joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006d070
Capabilities:
Read http header

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1401761c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rsi, rcx
mov rbx, rdx
mov qword [r11 - 0x60], rdx
mov rdi, qword [r11 + 0x18]
xor ebp, ebp
mov dword [rsp + 0x30], ebp
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], rbp
mov qword [rdx + 0x18], 7
mov word [rdx], bp
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x68], ebp
mov r8, rdi
cmp qword [rdi + 0x18], 7
jbe 0x14006d0de
mov r8, qword [rdi]
mov qword [rsp + 0x28], rbp
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov edx, 0xffff
mov rcx, qword [rsi + 0x20]
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x14006d112
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14006d1c0
xor r8d, r8d
mov edx, dword [rsp + 0x68]
shr rdx, 1
mov rcx, rbx
call fcn.14000d3b0
mov r9, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14006d131
mov r9, qword [rbx]
cmp qword [rdi + 0x18], 7
jbe 0x14006d13b
mov rdi, qword [rdi]
mov qword [rsp + 0x28], rbp
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r8, rdi
mov edx, 0xffff
mov rcx, qword [rsi + 0x20]
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x14006d195
xor r8d, r8d
mov edx, dword [rsp + 0x68]
shr rdx, 1
mov rcx, rbx
call fcn.14000d3b0
mov rax, rbx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400b89f0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea r8, str.Unable_to_query_response_headers_
lea rcx, [rsp + 0x40]
call fcn.1400aa730
lea rdx, [0x140172368]
lea rcx, [rsp + 0x40]
call fcn.1400bb9a0
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea r8, str.Unable_to_query_response_headers_
lea rcx, [rsp + 0x40]
call fcn.1400aa730
lea rdx, [0x140172368]
lea rcx, [rsp + 0x40]
call fcn.1400bb9a0
int3

Function at 0x14006d2b0
Capabilities:
Read http header

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x40
mov rax, qword [0x1401761c0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov eax, dword [rcx + 0x58]
xor ebx, ebx
mov dword [rsp + 0x30], ebx
mov edi, ebx
test eax, eax
jne 0x14006d312
mov rcx, qword [rcx + 0x20]
lea rax, [r11 - 0x14]
mov qword [r11 - 0x20], rbx
lea r9, [r11 - 0x18]
xor r8d, r8d
mov qword [r11 - 0x28], rax
mov edx, 0x20000013
mov dword [rsp + 0x34], 4
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x14006d314
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
cmove ebx, dword [rsp + 0x30]
mov eax, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400b89f0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14006e370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 8], rcx
push rbp
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rdi, qword [rbp + 0xd0]
mov rax, qword [rdi]
movsxd rcx, dword [rax + 8]
lea rax, vtable.asw::log::detail::LogModule.2.0
mov qword [rcx + rdi], rax
mov rax, qword [rdi]
movsxd rcx, dword [rax + 0xc]
lea rax, vtable.asw::log::detail::LogModule.1.0
mov qword [rcx + rdi], rax
mov rax, qword [rdi]
movsxd rcx, dword [rax + 0x10]
lea rax, vtable.asw::log::detail::LogModule.0
mov qword [rcx + rdi], rax
mov rax, qword [rdi]
movsxd rcx, dword [rax + 8]
lea edx, [rcx - 0x20]
mov dword [rcx + rdi - 4], edx
mov rax, qword [rdi]
movsxd rcx, dword [rax + 0x10]
lea edx, [rcx - 0x48]
mov dword [rcx + rdi - 4], edx
mov rcx, qword [rdi + 8]
mov dword [rsp + 0x30], 0x32433437
mov dword [rsp + 0x34], 0x31353045
mov dword [rsp + 0x40], 0x5f676f6c
mov dword [rsp + 0x44], 0x75646f6d
mov dword [rsp + 0x48], 0x656c
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x4c], rax
mov dword [rsp + 0x54], 0x1f
mov rax, qword [rcx]
lea r9, [rsp + 0x40]
mov r8d, 2
lea rdx, [rsp + 0x60]
mov rax, qword [rax + 0x20]
call qword [case.0x1400a96cf.0]
lea rcx, [rsp + 0x60]
call fcn.14006efc0
lea rcx, [rsp + 0x60]
call fcn.140052560
mov rcx, qword [rdi + 8]
mov dword [rsp + 0x30], 0x32433437
mov dword [rsp + 0x34], 0x31353045
mov dword [rsp + 0x40], 0x5f676f6c
mov dword [rsp + 0x44], 0x75646f6d
mov dword [rsp + 0x48], 0x656c
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x4c], rax
mov dword [rsp + 0x54], 0x20
mov rax, qword [rcx]
lea r9, [rsp + 0x40]
mov r8d, 2
lea rdx, [rsp + 0x60]
mov rax, qword [rax + 0x20]
call qword [case.0x1400a96cf.0]
lea rcx, [rsp + 0x60]
call fcn.14006f010
lea rcx, [rsp + 0x60]
call fcn.140052560
lea rcx, [rdi + 8]
call fcn.14000d280
nop
lea rcx, [rdi + 0x40]
call fcn.14005ec40
lea rax, vtable.asw::mi::IExportable.0
mov qword [rdi + 0x20], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x34], 0xffffffff
mov rdx, qword [rsp + 0x30]
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
jmp fcn.14005eea0
Function at 0x140070240
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0xc0
mov rax, qword [0x1401761c0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, rcx
mov rbp, rdx
mov eax, dword [rcx + 0xe0]
cmp dword [rdx], eax
jl 0x1400703e8
call fcn.140070a60
lea rax, [0x14014fee0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 2
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x90]
mov rcx, rbp
call fcn.140074900
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
lea rcx, [rsi + 0x80]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsi + 0xb0]
test rax, rax
je 0x1400702e7
lock inc dword [rax + 8]
mov r14, qword [rsi + 0xa8]
mov qword [rsp + 0x80], r14
mov rax, qword [rsi + 0xb0]
mov qword [rsp + 0x88], rax
lea rcx, [rsi + 0x80]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
xor eax, eax
mov dword [rsp + 0x78], eax
lea rdx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0xf
cmova rdx, qword [rsp + 0x90]
lea rdi, [rax - 1]
test r14, r14
je 0x140070341
mov rcx, qword [r14]
jmp 0x140070344
mov rcx, rdi
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
mov r8d, dword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140070410
mov eax, dword [rsi + 0xe4]
cmp dword [rbp], eax
jl 0x14007038b
mov rax, qword [rsp + 0x80]
test rax, rax
je 0x140070381
mov rcx, qword [rax]
jmp 0x140070384
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
nop
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x1400703db
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400703db
mov rbx, qword [rsp + 0x88]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x1400a96cf.0]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1400703db
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400a96cf.0]
nop
lea rcx, [rsp + 0x90]
call fcn.140026240
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400b89f0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.1400aa630
lea rdx, [0x140172368]
lea rcx, [rsp + 0x50]
call fcn.1400bb9a0
int3
Function at 0x140070a60
Capabilities:
Get file size

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1401761c0]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
lea rbx, [rcx + 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r14, [rsi + 0xa8]
mov rax, qword [r14 + 8]
test rax, rax
je 0x140070abc
lock inc dword [rax + 8]
mov r15, qword [r14]
mov qword [rsp + 0x60], r15
mov rax, qword [r14 + 8]
mov qword [rsp + 0x68], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdi, 0xffffffffffffffff
test r15, r15
je 0x140070ae8
mov rcx, qword [r15]
jmp 0x140070aeb
mov rcx, rdi
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140070c49
mov rax, qword [rsi + 0xd8]
cmp qword [rsp + 0x70], rax
jl 0x140070bae
mov qword [rsp + 0x20], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rcx, qword [r14]
test rcx, rcx
je 0x140070b2c
mov rcx, qword [rcx]
jmp 0x140070b2f
mov rcx, rdi
lea rdx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140070c1d
mov rax, qword [rsi + 0xd8]
cmp qword [rsp + 0x78], rax
jl 0x140070ba2
mov rax, qword [r14]
test rax, rax
je 0x140070b5d
mov rcx, qword [rax]
jmp 0x140070b60
mov rcx, rdi
lea rbx, [rsi + 0xb8]
mov rdx, rbx
call fcn.14006fb80
cmp qword [rbx + 0x18], 7
jbe 0x140070b79
mov rbx, qword [rbx]
xor r9d, r9d
mov r8, rbx
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.140070440
mov rdx, rax
mov rcx, r14
call fcn.14003bef0
lea rcx, [rsp + 0x28]
call fcn.14000d280
nop
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140070bf4
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140070bf4
mov rbx, qword [rsp + 0x68]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x1400a96cf.0]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x140070bf4
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400a96cf.0]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400b89f0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov edx, eax
lea r8, str.Unable_to_get_file_size_
lea rcx, [rsp + 0x38]
call fcn.1400aa6a0
lea rdx, [0x140172368]
lea rcx, [rsp + 0x38]
call fcn.1400bb9a0
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea r8, str.Unable_to_get_file_size_
lea rcx, [rsp + 0x38]
call fcn.1400aa6a0
lea rdx, [0x140172368]
lea rcx, [rsp + 0x38]
call fcn.1400bb9a0
int3
Function at 0x140072530
Capabilities:
Create thread

Disassembly:
movsxd rax, dword [rcx - 4]
sub rcx, rax
jmp 0x140072530
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rax, qword [0x1401761c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, qword [rsp + 0x60]
xor ebp, ebp
mov ecx, 0xb0
call fcn.1400b8a40
mov rbx, rax
mov qword [rsp + 0x40], rax
mov word [rax], bp
lea rcx, [rax + 8]
mov dword [rcx], ebp
mov qword [rcx + 8], rbp
mov qword [rcx + 0x10], rbp
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
movups xmmword [rcx + 0x28], xmm0
movups xmmword [rcx + 0x38], xmm0
mov qword [rcx + 0x48], rbp
lea edx, [rbp + 2]
call fcn.1400b7f38
lea rcx, [rbx + 0x58]
call fcn.1400b8440
xorps xmm0, xmm0
movups xmmword [rbx + 0xa0], xmm0
mov rdi, qword [rsi - 0x28]
mov qword [rsi - 0x28], rbx
test rdi, rdi
je 0x1400725e8
cmp dword [rdi + 0xa8], ebp
jne 0x140072686
lea rcx, [rdi + 0x58]
call fcn.1400b66d0
lea rcx, [rdi + 8]
call fcn.1400b66d0
mov edx, 0xb0
mov rcx, rdi
call fcn.1400b8a80
lea rbx, [rsi - 0x110]
mov ecx, 8
call fcn.1400b8a40
mov qword [rax], rbx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x1400734c0]
xor edx, edx
xor ecx, ecx
call fcn.1400ca7a8
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140072677
mov rax, qword [rsi - 0x28]
cmp dword [rax + 0xa8], 0
jne 0x14007268c
xorps xmm0, xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movups xmmword [rax + 0xa0], xmm1
cmp dword [rsp + 0x38], 0
jne 0x14007268c
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400b89f0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov dword [rsp + 0x38], ebp
mov ecx, 6
call fcn.1400b78c0
nop
call fcn.1400c8abc
int3
call fcn.1400c8abc
int3
Function at 0x140077040
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, qword [rsp + 0x40]
mov ecx, pe_nt_image_headers64
call fcn.1400b8a40
xor edx, edx
mov r8d, pe_nt_image_headers64
mov rcx, rax
mov rbx, rax
call fcn.1400fed10
mov rcx, qword [rdi + 8]
mov qword [rdi + 8], rbx
test rcx, rcx
je 0x140077088
mov edx, pe_nt_image_headers64
call fcn.1400b8a80
mov rcx, qword [rdi + 8]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.140078040

Function at 0x1400770d0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rcx + 8]
add rsp, 0x28
jmp fcn.140078390

Function at 0x140077250
Capabilities:
Hash data with md5

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
sub rsp, 0x90
mov rax, qword [0x1401761c0]
xor rax, rsp
mov qword [rsp + 0x88], rax
xor eax, eax
mov rbx, r8
mov r8, qword [r11 + 0x10]
mov rdx, rcx
mov qword [r11 - 0x68], rax
lea rcx, [r11 - 0x78]
mov dword [rsp + 0x20], 0x67452301
mov dword [rsp + 0x24], 0xefcdab89
mov dword [rsp + 0x28], 0x98badcfe
mov dword [rsp + 0x2c], 0x10325476
call fcn.140077330
test rbx, rbx
je 0x140077312
mov rdx, qword [rsp + 0x30]
mov ecx, 0x78
mov qword [rsp + 0x80], rdx
mov r8d, 0x38
shr edx, 3
and edx, 0x3f
sub ecx, edx
sub r8d, edx
cmp edx, 0x38
lea rdx, [0x140150540]
cmovae r8d, ecx
lea rcx, [rsp + 0x20]
call fcn.140077330
mov r8d, 8
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x20]
call fcn.140077330
movaps xmm0, xmmword [rsp + 0x20]
movups xmmword [rbx], xmm0
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400b89f0
add rsp, 0x90
pop rbx
ret

Function at 0x140078040
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x20
mov rbx, qword [rsp + 0x30]
xor edx, edx
movups xmm0, xmmword [0x140152a00]
mov r8d, 0x100
movups xmmword [rbx], xmm0
lea rcx, [rbx + 0x20]
movups xmm1, xmmword [0x140152a10]
movups xmmword [rbx + 0x10], xmm1
call fcn.1400fed10
mov rcx, qword [0x14017f770]
xor eax, eax
mov qword [rbx + 0x120], rax
mov dword [rbx + 0x128], eax
mov qword [rbx + 0x130], rax
mov qword [rbx + 0x138], rax
movabs rax, 0x1000000010000000
test rax, rcx
je 0x1400780cc
mov edx, 0x20
lea ecx, [rdx + 0x20]
call fcn.14007c820
mov rcx, qword [0x14017f770]
mov qword [rbx + 0x130], rax
lea rax, [0x140001740]
mov qword [rbx + 0x138], rax
test cl, 0x20
je 0x140078148
lea rax, [0x140002840]
mov qword [rbx + 0x138], rax
bt rcx, 0x12
jae 0x140078108
lea rax, [0x140007340]
mov qword [rbx + 0x138], rax
add rsp, 0x20
pop rbx
ret
bt rcx, 0xa
jae 0x140078148
mov rax, rcx
and eax, 0x5000
cmp rax, 0x5000
jne 0x140078133
lea rax, [0x140005300]
mov qword [rbx + 0x138], rax
add rsp, 0x20
pop rbx
ret
bt rcx, 0x29
jae 0x140078148
lea rax, [0x140003d60]
mov qword [rbx + 0x138], rax
add rsp, 0x20
pop rbx
ret
Function at 0x140078390
Capabilities:
Hash data using sha256

Disassembly:
mov rax, rsp
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rdi
sub rsp, 0x28
mov rbx, rcx
mov edi, r8d
test rcx, rcx
je 0x140078506
mov qword [rax + 0x20], rsi
mov rsi, rdx
test rdx, rdx
jne 0x1400783c6
test dil, 1
je 0x140078411
mov rcx, rbx
call fcn.1400782d0
test rsi, rsi
je 0x140078411
mov eax, dword [rbx]
bswap eax
mov dword [rsi], eax
mov eax, dword [rbx + 4]
bswap eax
mov dword [rsi + 4], eax
mov eax, dword [rbx + 8]
bswap eax
mov dword [rsi + 8], eax
mov eax, dword [rbx + 0xc]
bswap eax
mov dword [rsi + 0xc], eax
mov eax, dword [rbx + 0x10]
bswap eax
mov dword [rsi + 0x10], eax
mov eax, dword [rbx + 0x14]
bswap eax
mov dword [rsi + 0x14], eax
mov eax, dword [rbx + 0x18]
bswap eax
mov dword [rsi + 0x18], eax
mov eax, dword [rbx + 0x1c]
bswap eax
mov dword [rsi + 0x1c], eax
test dil, 3
je 0x140078468
test dil, 2
je 0x140078501
movups xmm0, xmmword [0x140152a00]
lea rcx, [rbx + 0x20]
xor edx, edx
mov r8d, 0x100
movups xmmword [rbx], xmm0
movups xmm1, xmmword [0x140152a10]
movups xmmword [rbx + 0x10], xmm1
call fcn.1400fed10
mov rsi, qword [rsp + 0x58]
mov qword [rbx + 0x120], 0
mov dword [rbx + 0x128], 0
add rsp, 0x28
pop rdi
pop rbx
ret
mov rsi, qword [rbx + 0x130]
and edi, 8
test rsi, rsi
je 0x1400784e2
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x1400784b3
mov qword [rsp + 0x20], r14
test edi, edi
je 0x140078494
mov r8d, dword [rsi + 0x24]
xor edx, edx
call fcn.1400fed10
mov edx, dword [rsi + 0x24]
mov r8d, 0x8000
mov rcx, qword [rsi + 0x10]
mov rax, qword [0x14017f778]
call qword [case.0x1400a96cf.0]
mov r14, qword [rsp + 0x20]
test edi, edi
je 0x1400784c7
xor edx, edx
mov r8d, 0xc0
mov rcx, rsi
call fcn.1400fed10
mov rax, qword [0x14017f788]
mov rcx, rsi
call qword [case.0x1400a96cf.0]
mov qword [rbx + 0x130], 0
mov qword [rbx + 0x138], 0
test edi, edi
je 0x140078501
xor edx, edx
mov r8d, pe_nt_image_headers64
mov rcx, rbx
call fcn.1400fed10
mov rsi, qword [rsp + 0x58]
add rsp, 0x28
pop rdi
pop rbx
ret
Function at 0x140080da0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
mov byte [r11 + 0x18], r8b
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x1401761c0]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbp, rdx
lea rbx, [rsp + 0x20]
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rsi, rcx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0x104
jne 0x140080e1c
mov ecx, 0x10000
call fcn.1400c89d0
mov rbx, rax
test rax, rax
je 0x140080e8b
mov r8d, 0x8000
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140080e96
cmp byte [rsp + 0x480], dil
je 0x140080e5f
mov r8d, 0x104
lea rdx, [rsp + 0x230]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x140080e5f
lea rax, [rsp + 0x20]
cmp rbx, rax
je 0x140080e57
mov rcx, rbx
call fcn.1400c89e0
lea rbx, [rsp + 0x230]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140080e96
mov r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], di
jne 0x140080e74
mov rdx, rbx
mov rcx, rbp
call fcn.14000be50
jmp 0x140080e9e
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rax, [rsp + 0x20]
cmp rbx, rax
je 0x140080ebd
lea rax, [rsp + 0x230]
cmp rbx, rax
je 0x140080ebd
mov rcx, rbx
call fcn.1400c89e0
mov eax, edi
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400b89f0
mov rbx, qword [rsp + 0x488]
add rsp, 0x450
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400811c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbp
push rdi
push r14
sub rsp, 0x270
mov rax, qword [0x1401761c0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r14, rcx
mov rbp, rdx
mov rdi, r8
test rcx, rcx
je 0x140081335
test rdx, rdx
je 0x140081335
cmp qword [r8 + 0x18], 7
mov rax, r8
mov qword [r11 - 0x28], rsi
jbe 0x14008121c
mov rax, qword [r8]
xor ecx, ecx
mov qword [rsp + 0x268], rbx
mov qword [rdi + 0x10], rcx
xor r9d, r9d
mov word [rax], cx
xor r8d, r8d
lea rax, [rsp + 0x34]
mov word [rsp + 0x40], cx
mov qword [rsp + 0x28], rax
mov rdx, rbp
lea rax, [rsp + 0x40]
mov dword [rsp + 0x34], 0x208
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp eax, 0xea
jne 0x1400812f3
mov eax, dword [rsp + 0x34]
lea rdx, [0x140133c10]
add eax, 2
mov ecx, eax
mov dword [rsp + 0x30], eax
call fcn.1400b8fb0
mov rbx, rax
test rax, rax
je 0x1400812ec
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rbx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x1400812e2
mov edx, dword [rsp + 0x30]
shr edx, 1
je 0x1400812d4
nop dword [rax]
lea r8d, [rdx - 1]
cmp word [rbx + r8*2], 0
jne 0x1400812d4
mov edx, r8d
test r8d, r8d
jne 0x1400812c0
mov r8d, edx
mov rcx, rdi
mov rdx, rbx
call fcn.14000be50
mov rcx, rbx
call fcn.1400b8a80
jmp 0x140081321
mov esi, 8
jmp 0x140081321
test eax, eax
jne 0x140081321
mov ecx, dword [rsp + 0x34]
shr ecx, 1
je 0x140081311
nop
lea edx, [rcx - 1]
cmp word [rsp + rdx*2 + 0x40], 0
jne 0x140081311
mov ecx, edx
test edx, edx
jne 0x140081300
mov r8d, ecx
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14000be50
mov rbx, qword [rsp + 0x268]
mov eax, esi
mov rsi, qword [rsp + 0x260]
jmp 0x14008133a
mov eax, 0x57
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400b89f0
add rsp, 0x270
pop r14
pop rdi
pop rbp
ret
Function at 0x140084cd0
Capabilities:
Inspect section memory permissions

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rsp + 0x40]
mov edi, dword [rsp + 0x48]
bts edi, 0x1c
movzx eax, word [rbx]
cmp ax, 0x5c
je 0x140084d06
cmp ax, 0x2f
jne 0x140084d26
movzx ecx, word [rbx + 2]
cmp cx, 0x5c
je 0x140084d16
cmp cx, 0x2f
jne 0x140084d26
movzx ecx, word [rbx + 4]
cmp cx, 0x3f
je 0x140084d26
cmp cx, 0x2e
jne 0x140084d4f
mov ecx, 0xffdf
and ax, cx
sub ax, 0x41
cmp ax, 0x19
ja 0x140084d8a
cmp word [rbx + 2], 0x3a
jne 0x140084d8a
movzx eax, word [rbx + 4]
cmp ax, 0x5c
je 0x140084d4f
cmp ax, 0x2f
jne 0x140084d8a
test edi, 0x600000
jne 0x140084d8a
mov rcx, rbx
call fcn.140083700
mov rsi, rax
test rax, rax
je 0x140084d8a
mov r8, qword [rsp + 0x50]
mov edx, edi
mov rcx, rax
call fcn.140084770
mov rcx, rsi
mov ebx, eax
call fcn.1400b8a80
mov eax, ebx
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
mov r8, qword [rsp + 0x50]
mov edx, edi
mov rcx, rbx
add rsp, 0x20
pop rdi
pop rsi
pop rbx
jmp fcn.140084770