joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a3e20
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x108
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x70], xmm6
mov qword [rbp + 0x68], 0xfffffffffffffffe
mov qword [rbp + 0x60], r9
mov rdi, r8
mov r15, rdx
mov rsi, rcx
mov rax, qword [rbp + 0xf8]
mov eax, dword [rax + 0x5c]
mov rcx, qword [rdx + 0x10]
mov qword [rbp - 0x10], rcx
movups xmm0, xmmword [rdx]
movaps xmmword [rbp - 0x20], xmm0
mov rcx, qword [rdx + 0x18]
test rcx, rcx
je 0x1400a3e7a
lock inc dword [rcx + 8]
lea rdx, [rbp - 8]
mov qword [rdx], rcx
movups xmm0, xmmword [r15 + 0x20]
movaps xmmword [rdx + 8], xmm0
movups xmm0, xmmword [r15 + 0x30]
movups xmm1, xmmword [r15 + 0x40]
movaps xmmword [rdx + 0x18], xmm0
movaps xmmword [rdx + 0x28], xmm1
cmp qword [rbp + 0x60], 0
jle 0x1400a3f7e
shr rax, 0x15
and eax, 0x18
lea rcx, [0x1401e9b08]
mov r13, qword [rbp + 0xf0]
mov r14, qword [rax + rcx]
add r15, 0x30
add qword [rbp + 0x60], rdi
movaps xmm6, xmmword [0x1401ca5e0]
lea rbx, [rbp - 0x48]
movss xmm0, dword [r13]
movss dword [rbp + 0x38], xmm0
movss xmm1, dword [r13 + 4]
movaps xmm2, xmm1
xorps xmm2, xmm6
movss dword [rbp + 0x3c], xmm2
movss xmm2, dword [r13 + 8]
movss dword [rbp + 0x40], xmm2
movss dword [rbp + 0x44], xmm1
movss dword [rbp + 0x48], xmm0
movss xmm0, dword [r13 + 0xc]
movss dword [rbp + 0x4c], xmm0
and qword [rbp + 0x50], 0
movabs rax, 0xc03f800000
mov qword [rbp + 0x58], rax
mov rdx, qword [r15]
mov rcx, rbx
lea r8, [rbp + 0x38]
call fcn.1400c4048
mov qword [rbp + 0x10], rbx
mov rcx, rdi
call r14
movsxd r12, eax
mov rax, qword [rsi]
mov rax, qword [rax + 0xa8]
and dword [rsp + 0x28], 0
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x30], rcx
and dword [rsp + 0x20], 0
mov rcx, rsi
lea rdx, [rbp - 0x20]
mov r8, rdi
mov r9, r12
call rax
add rdi, r12
add r13, 0x10
cmp rdi, qword [rbp + 0x60]
jb 0x1400a3ed3
lea rcx, [rbp - 8]
call fcn.140042d92
movaps xmm6, xmmword [rbp + 0x70]
add rsp, 0x108
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1400a9f46
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa0
movaps xmmword [rsp + 0x90], xmm6
movd xmm1, r8d
movd xmm0, r9d
addss xmm0, xmm1
movss xmm1, dword [0x1401e9b54]
ucomiss xmm1, xmm0
jb 0x1400aa106
ucomiss xmm0, dword [0x1401e9b58]
jb 0x1400aa106
shr r8, 0x20
movd xmm2, r8d
shr r9, 0x20
movd xmm6, r9d
addss xmm6, xmm2
ucomiss xmm1, xmm6
jb 0x1400aa106
ucomiss xmm6, dword [0x1401e9b58]
jb 0x1400aa106
mov rdi, rdx
mov r15, rcx
call fcn.1401c60d4
cvttss2si esi, xmm0
movaps xmm0, xmm6
call fcn.1401c60d4
cvttss2si eax, xmm0
movsx ecx, word [rdi + 0x1e]
add ecx, esi
movsx edx, word [rdi + 0x1c]
add edx, eax
movzx eax, word [rdi + 0x18]
movzx esi, word [rdi + 0x1a]
lea rbx, [rsp + 0x28]
and qword [rbx - 8], 0
add eax, ecx
add esi, edx
mov dword [rbx], ecx
mov dword [rbx + 4], edx
mov dword [rbx + 8], eax
mov dword [rbx + 0xc], esi
cmp byte [r15], 0
je 0x1400aa06c
mov rdx, qword [r15 + 0x18]
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov r8, rbx
call fcn.1400f098c
cmp byte [rsi + 0x48], 0
jne 0x1400aa106
lea r8, [rsp + 0x20]
mov rcx, r15
mov rdx, rdi
call fcn.1400aa11e
test al, al
je 0x1400aa106
lea rdi, [rsp + 0x78]
lea rbx, [rsp + 0x20]
lea rsi, [rsp + 0x40]
mov rcx, r15
mov rdx, rbx
mov r8, rdi
call fcn.1400aa160
mov rcx, rsi
call fcn.1400f09f6
cmp byte [rsp + 0x88], 0
je 0x1400aa047
jmp 0x1400aa106
lea r14, [r15 + 0x30]
mov rcx, r14
mov rdx, rbx
call fcn.1400aa28e
test al, al
je 0x1400aa0a5
lea r8, [rsp + 0x20]
mov rcx, r15
mov rdx, rdi
call fcn.1400aa11e
test al, al
je 0x1400aa106
lea rdx, [rsp + 0x20]
mov rcx, r15
mov r8, rbx
call fcn.1400aa160
jmp 0x1400aa106
mov ebx, dword [rsp + 0x28]
mov eax, dword [r15 + 0x38]
cmp ebx, eax
jge 0x1400aa106
mov esi, dword [r14]
mov ecx, dword [rsp + 0x30]
cmp esi, ecx
jge 0x1400aa106
mov r9d, dword [rsp + 0x2c]
mov edx, dword [r15 + 0x3c]
cmp r9d, edx
jge 0x1400aa106
mov r10d, dword [r15 + 0x34]
mov r8d, dword [rsp + 0x34]
cmp r10d, r8d
jge 0x1400aa106
cmp ebx, esi
cmovg esi, ebx
lea rbx, [rsp + 0x40]
mov dword [rbx], esi
cmp r9d, r10d
cmovg r10d, r9d
mov dword [rbx + 4], r10d
cmp ecx, eax
cmovl eax, ecx
mov dword [rbx + 8], eax
cmp r8d, edx
cmovl edx, r8d
mov dword [rbx + 0xc], edx
jmp 0x1400aa07f
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400eaa00
Capabilities:
Hash data using murmur3

Disassembly:
mov eax, ecx
shr eax, 0x10
xor eax, ecx
imul eax, eax, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
ret
mov ecx, dword [rcx]
jmp 0x1400d4770

Function at 0x1400f6cda
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov esi, r9d
mov r15d, r8d
mov ebx, edx
mov r14d, dword [rsp + 0x80]
mov rdi, qword [rcx + 8]
mov ebp, 0xff
lea r9d, [rsi + 0x8000]
mov r8d, r9d
sar r8d, 0x10
shr r9d, 8
and r9d, ebp
dec r8d
mov rax, qword [rdi]
mov dword [rsp + 0x20], r9d
xor r9d, ebp
mov rcx, rdi
mov edx, ebx
call qword [rax + 0x48]
inc ebx
add esi, r14d
cmp ebx, r15d
jl 0x1400f6cff
mov eax, esi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1400f6eb6
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov esi, r9d
mov r15d, r8d
mov ebx, edx
mov rdi, rcx
mov r14d, dword [rsp + 0x80]
mov ebp, 0xff
lea r9d, [rsi + 0x8000]
mov edx, r9d
sar edx, 0x10
shr r9d, 8
mov rcx, qword [rdi + 8]
and r9d, ebp
dec edx
mov rax, qword [rcx]
mov dword [rsp + 0x20], r9d
xor r9d, ebp
mov r8d, ebx
call qword [rax + 0x40]
inc ebx
add esi, r14d
cmp ebx, r15d
jl 0x1400f6eda
mov eax, esi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140117326
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm9
movaps xmmword [rsp + 0x50], xmm8
movaps xmmword [rsp + 0x40], xmm7
movaps xmmword [rsp + 0x30], xmm6
mov rsi, r9
mov edi, r8d
mov ebp, edx
mov r14, rcx
mov ebx, dword [rsp + 0xe0]
mov r15, qword [rcx + 0x90]
mov rcx, qword [rcx + 0xa0]
lea r12, [r14 + 0x68]
call fcn.140113720
mov edx, edi
mov r13, rax
mov eax, ebp
and eax, 1
mov ecx, edi
and ecx, 1
lea edi, [rax + rcx*2]
shl edi, 8
cmp byte [r14 + 0x98], 2
jne 0x1401173fa
test ebx, ebx
jle 0x14011749d
add ebx, ebp
cvtsi2ss xmm6, edx
addss xmm6, dword [0x1401ca5b4]
movss xmm7, dword [0x1401ca5b4]
lea r14, [rsp + 0x20]
cvtsi2ss xmm1, ebp
addss xmm1, xmm7
mov rcx, r12
movaps xmm2, xmm6
mov r9, r14
call r15
movss xmm1, dword [rsp + 0x20]
movss xmm0, dword [rsp + 0x24]
call fcn.1401174c4
add eax, edi
mov eax, dword [r13 + rax*4]
mov dword [rsi], eax
add rsi, 4
xor edi, 0x100
inc ebp
cmp ebp, ebx
jl 0x1401173b7
jmp 0x14011749d
cvtsi2ss xmm8, edx
movss xmm0, dword [0x1401ca5b4]
addss xmm8, xmm0
cvtsi2ss xmm1, ebp
addss xmm1, xmm0
lea rbp, [rsp + 0x20]
mov rcx, r12
movaps xmm2, xmm8
mov r9, rbp
call r15
movss xmm6, dword [rbp]
movss xmm7, dword [rbp + 4]
cmp byte [r14 + 0x98], 1
jne 0x14011745c
lea rbp, [rsp + 0x28]
mov rcx, r12
mov rdx, rbp
movaps xmm2, xmm8
call fcn.1400c4f30
movss xmm8, dword [rbp]
movss xmm9, dword [rbp + 4]
jmp 0x140117468
movss xmm8, dword [r14 + 0x68]
movss xmm9, dword [r14 + 0x74]
test ebx, ebx
jle 0x14011749d
inc ebx
movaps xmm0, xmm7
movaps xmm1, xmm6
call fcn.1401174c4
add eax, edi
mov eax, dword [r13 + rax*4]
mov dword [rsi], eax
add rsi, 4
addss xmm6, xmm8
addss xmm7, xmm9
xor edi, 0x100
dec ebx
cmp ebx, 1
ja 0x14011746e
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x50]
movaps xmm9, xmmword [rsp + 0x60]
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140117948
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
movaps xmmword [rsp + 0x90], xmm8
movaps xmmword [rsp + 0x80], xmm7
movaps xmmword [rsp + 0x70], xmm6
mov rsi, r9
mov r15d, r8d
mov r14d, edx
mov r13, rcx
mov ebp, dword [rsp + 0x110]
mov rbx, qword [rcx + 8]
mov rax, qword [rcx + 0x90]
mov qword [rsp + 0x48], rax
mov eax, edx
and eax, 1
mov ecx, r8d
and ecx, 1
lea edi, [rax + rcx*2]
shl edi, 8
mov rcx, qword [r13 + 0xa0]
call fcn.140113720
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov eax, dword [rbx + 0x60]
cmp eax, 2
lea rcx, [0x140117c52]
lea rdx, [0x140117b7a]
cmove rdx, rcx
test eax, eax
lea r12, [0x140117bd4]
cmovne r12, rdx
cmp byte [r13 + 0x98], 2
jne 0x140117a9e
mov ecx, r15d
mov eax, r14d
test ebp, ebp
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
jle 0x140117b50
cvtsi2ss xmm6, ecx
addss xmm6, dword [0x1401ca5b4]
cvtsi2ss xmm7, eax
add r13, 0x68
add r14, 0x148
addss xmm7, dword [0x1401ca5b4]
inc ebp
lea rbx, [rsp + 0x50]
movss xmm8, dword [0x1401ca5bc]
mov rcx, r13
movaps xmm1, xmm7
movaps xmm2, xmm6
lea r9, [rsp + 0x40]
call qword [rsp + 0x48]
movss xmm2, dword [rsp + 0x40]
movss xmm3, dword [rsp + 0x44]
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, r14
call fcn.14011761a
mov dword [rsp + 0x20], 1
mov rcx, rbx
mov rdx, rsi
mov r8, r15
mov r9d, edi
call r12
addss xmm7, xmm8
xor edi, 0x100
add rsi, 4
dec ebp
cmp ebp, 1
ja 0x140117a39
jmp 0x140117b50
cvtsi2ss xmm6, r15d
movss xmm0, dword [0x1401ca5b4]
cvtsi2ss xmm1, r14d
movaps xmm2, xmm6
addss xmm2, xmm0
addss xmm1, xmm0
lea r14, [r13 + 0x68]
lea rbx, [rsp + 0x40]
mov rcx, r14
mov r9, rbx
call qword [rsp + 0x48]
movss xmm8, dword [rbx]
movss xmm7, dword [rbx + 4]
cmp byte [r13 + 0x98], 1
jne 0x140117b00
lea rbx, [rsp + 0x50]
mov rcx, r14
mov rdx, rbx
movaps xmm2, xmm6
call fcn.1400c4f30
movss xmm0, dword [rbx]
movss xmm1, dword [rbx + 4]
jmp 0x140117b0c
movss xmm0, dword [r13 + 0x68]
movss xmm1, dword [r13 + 0x74]
mov r15, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
add rdx, 0x148
movss dword [rsp + 0x28], xmm1
movss dword [rsp + 0x20], xmm0
lea rbx, [rsp + 0x50]
mov rcx, rbx
movaps xmm2, xmm8
movaps xmm3, xmm7
call fcn.14011761a
mov dword [rsp + 0x20], ebp
mov rcx, rbx
mov rdx, rsi
mov r8, r15
mov r9d, edi
call r12
movaps xmm6, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm8, xmmword [rsp + 0x90]
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14011cb1e
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rdx, r9
call fcn.14011caf6
mov r9d, dword [rbx + 0x14]
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14011c2b4
Function at 0x14016fa6d
Capabilities:
Read file on windows

Disassembly:
mov rax, qword [rcx + 8]
test rax, rax
je 0x1400fe729
mov rcx, rdx
mov rdx, r8
mov r8, rax
jmp 0x14016fa6d
xor eax, eax
ret
push rsi
push rdi
sub rsp, 0x28
mov rdi, r8
mov rsi, rdx
test rcx, rcx
je 0x14016fa94
mov edx, 1
mov r8, rsi
mov r9, rdi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14019f170
mov rcx, rdi
call fcn.14019f734
cmp eax, 0xffffffff
je 0x14016fabd
mov rcx, rdi
mov edx, esi
mov r8d, 1
call fcn.14019f50c
mov ecx, eax
xor eax, eax
test ecx, ecx
cmove rax, rsi
jmp 0x14016fabf
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x14016fb30
Capabilities:
Print debug messages

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x840
mov rsi, rcx
lea rdi, [rsp + 0x868]
mov qword [rdi], rdx
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r9
mov qword [rsp + 0x28], rdi
mov ecx, 2
call fcn.14019b3f4
mov rcx, rax
mov rdx, rsi
mov r8, rdi
call fcn.14016fbb1
mov ecx, 2
call fcn.14019b3f4
mov rcx, rax
call fcn.14019e1c0
mov qword [rsp + 0x28], rdi
lea rbx, [rsp + 0x30]
mov edx, 0x800
mov rcx, rbx
mov r8, rsi
mov r9, rdi
call fcn.14000ee98
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
nop
add rsp, 0x840
pop rbx
pop rdi
pop rsi
ret

Function at 0x140175018
Capabilities:
Get file size
Read file via mapping

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rdx
call fcn.14019fd00
cmp rax, 0xffffffffffffffff
je 0x1401750a9
mov rbx, rax
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor edi, edi
test eax, eax
je 0x1401750b8
cmp qword [rbp - 0x10], 0
js 0x1401750b8
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor edi, edi
push 2
pop r8
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbp - 8], rax
test rax, rax
je 0x1401750af
and qword [rsp + 0x20], 0
push 4
pop rdx
mov rcx, rax
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
je 0x1401750ad
mov rax, qword [rbp - 0x10]
mov qword [rsi], rax
jmp 0x1401750af
xor edi, edi
jmp 0x1401750b8
xor edi, edi
lea rcx, [rbp - 8]
call fcn.1400fb6c2
mov rax, rdi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop rbp
ret
push rsi
sub rsp, 0x20
mov rsi, rdx
call fcn.14019ded8
test eax, eax
js 0x140175108
mov ecx, eax
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp 0x140175018
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x1401750e8
Capabilities:
Get file size
Read file via mapping

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rdx
call fcn.14019fd00
cmp rax, 0xffffffffffffffff
je 0x1401750a9
mov rbx, rax
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor edi, edi
test eax, eax
je 0x1401750b8
cmp qword [rbp - 0x10], 0
js 0x1401750b8
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor edi, edi
push 2
pop r8
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbp - 8], rax
test rax, rax
je 0x1401750af
and qword [rsp + 0x20], 0
push 4
pop rdx
mov rcx, rax
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
je 0x1401750ad
mov rax, qword [rbp - 0x10]
mov qword [rsi], rax
jmp 0x1401750af
xor edi, edi
jmp 0x1401750b8
xor edi, edi
lea rcx, [rbp - 8]
call fcn.1400fb6c2
mov rax, rdi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop rbp
ret
push rsi
sub rsp, 0x20
mov rsi, rdx
call fcn.14019ded8
test eax, eax
js 0x140175108
mov ecx, eax
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp 0x140175018
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x140175110
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov al, byte [0x140260910]
test cl, cl
je 0x140175172
test al, 1
jne 0x140175176
lea rcx, [0x140256d00]
mov qword [rbp - 0x18], rcx
call fcn.140083e50
lea rax, [0x1400a44de]
mov qword [rbp - 0x10], rax
cmp byte [0x140260910], 0
jne 0x140175167
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140260914], eax
mov byte [0x140260910], 1
lea rcx, [rbp - 0x18]
call fcn.1400a449c
jmp 0x140175176
test al, 1
je 0x140175184
mov ecx, dword [0x140260914]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x140175186
xor eax, eax
add rsp, 0x40
pop rbp
ret
Function at 0x14019ddd0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
neg rcx
test rax, 7
je 0x14019dded
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x14019de48
test al, 7
jne 0x14019dde0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x14019de01
mov rdx, qword [rax - 8]
test dl, dl
je 0x14019de72
test dh, dh
je 0x14019de6c
shr rdx, 0x10
test dl, dl
je 0x14019de66
test dh, dh
je 0x14019de60
shr rdx, 0x10
test dl, dl
je 0x14019de5a
test dh, dh
je 0x14019de54
shr edx, 0x10
test dl, dl
je 0x14019de4e
test dh, dh
jne 0x14019de01
lea rax, [rcx + rax - 1]
ret
lea rax, [rcx + rax - 2]
ret
lea rax, [rcx + rax - 3]
ret
lea rax, [rcx + rax - 4]
ret
lea rax, [rcx + rax - 5]
ret
lea rax, [rcx + rax - 6]
ret
lea rax, [rcx + rax - 7]
ret
lea rax, [rcx + rax - 8]
ret

Function at 0x14019f7d8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.1401b8800
sub rsp, rax
mov rax, qword [0x140248300]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r14, rdx
mov rbx, rcx
call fcn.14019ded8
xor esi, esi
movsxd r12, eax
cmp dword [rbx + 0x10], esi
jne 0x14019f82c
mov rax, r14
jmp 0x14019f946
mov rax, qword [rbx]
mov rdi, r12
sub rax, qword [rbx + 8]
xor r8d, r8d
cqo
sar rdi, 6
sub rax, rdx
mov rbx, r12
sar rax, 1
and ebx, 0x3f
mov r15, rax
shl rbx, 6
lea rax, [0x140000000]
mov ecx, r12d
mov rdx, qword [rax + rdi*8 + 0x2576f0]
mov rbp, r12
mov rdx, qword [rbx + rdx + 0x30]
call fcn.1401b8448
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rdi*8 + 0x2576f0]
cmp r13, qword [rbx + rcx + 0x30]
je 0x14019f893
or rax, 0xffffffffffffffff
jmp 0x14019f946
mov rcx, rbp
mov qword [rsp + 0x20], rsi
sar rcx, 6
lea r9, [rsp + 0x30]
and ebp, 0x3f
lea rdx, [rsp + 0x40]
shl rbp, 6
mov r8d, 0x1000
mov rcx, qword [rax + rcx*8 + 0x2576f0]
mov rcx, qword [rcx + rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14019f88a
xor r8d, r8d
mov rdx, r14
mov ecx, r12d
call fcn.1401b8448
test rax, rax
js 0x14019f88a
mov eax, dword [rsp + 0x30]
cmp r15, rax
jg 0x14019f88a
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test r15, r15
je 0x14019f93a
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x14019f93a
cmp byte [rcx], 0xd
jne 0x14019f920
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x14019f92f
cmp byte [rcx + 1], 0xa
jne 0x14019f92f
inc rcx
jmp 0x14019f92f
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x2481d0]
add rcx, rax
inc rsi
inc rcx
cmp rsi, r15
jne 0x14019f902
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1401af390
lea r11, [rsp + 0x1050]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1401a22b4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r10, [0x1402576f0]
mov r14, rdx
mov rax, r15
sar rax, 6
mov rdx, r15
and edx, 0x3f
mov rdi, r15
shl rdx, 6
mov r9, qword [r10 + rax*8]
mov r12, qword [r9 + rdx + 0x28]
test r8, r8
je 0x1401a2319
cmp byte [r14], 0xa
jne 0x1401a2319
mov rcx, r15
mov rax, r15
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r10 + rax*8]
or byte [rax + rcx + 0x38], 4
jmp 0x1401a233a
mov dl, byte [r9 + rdx + 0x38]
mov rcx, rdi
and dl, 0xfb
mov rax, rdi
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r10 + rax*8]
mov byte [rax + rcx + 0x38], dl
lea rbp, [r14 + r8]
mov rsi, r14
mov rbx, r14
cmp r14, rbp
jae 0x1401a2494
mov r13d, 1
mov al, byte [rsi]
cmp al, 0x1a
je 0x1401a2454
cmp al, 0xd
je 0x1401a236e
mov byte [rbx], al
add rbx, r13
add rsi, r13
jmp 0x1401a2449
lea rax, [rsi + 1]
cmp rax, rbp
jae 0x1401a2394
cmp byte [rax], 0xa
jne 0x1401a2386
mov byte [rbx], 0xa
mov eax, 2
jmp 0x1401a238c
mov byte [rbx], 0xd
mov rax, r13
add rsi, rax
jmp 0x1401a2446
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov r8d, r13d
lea rdx, [rsp + 0x70]
mov rcx, r12
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1401a243c
cmp dword [rsp + 0x78], 0
je 0x1401a243c
mov rcx, rdi
lea r10, [0x1402576f0]
and ecx, 0x3f
mov rax, rdi
sar rax, 6
shl rcx, 6
mov rax, qword [r10 + rax*8]
test byte [rax + rcx + 0x38], 0x48
je 0x1401a240c
mov dl, byte [rsp + 0x70]
cmp dl, 0xa
je 0x1401a2418
mov rcx, rdi
mov byte [rbx], 0xd
mov rax, rdi
and ecx, 0x3f
sar rax, 6
shl rcx, 6
mov rax, qword [r10 + rax*8]
mov byte [rax + rcx + 0x3a], dl
jmp 0x1401a2446
cmp byte [rsp + 0x70], 0xa
jne 0x1401a241d
cmp rbx, r14
jne 0x1401a241d
mov byte [rbx], 0xa
jmp 0x1401a2446
mov r8d, r13d
or rdx, 0xffffffffffffffff
mov ecx, r15d
call fcn.1401b8450
cmp byte [rsp + 0x70], 0xa
lea r10, [0x1402576f0]
je 0x1401a2449
jmp 0x1401a2443
lea r10, [0x1402576f0]
mov byte [rbx], 0xd
add rbx, r13
cmp rsi, rbp
jb 0x1401a2353
jmp 0x1401a2494
mov rcx, rdi
mov rax, rdi
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r10 + rax*8]
mov dl, byte [rax + rcx + 0x38]
test dl, 0x40
jne 0x1401a248d
mov rax, rdi
or dl, 2
sar rax, 6
and edi, 0x3f
shl rdi, 6
mov rax, qword [r10 + rax*8]
mov byte [rax + rdi + 0x38], dl
jmp 0x1401a2494
mov cl, byte [rsi]
mov byte [rbx], cl
add rbx, r13
sub rbx, r14
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401a24b4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r11, [0x1402576f0]
mov r9, r15
mov rax, r15
sar rax, 6
and r9d, 0x3f
shl r9, 6
mov r14, rdx
mov rdi, r15
mov r10d, 0xa
mov rdx, qword [r11 + rax*8]
mov r12, qword [rdx + r9 + 0x28]
test r8, r8
je 0x1401a2520
cmp word [r14], r10w
jne 0x1401a2520
mov rcx, r15
mov rax, r15
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r11 + rax*8]
or byte [rax + rcx + 0x38], 4
jmp 0x1401a2541
mov dl, byte [rdx + r9 + 0x38]
mov rcx, rdi
and dl, 0xfb
mov rax, rdi
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r11 + rax*8]
mov byte [rax + rcx + 0x38], dl
lea rbp, [r14 + r8*2]
mov rsi, r14
mov rbx, r14
cmp r14, rbp
jae 0x1401a271a
mov ecx, 0xd
lea r13d, [rcx - 0xb]
movzx eax, word [rsi]
cmp ax, 0x1a
je 0x1401a26d8
cmp ax, cx
je 0x1401a257d
mov word [rbx], ax
add rbx, r13
add rsi, r13
jmp 0x1401a2671
lea rax, [rsi + 2]
cmp rax, rbp
jae 0x1401a25a5
cmp word [rax], r10w
jne 0x1401a2597
mov word [rbx], r10w
mov eax, 4
jmp 0x1401a259d
mov word [rbx], cx
mov rax, r13
add rsi, rax
jmp 0x1401a26bb
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x80]
mov r8d, r13d
lea rdx, [rsp + 0x70]
mov rcx, r12
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1401a26c0
cmp dword [rsp + 0x80], 0
je 0x1401a26c0
mov rcx, rdi
lea r11, [0x1402576f0]
and ecx, 0x3f
mov rax, rdi
sar rax, 6
mov r10d, 0xa
shl rcx, 6
mov rax, qword [r11 + rax*8]
test byte [rax + rcx + 0x38], 0x48
je 0x1401a267f
movzx eax, word [rsp + 0x70]
cmp ax, r10w
jne 0x1401a2617
mov word [rbx], r10w
jmp 0x1401a2669
mov r8, rdi
mov word [rsp + 0x78], ax
mov r9, rdi
and r8d, 0x3f
sar r9, 6
mov ecx, 0xd
xor edx, edx
mov word [rbx], cx
shl r8, 6
mov rcx, qword [r11 + r9*8]
mov al, byte [rsp + rdx + 0x78]
add rcx, r8
mov byte [rcx + rdx + 0x3a], al
inc rdx
cmp rdx, r13
jl 0x1401a2638
mov rcx, rdi
mov rax, rdi
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r11 + rax*8]
mov byte [rax + rcx + 0x3c], r10b
add rbx, r13
mov ecx, 0xd
cmp rsi, rbp
jb 0x1401a255d
jmp 0x1401a271a
cmp word [rsp + 0x70], r10w
jne 0x1401a268c
cmp rbx, r14
je 0x1401a2611
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.1401b8450
mov r10d, 0xa
lea r11, [0x1402576f0]
cmp word [rsp + 0x70], r10w
je 0x1401a266c
lea ecx, [r10 + 3]
mov word [rbx], cx
add rbx, r13
jmp 0x1401a2671
mov ecx, 0xd
lea r11, [0x1402576f0]
mov word [rbx], cx
add rbx, r13
lea r10d, [rcx - 3]
jmp 0x1401a2671
mov rcx, rdi
mov rax, rdi
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r11 + rax*8]
mov dl, byte [rax + rcx + 0x38]
test dl, 0x40
jne 0x1401a2711
mov rax, rdi
or dl, r13b
sar rax, 6
and edi, 0x3f
shl rdi, 6
mov rax, qword [r11 + rax*8]
mov byte [rax + rdi + 0x38], dl
jmp 0x1401a271a
movzx ecx, word [rsi]
mov word [rbx], cx
add rbx, r13
sub rbx, r14
sar rbx, 1
lea rax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret