joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003bf50
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14003c03c
mov rax, qword [rsp + 0x38]
xor edx, edx
sub rax, qword [0x140098f18]
mov rcx, qword [rdi]
imul rax, rax, 0xf4240
mov qword [rsp + 0x48], rsi
div qword [0x140098f10]
mov rsi, rax
add rsi, qword [0x140098f20]
test rcx, rcx
je 0x14003bfce
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
je 0x14003c049
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x30]
xor eax, eax
lea rcx, [rsp + 0x40]
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14003c02f
mov rax, qword [rsp + 0x40]
xor edx, edx
sub rax, qword [0x140098f18]
imul rax, rax, 0xf4240
div qword [0x140098f10]
sub rax, rsi
add rax, qword [0x140098f20]
lock inc dword [0x140098800]
lock xadd qword [0x140098808], rax
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
lea rcx, str.QueryPerformanceCounter_failed
call fcn.140013bd0
int3
lea rcx, str.QueryPerformanceCounter_failed
call fcn.140013bd0
int3
lea rcx, str.UnMapViewOfFile___failed
call fcn.140013bd0
int3
Function at 0x140042a00
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x4b0
mov r15, rcx
lea rcx, [rsp + 0x220]
call fcn.1400408e0
mov r12d, 0xffff
nop word [rax + rax]
movzx eax, word [rsp + 0x224]
movzx ecx, word [rsp + 0x226]
shr ax, 1
and ax, 1
cmp cx, ax
jbe 0x140042a6c
add cx, r12w
mov al, 1
mov word [rsp + 0x226], cx
jmp 0x140042a6e
xor al, al
test al, al
je 0x140042c0e
test cx, cx
je 0x140042c0e
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x20]
call fcn.140040c50
movzx eax, byte [rsp + 0x20]
lea r9, [rsp + 0x21]
mov r8d, 0x1505
test eax, eax
je 0x140042ad0
nop word [rax + rax]
lea ecx, [rax - 0x41]
cmp ecx, 0x1a
lea edx, [rax + 0x20]
lea r9, [r9 + 1]
cmovb eax, edx
imul r8d, r8d, 0x21
add r8d, eax
movzx eax, byte [r9 - 1]
test eax, eax
jne 0x140042ab0
mov rax, qword [r15]
test r8d, r8d
mov edi, 1
cmovne edi, r8d
mov ebp, dword [rax + 0x10]
test ebp, ebp
je 0x140042b38
mov rsi, qword [rax]
dec ebp
mov r14, qword [rax + 8]
mov ebx, ebp
and ebx, edi
mov ecx, ebx
mov eax, dword [rsi + rbx*4]
test eax, eax
je 0x140042b38
nop dword [rax]
cmp edi, eax
jne 0x140042b20
mov rcx, qword [r14 + rcx*8]
lea rax, [rsp + 0x20]
cmp rcx, rax
je 0x140042b2f
lea rdx, [rsp + 0x20]
call fcn.140007fb0
test eax, eax
je 0x140042b2f
inc ebx
and ebx, ebp
mov ecx, ebx
mov eax, dword [rsi + rbx*4]
test eax, eax
jne 0x140042b00
jmp 0x140042b38
cmp ebx, 0xffffffff
jne 0x140042a40
mov rax, qword [r15 + 8]
mov rbx, 0xffffffffffffffff
mov rsi, qword [rax]
lea rax, [rsp + 0x20]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140042b50
mov rcx, qword [rsi + 8]
inc rbx
mov rdx, qword [rcx + 0x18]
lea rax, [rdx + rbx]
cmp rax, qword [rcx + 0x10]
jbe 0x140042b7b
mov rdx, rbx
mov rcx, rsi
call fcn.14003bc10
xor edx, edx
mov rcx, qword [rsi + 8]
lea rax, [rdx + rbx]
lea r8, [rbx - 1]
mov rbp, qword [rcx + 0x28]
mov qword [rcx + 0x18], rax
add rbp, rdx
mov rax, qword [rsi + 8]
lea rdx, [rsp + 0x20]
mov rcx, qword [rax + 0x20]
add rcx, qword [rax + 0x18]
mov qword [rsi + 0x10], rcx
mov rcx, rbp
call fcn.14004eca0
mov byte [rbx + rbp - 1], 0
mov rbx, qword [r15]
mov esi, dword [rbx + 0x18]
movzx ecx, byte [rbx + 0x14]
inc esi
mov r8d, dword [rbx + 0x10]
mov eax, esi
shl rax, 8
shr rax, cl
cmp rax, 0x50
jbe 0x140042bdf
mov rcx, rbx
call fcn.1400111a0
mov r8d, dword [rbx + 0x10]
mov rdx, qword [rbx]
dec r8d
mov ecx, r8d
and ecx, edi
cmp dword [rdx + rcx*4], 0
je 0x140042bfb
inc ecx
and ecx, r8d
cmp dword [rdx + rcx*4], 0
jne 0x140042bf0
mov dword [rdx + rcx*4], edi
mov rax, qword [rbx + 8]
mov qword [rax + rcx*8], rbp
mov dword [rbx + 0x18], esi
jmp 0x140042a40
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140043430
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x50
mov r13d, dword [rsp + 0xa0]
mov r15, r9
mov rbp, qword [rsp + 0xb0]
mov esi, r8d
mov rdi, rdx
mov r14, rcx
test r13d, r13d
jne 0x140043486
mov r8, rdx
mov rcx, rbp
mov edx, esi
call fcn.140016040
cmp eax, 0xffffffff
jne 0x140043486
mov r8, rdi
mov edx, esi
mov rcx, rbp
call fcn.140018f40
mov rbx, qword [rsp + 0xa8]
mov r8, rdi
mov rcx, rbx
mov edx, esi
call fcn.140016040
cmp eax, 0xffffffff
je 0x1400434b0
cdqe
shl rax, 4
add rax, qword [rbx + 0x28]
jne 0x140043674
movzx ecx, byte [rbx + 0x14]
mov edx, dword [rbx + 0x10]
mov qword [rsp + 0x80], r12
mov r12d, dword [rbx + 0x18]
inc r12d
mov eax, r12d
shl rax, 8
shr rax, cl
cmp rax, 0x50
jbe 0x1400434e1
mov rcx, rbx
call fcn.14001f520
mov edx, dword [rbx + 0x10]
mov r8, qword [rbx]
lea ecx, [rdx - 1]
mov edx, ecx
and edx, esi
cmp dword [r8 + rdx*4], 0
je 0x1400434fd
inc edx
and edx, ecx
cmp dword [r8 + rdx*4], 0
jne 0x1400434f2
mov dword [r8 + rdx*4], esi
mov r9d, 0x1505
mov rax, qword [rbx + 8]
lea r8, [rdi + 1]
movsxd rcx, edx
add rcx, rcx
mov qword [rax + rdx*8], rdi
mov rax, qword [rbx + 0x28]
mov dword [rbx + 0x18], r12d
movups xmm0, xmmword [r14]
movups xmmword [rax + rcx*8], xmm0
movzx eax, byte [rdi]
test eax, eax
je 0x140043552
lea ecx, [rax - 0x41]
cmp ecx, 0x1a
lea edx, [rax + 0x20]
lea r8, [r8 + 1]
cmovb eax, edx
imul r9, r9, 0x21
mov ecx, eax
movzx eax, byte [r8 - 1]
add r9, rcx
test eax, eax
jne 0x140043530
movsxd rdx, dword [r15 + 8]
lea rdi, [r15 + 8]
test r9, r9
lea r8, [rsp + 0x40]
mov eax, 1
cmovne rax, r9
xor rax, qword [r14]
lea rcx, [rdi + rdx]
mov qword [rsp + 0x40], rax
mov rax, qword [r14 + 8]
mov qword [rsp + 0x48], rax
xor eax, eax
sub eax, edx
mov edx, dword [r15 + 4]
neg eax
sbb rax, rax
and rcx, rax
call fcn.1400064e0
mov r11, rax
test rax, rax
je 0x14004366c
movsxd rdx, dword [rdi]
lea r9, [r15 + 0xc]
movsxd r10, dword [r9]
xor ecx, ecx
sub ecx, edx
neg ecx
lea r8, [rdi + rdx]
sbb rax, rax
lea rcx, [r9 + r10]
and r8, rax
xor eax, eax
sub eax, r10d
sub r11, r8
sar r11, 4
movsxd rdx, r11d
add rdx, rdx
neg eax
sbb rax, rax
and rcx, rax
movsxd rax, dword [rcx + rdx*8 + 8]
test rax, rax
jle 0x14004366c
xor edi, edi
lea rsi, [rdx*8 + 0xc]
lea r12d, [r13 + 1]
add rsi, rcx
mov r13, rax
nop dword [rax + rax]
movsxd rcx, dword [rsi]
lea r11, [rdi*8]
xor eax, eax
mov qword [rsp + 0x30], rbp
sub eax, ecx
mov qword [rsp + 0x28], rbx
neg eax
mov dword [rsp + 0x20], r12d
lea r10, [rsi + rcx]
movsxd rcx, dword [rsi]
sbb rax, rax
and r10, rax
xor eax, eax
sub eax, ecx
add r10, r11
neg eax
lea r8, [rsi + rcx]
mov rcx, r14
sbb rax, rax
movsxd r9, dword [r10]
and r8, rax
xor eax, eax
sub eax, r9d
neg eax
mov r8d, dword [r8 + r11 + 4]
lea rdx, [r10 + r9]
sbb rax, rax
mov r9, r15
and rdx, rax
call fcn.140043430
inc rdi
cmp rdi, r13
jl 0x140043600
mov r12, qword [rsp + 0x80]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x140048760
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x560
mov rsi, rdx
mov r14, rcx
mov rdx, r9
lea rcx, [rsp + 0x2d0]
mov rdi, r8
call fcn.1400408e0
mov rbx, qword [rsp + 0x5a8]
lea rcx, [rsp + 0x40]
mov rdx, qword [rbx]
call fcn.1400408e0
cmp byte [rbx + 0x10], 0
jne 0x1400488c8
mov rdx, rsi
lea rcx, [rsp + 0x2d0]
mov eax, 5
nop dword [rax]
nop word [rax + rax]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub rax, 1
jne 0x1400487d0
mov rax, qword [rcx]
mov qword [rdx], rax
mov eax, dword [rcx + 8]
mov dword [rdx + 8], eax
movzx eax, word [rsi + 4]
movzx ecx, word [rsi + 6]
shr ax, 1
and ax, 1
cmp cx, ax
jbe 0x14004884a
dec cx
mov word [rsi + 6], cx
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140040ae0
mov rdx, rsi
mov rcx, rdi
call fcn.140040c50
movzx edx, byte [rdi]
lea r9, [rdi + 1]
mov r8d, 0x1505
test edx, edx
je 0x1400488a0
nop dword [rax]
nop word [rax + rax]
lea eax, [rdx - 0x41]
cmp eax, 0x1a
lea ecx, [rdx + 0x20]
lea r9, [r9 + 1]
cmovb edx, ecx
imul r8d, r8d, 0x21
add r8d, edx
movzx edx, byte [r9 - 1]
test edx, edx
jne 0x140048880
test r8d, r8d
lea rcx, [rsp + 0x20]
mov r9d, 1
mov rdx, r14
cmovne r9d, r8d
mov r8, rdi
call fcn.140049670
test byte [rsp + 0x20], 1
jne 0x1400489d0
mov r9, qword [rsp + 0x5a0]
xor eax, eax
movsxd rcx, dword [r9 + 8]
lea r8, [r9 + 8]
sub eax, ecx
neg eax
sbb rax, rax
lea rbx, [r8 + rcx]
movsxd rcx, dword [r8]
and rbx, rax
xor eax, eax
sub eax, ecx
neg eax
lea rdx, [r8 + rcx]
sbb rax, rax
and rdx, rax
movsxd rax, dword [r9 + 4]
lea rbp, [rdx + rax*4]
cmp rbx, rbp
je 0x1400489b1
nop dword [rax]
movsxd rcx, dword [rbx]
xor eax, eax
sub eax, ecx
neg eax
lea rdx, [rbx + rcx]
sbb rax, rax
and rdx, rax
mov rcx, rsi
call fcn.1400408e0
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140040ae0
mov rdx, rsi
mov rcx, rdi
call fcn.140040c50
movzx eax, byte [rdi]
lea r9, [rdi + 1]
mov r8d, 0x1505
test eax, eax
je 0x140048980
nop dword [rax]
nop dword [rax + rax]
lea ecx, [rax - 0x41]
cmp ecx, 0x1a
lea edx, [rax + 0x20]
lea r9, [r9 + 1]
cmovb eax, edx
imul r8d, r8d, 0x21
add r8d, eax
movzx eax, byte [r9 - 1]
test eax, eax
jne 0x140048960
test r8d, r8d
lea rcx, [rsp + 0x20]
mov r9d, 1
mov rdx, r14
cmovne r9d, r8d
mov r8, rdi
call fcn.140049670
test byte [rsp + 0x20], 1
jne 0x1400489d0
add rbx, 4
cmp rbx, rbp
jne 0x140048910
xor al, al
lea r11, [rsp + 0x560]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov al, 1
jmp 0x1400489b3
Function at 0x14004ab5c
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140096018]
xor rax, rsp
mov qword [rsp + 0x60], rax
movzx edi, r8b
mov sil, dl
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, eax
cmp eax, 0xffffffff
jne 0x14004ab9c
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14004acd1
bt edx, 0xa
jae 0x14004acb4
test sil, sil
je 0x14004acb4
mov r9d, 0x2000000
mov r8d, 0x180
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.14004b2cc
mov ebx, eax
test eax, eax
je 0x14004abee
mov rcx, qword [rsp + 0x30]
cmp rcx, 0xffffffffffffffff
je 0x14004abe7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x14004acf0
mov eax, ebx
jmp 0x14004acd1
lea r9, [0x14004ab44]
lea r8, str.GetFileInformationByHandleEx
lea rdx, [0x14008add8]
lea rcx, [0x140096e60]
call fcn.14004aae4
mov esi, 0x28
mov r9d, esi
lea r8, [rsp + 0x38]
xor edx, edx
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
call qword [0x1400774e8]
test eax, eax
jne 0x14004ac53
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp rbx, 0xffffffffffffffff
mov edi, eax
je 0x14004ac4f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x14004acf0
mov eax, edi
jmp 0x14004acd1
mov ecx, dword [rsp + 0x58]
mov eax, ecx
and eax, 1
cmp eax, edi
je 0x14004ac9f
xor ecx, 1
mov dword [rsp + 0x58], ecx
lea r9, [0x14004ab44]
lea r8, str.SetFileInformationByHandle
lea rdx, [0x14008add8]
lea rcx, [0x140096e68]
call fcn.14004aae4
mov r9d, esi
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rbx
call qword [0x1400774e8]
test eax, eax
je 0x14004ac30
cmp rbx, 0xffffffffffffffff
je 0x14004accf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x14004acf0
jmp 0x14004accf
and eax, 1
cmp eax, edi
je 0x14004accf
xor edx, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x14004ab91
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14004cc10
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.14005d2f8
int3
Function at 0x14004b324
Capabilities:
Delete directory
Delete file

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
lea rdi, [0x14004ab44]
mov r9, rdi
lea r8, str.SetFileInformationByHandle
lea rdx, [0x14008add8]
lea rcx, [0x140096e68]
call fcn.14004aae4
mov rsi, rax
cmp rax, rdi
jne 0x14004b3cc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor edi, edi
test eax, eax
je 0x14004b37a
mov byte [rsp + 0x68], 1
mov dword [rsp + 0x6c], edi
mov rax, qword [rsp + 0x68]
jmp 0x14004b3c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x10b
jne 0x14004b39a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14004b36a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x78], dil
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 2]
cmp ecx, 1
jbe 0x14004b3bb
cmp eax, 0x35
je 0x14004b3bb
cmp eax, 0x7b
mov dword [rsp + 0x7c], eax
jne 0x14004b3bf
mov dword [rsp + 0x7c], edi
mov rax, qword [rsp + 0x78]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
mov r9d, 0x2200000
mov r8d, 0x10000
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.14004b2cc
xor edi, edi
test eax, eax
je 0x14004b425
mov byte [rsp + 0x78], dil
lea ecx, [rax - 2]
cmp ecx, 1
jbe 0x14004b406
cmp eax, 0x35
je 0x14004b406
cmp eax, 0x7b
mov dword [rsp + 0x7c], eax
jne 0x14004b40a
mov dword [rsp + 0x7c], edi
mov rcx, qword [rsp + 0x30]
cmp rcx, 0xffffffffffffffff
je 0x14004b3bf
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x14004b4bf
jmp 0x14004b3bf
mov dword [rsp + 0x70], 3
mov r9d, 4
lea r8, [rsp + 0x70]
lea edx, [r9 + 0x11]
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
mov rax, rsi
call qword [0x1400774e8]
test eax, eax
je 0x14004b45c
mov byte [rsp + 0x78], 1
mov dword [rsp + 0x7c], edi
jmp 0x14004b4ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
sub ecx, 1
je 0x14004b47a
sub ecx, 0x31
je 0x14004b47a
cmp ecx, 0x25
je 0x14004b47a
mov byte [rsp + 0x78], dil
jmp 0x14004b4a9
mov byte [rsp + 0x68], 1
mov r9d, 1
lea r8, [rsp + 0x68]
lea edx, [r9 + 3]
mov rcx, rbx
mov rax, rsi
call qword [0x1400774e8]
test eax, eax
jne 0x14004b451
mov byte [rsp + 0x78], dil
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x7c], eax
cmp rbx, 0xffffffffffffffff
je 0x14004b3bf
mov rcx, rbx
jmp 0x14004b415
call fcn.14005d2f8
int3

Function at 0x14004cb46
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x198
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x1a0]
add rcx, rax
jmp 0x140052888
mov rax, rcx
mov qword [rsp + 0x58], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + rax + 0x88]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a0]
jmp 0x14004cde3
Function at 0x14004d658
Capabilities:
Enumerate pe sections
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xe8
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x58], 0
jmp 0x14004f123
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x30], rax
Function at 0x140052802
Capabilities:
Access peb ldr_data
Get process filename

Disassembly:
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0
jmp 0x14004f4e3
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x10]
sub rax, 0x10
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x30], rax
jne 0x14005295f
jmp 0x14004f058
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
lea rax, [rcx + rax*2 + 2]
mov qword [rsp + 0x38], rax
jmp 0x14004e382
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
test eax, eax
jne 0x140050e05
jmp 0x1400522b5
mov rax, qword [rsp + 0x48]
add rsp, 0x68
ret
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
test eax, eax
jne 0x140050e05
jmp 0x1400522b5
xor r9d, r9d
mov r8d, eax
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call fcn.14004f0ea
jmp 0x140053338
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
cmp eax, 0x5c
je 0x14004deb0
jmp 0x1400534a0
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x48], rax
jmp 0x14004f058
mov rcx, qword [rsp + 0x70]
call fcn.140052c98
jmp 0x14004f508
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x20]
sub rax, 0x10
jmp 0x14005358e
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14004d0a1
jmp 0x14004da35
test eax, eax
je 0x140051afa
jmp 0x14004da35
jmp 0x14004e382
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], 0
jmp 0x14005295f

Function at 0x140056df4
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140056c87
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140056c87
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140056c87
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140056c87
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140056c87
cmp dword [rcx + 0x84], 0xe
jbe 0x140056c87
cmp dword [rcx + 0xf8], 0
je 0x140056c87
mov ecx, ebx
call fcn.140056d28
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140056b18
cmp dword [rbp + 0x20], 0
je 0x140056cd4
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140056cdc
int3
xor r8d, r8d
xor edx, edx
jmp 0x140056c20
Function at 0x140068c8f
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x1450
call fcn.14004cea0
sub rsp, rax
mov rax, qword [0x140096018]
xor rax, rsp
mov qword [rsp + 0x1440], rax
movsxd r10, edx
mov rdi, rcx
mov rax, r10
mov ebp, r9d
sar rax, 6
lea rcx, [0x140098220]
and r10d, 0x3f
add rbp, r8
mov rsi, r8
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmp r8, rbp
jae 0x140068cee
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jae 0x140068ca7
movzx eax, word [rsi]
add rsi, 2
cmp ax, 0xa
jne 0x140068c93
add dword [rdi + 8], 2
mov ecx, 0xd
mov word [rbx], cx
add rbx, 2
mov word [rbx], ax
add rbx, 2
lea rax, [rsp + 0x143e]
cmp rbx, rax
jb 0x140068c71
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
sub rbx, rax
lea r9, [rsp + 0x30]
sar rbx, 1
lea rdx, [rsp + 0x40]
add ebx, ebx
mov rcx, r14
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140068ce6
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp eax, ebx
jb 0x140068cee
cmp rsi, rbp
jb 0x140068c6c
jmp 0x140068cee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
call fcn.14004cc10
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400128d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov rax, qword [rsp + 0x38]
lea rbp, [r8 - 1]
sar rbp, 1
mov rdi, r9
mov r14, r8
mov r11, rdx
mov rbx, rcx
mov rsi, rdx
cmp rdx, rbp
jge 0x14001294e
nop dword [rax + rax]
mov r8, qword [rax]
lea r10, [rdx + rdx]
mov rcx, qword [rbx + r10*8 + 0x10]
xor r9d, r9d
mov rdx, qword [rbx + r10*8 + 8]
movss xmm0, dword [r8 + rcx*4]
comiss xmm0, dword [r8 + rdx*4]
lea rdx, [r10 + 1]
seta r9b
xor r9, 1
add rdx, r9
mov rcx, qword [rbx + rdx*8]
mov qword [rbx + r11*8], rcx
mov r11, rdx
cmp rdx, rbp
jl 0x140012910
jne 0x140012963
test r14b, 1
jne 0x140012963
mov rcx, qword [rbx + r14*8 - 8]
mov qword [rbx + r11*8], rcx
lea r11, [r14 - 1]
cmp rsi, r11
jge 0x1400129a8
nop dword [rax + rax]
mov rdx, qword [rax]
lea r8, [r11 - 1]
mov rcx, qword [rdi]
sar r8, 1
mov r9, qword [rbx + r8*8]
movss xmm0, dword [rdx + r9*4]
comiss xmm0, dword [rdx + rcx*4]
jbe 0x1400129a2
mov qword [rbx + r11*8], r9
mov r11, r8
cmp rsi, r8
jl 0x140012970
mov rax, qword [rdi]
mov qword [rbx + r8*8], rax
jmp 0x1400129af
mov qword [rbx + r11*8], rcx
jmp 0x1400129af
mov rax, qword [rdi]
mov qword [rbx + r11*8], rax
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r15
pop r14
ret
Function at 0x140025a50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
dec dword [rcx + 0x80]
movzx esi, dl
movsxd r8, dword [rcx + 0x6c]
mov rbx, rcx
lea eax, [r8 - 1]
mov dword [rcx + 0x6c], eax
cmp byte [rcx + 8], 0
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax + r8*8 - 8]
je 0x140025acd
mov r9, qword [rcx + 0x78]
test r9, r9
je 0x140025aa8
mov edx, 1
lea rcx, [0x1402b2918]
lea r8d, [rdx + 1]
call fcn.140279148
jmp 0x140025bb2
add rcx, 0x110
mov edx, 2
call fcn.140027d10
movzx ecx, word [0x1402b2918]
mov word [rax - 1], cx
mov byte [rax + 1], 0
jmp 0x140025bb2
cmp dword [rcx + 0x84], 0
jge 0x140025b16
test sil, sil
jne 0x140025b16
mov rdx, qword [rcx + 0x78]
test rdx, rdx
je 0x140025af0
mov ecx, 0xa
call fcn.14027882c
jmp 0x140025b07
add rcx, 0x110
mov edx, 1
call fcn.140027d10
mov word [rax - 1], 0xa
mov rax, qword [rbx]
mov rcx, rbx
mov edx, dword [rbx + 0x80]
call qword [rax + 0x58]
mov r9, qword [rbx + 0x78]
test r9, r9
je 0x140025b36
mov edx, 1
lea rcx, [0x1402b291c]
lea r8d, [rdx + 1]
call fcn.140279148
jmp 0x140025b56
lea rcx, [rbx + 0x110]
mov edx, 2
call fcn.140027d10
movzx ecx, word [0x1402b291c]
mov word [rax - 1], cx
mov byte [rax + 1], 0
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdi + r8], 0
jne 0x140025b60
mov rdx, rdi
mov rcx, rbx
call fcn.140029310
mov r9, qword [rbx + 0x78]
test r9, r9
je 0x140025b94
mov edx, 1
lea rcx, [0x1402b2898]
mov r8d, edx
call fcn.140279148
jmp 0x140025bb2
lea rcx, [rbx + 0x110]
mov edx, 1
call fcn.140027d10
movzx ecx, byte [0x1402b2898]
mov byte [rax - 1], cl
mov byte [rax], 0
mov eax, dword [rbx + 0x80]
cmp dword [rbx + 0x84], eax
jne 0x140025bca
mov dword [rbx + 0x84], 0xffffffff
test eax, eax
jne 0x140025bfd
test sil, sil
jne 0x140025bfd
mov rdx, qword [rbx + 0x78]
test rdx, rdx
je 0x140025be6
lea ecx, [rax + 0xa]
call fcn.14027882c
jmp 0x140025bfd
lea rcx, [rbx + 0x110]
mov edx, 1
call fcn.140027d10
mov word [rax - 1], 0xa
mov rsi, qword [rsp + 0x38]
mov byte [rbx + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret