joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002b130
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x288
mov qword [rsp + 0x260], 0xfffffffffffffffe
mov rax, qword [0x140043078]
xor rax, rsp
mov qword [rsp + 0x278], rax
mov dword [rsp + 0x258], 0
lea rdx, [0x14003865c]
lea rcx, [rsp + 0x30]
call fcn.1400035c0
nop
mov rcx, qword [rsp + 0x290]
call fcn.1400016e0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x40]
lea r8, [0x1400386c0]
lea rdx, str.ModelName
lea rcx, [0x1400386e8]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rdx, [0x140038708]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x14002b203
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x298]
call fcn.140001740
mov eax, dword [rsp + 0x258]
or eax, 1
mov dword [rsp + 0x258], eax
lea rcx, [rsp + 0x30]
call fcn.140002710
mov rax, qword [rsp + 0x298]
jmp 0x14002b282
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x250]
call fcn.1400035c0
mov qword [rsp + 0x268], rax
mov rax, qword [rsp + 0x268]
mov qword [rsp + 0x270], rax
mov rdx, qword [rsp + 0x270]
lea rcx, [rsp + 0x30]
call fcn.140001ac0
nop
lea rcx, [rsp + 0x250]
call fcn.140002710
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x298]
call fcn.140001740
mov eax, dword [rsp + 0x258]
or eax, 1
mov dword [rsp + 0x258], eax
lea rcx, [rsp + 0x30]
call fcn.140002710
mov rax, qword [rsp + 0x298]
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.140016f40
add rsp, 0x288
ret
Function at 0x14002bdb0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 1
mov rcx, qword [rsp + 0x48]
call fcn.1400016e0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r11, rax
mov rax, qword [rsp + 0x40]
mov qword [rax], r11
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
jne 0x14002bdfc
mov dword [rsp + 0x20], 0
jmp 0x14002bee6
lea rdx, str.GE_GetURLW
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r11, rax
mov rax, qword [rsp + 0x40]
mov qword [rax + 8], r11
mov rax, qword [rsp + 0x40]
cmp qword [rax + 8], 0
jne 0x14002be36
mov dword [rsp + 0x20], 0
jmp 0x14002bee6
lea rdx, str.GE_GetURLExW
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r11, rax
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x10], r11
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x10], 0
jne 0x14002be6d
mov dword [rsp + 0x20], 0
jmp 0x14002bee6
lea rdx, str.GE_freeW
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r11, rax
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x18], r11
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x18], 0
jne 0x14002bea4
mov dword [rsp + 0x20], 0
jmp 0x14002bee6
lea rdx, str.GE_GetURL2W
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r11, rax
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x20], r11
lea rdx, str.GE_GetURLEx2W
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r11, rax
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x28], r11
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov rcx, qword [rsp + 0x48]
call fcn.140002710
mov eax, dword [rsp + 0x24]
add rsp, 0x38
ret

Function at 0x14002caa0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov dword [rsp + 0x90], 1
mov r8d, 0x70
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140017420
mov dword [rsp + 0x20], 0x70
mov dword [rsp + 0x24], 0x4040
lea rax, str.open
mov qword [rsp + 0x30], rax
lea rax, str.rundll32.exe
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0xb0]
add rcx, 0x20
call fcn.1400016e0
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], 5
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [rsp + 0x90], eax
mov eax, dword [rsp + 0x90]
add rsp, 0xa8
ret

Function at 0x14002d000
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov dword [rsp + 0x90], 1
mov r8d, 0x70
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140017420
mov dword [rsp + 0x20], 0x70
mov dword [rsp + 0x24], 0x4040
lea rax, [0x140038a58]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0xb0]
add rcx, 0x28
call fcn.1400016e0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x50], 5
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [rsp + 0x90], eax
mov eax, dword [rsp + 0x90]
add rsp, 0xa8
ret
Function at 0x14002d830
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xc8
mov dword [rsp + 0xb0], 1
mov dword [rsp + 0x30], 0
mov r8d, 0x70
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140017420
mov rax, qword [rsp + 0xd0]
cmp dword [rax + 0x28], 1
jne 0x14002d8c5
mov rax, qword [rsp + 0xd0]
cmp dword [rax + 0x50], 0
jne 0x14002d8c5
mov rcx, qword [rsp + 0xd0]
add rcx, 0x18
call fcn.1400016e0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
mov rax, qword [rsp + 0xd0]
call qword [rax + 0x58]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14002d8c3
mov dword [rsp + 0xb0], 0
jmp 0x14002d927
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x44], 0x4040
lea rax, [0x140038c80]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0xd0]
add rcx, 8
call fcn.1400016e0
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0xd0]
add rcx, 0x20
call fcn.1400016e0
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x70], 5
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [rsp + 0xb0], eax
mov rax, qword [rsp + 0xd0]
cmp dword [rax + 0x28], 7
jne 0x14002d948
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0xb0]
add rsp, 0xc8
ret
Function at 0x7ff7f3a035b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xc8
mov rax, qword [0x7ff7f3d30410]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xd0]
cmp qword [rax + 0x68], 0
je 0x7ff7f3a035ed
mov rax, qword [rsp + 0xd0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x7ff7f3a035f4
mov al, 1
jmp 0x7ff7f3a03789
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x38], 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xd0]
call qword [rsp + 0x68]
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], 0xffffffff
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jne 0x7ff7f3a03648
mov dword [rsp + 0x3c], 1
jmp 0x7ff7f3a03650
mov dword [rsp + 0x3c], 0
movzx eax, byte [rsp + 0x3c]
mov byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x30]
test eax, eax
je 0x7ff7f3a03669
xor al, al
jmp 0x7ff7f3a03789
mov qword [rsp + 0x78], 0x20
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0xa8]
mov rcx, qword [rsp + 0xd0]
add rcx, 0x74
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x88]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [rsp + 0x70]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x7ff7f3a036ee
cmp dword [rsp + 0x34], 1
je 0x7ff7f3a036fa
cmp dword [rsp + 0x34], 3
je 0x7ff7f3a03777
jmp 0x7ff7f3a03787
mov rax, qword [rsp + 0xd0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jbe 0x7ff7f3a0374e
mov rax, qword [rsp + 0xd0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
lea rcx, [rsp + 0x88]
call fcn.7ff7f3cbf6a4
cmp qword [rsp + 0x50], rax
je 0x7ff7f3a0374e
xor al, al
jmp 0x7ff7f3a03789
mov rax, qword [rsp + 0xd0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x7ff7f3a03768
mov dword [rsp + 0x40], 1
jmp 0x7ff7f3a03770
mov dword [rsp + 0x40], 0
movzx eax, byte [rsp + 0x40]
jmp 0x7ff7f3a03789
mov rax, qword [rsp + 0xd0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x7ff7f3a03789
xor al, al
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.7ff7f3c4ba40
add rsp, 0xc8
ret
Function at 0x7ff7f3a32e30
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
add rax, 0x30
mov rcx, rax
call fcn.7ff7f3b4a6c0
mov rax, qword [rsp + 0x30]
add rax, 0x50
mov rcx, rax
call fcn.7ff7f3b4a6c0
mov rax, qword [rsp + 0x30]
add rax, 0x70
mov rcx, rax
call fcn.7ff7f3a00ff0
mov rax, qword [rsp + 0x30]
add rax, 0x90
mov rcx, rax
call fcn.7ff7f3a00ff0
mov rax, qword [rsp + 0x30]
lea rcx, [0x7ff7f3d141f0]
mov qword [rax + 0x18], rcx
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x7ff7f3b81160
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 0x20], r9
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov rax, qword [0x7ff7f3d30410]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0x98], 0
mov dword [rsp + 0x40], 0
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0xc0]
call fcn.7ff7f3b80ea0
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x7ff7f3b811de
mov eax, dword [rsp + 0x40]
jmp 0x7ff7f3b8131f
cmp dword [rsp + 0xe0], 0
je 0x7ff7f3b811f9
mov eax, dword [rsp + 0xe0]
mov qword [rsp + 0x48], rax
jmp 0x7ff7f3b8129f
mov qword [rsp + 0x58], 0x2d0e1ea8
mov rax, qword [rsp + 0x58]
xor rax, 8
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x60], 8
mov rax, qword [0x7ff7f3d31188]
xor rax, 0x8960
imul rax, rax, 6
mov qword [rsp + 0x68], rax
imul rax, qword [0x7ff7f3d31180], 0x8960
xor edx, edx
mov ecx, 8
div rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
lea rax, [rax + rcx + 1]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
sub rax, rcx
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
xor edx, edx
div rcx
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0xd8], 0
je 0x7ff7f3b812b9
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x50], rax
jmp 0x7ff7f3b812c5
lea rax, [0x7ff7f3d0bd30]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x20], rax
movzx r9d, byte [rsp + 0xd0]
mov r8, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0xc0]
call fcn.7ff7f3b80840
mov dword [rsp + 0x40], eax
mov rcx, qword [rsp + 0x98]
call fcn.7ff7f3b81130
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.7ff7f3c4ba40
add rsp, 0xb8
ret

Function at 0x7ff7f3c55ec0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
lea rax, [0x7ff7f3cf7748]
mov rdi, qword [rsp + 0x18]
mov rsi, rax
mov ecx, 0x20
rep movsb byte [rdi], byte [rsi]
pop rdi
pop rsi
ret

Function at 0x7ff7f3c55ee0
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x7ff7f3d30410]
xor rax, rsp
mov qword [rsp + 0x40], rax
movabs rax, 0x6a09e667f3bcc908
mov qword [rsp], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rsp + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rsp + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rsp + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rsp + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rsp + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rsp + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rsp + 0x38], rax
lea rax, [rsp]
mov rdi, qword [rsp + 0x70]
mov rsi, rax
mov ecx, 0x40
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.7ff7f3c4ba40
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x1400045f0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x13c0]
mov eax, 0x14c0
call fcn.14000fb70
sub rsp, rax
mov r14d, edx
mov r15, rcx
mov rsi, qword [rbp + 0x1418]
xor r12d, r12d
mov word [rbp + 0x3c0], r12w
mov byte [rbp - 0x40], r12b
mov rbx, qword [rbp + 0x1420]
mov ecx, dword [rbx]
mov dword [rsp + 0x28], ecx
mov eax, dword [rbx + 4]
mov dword [rsp + 0x2c], eax
call fcn.140001840
mov edi, eax
mov dword [rsp + 0x20], 3
mov ecx, r12d
mov eax, 8
cmp byte [rbx + 8], cl
cmovne ecx, eax
mov dword [rsp + 0x24], ecx
mov ecx, 1
lock xadd dword [0x14004fb90], ecx
inc ecx
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x38], r12
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
mov dword [rsp + 0x40], eax
lea rax, str.C:_a_work1_s_toolsWebcamReportToolpackagesMicrosoft.Windows.ImplementationLibrary.1.0.220914.1includewil_resource.h
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], r14d
mov dword [rsp + 0x64], edi
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], r15
mov qword [rsp + 0x68], r12
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], rax
xorps xmm1, xmm1
movups xmmword [rsp + 0x70], xmm1
mov qword [rbp - 0x80], rax
mov rax, qword [0x14004fb80]
test rax, rax
je 0x1400046e3
call rax
mov qword [rbp - 0x60], rax
jmp 0x1400046e7
mov qword [rbp - 0x60], r12
mov rax, qword [0x14004fb00]
test rax, rax
je 0x1400046fa
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x14004fb30]
test rax, rax
je 0x140004717
mov r8d, 0x400
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x14004fb28]
test rax, rax
je 0x14000472a
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x14004fb58]
test rax, rax
je 0x140004744
test byte [rsp + 0x24], 2
jne 0x140004744
lea rcx, [rsp + 0x20]
call rax
cmp dword [rsp + 0x28], r12d
jl 0x140004761
mov dword [rsp + 0x28], 0x8000ffff
mov ecx, 0x8000ffff
call fcn.140001a00
mov dword [rsp + 0x2c], eax
cmp byte [0x14004fae8], r12b
jne 0x14000478f
mov rax, qword [0x14004fad8]
test rax, rax
je 0x14000477e
call rax
movzx r12d, al
jmp 0x14000478a
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
test eax, eax
setne r12b
test r12d, r12d
je 0x140004796
test byte [rsp + 0x24], 2
je 0x1400047b9
mov rax, qword [0x14004faf0]
test rax, rax
je 0x14000480f
cmp byte [0x14004fb10], 0
jne 0x14000480f
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x20]
call rax
jmp 0x14000480f
mov rax, qword [0x14004faf0]
test rax, rax
je 0x1400047e2
cmp byte [0x14004fb10], 0
jne 0x1400047e2
mov r8d, 0x800
lea rdx, [rbp + 0x3c0]
lea rcx, [rsp + 0x20]
call rax
cmp word [rbp + 0x3c0], 0
jne 0x140004802
lea r8, [rsp + 0x20]
mov edx, 0x800
lea rcx, [rbp + 0x3c0]
call fcn.140001350
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
test byte [rsp + 0x24], 4
jne 0x14000481f
cmp byte [0x14004faf8], 0
je 0x14000482e
mov rax, qword [0x14004fb40]
test rax, rax
je 0x14000482e
call rax
nop
lea rcx, [rsp + 0x20]
call fcn.140002d40
int3
Function at 0x140005b30
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [0x14004d080]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
lea rbx, [0x14004fc40]
mov eax, dword [rdx + rcx]
cmp dword [0x14004fd68], eax
jle 0x140005ca7
lea rcx, [0x14004fd68]
call fcn.14000f698
cmp dword [0x14004fd68], 0xffffffff
jne 0x140005ca7
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x60]
call fcn.1400117b0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x140005c82
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140005bd5
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.14000ce30
nop
mov r8d, 0x11
lea rdx, [0x140045b58]
lea rcx, [rsp + 0x38]
call fcn.14000af60
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rdx, qword [rsp + 0x38]
call fcn.140008e60
mov rax, qword [0x14004fc40]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rcx + rbx], rax
mov rax, qword [0x14004fc40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rcx + rbx - 4], edx
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140005c8e
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c7b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005cc3
call fcn.14000f4dc
jmp 0x140005c8e
lea rdx, str.WebcamReport.txt
call fcn.140008e60
lea rcx, [0x140036930]
call fcn.14000f4c4
nop
lea rcx, [0x14004fd68]
call fcn.14000f638
mov rax, rbx
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14000efd0
add rsp, 0x180
pop rbx
ret
call fcn.140015ad4
nop
int3
Function at 0x140008320
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140008351
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x1400083cb
mov rdi, r14
mov rcx, rbx
call fcn.14000add0
test rax, rax
jle 0x1400083a3
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.140011100
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1400083bb
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x1400083c3
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140008365
sub r14, rdi
jmp 0x1400084af
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x1400083e2
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400083e4
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140008416
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.140011100
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1400084ac
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140008451
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14000848d
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.14001bb50
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x1400084ac
cmp rbp, rax
ja 0x140008460
test rbp, rbp
je 0x1400084ac
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.14001bb50
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000fed4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test rax, rax
je 0x14000ff1e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000ff1e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000ff1e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000ff1e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000ff1e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000ff20
xor al, al
add rsp, 0x28
ret
Function at 0x1400268c8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x1400268fa
call fcn.140019fe0
mov dword [rax], 0x16
call fcn.140015ab4
jmp 0x140026a19
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140026a19
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x140026a19
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x140026929
lock or dword [rcx + 0x14], 0x10
jmp 0x140026a19
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14002693d
call fcn.140027ad4
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.140024fc8
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.140028b0c
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x140026a07
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x1400269d2
mov rcx, rsi
call fcn.140024fc8
cmp eax, edi
je 0x1400269bd
mov rcx, rsi
call fcn.140024fc8
cmp eax, 0xfffffffe
je 0x1400269bd
mov rcx, rsi
call fcn.140024fc8
movsxd rbx, eax
lea r14, [0x14004f3e0]
mov rcx, rsi
sar rbx, 6
call fcn.140024fc8
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x1400269c4
lea rdx, [0x14004d430]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400269d2
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x1400269f6
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x1400269f6
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x1400269f6
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x140026a1c
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x140027854
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.14000fb70
sub rsp, rax
mov rax, qword [0x14004d080]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.140024fc8
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x1400278a3
mov rax, rbp
jmp 0x1400279ab
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x4f3e0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.1400292e4
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x4f3e0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x1400279a7
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
test eax, eax
je 0x1400279a7
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.1400292e4
test rax, rax
js 0x1400279a7
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x1400279a7
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x140027999
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x140027999
cmp byte [rcx], 0xd
jne 0x14002797f
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x14002798e
cmp byte [rcx + 1], 0xa
jne 0x14002798e
inc rcx
jmp 0x14002798e
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x4d480]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x140027961
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x1400279ab
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14000efd0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret