joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c1790
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r12
mov eax, 0x11cd0
call fcn.1400e0a90
sub rsp, rax
xor ebx, ebx
mov rbp, r8
movzx esi, dl
mov r12, rcx
test r8, r8
je 0x1400c17b9
mov qword [r8], rbx
cmp qword [rcx + 0x10], rbx
jne 0x1400c17c9
mov eax, 1
jmp 0x1400c19c1
mov dl, 1
call fcn.1400c1bc0
test eax, eax
je 0x1400c19c1
mov qword [rsp + 0x11cf0], rdi
mov qword [rsp + 0x11cf8], r13
call qword [sym.imp.USER32.DLL_GetForegroundWindow]
mov r8, qword [0x1401255c8]
mov rcx, r12
mov rdx, rax
mov rdi, rax
call fcn.1400c1c70
mov ecx, dword [0x14012c4bc]
test rax, rax
mov dword [rsp + 0x1874], ebx
mov qword [rsp + 0x1878], rbx
setne r13b
mov qword [rsp + 0x1880], rbx
mov qword [rsp + 0x1898], rbx
test r13b, r13b
mov qword [rsp + 0x18a8], rbx
mov qword [rsp + 0x18b0], rbx
cmove ecx, ebx
mov dword [0x14012c4bc], ecx
test sil, sil
je 0x1400c185c
mov byte [rsp + 0x1871], bl
test r13b, r13b
je 0x1400c1864
mov byte [rsp + 0x1871], 1
mov r8, qword [0x14012c4c8]
lea rax, [0x1400f1524]
test ecx, ecx
mov qword [rsp + 0x1038], rax
mov qword [rsp + 0x1048], rax
mov qword [rsp + 0x1050], rax
mov rax, qword [0x1401255c8]
mov qword [rsp + 0x1888], r8
mov dword [rsp + 0x1890], ecx
mov qword [rsp + 0x1040], rbx
mov qword [rsp + 0x1068], r12
mov dword [rsp + 0x20], reloc.OLEAUT32.DLL_SafeArrayGetDim
mov qword [rsp + 0x28], rax
setg sil
test r13b, r13b
je 0x1400c18f7
mov edx, ebx
test ecx, ecx
jle 0x1400c18e0
mov rax, r8
cmp qword [rax], rdi
je 0x1400c18f7
inc edx
add rax, 8
cmp edx, ecx
jl 0x1400c18d1
cmp ecx, 0x1f4
jge 0x1400c18f7
movsxd rax, ecx
inc ecx
mov qword [r8 + rax*8], rdi
mov dword [0x14012c4bc], ecx
mov dword [rsp + 0x1890], ecx
lea rdx, [rsp + 0x20]
lea rcx, [0x1400bf070]
call qword [sym.imp.USER32.DLL_EnumWindows]
mov rcx, qword [rsp + 0x1878]
test rcx, rcx
jne 0x1400c194d
test sil, sil
je 0x1400c1936
mov r8, qword [0x14012c4c8]
mov ecx, ebx
mov dword [0x14012c4bc], ebx
xor sil, sil
jmp 0x1400c18c3
test rbp, rbp
je 0x1400c1949
mov rax, qword [r12 + 0x20]
test rax, rax
je 0x1400c1949
mov qword [rbp], rax
xor eax, eax
jmp 0x1400c19b1
call fcn.1400be7b0
movsxd rcx, dword [0x14012c4bc]
mov rdx, qword [rsp + 0x1878]
mov r8, qword [0x14012c4c8]
test ecx, ecx
jle 0x1400c197f
mov rax, r8
nop
cmp qword [rax], rdx
je 0x1400c1993
inc ebx
add rax, 8
cmp ebx, ecx
jl 0x1400c1970
cmp ecx, 0x1f4
jge 0x1400c1993
mov qword [r8 + rcx*8], rdx
inc ecx
mov dword [0x14012c4bc], ecx
mov rax, qword [0x1401255c8]
mov ecx, dword [rax + 0x74]
cmp ecx, 0xffffffff
jle 0x1400c19ac
mov edx, 1
call fcn.140001b60
mov eax, 1
mov rdi, qword [rsp + 0x11cf0]
mov r13, qword [rsp + 0x11cf8]
mov rbx, qword [rsp + 0x11d00]
add rsp, 0x11cd0
pop r12
pop rsi
pop rbp
ret
Function at 0x1400c19e0
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x11ce0
call fcn.1400e0a90
sub rsp, rax
cmp qword [rcx + 0x10], 0
movzx edi, dl
mov rbx, rcx
je 0x1400c1ba5
xor edx, edx
call fcn.1400c1bc0
test eax, eax
jne 0x1400c1a20
mov rbx, qword [rsp + 0x11d00]
add rsp, 0x11ce0
pop rdi
ret
mov qword [rsp + 0x11cf0], rbp
mov qword [rsp + 0x11cf8], rsi
call qword [sym.imp.USER32.DLL_GetForegroundWindow]
mov r8, qword [0x1401255c8]
mov rcx, rbx
mov rdx, rax
mov rsi, rax
call fcn.1400c1c70
mov ecx, dword [0x14012c4bc]
xor ebp, ebp
test rax, rax
lea rax, [0x1400f1524]
cmovne ecx, ebp
mov qword [rsp + 0x1048], rax
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x1884], ebp
mov qword [rsp + 0x1888], rbp
mov qword [rsp + 0x1890], rbp
mov dword [0x14012c4bc], ecx
mov qword [rsp + 0x18b8], rbp
mov qword [rsp + 0x18c0], rbp
test dil, dil
je 0x1400c1aaa
mov byte [rsp + 0x1881], bpl
test ecx, ecx
je 0x1400c1ab2
mov byte [rsp + 0x1881], 1
mov rax, qword [0x14012c4c8]
mov dword [rsp + 0x18a0], ecx
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x1898], rax
mov rax, qword [rbx + 0x10]
lea rcx, [0x1400c1d90]
mov qword [rsp + 0x18a8], rax
call qword [sym.imp.USER32.DLL_EnumWindows]
mov rax, qword [rsp + 0x1888]
test rax, rax
je 0x1400c1b69
lea rdx, [rsp + 0x20]
lea rcx, [0x1400c02f0]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbp
call qword [sym.imp.USER32.DLL_EnumWindows]
mov rbx, qword [rsp + 0x28]
test rbx, rbx
je 0x1400c1b30
mov rcx, qword [rsp + 0x1888]
call fcn.1400c1200
mov qword [rsp + 0x1888], rbx
jmp 0x1400c1b38
mov rbx, qword [rsp + 0x1888]
mov rcx, rbx
call fcn.1400be7b0
mov rcx, qword [rsp + 0x1888]
call fcn.1400c1200
mov r11, qword [0x1401255c8]
mov ecx, dword [r11 + 0x74]
cmp ecx, 0xffffffff
jle 0x1400c1b95
mov edx, 1
call fcn.140001b60
jmp 0x1400c1b95
mov eax, dword [0x14012c4bc]
test eax, eax
je 0x1400c1b95
cmp eax, 1
mov dword [0x14012c4bc], ebp
setg al
test al, al
je 0x1400c1b95
mov rcx, rsi
call fcn.1400c1200
xor edx, edx
mov rcx, rbx
call fcn.1400c19e0
mov rsi, qword [rsp + 0x11cf8]
mov rbp, qword [rsp + 0x11cf0]
mov eax, 1
mov rbx, qword [rsp + 0x11d00]
add rsp, 0x11ce0
pop rdi
ret
Function at 0x1400d7648
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400d74b8

Function at 0x1400e2fc8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140123ea8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.1400db46c
xor ebx, ebx
cmp qword [0x140128d48], rbx
mov rdi, rax
jne 0x1400e30db
lea rcx, [0x1400f0b20]
call qword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1400e31b2
lea rdx, [0x1400f0b10]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
test rax, rax
je 0x1400e31b2
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_EncodePointer]
lea rdx, [0x1400f0b00]
mov rcx, rsi
mov qword [0x140128d48], rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_EncodePointer]
lea rdx, [0x1400f0ae8]
mov rcx, rsi
mov qword [0x140128d50], rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_EncodePointer]
lea rdx, [0x1400f0ac8]
mov rcx, rsi
mov qword [0x140128d58], rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_EncodePointer]
mov r11, rax
mov qword [0x140128d68], rax
test rax, rax
je 0x1400e30d2
lea rdx, [0x1400f0ab0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_EncodePointer]
mov qword [0x140128d60], rax
jmp 0x1400e30e2
mov rax, qword [0x140128d60]
jmp 0x1400e30e9
mov rax, qword [0x140128d60]
mov r11, qword [0x140128d68]
cmp rax, rdi
je 0x1400e3150
cmp r11, rdi
je 0x1400e3150
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_DecodePointer]
mov rcx, qword [0x140128d68]
mov rsi, rax
call qword [sym.imp.KERNEL32.DLL_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x1400e3150
test rax, rax
je 0x1400e3150
call rsi
test rax, rax
je 0x1400e314a
lea rcx, [rsp + 0x30]
mov r9d, reloc.OLEAUT32.DLL_VariantTimeToDosDateTime
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400e314a
test byte [rsp + 0x40], 1
jne 0x1400e3150
bts ebp, 0x15
jmp 0x1400e3190
mov rcx, qword [0x140128d50]
cmp rcx, rdi
je 0x1400e3190
call qword [sym.imp.KERNEL32.DLL_DecodePointer]
test rax, rax
je 0x1400e3190
call rax
mov rbx, rax
test rax, rax
je 0x1400e3190
mov rcx, qword [0x140128d58]
cmp rcx, rdi
je 0x1400e3190
call qword [sym.imp.KERNEL32.DLL_DecodePointer]
test rax, rax
je 0x1400e3190
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140128d48]
call qword [sym.imp.KERNEL32.DLL_DecodePointer]
test rax, rax
je 0x1400e31b2
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x1400e31b4
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400df260
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1406b2058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1406b21df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406b2089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406b206f
add dl, dl
jne 0x1406b2096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406b20f6
xor eax, eax
add dl, dl
jne 0x1406b20a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406b21ad
add dl, dl
jne 0x1406b20b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406b20c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406b20d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406b20dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406b20ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406b207e
mov eax, 1
add dl, dl
jne 0x1406b2106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406b2113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406b20fb
sub eax, ebx
mov ebx, 1
jne 0x1406b214c
mov ecx, 1
add dl, dl
jne 0x1406b212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406b213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406b2123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406b207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406b2168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406b2175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406b215d
cmp eax, 0x7d00
jae 0x1406b219b
cmp eax, 0x500
jb 0x1406b2196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406b207e
cmp eax, 0x7f
ja 0x1406b219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406b207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406b21d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406b207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140002e30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rdi
cmp dword [0x140069654], 0
lea rdi, [0x140069650]
mov r11d, r8d
mov r9d, edx
mov r10, rcx
jne 0x140002f08
mov qword [rsp + 0x10], rbx
xor edx, edx
mov rbx, rdi
nop dword [rax]
mov r8d, edx
lea rbx, [rbx + 4]
and r8d, 1
mov eax, edx
shr eax, 1
neg r8d
and r8d, 0xedb88320
inc edx
xor r8d, eax
mov eax, r8d
shr r8d, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, r8d
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rbx - 4], eax
cmp edx, 0x100
jb 0x140002e60
mov rbx, qword [rsp + 0x10]
not r11d
mov eax, r11d
test r9d, r9d
jle 0x140002f3e
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
movzx edx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [rdi + rdx*4]
sub r9d, 1
jne 0x140002f20
not eax
pop rdi
ret
movzx r9d, byte [r10]
lea r8, [r10 + 1]
test r9b, r9b
je 0x140002f7f
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x140002f63
cmp byte [r8], r9b
jne 0x140002f63
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rdi + rdx*4]
test r9b, r9b
jne 0x140002f50
not eax
pop rdi
ret
Function at 0x1400129c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x20
mov rdi, qword [0x140069368]
xor ebx, ebx
mov rbp, rcx
mov dword [rdi + 0x2cd4], ebx
test rcx, rcx
je 0x140012ad1
mov qword [rsp + 0x30], rsi
lea rsi, [rdi + 0x2cd8]
mov dword [rdi + 0x2cd4], ebx
mov r8d, dword [rsi + 4]
test r8d, r8d
jns 0x140012a1f
mov eax, r8d
mov rcx, rsi
cdq
sub eax, edx
mov edx, ebx
sar eax, 1
add eax, r8d
test eax, eax
cmovg edx, eax
call fcn.140013980
mov dword [rsi], ebx
mov eax, ebx
cmp dword [rsi + 4], ebx
jne 0x140012a37
mov edx, 8
mov rcx, rsi
call fcn.140013980
mov eax, dword [rsi]
movsxd rcx, eax
mov rax, qword [rsi + 8]
mov byte [rcx + rax], bl
inc dword [rsi]
mov eax, dword [rsi]
cmp dword [rdi + 0x2ce8], ebx
jle 0x140012a8c
mov qword [rsp + 0x38], r14
mov r14, rbx
nop word [rax + rax]
mov r9, qword [rdi + 0x2cf0]
mov r8, rsi
add r9, r14
mov rcx, rdi
mov rdx, r9
call qword [r9 + 0x20]
inc ebx
add r14, 0x30
cmp ebx, dword [rdi + 0x2ce8]
jl 0x140012a60
mov eax, dword [rsi]
mov r14, qword [rsp + 0x38]
mov rdi, qword [rdi + 0x2ce0]
lea rdx, [0x14004cc6c]
dec eax
mov rcx, rbp
movsxd rsi, eax
call fcn.140002f90
mov rbx, rax
test rax, rax
je 0x140012acc
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14001a470
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
push rbp
push r13
push r14
sub rsp, 0xb0
xor eax, eax
movsxd r13, r9d
mov dword [rsp + 0xe8], eax
mov r14, rdx
mov qword [rsp + 0x60], r13
mov rbp, rcx
test r9d, r9d
jle 0x14001a6be
mov qword [r11 + 8], rbx
lea rbx, [r8 + 0x20]
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 - 0x20], r12
xor r12d, r12d
mov qword [r11 - 0x28], r15
movaps xmmword [r11 - 0x38], xmm6
movaps xmmword [r11 - 0x48], xmm7
xorps xmm7, xmm7
movaps xmmword [r11 - 0x58], xmm8
mov r11d, pe_nt_image_headers64
movss xmm8, dword [0x14005daf0]
nop dword [rax + rax]
movss xmm6, dword [rbx - 0x20]
comiss xmm6, xmm7
jbe 0x14001a52c
movsxd r10, dword [r14 + 0x24]
mov r9, qword [r14 + 8]
movsx ecx, r11w
movzx eax, byte [r10 + r9 + 7]
movzx edx, byte [r10 + r9 + 6]
imul edx, ecx
movsx ecx, r11w
add dx, ax
movzx eax, byte [r10 + r9 + 5]
movsx r8d, dx
movzx edx, byte [r10 + r9 + 4]
imul edx, ecx
add ax, dx
cwde
sub eax, r8d
movd xmm0, eax
jmp 0x14001a54b
movsxd rdx, dword [r14 + 0x1c]
xorps xmm6, xmm8
mov rax, qword [r14 + 8]
movzx ecx, byte [rdx + rax + 0x12]
movzx eax, byte [rdx + rax + 0x13]
shl ecx, 8
add ecx, eax
movd xmm0, ecx
movzx eax, byte [rbp + 0x20]
xor edi, edi
cvtdq2ps xmm0, xmm0
mov byte [rbx], al
movzx eax, byte [rbp + 0x24]
mov byte [rbx + 1], al
divss xmm6, xmm0
cmp dword [rbx - 0x10], edi
jle 0x14001a666
mov r15, qword [rsp + 0xf0]
mov rax, r12
mov r13d, dword [rsp + 0xe8]
add r15, 6
shl rax, 4
xor esi, esi
add r15, rax
nop word [rax + rax]
mov rax, qword [rbx - 0x18]
test rax, rax
jne 0x14001a5a0
mov edx, dword [rbx - 0x1c]
add edx, edi
jmp 0x14001a5a3
mov edx, dword [rax + rsi]
mov eax, dword [rbp + 0x24]
xorps xmm3, xmm3
xorps xmm2, xmm2
mov rcx, r14
cvtsi2ss xmm3, rax
mov eax, dword [rbp + 0x20]
cvtsi2ss xmm2, rax
mulss xmm3, xmm6
mulss xmm2, xmm6
call fcn.140015760
mov edx, eax
mov rcx, r14
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
movss dword [rsp + 0x28], xmm7
movss dword [rsp + 0x20], xmm7
call fcn.140018080
movzx eax, word [rbp + 0x20]
inc r13d
sub ax, word [rsp + 0x50]
inc r12
dec ax
inc edi
add ax, word [rbp + 0x1c]
add rsi, 4
add ax, word [rsp + 0x54]
mov word [r15 - 2], ax
movzx eax, word [rbp + 0x24]
sub ax, word [rsp + 0x58]
dec ax
add ax, word [rbp + 0x1c]
add ax, word [rsp + 0x5c]
mov word [r15], ax
add r15, 0x10
cmp edi, dword [rbx - 0x10]
jl 0x14001a590
mov dword [rsp + 0xe8], r13d
mov r11d, pe_nt_image_headers64
mov r13, qword [rsp + 0x60]
add rbx, 0x28
sub r13, 1
mov qword [rsp + 0x60], r13
jne 0x14001a4e0
mov eax, dword [rsp + 0xe8]
movaps xmm8, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x90]
mov r15, qword [rsp + 0xa0]
mov r12, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xe0]
mov rsi, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0xd0]
add rsp, 0xb0
pop r14
pop r13
pop rbp
ret
Function at 0x14001de60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x14001e017
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov esi, r9d
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x14001def6
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.14001d840
mov r8d, dword [rbx + 0x80]
mov r9d, esi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.14001ce20
mov ecx, dword [rbx + 0x84]
test ecx, ecx
jns 0x14001dee7
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [rbx + 0x80]
test eax, eax
cmovg edx, eax
call fcn.1400135e0
mov dword [rbx + 0x80], 0
jmp 0x14001e003
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.14001bd40
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rdi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rdi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], esi
movsd xmm0, qword [rdi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], esi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140036ba0
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
push r13
push r15
mov eax, 0x1070
call fcn.14004aa50
sub rsp, rax
mov rax, qword [0x140068010]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov rdx, qword [rsp + 0x10b0]
xor ebp, ebp
mov qword [rsp + 0x38], r9
mov r15, r8
mov qword [rsp + 0x30], rdx
mov r13, rcx
test r8, r8
je 0x140036c1b
mov r9d, 0x1000
lea rdx, [rsp + 0x40]
call fcn.1400352e0
test al, al
jne 0x140036c23
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Cant_read_module_headers
call fcn.140038b20
lea rdx, [0x140038d00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rdx, rbp
jmp 0x140036d3d
mov qword [rsp + 0x1068], rsi
lea rdx, str.PAGE
mov qword [rsp + 0x1060], rdi
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x1058], r12
mov qword [rsp + 0x1050], r14
inc rdi
cmp byte [rdx + rdi], bpl
jne 0x140036c51
movsxd rax, dword [rsp + 0x7c]
lea rcx, [rsp + 0x40]
add rcx, rax
mov qword [rsp + 0x1098], rbx
mov esi, ebp
movzx eax, word [rcx + 0x14]
lea r12, [rcx + 0x18]
movzx r14d, word [rcx + 6]
add r12, rax
test r14d, r14d
je 0x140036cef
nop word [rax + rax]
mov eax, esi
mov r8, rdi
lea rcx, [rax + rax*4]
lea rbx, [r12 + rcx*8]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140036cbe
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], bpl
jne 0x140036cb0
cmp rdi, rax
je 0x140036cce
inc esi
cmp esi, r14d
jae 0x140036cef
lea rdx, str.PAGE
jmp 0x140036c90
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x140036cef
mov ecx, dword [rbx + 8]
mov edx, eax
lea rax, [rsp + 0x40]
add rax, rdx
je 0x140036cef
test ecx, ecx
je 0x140036cef
mov ebp, ecx
add rdx, r15
jmp 0x140036d15
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Cant_find_section
call fcn.140038b20
lea rdx, [0x140038d00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rdx, rbp
mov rbx, qword [rsp + 0x1098]
mov rdi, qword [rsp + 0x1060]
mov rsi, qword [rsp + 0x1068]
mov r12, qword [rsp + 0x1058]
mov r14, qword [rsp + 0x1050]
mov rax, qword [rsp + 0x30]
mov rcx, r13
mov r9, qword [rsp + 0x38]
mov r8d, ebp
mov qword [rsp + 0x20], rax
call fcn.140036a20
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400495e0
add rsp, 0x1070
pop r15
pop r13
pop rbp
ret
Function at 0x1400379d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140037a07
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140037a28
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140037a2a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140037a83
test ecx, ecx
jle 0x140037a63
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140037a83
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140037a83
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret