joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007200
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x80
mov rax, qword [0x140010200]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, qword [rsp + 0xd0]
xor ebp, ebp
movsx eax, dl
add eax, 0xffffffa8
mov r10, rcx
lea r11, str.0123456789abcdef
mov dword [rsp + 0x24], ebp
mov esi, ebp
cmp eax, 0x20
ja case.0x140007265.89
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0x7458]
mov ecx, dword [rdx + rax*4 + 0x7440]
add rcx, rdx
jmp rcx
mov ecx, 0xa
test r10, r10
jns 0x14000727e
mov dword [rsp + 0x24], 0x2d
neg r10
jmp 0x1400072a7
test r8d, r8d
je 0x1400072a7
mov dword [rsp + 0x24], 0x2b
jmp 0x1400072a7
mov ecx, 8
jmp 0x1400072a7
mov ecx, 0xa
jmp 0x1400072a7
lea r11, str.0123456789ABCDEF
mov ecx, 0x10
mov qword [rsp + 0x90], rdi
mov edi, dword [rsp + 0xc0]
test r10, r10
jne 0x1400072c8
cmp dword [rsp + 0xc8], esi
je 0x1400072c8
test edi, edi
je 0x1400072ef
lea r8, [rsp + 0x30]
nop dword [rax]
xor edx, edx
mov rax, r10
inc esi
div rcx
lea r8, [r8 + 1]
mov r10, rax
movzx eax, byte [rdx + r11]
mov byte [r8 - 1], al
test r10, r10
jne 0x1400072d0
mov eax, dword [rsp + 0xb0]
sub edi, esi
cmovs edi, ebp
sub eax, edi
sub eax, esi
cmovs eax, ebp
mov dword [rsp + 0x20], eax
test r9d, r9d
je 0x140007311
neg eax
mov dword [rsp + 0x20], eax
mov ecx, dword [rsp + 0xb8]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x24]
mov r9, rbx
call fcn.140007a40
test edi, edi
jle 0x140007360
nop
mov rax, qword [rbx + 0x10]
dec edi
test rax, rax
je 0x140007353
cmp qword [rbx], rax
jb 0x140007353
cmp qword [rbx + 0x18], rbp
jne 0x14000734b
inc dword [rbx + 0x20]
jmp 0x14000735c
mov rcx, rbx
call fcn.1400066a0
mov rax, qword [rbx]
mov byte [rax], 0x30
inc qword [rbx]
test edi, edi
jg 0x140007330
movsxd rdi, esi
test esi, esi
jle 0x1400073a7
nop word [rax + rax]
mov rax, qword [rbx + 0x10]
movsx esi, byte [rsp + rdi + 0x2f]
dec rdi
test rax, rax
je 0x140007399
cmp qword [rbx], rax
jb 0x140007399
cmp qword [rbx + 0x18], rbp
jne 0x140007391
inc dword [rbx + 0x20]
jmp 0x1400073a2
mov rcx, rbx
call fcn.1400066a0
mov rax, qword [rbx]
mov byte [rax], sil
inc qword [rbx]
test rdi, rdi
jg 0x140007370
mov eax, dword [rsp + 0x20]
test eax, eax
jns 0x140007414
neg eax
movsxd rsi, eax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140007406
mov rdi, qword [rbx]
cmp rdi, rax
jb 0x140007406
mov r9, qword [rbx + 0x18]
test r9, r9
jne 0x1400073d3
inc dword [rbx + 0x20]
jmp 0x14000740f
mov rcx, qword [rbx + 8]
sub rdi, rcx
cmp byte [rbx + 0x24], bpl
jne 0x1400073ff
test rdi, rdi
je 0x1400073ff
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x1400073ff
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], 0x20
inc qword [rbx]
dec rsi
jne 0x1400073b4
mov rdi, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400096d0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rsi
ret
Function at 0x140007480
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
xor eax, eax
lea edi, [r8 - 1]
mov qword [rsp + 0x30], rbp
test edi, edi
mov rbx, r9
mov ebp, ecx
cmovs edi, eax
test edx, edx
je 0x1400074a5
neg edi
mov qword [rsp + 0x38], rsi
test edi, edi
jle 0x140007511
nop
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140007502
mov rsi, qword [rbx]
cmp rsi, rax
jb 0x140007502
mov r9, qword [rbx + 0x18]
test r9, r9
jne 0x1400074cf
inc dword [rbx + 0x20]
jmp 0x14000750b
mov rcx, qword [rbx + 8]
sub rsi, rcx
cmp byte [rbx + 0x24], 0
jne 0x1400074fb
test rsi, rsi
je 0x1400074fb
mov r8, rsi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rsi
je 0x1400074fb
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], 0x20
inc qword [rbx]
dec edi
test edi, edi
jg 0x1400074b0
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140007533
cmp qword [rbx], rax
jb 0x140007533
cmp qword [rbx + 0x18], 0
jne 0x14000752b
inc dword [rbx + 0x20]
jmp 0x14000753c
mov rcx, rbx
call fcn.1400066a0
mov rax, qword [rbx]
mov byte [rax], bpl
inc qword [rbx]
mov rbp, qword [rsp + 0x30]
test edi, edi
jns 0x1400075b0
neg edi
movsxd rsi, edi
nop word [rax + rax]
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1400075a2
mov rdi, qword [rbx]
cmp rdi, rax
jb 0x1400075a2
mov r9, qword [rbx + 0x18]
test r9, r9
jne 0x14000756f
inc dword [rbx + 0x20]
jmp 0x1400075ab
mov rcx, qword [rbx + 8]
sub rdi, rcx
cmp byte [rbx + 0x24], 0
jne 0x14000759b
test rdi, rdi
je 0x14000759b
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x14000759b
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], 0x20
inc qword [rbx]
dec rsi
jne 0x140007550
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400078c0
Capabilities:
Write file on windows

Disassembly:
test edx, edx
jle 0x140007989
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x20
mov qword [rsp + 0x30], rsi
mov rbx, r8
mov ebp, edx
mov qword [rsp + 0x38], rdi
mov r14, rcx
nop word [rax + rax]
cmp qword [rbx + 0x10], 0
je 0x1400078fe
mov eax, dword [rbx + 0x10]
sub eax, dword [rbx]
jmp 0x140007900
mov eax, ebp
test eax, eax
jg 0x140007945
mov r9, qword [rbx + 0x18]
test r9, r9
je 0x14000796c
mov rcx, qword [rbx + 8]
mov rdi, qword [rbx]
sub rdi, rcx
cmp byte [rbx + 0x24], 0
jne 0x14000793c
test rdi, rdi
je 0x14000793c
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x14000793c
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
jmp 0x140007966
mov rcx, qword [rbx]
cmp eax, ebp
mov esi, ebp
cmovl esi, eax
mov rdx, r14
movsxd rdi, esi
mov r8, rdi
call qword [sym.imp.MSVCR120.dll_memmove]
add qword [rbx], rdi
add r14, rdi
sub ebp, esi
test ebp, ebp
jg 0x1400078f0
jmp 0x14000796f
add dword [rbx + 0x20], ebp
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140007a40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
cmp dword [r8], 0
mov rbx, r9
mov rdi, r8
mov r14, rdx
mov esi, ecx
jle 0x140007ab8
test ecx, ecx
je 0x140007ab8
mov ecx, dword [rdx]
test ecx, ecx
je 0x140007a81
mov rdx, rbx
call fcn.140007990
dec dword [rdi]
mov dword [r14], 0
cmp dword [rdi], 0
jle 0x140007ab8
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140007aa8
cmp qword [rbx], rax
jb 0x140007aa8
cmp qword [rbx + 0x18], 0
jne 0x140007aa0
inc dword [rbx + 0x20]
jmp 0x140007ab1
mov rcx, rbx
call fcn.1400066a0
mov rax, qword [rbx]
mov byte [rax], sil
inc qword [rbx]
dec dword [rdi]
cmp dword [rdi], 0
jg 0x140007a86
xor eax, eax
cmp dword [r14], eax
setne al
cmp dword [rdi], eax
jle 0x140007b2d
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140007b16
mov rsi, qword [rbx]
cmp rsi, rax
jb 0x140007b16
mov r9, qword [rbx + 0x18]
test r9, r9
jne 0x140007ae3
inc dword [rbx + 0x20]
jmp 0x140007b1f
mov rcx, qword [rbx + 8]
sub rsi, rcx
cmp byte [rbx + 0x24], 0
jne 0x140007b0f
test rsi, rsi
je 0x140007b0f
mov r8, rsi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rsi
je 0x140007b0f
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], 0x20
inc qword [rbx]
dec dword [rdi]
xor eax, eax
cmp dword [r14], eax
setne al
cmp dword [rdi], eax
jg 0x140007ac4
mov esi, dword [r14]
test esi, esi
je 0x140007b6f
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140007b56
cmp qword [rbx], rax
jb 0x140007b56
cmp qword [rbx + 0x18], 0
jne 0x140007b4e
inc dword [rbx + 0x20]
jmp 0x140007b5f
mov rcx, rbx
call fcn.1400066a0
mov rax, qword [rbx]
mov byte [rax], sil
inc qword [rbx]
mov eax, dword [rdi]
test eax, eax
jle 0x140007b69
dec eax
jmp 0x140007b6d
jns 0x140007b6f
inc eax
mov dword [rdi], eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140008380
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1400083a8
call qword [sym.imp.MSVCR120.dll__errno]
mov dword [rax], 2
xor eax, eax
add rsp, 0x20
pop rbx
ret
test al, 0x10
jne 0x1400083c0
call qword [sym.imp.MSVCR120.dll__errno]
mov dword [rax], 0x14
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov ecx, 0x120
mov qword [rsp + 0x30], rdi
call qword [sym.imp.MSVCR120.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1400083f1
call qword [sym.imp.MSVCR120.dll__errno]
mov rdi, qword [rsp + 0x30]
mov dword [rax], 0xc
xor eax, eax
add rsp, 0x20
pop rbx
ret
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400083f5
add rcx, 4
call qword [sym.imp.MSVCR120.dll_malloc]
mov rcx, rax
mov qword [rdi], rax
test rax, rax
jne 0x140008435
call qword [sym.imp.MSVCR120.dll__errno]
mov rcx, rdi
mov dword [rax], 0xc
call qword [sym.imp.MSVCR120.dll_free]
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, rax
nop dword [rax + rax]
movzx eax, byte [rbx]
lea rdx, [rdx + 1]
lea rbx, [rbx + 1]
mov byte [rdx - 1], al
test al, al
jne 0x140008440
or rax, 0xffffffffffffffff
nop word [rax + rax]
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x140008460
cmp byte [rax + rcx - 1], 0x2f
je 0x1400084aa
or rax, 0xffffffffffffffff
nop word [rax + rax]
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x140008480
cmp byte [rax + rcx - 1], 0x5c
je 0x1400084aa
lea rdx, [rcx - 1]
cmp byte [rdx + 1], 0
lea rdx, [rdx + 1]
jne 0x140008496
movzx eax, word [0x14000c168]
mov word [rdx], ax
dec rcx
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1400084b0
movzx eax, word [0x14000c16c]
mov qword [rdi + 0x118], 0xffffffffffffffff
mov word [rcx], ax
xor eax, eax
mov dword [rdi + 8], eax
mov word [rdi + 0xc], ax
mov rax, rdi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
Function at 0x1400084f0
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x140010200]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x118]
lea rdx, [rsp + 0x20]
cmp rcx, 0xffffffffffffffff
jne 0x140008562
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rbx + 0x118], rax
cmp rax, 0xffffffffffffffff
jne 0x140008577
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140008551
call qword [sym.imp.MSVCR120.dll__errno]
mov dword [rax], 0
xor eax, eax
jmp 0x1400085b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140008f40
xor eax, eax
jmp 0x1400085b5
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140008577
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jmp 0x14000853f
lea rdx, [rsp + 0x4c]
mov rax, rbx
lea rcx, [rsp + 0x4c]
sub rax, rdx
lea rdx, [rax + 0x10]
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rdx + rcx - 1], al
test al, al
jne 0x140008590
or rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax + 0x10], 0
jne 0x1400085a3
mov word [rbx + 0xe], ax
lea rax, [rbx + 8]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400096d0
add rsp, 0x170
pop rbx
ret

Function at 0x1400088e0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
cmp qword [str.msvcrt], 0
mov rsi, rcx
je 0x140008990
mov qword [rsp + 0x30], rbp
lea rbp, str.msvcrt
mov qword [rsp + 0x38], rdi
xor edi, edi
mov rcx, rbp
mov ebx, edi
mov rax, qword [rbx + rbp + 0x10]
test rax, rax
jne 0x140008967
cmp qword [rbx + rbp + 8], rax
jne 0x14000896c
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbx + rbp + 8], rax
test rax, rax
jne 0x140008942
mov qword [rbx + rbp + 8], 0xffffffffffffffff
jmp 0x14000896c
lea rdx, [0x14000c2a0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + rbp + 0x10], rax
test rax, rax
jne 0x140008967
mov qword [rbx + rbp + 8], 0xffffffffffffffff
jmp 0x14000896c
mov rcx, rsi
call rax
inc rdi
lea rcx, [rdi + rdi*2]
lea rbx, [rcx*8]
cmp qword [rbx + rbp], 0
lea rcx, [rbx + rbp]
jne 0x140008913
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.MSVCR120.dll__strdup]
mov rbx, rax
test rax, rax
je 0x1400089c0
mov edx, 0x3d
mov rcx, rax
call qword [sym.imp.MSVCR120.dll_strchr]
mov rdx, rax
test rax, rax
jne 0x1400089ce
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_free]
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov byte [rax], 0
inc rdx
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x1400089e0
test rax, rax
je 0x1400089fb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x1400089b7
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_free]
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
jmp qword [sym.imp.MSVCR120.dll__putenv]
Function at 0x140017fcd
Capabilities:
Resolve function by hash

Disassembly:
movabs eax, dword fs:[0xc78c08500000030]
mov eax, dword [rax + 0xc]
mov esi, dword [rax + 0x1c]
lodsd eax, dword [rsi]
mov ebx, dword [rax + 8]
jmp 0x140017fec
pop rsi
add esi, 3
push rbx
mov edx, 0xec0e4e8e
call rsi
push rax
mov edx, 0x7c0dfcaa
call rsi
push rax
push rdi
mov edx, 0x4ee4a045
call rsi
xor edx, edx
push rdx
push 0x6d756369
push 0x6c656167
push rsp
push rdx
push rdx
call rax
push rax
mov edx, 0x75da1966
call rsi
call rax
xchg edi, eax
mov edx, 0xffd97fb
call rsi
call rax
cmp edi, 0xb7
jne 0x14001803b
mov esp, ebp
invalid
call fcn.14001805c
sti
xchg edi, eax
std
pcmpeqd mm5, qword [rbp - 0x50]
jb 0x140018048
jb 0x140018048
mov bl, 0x16
movabs eax, dword [0xd368a7c7d2d83d6a]
invalid
Function at 0x140007ca0
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rcx, qword [0x1400410c0]
test rcx, rcx
je 0x140007cd8
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140007cf8
mov rcx, qword [0x1400410c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x1400420e0], 0
jne 0x140007d10
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, qword [0x1400410c0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x140007ccb
mov edx, 0x414
lea r12, [rsp + 0x20]
lea rsi, [0x14001d392]
mov qword [rsp + 0x20], 0
lea rdi, [0x140042100]
movq xmm0, rsi
mov rcx, r12
mov dword [rsp + 0x28], 3
movq xmm6, rdi
mov word [rsp + 0x40], dx
mov rbp, qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, 0x14
punpcklqdq xmm6, xmm0
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], rsi
movaps xmmword [rsp + 0x30], xmm6
call rbp
mov r13, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140007de4
test al, 0x10
je 0x140007ce1
mov ecx, 0x64
call r14
mov eax, 0x414
mov qword [rsp + 0x50], rsi
mov rcx, r12
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 3
mov word [rsp + 0x40], ax
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
movaps xmmword [rsp + 0x30], xmm6
call rbp
sub ebx, 1
je 0x140007ce1
mov rcx, rdi
call r13
cmp eax, 0xffffffff
jne 0x140007d90
jmp 0x140007ce1

Function at 0x14000e450
Capabilities:
Create directory

Disassembly:
push rdi
mov eax, 0x2020
push rsi
push rbx
call fcn.140015910
sub rsp, rax
mov eax, dword [0x140046100]
mov rsi, rcx
test eax, eax
je 0x14000e4f0
xor ebx, ebx
lea rdi, [0x140044100]
test eax, eax
jg 0x14000e48c
jmp 0x14000e4a0
add rbx, 1
cmp dword [0x140046100], ebx
jle 0x14000e4a0
mov rdx, qword [rdi + rbx*8]
mov rcx, rsi
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x14000e480
jmp 0x14000e4d7
mov rcx, rsi
call sub.msvcrt.dll_wcslen
cmp rax, 2
jne 0x14000e4b5
cmp word [rsi + 2], 0x3a
je 0x14000e4d7
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14000e540
movsxd rbx, dword [0x140046100]
cmp ebx, 0x3ff
jle 0x14000e558
mov eax, 1
add rsp, 0x2020
pop rbx
pop rsi
pop rdi
ret
lea rdi, [rsp + 0x20]
lea rbx, str.HOME
mov r8d, 0x1000
mov rdx, rbx
mov rcx, rdi
call fcn.140007540
test al, al
je 0x14000e57a
movsxd rbx, dword [0x140046100]
mov rcx, rdi
lea rdi, [0x140044100]
call sub.msvcrt.dll__wcsdup
mov qword [rdi + rbx*8], rax
mov eax, dword [0x140046100]
add eax, 1
mov dword [0x140046100], eax
jmp 0x14000e471
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000e4c4
xor eax, eax
jmp 0x14000e4dc
mov rcx, rsi
call sub.msvcrt.dll__wcsdup
add dword [0x140046100], 1
mov rdx, rax
lea rax, [0x140044100]
mov qword [rax + rbx*8], rdx
jmp 0x14000e4d7
mov rcx, rbx
call fcn.140007be0
nop
nop word cs:[rax + rax]
nop
Function at 0x140003b50
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140003bad
lea rbx, [0x1400de0e0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140003b94
cmp r10, 2
jb 0x140003b94
cmp byte [r9], r8b
jne 0x140003b94
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140003b70
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140003bef
lea rbx, [0x1400de0e0]
cmp r8b, 0x23
jne 0x140003bd3
cmp byte [r9], r8b
jne 0x140003bd3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140003bc0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140003db0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x140003ddf
mov r8d, 0x7d7
lea rdx, str.D:Source_Codeoxcy_panel_full_lindooxcy_panel_full_lindoimgui_facturaimgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x140003deb
mov qword [rdi], 0
lea rdx, [0x1400dd908]
mov rcx, rbx
call fcn.140003c00
mov rbx, rax
test rax, rax
jne 0x140003e0d
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140003ee6
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003ee6
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140003ee6
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003ee6
cmp rsi, 0xffffffffffffffff
je 0x140003ee6
mov rax, qword [0x140235a20]
test rax, rax
je 0x140003e83
inc dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x140003ee6
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x140003ed3
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140235a20]
test rax, rax
je 0x140003ec8
dec dword [rax + 0xf4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140003eef
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x140003ee1
mov qword [rdi], rsi
mov rax, rbp
jmp 0x140003ef1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140007a60
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xf0], 0
mov rsi, rcx
movsxd rdi, edx
jg 0x140007a9c
mov r8d, 0x71f
lea rdx, str.D:Source_Codeoxcy_panel_full_lindooxcy_panel_full_lindoimgui_facturaimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rsi + 0xf8]
lea rdx, [0x1400de0e0]
movsxd r8, dword [rsi + 0xf0]
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, dil
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x39]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdx + rcx*4]
mov rcx, qword [rsi]
not ebx
cmp dword [rcx + 0x3f40], ebx
jne 0x140007b17
mov r8, rdi
mov edx, 4
mov ecx, ebx
call fcn.1400200c0
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140007b30
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp dword [rcx + 0xf0], 0
mov rdi, rdx
mov rbx, rcx
jg 0x140007b63
mov r8d, 0x71f
lea rdx, str.D:Source_Codeoxcy_panel_full_lindooxcy_panel_full_lindoimgui_facturaimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movss xmm0, dword [rbx + 0x110]
lea r10, [0x1400de0e0]
movsxd rcx, dword [rbx + 0xf0]
mov rax, qword [rbx + 0xf8]
movss xmm2, dword [rdi]
movss xmm1, dword [rbx + 0x114]
subss xmm2, xmm0
movss xmm3, dword [rdi + 4]
mov r9d, dword [rax + rcx*4 - 4]
subss xmm3, xmm1
movss xmm4, dword [rdi + 8]
not r9d
movzx ecx, r9b
subss xmm4, xmm0
movss xmm0, dword [rdi + 0xc]
shr r9d, 8
subss xmm0, xmm1
movd r8d, xmm2
movss dword [rsp + 0x20], xmm2
movzx eax, byte [rsp + 0x20]
xor rcx, rax
movss dword [rsp + 0x24], xmm3
mov eax, r8d
movss dword [rsp + 0x28], xmm4
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
movss dword [rsp + 0x2c], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0x24]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm3
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0x28]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm4
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
mov rbx, qword [rsp + 0x40]
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0x2c]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
shr r8, 0x18
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx edx, r9b
shr r9d, 8
xor r8, rdx
xor r9d, dword [r10 + r8*4]
not r9d
mov eax, r9d
add rsp, 0x30
pop rdi
ret