joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006c400
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov rax, qword [0x140099040]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor r14d, r14d
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp - 0x30]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
lea rbx, [r14 - 1]
cmp eax, 0x104
ja 0x14006c4a3
lea rcx, [rbp - 0x30]
mov rax, rbx
nop dword [rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], r14w
jne 0x14006c470
cmp word [rbp + rax*2 - 0x32], 0x5c
jne 0x14006c49d
lea rax, [rax*2 - 2]
cmp rax, 0x20a
jae 0x14006c610
mov word [rbp + rax - 0x30], r14w
lea rdx, [rbp - 0x30]
jmp 0x14006c4aa
lea rdx, [0x14008adf8]
lea rcx, [rsp + 0x70]
call fcn.140059ff0
nop
cmp qword [rbp - 0x80], 0
jne 0x14006c4d0
lea rdx, [0x14008adf8]
mov rcx, rdi
call fcn.140059ff0
jmp 0x14006c5d6
lea rcx, [rbp - 0x50]
call fcn.14006c1e0
mov rsi, rax
mov dword [rsp + 0x50], 0x6b6a6dc8
xor eax, eax
mov qword [rsp + 0x54], rax
mov dword [rsp + 0x5c], eax
mov byte [rsp + 0x60], al
mov qword [rsp + 0x40], r14
mov rcx, qword [rsp + 0x40]
movabs r9, 0x26dc052fec991192
nop word [rax + rax]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
movzx edx, byte [rsp + rax + 0x50]
add rcx, r9
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
add r8, rcx
add r8, rdx
add r8b, 2
mov rax, qword [rsp + 0x40]
mov byte [rsp + rax + 0x50], r8b
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp rax, 0x11
jb 0x14006c510
lea rax, [rsp + 0x50]
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14006c560
movabs rax, 0x7ffffffffffffffe
mov rcx, qword [rbp - 0x80]
sub rax, rcx
cmp rax, rbx
jb 0x14006c60a
lea r9, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova r9, qword [rsp + 0x70]
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x70]
call fcn.140072250
nop
mov r9, rsi
lea r8, [rbp - 0x70]
mov rcx, rdi
call fcn.140072020
nop
lea rcx, [rbp - 0x70]
call fcn.140059f80
nop
lea rcx, [rbp - 0x50]
call fcn.140059f80
nop
lea rcx, [rsp + 0x70]
call fcn.140059f80
mov rax, rdi
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.140075d20
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.14003ab20
nop
call fcn.140075f68
int3
Function at 0x14006cc20
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x190
mov rax, qword [0x140099040]
xor rax, rsp
mov qword [rsp + 0x180], rax
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14006cc54
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x160]
call fcn.14006c1e0
nop
mov rcx, rax
call fcn.1400746d0
movzx ebx, al
lea rcx, [rsp + 0x160]
call fcn.140059f80
test bl, bl
jne 0x14006cc85
xor al, al
jmp 0x14006ce0e
lea rcx, [rsp + 0x140]
call fcn.14006c400
nop
lea rdx, [rsp + 0x140]
cmp qword [rsp + 0x158], 7
cmova rdx, qword [rsp + 0x140]
lea rcx, [rsp + 0x30]
call fcn.14006fac0
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movsxd rcx, eax
movabs rax, 0x1c926b9d39431d5f
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0x23d6df
sub rcx, rax
add ecx, 0x1649d
movsxd rsi, ecx
mov rcx, rsi
call fcn.140076480
mov rdi, rax
xor ebx, ebx
test rsi, rsi
je 0x14006cd34
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r9d, eax
mov eax, 0x80808081
imul r9d
add edx, r9d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r9d, ecx
mov byte [rbx + rdi], r9b
inc rbx
cmp rbx, rsi
jb 0x14006cd01
mov r8, rsi
mov rdx, rdi
lea rcx, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
lea rcx, [rsp + 0x38]
call fcn.14005add0
test rax, rax
jne 0x14006cd82
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x30]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov rcx, rdi
call fcn.1400763dc
lea rcx, [rsp + 0x140]
cmp qword [rsp + 0x158], 7
cmova rcx, qword [rsp + 0x140]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
nop
test eax, eax
sete bl
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x30], rax
mov rcx, qword [rsp + 0x30]
movsxd rdx, dword [rcx + 4]
lea r8d, [rdx - 0xa8]
mov dword [rsp + rdx + 0x2c], r8d
lea rcx, [rsp + 0x38]
call fcn.1400597b0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rsp + 0xd8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x140]
call fcn.140059f80
movzx eax, bl
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140075d20
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14006d060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x3f]
sub rsp, 0xc0
mov rax, qword [0x140099040]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rdi, rdx
mov rbx, rcx
mov ecx, 8
mov rax, qword gs:[0x58]
mov rax, qword [rax]
mov eax, dword [rcx + rax]
cmp dword [0x1409640ec], eax
jle 0x14006d1fd
lea rcx, [0x1409640ec]
call fcn.140075de8
cmp dword [0x1409640ec], 0xffffffff
jne 0x14006d1fd
mov dword [rbp - 0x21], 0x584766b9
mov dword [rbp - 0x1d], 0x5a6d416a
mov dword [rbp - 0x19], 0x43545663
mov dword [rbp - 0x15], 0x62536c51
mov dword [rbp - 0x11], 0x4e4f7943
mov dword [rbp - 0xd], 0x2a674b71
mov dword [rbp - 9], 0x4478444d
mov byte [rbp - 5], 0xe2
xor eax, eax
mov qword [rbp - 4], rax
mov byte [rbp + 4], al
mov qword [rbp - 0x31], rax
mov rax, qword [rbp - 0x31]
movabs r9, 0xfef59034006ea5ff
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x31]
mov rax, qword [rbp - 0x31]
movzx edx, byte [rbp + rax - 0x21]
add rcx, r9
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
add r8, rcx
add r8, rdx
add r8b, 7
mov rax, qword [rbp - 0x31]
mov byte [rbp + rax - 0x21], r8b
mov rax, qword [rbp - 0x31]
inc rax
mov qword [rbp - 0x31], rax
mov rax, qword [rbp - 0x31]
cmp rax, 0x26
jb 0x14006d120
xorps xmm0, xmm0
movups xmmword [rbp + 0xf], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1f], xmm1
lea rax, [rbp - 0x21]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14006d180
lea rdx, [rbp - 0x21]
lea rcx, [rbp + 0xf]
call fcn.14005fa20
nop
lea r8, [rbp + 0xf]
mov rdx, qword [0x140963a78]
mov rcx, rbx
call fcn.14006d9a0
mov qword [0x140964050], rax
mov rdx, qword [rbp + 0x27]
cmp rdx, 0xf
jbe 0x14006d1f1
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006d1eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006d1eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400763dc
nop
lea rcx, [0x1409640ec]
call fcn.140075d7c
cmp qword [0x140964050], 0
je 0x14006d228
mov qword [rbp - 0x29], 0
mov r9, rdi
lea rdx, [rbp - 0x29]
mov rcx, rbx
call fcn.140070400
test al, al
je 0x14006d228
mov rax, qword [rbp - 0x29]
jmp 0x14006d22a
xor eax, eax
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140075d20
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14006d250
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x140099040]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rdi, rdx
mov rbx, rcx
mov edx, 8
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1409640d4], eax
jle 0x14006d3dd
lea rcx, [0x1409640d4]
call fcn.140075de8
cmp dword [0x1409640d4], 0xffffffff
jne 0x14006d3dd
mov dword [rbp - 9], 0x694866b9
mov dword [rbp - 5], 0x5a5b696b
mov dword [rbp - 1], 0x6f544e6a
mov dword [rbp + 3], 0x63617e47
mov dword [rbp + 7], 0x4f2b7651
mov dword [rbp + 0xb], 0x7a4b7f4e
mov word [rbp + 0xf], 0xe17b
xor eax, eax
mov qword [rbp + 0x11], rax
mov byte [rbp + 0x19], al
mov qword [rbp - 0x19], rax
mov rax, qword [rbp - 0x19]
movabs r9, 0x5431ee122942ebff
nop
mov rcx, qword [rbp - 0x19]
mov rax, qword [rbp - 0x19]
movzx edx, byte [rbp + rax - 9]
add rcx, r9
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
add r8, rcx
add r8, rdx
add r8b, 7
mov rax, qword [rbp - 0x19]
mov byte [rbp + rax - 9], r8b
mov rax, qword [rbp - 0x19]
inc rax
mov qword [rbp - 0x19], rax
mov rax, qword [rbp - 0x19]
cmp rax, 0x23
jb 0x14006d300
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 9]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14006d360
lea rdx, [rbp - 9]
lea rcx, [rbp + 0x27]
call fcn.14005fa20
nop
lea r8, [rbp + 0x27]
mov rdx, qword [0x140963a78]
mov rcx, rbx
call fcn.14006d9a0
mov qword [0x140964098], rax
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0xf
jbe 0x14006d3d1
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006d3cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006d3cb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400763dc
nop
lea rcx, [0x1409640d4]
call fcn.140075d7c
cmp qword [0x140964098], 0
je 0x14006d403
mov r9, rdi
lea rdx, [rbp - 0x11]
mov rcx, rbx
call fcn.1400707a0
test al, al
je 0x14006d403
cmp dword [rbp - 0x11], 0
setge al
jmp 0x14006d405
xor al, al
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140075d20
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14006e360
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x140099040]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x14006e53d
mov edx, 8
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1409640b4], eax
jle 0x14006e50d
lea rcx, [0x1409640b4]
call fcn.140075de8
cmp dword [0x1409640b4], 0xffffffff
jne 0x14006e50d
mov dword [rbp - 0x19], 0xd72e25ca
mov dword [rbp - 0x15], 0x5b4b5149
mov dword [rbp - 0x11], 0x4e56ac4d
mov dword [rbp - 0xd], 0x53584059
mov dword [rbp - 9], 0x465c44a7
mov dword [rbp - 5], 0xab555c46
mov dword [rbp - 1], 0x5e465351
mov dword [rbp + 3], 0xff4a43bd
xor eax, eax
mov qword [rbp + 7], rax
mov dword [rbp + 0xf], eax
mov byte [rbp + 0x13], al
mov qword [rbp - 0x21], rax
mov rax, qword [rbp - 0x21]
movabs r9, 0x143c3b21979937bc
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rbp - 0x21]
mov rax, qword [rbp - 0x21]
movzx edx, byte [rbp + rax - 0x19]
add rcx, r9
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
add r8, rcx
add r8, rdx
sub r8b, 0x24
mov rax, qword [rbp - 0x21]
mov byte [rbp + rax - 0x19], r8b
mov rax, qword [rbp - 0x21]
inc rax
mov qword [rbp - 0x21], rax
mov rax, qword [rbp - 0x21]
cmp rax, 0x2d
jb 0x14006e430
xorps xmm0, xmm0
movups xmmword [rbp + 0x17], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x27], xmm1
lea rax, [rbp - 0x19]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14006e490
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x17]
call fcn.14005fa20
nop
lea r8, [rbp + 0x17]
mov rdx, qword [0x140963a78]
mov rcx, rdi
call fcn.14006d9a0
mov qword [0x140964070], rax
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0xf
jbe 0x14006e501
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006e4fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006e4fb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400763dc
nop
lea rcx, [0x1409640b4]
call fcn.140075d7c
cmp qword [0x140964070], 0
je 0x14006e53d
mov qword [rsp + 0x20], rsi
mov r9, rbx
lea rdx, [rbp - 0x29]
mov rcx, rdi
call fcn.140071920
test al, al
je 0x14006e539
cmp byte [rbp - 0x29], 0
je 0x14006e539
mov al, 1
jmp 0x14006e53f
xor eax, eax
jmp 0x14006e53f
xor al, al
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140075d20
mov rbx, qword [rsp + 0xd8]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006e560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x140099040]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x14006e735
mov edx, 8
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1409640e4], eax
jle 0x14006e70d
lea rcx, [0x1409640e4]
call fcn.140075de8
cmp dword [0x1409640e4], 0xffffffff
jne 0x14006e70d
mov dword [rbp - 0x19], 0x67444d64
mov dword [rbp - 0x15], 0x40494c43
mov dword [rbp - 0x11], 0x744c964e
mov dword [rbp - 0xd], 0x5b526a4d
mov dword [rbp - 9], 0x6c566e8f
mov dword [rbp - 5], 0x73616650
mov dword [rbp - 1], 0x645c6b6d
mov dword [rbp + 3], 0x37a0ab89
xor eax, eax
mov qword [rbp + 7], rax
mov dword [rbp + 0xf], eax
mov word [rbp + 0x13], ax
mov qword [rbp - 0x29], rax
mov rax, qword [rbp - 0x29]
movabs r9, 0x3c5e9255661debe3
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x29]
mov rax, qword [rbp - 0x29]
movzx edx, byte [rbp + rax - 0x19]
add rcx, r9
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
add r8, rcx
add r8, rdx
sub r8b, 0x35
mov rax, qword [rbp - 0x29]
mov byte [rbp + rax - 0x19], r8b
mov rax, qword [rbp - 0x29]
inc rax
mov qword [rbp - 0x29], rax
mov rax, qword [rbp - 0x29]
cmp rax, 0x2e
jb 0x14006e630
xorps xmm0, xmm0
movups xmmword [rbp + 0x17], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x27], xmm1
lea rax, [rbp - 0x19]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14006e690
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x17]
call fcn.14005fa20
nop
lea r8, [rbp + 0x17]
mov rdx, qword [0x140963a78]
mov rcx, rdi
call fcn.14006d9a0
mov qword [0x140964078], rax
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0xf
jbe 0x14006e701
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006e6fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006e6fb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400763dc
nop
lea rcx, [0x1409640e4]
call fcn.140075d7c
cmp qword [0x140964078], 0
je 0x14006e735
mov qword [rsp + 0x20], rsi
mov r9, rbx
lea rdx, [rbp - 0x21]
mov rcx, rdi
call fcn.140071ca0
test al, al
je 0x14006e735
mov rax, qword [rbp - 0x21]
jmp 0x14006e737
xor eax, eax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140075d20
mov rbx, qword [rsp + 0xd8]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006f110
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push rbp
push r13
push r14
mov eax, 0x1078
call fcn.140076e90
sub rsp, rax
mov rax, qword [0x140099040]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov r14, rdx
mov qword [rsp + 0x38], r9
mov rdx, qword [rsp + 0x10c0]
xor ebp, ebp
mov qword [rsp + 0x30], rdx
mov r13, r8
mov qword [rsp + 0x40], rcx
test r8, r8
jne 0x14006f162
mov rdx, rbp
jmp 0x14006f22b
mov r9d, 0x1000
lea rdx, [rsp + 0x50]
call fcn.14006ce40
test al, al
je 0x14006f15a
mov qword [rsp + 0x10a8], rsi
mov qword [rsp + 0x1070], rdi
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x1068], r12
mov qword [rsp + 0x1060], r15
nop dword [rax]
inc rdi
cmp byte [r14 + rdi], bpl
jne 0x14006f1a0
movsxd rax, dword [rsp + 0x8c]
lea rcx, [rsp + 0x50]
add rcx, rax
mov esi, ebp
movzx eax, word [rcx + 0x14]
lea r12, [rcx + 0x18]
movzx r15d, word [rcx + 6]
add r12, rax
test r15d, r15d
je 0x14006f208
mov eax, esi
mov r8, rdi
mov rdx, r14
lea rcx, [rax + rax*4]
lea rbx, [r12 + rcx*8]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14006f201
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], bpl
jne 0x14006f1f3
cmp rdi, rax
je 0x14006f265
inc esi
cmp esi, r15d
jb 0x14006f1d0
mov rdx, rbp
mov r12, qword [rsp + 0x1068]
mov rdi, qword [rsp + 0x1070]
mov rsi, qword [rsp + 0x10a8]
mov r15, qword [rsp + 0x1060]
mov rax, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov r8d, ebp
mov qword [rsp + 0x20], rax
call fcn.14006f000
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.140075d20
add rsp, 0x1078
pop r14
pop r13
pop rbp
pop rbx
ret
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x14006f208
mov ecx, dword [rbx + 8]
lea rdx, [rsp + 0x50]
add rdx, rax
je 0x14006f208
test ecx, ecx
je 0x14006f208
lea rax, [rsp + 0x50]
mov ebp, ecx
sub rdx, rax
add rdx, r13
jmp 0x14006f20b
Function at 0x1400725c0
Capabilities:
Parse pe header

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
push rbx
push rbp
push rdi
push r14
push r15
sub rsp, 0x60
mov eax, 0x5a4d
mov r14, rdx
mov r15, rcx
cmp word [rdx], ax
jne 0x1400727f9
movsxd rdi, dword [rdx + 0x3c]
add rdi, rdx
cmp dword [rdi], 0x4550
jne 0x1400727f9
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x1400727f9
mov ebx, dword [rdi + 0x50]
xor ecx, ecx
mov edx, ebx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
test rax, rax
je 0x1400727f9
movzx ecx, word [rdi + 0x14]
lea r8, [rsp + 0x98]
mov qword [rsp + 0x90], rsi
xor esi, esi
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r13
mov eax, dword [rcx + rdi + 0x24]
sub ebx, eax
mov edx, ebx
mov rcx, r15
mov dword [rsp + 0xa8], eax
mov qword [rsp + 0x98], rsi
mov r12d, ebx
call fcn.1400723a0
mov qword [rsp + 0xd0], rax
mov r13, rax
test rax, rax
je 0x1400727d4
mov r8d, dword [rdi + 0x54]
mov rdx, r14
mov rcx, rbp
call sub.VCRUNTIME140.dll_memcpy
movzx ebx, word [rdi + 0x14]
xor eax, eax
add rbx, 0x28
cmp ax, word [rdi + 6]
jae 0x1400726d1
add rbx, rdi
test dword [rbx + 0x14], 0x80
ja 0x1400726c3
mov edx, dword [rbx + 4]
mov ecx, dword [rbx - 4]
add rdx, r14
mov r8d, dword [rbx]
add rcx, rbp
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [rdi + 6]
inc esi
add rbx, 0x28
cmp esi, eax
jl 0x1400726a6
mov r14d, dword [rsp + 0xa8]
lea rcx, [rsp + 0x38]
mov rsi, r13
mov rdx, rbp
sub r13, r14
mov rbx, r13
sub rbx, qword [rdi + 0x30]
call fcn.140073020
mov rdx, rbx
mov rcx, rax
call fcn.140072810
mov rdx, rbp
lea rcx, [rsp + 0x38]
call fcn.140073150
mov rdx, rax
mov rcx, r15
call fcn.140072910
test al, al
je 0x1400727d4
lea r8, [r14 + rbp]
mov r9, r12
mov rdx, rsi
mov rcx, r15
call fcn.14006ce40
test al, al
je 0x1400727d4
mov ebx, dword [rdi + 0x28]
lea rcx, [rsp + 0xa0]
mov rax, qword [rsp + 0x98]
mov r9, r12
mov r8, rsi
mov qword [rsp + 0x20], rax
mov dl, 1
add rbx, r13
call fcn.14003e0d0
test al, al
je 0x1400727d4
mov r9, qword [rsp + 0xa0]
lea rdx, [rsp + 0xa8]
xor eax, eax
mov r8, rbx
mov rcx, r15
mov dword [rsp + 0xa8], eax
call fcn.140072ae0
test al, al
je 0x1400727d4
mov rdx, qword [rsp + 0xd8]
test rdx, rdx
je 0x1400727a2
mov ecx, dword [rsp + 0xa8]
mov dword [rdx], ecx
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rsi
mov r12, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x90]
mov r13, qword [rsp + 0x50]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0xd0]
mov rcx, r15
call fcn.14006d7d0
xor eax, eax
jmp 0x1400727b6
xor eax, eax
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
Function at 0x140073020
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rsi, rdx
mov rdi, rcx
xor r8d, r8d
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x140073121
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x140073121
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r8
mov ecx, dword [rax + rdx + 0xb0]
test ecx, ecx
jne 0x140073085
mov qword [rdi], r8
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r8
jmp 0x14007312c
lea rbx, [rdx + rcx]
mov ebp, dword [rax + rdx + 0xb4]
add rbp, rbx
mov rcx, qword [rsp + 0x30]
cmp rbx, rbp
jae 0x14007310f
nop dword [rax]
mov edx, dword [rbx + 4]
test edx, edx
je 0x14007310f
mov eax, dword [rbx]
add rax, rsi
mov qword [rsp + 0x40], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x48], rax
lea rax, [rdx - 8]
shr rax, 1
mov dword [rsp + 0x50], eax
cmp rcx, r8
je 0x1400730e8
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x50]
movsd qword [rcx + 0x10], xmm1
add rcx, 0x18
mov qword [rsp + 0x30], rcx
jmp 0x140073104
lea r8, [rsp + 0x40]
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.140073600
mov r8, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, rbp
jb 0x1400730a0
mov rax, qword [rsp + 0x28]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], r8
jmp 0x14007312c
mov qword [rcx], r8
mov qword [rcx + 8], r8
mov qword [rcx + 0x10], r8
mov rax, rdi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret