movzx r8d, word [rcx + 2]
mov eax, r10d
shr rax, 4
xor r10, 0x7f0
shr r10, 4
mov r15d, edx
mov rbx, rcx
mov rsi, r13
mov r14d, dword [r11 + rax*4]
mov eax, r8d
shr rax, 4
xor r8, 0x7f0
shr r8, 4
mov r12d, dword [r11 + rax*4]
mov eax, dword [r11 + r8*4]
add eax, dword [r11 + r10*4]
add r12d, dword [r11 + r10*4]
mov dword [rsp + 0x48], eax
xor r9d, r9d
nop dword [rax + rax]
cmp r9d, ebp
jae 0x1400b7710
xor r10d, r10d
lea edi, [r15*8]
mov r8d, r9d
or r8d, 8
nop dword [rax + rax]
mov ecx, r8d
mov eax, r8d
and ecx, 1
shr rax, 1
neg ecx
shr r8d, 1
sar rcx, 4
add rax, rdi
and ecx, 0x7f
movzx edx, word [rbx + rax*2 + 4]
shr rdx, 4
xor rdx, rcx
add r10d, dword [r11 + rdx*4]
cmp r8d, 1
jne 0x1400b75f0
lea eax, [r10 + r14]
inc r9d
mov dword [rsi], eax
add rsi, 4
cmp r9d, 8
jb 0x1400b75d0
cmp r9d, 0x10
jae 0x1400b76a7
lea rsi, [r9*4]
add rsi, r13
cmp r9d, ebp
jae 0x1400b7710
xor r10d, r10d
lea r8d, [r9 - 8]
or r8d, 8
nop dword [rax]
mov ecx, r8d
mov eax, r8d
and ecx, 1
shr rax, 1
neg ecx
shr r8d, 1
sar rcx, 4
add rax, rdi
and ecx, 0x7f
movzx edx, word [rbx + rax*2 + 0x104]
shr rdx, 4
xor rdx, rcx
add r10d, dword [r11 + rdx*4]
cmp r8d, 1
jne 0x1400b7660
lea eax, [r10 + r12]
inc r9d
mov dword [rsi], eax
add rsi, 4
cmp r9d, 0x10
jb 0x1400b7645
cmp r9d, ebp
jae 0x1400b7710
mov esi, dword [rsp + 0x48]
lea rdi, [r9*4]
add rdi, r13
nop dword [rax + rax]
xor r10d, r10d
lea eax, [r9 - 0x10]
bts eax, 8
nop dword [rax + rax]
mov edx, eax
mov ecx, eax
and edx, 1
shr rcx, 1
neg edx
shr eax, 1
sar rdx, 4
and edx, 0x7f
movzx r8d, word [rbx + rcx*2 + 0x204]
shr r8, 4
xor r8, rdx
add r10d, dword [r11 + r8*4]
cmp eax, 1
jne 0x1400b76d0
lea eax, [r10 + rsi]
inc r9d
mov dword [rdi], eax
add rdi, 4
cmp r9d, ebp
jb 0x1400b76c0
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1400b9850
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor ebx, ebx
lea rdi, [rcx + 0x33e1c]
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx + 0x344c6]
lea rdi, [rdi + 4]
shr rax, 4
mov r9d, ebx
and r9d, 1
mov r11d, ebx
mov edx, r9d
shr r11d, 1
neg edx
or r9d, 2
sar rdx, 4
mov r8d, r11d
and edx, 0x7f
shr r11d, 1
xor rdx, rax
and r8d, 1
mov eax, r8d
inc ebx
neg eax
sar rax, 4
mov r10d, dword [rcx + rdx*4 + 0x3276c]
and eax, 0x7f
movzx edx, word [rcx + r9*2 + 0x344c4]
add r9d, r9d
shr rdx, 4
or r9d, r8d
xor rdx, rax
mov r8d, r11d
and r8d, 1
shr r11d, 1
mov eax, r8d
and r11d, 1
neg eax
add r10d, dword [rcx + rdx*4 + 0x3276c]
movzx edx, word [rcx + r9*2 + 0x344c4]
sar rax, 4
and eax, 0x7f
shr rdx, 4
xor rdx, rax
lea eax, [r9 + r9]
or eax, r8d
add r10d, dword [rcx + rdx*4 + 0x3276c]
movzx edx, word [rcx + rax*2 + 0x344c4]
mov eax, r11d
shr rdx, 4
neg eax
sar rax, 4
and eax, 0x7f
xor rdx, rax
mov edx, dword [rcx + rdx*4 + 0x3276c]
add edx, r10d
mov dword [rdi - 4], edx
cmp ebx, 0x10
jb 0x1400b9870
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov dword [rcx + 0x33e5c], 0
ret
Function at 0x1400b9f10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x50
xor ebp, ebp
mov qword [rsp + 0x68], rsi
mov qword [rcx + 0x3d5b0], rbp
lea r9, [rcx + 0x248]
mov qword [rcx + 0x3d5a8], rbp
lea r8, [rcx + 0x2d4]
mov qword [rcx + 0x288], rbp
mov edx, ebp
mov qword [rcx + 0x270], rbp
mov rdi, rcx
mov qword [rsp + 0x70], r14
mov qword [rcx + 0x2a8], 4
mov dword [rcx + 0x284], 0x20
mov qword [rcx + 0x2b8], 1
nop word [rax + rax]
mov ecx, edx
lea r8, [r8 + 4]
and ecx, 1
mov eax, edx
shr eax, 1
neg ecx
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x1400b9f80
lea rdx, [rsp + 0x20]
mov qword [rdi + 0x178], rbp
mov rcx, rdi
mov dword [rdi + 0x1c0], ebp
mov qword [rdi + 0x200], rbp
mov qword [rdi + 0x1d0], rbp
mov qword [rdi + 0x1d8], rbp
mov qword [rdi + 0x1e0], rbp
mov qword [rdi + 0x1e8], rbp
mov qword [rdi + 0x1f0], rbp
mov qword [rdi + 0x1f8], rbp
mov dword [rdi + 0x80], ebp
mov qword [rdi + 0xc0], rbp
mov qword [rdi + 0x90], rbp
mov qword [rdi + 0x98], rbp
mov qword [rdi + 0xa0], rbp
mov qword [rdi + 0xa8], rbp
mov qword [rdi + 0xb0], rbp
mov qword [rdi + 0xb8], rbp
mov qword [rdi + 0x240], r9
mov qword [rsp + 0x20], 5
mov qword [rsp + 0x44], rbp
mov dword [rsp + 0x4c], 0xffffffff
mov qword [rsp + 0x3c], 0xffffffffffffffff
mov qword [rsp + 0x34], 0xffffffffffffffff
mov qword [rsp + 0x2c], 0xffffffffffffffff
mov dword [rsp + 0x28], 0xffffffff
call fcn.1400b6920
mov esi, 2
mov word [rdi + 0x3076c], 0x100
mov r14d, esi
mov qword [rsp + 0x60], rbx
nop dword [rax]
nop dword [rax + rax]
mov ecx, esi
mov edx, 1
sar ecx, 1
dec ecx
shl edx, cl
test edx, edx
je 0x1400ba12c
mov ebx, edx
lea rcx, [rdi + 0x3076c]
mov r8d, edx
add rcx, r14
movzx edx, sil
call fcn.1400fb270
add r14, rbx
inc esi
cmp esi, 0x1a
jl 0x1400ba100
mov r14, qword [rsp + 0x70]
mov r8d, 8
mov rsi, qword [rsp + 0x68]
mov r9d, r8d
mov rbx, qword [rsp + 0x60]
nop dword [rax + rax]
mov eax, r8d
mov edx, ebp
mov ecx, 4
nop word [rax + rax]
imul eax, eax
add edx, edx
cmp eax, 0x10000
jb 0x1400ba17b
nop dword [rax]
shr eax, 1
inc edx
cmp eax, 0x10000
jae 0x1400ba170
sub rcx, 1
jne 0x1400ba160
mov rax, r9
mov ecx, 0xa1
shr rax, 4
sub ecx, edx
add r8d, 0x10
add r9, 0x10
mov dword [rdi + rax*4 + 0x3276c], ecx
cmp r8d, 0x800
jb 0x1400ba150
mov qword [rdi + 0x33e78], rbp
mov qword [rdi + 0x3d5f8], rbp
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400cb2d0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 8], 0
mov rbx, rcx
jne 0x1400cb315
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 8], rax
test rax, rax
jne 0x1400cb315
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 1
cmovne ecx, eax
test ecx, ecx
je 0x1400cb315
mov eax, ecx
add rsp, 0x30
pop rbx
ret
cmp qword [rbx + 0x10], 0
jne 0x1400cb349
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x1400cb349
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 1
cmovne ecx, eax
test ecx, ecx
jne 0x1400cb30d
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
jne 0x1400cb35d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
jne 0x1400cb371
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [rbx + 0x18], 0
mov byte [rbx + 0x20], 0
je 0x1400cb384
xor eax, eax
add rsp, 0x30
pop rbx
ret
lea rax, [rsp + 0x40]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x28], rax
lea r8, [0x1400cb270]
xor edi, edi
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call fcn.14010f89c
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x1400cb3c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov edi, 1
cmovne edi, eax
mov eax, edi
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret

Function at 0x1400cc970
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x40]
mov r9, r8
mov r8, rdx
mov qword [rsp + 0x28], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call fcn.14010f89c
mov qword [rbx], rax
test rax, rax
je 0x1400cc9aa
xor eax, eax
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 1
cmovne ecx, eax
mov eax, ecx
add rsp, 0x30
pop rbx
ret
Function at 0x1400d0610
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [r8 + 0xc], 0x105
mov rbx, r8
mov rdi, rcx
jg 0x1400d0637
mov edx, 0x105
mov rcx, rbx
call fcn.1400986c0
mov r9, qword [rbx]
lea rdx, [0x140151c10]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov r8, qword [rbx]
xor edx, edx
mov r9d, eax
cmp byte [r8], dl
je 0x1400d066b
mov rcx, r8
nop dword [rax]
inc edx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x1400d0660
movsxd rax, edx
mov byte [rax + r8], 0
mov eax, r9d
mov dword [rbx + 8], edx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400d0690
Capabilities:
Delete file
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp byte [rcx], 0
mov rsi, r9
mov rbp, rdx
mov rbx, rcx
je 0x1400d06d9
mov rdi, qword [rcx + 8]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x1400d06c9
mov al, 1
jmp 0x1400d06d7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
sete al
mov byte [rbx], al
mov r8, rsi
mov rcx, rbp
call fcn.1400d0610
mov edi, eax
test eax, eax
je 0x1400d06fb
lea rcx, [rbx + 8]
mov rdx, rsi
call fcn.1400d0710
mov eax, edi
mov byte [rbx], 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400d0c00
Capabilities:
Delete file
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x28]
call fcn.1400f877c
mov rcx, qword [rbx + 0x38]
call fcn.1400f877c
mov rcx, qword [rbx + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x1400d0c3d
cmp byte [rbx + 0x20], 0
jne 0x1400d0c3d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1400d0c3d
mov qword [rbx + 0x18], 0xffffffffffffffff
cmp byte [rbx], 0
je 0x1400d0c73
mov qword [rsp + 0x30], rdi
xor edx, edx
mov rdi, qword [rbx + 8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x1400d0c5e
mov al, 1
jmp 0x1400d0c6c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
sete al
mov rdi, qword [rsp + 0x30]
mov byte [rbx], al
mov rcx, qword [rbx + 8]
add rsp, 0x20
pop rbx
jmp fcn.1400f877c
Function at 0x1400d0c90
Capabilities:
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r14d, r8d
mov r15, rdx
mov rdi, rcx
test r8d, r8d
jne 0x1400d0cc1
mov al, 1
jmp 0x1400d0e65
xor r12d, r12d
cmp byte [rcx + 0x48], r12b
jne 0x1400d0dde
mov dword [rsp + 0x48], r12d
lea ecx, [r12 + 4]
call fcn.1400f8f68
mov rbx, rax
mov qword [rsp + 0x40], rax
mov byte [rax], r12b
mov dword [rsp + 0x4c], 4
mov ecx, 0x106
call fcn.1400f8f68
mov rsi, rax
mov rcx, rbx
call fcn.1400f877c
mov qword [rsp + 0x40], rsi
mov byte [rsi], r12b
mov dword [rsp + 0x4c], 0x106
mov rdx, rsi
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov r8d, eax
mov edx, r12d
cmp byte [rsi], dl
je 0x1400d0d3b
mov rcx, rsi
inc edx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x1400d0d30
movsxd rax, edx
mov byte [rax + rsi], 0
mov dword [rsp + 0x48], edx
lea eax, [r8 - 1]
cmp eax, 0x103
ja 0x1400d0e5b
lea r9, [rdi + 0x38]
mov rdx, rsi
mov rcx, rdi
call fcn.1400d0690
test eax, eax
je 0x1400d0e5b
mov rbx, qword [rdi + 0x38]
mov rcx, qword [rdi + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x1400d0d96
cmp byte [rdi + 0x20], 0
jne 0x1400d0d96
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1400d0e5b
mov qword [rdi + 0x18], 0xffffffffffffffff
mov byte [rdi + 0x20], 0
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rdi + 0x18], rax
cmp rax, 0xffffffffffffffff
je 0x1400d0e5b
mov byte [rdi + 0x48], 1
mov rcx, rsi
call fcn.1400f877c
mov ebx, r14d
mov rsi, r15
mov ebp, r12d
mov r13d, 0x400000
nop dword [rax]
mov r8d, ebx
cmp ebx, r13d
cmova r8d, r13d
mov dword [rsp + 0x90], r12d
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x90]
mov rdx, rsi
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x90]
add ebp, ecx
test eax, eax
je 0x1400d0e63
test ecx, ecx
je 0x1400d0e34
add rsi, rcx
sub ebx, ecx
jne 0x1400d0df0
mov ebx, ebp
lea r9, [0x14017e1e0]
mov r8d, ebp
mov rdx, r15
mov ecx, dword [rdi + 0x58]
call qword [0x14017de80]
mov dword [rdi + 0x58], eax
add qword [rdi + 0x50], rbx
cmp ebp, r14d
sete al
jmp 0x1400d0e65
mov rcx, rsi
call fcn.1400f877c
xor al, al
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret