joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400142c0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x20]
xorps xmm4, xmm4
movaps xmmword [rbp + 0x50], xmm4
movaps xmmword [rbp + 0x60], xmm4
xor eax, eax
mov qword [rbp + 0x70], rax
mov rax, qword [0x1401e3840]
mov qword [rbp + 0x18], rax
test dword [rsp], esp
sub rsp, 0x210
lea rcx, [rsp + 0x20]
mov qword [rbp + 0x68], rcx
mov dword [rbp + 0x70], 0x104
xor ecx, ecx
mov dword [rbp + 0x60], ecx
mov rcx, qword gs:[0x58]
mov eax, dword [0x1401efa84]
mov edx, 0x10
add rdx, qword [rcx + rax*8]
mov rbx, qword [rdx]
test rbx, rbx
je 0x14001445f
mov qword [rbp + 0x20], rbx
jmp 0x14001434b
mov edx, ebx
sub edx, dword [rbp + 0x60]
lea rcx, [rbp + 0x58]
call fcn.140007f18
mov esi, dword [rbp + 0x70]
mov rdi, qword [rbp + 0x68]
mov qword [rbp + 0x50], rdi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov ecx, esi
mov dword [rbp + 0x14], ecx
mov rdx, rdi
mov qword [rbp + 0xc], rdx
lea rcx, [rbp + 0x28]
call fcn.1400d29d0
mov ecx, dword [rbp + 0x14]
mov rdx, qword [rbp + 0xc]
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov ebx, eax
lea rcx, [rbp + 0x28]
call fcn.1400d2a20
call sub.KERNEL32.dll_GetLastError
xor edx, edx
mov qword [rbp + 0x50], rdx
mov rsi, qword [rbp + 0x20]
mov dword [rsi + 0x90], eax
mov edx, ebx
movsxd rcx, dword [rbp + 0x70]
cmp rdx, rcx
jg 0x1400143c3
test ebx, ebx
je 0x140014480
mov dword [rbp + 0x60], ebx
mov r8d, dword [rbp + 0x60]
cmp r8d, dword [rbp + 0x70]
jbe 0x1400143cd
jmp 0x14001447a
cmp ebx, dword [rbp + 0x70]
jbe 0x14001434b
jmp 0x14001433d
mov rcx, qword [rbp + 0x68]
mov edx, 0x7e
call fcn.140026b60
test eax, eax
je 0x140014451
lea rcx, [rbp + 0x58]
xor edx, edx
call fcn.14004fc20
mov rbx, rax
mov rsi, qword [rbp + 0x58]
xorps xmm0, xmm0
movups xmmword [rbp + 0x58], xmm0
movups xmmword [rbp + 0x68], xmm0
test rsi, rsi
je 0x140014427
lea rcx, [0x140132bd0]
cmp qword [rcx - 8], 0
jne 0x140014473
mov rcx, qword [0x1401e2998]
mov rcx, qword [rcx + 8]
mov rdx, rsi
xor r8d, r8d
cmp dword [rcx], ecx
call fcn.14009d400
mov rax, rbx
lea rcx, [0x1401e3840]
mov rcx, qword [rcx]
cmp qword [rbp + 0x18], rcx
je 0x14001443f
call fcn.1400d0870
nop
lea rsp, [rbp + 0x78]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [rbp + 0x58]
call fcn.140007cf4
mov rbx, rax
jmp 0x140014427
mov rcx, rdx
lea rax, [0x14005e84c]
call rax
mov rbx, rax
jmp 0x140014337
call fcn.1400cde03
jmp 0x14001440f
call fcn.14002773c
int3
lea rcx, [0x140119af8]
call fcn.14005017c
mov rcx, rax
call fcn.1400d12b0
int3
Function at 0x140014520
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0x20]
xor eax, eax
mov qword [rbp + 0x58], rax
xorps xmm4, xmm4
movaps xmmword [rbp + 0x60], xmm4
movaps xmmword [rbp + 0x70], xmm4
mov qword [rbp + 0x80], rax
mov rax, qword [0x1401e3840]
mov qword [rbp + 0x20], rax
mov rbx, rcx
test dword [rsp], esp
sub rsp, 0x100
lea rcx, [rsp + 0x20]
mov qword [rbp + 0x78], rcx
mov dword [rbp + 0x80], 0x80
xor ecx, ecx
mov dword [rbp + 0x70], ecx
mov rcx, qword gs:[0x58]
mov eax, dword [0x1401efa84]
mov edx, 0x10
add rdx, qword [rcx + rax*8]
mov rsi, qword [rdx]
test rsi, rsi
je 0x1400146ac
mov qword [rbp + 0x28], rsi
jmp 0x1400145c1
mov edi, ebx
mov rbx, qword [rbp + 0xd0]
mov edx, edi
sub edx, dword [rbp + 0x70]
lea rcx, [rbp + 0x68]
call fcn.140007f18
mov rdi, qword [rbp + 0x78]
mov r14d, dword [rbp + 0x80]
mov qword [rbp + 0x60], rdi
test rbx, rbx
je 0x1400145e2
mov qword [rbp + 0xd0], rbx
lea r15, [rbx + 0xc]
jmp 0x1400145ec
xor r15d, r15d
mov qword [rbp + 0xd0], rbx
mov qword [rbp + 0x58], r15
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, r15
mov qword [rbp + 0x14], rcx
mov rdx, rdi
mov qword [rbp + 0xc], rdx
mov r8d, r14d
mov dword [rbp + 0x1c], r8d
lea rcx, [rbp + 0x30]
call fcn.1400d29d0
mov rcx, qword [rbp + 0x14]
mov rdx, qword [rbp + 0xc]
mov r8d, dword [rbp + 0x1c]
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
mov ebx, eax
lea rcx, [rbp + 0x30]
call fcn.1400d2a20
call sub.KERNEL32.dll_GetLastError
xor ecx, ecx
mov qword [rbp + 0x58], rcx
mov qword [rbp + 0x60], rcx
mov rsi, qword [rbp + 0x28]
mov dword [rsi + 0x90], eax
mov ecx, ebx
movsxd rax, dword [rbp + 0x80]
cmp rcx, rax
jg 0x140014694
test ebx, ebx
je 0x1400146c0
dec ebx
mov dword [rbp + 0x70], ebx
lea rcx, [rbp + 0x68]
call fcn.140007cf4
lea rcx, [0x1401e3840]
mov rcx, qword [rcx]
cmp qword [rbp + 0x20], rcx
je 0x14001467f
call fcn.1400d0870
nop
lea rsp, [rbp + 0x88]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
cmp ebx, dword [rbp + 0x80]
ja 0x1400145aa
mov rbx, qword [rbp + 0xd0]
jmp 0x1400145c1
mov rcx, rdx
lea rax, [0x14005e84c]
call rax
mov rsi, rax
jmp 0x1400145a4
lea rcx, [0x140119af8]
call fcn.14005017c
mov rcx, rax
call fcn.1400d12b0
int3
Function at 0x1400148a0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x20]
xorps xmm4, xmm4
movaps xmmword [rbp + 0x50], xmm4
movaps xmmword [rbp + 0x60], xmm4
xor eax, eax
mov qword [rbp + 0x70], rax
mov rax, qword [0x1401e3840]
mov qword [rbp + 0x10], rax
test dword [rsp], esp
sub rsp, 0x40
lea rcx, [rsp + 0x20]
mov qword [rbp + 0x68], rcx
mov dword [rbp + 0x70], 0x20
xor ecx, ecx
mov dword [rbp + 0x60], ecx
mov rcx, qword gs:[0x58]
mov eax, dword [0x1401efa84]
mov edx, 0x10
add rdx, qword [rcx + rax*8]
mov rbx, qword [rdx]
test rbx, rbx
je 0x1400149d3
mov qword [rbp + 0x18], rbx
jmp 0x140014928
mov edx, ebx
sub edx, dword [rbp + 0x60]
lea rcx, [rbp + 0x58]
call fcn.140007f18
mov rsi, qword [rbp + 0x68]
mov qword [rbp + 0x20], rsi
mov edi, dword [rbp + 0x70]
mov qword [rbp + 0x50], rsi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rsi, qword [rbp + 0x20]
mov rcx, rsi
mov qword [rbp + 4], rcx
mov edx, edi
mov dword [rbp + 0xc], edx
lea rcx, [rbp + 0x28]
call fcn.1400d29d0
mov rcx, qword [rbp + 4]
mov edx, dword [rbp + 0xc]
call sub.KERNEL32.dll_GetSystemDirectoryW
mov ebx, eax
lea rcx, [rbp + 0x28]
call fcn.1400d2a20
call sub.KERNEL32.dll_GetLastError
xor ecx, ecx
mov qword [rbp + 0x50], rcx
mov rsi, qword [rbp + 0x18]
mov dword [rsi + 0x90], eax
mov ecx, ebx
movsxd rax, dword [rbp + 0x70]
cmp rcx, rax
jg 0x1400149c5
test ebx, ebx
je 0x1400149e7
mov dword [rbp + 0x60], ebx
lea rcx, [rbp + 0x58]
call fcn.140007cf4
lea rcx, [0x1401e3840]
mov rcx, qword [rcx]
cmp qword [rbp + 0x10], rcx
je 0x1400149b3
call fcn.1400d0870
nop
lea rsp, [rbp + 0x78]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
cmp ebx, dword [rbp + 0x70]
jbe 0x140014928
jmp 0x14001491a
mov rcx, rdx
lea rax, [0x14005e84c]
call rax
mov rbx, rax
jmp 0x140014914
lea rcx, [0x140119af8]
call fcn.14005017c
mov rcx, rax
call fcn.1400d12b0
int3
Function at 0x140014a00
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0x20]
xor eax, eax
mov qword [rbp + 0x58], rax
xorps xmm4, xmm4
movaps xmmword [rbp + 0x60], xmm4
movaps xmmword [rbp + 0x70], xmm4
mov qword [rbp + 0x80], rax
mov rax, qword [0x1401e3840]
mov qword [rbp + 0x20], rax
mov rbx, rcx
test dword [rsp], esp
sub rsp, 0x100
lea rcx, [rsp + 0x20]
mov qword [rbp + 0x78], rcx
mov dword [rbp + 0x80], 0x80
xor ecx, ecx
mov dword [rbp + 0x70], ecx
mov rcx, qword gs:[0x58]
mov eax, dword [0x1401efa84]
mov edx, 0x10
add rdx, qword [rcx + rax*8]
mov rsi, qword [rdx]
test rsi, rsi
je 0x140014be2
mov qword [rbp + 0x28], rsi
jmp 0x140014a9f
mov edx, ebx
mov rbx, qword [rbp + 0xd0]
sub edx, dword [rbp + 0x70]
lea rcx, [rbp + 0x68]
call fcn.140007f18
mov rdi, qword [rbp + 0x78]
mov r14d, dword [rbp + 0x80]
mov qword [rbp + 0x60], rdi
test rbx, rbx
je 0x140014ac0
mov qword [rbp + 0xd0], rbx
lea r15, [rbx + 0xc]
jmp 0x140014aca
xor r15d, r15d
mov qword [rbp + 0xd0], rbx
mov qword [rbp + 0x58], r15
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, r15
mov qword [rbp + 0x14], rcx
mov rdx, rdi
mov qword [rbp + 0xc], rdx
mov r8d, r14d
mov dword [rbp + 0x1c], r8d
lea rcx, [rbp + 0x30]
call fcn.1400d29d0
mov rcx, qword [rbp + 0x14]
mov rdx, qword [rbp + 0xc]
mov r8d, dword [rbp + 0x1c]
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov ebx, eax
lea rcx, [rbp + 0x30]
call fcn.1400d2a20
call sub.KERNEL32.dll_GetLastError
xor ecx, ecx
mov qword [rbp + 0x58], rcx
mov qword [rbp + 0x60], rcx
mov rsi, qword [rbp + 0x28]
mov dword [rsi + 0x90], eax
mov ecx, ebx
movsxd rdx, dword [rbp + 0x80]
cmp rcx, rdx
jg 0x140014bbc
test ebx, ebx
jne 0x140014bd4
cmp dword [rsi + 0x90], 0xcb
jne 0x140014bd4
mov rdi, qword [rbp + 0x68]
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
movups xmmword [rbp + 0x78], xmm0
test rdi, rdi
je 0x140014b90
lea rcx, [0x140132bd0]
cmp qword [rcx - 8], 0
jne 0x140014bf6
mov rcx, qword [0x1401e2998]
mov rcx, qword [rcx + 8]
mov rdx, rdi
xor r8d, r8d
cmp dword [rcx], ecx
call fcn.14009d400
xor eax, eax
lea rcx, [0x1401e3840]
mov rcx, qword [rcx]
cmp qword [rbp + 0x20], rcx
je 0x140014ba7
call fcn.1400d0870
nop
lea rsp, [rbp + 0x88]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
cmp ebx, dword [rbp + 0x80]
ja 0x140014a8a
mov rbx, qword [rbp + 0xd0]
jmp 0x140014a9f
mov dword [rbp + 0x70], ebx
lea rcx, [rbp + 0x68]
call fcn.140007cf4
jmp 0x140014b92
mov rcx, rdx
lea rax, [0x14005e84c]
call rax
mov rsi, rax
jmp 0x140014a84
call fcn.1400cde03
jmp 0x140014b78
Function at 0x140015b60
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x20]
xorps xmm4, xmm4
movaps xmmword [rbp + 0x10], xmm4
xor eax, eax
mov qword [rbp + 0x20], rax
mov rax, qword [0x1401e3840]
mov qword [rbp + 8], rax
mov esi, ecx
mov ebx, edx
mov rdi, r8
mov r14d, dword [rdi + 8]
xor r15d, r15d
cmp r14d, 0x100
jae 0x140015bbb
test dword [rsp], esp
sub rsp, 0x200
lea r13, [rsp + 0x20]
mov r12d, 0x100
jmp 0x140015bfb
lea rcx, [0x140132bd0]
cmp qword [rcx - 8], 0
jne 0x140015cdd
mov rcx, qword [0x1401e2998]
mov rcx, qword [rcx + 8]
lea edx, [r14 + 1]
cmp dword [rcx], ecx
call fcn.14009d1a0
mov r15, rax
test r15, r15
jne 0x140015bf3
xor r13d, r13d
xor r12d, r12d
jmp 0x140015bfb
lea r13, [r15 + 0x10]
mov r12d, dword [r15 + 8]
mov qword [rbp + 0x10], r13
mov dword [rbp + 0x18], r12d
lea rdx, [rbp + 0x10]
mov rcx, rdi
call fcn.140033280
cmp r14d, r12d
jae 0x140015cee
mov ecx, r14d
mov word [r13 + rcx*2], 0
xor ecx, ecx
test r12d, r12d
cmovne rcx, r13
mov qword [rbp + 0x20], rcx
cmp r14d, 2
jle 0x140015c67
add r14d, 0xfffffffc
mov edx, esi
rol edx, 5
add esi, edx
mov edx, dword [rcx]
or edx, 0x200020
xor esi, edx
mov edx, ebx
rol edx, 5
add ebx, edx
mov edx, dword [rcx + 4]
or edx, 0x200020
xor ebx, edx
add rcx, 8
cmp r14d, 2
jg 0x140015c36
test r14d, r14d
jle 0x140015c7d
mov edx, ebx
rol edx, 5
add edx, ebx
mov ebx, dword [rcx]
or ebx, 0x200020
xor ebx, edx
xor ecx, ecx
mov qword [rbp + 0x20], rcx
test r15, r15
je 0x140015cae
lea rcx, [0x140132bd0]
cmp qword [rcx - 8], 0
jne 0x140015ce7
mov rcx, qword [0x1401e2998]
mov rcx, qword [rcx + 8]
mov rdx, r15
xor r8d, r8d
cmp dword [rcx], ecx
call fcn.14009d400
imul eax, ebx, 0x5d588b65
add eax, esi
lea rcx, [0x1401e3840]
mov rcx, qword [rcx]
cmp qword [rbp + 8], rcx
je 0x140015ccb
call fcn.1400d0870
nop
lea rsp, [rbp + 0x28]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.1400cde03
jmp 0x140015bcd
call fcn.1400cde03
jmp 0x140015c96
call fcn.140027714
int3
Function at 0x1400218b0
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rbx, rcx
mov esi, dword [rbx + 0x1c]
mov edi, esi
and edi, 3
cmp esi, 4
jb 0x1400218e6
mov eax, dword [rbx]
rol eax, 1
mov ecx, dword [rbx + 4]
rol ecx, 7
add eax, ecx
mov ecx, dword [rbx + 8]
rol ecx, 0xc
add eax, ecx
mov ecx, dword [rbx + 0xc]
rol ecx, 0x12
add eax, ecx
jmp 0x1400218fc
lea rbp, [0x140132878]
cmp qword [rbp - 8], 0
jne 0x14002196d
mov eax, dword [rbp]
add eax, 0x165667b1
lea eax, [rax + rsi*4]
test edi, edi
je 0x140021943
imul ecx, dword [rbx + 0x10], 0xc2b2ae3d
add eax, ecx
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
cmp edi, 1
jbe 0x140021943
imul ecx, dword [rbx + 0x14], 0xc2b2ae3d
add ecx, eax
rol ecx, 0x11
imul eax, ecx, 0x27d4eb2f
cmp edi, 2
jbe 0x140021943
imul ecx, dword [rbx + 0x18], 0xc2b2ae3d
add ecx, eax
rol ecx, 0x11
imul eax, ecx, 0x27d4eb2f
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
imul eax, ecx, 0x85ebca77
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0xc2b2ae3d
mov ecx, eax
shr ecx, 0x10
xor eax, ecx
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret
call fcn.1400cd456
jmp 0x1400218f4
Function at 0x1400266e0
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm7
mov rsi, rcx
mov rdi, r8
mov r8d, edx
mov ebx, r9d
test ebx, ebx
jne 0x140026727
xor eax, eax
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x58
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
lea ebp, [rbx - 1]
test ebp, ebp
jne 0x140026765
movsx rdx, word [rdi]
movzx ecx, dx
dec ecx
cmp ecx, 0xfe
jae 0x1400268fe
mov rcx, rsi
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x58
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400ca740
xor r14d, r14d
movzx r15d, word [rdi]
mov r13d, r8d
sub r13d, ebp
cmp r13d, 8
jge 0x1400267e8
add rdi, 2
test r13d, r13d
jle 0x1400268de
lea rcx, [rsi + r14*2]
movsx rdx, r15w
mov r8d, r13d
call fcn.1400c3680
test eax, eax
jl 0x1400268de
sub r13d, eax
movsxd rcx, eax
add r14, rcx
test r13d, r13d
jle 0x1400268de
lea rcx, [rsi + r14*2 + 2]
mov r8d, ebp
add r8, r8
mov rdx, rdi
call fcn.140026160
test eax, eax
je 0x1400268cf
mov eax, r14d
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x58
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
movsxd rcx, ebp
movzx ecx, word [rdi + rcx*2]
movsxd rbp, ebp
jmp 0x1400267fb
dec rbp
movzx ecx, word [rdi + rbp*2]
cmp ecx, r15d
jne 0x140026806
cmp rbp, 1
jg 0x1400267f4
movd xmm0, r15d
movaps xmm6, xmm0
punpcklwd xmm6, xmm0
pshufd xmm6, xmm6, 0
movd xmm0, ecx
movaps xmm7, xmm0
punpcklwd xmm7, xmm0
pshufd xmm7, xmm7, 0
movsxd r15, r13d
add r15, 0xfffffffffffffff8
jmp 0x140026833
mov r14, r15
movups xmm0, xmmword [rsi + r14*2]
pcmpeqw xmm0, xmm6
lea rcx, [r14 + rbp]
movups xmm1, xmmword [rsi + rcx*2]
pcmpeqw xmm1, xmm7
pand xmm0, xmm1
xorps xmm1, xmm1
pcmpeqb xmm1, xmm0
pmovmskb ecx, xmm1
cmp ecx, 0xffff
jne 0x140026872
add r14, 8
movsxd rcx, r13d
cmp r14, rcx
je 0x1400268de
cmp r14, r15
jle 0x140026833
jmp 0x140026830
pmovmskb r12d, xmm0
test r12d, r12d
jne 0x140026883
mov ecx, 0x20
jmp 0x140026887
bsf ecx, r12d
shr ecx, 1
mov eax, ecx
mov qword [rsp + 0x28], rax
cmp ebx, 2
je 0x1400268b4
lea rcx, [r14 + rax]
lea rcx, [rsi + rcx*2]
mov r8d, ebx
add r8, r8
mov rdx, rdi
call fcn.140026160
test eax, eax
mov rax, qword [rsp + 0x28]
je 0x1400268bc
add eax, r14d
jmp 0x1400267cd
lea eax, [r12 - 1]
and eax, r12d
lea r12d, [rax - 1]
and r12d, eax
jne 0x140026877
jmp 0x14002685f
dec r13d
inc r14
test r13d, r13d
jg 0x140026785
mov eax, 0xffffffff
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x58
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rsi
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x58
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400c3680
Function at 0x14002e864
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
cmp qword [rbx], 0
jne 0x14002e88e
lea rcx, [0x14015ac30]
mov edx, 0x55
call fcn.1400d0e60
mov rdx, rax
mov rcx, rbx
call fcn.1400d0fc0
xor eax, eax
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], eax
mov rax, qword [rbx]
cmp dword [rax + 8], 0x50
jbe 0x14002e8fc
mov dword [rax + 0x150], 0x67452301
mov rax, qword [rbx]
cmp dword [rax + 8], 0x51
jbe 0x14002e8fc
mov dword [rax + 0x154], 0xefcdab89
mov rax, qword [rbx]
cmp dword [rax + 8], 0x52
jbe 0x14002e8fc
mov dword [rax + 0x158], 0x98badcfe
mov rax, qword [rbx]
cmp dword [rax + 8], 0x53
jbe 0x14002e8fc
mov dword [rax + 0x15c], 0x10325476
mov rax, qword [rbx]
cmp dword [rax + 8], 0x54
jbe 0x14002e8fc
mov dword [rax + 0x160], 0xc3d2e1f0
add rsp, 0x20
pop rbx
ret
call fcn.140027714
int3
Function at 0x140039fc0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r14
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm7
movsd xmm6, qword [0x140187520]
movaps xmm7, xmm6
call fcn.14003a1fc
call fcn.140038550
test eax, eax
jge 0x14003a00e
mov dword [0x1401e3a00], 0xffff
xor eax, eax
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
add rsp, 0x60
pop rbx
pop rbp
pop rsi
pop rdi
pop r14
ret
lea rbx, [0x140132a80]
cmp qword [rbx - 8], 0
jne 0x14003a1c8
movabs rdx, 0x431bde82d7b634db
mov rax, rdx
imul qword [rbx]
mov rcx, rdx
shr rcx, 0x3f
sar rdx, 0x12
lea rsi, [rdx + rcx + 1]
mov ebx, 0xa
mov edi, 8
add edi, edi
lea rcx, [rsp + 0x38]
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rbp, qword [rsp + 0x38]
cmp dword [0x1401e9760], 0
jne 0x14003a1d2
test edi, edi
jle 0x14003a079
mov r14d, edi
call fcn.140038550
dec r14d
jne 0x14003a06f
lea rcx, [rsp + 0x30]
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rcx, qword [rsp + 0x30]
sub rcx, rbp
mov rbp, rcx
cmp dword [0x1401e9760], 0
jne 0x14003a1dc
cmp rbp, rsi
jl 0x14003a04a
xorps xmm0, xmm0
cvtsi2sd xmm0, rbp
xorps xmm1, xmm1
cvtsi2sd xmm1, edi
divsd xmm0, xmm1
ucomisd xmm7, xmm0
jp 0x14003a0bb
je 0x14003a0c9
ucomisd xmm7, xmm7
jp 0x14003a0d3
ucomisd xmm0, xmm7
ja 0x14003a0d3
jmp 0x14003a0d6
movq rcx, xmm7
test rcx, rcx
jge 0x14003a0c7
movaps xmm0, xmm7
movaps xmm7, xmm0
mov ecx, edi
sar ecx, 0x1f
and ecx, 3
add ecx, edi
mov edi, ecx
sar edi, 2
add edi, edi
lea rcx, [rsp + 0x28]
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rbp, qword [rsp + 0x28]
cmp dword [0x1401e9760], 0
jne 0x14003a1e6
test edi, edi
jle 0x14003a117
mov r14d, edi
call fcn.14003a1fc
dec r14d
jne 0x14003a10d
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rax, qword [rsp + 0x20]
sub rax, rbp
mov rbp, rax
cmp dword [0x1401e9760], 0
jne 0x14003a1f0
cmp rbp, rsi
jl 0x14003a0e8
xorps xmm0, xmm0
cvtsi2sd xmm0, rbp
xorps xmm1, xmm1
cvtsi2sd xmm1, edi
divsd xmm0, xmm1
ucomisd xmm6, xmm0
jp 0x14003a159
je 0x14003a167
ucomisd xmm6, xmm6
jp 0x14003a171
ucomisd xmm0, xmm6
ja 0x14003a171
jmp 0x14003a174
movq rax, xmm6
test rax, rax
jge 0x14003a165
movaps xmm0, xmm6
movaps xmm6, xmm0
dec ebx
jne 0x14003a045
movaps xmm0, xmm7
mulsd xmm0, qword [0x140187528]
divsd xmm0, xmm6
call fcn.1400d19c0
mov ecx, 0x1388
cmp eax, 0x1388
cmovg eax, ecx
mov dword [0x1401e3a00], eax
cmp dword [0x1401e3a00], 5
setle al
movzx eax, al
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
add rsp, 0x60
pop rbx
pop rbp
pop rsi
pop rdi
pop r14
ret
call fcn.1400cd5b2
jmp 0x14003a020
call fcn.1400d1b20
jmp 0x14003a068
call fcn.1400d1b20
jmp 0x14003a09b
call fcn.1400d1b20
jmp 0x14003a106
call fcn.1400d1b20
jmp 0x14003a139
Function at 0x140061714
Capabilities:
Copy file

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], rax
mov rbx, r8
mov rsi, r9
mov rdi, qword [rbp + 0x30]
mov qword [rbp - 0x40], rdi
test rdx, rdx
je 0x140061755
add rdx, 0xc
mov r14, rdx
jmp 0x140061758
xor r14d, r14d
mov qword [rbp - 0x48], r14
test rcx, rcx
je 0x14006176a
add rcx, 0xc
mov r15, rcx
jmp 0x14006176d
xor r15d, r15d
mov qword [rbp - 0x50], r15
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov qword [rsp + 0x20], rdi
mov edi, dword [rbp + 0x38]
mov dword [rsp + 0x28], edi
mov rcx, r15
mov qword [rbp - 0x80], rcx
mov rdx, r14
mov qword [rbp - 0x88], rdx
mov r8, rbx
mov qword [rbp - 0x90], r8
mov r9, rsi
mov qword [rbp - 0x98], r9
lea rcx, [rbp - 0x78]
call fcn.1400d29d0
mov rcx, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x88]
mov r8, qword [rbp - 0x90]
mov r9, qword [rbp - 0x98]
call sub.KERNEL32.dll_CopyFileExW
mov ebx, eax
lea rcx, [rbp - 0x78]
call fcn.1400d2a20
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x1401efa84]
mov edx, 0x10
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x140061832
mov dword [rdi + 0x90], esi
test ebx, ebx
setne al
movzx eax, al
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x14005e84c]
call rax
mov rdi, rax
jmp 0x140061810

Function at 0x140061844
Capabilities:
Create directory

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov rbx, rdx
test rcx, rcx
je 0x140061873
add rcx, 0xc
mov rsi, rcx
jmp 0x140061875
xor esi, esi
mov qword [rbp - 0x40], rsi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rsi
mov qword [rbp - 0x70], rcx
mov rdx, rbx
mov qword [rbp - 0x78], rdx
lea rcx, [rbp - 0x68]
call fcn.1400d29d0
mov rcx, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x78]
call sub.KERNEL32.dll_CreateDirectoryW
mov ebx, eax
lea rcx, [rbp - 0x68]
call fcn.1400d2a20
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x1401efa84]
mov edx, 0x10
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x1400618fb
mov dword [rdi + 0x90], esi
test ebx, ebx
setne al
movzx eax, al
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x14005e84c]
call rax
mov rdi, rax
jmp 0x1400618dc