joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003cfc
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
movzx r14d, dx
mov rdi, rcx
mov ebx, 0xffff
xor esi, esi
cmp bx, dx
jne 0x140003d39
movzx eax, si
jmp 0x140003f0a
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140003d7a
mov r8, qword [rcx + 0x58]
movsxd r9, dword [r8]
mov rax, r9
lea rcx, [rdx + r9*2]
cmp rdx, rcx
jae 0x140003d7a
lea eax, [r9 - 1]
mov dword [r8], eax
mov rcx, qword [rdi + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 2]
mov qword [rcx], rax
mov word [rdx], r14w
movzx eax, r14w
jmp 0x140003f0a
cmp qword [rdi + 0x90], rsi
je 0x140003f07
mov rdx, qword [rdi + 0x18]
lea rax, [rdi + 0x80]
cmp qword [rdx], rax
jne 0x140003db5
mov rcx, qword [rdi + 0x70]
mov rax, qword [rdi + 0x68]
mov qword [rdx], rax
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
sub rcx, rcx
sar rcx, 1
mov rax, qword [rdi + 0x50]
mov dword [rax], ecx
cmp qword [rdi + 0x78], rsi
jne 0x140003ddd
mov rdx, qword [rdi + 0x90]
movzx ecx, r14w
call fcn.140020e90
cmp ax, bx
je 0x140003f07
movzx ebx, r14w
jmp 0x140003f07
mov word [rbp - 0x30], r14w
mov qword [rbp - 8], 0xf
mov qword [rbp - 0x10], rsi
mov byte [rbp - 0x20], sil
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rbp - 0x20]
call fcn.140005c44
nop
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
lea r8, [rbp - 0x20]
cmovae r8, qword [rbp - 0x20]
mov rcx, qword [rdi + 0x78]
mov r10, qword [rcx]
add rdx, qword [rbp - 0x10]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r8
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x2e]
lea r8, [rbp - 0x30]
lea rdx, [rdi + 0x84]
call qword [r10 + 0x38]
test eax, eax
js 0x140003ef7
cmp eax, 1
jg 0x140003ed9
lea rax, [rbp - 0x20]
mov r9, qword [rbp - 0x20]
mov r10, qword [rbp - 8]
cmp r10, 0x10
cmovae rax, r9
mov r15, qword [rbp + 0x40]
sub r15, rax
je 0x140003ea3
lea rcx, [rbp - 0x20]
cmp r10, 0x10
cmovae rcx, r9
mov r9, qword [rdi + 0x90]
mov r8, r15
mov edx, 1
call fcn.140022518
cmp r15, rax
jne 0x140003ef7
mov byte [rdi + 0x82], 1
lea rax, [rbp - 0x30]
cmp qword [rbp + 0x48], rax
jne 0x140003ef3
test r15, r15
jne 0x140003e03
cmp qword [rbp - 0x10], 0x20
jae 0x140003ef7
xor r8d, r8d
lea edx, [r15 + 8]
lea rcx, [rbp - 0x20]
call fcn.140001780
jmp 0x140003e03
cmp eax, 3
jne 0x140003ef7
mov rdx, qword [rdi + 0x90]
movzx ecx, word [rbp - 0x30]
call fcn.140020e90
cmp ax, bx
je 0x140003ef7
movzx ebx, r14w
cmp qword [rbp - 8], 0x10
jb 0x140003f07
mov rcx, qword [rbp - 0x20]
call fcn.1400208dc
movzx eax, bx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140004898
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov esi, edx
mov rdi, rcx
or ebx, 0xffffffff
cmp edx, ebx
jne 0x1400048c8
xor eax, eax
jmp 0x140004a87
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x140004902
mov rdx, qword [rdi + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x140004902
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rdi + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov byte [rdx], sil
mov eax, esi
jmp 0x140004a87
cmp qword [rdi + 0x90], 0
je 0x140004a85
mov rdx, qword [rdi + 0x18]
lea rax, [rdi + 0x80]
cmp qword [rdx], rax
jne 0x14000493a
mov rcx, qword [rdi + 0x70]
mov rax, qword [rdi + 0x68]
mov qword [rdx], rax
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
sub ecx, ecx
mov rax, qword [rdi + 0x50]
mov dword [rax], ecx
cmp qword [rdi + 0x78], 0
jne 0x14000495b
movsx ecx, sil
mov rdx, qword [rdi + 0x90]
call fcn.1400209ac
cmp eax, ebx
cmovne ebx, esi
jmp 0x140004a85
mov byte [rbp - 0x30], sil
mov qword [rbp - 8], 0xf
and qword [rbp - 0x10], 0
mov byte [rbp - 0x20], 0
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rbp - 0x20]
call fcn.140005c44
nop
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
lea r8, [rbp - 0x20]
cmovae r8, qword [rbp - 0x20]
mov rcx, qword [rdi + 0x78]
mov r10, qword [rcx]
add rdx, qword [rbp - 0x10]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r8
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x2f]
lea r8, [rbp - 0x30]
lea rdx, [rdi + 0x84]
call qword [r10 + 0x38]
test eax, eax
js 0x140004a75
cmp eax, 1
jg 0x140004a5b
lea rax, [rbp - 0x20]
mov r9, qword [rbp - 0x20]
mov r10, qword [rbp - 8]
cmp r10, 0x10
cmovae rax, r9
mov r14, qword [rbp + 0x40]
sub r14, rax
je 0x140004a21
lea rcx, [rbp - 0x20]
cmp r10, 0x10
cmovae rcx, r9
mov r9, qword [rdi + 0x90]
mov r8, r14
mov edx, 1
call fcn.140022518
cmp r14, rax
jne 0x140004a75
mov byte [rdi + 0x81], 1
lea rax, [rbp - 0x30]
cmp qword [rbp + 0x48], rax
jne 0x140004a57
test r14, r14
jne 0x140004981
cmp qword [rbp - 0x10], 0x20
jae 0x140004a75
xor r8d, r8d
lea edx, [r14 + 8]
lea rcx, [rbp - 0x20]
call fcn.140001780
jmp 0x140004981
mov ebx, esi
jmp 0x140004a75
cmp eax, 3
jne 0x140004a75
movsx ecx, byte [rbp - 0x30]
mov rdx, qword [rdi + 0x90]
call fcn.1400209ac
cmp eax, ebx
cmovne ebx, esi
cmp qword [rbp - 8], 0x10
jb 0x140004a85
mov rcx, qword [rbp - 0x20]
call fcn.1400208dc
mov eax, ebx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140005740
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, rcx
xor ebx, ebx
cmp qword [rcx + 0x78], rbx
je 0x140005891
cmp byte [rcx + 0x82], bl
je 0x140005891
mov rax, qword [rcx]
mov esi, 0xffff
mov edx, esi
call qword [rax + 0x18]
cmp si, ax
jne 0x140005797
xor al, al
jmp 0x140005896
mov qword [rbp - 0x10], 0xf
mov qword [rbp - 0x18], rbx
mov byte [rbp - 0x28], bl
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rbp - 0x28]
call fcn.140005c44
nop
mov esi, 1
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
lea r8, [rbp - 0x28]
cmovae r8, qword [rbp - 0x28]
mov rcx, qword [rdi + 0x78]
mov r10, qword [rcx]
mov r9, qword [rbp - 0x18]
add r9, rdx
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x84]
call qword [r10 + 0x40]
mov ecx, eax
test eax, eax
je 0x140005801
dec ecx
jne 0x14000586d
jmp 0x140005807
mov byte [rdi + 0x82], bl
lea rax, [rbp - 0x28]
mov r9, qword [rbp - 0x28]
mov r10, qword [rbp - 0x10]
cmp r10, 0x10
cmovae rax, r9
mov r14, qword [rbp + 0x20]
sub r14, rax
je 0x140005847
lea rcx, [rbp - 0x28]
cmp r10, 0x10
cmovae rcx, r9
mov r9, qword [rdi + 0x90]
mov r8, r14
mov rdx, rsi
call fcn.140022518
cmp r14, rax
jne 0x140005877
cmp byte [rdi + 0x82], bl
je 0x140005874
test r14, r14
jne 0x1400057bc
xor r8d, r8d
lea edx, [r14 + 8]
lea rcx, [rbp - 0x28]
call fcn.140001780
jmp 0x1400057bc
cmp ecx, 2
jne 0x14000587d
jmp 0x14000587a
mov bl, sil
mov sil, bl
mov bl, sil
cmp qword [rbp - 0x10], 0x10
jb 0x14000588d
mov rcx, qword [rbp - 0x28]
call fcn.1400208dc
mov al, bl
jmp 0x140005896
mov eax, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400059e4
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, rcx
xor ebx, ebx
cmp qword [rcx + 0x78], rbx
je 0x140005b31
cmp byte [rcx + 0x81], bl
je 0x140005b31
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
jne 0x140005a37
xor al, al
jmp 0x140005b36
mov qword [rbp - 0x10], 0xf
mov qword [rbp - 0x18], rbx
mov byte [rbp - 0x28], bl
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rbp - 0x28]
call fcn.140005c44
nop
mov esi, 1
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
lea r8, [rbp - 0x28]
cmovae r8, qword [rbp - 0x28]
mov rcx, qword [rdi + 0x78]
mov r10, qword [rcx]
mov r9, qword [rbp - 0x18]
add r9, rdx
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x84]
call qword [r10 + 0x40]
mov ecx, eax
test eax, eax
je 0x140005aa1
dec ecx
jne 0x140005b0d
jmp 0x140005aa7
mov byte [rdi + 0x81], bl
lea rax, [rbp - 0x28]
mov r9, qword [rbp - 0x28]
mov r10, qword [rbp - 0x10]
cmp r10, 0x10
cmovae rax, r9
mov r14, qword [rbp + 0x20]
sub r14, rax
je 0x140005ae7
lea rcx, [rbp - 0x28]
cmp r10, 0x10
cmovae rcx, r9
mov r9, qword [rdi + 0x90]
mov r8, r14
mov rdx, rsi
call fcn.140022518
cmp r14, rax
jne 0x140005b17
cmp byte [rdi + 0x81], bl
je 0x140005b14
test r14, r14
jne 0x140005a5c
xor r8d, r8d
lea edx, [r14 + 8]
lea rcx, [rbp - 0x28]
call fcn.140001780
jmp 0x140005a5c
cmp ecx, 2
jne 0x140005b1d
jmp 0x140005b1a
mov bl, sil
mov sil, bl
mov bl, sil
cmp qword [rbp - 0x10], 0x10
jb 0x140005b2d
mov rcx, qword [rbp - 0x28]
call fcn.1400208dc
mov al, bl
jmp 0x140005b36
mov eax, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140017990
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 8], rbx
mov r10d, dword [rcx]
mov ebx, r8d
mov r8, rcx
mov eax, ebx
mov r9d, r10d
mov r11, rdx
xor r9, rax
shr r10d, 8
movzx eax, r9b
mov r9d, dword [rdx + rax*4]
mov edx, dword [rcx + 8]
xor r9d, r10d
mov dword [rcx], r9d
movzx eax, r9b
add eax, dword [rcx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [rcx + 4], eax
mov ecx, eax
shr ecx, 0x18
xor rcx, rdx
shr edx, 8
movzx eax, cl
mov eax, dword [r11 + rax*4]
xor eax, edx
mov dword [r8 + 8], eax
mov eax, ebx
mov rbx, qword [rsp + 8]
ret

Function at 0x140017a60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push r15
sub rsp, 0x48
mov rbp, r9
mov r15, rcx
cmp r8d, 0xc
jge 0x140017a82
xor eax, eax
add rsp, 0x48
pop r15
pop rbp
ret
mov eax, dword [0x14006f480]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
inc eax
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r14
mov dword [0x14006f480], eax
cmp eax, 1
jne 0x140017ac6
xor ecx, ecx
call fcn.1400239dc
xor eax, 0xbb40e64e
mov ecx, eax
call fcn.140023a68
mov r12, qword [rsp + 0x80]
mov rdx, rbp
mov rcx, r15
mov r8, r12
call fcn.1400179f0
mov r13d, 0xa
lea rsi, [rsp + 0x20]
mov r14d, r13d
nop word [rax + rax]
call fcn.140023a3c
mov rcx, rbp
sar eax, 7
movzx edi, al
call fcn.140017970
mov r8d, edi
mov rdx, r12
mov ebx, eax
call fcn.140017990
xor dil, bl
inc rsi
dec r14
mov byte [rsi - 1], dil
jne 0x140017af0
mov r8, r12
mov rdx, rbp
mov rcx, r15
call fcn.1400179f0
mov r15, qword [rsp + 0x68]
lea rax, [rsp + 0x20]
mov r14, r15
lea rsi, [rsp + 0x20]
sub r14, rax
mov rcx, rbp
call fcn.140017970
movzx edi, byte [rsi]
mov rdx, r12
mov r8d, edi
mov ebx, eax
call fcn.140017990
xor dil, bl
inc rsi
dec r13
mov byte [r14 + rsi - 1], dil
jne 0x140017b42
mov rcx, rbp
call fcn.140017970
mov esi, dword [rsp + 0x88]
mov rdx, r12
mov ebx, esi
mov edi, eax
shr ebx, 0x10
movzx r8d, bl
call fcn.140017990
xor bl, dil
mov rcx, rbp
mov byte [r15 + 0xa], bl
call fcn.140017970
shr esi, 0x18
mov r8d, esi
mov rdx, r12
mov ebx, eax
call fcn.140017990
mov r14, qword [rsp + 0x30]
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x78]
xor sil, bl
mov rbx, qword [rsp + 0x60]
mov byte [r15 + 0xb], sil
mov rsi, qword [rsp + 0x70]
lea eax, [r13 + 0xc]
mov r13, qword [rsp + 0x38]
add rsp, 0x48
pop r15
pop rbp
ret
Function at 0x140018cf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
cmp dword [rcx + 0x10108], 0
mov rsi, rcx
je 0x140018d73
mov qword [rsp + 0x30], rbp
xor ebp, ebp
cmp dword [rcx + 0xd4], ebp
jbe 0x140018d6e
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], r12
lea rdi, [rcx + 0x100]
nop word [rax + rax]
lea rcx, [rsi + 0x10128]
call fcn.140017970
movzx r8d, byte [rdi]
mov rdx, qword [rsi + 0x10138]
lea rcx, [rsi + 0x10128]
mov ebx, eax
call fcn.140017990
xor byte [rdi], bl
inc ebp
inc rdi
cmp ebp, dword [rsi + 0xd4]
jb 0x140018d30
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov r9d, dword [rsi + 0xd4]
mov rdx, qword [rsi + 0x58]
mov rcx, qword [rsi + 0x38]
mov ebx, dword [rsi + 0xd4]
lea r8, [rsi + 0x100]
call qword [rsi + 0x10]
or ecx, 0xffffffff
xor edx, edx
cmp eax, ebx
mov dword [rsi + 0xd4], 0
cmovne edx, ecx
mov ecx, dword [rsi + 0x84]
add qword [rsi + 0x10118], rbx
mov rbx, qword [rsp + 0x48]
add qword [rsi + 0x10120], rcx
mov dword [rsi + 0x84], 0
mov eax, edx
add rsp, 0x20
pop rsi
ret
Function at 0x140039cb8
Capabilities:
Get file size

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov rax, rdx
mov rdi, rcx
xor r12d, r12d
mov dword [rbp - 0x30], r12d
cmp qword [rdx + 0x18], 8
jb 0x140039cf2
mov rax, qword [rdx]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rax
call qword [0x140070d90]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x140039d4b
lea rdx, [0x140058a16]
mov qword [rdi + 0x18], 0xf
mov qword [rdi + 0x10], r12
xor r8d, r8d
mov byte [rdi], r12b
mov rcx, rdi
call fcn.14000159c
jmp 0x140039e16
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
cmp eax, 0xffffffff
jne 0x140039d70
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x140058a17]
jmp 0x140039d2c
mov qword [rbp - 8], 0xf
mov qword [rbp - 0x10], r12
mov byte [rbp - 0x20], r12b
mov rdx, r14
test eax, eax
jne 0x140039d92
mov qword [rbp - 0x10], rdx
mov byte [rbp + r14 - 0x20], r12b
jmp 0x140039d9e
xor r8d, r8d
lea rcx, [rbp - 0x20]
call fcn.140001780
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x28]
mov r8d, r14d
mov rcx, r15
call qword [0x140070d58]
mov ebx, eax
mov rcx, r15
call qword [0x140070d98]
test ebx, ebx
je 0x140039de4
cmp dword [rbp + 0x28], r14d
jne 0x140039de4
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.140001228
jmp 0x140039e06
mov qword [rdi + 0x18], 0xf
mov qword [rdi + 0x10], r12
mov byte [rdi], r12b
xor r8d, r8d
lea rdx, [0x140058a1e]
mov rcx, rdi
call fcn.14000159c
nop
cmp qword [rbp - 8], 0x10
jb 0x140039e16
mov rcx, qword [rbp - 0x20]
call fcn.1400208dc
mov rax, rdi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14003c888
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x50
mov rbx, qword [r8]
and dword [rsp + 0x20], 0
mov rsi, rdx
mov rdi, rcx
test rbx, rbx
jne 0x14003c8da
and qword [rcx + 0x10], rbx
mov qword [rcx + 0x18], 0xf
lea rdx, [0x140058a3a]
xor r8d, r8d
mov byte [rcx], bl
call fcn.14000159c
jmp 0x14003ca2d
xor ebp, ebp
mov rax, rbx
lea r13d, [rbp + 1]
and eax, 3
jne 0x14003c8f4
cmp byte [rbx + rdx - 1], 0x3d
je 0x14003c8f4
xor r14d, r14d
jmp 0x14003c904
mov r14, r13
cmp rax, 2
ja 0x14003c909
cmp byte [rbx + rdx - 2], 0x3d
jne 0x14003c909
xor r15d, r15d
jmp 0x14003c90c
mov r15, r13
and qword [rsp + 0x38], rbp
sub rbx, r14
lea rcx, [rsp + 0x28]
and rbx, 0xfffffffffffffffc
xor r8d, r8d
mov qword [rsp + 0x40], 0xf
mov rdx, rbx
mov byte [rsp + 0x28], bpl
shr rdx, 2
lea rax, [r15 + rdx*2]
add rdx, rax
add rdx, r14
call fcn.140005c44
cmp qword [rsp + 0x40], 0x10
lea r9, [rsp + 0x28]
cmovae r9, qword [rsp + 0x28]
lea r10, [0x1400596b0]
test rbx, rbx
je 0x14003c9c4
lea rdx, [rbx - 1]
lea r8, [rsi + 1]
shr rdx, 2
add rdx, r13
movzx eax, byte [r8 - 1]
mov ecx, dword [r10 + rax*4]
movzx eax, byte [r8]
lea r8, [r8 + 4]
shl ecx, 6
or ecx, dword [r10 + rax*4]
movzx eax, byte [r8 - 3]
shl ecx, 6
or ecx, dword [r10 + rax*4]
movzx eax, byte [r8 - 2]
shl ecx, 6
or ecx, dword [r10 + rax*4]
mov eax, ecx
sar eax, 0x10
mov byte [r9 + rbp], al
add rbp, r13
mov eax, ecx
sar eax, 8
mov byte [r9 + rbp], al
add rbp, r13
mov byte [r9 + rbp], cl
add rbp, r13
sub rdx, r13
jne 0x14003c970
test r14, r14
je 0x14003ca0e
movzx eax, byte [rbx + rsi]
movzx edx, byte [rbx + rsi + 1]
mov ecx, dword [r10 + rax*4]
mov r8d, dword [r10 + rdx*4]
shl ecx, 6
or r8d, ecx
shl r8d, 0xc
mov eax, r8d
sar eax, 0x10
mov byte [r9 + rbp], al
test r15, r15
je 0x14003ca0e
movzx eax, byte [rbx + rsi + 2]
sar r8d, 8
mov ecx, dword [r10 + rax*4]
shl ecx, 6
sar ecx, 8
or cl, r8b
mov byte [r9 + rbp + 1], cl
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.140001228
cmp qword [rsp + 0x40], 0x10
jb 0x14003ca2d
mov rcx, qword [rsp + 0x28]
call fcn.1400208dc
lea r11, [rsp + 0x50]
mov rax, rdi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
Function at 0x14003d6d8
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor edi, edi
mov r15, rdx
mov rbx, rcx
mov dword [rdx], edi
mov ebp, 0x3e8
xor r9d, r9d
lea rcx, [0x14005a7b8]
xor r8d, r8d
lea edx, [r9 + 1]
mov dword [rsp + 0x20], edi
call qword [0x140070de8]
mov r14, rax
test rax, rax
jne 0x14003d724
mov ecx, ebp
call qword [0x140070d38]
jmp 0x14003d6f7
cmp qword [rbx + 0x18], 8
jb 0x14003d730
mov rdx, qword [rbx]
jmp 0x14003d733
mov rdx, rbx
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x80000000
call qword [0x140070f20]
mov rsi, rax
test rax, rax
je 0x14003d71a
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x60]
mov edx, 0x20000005
mov rcx, rax
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x70], 4
mov qword [rsp + 0x20], rdi
call qword [0x140070ef8]
mov ebx, dword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x14003d7de
mov r8d, dword [rsp + 0x60]
mov ebx, edi
mov rdx, rax
jmp 0x14003d7c6
cmp dword [rsp + 0x68], edi
jbe 0x14003d7d8
add ebx, dword [rsp + 0x68]
mov r8d, dword [rsp + 0x60]
mov edx, ebx
sub r8d, ebx
add rdx, rbp
lea r9, [rsp + 0x68]
mov rcx, rsi
call qword [0x140070ea0]
test eax, eax
jne 0x14003d7af
mov dword [r15], ebx
mov rdi, rbp
mov rcx, rsi
call qword [0x140070ee8]
mov rcx, r14
call qword [0x140070ee8]
mov rbx, qword [rsp + 0x78]
mov rax, rdi
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003f6cc
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x28]
sub rsp, 0x120
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
call fcn.14004003c
mov qword [rsp + 0x78], 0xf
xor edi, edi
mov qword [rsp + 0x70], rdi
mov byte [rsp + 0x60], dil
or rbx, 0xffffffffffffffff
cmp byte [rax], dil
jne 0x14003f713
mov r8d, edi
jmp 0x14003f71f
mov r8, rbx
inc r8
cmp byte [rax + r8], dil
jne 0x14003f716
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14000159c
nop
lea rdx, [0x1400595ac]
lea rcx, [rsp + 0x60]
call fcn.1400123fc
test al, al
jne 0x14003f75b
lea rdx, [0x1400595bc]
lea rcx, [rsp + 0x60]
call fcn.1400123fc
test al, al
je 0x14003f8bf
call fcn.1400422f8
call fcn.14003d384
lea rcx, [rbp - 0x18]
call fcn.140047038
mov qword [rsp + 0x38], 0xf
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
cmp byte [rbp - 0x18], dil
jne 0x14003f78c
mov rbx, rdi
jmp 0x14003f799
lea rax, [rbp - 0x18]
inc rbx
cmp byte [rax + rbx], dil
jne 0x14003f790
mov r8, rbx
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x20]
call fcn.14000159c
nop
lea r8, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae r8, qword [rsp + 0x20]
add r8, qword [rsp + 0x30]
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rdx, qword [rsp + 0x20]
mov ebx, 7
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x70], rdi
mov word [rbp - 0x80], di
lea rcx, [rbp - 0x80]
call fcn.14001224c
nop
lea rcx, [rbp - 0x60]
call fcn.140046fa0
nop
lea r8, [0x1400595cc]
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x40]
call fcn.1400064b0
nop
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14001461c
nop
cmp qword [rbp - 0x28], 8
jb 0x14003f82e
mov rcx, qword [rbp - 0x40]
call fcn.1400208dc
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x30], rdi
mov word [rbp - 0x40], di
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call fcn.140046c88
lea rcx, [0x14005ad20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
cmp qword [rsp + 0x58], 8
jb 0x14003f870
mov rcx, qword [rsp + 0x40]
call fcn.1400208dc
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rdi
mov word [rsp + 0x40], di
cmp qword [rbp - 0x48], 8
jb 0x14003f88f
mov rcx, qword [rbp - 0x60]
call fcn.1400208dc
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x50], rdi
mov word [rbp - 0x60], di
cmp qword [rbp - 0x68], 8
jb 0x14003f8ac
mov rcx, qword [rbp - 0x80]
call fcn.1400208dc
nop
cmp qword [rsp + 0x38], 0x10
jb 0x14003f8bf
mov rcx, qword [rsp + 0x20]
call fcn.1400208dc
nop
cmp qword [rsp + 0x78], 0x10
jb 0x14003f8d1
mov rcx, qword [rsp + 0x60]
call fcn.1400208dc
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret