joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000aaa4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x18000aade
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x18000aae3
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x18000ab2c
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x18000d430]
cmp byte [rcx + rax], 0
je 0x18000ab2c
dec r8
sub rdx, 1
jne 0x18000ab12
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x141c4c0b0
Capabilities:
Decompress data using aplib

Disassembly:
call 0x141c4c237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141c4c0e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141c4c0c7
add dl, dl
jne 0x141c4c0ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141c4c14e
xor eax, eax
add dl, dl
jne 0x141c4c0fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141c4c205
add dl, dl
jne 0x141c4c10e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141c4c11b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141c4c128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141c4c135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141c4c142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141c4c0d6
mov eax, 1
add dl, dl
jne 0x141c4c15e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141c4c16b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141c4c153
sub eax, ebx
mov ebx, 1
jne 0x141c4c1a4
mov ecx, 1
add dl, dl
jne 0x141c4c186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141c4c193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141c4c17b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141c4c0d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141c4c1c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141c4c1cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141c4c1b5
cmp eax, 0x7d00
jae 0x141c4c1f3
cmp eax, 0x500
jb 0x141c4c1ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141c4c0d6
cmp eax, 0x7f
ja 0x141c4c1f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141c4c0d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141c4c22a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141c4c0d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180c86058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.180c861df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180c86089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180c8606f
add dl, dl
jne 0x180c86096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180c860f6
xor eax, eax
add dl, dl
jne 0x180c860a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180c861ad
add dl, dl
jne 0x180c860b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180c860c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180c860d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180c860dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x180c860ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x180c8607e
mov eax, 1
add dl, dl
jne 0x180c86106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180c86113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180c860fb
sub eax, ebx
mov ebx, 1
jne 0x180c8614c
mov ecx, 1
add dl, dl
jne 0x180c8612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180c8613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180c86123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180c8607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180c86168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180c86175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180c8615d
cmp eax, 0x7d00
jae 0x180c8619b
cmp eax, 0x500
jb 0x180c86196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180c8607e
cmp eax, 0x7f
ja 0x180c8619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180c8607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x180c861d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x180c8607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140004000
Capabilities:
Encode data using xor

Disassembly:
movabs rcx, 0xf47b51f89cbffe6d
movabs rdx, 0x1000
movabs r8, 0x3ee7
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x10]
add rdx, rax
add r8, rax
mov r9, rdx
xor qword [rdx], rcx
add rdx, 8
cmp rdx, r8
jb 0x140004034
jmp r9

Function at 0x1f9e058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1f9e1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1f9e089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1f9e06f
add dl, dl
jne 0x1f9e096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1f9e0f6
xor eax, eax
add dl, dl
jne 0x1f9e0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1f9e1ad
add dl, dl
jne 0x1f9e0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1f9e0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1f9e0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1f9e0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1f9e0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1f9e07e
mov eax, 1
add dl, dl
jne 0x1f9e106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1f9e113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1f9e0fb
sub eax, ebx
mov ebx, 1
jne 0x1f9e14c
mov ecx, 1
add dl, dl
jne 0x1f9e12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1f9e13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1f9e123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1f9e07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1f9e168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1f9e175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1f9e15d
cmp eax, 0x7d00
jae 0x1f9e19b
cmp eax, 0x500
jb 0x1f9e196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1f9e07e
cmp eax, 0x7f
ja 0x1f9e19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1f9e07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1f9e1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1f9e07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000a260
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x14000a282
xor eax, eax
add rsp, 0x30
pop r14
pop rbp
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
je 0x14000a30e
lfence
mov rdi, rbp
nop dword [rax]
mov rcx, rbx
call fcn.140005990
test rax, rax
jle 0x14000a2de
cmp rdi, rax
mov rsi, rdi
mov rcx, r14
cmovge rsi, rax
mov rax, qword [rbx + 0x38]
mov r8, rsi
mov rdx, qword [rax]
call fcn.14006d650
mov rax, qword [rbx + 0x50]
sub rdi, rsi
sub dword [rax], esi
mov rcx, qword [rbx + 0x38]
movsxd rax, esi
add qword [rcx], rax
jmp 0x14000a2fe
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x38]
call qword [case.0x14000765d.0]
cmp eax, 0xffffffff
je 0x14000a306
mov byte [r14], al
dec rdi
mov esi, 1
add r14, rsi
test rdi, rdi
jg 0x14000a2a0
sub rbp, rdi
jmp 0x14000a3f8
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000a325
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000a327
xor ecx, ecx
movsxd rax, ecx
mov rdi, rbp
test ecx, ecx
je 0x14000a35c
cmp rax, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.14006d650
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
mov rdi, rsi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14000a3f2
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000a397
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rdi, 0xfff
jbe 0x14000a3d0
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.14007841c
sub rsi, rax
add r14, rax
mov rdi, rsi
cmp rax, 0xfff
jne 0x14000a3f2
cmp rsi, rax
ja 0x14000a3a0
test rdi, rdi
je 0x14000a3f2
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.14007841c
mov rsi, rdi
sub rsi, rax
sub rbp, rsi
lfence
mov rsi, qword [rsp + 0x28]
mov rax, rbp
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rbp
pop rbx
ret
Function at 0x14000e830
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x170
mov rax, qword [0x1400ca010]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
cmp qword [rcx + 0x18], 8
jb 0x14000e862
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000ea7e
xor edx, edx
mov r8d, 0xf8
lea rcx, [rsp + 0x60]
call fcn.14006d3c0
lea rcx, [rsp + 0x60]
call fcn.1400106e0
nop
lea rcx, [rsp + 0x28]
call fcn.14001f780
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x14000e8a7
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140016970
lea rdx, [0x1400b1ffc]
mov rcx, rax
call fcn.140014060
lea rdx, str.installer_lib::Filesystem::is_directory
mov rcx, rax
call fcn.140014060
lea rdx, [0x1400b1fd0]
mov rcx, rax
call fcn.140013dc0
lea rdx, str.Failed_to_determine_if
mov rcx, rax
call fcn.140013dc0
mov rdx, rbx
mov rcx, rax
call fcn.1400143e0
lea rdx, [0x1400b2000]
mov rcx, rax
call fcn.140013dc0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.1400108a0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x14000e961
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e95b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000eaaa
call fcn.140047430
nop
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], di
mov dword [rsp + 0x20], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov rcx, qword [rsp + 0xe8]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x14000e9cd
mov rax, qword [rsp + 0xb8]
mov r8, qword [rax]
test r8, r8
je 0x14000e9cd
mov rax, qword [rsp + 0x98]
mov rdx, qword [rax]
cmp r8, qword [rsp + 0xe0]
cmovb r8, qword [rsp + 0xe0]
sub r8, rdx
sar r8, 1
jmp 0x14000ea10
test cl, 4
jne 0x14000ea06
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rax]
test rcx, rcx
je 0x14000ea06
mov rax, qword [rsp + 0x90]
mov rdx, qword [rax]
mov rax, qword [rsp + 0xc8]
movsxd r8, dword [rax]
add r8, r8
sub r8, rdx
add r8, rcx
sar r8, 1
jmp 0x14000ea10
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x14000ea20
lea rcx, [rsp + 0x28]
call fcn.140012760
nop
mov edx, 0x28
lea rcx, [rsp + 0x28]
call fcn.14001fc60
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x14000ea6f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ea69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000eab0
call fcn.140047430
nop
lea rcx, [rsp + 0x60]
call fcn.14000e3f0
nop
xor al, al
jmp 0x14000ea89
and eax, 0x410
cmp eax, 0x10
sete al
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140047410
mov rbx, qword [rsp + 0x188]
add rsp, 0x170
pop rdi
ret
call fcn.140076d80
int3
call fcn.140076d80
int3
Function at 0x14001f360
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14001f3d8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14001f3d8
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x14001f3c5
nop
cmp rbx, rcx
jae 0x14001f3d8
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x14001f3b0
cmp rbx, rcx
jae 0x14001f3d8
cmp word [rbx], 0
je 0x14001f3d8
lfence
mov rax, rbx
jmp 0x14001f3da
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14002f570
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x1400ca010]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rcx
cmp qword [rcx + 8], 0xffffffffffffffff
je 0x14002f6d2
cmp byte [rdx + 4], 0
je 0x14002f5ae
mov eax, dword [rcx]
cmp dword [rdx], eax
jl 0x14002f6d2
mov r9, r8
mov r8, rdx
lea rdx, str._H:_M:_S
lea rcx, [rbp + 0xf]
call fcn.14002f030
nop
mov dword [rbp + 7], 0
cmp byte [rbx + 0x10], 0
je 0x14002f671
lea rax, [rbp + 0xf]
cmp qword [rbp + 0x27], 0x10
cmovae rax, qword [rbp + 0xf]
mov qword [rbp - 9], rax
mov rax, qword [rbp + 0x1f]
mov qword [rbp - 1], rax
movaps xmm0, xmmword [rbp - 9]
movdqa xmmword [rbp - 9], xmm0
lea rdx, [rbp - 9]
lea rcx, [rbp + 0x2f]
call fcn.140037780
lea rdx, [rbp + 0x2f]
cmp qword [rbp + 0x47], 8
cmovae rdx, qword [rbp + 0x2f]
mov qword [rsp + 0x20], 0
lea r9, [rbp + 7]
mov r8d, dword [rbp + 0x3f]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov rdx, qword [rbp + 0x47]
cmp rdx, 8
jb 0x14002f69b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002f66a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002f6f5
call fcn.140047430
jmp 0x14002f69b
lea rdx, [rbp + 0xf]
cmp qword [rbp + 0x27], 0x10
cmovae rdx, qword [rbp + 0xf]
mov qword [rsp + 0x20], 0
lea r9, [rbp + 7]
mov r8d, dword [rbp + 0x1f]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x14002f6d2
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002f6cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002f6ef
call fcn.140047430
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140047410
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rbp
ret
call fcn.140076d80
nop
call fcn.140076d80
nop
int3
Function at 0x140030100
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1400ca010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rdi, qword [r8]
mov r14, r9
mov rbp, qword [rsp + 0xe0]
mov rsi, rdx
mov r15, qword [rsp + 0xe8]
mov rbx, rcx
mov r12, qword [rsp + 0xf0]
test rdi, rdi
je 0x140030206
cmp qword [rdi + 8], 0xffffffffffffffff
je 0x140030206
cmp byte [rcx + 4], 0
je 0x140030169
mov eax, dword [rdi]
cmp dword [rcx], eax
jl 0x140030206
mov r9, rsi
lea rdx, str._FT_T
mov r8, rbx
lea rcx, [rsp + 0x38]
call fcn.14002f030
mov r8d, dword [rsp + 0x48]
lea rdx, [rsp + 0x38]
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x30]
xor eax, eax
mov qword [rsp + 0x68], 0xffffffffffffffff
cmp qword [rsp + 0x50], 0x10
mov dword [rsp + 0x30], eax
cmovae rdx, qword [rsp + 0x38]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140030206
mov rcx, qword [rsp + 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030201
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003024e
call fcn.140047430
mov rcx, qword [r14]
test rcx, rcx
je 0x140030219
mov r8, rsi
mov rdx, rbx
call fcn.14002f2f0
mov r9, r15
mov qword [rsp + 0x20], r12
mov r8, rbp
mov rdx, rsi
mov rcx, rbx
call fcn.140030e90
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140047410
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.140076d80
int3
Function at 0x140031a00
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xd0
mov rax, qword [0x1400ca010]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r15, r8
mov rdi, rdx
mov rbp, rcx
mov qword [rsp + 0xb8], rcx
xor ebx, ebx
mov dword [rsp + 0xb8], ebx
mov rcx, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x140031a4c
mov rcx, qword [rdx]
lea rdx, [rsp + 0xb8]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov r14d, eax
test eax, eax
je 0x140031b8f
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rbx
cmp r14, 0x1000
jb 0x140031ab1
lea rcx, [r14 + 0x27]
cmp rcx, r14
jbe 0x140031bc0
lfence
call fcn.1400476d8
mov rcx, rax
test rax, rax
je 0x140031b89
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140031abc
lfence
mov rcx, r14
call fcn.1400476d8
mov qword [rsp + 0xa0], rax
lea rbx, [rax + r14]
mov qword [rsp + 0xb0], rbx
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.14006d3c0
mov qword [rsp + 0xa8], rbx
cmp qword [rdi + 0x18], 0x10
jb 0x140031aef
mov rdi, qword [rdi]
mov r9, qword [rsp + 0xa0]
mov r8d, r14d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x140031bc6
mov r8, r15
mov rdx, qword [rsp + 0xa0]
mov rcx, rbp
call fcn.1400314f0
nop
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x140031b5f
mov rdx, qword [rsp + 0xb0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031b5a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031b89
call fcn.140047430
mov rax, rbp
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140047410
mov rbx, qword [rsp + 0x118]
add rsp, 0xd0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140076d80
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.1400311f0
nop
mov r8, rax
lea rdx, str.Failed_to_get_Version_resource_size:
lea rcx, [rsp + 0x40]
call fcn.14002a130
nop
mov rcx, rax
call fcn.1400314c0
nop
call fcn.140002c40
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x60]
call fcn.1400311f0
nop
mov r8, rax
lea rdx, str.Failed_to_get_Version_resource_content:
lea rcx, [rsp + 0x80]
call fcn.14002a130
nop
mov rcx, rax
call fcn.1400314c0
int3
Function at 0x140031c00
Capabilities:
Get file version info

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1400ca010]
xor rax, rsp
mov qword [rbp], rax
mov r12, r8
mov rdi, rdx
mov r14, rcx
mov qword [rbp - 8], rcx
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x140031c3f
mov rcx, qword [rdx]
lea rdx, [rbp - 8]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov r15d, eax
test eax, eax
je 0x140031dda
xorps xmm0, xmm0
xor eax, eax
movdqu xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rax
cmp r15, 0x1000
jb 0x140031c9a
lea rcx, [r15 + 0x27]
cmp rcx, r15
jbe 0x140031e0a
lfence
call fcn.1400476d8
mov rcx, rax
test rax, rax
je 0x140031e10
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140031ca5
lfence
mov rcx, r15
call fcn.1400476d8
mov qword [rbp - 0x20], rax
lea rbx, [rax + r15]
mov qword [rbp - 0x10], rbx
mov r8, r15
xor edx, edx
mov rcx, rax
call fcn.14006d3c0
mov qword [rbp - 0x18], rbx
cmp qword [rdi + 0x18], 8
jb 0x140031ccc
mov rdi, qword [rdi]
mov r9, qword [rbp - 0x20]
mov r8d, r15d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x140031e16
mov r8, r12
mov rdx, qword [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.1400314f0
nop
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x140031d06
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rcx
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x50]
mov rcx, r14
call fcn.140037780
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140031d66
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031d61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031e45
call fcn.140047430
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140031db3
mov rdx, qword [rbp - 0x10]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031dae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031dd4
call fcn.140047430
mov rax, r14
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140047410
add rsp, 0x110
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140076d80
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x60]
call fcn.1400311f0
nop
mov r8, rax
lea rdx, str.Failed_to_get_Version_resource_size:
lea rcx, [rbp - 0x80]
call fcn.14002a130
nop
mov rcx, rax
call fcn.1400314c0
nop
call fcn.140002c40
int3
call fcn.140076d80
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp - 0x60]
call fcn.1400311f0
nop
mov r8, rax
lea rdx, str.Failed_to_get_Version_resource_content:
lea rcx, [rbp - 0x40]
call fcn.14002a130
nop
mov rcx, rax
call fcn.1400314c0
nop
call fcn.140076d80
int3