joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140013ec0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140013cec

Function at 0x140712058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1407121df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140712089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14071206f
add dl, dl
jne 0x140712096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407120f6
xor eax, eax
add dl, dl
jne 0x1407120a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407121ad
add dl, dl
jne 0x1407120b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407120c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407120d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407120dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407120ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14071207e
mov eax, 1
add dl, dl
jne 0x140712106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140712113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407120fb
sub eax, ebx
mov ebx, 1
jne 0x14071214c
mov ecx, 1
add dl, dl
jne 0x14071212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14071213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140712123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14071207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140712168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140712175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14071215d
cmp eax, 0x7d00
jae 0x14071219b
cmp eax, 0x500
jb 0x140712196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14071207e
cmp eax, 0x7f
ja 0x14071219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14071207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407121d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14071207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400112a3
Capabilities:
Terminate process

Disassembly:
jmp 0x140014a30
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140011348
Capabilities:
Parse pe header

Disassembly:
jmp 0x140015d80
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140015da0
xor al, al
jmp 0x140015e21
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140015db3
xor al, al
jmp 0x140015e21
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140015ddd
xor al, al
jmp 0x140015e21
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015df1
xor al, al
jmp 0x140015e21
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015e03
xor al, al
jmp 0x140015e21
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140015e1f
xor al, al
jmp 0x140015e21
mov al, 1
add rsp, 0x38
ret
Function at 0x413926
Capabilities:
Hash data with crc32

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov dword [rbp - 4], 0xffffffff
mov dword [rbp - 8], 0
jmp 0x413985
mov eax, dword [rbp - 4]
shr eax, 8
mov ecx, eax
mov eax, dword [rbp - 8]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
movzx eax, byte [rax]
movzx edx, al
mov eax, dword [rbp - 4]
movzx eax, al
xor eax, edx
mov eax, eax
lea rdx, [rax*4]
lea rax, [0x00454840]
mov eax, dword [rdx + rax]
xor eax, ecx
mov dword [rbp - 4], eax
add dword [rbp - 8], 1
mov eax, dword [rbp - 8]
cmp eax, dword [rbp + 0x18]
jl 0x413945
mov eax, dword [rbp - 4]
not eax
add rsp, 0x10
pop rbp
ret

Function at 0x416dce
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
sub rsp, 0x38
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x30], rcx
mov ecx, 0x1000
call sub.msvcrt.dll_malloc
mov qword [rbp - 0x58], rax
mov rax, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x30]
mov rcx, rax
call sub.msvcrt.dll_strcpy
mov rax, qword [rbp - 0x58]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
mov rax, qword [rbp - 0x58]
add rax, rdx
mov word [rax], 0x2f
mov rax, qword [rbp - 0x58]
lea rdx, str.CriticalBreachDetected.pdf
mov rcx, rax
call sub.msvcrt.dll_strcat
mov rax, qword [rbp - 0x58]
lea rdx, [0x00455353]
mov rcx, rax
call sub.msvcrt.dll_fopen
mov qword [rbp - 0x60], rax
cmp qword [rbp - 0x60], 0
je 0x416e8a
mov eax, dword [0x00454768]
mov edx, eax
mov rax, qword [rbp - 0x60]
mov r9, rax
mov r8d, 1
lea rcx, str._PDF_1.5_n_
call sub.msvcrt.dll_fwrite
mov rax, qword [rbp - 0x60]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov rax, qword [rbp - 0x58]
mov rcx, rax
call fcn.0044a060
nop
add rsp, 0x38
pop rdi
pop rbp
ret
Function at 0x424230
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x4242ff
test rdx, rdx
je 0x4242e6
lea eax, [r8 - 0x10]
and eax, 0xffffffef
jne 0x4242cd
mov r11d, dword [rdx]
test r9d, r9d
mov r10d, 0x14
cmove r9d, r10d
cmp r8d, 0x20
mov dword [rcx + 0x10], r11d
mov eax, dword [rdx + 4]
mov dword [rcx + 0x14], eax
mov r10d, dword [rdx + 8]
lea rax, str.expand_16_byte_k
mov dword [rcx + 0x18], r10d
mov r11d, dword [rdx + 0xc]
mov dword [rcx + 0x1c], r11d
jne 0x424291
lea rax, str.expand_32_byte_k
add rdx, 0x10
mov r8d, dword [rdx]
movdqu xmm0, xmmword [rax]
xor eax, eax
mov dword [rcx + 0x20], r8d
mov r10d, dword [rdx + 4]
mov dword [rcx + 0x24], r10d
mov r11d, dword [rdx + 8]
mov dword [rcx + 0x28], r11d
mov edx, dword [rdx + 0xc]
movups xmmword [rcx], xmm0
mov dword [rcx + 0x88], r9d
mov dword [rcx + 0x84], 0
mov dword [rcx + 0x2c], edx
add rsp, 0x28
ret
lea rdx, str.src_stream_chacha_chacha_setup.c
lea rcx, str.keylen__32__keylen__16
mov r8d, 0x24
call fcn.0041e640
lea rdx, str.src_stream_chacha_chacha_setup.c
lea rcx, [0x0045f114]
mov r8d, 0x23
call fcn.0041e640
lea rdx, str.src_stream_chacha_chacha_setup.c
lea rcx, [0x0045f109]
mov r8d, 0x22
call fcn.0041e640
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x442820
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x00454cd8], eax
je 0x44283a
add rsp, 0x28
ret
call sub.msvcrt.dll_abort
nop

Function at 0x442c70
Capabilities:
Print debug messages

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x90
test rcx, rcx
mov rbx, rcx
je 0x442c93
call fcn.00445900
cmp eax, 1
je 0x442c9e
mov qword [rbx], 0xffffffffffffffff
add rsp, 0x90
pop rbx
pop rsi
pop rdi
ret
lea rdi, [rsp + 0x20]
lea rsi, str.Error_cleaning_up_spin_keys_for_thread
mov ecx, 0xa
lea rbx, [rsp + 0x20]
xor eax, eax
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x48]
mov ecx, 0x43
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rbx + 0x27]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x442d27
mov eax, 0x28
jmp 0x442cfa
add rax, 1
cmp rax, 0x6b
je 0x442d19
cmp byte [rbx + rax], 0
mov edx, eax
jne 0x442cf0
cmp eax, 0x6a
je 0x442d19
movsxd rax, edx
mov byte [rsp + rax + 0x20], 0xa
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rax + 0x20], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov edx, 0x27
jmp 0x442d07

Function at 0x442dc0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp dword [0x0046d470], 1
je 0x442dd6
call fcn.00442d30
mov ecx, dword [0x00454cd8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x442e00
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.00442bb0
cmp qword [0x00475050], 0
mov rsi, rax
je 0x442dea
test rax, rax
je 0x442dea
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
mov dword [rsi + 0x70], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea rcx, [rsi + 0x68]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], 0xffffffffffffffff
call fcn.00442c70
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsi + 0xb8], 0
mov qword [rsi + 0x28], 0
call rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
call rbx
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
lea r9, [rsi + 0x28]
mov dword [rsp + 0x20], 0
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x442ee9
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rsi + 0xc0], eax
movzx eax, byte [rsi + 0x40]
mov rdx, rsi
mov dword [rsi + 0xbc], 0
mov ecx, dword [0x00454cd8]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rsi + 0x40], al
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x442ee9
mov rbx, rsi
jmp 0x442dea
call sub.msvcrt.dll_abort
nop
nop
Function at 0x444440
Capabilities:
Create thread
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov r13, rcx
mov rbp, rdx
mov rsi, r8
mov rdi, r9
call fcn.00442bb0
test rax, rax
mov rbx, rax
je 0x444651
test r13, r13
je 0x44447b
mov rax, qword [rax + 0x1d8]
mov qword [r13], rax
mov r12, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbx + 8], rdi
mov rdi, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x10], rsi
mov esi, 1
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0x44], 1
mov qword [rbx + 0x28], 0xffffffffffffffff
mov r14, r12
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
call rdi
test rax, rax
mov qword [rbx + 0x30], rax
jne 0x4444f0
cmp esi, 1
je 0x4444e1
mov ecx, 0x14
call r14
cmp esi, 5
je 0x4444f0
add esi, 1
jmp 0x4444b2
xor ecx, ecx
call r12
jmp 0x4444dc
lea rdi, [rbx + 0x68]
mov qword [rbx + 0x38], 0xffffffffffffffff
mov rcx, rdi
call fcn.00442c70
cmp qword [rbx + 0x30], 0
mov dword [rbx], 0xbab1f00d
mov dword [rbx + 0xc0], 0
mov dword [rbx + 0xb8], 0
je 0x444632
test rbp, rbp
je 0x4446a0
mov eax, dword [rbp]
mov rsi, qword [rbp + 0x10]
test al, 8
mov dword [rbx + 0x44], eax
jne 0x444680
mov eax, dword [rbp + 0x18]
mov edx, esi
mov dword [rbx + 0xc0], eax
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
mov r9, rbx
lea r8, [0x00443230]
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov rsi, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x444602
mov eax, dword [rbx + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jl 0x4445b2
cmp eax, 0xffffffff
mov edx, 0xfffffffe
jl 0x4445b2
cmp eax, 0xe
mov edx, 0xf
jg 0x4445b2
cmp eax, 2
mov edx, 2
cmovle edx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [rbx + 0x44], 4
je 0x444665
mov rcx, rsi
mov qword [rbx + 0x28], 0
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x444611
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 0x38]
call fcn.00442510
mov rcx, rdi
call fcn.00442c70
mov qword [rbx + 0x30], 0
mov qword [rbx + 0x28], 0
test r13, r13
je 0x44463f
mov qword [r13], 0
cmp qword [rbx + 0x1d0], 0
jne 0x444651
mov rcx, rbx
call fcn.00442a50
mov eax, 0xb
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov qword [rbx + 0x28], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x4445e9
call fcn.00442dc0
mov eax, dword [rax + 0xc0]
mov edx, esi
mov dword [rbx + 0xc0], eax
jmp 0x44454f
xor edx, edx
jmp 0x44454f
Function at 0x447010
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov ecx, dword [0x0046daa4]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x447130
mov rax, qword [0x0046daa8]
xor ebx, ebx
add rax, 0x18
mov rdx, qword [rax]
cmp rsi, rdx
jb 0x44705c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rsi, rdx
jb 0x447116
add ebx, 1
add rax, 0x28
cmp ebx, ecx
jne 0x447040
mov rcx, rsi
call fcn.00447c50
test rax, rax
mov r12, rax
je 0x447168
movsxd rbx, ebx
lea rbx, [rbx + rbx*4]
shl rbx, 3
mov r13, rbx
add r13, qword [0x0046daa8]
mov qword [r13 + 0x20], rax
mov dword [r13], 0
call fcn.00447da0
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 0x18], rax
mov rax, qword [0x0046daa8]
mov rcx, qword [rax + rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x44714b
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x44710f
sub eax, 0x40
and eax, 0xffffffbf
je 0x44710f
add rbx, qword [0x0046daa8]
mov rcx, qword [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x447137
add dword [0x0046daa4], 1
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.msvcrt.dll_memcpy
xor ebx, ebx
jmp 0x447067
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00446fa0
mov rax, qword [0x0046daa8]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.00446fa0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call fcn.00446fa0
nop
nop dword [rax + rax]

Function at 0x4478c0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0046dd80]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0046dd60]
test rbx, rbx
je 0x447914
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x44790b
test rsi, rsi
je 0x44790b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4478f0
lea rcx, [0x0046dd80]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x447c50
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x00461d40]
xor edx, edx
mov r8, rcx
cmp word [r9], 0x5a4d
je 0x447c70
mov rax, rdx
add rsp, 0x28
ret
mov rcx, r9
call fcn.00447b30
test eax, eax
je 0x447c68
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add rax, r9
movzx edx, word [rax + 0x14]
lea rdx, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x447ccd
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x447cc4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x447c68
add rdx, 0x28
cmp rdx, r9
jne 0x447cb0
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret

Function at 0x448560
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x138
mov rbx, rcx
call sub.msvcrt.dll__errno
test rbx, rbx
mov dword [rax], 0
je 0x4486ec
cmp byte [rbx], 0
je 0x4486b4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4486d0
test al, 0x10
je 0x4486b4
lea rdi, [rsp + 0x20]
mov r8d, 0x104
mov rdx, rbx
mov rcx, rdi
mov rsi, rdi
call sub.msvcrt.dll__fullpath
mov edx, dword [rsi]
add rsi, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x4485be
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [rsi + 2]
mov ecx, eax
cmove rsi, rdx
add cl, al
sbb rsi, 3
sub rsi, rdi
lea rcx, [rsi + 0x24b]
call sub.msvcrt.dll_malloc
test rax, rax
mov rbx, rax
je 0x4486df
lea r9, [rax + 0x244]
lea rbp, [rsi + 1]
mov rdx, rdi
mov rcx, r9
mov r8, rbp
call sub.msvcrt.dll_memcpy
cmp byte [rbx + 0x244], 0
mov r9, rax
je 0x448650
movzx eax, byte [rbx + rsi + 0x243]
cmp al, 0x2f
je 0x448650
cmp al, 0x5c
je 0x448650
mov r8d, 0x5c
mov word [r9 + rsi], r8w
mov rsi, rbp
mov eax, 0x2a
xor edx, edx
xor ecx, ecx
mov word [r9 + rsi], ax
mov word [rbx + 0x12c], dx
lea rdx, [rbx + 0x130]
mov word [rbx + 0x12e], cx
xor eax, eax
mov ecx, 0x20
mov rdi, rdx
mov qword [rbx + 0x238], 0xffffffffffffffff
mov dword [rbx + 0x240], 0
mov dword [rbx + 0x128], 0
rep stosq qword [rdi], rax
mov dword [rdi], 0
mov rax, rbx
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor ebx, ebx
call sub.msvcrt.dll__errno
mov dword [rax], 0x14
mov rax, rbx
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sub.msvcrt.dll__errno
xor ebx, ebx
mov dword [rax], 2
jmp 0x4486a5
call sub.msvcrt.dll__errno
mov dword [rax], 0xc
jmp 0x4486a5
call sub.msvcrt.dll__errno
mov dword [rax], 0xe
jmp 0x4486a5
Function at 0x414520
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4146c6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00430640
xorps xmm15, xmm15
mov r14, qword [0x0056bd48]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x41458b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4145a0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x4145c5
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x4145d9
cmp rbx, 0x1000
jae 0x414595
nop dword [rax]
jmp 0x414649
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x4145ed
xor edx, edx
jmp 0x414640
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00430640
xorps xmm15, xmm15
mov r14, qword [0x0056bd48]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x4145cf
jmp 0x4145b4
call fcn.0045e140
xorps xmm15, xmm15
mov r14, qword [0x0056bd48]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00434a40
lea rax, [0x0049289a]
mov ebx, 0x18
call fcn.00435340
mov rax, qword [rsp + 0x38]
call fcn.00435040
lea rax, [0x0049295a]
mov ebx, 0x19
call fcn.00435340
mov rax, qword [rsp + 0x30]
nop
call fcn.00435040
call fcn.00434ca0
call fcn.00434ac0
lea rax, [0x004948f0]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00433100
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045a5e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00414520
Function at 0x414700
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41492a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004306c0
xorps xmm15, xmm15
mov r14, qword [0x0056bd48]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x414779
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x41478c
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4147b0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x4147c4
cmp rbx, 0x1000
jae 0x414783
jmp 0x414845
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4147d6
xor esi, esi
jmp 0x414836
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.004306c0
xorps xmm15, xmm15
mov r14, qword [0x0056bd48]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x4147ba
nop
jmp 0x4147a2
call fcn.0045e140
xorps xmm15, xmm15
mov r14, qword [0x0056bd48]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4148c5
call fcn.00434a40
lea rax, [0x00492d74]
mov ebx, 0x19
call fcn.00435340
mov rax, qword [rsp + 0x68]
call fcn.00435040
lea rax, [0x0049295a]
mov ebx, 0x19
call fcn.00435340
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00435040
call fcn.00434ca0
call fcn.00434ac0
lea rax, [0x0048fbca]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.00433100
cmp eax, 0x5af
je 0x414868
call fcn.00434a40
lea rax, [0x00492d74]
mov ebx, 0x19
nop dword [rax]
call fcn.00435340
mov rax, qword [rsp + 0x38]
call fcn.00435040
lea rax, [0x0049295a]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00435340
mov eax, dword [rsp + 0x34]
call fcn.00435040
call fcn.00434ca0
call fcn.00434ac0
lea rax, [0x0049434b]
mov ebx, 0x1f
call fcn.00433100
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045a5e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00414700