joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e690
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xd0
mov rax, qword [0x14004b010]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r9d, 0xa
lea rdx, str.DELSAMPLE_0_0_c_c
lea rcx, [rsp + 0x80]
lea r8d, [r9 + 3]
call fcn.140001190
mov rdi, qword [0x140103ad0]
xor ebx, ebx
cmp dword [rdi + 0x12cc310], 1
jne 0x14000e72e
mov rdi, qword [rdi + 0x1436720]
cmp dword [rdi + 8], 1
je 0x14000e72e
lea rax, [rsp + 0x80]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], bl
jne 0x14000e700
mov rcx, qword [rdi + 0xe00028]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rdi + 0xe00020], ebx
call fcn.140012230
mov rcx, qword [0x140103ad0]
test eax, eax
jne 0x14000e842
mov qword [rsp + 0xe0], rsi
add rcx, 0xbb12e0
movabs rsi, 0x100100002401
mov edx, ebx
nop dword [rax]
movzx eax, byte [rcx]
cmp al, 0x2c
ja 0x14000e76d
bt rsi, rax
jb 0x14000e77a
inc rcx
inc edx
cmp edx, 0x100
jl 0x14000e760
lea rdx, [rsp + 0x38]
mov r8d, ebx
lea rdi, [rcx + 1]
movzx ecx, byte [rdi]
cmp cl, 0x2c
ja 0x14000e794
bt rsi, rcx
jb 0x14000e7aa
mov byte [rdx], cl
inc rdi
inc rdx
inc r8d
cmp r8d, 0x100
jl 0x14000e786
jmp 0x14000e7ac
mov byte [rdx], bl
lea rcx, [rsp + 0x38]
call fcn.140021b3c
lea rdx, [rsp + 0x38]
inc rdi
mov r8d, ebx
movzx ecx, byte [rdi]
cmp cl, 0x2c
ja 0x14000e7cf
bt rsi, rcx
jb 0x14000e7e5
mov byte [rdx], cl
inc rdi
inc rdx
inc r8d
cmp r8d, 0x100
jl 0x14000e7c1
jmp 0x14000e7e7
mov byte [rdx], bl
lea rcx, [rsp + 0x38]
call fcn.140021b3c
lea rax, [rsp + 0x58]
sub rdi, rax
lea rcx, [rsp + 0x58]
nop
movzx edx, byte [rdi + rcx + 1]
cmp dl, 0x2c
ja 0x14000e810
bt rsi, rdx
jb 0x14000e821
mov byte [rcx], dl
inc ebx
inc rcx
cmp ebx, 0x100
jl 0x14000e800
jmp 0x14000e824
mov byte [rcx], 0
lea rcx, [rsp + 0x58]
call fcn.140021b3c
mov rcx, qword [0x140103ad0]
mov rsi, qword [rsp + 0xe0]
mov dword [rcx + 0x6c], eax
jmp 0x14000e850
mov eax, dword [rcx + 0x12cc3d4]
test eax, eax
cmovg ebx, eax
mov dword [rcx + 0x6c], ebx
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140019b70
mov rbx, qword [rsp + 0xe8]
add rsp, 0xd0
pop rdi
ret
Function at 0x14000eca0
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x1a0
mov rax, qword [0x14004b010]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rax, qword [0x140103ad0]
lea rcx, [rsp + 0x70]
mov dword [rax + 0x12cc38c], 0
call fcn.1400262ec
lea rcx, [rsp + 0x70]
call fcn.140026658
mov r8, qword [0x140103ad0]
mov rbx, rax
movups xmm0, xmmword [rax]
cmp dword [r8 + 0x12cc374], 0
movups xmmword [r8 + 0x14366c0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r8 + 0x14366d0], xmm1
mov ecx, dword [rax + 0x20]
mov dword [r8 + 0x14366e0], ecx
je 0x14000eebf
add r8, 0xbb0be0
lea rdx, str._sLogFile
lea rcx, [rsp + 0x90]
call fcn.140001190
lea rcx, [rsp + 0x90]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
cmp eax, 1
je 0x14000ed57
xor edx, edx
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rax, qword [0x140103ad0]
cmp dword [rax + 0x12cc3b4], 0
jne 0x14000edc7
cmp dword [rax + 0x12cc378], 2
jne 0x14000edc7
mov edx, dword [rbx + 0x10]
lea rcx, [rax + 0xbb0ce0]
mov eax, dword [rbx]
lea r8, [rsp + 0x90]
mov r9d, dword [rbx + 0x14]
inc edx
mov dword [rsp + 0x48], 0x2e
add r9d, 0x76c
mov dword [rsp + 0x40], eax
mov eax, dword [rbx + 4]
mov dword [rsp + 0x38], eax
mov eax, dword [rbx + 8]
mov dword [rsp + 0x30], eax
mov eax, dword [rbx + 0xc]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edx
lea rdx, str._slog__04d__02d_02d__02d_02d_02d_RAW_cbin
call fcn.140001190
jmp 0x14000ee6c
cmp dword [rax + 0x14366e8], 1
lea rcx, [0x140043a78]
lea rdx, [0x140043a74]
cmovne rdx, rcx
lea rcx, [rsp + 0x78]
call fcn.140001190
mov rax, qword [0x140103ad0]
lea r10, [rsp + 0x78]
mov r8d, dword [rbx + 0x10]
mov r9d, dword [rbx + 0x14]
inc r8d
mov dword [rsp + 0x60], 0x2e
add r9d, 0x76c
movsd xmm0, qword [rax + 0x18]
lea rcx, [rax + 0xbb0ce0]
mov eax, dword [rax + 0x5c]
mulsd xmm0, qword [0x140045000]
mov qword [rsp + 0x58], r10
mov dword [rsp + 0x50], eax
mov eax, dword [rbx]
cvttsd2si edx, xmm0
mov dword [rsp + 0x48], edx
lea rdx, str._slog__04d__02d_02d__02d_02d_02d_R_05d_Th_02d__s_ccsv
mov dword [rsp + 0x40], eax
mov eax, dword [rbx + 4]
mov dword [rsp + 0x38], eax
mov eax, dword [rbx + 8]
mov dword [rsp + 0x30], eax
mov eax, dword [rbx + 0xc]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r8d
lea r8, [rsp + 0x90]
call fcn.140001190
mov rax, qword [0x140103ad0]
xorps xmm0, xmm0
mov dword [rax + 0x14366bc], 1
movups xmmword [rax + 0xbb0b50], xmm0
movups xmmword [rax + 0xbb0b60], xmm0
movups xmmword [rax + 0xbb0b70], xmm0
movups xmmword [rax + 0xbb0b80], xmm0
movups xmmword [rax + 0xbb0b90], xmm0
movups xmmword [rax + 0xbb0ba0], xmm0
movups xmmword [rax + 0xbb0bb0], xmm0
movups xmmword [rax + 0xbb0bc0], xmm0
movups xmmword [rax + 0xbb0bd0], xmm0
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140019b70
add rsp, 0x1a0
pop rbx
ret
Function at 0x140012300
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x48
mov rax, qword [0x14004b010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r8, qword [0x140103ad0]
cmp dword [r8 + 0x143679c], 0
je 0x1400123c4
lea rcx, [r8 + 0x12cb2e0]
mov dword [rsp + 0x20], 0xa
mov r8d, dword [r8 + 0x1436798]
lea rdx, str.AVERAGE__d_c_c
mov r9d, InitCommonControls
call fcn.140001190
mov rdx, qword [0x140103ad0]
cmp dword [rdx + 0x12cc310], 1
jne 0x1400123b4
mov qword [rsp + 0x40], rbx
mov rbx, qword [rdx + 0x1436720]
cmp dword [rbx + 8], 1
je 0x1400123af
add rdx, 0x12cb2e0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140012380
mov rcx, qword [rbx + 0xe00028]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rbx + 0xe00020], 0
mov rbx, qword [rsp + 0x40]
call fcn.140012230
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140019b70
add rsp, 0x48
ret
Function at 0x140013750
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x140103ad0]
lea rdx, [0x140043b90]
add rcx, 0xbb0ee0
call fcn.1400254a0
mov rbx, rax
test rax, rax
jne 0x14001377e
add rsp, 0x20
pop rbx
ret
mov rcx, qword [0x140103ad0]
mov edx, 0x80
add rcx, 0xbb12e0
mov qword [rsp + 0x30], rdi
mov r9, rbx
lea r8d, [rdx - 0x7f]
call fcn.140026900
mov rcx, qword [0x140103ad0]
xor edi, edi
add rcx, 0xbb12e0
mov r9, rbx
lea edx, [rdi + 0x20]
lea r8d, [rdi + 1]
call fcn.140026900
cmp eax, 1
jl 0x14001383d
mov r8, qword [0x140103ad0]
mov r9, rbx
movzx ecx, byte [r8 + 0xbb12e8]
movzx eax, byte [r8 + 0xbb12e9]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 0xbb12ea]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 0xbb12eb]
shl ecx, 8
or ecx, eax
sub ecx, 0x20
movsxd rdx, ecx
lea rcx, [r8 + 0xbb1300]
mov r8d, 1
call fcn.140026900
mov rcx, qword [0x140103ad0]
mov edx, 0x20
add rcx, 0xbb12e0
mov r9, rbx
inc edi
lea r8d, [rdx - 0x1f]
call fcn.140026900
cmp eax, 1
jge 0x1400137c6
mov rcx, rbx
call fcn.1400259b8
mov rcx, rbx
call fcn.1400259b8
mov eax, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
Function at 0x140014510
Capabilities:
Create thread

Disassembly:
push rbx
push rdi
sub rsp, 0x78
mov rax, qword [0x14004b010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [rcx + 0xe00028]
mov edi, r8d
dec rax
mov r10, rdx
mov rbx, rcx
cmp rax, 0xfffffffffffffffd
ja 0x140014546
mov eax, 1
jmp 0x140014591
mov qword [rsp + 0x70], rsi
xor r9d, r9d
xor esi, esi
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov rcx, r10
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbx + 0xe00028], rax
cmp rax, 0xffffffffffffffff
jne 0x1400145a5
mov dword [rbx + 8], 1
xor eax, eax
mov rsi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140019b70
add rsp, 0x78
pop rdi
pop rbx
ret
mov edx, 0x100000
mov dword [rbx + 8], esi
mov r8d, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetupComm]
test eax, eax
je 0x14001458a
mov rcx, qword [rbx + 0xe00028]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetCommState]
mov eax, dword [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov rcx, qword [rbx + 0xe00028]
and eax, 0xffff8001
or eax, 1
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x48], eax
mov word [rsp + 0x52], 8
mov byte [rsp + 0x54], sil
call qword [sym.imp.KERNEL32.dll_SetCommState]
test eax, eax
je 0x14001458a
mov qword [rsp + 0x28], rsi
lea r8, [0x140014640]
mov r9, rbx
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call fcn.140025304
mov qword [rbx + 0xe00030], rax
mov eax, 1
jmp 0x14001458c
Function at 0x14001a6c4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001a70e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001a70e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001a70e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001a70e
cmp dword [rcx + 0x84], 0xe
jbe 0x14001a70e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001a710
xor al, al
add rsp, 0x28
ret

Function at 0x140026e60
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140026c50
Function at 0x14002d3d4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140037350
sub rsp, rax
mov rax, qword [0x14004b010]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14002a740
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x14002d423
mov rax, rbp
jmp 0x14002d52b
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x1032c0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.14002d018
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x1032c0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x14002d527
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14002d527
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.14002d018
test rax, rax
js 0x14002d527
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x14002d527
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x14002d519
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x14002d519
cmp byte [rcx], 0xd
jne 0x14002d4ff
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x14002d50e
cmp byte [rcx + 1], 0xa
jne 0x14002d50e
inc rcx
jmp 0x14002d50e
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x4b500]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x14002d4e1
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x14002d52b
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140019b70
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x14002d698
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x14002d675
call fcn.1400286f4
mov dword [rax], 0x16
call fcn.1400285b8
or eax, 0xffffffff
jmp 0x14002d692
sub dword [rcx + 0x10], 1
jns 0x14002d684
add rsp, 0x28
jmp fcn.14002f304
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x14002d654
Function at 0x14002e8f0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x1401032c0]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x14002e94e
cmp word [rdx], r12w
jne 0x14002e94e
or byte [rax + r8*8 + 0x38], cl
jmp 0x14002e954
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x14002eaaf
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x14002ea8a
lea r9, [rcx + 2]
cmp ax, r13w
je 0x14002e98d
mov rcx, r9
jmp 0x14002e9b0
cmp r9, rdx
jae 0x14002e9c7
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x14002e971
jmp 0x14002eaaf
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14002ea84
cmp dword [rsp + 0x80], edi
je 0x14002ea84
mov rdx, r14
lea r11, [0x1401032c0]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x14002ea5d
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x14002ea30
mov word [rbx], r12w
jmp 0x14002eaab
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x14002ea39
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x14002eaab
cmp word [rsp + 0x70], r12w
jne 0x14002ea6a
cmp rbx, rsi
je 0x14002ea2a
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.14002d020
cmp word [rsp + 0x70], r12w
je 0x14002eaaf
mov word [rbx], r13w
jmp 0x14002eaab
lea r11, [0x1401032c0]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x14002eaa7
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x14002eaaf
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14002f304
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x14002f336
call fcn.1400286f4
mov dword [rax], 0x16
call fcn.1400285b8
jmp 0x14002f455
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14002f455
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14002f455
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x14002f365
lock or dword [rcx + 0x14], 0x10
jmp 0x14002f455
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14002f379
call fcn.1400352a4
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.14002a740
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.14002ed9c
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x14002f443
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x14002f40e
mov rcx, rsi
call fcn.14002a740
cmp eax, edi
je 0x14002f3f9
mov rcx, rsi
call fcn.14002a740
cmp eax, 0xfffffffe
je 0x14002f3f9
mov rcx, rsi
call fcn.14002a740
movsxd rbx, eax
lea r14, [0x1401032c0]
mov rcx, rsi
sar rbx, 6
call fcn.14002a740
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x14002f400
lea rdx, [0x14004b170]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14002f40e
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x14002f432
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x14002f432
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x14002f432
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x14002f458
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x140030dec
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140030e1c
xor eax, eax
jmp 0x140030edf
mov rbp, rbx
cmp word [rax], si
je 0x140030e41
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140030e28
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140030e24
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140030d3c
movsxd r14, eax
test eax, eax
jne 0x140030e7f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140030e15
mov rcx, r14
call fcn.1400291a0
mov rdi, rax
test rax, rax
jne 0x140030e98
xor ecx, ecx
call fcn.14002878c
jmp 0x140030e74
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140030d3c
test eax, eax
jne 0x140030ec9
mov rcx, rdi
call fcn.14002878c
jmp 0x140030ed3
xor ecx, ecx
call fcn.14002878c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140030efc
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140030f83
mov rsi, rbx
cmp word [rax], bp
je 0x140030f42
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140030f2c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140030f28
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400291a0
mov rdi, rax
test rax, rax
je 0x140030f70
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14001d580
mov rbp, rdi
xor ecx, ecx
call fcn.14002878c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140036960
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14002d020
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14002d020
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140036ab0
cmp rax, 0xffffffffffffffff
je 0x140036ab0
xor edi, edi
test rbp, rbp
jle 0x140036a5b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140028714
mov rbx, rax
test rax, rax
jne 0x1400369e8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140036a51
mov edx, 0x8000
mov ecx, r14d
call fcn.140027ee4
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14002c7f4
cmp eax, 0xffffffff
je 0x140036a31
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400369f8
mov edx, r15d
mov ecx, r14d
call fcn.140027ee4
jmp 0x140036a51
cmp byte [rsi + 0x38], dil
je 0x140036a48
cmp dword [rsi + 0x34], 5
jne 0x140036a48
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], InitCommonControls
cmp byte [rsi + 0x30], dil
je 0x140036a51
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14002878c
jmp 0x140036ac4
jns 0x140036ac4
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14002d020
cmp rax, 0xffffffffffffffff
jne 0x140036a7c
cmp byte [rsi + 0x30], dil
je 0x140036ac4
mov edi, dword [rsi + 0x2c]
jmp 0x140036ac4
mov ecx, r14d
call fcn.140031e50
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140036ac4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, InitCommonControls
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], InitCommonControls
jmp 0x140036ac4
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140036abd
mov eax, dword [rsi + 0x2c]
jmp 0x140036ac2
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14002d020
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140037290
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400372b8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400372b8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180003210
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18000326d
lea rbx, [0x18005d400]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180003254
cmp r10, 2
jb 0x180003254
cmp byte [r9], r8b
jne 0x180003254
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180003230
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1800032af
lea rbx, [0x18005d400]
cmp r8b, 0x23
jne 0x180003293
cmp byte [r9], r8b
jne 0x180003293
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180003280
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x180003470
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x18000349f
mov r8d, 0x72f
lea rdx, str.D:.Esp_line_Sourcepandora_loaderimgui_menuimgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x1800034ab
mov qword [rdi], 0
lea rdx, [0x18005cd28]
mov rcx, rbx
call fcn.1800032c0
mov rbx, rax
test rax, rax
jne 0x1800034cd
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x1800035a6
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800035a6
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x1800035a6
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800035a6
cmp rsi, 0xffffffffffffffff
je 0x1800035a6
mov rax, qword [0x18006ecd0]
test rax, rax
je 0x180003543
inc dword [rax + 0xec]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x1800035a6
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x180003593
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x18006ecd0]
test rax, rax
je 0x180003588
dec dword [rax + 0xec]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1800035af
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x1800035a1
mov qword [rdi], rsi
mov rax, rbp
jmp 0x1800035b1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret