joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014b20
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x14009b080]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, r9
mov r9, r8
mov r15, rdx
mov rsi, rcx
mov qword [rsp + 0x20], rcx
movzx edx, byte [r8]
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs rcx, 0x100000001b3
imul rdx, rcx
movzx eax, byte [r8 + 1]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [r8 + 2]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [r8 + 3]
xor rdx, rax
imul rdx, rcx
mov r8, qword [rsi + 0x30]
and r8, rdx
add r8, r8
mov rcx, qword [rsi + 0x18]
mov rbx, qword [rsi + 8]
mov rax, qword [rcx + r8*8]
cmp rbx, rax
je 0x140014c07
mov rbx, qword [rcx + r8*8 + 8]
mov rbx, qword [rbx]
nop dword [rax + rax]
cmp rbx, rax
je 0x140014c07
mov rbx, qword [rbx + 8]
mov ecx, dword [rbx + 0x10]
cmp dword [r9], ecx
jne 0x140014bc0
mov rdx, qword [rdi + 8]
mov rcx, qword [rdi]
mov qword [rdx], rcx
mov rdx, qword [rdi]
mov rcx, qword [rdi + 8]
mov qword [rdx + 8], rcx
dec qword [rsi + 0x10]
mov edx, 0x28
mov rcx, rdi
call fcn.1400187f4
mov qword [r15], rbx
mov byte [r15 + 8], 0
mov rax, r15
jmp 0x140014d2d
mov qword [rsp + 0x40], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x140014c41
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x140014c5e
mov qword [rdx + r8*8], rdi
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rdi
jmp 0x140014c8d
cmp rax, rbx
jne 0x140014c69
mov qword [rdx + r8*8], rdi
jmp 0x140014c8d
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rdi
je 0x140014c8d
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x1400946ec]
test rax, rax
jns 0x140014cae
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x140014cbf
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x140014d22
cmp rdx, 0x200
jae 0x140014cdb
lea rdx, [rdx*8]
jmp 0x140014ced
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x140014ced
add rdx, rdx
mov rcx, rsi
call fcn.1400096b0
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x140014d22
mov r14, qword [rax + 8]
mov rbx, qword [rsi + 8]
mov rbx, qword [rbx]
lea r8, [rbx + 0x10]
mov r9, rbx
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140014b20
cmp rbx, r14
jne 0x140014d02
mov qword [r15], rdi
mov byte [r15 + 8], 1
mov rax, r15
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400187d0
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140014d80
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov r9, rcx
movzx edx, byte [r8 + 0x10]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movzx eax, byte [r8 + 0x11]
mov r10, qword [r9 + 0x30]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0x12]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0x13]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [r9 + 0x18]
and r10, rdx
shl r10, 4
add rcx, r10
mov rax, qword [rcx]
cmp qword [rcx + 8], r8
jne 0x140014e14
cmp rax, r8
jne 0x140014e0a
mov rax, qword [r9 + 8]
mov qword [rcx], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
mov qword [r10 + rcx + 8], rax
jmp 0x140014e1f
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
jmp 0x140014e1f
cmp rax, r8
jne 0x140014e1f
mov rax, qword [r8]
mov qword [rcx], rax
mov rcx, qword [r8 + 8]
mov rbx, qword [r8]
mov qword [rcx], rbx
mov rdx, qword [r8]
mov rcx, qword [r8 + 8]
mov qword [rdx + 8], rcx
mov edx, 0x28
dec qword [r9 + 0x10]
mov rcx, r8
call fcn.1400187f4
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140015700
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [r8 + 0x28], 0x10
lea r9, [r8 + 0x10]
mov r10, qword [r9 + 0x10]
mov rbx, rdx
mov r11, rcx
jb 0x14001571e
mov r9, qword [r9]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
test r10, r10
je 0x140015759
mov qword [rsp + 0x40], rdi
movabs rdi, 0x100000001b3
nop
movzx eax, byte [rcx + r9]
inc rcx
xor rdx, rax
imul rdx, rdi
cmp rcx, r10
jb 0x140015740
mov rdi, qword [rsp + 0x40]
mov r9, qword [r11 + 0x30]
and r9, rdx
mov rdx, qword [r11 + 0x18]
shl r9, 4
add rdx, r9
mov rax, qword [rdx]
cmp qword [rdx + 8], r8
jne 0x140015799
cmp rax, r8
jne 0x14001578f
mov rax, qword [r11 + 8]
mov qword [rdx], rax
mov rcx, qword [r11 + 0x18]
mov rax, qword [r11 + 8]
mov qword [r9 + rcx + 8], rax
jmp 0x1400157a4
mov rax, qword [r8 + 8]
mov qword [rdx + 8], rax
jmp 0x1400157a4
cmp rax, r8
jne 0x1400157a4
mov rcx, qword [r8]
mov qword [rdx], rcx
lea rcx, [r11 + 8]
mov rdx, rbx
call fcn.1400155f0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x140017000
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x36
syscall
ret
Function at 0x1400227bc
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400227dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140024bd8
or eax, 0xffffffff
jmp 0x1400227de
xor eax, eax
add rsp, 0x28
ret

Function at 0x140027e14
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140027c40
Function at 0x14016c874
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
test r10, r10
jmp 0x14016cf1f
mov word [rsp + 0xd], 0x10a5
lea rsp, [rsp + 0x10]
je 0x14016cf95
mov r9d, 0xa4000904
lea rcx, [0x140145a50]
mov r9d, 0x311f4237
sal r9b, 0xa2
not r9
movzx r9d, byte [r9 + r11 + 0x311f42dd]
xor r9d, edx
push 0xffffffffe719e292
rol dword [rsp + 3], 0xf1
and r9d, 0xff
shr dword [rsp], 0x83
mov r9d, dword [rcx + r9*4]
adc qword [rsp], 0xffffffff8b041ebc
shr edx, 8
xor edx, r9d
inc r11
xor edx, 0x2a2a6c8f
dec r10
lea rsp, [rsp + 8]
jne 0x14016cf3e
jmp 0x140167831
Function at 0x140002c30
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0xb8
mov ecx, 4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140002dfa
mov rdx, qword [0x140034a40]
lea r8, [rsp + 0x50]
mov rcx, qword [0x140034a00]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm7
add rdx, 0x308
xorps xmm7, xmm7
movaps xmmword [rsp + 0x70], xmm9
mov r9d, 0x18
movsd qword [rsp + 0x60], xmm7
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movsd xmm9, qword [0x140034218]
ucomisd xmm9, xmm7
jp 0x140002caf
je 0x140002dec
movaps xmmword [rsp + 0x80], xmm8
movsd xmm8, qword [0x140034220]
ucomisd xmm8, xmm7
jp 0x140002cce
je 0x140002de3
movaps xmmword [rsp + 0xa0], xmm6
movsd xmm6, qword [0x140034228]
ucomisd xmm6, xmm7
jp 0x140002cea
je 0x140002ddb
subsd xmm9, qword [0x140034990]
subsd xmm8, qword [0x140034998]
subsd xmm6, qword [0x1400349a0]
movaps xmm0, xmm9
mulsd xmm0, xmm9
movaps xmm2, xmm8
mulsd xmm2, xmm8
movaps xmm1, xmm6
mulsd xmm1, xmm6
addsd xmm2, xmm0
xorps xmm0, xmm0
addsd xmm2, xmm1
ucomisd xmm0, xmm2
ja 0x140002d34
sqrtpd xmm0, xmm2
jmp 0x140002d3c
movaps xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrt
cvtsd2ss xmm0, xmm0
xorps xmm2, xmm2
cvtss2sd xmm2, xmm0
divsd xmm6, xmm2
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_asin
xorps xmm2, xmm2
movaps xmm1, xmm9
cvtsd2ss xmm2, xmm0
movaps xmm0, xmm8
cvtps2pd xmm3, xmm2
mulsd xmm3, qword [0x14002e748]
cvtpd2ps xmm2, xmm3
subss xmm2, dword [0x14002e71c]
cvtps2pd xmm2, xmm2
movsd qword [rsp + 0x30], xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll_atan2
mov rdx, qword [0x140034a40]
lea r8, [rsp + 0x30]
mov rcx, qword [0x140034a00]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
add rdx, 0x308
mov r9d, 0x18
mov qword [rsp + 0x20], 0
movsd qword [rsp + 0x40], xmm7
cvtps2pd xmm2, xmm1
mulsd xmm2, qword [0x14002e748]
cvtpd2ps xmm0, xmm2
cvtps2pd xmm1, xmm0
movsd qword [rsp + 0x38], xmm1
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movaps xmm6, xmmword [rsp + 0xa0]
movaps xmm8, xmmword [rsp + 0x80]
movaps xmm7, xmmword [rsp + 0x90]
movaps xmm9, xmmword [rsp + 0x70]
add rsp, 0xb8
ret
Function at 0x140007180
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rdi
cmp dword [0x140034a64], 0
lea rdi, [0x140034a60]
mov r11d, r8d
mov r9d, edx
mov r10, rcx
jne 0x140007258
mov qword [rsp + 0x10], rbx
xor edx, edx
mov rbx, rdi
nop dword [rax]
mov r8d, edx
lea rbx, [rbx + 4]
and r8d, 1
mov eax, edx
shr eax, 1
neg r8d
and r8d, 0xedb88320
inc edx
xor r8d, eax
mov eax, r8d
shr r8d, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, r8d
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rbx - 4], eax
cmp edx, 0x100
jb 0x1400071b0
mov rbx, qword [rsp + 0x10]
not r11d
mov eax, r11d
test r9d, r9d
jle 0x14000728e
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
movzx edx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [rdi + rdx*4]
sub r9d, 1
jne 0x140007270
not eax
pop rdi
ret
movzx r9d, byte [r10]
lea r8, [r10 + 1]
test r9b, r9b
je 0x1400072cf
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x1400072b3
cmp byte [r8], r9b
jne 0x1400072b3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rdi + rdx*4]
test r9b, r9b
jne 0x1400072a0
not eax
pop rdi
ret
Function at 0x1400074d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
test r8, r8
je 0x1400074e9
mov qword [r8], 0
lea rdx, [0x14002a9a0]
call fcn.1400072e0
mov rbx, rax
test rax, rax
jne 0x140007508
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
xor edx, edx
mov r8d, 2
mov qword [rsp + 0x38], rsi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400075ca
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x1400075ca
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400075ca
mov rax, qword [0x140034988]
mov rbp, rsi
test rax, rax
je 0x140007567
inc dword [rax + 0x3c8]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x1400075ca
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rbp
je 0x1400075b7
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140034988]
test rax, rax
je 0x1400075ac
dec dword [rax + 0x3c8]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400075d3
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x1400075c5
mov qword [rdi], rbp
mov rax, rsi
jmp 0x1400075d5
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400151b0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x20
mov rdi, qword [0x140034988]
xor esi, esi
mov r15, rcx
mov dword [rdi + 0x2d9c], esi
test rcx, rcx
je 0x1400152ca
mov qword [rsp + 0x40], rbx
lea rbx, [rdi + 0x2da0]
mov dword [rdi + 0x2d9c], esi
mov ecx, dword [rbx + 4]
mov qword [rsp + 0x48], rbp
test ecx, ecx
jns 0x14001520a
mov eax, ecx
cdq
sub eax, edx
mov edx, esi
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.140016080
mov dword [rbx], esi
cmp dword [rbx + 4], esi
jne 0x14001521e
mov edx, 8
mov rcx, rbx
call fcn.140016080
movsxd rcx, dword [rbx]
mov ebp, esi
mov rax, qword [rbx + 8]
mov byte [rcx + rax], sil
inc dword [rbx]
cmp dword [rdi + 0x2db0], esi
jle 0x14001526a
mov qword [rsp + 0x50], r14
mov r14, rsi
nop dword [rax]
mov r9, qword [rdi + 0x2db8]
mov r8, rbx
add r9, r14
mov rcx, rdi
mov rdx, r9
call qword [r9 + 0x20]
inc ebp
add r14, 0x30
cmp ebp, dword [rdi + 0x2db0]
jl 0x140015240
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
cmp qword [rbx + 8], rsi
je 0x140015279
mov esi, dword [rbx]
dec esi
mov rax, qword [rdi + 0x2da8]
lea rdx, [0x14002a9a4]
test rax, rax
movsxd rsi, esi
lea rdi, [0x140034928]
mov rcx, r15
cmovne rdi, rax
call fcn.1400072e0
mov rbx, rax
test rax, rax
je 0x1400152c5
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
Function at 0x14001d020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
push r13
push r14
sub rsp, 0xb8
mov r13, rcx
movsxd rax, r9d
xor ecx, ecx
mov qword [rsp + 0x60], rax
mov dword [rsp + 0xe8], ecx
mov r14, rdx
test r9d, r9d
jle 0x14001d282
mov qword [r11 + 8], rbx
lea rbx, [r8 + 0x20]
mov qword [r11 + 0x10], rbp
movzx ebp, byte [r13 + 0x24]
mov qword [r11 + 0x18], rsi
mov qword [r11 - 0x18], rdi
mov edi, pe_nt_image_headers64
mov qword [r11 - 0x20], r12
xor r12d, r12d
mov qword [r11 - 0x28], r15
movaps xmmword [r11 - 0x38], xmm6
movaps xmmword [r11 - 0x48], xmm7
xorps xmm7, xmm7
movaps xmmword [r11 - 0x58], xmm8
movzx r11d, byte [r13 + 0x20]
movss xmm8, dword [0x14002eba0]
nop word [rax + rax]
movss xmm6, dword [rbx - 0x20]
comiss xmm6, xmm7
jbe 0x14001d0ea
movsxd r10, dword [r14 + 0x24]
mov r9, qword [r14 + 8]
movsx ecx, di
movzx eax, byte [r10 + r9 + 7]
movzx edx, byte [r10 + r9 + 6]
imul edx, ecx
movsx ecx, di
add dx, ax
movzx eax, byte [r10 + r9 + 5]
movsx r8d, dx
movzx edx, byte [r10 + r9 + 4]
imul edx, ecx
add ax, dx
cwde
sub eax, r8d
movd xmm0, eax
jmp 0x14001d109
movsxd rdx, dword [r14 + 0x1c]
xorps xmm6, xmm8
mov rax, qword [r14 + 8]
movzx ecx, byte [rdx + rax + 0x12]
movzx eax, byte [rdx + rax + 0x13]
shl ecx, 8
add ecx, eax
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
xor edi, edi
mov byte [rbx], r11b
mov byte [rbx + 1], bpl
divss xmm6, xmm0
cmp dword [rbx - 0x10], edi
jle 0x14001d220
mov r15, qword [rsp + 0xf0]
mov rax, r12
shl rax, 4
add r15, 6
xor esi, esi
add r15, rax
nop word [rax + rax]
mov rax, qword [rbx - 0x18]
test rax, rax
jne 0x14001d150
mov edx, dword [rbx - 0x1c]
add edx, edi
jmp 0x14001d153
mov edx, dword [rax + rsi]
mov eax, dword [r13 + 0x24]
xorps xmm3, xmm3
xorps xmm2, xmm2
mov rcx, r14
cvtsi2ss xmm3, rax
mov eax, dword [r13 + 0x20]
cvtsi2ss xmm2, rax
mulss xmm3, xmm6
mulss xmm2, xmm6
call fcn.140018350
mov edx, eax
mov rcx, r14
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
movss dword [rsp + 0x28], xmm7
movss dword [rsp + 0x20], xmm7
call fcn.14001ac80
movzx ecx, word [r13 + 0x1c]
inc r12
movzx r11d, word [r13 + 0x20]
movzx eax, cx
sub ax, word [rsp + 0x50]
dec cx
movzx ebp, word [r13 + 0x24]
dec ax
add ax, r11w
inc edi
add ax, word [rsp + 0x54]
add rsi, 4
mov word [r15 - 2], ax
movzx eax, bp
sub ax, word [rsp + 0x58]
add ax, cx
mov ecx, dword [rsp + 0xe8]
add ax, word [rsp + 0x5c]
inc ecx
mov word [r15], ax
add r15, 0x10
mov dword [rsp + 0xe8], ecx
cmp edi, dword [rbx - 0x10]
jl 0x14001d140
jmp 0x14001d227
mov ecx, dword [rsp + 0xe8]
add rbx, 0x28
mov edi, pe_nt_image_headers64
sub qword [rsp + 0x60], 1
jne 0x14001d0a0
movaps xmm8, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x90]
mov r15, qword [rsp + 0xa0]
mov r12, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0xd0]
mov eax, ecx
add rsp, 0xb8
pop r14
pop r13
ret
Function at 0x1400209e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x140020b99
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov esi, r9d
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x140020a76
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.140020350
mov r8d, dword [rbx + 0x80]
mov r9d, esi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.14001f960
mov ecx, dword [rbx + 0x84]
test ecx, ecx
jns 0x140020a67
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [rbx + 0x80]
test eax, eax
cmovg edx, eax
call fcn.140015d00
mov dword [rbx + 0x80], 0
jmp 0x140020b85
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
mov r8d, 4
call fcn.14001e840
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rdi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rdi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], esi
movsd xmm0, qword [rdi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], esi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140028588
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400285d2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400285d2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400285d2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400285d2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400285d2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400285d4
xor al, al
add rsp, 0x28
ret
Function at 0x1400035a0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, 0xffff
movzx edi, dx
mov rbx, rcx
cmp si, dx
jne 0x1400035d1
xor eax, eax
jmp 0x14000371b
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x14000360e
mov r9, qword [rcx + 0x58]
movsxd r10, dword [r9]
lea rdx, [r8 + r10*2]
cmp r8, rdx
jae 0x14000360e
lea ecx, [r10 - 1]
movzx eax, di
mov dword [r9], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], di
jmp 0x14000371b
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x140003710
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140003655
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140003663
movzx ecx, di
jmp 0x1400036b7
lea rax, [rsp + 0x40]
mov word [rsp + 0x50], di
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x52]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400036d0
sub eax, 1
je 0x1400036d0
cmp eax, 2
jne 0x140003710
movzx ecx, word [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
cmp ax, si
cmove di, si
movzx eax, di
jmp 0x140003713
mov rbp, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x1400036fe
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbp, rax
jne 0x140003710
lea rax, [rsp + 0x50]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x48], rax
cmovne si, di
movzx eax, si
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140004490
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x140003a20
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140003af5
cmp byte [rcx + 0x72], 0
je 0x140003af5
mov rax, qword [rcx]
mov qword [rsp + 0x78], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x140003af1
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003ab6
sub eax, 1
je 0x140003aba
cmp eax, 2
jne 0x140003af1
mov byte [rbx + 0x72], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004490
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140003ae8
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140003af1
cmp byte [rbx + 0x72], 0
sete al
jmp 0x140003a9e
xor al, al
jmp 0x140003a9e
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004490
add rsp, 0x60
pop rbx
ret

Function at 0x140004e10
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004e5a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004e5a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004e5a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004e5a
cmp dword [rcx + 0x84], 0xe
jbe 0x140004e5a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004e5c
xor al, al
add rsp, 0x28
ret
Function at 0x14000246c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400024b6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400024b6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400024b6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400024b6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400024b6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400024b8
xor al, al
add rsp, 0x28
ret

Function at 0x14000b7e4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000b5d4