joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140193160
Capabilities:
Read file on windows
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov r8, qword [0x1403d8fc0]
mov eax, dword [0x1403d8fc8]
mov r10, qword [0x140408f00]
mov rdx, qword [r8 + 8]
mov rsi, qword [0x1403d9000]
inc eax
movsxd rcx, eax
lea r9, [r10 - 1]
add rcx, rdx
cmp rsi, rcx
jbe 0x1401931ce
call qword [sym.imp.MSVCR100.dll___iob_func]
lea rcx, str.fatal_flex_scanner_internal_error__end_of_buffer_missed
lea rdx, [rax + 0x60]
call qword [sym.imp.MSVCR100.dll_fputs]
call qword [sym.imp.MSVCR100.dll___iob_func]
mov ecx, 0xa
lea rdx, [rax + 0x60]
call qword [sym.imp.MSVCR100.dll_putc]
mov ecx, 1
call qword [sym.imp.MSVCR100.dll_exit]
int3
sub esi, r10d
test esi, esi
jle 0x1401931f2
mov ecx, esi
nop word [rax + rax]
movzx eax, byte [r9]
inc rdx
inc r9
dec rcx
mov byte [rdx - 1], al
jne 0x1401931e0
cmp dword [r8 + 0x20], 0
mov qword [rsp + 0x38], rdi
je 0x140193207
xor eax, eax
mov ecx, eax
jmp 0x140193342
mov edi, dword [r8 + 0x18]
sub edi, esi
dec edi
cmp edi, 0x2000
jle 0x140193243
mov edi, 0x2000
cmp dword [0x1403d8fd4], 0
je 0x1401932c6
call fcn.140193120
mov r8, qword [0x1403d8fc0]
mov r11d, eax
test eax, eax
jne 0x14019327f
mov ecx, eax
jmp 0x140193342
test edi, edi
jg 0x14019321c
call qword [sym.imp.MSVCR100.dll___iob_func]
lea rcx, str.fatal_error___scanner_input_buffer_overflow
lea rdx, [rax + 0x60]
call qword [sym.imp.MSVCR100.dll_fputs]
call qword [sym.imp.MSVCR100.dll___iob_func]
mov ecx, 0xa
lea rdx, [rax + 0x60]
call qword [sym.imp.MSVCR100.dll_putc]
mov ecx, 1
call qword [sym.imp.MSVCR100.dll_exit]
int3
mov rax, qword [r8 + 8]
movsxd rcx, esi
mov byte [rcx + rax], r11b
mov ecx, 1
xor eax, eax
mov rdi, qword [rsp + 0x38]
add ecx, esi
movsxd rdx, ecx
mov dword [0x1403d8fc8], ecx
mov rcx, qword [r8 + 8]
mov byte [rdx + rcx], 0
mov rcx, qword [r8 + 8]
mov byte [rdx + rcx + 1], 0
mov rcx, qword [r8 + 8]
inc rcx
mov qword [0x140408f00], rcx
add rsp, 0x20
pop rsi
ret
mov rcx, qword [0x1403d8ff0]
mov qword [rsp + 0x30], rbx
movsxd rbx, esi
add rbx, qword [r8 + 8]
call qword [sym.imp.MSVCR100.dll__fileno]
mov r8d, edi
mov ecx, eax
mov rdx, rbx
call sub.MSVCR100.dll__read
mov rbx, qword [rsp + 0x30]
mov ecx, eax
mov dword [0x1403d8fc8], eax
test eax, eax
jns 0x140193335
call qword [sym.imp.MSVCR100.dll___iob_func]
lea rcx, str.read___in_flex_scanner_failed
lea rdx, [rax + 0x60]
call qword [sym.imp.MSVCR100.dll_fputs]
call qword [sym.imp.MSVCR100.dll___iob_func]
mov ecx, 0xa
lea rdx, [rax + 0x60]
call qword [sym.imp.MSVCR100.dll_putc]
mov ecx, 1
call qword [sym.imp.MSVCR100.dll_exit]
int3
mov r8, qword [0x1403d8fc0]
jne 0x14019328f
cmp esi, 1
jne 0x140193356
mov eax, esi
mov dword [r8 + 0x20], 2
jmp 0x140193291
mov eax, 2
mov dword [r8 + 0x20], 1
jmp 0x140193291
Function at 0x140197920
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
push r12
push r13
sub rsp, 0x20
mov r12, rcx
mov ecx, 0x4000
mov rdi, r8
mov r13, rdx
call qword [sym.imp.MSVCR100.dll_malloc]
mov rbp, rax
test rax, rax
jne 0x14019795c
lea eax, [rbp + 4]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
mov qword [rsp + 0x40], rbx
xor ebx, ebx
mov qword [rsp + 0x48], rsi
cmp rdi, 0xffffffffffffffff
je 0x14019798c
cmp rbx, rdi
jae 0x140197a0a
mov r8d, 0x4000
mov rax, rdi
sub rax, rbx
cmp rax, r8
cmovb r8, rax
jmp 0x140197992
mov r8d, 0x4000
mov r9, r12
mov edx, 1
mov rcx, rbp
call qword [sym.imp.MSVCR100.dll_fread]
mov rsi, rax
test rax, rax
je 0x1401979ed
mov r9, r13
mov r8, rax
mov edx, 1
mov rcx, rbp
call qword [sym.imp.MSVCR100.dll_fwrite]
cmp rax, rsi
jne 0x1401979c9
add rbx, rsi
jmp 0x140197968
mov rcx, rbp
call qword [sym.imp.MSVCR100.dll_free]
mov rcx, qword [0x140407720]
lea rdx, str._fcopy:_write_error_n
call qword [sym.imp.MSVCR100.dll_fprintf]
mov eax, 0xa
jmp 0x140197a15
mov rcx, r12
call qword [sym.imp.MSVCR100.dll_ferror]
test eax, eax
je 0x140197a0a
mov rcx, rbp
call qword [sym.imp.MSVCR100.dll_free]
mov eax, VariantTimeToDosDateTime
jmp 0x140197a15
mov rcx, rbp
call qword [sym.imp.MSVCR100.dll_free]
xor eax, eax
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x1401985c0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x60
mov rax, qword [0x1403c2c80]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rdx
lea rdx, [rsp + 0x20]
mov rdi, rcx
call fcn.140199a80
test eax, eax
jne 0x14019860a
cmp word [rsp + 0x28], 1
jg 0x140198629
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll__unlink]
test eax, eax
jne 0x14019867e
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.MSVCR100.dll_rename]
test eax, eax
je 0x1401986b8
call qword [sym.imp.MSVCR100.dll__errno]
cmp dword [rax], 0x12
jne 0x14019867e
lea rdx, [0x1403281e8]
mov rcx, rsi
call qword [sym.imp.MSVCR100.dll_fopen]
mov rbp, rax
test rax, rax
jne 0x14019865d
mov rcx, qword [0x140407720]
lea rdx, str._replace:_cant_open__s_n
mov r8, rsi
call qword [sym.imp.MSVCR100.dll_fprintf]
lea eax, [rbp + 0xa]
jmp 0x1401986ba
lea rdx, [0x14030bdfc]
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll_fopen]
mov rcx, rbp
mov r12, rax
test rax, rax
jne 0x140198685
call qword [sym.imp.MSVCR100.dll_fclose]
mov eax, 0xf
jmp 0x1401986ba
mov r8d, 0xffffffff
mov rdx, rax
call fcn.140197920
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.MSVCR100.dll_fclose]
mov rcx, r12
call qword [sym.imp.MSVCR100.dll_fclose]
test eax, eax
jne 0x1401986dc
test ebx, ebx
jne 0x1401986dc
mov rcx, rsi
call qword [sym.imp.MSVCR100.dll__unlink]
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1402912a0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll__unlink]
test ebx, ebx
je 0x1401986f8
mov eax, 0xe
cmp ebx, 0xa
cmove ebx, eax
mov eax, ebx
jmp 0x1401986ba
mov ebx, 0xe
mov eax, ebx
jmp 0x1401986ba
Function at 0x1401997d0
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x290
mov rax, qword [0x1403c2c80]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, rcx
movzx ecx, byte [rcx]
call qword [sym.imp.MSVCR100.dll_isalpha]
test eax, eax
je 0x140199801
cmp byte [rbx + 1], 0x3a
je 0x140199824
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x170]
mov edx, Ordinal_262
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea rbx, [rsp + 0x170]
lea rcx, [rsp + 0x40]
mov r8d, 3
mov rdx, rbx
mov qword [rsp + 0x48], rbx
call qword [sym.imp.MSVCR100.dll_strncpy]
mov dword [rsp + 0x38], Ordinal_262
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x170]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
mov r8d, Ordinal_262
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x43], 0
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCR100.dll__strupr]
lea rdx, [0x14030df7c]
mov r8d, 3
mov rcx, rax
call qword [sym.imp.MSVCR100.dll_strncmp]
test eax, eax
je 0x1401998e7
lea rdx, str.VFAT
lea rcx, [rsp + 0x60]
mov r8d, 4
call qword [sym.imp.MSVCR100.dll_strncmp]
test eax, eax
je 0x1401998e7
lea rdx, str.HPFS
lea rcx, [rsp + 0x60]
mov r8d, 4
call qword [sym.imp.MSVCR100.dll_strncmp]
test eax, eax
je 0x1401998e7
xor eax, eax
jmp 0x1401998ec
mov eax, 1
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1402912a0
add rsp, 0x290
pop rbx
ret
Function at 0x140199a80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rdi
sub rsp, 0x58
mov rdi, rdx
mov rbx, rcx
call qword [sym.imp.MSVCR100.dll__stat64]
mov rcx, rbx
test eax, eax
jne 0x140199c19
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x50], rsi
call fcn.1401997d0
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov edx, 0x80
lea r8d, [r9 + 1]
mov rcx, rbx
mov dword [rsp + 0x28], 0x2000000
mov ebp, eax
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140199c06
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x88]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x140199c06
lea rdx, [rdi + 0x28]
lea rcx, [rsp + 0x40]
test ebp, ebp
jne 0x140199b92
call fcn.140199910
cmp dword [rsp + 0x80], ebp
jne 0x140199b49
cmp dword [rsp + 0x84], ebp
jne 0x140199b49
mov rax, qword [rdi + 0x28]
mov qword [rdi + 0x20], rax
jmp 0x140199b5a
lea rdx, [rdi + 0x20]
lea rcx, [rsp + 0x80]
call fcn.140199910
cmp dword [rsp + 0x88], 0
jne 0x140199b6e
cmp dword [rsp + 0x8c], 0
je 0x140199bda
lea rdx, [rdi + 0x30]
lea rcx, [rsp + 0x88]
call fcn.140199910
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x70]
xor eax, eax
add rsp, 0x58
pop rdi
pop rbx
ret
call fcn.140199980
cmp dword [rsp + 0x80], 0
jne 0x140199bb5
cmp dword [rsp + 0x84], 0
jne 0x140199bb5
mov rax, qword [rdi + 0x28]
mov qword [rdi + 0x20], rax
jmp 0x140199bc6
lea rdx, [rdi + 0x20]
lea rcx, [rsp + 0x80]
call fcn.140199980
cmp dword [rsp + 0x88], 0
jne 0x140199bf5
cmp dword [rsp + 0x8c], 0
jne 0x140199bf5
mov rax, qword [rdi + 0x28]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x70]
mov qword [rdi + 0x30], rax
xor eax, eax
add rsp, 0x58
pop rdi
pop rbx
ret
lea rdx, [rdi + 0x30]
lea rcx, [rsp + 0x88]
call fcn.140199980
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x70]
xor eax, eax
add rsp, 0x58
pop rdi
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp eax, 0xffffffff
je 0x140199c81
test al, 0x10
je 0x140199c81
xor eax, eax
mov ecx, 0x210000
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x20], rax
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x30], rax
call fcn.1401977a0
shl bx, 7
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x30], rax
mov qword [rdi + 0x20], rax
mov eax, 0x80
not bx
and bx, ax
mov eax, 0x4100
or bx, ax
xor eax, eax
mov word [rdi + 6], bx
add rsp, 0x58
pop rdi
pop rbx
ret
or eax, 0xffffffff
add rsp, 0x58
pop rdi
pop rbx
ret
Function at 0x140199e90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov r11, r8
mov r10, rdx
mov r9d, ecx
test rdx, rdx
jne 0x140199ea9
xor eax, eax
add rsp, 0x28
ret
mov qword [rsp + 0x30], rbx
call fcn.140199e80
not r9d
mov rbx, rax
test r8, r8
je 0x140199ee5
nop
test r10b, 3
je 0x140199ee5
movzx edx, byte [r10]
mov ecx, r9d
inc r10
xor rdx, rcx
shr ecx, 8
movzx eax, dl
mov r9d, dword [rbx + rax*4]
xor r9d, ecx
dec r11
jne 0x140199ec0
mov qword [rsp + 0x20], rdi
cmp r11, 0x10
jb 0x14019a004
mov rdi, r11
shr rdi, 4
mov rax, rdi
imul rax, rax, 0xfffffffffffffff0
add r11, rax
nop word [rax + rax]
xor r9d, dword [r10]
add r10, 0x10
movzx ecx, r9b
shr r9d, 8
mov edx, dword [rbx + rcx*4]
xor edx, r9d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rbx + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [rbx + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rbx + rcx*4]
xor r8d, edx
xor r8d, dword [r10 - 0xc]
movzx ecx, r8b
shr r8d, 8
mov edx, dword [rbx + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rbx + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [rbx + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rbx + rcx*4]
xor r8d, edx
xor r8d, dword [r10 - 8]
movzx ecx, r8b
shr r8d, 8
mov edx, dword [rbx + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rbx + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [rbx + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rbx + rcx*4]
xor r8d, edx
xor r8d, dword [r10 - 4]
movzx ecx, r8b
shr r8d, 8
mov edx, dword [rbx + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rbx + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [rbx + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r9d, dword [rbx + rcx*4]
xor r9d, edx
dec rdi
jne 0x140199f10
cmp r11, 4
jb 0x14019a062
mov rdi, r11
shr rdi, 2
mov rax, rdi
imul rax, rax, 0xfffffffffffffffc
add r11, rax
nop dword [rax + rax]
xor r9d, dword [r10]
add r10, 4
movzx ecx, r9b
shr r9d, 8
mov edx, dword [rbx + rcx*4]
xor edx, r9d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rbx + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [rbx + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r9d, dword [rbx + rcx*4]
xor r9d, edx
dec rdi
jne 0x14019a020
mov rdi, qword [rsp + 0x20]
test r11, r11
je 0x14019a092
nop dword [rax]
movzx ecx, byte [r10]
mov eax, r9d
inc r10
xor rcx, rax
movzx eax, cl
mov ecx, r9d
mov r9d, dword [rbx + rax*4]
shr ecx, 8
xor r9d, ecx
dec r11
jne 0x14019a070
mov rbx, qword [rsp + 0x30]
not r9d
mov eax, r9d
add rsp, 0x28
ret
Function at 0x14019c490
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov r9, qword [rcx + 8]
mov rax, rdx
mov rbx, rcx
test r9, r9
jne 0x14019c4d1
mov rcx, qword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Unable_to_open_file
call fcn.1400090e0
mov rdx, qword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::endl_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_]
mov rcx, rax
call qword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
movsxd r8, r8d
mov edx, 1
mov rcx, rax
call qword [sym.imp.MSVCR100.dll_fread]
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14019c720
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0xe8], rbx
mov rax, qword [0x1403c2c80]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov edi, r8d
mov rax, rdx
mov rbx, rcx
mov r9, qword [rcx + 8]
test r9, r9
jne 0x14019c786
lea rdx, str.Unable_to_open_file
mov rcx, qword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400090e0
mov rcx, rax
mov rdx, qword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::endl_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_]
call qword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14019c835
movsxd r8, edi
mov edx, 1
mov rcx, rax
call qword [sym.imp.MSVCR100.dll_fwrite]
cmp rax, rdi
jae 0x14019c835
mov qword [rsp + 0x48], shutdown
mov qword [rsp + 0x40], 0
mov byte [rsp + 0x30], 0
mov r8d, shutdown
lea rdx, str.out_of_disk_space
lea rcx, [rsp + 0x30]
call fcn.140008ba0
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.14019d920
nop
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x90]
call qword [sym.imp.MSVCR100.dll_public:_void___cdecl_std::exception::constructor_char_const__const___ptr64_const____ptr64____ptr64]
lea r11, vtable.DL_Exception_class_std::runtime_error_.1.0
mov qword [rsp + 0x60], r11
lea rax, vtable.DL_Exception_class_std::runtime_error_.0
mov qword [rsp + 0x90], rax
lea rdx, [0x1403ab520]
lea rcx, [rsp + 0x60]
call sub.MSVCR100.dll__CxxThrowException
nop
mov rax, rbx
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1402912a0
mov rbx, qword [rsp + 0xe8]
add rsp, 0xc0
pop rdi
ret
Function at 0x1401aeef0
Capabilities:
Query environment variable

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rsi
mov rax, qword [0x1403c2c80]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
lea rax, vtable.DL_MObserverManager.0
mov qword [rcx], rax
add rcx, 8
call fcn.1401164e0
nop
lea rcx, [rbx + 0x28]
call fcn.1401aeda0
nop
lea rcx, str.DL_OBSERVER_DEBUG
call qword [sym.imp.MSVCR100.dll_getenv]
mov rdx, rax
test rax, rax
je 0x1401af009
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x1401af007
mov qword [rsp + 0x48], shutdown
xor esi, esi
mov qword [rsp + 0x40], rsi
mov byte [rsp + 0x30], al
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x30]
call fcn.140008ba0
nop
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rcx, qword [rsp + 0x30]
mov r8d, 1
mov rdi, qword [rsp + 0x40]
cmp rdi, r8
cmovb r8, rdi
lea rdx, [0x14032822c]
call sub.MSVCR100.dll_memcmp
movsxd rcx, eax
test eax, eax
jne 0x1401aefe7
cmp rdi, 1
jae 0x1401aefe1
or ecx, 0xffffffff
jmp 0x1401aefe7
setne sil
mov ecx, esi
test ecx, ecx
sete byte [0x1403f6478]
cmp qword [rsp + 0x48], 0x10
jb 0x1401af005
mov rcx, qword [rsp + 0x30]
call fcn.140290ed8
nop
jmp 0x1401af009
jmp 0x1401af009
jmp 0x1401af009
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1402912a0
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x1401b5fc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
push rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x40
movsxd rbp, dword [rsp + 0xa0]
mov rax, qword [rdx + 0x18]
mov r13, qword [rdx]
mov r14, qword [rdx + 8]
mov r15, qword [rdx + 0x10]
mov r12d, r9d
movsxd r9, dword [rsp + 0xa8]
sub r12d, r8d
mov rbx, rdx
inc r12d
mov rsi, rcx
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x98], r12d
cmp rbp, r9
jg 0x1401b61af
mov qword [rsp + 0x80], rdi
movaps xmmword [rsp + 0x30], xmm6
movss xmm6, dword [0x1402d37f0]
mov rax, qword [rsi + 0x18]
cmp rax, qword [rsi + 0x20]
je 0x1401b606a
movsxd rcx, r8d
lea r8, [rcx + rcx*2]
nop word [rax + rax]
mov rcx, qword [rax + 8]
add rax, 0x20
mov rdx, qword [rcx + rbp*8]
lea rcx, [r8 + rdx]
mov qword [rax - 0x10], rcx
cmp rax, qword [rsi + 0x20]
jne 0x1401b6050
mov edi, r12d
test r12d, r12d
je 0x1401b6120
mov r12, qword [rsp + 0x88]
nop
movd xmm0, dword [r12]
movd xmm1, dword [r15]
mov r9d, dword [r14]
mov r8d, dword [r13]
dec edi
mov rcx, rsi
cvtps2pd xmm0, xmm0
cvtps2pd xmm1, xmm1
mov edx, edi
movsd qword [rsp + 0x28], xmm0
movsd qword [rsp + 0x20], xmm1
call fcn.1401b5410
mov r11d, dword [rbx + 0x30]
movss xmm0, dword [rbx + 0x28]
add dword [rbx + 0x20], r11d
mov eax, dword [rbx + 0x20]
addss xmm0, dword [rbx + 0x38]
comiss xmm0, xmm6
movss dword [rbx + 0x28], xmm0
jb 0x1401b60dd
subss xmm0, xmm6
inc eax
movss dword [rbx + 0x28], xmm0
mov dword [rbx + 0x20], eax
movss xmm0, dword [rbx + 0x2c]
mov eax, dword [rbx + 0x34]
addss xmm0, dword [rbx + 0x3c]
add dword [rbx + 0x24], eax
mov eax, dword [rbx + 0x24]
comiss xmm0, xmm6
movss dword [rbx + 0x2c], xmm0
jb 0x1401b6108
subss xmm0, xmm6
inc eax
movss dword [rbx + 0x2c], xmm0
mov dword [rbx + 0x24], eax
test edi, edi
jne 0x1401b6080
mov r12d, dword [rsp + 0x98]
movsxd r9, dword [rsp + 0xa8]
movss xmm0, dword [rbx + 0x48]
mov eax, dword [rbx + 0x50]
inc rbp
addss xmm0, dword [rbx + 0x58]
add dword [rbx + 0x40], eax
mov eax, dword [rbx + 0x40]
comiss xmm0, xmm6
movss dword [rbx + 0x48], xmm0
jb 0x1401b614e
subss xmm0, xmm6
inc eax
movss dword [rbx + 0x48], xmm0
mov dword [rbx + 0x40], eax
movss xmm0, dword [rbx + 0x4c]
mov eax, dword [rbx + 0x54]
addss xmm0, dword [rbx + 0x5c]
add dword [rbx + 0x44], eax
mov eax, dword [rbx + 0x44]
comiss xmm0, xmm6
movss dword [rbx + 0x4c], xmm0
jb 0x1401b6179
subss xmm0, xmm6
inc eax
movss dword [rbx + 0x4c], xmm0
mov dword [rbx + 0x44], eax
mov eax, dword [rbx + 0x40]
mov r8d, dword [rsp + 0x90]
mov dword [rbx + 0x20], eax
mov eax, dword [rbx + 0x48]
mov dword [rbx + 0x28], eax
mov eax, dword [rbx + 0x44]
mov dword [rbx + 0x24], eax
mov eax, dword [rbx + 0x4c]
mov dword [rbx + 0x2c], eax
cmp rbp, r9
jle 0x1401b6030
movaps xmm6, xmmword [rsp + 0x30]
mov rdi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret
Function at 0x1402283e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
movzx eax, byte [rdx + 0x20]
mov rbp, rdx
mov rbx, rcx
cmp byte [rcx + 0x20], al
jne 0x14022844a
movzx eax, byte [rdx + 0x21]
cmp byte [rcx + 0x21], al
jne 0x14022844a
mov eax, dword [rdx + 0x24]
cmp dword [rcx + 0x24], eax
jne 0x14022844a
mov rcx, qword [rdx + 8]
mov rax, qword [rbx + 8]
sub rcx, qword [rdx]
sub rax, qword [rbx]
xor rcx, rax
test rcx, 0xfffffffffffffe00
jne 0x14022844a
movsd xmm0, qword [rbx + 0x1a8]
ucomisd xmm0, qword [rdx + 0x1a8]
jp 0x14022844a
jne 0x14022844a
movzx eax, word [rdx + 0x1b0]
cmp word [rbx + 0x1b0], ax
jne 0x14022844a
mov cl, 1
jmp 0x14022844c
xor cl, cl
xor edi, edi
test cl, cl
je 0x1402284f2
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r13
mov esi, edi
nop word [rax + rax]
mov rdx, qword [rbx]
mov rax, qword [rbx + 8]
sub rax, rdx
sar rax, 9
cmp rdi, rax
jae 0x1402284b3
mov rax, qword [rbp]
mov r8, qword [rsi + rdx]
lea r12, [rsi + rdx + 8]
mov rcx, qword [rsi + rax]
lea r13, [rsi + rax + 8]
test r8, r8
jne 0x1402284cd
test rcx, rcx
je 0x1402284e2
xor cl, cl
inc rdi
add rsi, 0x200
test cl, cl
jne 0x140228470
mov r12, qword [rsp + 0x48]
mov r13, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x40]
movzx eax, cl
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
test rcx, rcx
je 0x1402284a3
mov rax, qword [r8]
mov rdx, rcx
mov rcx, r8
call qword [rax + 0x30]
test al, al
je 0x1402284a3
mov rdx, r13
mov rcx, r12
call fcn.140228010
movzx ecx, al
jmp 0x1402284a5
movzx eax, cl
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
Function at 0x140228630
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
movzx eax, byte [rdx + 0x20]
mov rsi, rdx
mov rbx, rcx
cmp byte [rcx + 0x20], al
jne 0x1402286a1
movzx eax, byte [rdx + 0x21]
cmp byte [rcx + 0x21], al
jne 0x1402286a1
mov eax, dword [rdx + 0x24]
cmp dword [rcx + 0x24], eax
jne 0x1402286a1
mov rcx, qword [rdx + 8]
mov rax, qword [rbx + 8]
sub rcx, qword [rdx]
sub rax, qword [rbx]
xor rcx, rax
test rcx, 0xfffffffffffffe00
jne 0x1402286a1
movsd xmm0, qword [rbx + 0x1a8]
ucomisd xmm0, qword [rdx + 0x1a8]
jp 0x1402286a1
jne 0x1402286a1
movzx eax, word [rdx + 0x1b0]
cmp word [rbx + 0x1b0], ax
jne 0x1402286a1
mov cl, 1
jmp 0x1402286a3
xor cl, cl
xor ebp, ebp
test cl, cl
je 0x140228739
mov qword [rsp + 0x30], rdi
mov edi, ebp
nop word [rax + rax]
mov rdx, qword [rbx]
mov rax, qword [rbx + 8]
sub rax, rdx
sar rax, 9
cmp rbp, rax
jae 0x1402286f8
mov rcx, qword [rdi + rdx]
mov rax, qword [rsi]
mov rdx, qword [rdi + rax]
test rcx, rcx
jne 0x140228710
test rdx, rdx
je 0x14022871f
xor cl, cl
inc rbp
add rdi, 0x200
test cl, cl
jne 0x1402286c0
movzx eax, cl
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
test rdx, rdx
je 0x1402286e8
mov rax, qword [rcx]
call qword [rax + 0x38]
test al, al
je 0x1402286e8
mov rax, qword [rbx]
lea rcx, [rdi + rax + 8]
mov rax, qword [rsi]
lea rdx, [rdi + rax + 8]
call fcn.140228130
movzx ecx, al
jmp 0x1402286ea
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
movzx eax, cl
add rsp, 0x20
pop rsi
ret