joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404d9ec0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
jmp 0x1404d9edc
mov qword [rax + 0x18], rsi
test r9, 0x4d345c70
mov qword [rax + 0x20], rdi
clc
push r14
cmc
test r9b, 0xe1
sub rsp, 0x40
jmp 0x1404d9efc
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub r14d, r14d
clc
ror bl, 0xb6
not bl
mov rbx, rax
jmp 0x1404d9f18
test rax, rax
jmp 0x1404d9f20
je 0x1404da0a6
mov rsi, rax
cmp r13b, 0xcb
test dl, sil
cmp word [rax], r14w
jmp 0x1404d9f39
je 0x1404d9f7f
or rax, 0xffffffffffffffff
jmp 0x1404d9f48
inc rax
test edx, eax
cmp r12b, bpl
cmp word [rsi + rax*2], r14w
jmp 0x1404d9f5a
jne 0x1404d9f48
lea rsi, [rsi + rax*2]
add rsi, 2
test si, 0x71df
test bl, r9b
cmp word [rsi], r14w
jmp 0x1404d9f79
jne 0x1404d9f3f
mov qword [rsp + 0x38], r14
stc
sub rsi, rbx
bsr r8w, dx
mov qword [rsp + 0x30], r14
rcr r8w, cl
add rsi, 2
sar rsi, 1
mov r8, rbx
mov r9d, esi
cmp al, r9b
mov dword [rsp + 0x28], r14d
cmp r14, 0x337c6603
xor edx, edx
cmc
test r13, rdx
jmp 0x1404d9fbd
mov qword [rsp + 0x20], r14
stc
xor ecx, ecx
jmp 0x1404d9fca
call fcn.1404ca2a9
movsxd rbp, eax
test eax, eax
jmp 0x1404d9fd9
je 0x1404da0a6
mov rcx, rbp
jmp 0x1404d9fe7
call fcn.1404ca1f4
mov rdi, rax
test rax, rax
jmp 0x1404d9ff7
je 0x1404da088
mov qword [rsp + 0x38], r14
rcl r8w, cl
bt r8, r10
rol r8b, cl
mov r9d, esi
adc r8, 0x13ae2c9c
sar r8w, 0xc1
movsx r8d, bx
mov qword [rsp + 0x30], r14
and r8b, bl
bts r8w, dx
mov r8, rbx
test ebp, 0x2da81d7a
test sp, r11w
cmp dil, 0x81
mov dword [rsp + 0x28], ebp
xor edx, edx
stc
cmp r9b, dl
sub ecx, ecx
jmp 0x1404da04f
mov qword [rsp + 0x20], rax
jmp 0x1404da059
call fcn.1404ca2a9
test eax, eax
jmp 0x1404da065
je 0x1404da088
mov rsi, rdi
movsx rdi, si
movzx edi, r10w
jmp 0x1404da07b
mov rdi, r14
jmp 0x1404da083
jmp 0x1404da094
mov rsi, r14
mov cx, 0x1494
movsx cx, r10b
mov rcx, rdi
jmp 0x1404da09c
call fcn.1404ca184
jmp 0x1404da0b3
mov rsi, r14
cmc
cmp sil, 0x79
jmp 0x1404da0b3
test rbx, rbx
jmp 0x1404da0bb
je 0x1404da0cf
mov rcx, rbx
jmp 0x1404da0c9
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
btr r14d, ebx
movsx r14, si
clc
mov rax, rsi
cmp ah, al
sal sil, 0xc7
mov rsi, qword [rsp + 0x60]
ror r14b, cl
rcl r14, cl
mov rbp, qword [rsp + 0x58]
bt edi, ebp
ror di, cl
xchg dil, r14b
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
cmovae r14d, r10d
jmp 0x1404da117
pop r14
jmp 0x1404da11e
ret
Function at 0x1404da11f
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
cmp esp, esi
test sil, 0xc2
mov qword [rsp + 0x10], rbp
stc
test r14w, r9w
mov qword [rsp + 0x18], rsi
clc
push rdi
jmp 0x1404da143
sub rsp, 0x20
jmp 0x1404da14c
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub esi, esi
movsxd rbx, ecx
rol bh, cl
add bx, r11w
mov rbx, rax
cmc
cmp sp, 0x5694
test rax, rax
jmp 0x1404da16e
je 0x1404da23c
mov rbp, rax
cmp word [rax], si
jmp 0x1404da17f
je 0x1404da1c2
or rax, 0xffffffffffffffff
inc rax
stc
cmc
cmp word [rbp + rax*2], si
jmp 0x1404da198
jne 0x1404da189
lea rbp, [rbp + rax*2]
add rbp, 2
jmp 0x1404da1b3
cmp word [rbp], si
jmp 0x1404da1bc
jne 0x1404da185
sub rbp, rbx
shl ch, cl
add rbp, 2
or cx, r14w
rcl cl, cl
movsx cx, ch
sar rbp, 1
add rbp, rbp
movsx cx, r13b
cmovb cx, r13w
mov rcx, rbp
jmp 0x1404da1ed
call fcn.1404ca1f4
mov rdi, rax
test rax, rax
jmp 0x1404da1fd
je 0x1404da222
mov r8, rbp
cdq
movzx cx, r15b
mov rdx, rbx
movsx ecx, si
mov rcx, rax
jmp 0x1404da21a
call fcn.1404a4291
mov rsi, rdi
sub ecx, ecx
jmp 0x1404da229
call fcn.1404ca184
mov rcx, rbx
jmp 0x1404da236
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
add ah, 0x27
shl ah, cl
mov rax, rsi
not esi
mov rsi, qword [rsp + 0x40]
bts bp, r12w
shr bpl, 0xbe
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
not di
mov di, cx
movzx rdi, ax
pop rdi
ret
Function at 0x1404dd103
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
not eax
lahf
movsx rax, r8w
mov qword [rsp + 0x18], rbp
movzx rax, bp
cdqe
movsx ax, r9b
push rsi
mov rax, 0x65b5011a
push rdi
movzx eax, r8w
push r14
mov ax, r10w
movsxd rax, esi
cbw
mov eax, 0x1450
jmp 0x1404dd141
call fcn.1404490ec
sub rsp, rax
cdqe
mov r10w, dx
mov rax, qword [0x1400b7288]
shl bpl, cl
bt r14d, 0xbf
shr r10b, 0xbb
xor rax, rsp
rol bp, cl
mov bp, 0x34ae
mov qword [rsp + 0x1440], rax
bsr di, r9w
movsxd r10, edx
mov rdi, rcx
xor sil, dl
mov rax, r10
cmovo dx, r11w
rcl r14w, cl
mov ebp, r9d
mov cx, di
sar rdx, cl
sar rax, 6
lea rcx, [0x1400ba940]
clc
cwd
and r10d, 0x3f
lea rbp, [rbp + r8]
mov rsi, r8
shld r14w, sp, 0xed
mov rax, qword [rcx + rax*8]
cmp di, r15w
adc dl, r9b
bts edx, r8d
lea rdx, [r10 + r10*8]
rcr r14w, cl
jmp 0x1404dd1d3
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
cmp cx, 0x185d
mov qword [rdi], rax
cmc
mov dword [rdi + 8], eax
test r12b, 0x1a
test r8b, bl
cmp r8, rbp
jmp 0x1404dd1f5
jae 0x1404dd2f4
lea rbx, [rsp + 0x40]
cmc
jmp 0x1404dd206
cmp rsi, rbp
jmp 0x1404dd20e
jae 0x1404dd265
mov al, byte [rsi]
inc rsi
clc
cmc
cmp al, 0xa
jmp 0x1404dd222
jne 0x1404dd240
inc dword [rdi + 8]
jmp 0x1404dd230
mov byte [rbx], 0xd
jmp 0x1404dd238
inc rbx
jmp 0x1404dd240
mov byte [rbx], al
not al
inc rbx
movzx ax, sil
shrd rax, rbx, 0x72
lea rax, [rsp + 0x143f]
cmp rax, rsp
cmp rbx, rax
jb 0x1404dd206
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
mov cl, 0x98
or cx, 0x6593
sub ebx, eax
lea r9, [rsp + 0x30]
movsx dx, r9b
mov r8d, ebx
lea rdx, [rsp + 0x40]
movsx rcx, r13w
movzx rcx, r10w
xchg ch, cl
mov rcx, r14
jmp 0x1404dd29d
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404dd2aa
je 0x1404dd2e2
mov eax, dword [rsp + 0x30]
test cl, r11b
cmp di, r9w
add dword [rdi + 4], eax
cmc
cmp r8, rsi
cmp eax, ebx
jmp 0x1404dd2c9
jb 0x1404dd2f4
cmp rsi, rbp
jmp 0x1404dd2d7
jb 0x1404dd1fb
jmp 0x1404dd2f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
rol rax, 0x89
mov cl, r14b
cmp sil, r13b
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
test r11, rdx
stc
xor rcx, rsp
call fcn.1404a0686
lea r11, [rsp + 0x1450]
movzx rbx, di
mov rbx, qword [r11 + 0x20]
movsxd rbp, r8d
mov rbp, qword [r11 + 0x30]
mov rsi, 0x352e2a8f
movsx si, r13b
mov rsp, r11
pop r14
not dil
bswap rdi
pop rdi
movsxd rsi, r9d
pop rsi
jmp 0x1404dd343
ret
Function at 0x1404dd344
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movsx eax, bp
movsx rax, dx
mov qword [rsp + 0x18], rbp
push rsi
movsx eax, r11w
lahf
movsx ax, r13b
push rdi
setl ah
push r14
movsxd rax, r8d
jmp 0x1404dd376
mov eax, 0x1450
jmp 0x1404dd380
call fcn.1404490ec
sub rsp, rax
sub dil, 0x17
shr r14, cl
movsx r10w, al
mov rax, qword [0x1400b7288]
movzx r14d, sp
xor rax, rsp
mov qword [rsp + 0x1440], rax
cmp r14d, 0x39c6b19
movsx r14d, di
movsxd r10, edx
shld rdx, rdi, 0xf8
shrd rbp, rdx, 0xe1
rcr dl, 0xff
mov rdi, rcx
lahf
cdqe
mov rax, r10
cmp sil, 0x60
shl bp, 0x1e
mov ebp, r9d
movsx cx, r8b
cmovp rsi, r13
movsxd rsi, r13d
sar rax, 6
add dx, 0x668c
lea rcx, [0x1400ba940]
and r10d, 0x3f
add rbp, r8
mov rsi, r8
mov rax, qword [rcx + rax*8]
setg dh
lea rdx, [r10 + r10*8]
rol r14d, 0x81
cmc
mov r14, qword [rax + rdx*8 + 0x28]
cmc
test esi, r10d
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmp r8, rbp
jmp 0x1404dd428
jae 0x1404dd561
lea rbx, [rsp + 0x40]
test r10b, 0x3a
jmp 0x1404dd43c
cmp rsi, rbp
jmp 0x1404dd444
jae 0x1404dd4af
movzx eax, word [rsi]
add rsi, 2
cmc
cmp r14b, r13b
cmp ax, 0xa
jmp 0x1404dd45e
jne 0x1404dd485
add dword [rdi + 8], 2
cmp r10b, 0xfd
movsxd rcx, ebp
mov ecx, 0xd
jmp 0x1404dd47e
mov word [rbx], cx
add rbx, 2
mov word [rbx], ax
seto al
add rbx, 2
shr eax, 0xc1
movsxd rax, eax
lea rax, [rsp + 0x143e]
cmp r11b, 0x85
cmp rbx, rax
jmp 0x1404dd4a9
jb 0x1404dd43c
and qword [rsp + 0x20], 0
and r9w, 0x4ae8
rdtsc
test r11w, r14w
lea rax, [rsp + 0x40]
sub rbx, rax
shr r9b, cl
lea r9, [rsp + 0x30]
ror r8b, cl
xchg cl, r8b
sar rbx, 1
rcr dx, cl
shr r8b, 0x96
bts rdx, r14
lea rdx, [rsp + 0x40]
cmovs cx, cx
add ebx, ebx
movzx ecx, r12w
movsxd rcx, r15d
mov rcx, r14
movsx r8, r15w
movzx r8w, spl
bswap r8
mov r8d, ebx
jmp 0x1404dd50e
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404dd51b
je 0x1404dd551
mov eax, dword [rsp + 0x30]
test dx, di
jmp 0x1404dd52e
add dword [rdi + 4], eax
clc
stc
cmp r13d, r11d
cmp eax, ebx
jmp 0x1404dd53d
jb 0x1404dd561
cmp rsi, rbp
jb 0x1404dd42e
jmp 0x1404dd561
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
bsf cx, r10w
inc ax
mov rax, rdi
bsr cx, r14w
movsx rcx, ax
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
jmp 0x1404dd57d
call fcn.1404a0686
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
cmovle r14w, dx
bswap r14w
mov rbp, qword [r11 + 0x30]
mov rsp, r11
movzx di, r9b
pop r14
xchg di, di
movzx rsi, r9w
movsxd rsi, ebx
pop rdi
movzx si, r15b
pop rsi
jmp 0x1404dd5bb
ret
Function at 0x1404dd5bc
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
jmp 0x1404dd5f4
mov qword [rsp + 0x18], rbp
push rsi
push rdi
movsx rax, r11w
lahf
movsx ax, dil
push r12
movsx rax, sp
cbw
xchg ah, ah
push r14
push r15
lahf
movzx eax, dx
cmove eax, ebx
mov eax, 0x1470
jmp 0x1404dd624
call fcn.1404490ec
sub rsp, rax
bswap di
btr di, 0xbf
rol r10b, cl
mov rax, qword [0x1400b7288]
xor rax, rsp
mov qword [rsp + 0x1460], rax
btr r14w, 0xdf
sar al, 0xa1
shld rbx, rbp, 0xf8
movsxd r10, edx
movzx r15w, r8b
mov rbx, rcx
rcr dil, 0x39
adc dil, r14b
sbb r15b, spl
mov rax, r10
not ch
cqo
mov r14d, r9d
cmp eax, ebx
btr edi, 0x19
sar rax, 6
lea rcx, [0x1400ba940]
shl dil, 0x96
and r10d, 0x3f
mov r12d, 0x660a11a6
movsx edi, r14w
lea r14, [r14 + r8]
mov r15, r8
not rdi
btr r12, r11
cmp r11b, r11b
mov rdi, r8
bt rdx, rdx
mov rax, qword [rcx + rax*8]
not dx
inc dl
sal dh, cl
lea rdx, [r10 + r10*8]
bsr r12d, r11d
or r12w, bp
mov r12, qword [rax + rdx*8 + 0x28]
stc
sub eax, eax
test ch, 0xba
test r15b, sil
cmp sil, dil
mov qword [rbx], rax
cmp r8, r14
jmp 0x1404dd6e4
mov dword [rbx + 8], eax
jae 0x1404dd882
lea rax, [rsp + 0x50]
stc
jmp 0x1404dd6f8
cmp rdi, r14
jae 0x1404dd74d
movzx ecx, word [rdi]
cmc
add rdi, 2
cmp cx, 0xa
jne 0x1404dd727
mov edx, 0xd
cmp cx, 0x207e
mov word [rax], dx
add rax, 2
cmp cl, r9b
mov word [rax], cx
cmc
add rax, 2
ror cl, cl
bts ecx, eax
rcr ecx, 0xc9
lea rcx, [rsp + 0x6f8]
cmc
test r11b, 0xab
cmp rax, rcx
jb 0x1404dd6f8
and qword [rsp + 0x38], 0
btr r8w, di
lea rcx, [rsp + 0x50]
and qword [rsp + 0x30], 0
adc r8b, cl
neg r8b
lea r8, [rsp + 0x50]
not r9b
or r9, 0x40a376a1
btr r9w, 0xa3
sub rax, rcx
mov dword [rsp + 0x28], 0xd55
movsx r9w, r9b
sar cl, cl
lea rcx, [rsp + 0x700]
xchg r9d, r9d
sar rax, 1
sal r9w, 3
movzx r9w, r8b
mov qword [rsp + 0x20], rcx
movzx cx, sil
mov r9d, eax
xor cx, ax
mov ecx, 0xfde9
sub edx, edx
jmp 0x1404dd7c4
call fcn.1404ca2a9
mov ebp, eax
test eax, eax
je 0x1404dd872
xor esi, esi
stc
test eax, eax
je 0x1404dd84a
and qword [rsp + 0x20], 0
btr r8, r13
cmp r13b, dil
cdq
lea rdx, [rsp + 0x700]
mov ecx, esi
rcr r8w, 0xb7
neg r8b
bsf r9w, cx
lea r9, [rsp + 0x40]
rcr r8d, cl
mov r8d, ebp
cmc
cmp r10b, 0x5b
add rdx, rcx
mov rcx, r12
jmp 0x1404dd81e
sub r8d, esi
jmp 0x1404dd826
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404dd833
je 0x1404dd872
add esi, dword [rsp + 0x40]
cmp esi, ebp
jmp 0x1404dd844
jb 0x1404dd7de
mov eax, edi
jmp 0x1404dd856
sub eax, r15d
stc
test edi, r10d
mov dword [rbx + 4], eax
jmp 0x1404dd86a
cmp rdi, r14
jmp 0x1404dd6e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
bt cx, 0x62
sbb ah, 0x15
mov rax, rbx
sbb cl, r11b
btr cx, 0x2e
adc cx, r14w
mov rcx, qword [rsp + 0x1460]
jmp 0x1404dd89e
xor rcx, rsp
jmp 0x1404dd8a6
call fcn.1404a0686
lea r11, [rsp + 0x1470]
movzx r12d, di
mov rbx, qword [r11 + 0x30]
not sil
mov rbp, qword [r11 + 0x40]
movzx si, dl
mov rsp, r11
xchg r15w, r15w
setne dil
pop r15
xchg r14w, r12w
bswap r14d
mov r12b, bpl
pop r14
movsx di, dil
xchg dil, dil
bswap di
pop r12
mov esi, r9d
setne sil
pop rdi
movsxd rsi, r12d
pop rsi
jmp 0x1404dd8fd
ret
Function at 0x1404e0cfe
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
btr r8w, 0xfa
movsx r9, di
sbb r9d, r9d
sub rsp, 0x20
mov rbx, rcx
movzx r9w, r8b
lea r9, [0x1400c8e90]
shl dh, cl
ror dh, 0x56
dec rdx
sub ecx, ecx
bswap dx
lea r8, [0x1400c8e88]
lea rdx, [0x1400cfb70]
call fcn.1404e0ff1
test rax, rax
jmp 0x1404e0d48
je 0x1404e0d6a
mov rcx, rbx
xchg bl, bh
and bh, 5
add rsp, 0x20
movsx ebx, ax
pop rbx
jmp 0x1404e0d63
push qword [0x1400b8d90]
ret
add rsp, 0x20
movsx rbx, r15w
pop rbx
jmp 0x1404e0d78
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1404e0e03
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
bswap r9d
movsx edx, r12w
cdq
mov ebx, ecx
lea r9, [0x1400c8ea0]
mov ecx, 2
mov r8b, r13b
lea r8, [0x1400c8e98]
cmovg edx, r14d
lea rdx, [0x1400cf758]
jmp 0x1404e0e39
call fcn.1404e0ff1
mov ecx, ebx
cmc
test dl, 0xd6
test rax, rax
jmp 0x1404e0e4c
je 0x1404e0e63
add rsp, 0x20
pop rbx
jmp 0x1404e0e5c
push qword [0x1400b8d90]
ret
add rsp, 0x20
bswap ebx
pop rbx
jmp 0x1404e0e6f
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404e0e76
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
setne r8b
sub rsp, 0x20
cmovne r8d, edx
movzx r9w, r12b
movsx r8w, r9b
mov rbx, rdx
lea r9, [0x1400c8ea8]
movsxd r8, r14d
setnp dl
bswap r8w
mov edi, ecx
cwd
movsx cx, sil
setp dl
lea rdx, [0x1400cf748]
xchg r8w, cx
movsx cx, cl
mov cl, r15b
mov ecx, 3
mov r8d, r14d
movzx r8d, r15w
bswap r8
lea r8, [0x1400c8ea0]
call fcn.1404e0ff1
mov rdx, rbx
rol ch, cl
mov ecx, edi
test rax, rax
jmp 0x1404e0eee
je 0x1404e0eff
call qword [0x1400b8d90]
jmp 0x1404e0f05
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
jmp 0x1404e0f19
pop rdi
jmp 0x1404e0f1f
ret
Function at 0x1404e2607
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
xor r9d, r9d
shl r8b, 0x66
add r8b, r14b
add r8b, 0x50
mov r8, rcx
clc
test edx, edx
jmp 0x1404e2625
jne 0x1404e269d
mov rdx, rcx
and r8d, 0xf
clc
cmc
and rdx, 0xfffffffffffffff0
stc
or r10d, 0xffffffff
jmp 0x1404e2642
xorps xmm0, xmm0
mov ecx, r8d
cmp dx, bp
shl r10d, cl
jmp 0x1404e2653
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and eax, r10d
jmp 0x1404e2663
jne 0x1404e2685
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
test eax, eax
jmp 0x1404e267f
je 0x1404e2669
bsf eax, eax
jmp 0x1404e2690
add rax, rdx
jmp 0x1404e2698
jmp 0x1404e27d9
cmp dword [reloc.d2d1.dll_Ordinal_1], 2
jmp 0x1404e26a9
jge 0x1404e2810
movzx eax, dl
or r10d, 0xffffffff
movsx ecx, bp
rcl r11b, cl
jmp 0x1404e26c1
mov ecx, eax
mov r11, r8
jmp 0x1404e26cf
shl ecx, 8
cmp si, r13w
cmp sil, 0x1b
test r15w, si
and r11, 0xfffffffffffffff0
stc
test r8, 0x68911d19
test r8b, spl
or ecx, eax
and r8d, 0xf
mov eax, r10d
jmp 0x1404e26fb
movd xmm0, ecx
mov ecx, r8d
pshuflw xmm1, xmm0, 0
xorps xmm0, xmm0
pcmpeqb xmm0, xmmword [r11]
pmovmskb ebx, xmm0
shl r10d, cl
pshufd xmm2, xmm1, 0
movdqa xmm0, xmm2
shl eax, cl
jmp 0x1404e2726
pcmpeqb xmm0, xmmword [r11]
pmovmskb edx, xmm0
and edx, r10d
and ebx, eax
jmp 0x1404e2739
jne 0x1404e2784
bsr ecx, edx
jmp 0x1404e2747
xorps xmm1, xmm1
movdqa xmm0, xmm2
lea rcx, [rcx + r11]
test edx, edx
jmp 0x1404e2759
cmovne r9, rcx
cmp r13w, di
add r11, 0x10
pcmpeqb xmm1, xmmword [r11]
pcmpeqb xmm0, xmmword [r11]
pmovmskb ebx, xmm1
pmovmskb edx, xmm0
test ebx, ebx
jmp 0x1404e277e
je 0x1404e273f
mov eax, ebx
xor cl, 0x60
neg eax
movsx ecx, r14w
inc cl
and eax, ebx
mov cl, 0x27
dec eax
btr bx, 0xf4
and edx, eax
bsr ecx, edx
jmp 0x1404e27af
add rcx, r11
movsx rax, r11w
setno al
test edx, edx
movzx rax, cx
xchg bh, ah
movsx ebx, dx
cmovne r9, rcx
mov bl, 0x72
mov eax, r12d
nop
mov rax, r9
movzx ebx, bp
movsx bx, r15b
mov rbx, qword [rsp + 8]
jmp 0x1404e27e3
ret
movsx eax, byte [r8]
cmp eax, edx
jmp 0x1404e27ef
cmove r9, r8
jmp 0x1404e27fe
cmp byte [r8], 0
jmp 0x1404e2807
je 0x1404e27ce
inc r8
test r8b, 0xf
jmp 0x1404e2819
jne 0x1404e27e4
movzx eax, dl
jmp 0x1404e2827
movd xmm0, eax
pcmpistri xmm0, xmmword [r8], 0x40
jae 0x1404e284a
movsxd r9, ecx
add r9, r8
jmp 0x1404e2843
pcmpistri xmm0, xmmword [r8], 0x40
je 0x1404e27ce
add r8, 0x10
jmp 0x1404e2859
jmp 0x1404e282b
Function at 0x140001694
Capabilities:
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov rax, qword [0x140016010]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rsi, rcx
mov qword [rbp + 0x1f], rcx
lea rcx, [rbp + 0x27]
call fcn.14000722c
nop
movabs rax, 0x7fffffffffffffff
mov rcx, qword [rbp + 0x37]
sub rax, rcx
cmp rax, 1
jb 0x14000168e
lea r9, [rbp + 0x27]
cmp qword [rbp + 0x3f], 0x10
cmovae r9, qword [rbp + 0x27]
mov qword [rsp + 0x30], 1
lea rax, [0x140009774]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 9]
call fcn.1400062ec
nop
lea rdx, [0x1400169c0]
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [rdx + rdi], 0
jne 0x140001556
mov rcx, qword [rbp + 7]
mov rax, qword [rbp + 0xf]
sub rax, rcx
cmp rdi, rax
ja 0x14000159d
lea rax, [rcx + rdi]
mov qword [rbp + 7], rax
lea rbx, [rbp - 9]
cmp qword [rbp + 0xf], 0x10
cmovae rbx, qword [rbp - 9]
add rbx, rcx
mov r8, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
lea rax, [rbp - 9]
jmp 0x1400015ae
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rbp - 9]
call fcn.140006150
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
and qword [rsi + 0x10], 0
and qword [rsi + 0x18], 0
movups xmm0, xmmword [rax]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsi + 0x10], xmm1
and qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov ebx, 0x1000
mov rdx, qword [rbp + 0xf]
cmp rdx, 0x10
jb 0x14000161b
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, rbx
jb 0x140001616
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001616
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400077f0
movdqa xmm0, xmmword [0x140012560]
movdqu xmmword [rbp + 7], xmm0
mov byte [rbp - 9], 0
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140001666
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, rbx
jb 0x140001661
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001661
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400077f0
mov rax, rsi
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400077d0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.1400011ec
nop
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r14
push rbp
lea rbp, [rax - 0x1b8]
sub rsp, 0x2b0
mov rax, qword [0x140016010]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rbx, rax
invalid
invalid
pushfq
mov dl, 0x95
Function at 0x140004214
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x14000423e
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1400042b1
mov rax, qword [rcx + 0x40]
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140004255
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140004257
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400042ab
test ecx, ecx
jle 0x14000428b
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x1400042ab
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400042ab
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x1400042c4
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x1400042e4
xor eax, eax
jmp 0x1400043c8
cmp qword [rcx + 0x68], 0
je 0x1400042f6
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x1400043c8
mov rax, qword [rcx + 0x38]
mov rdi, rsi
mov rdx, qword [rax]
test rdx, rdx
je 0x14000430d
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000430f
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000433c
cmp rax, rsi
mov rbx, rsi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebx
mov rcx, rbp
add r14, rbx
sub rdi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
je 0x1400043c2
mov r8, qword [rbp + 0x18]
lea rax, [rbp + 0x70]
cmp qword [r8], rax
jne 0x140004373
mov rcx, qword [rbp + 0x88]
mov rdx, qword [rbp + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbp + 0x38]
mov qword [rax], rcx
mov rax, qword [rbp + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x14000439d
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rdi, rax
cmp rax, rbx
jne 0x1400043c2
cmp rdi, rbx
ja 0x14000437a
test rdi, rdi
je 0x1400043c2
mov r9, qword [rbp + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rax, rsi
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret