joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180017018
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov dword [rsp + 0x20], r9d
push rsi
push rdi
push r14
sub rsp, 0x50
mov rbp, qword [rdx + 8]
lea rbx, [rcx + 0x40]
mov rax, qword [rsp + 0xa0]
mov rdi, rdx
mov qword [rcx + 0x70], rdx
mov r14, r8
xor edx, edx
mov dword [rcx + 8], 5
mov rsi, rcx
mov qword [rcx + 0x78], rax
mov rcx, rbx
lea r8d, [rdx + 0x20]
call fcn.180025ca4
and qword [rsp + 0x40], 0
lea r9, [rsp + 0x88]
mov eax, dword [rsp + 0x98]
mov r8d, 1
mov rcx, qword [rdi + 0x70]
mov rdx, r14
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASendTo]
test eax, eax
jne 0x18001713a
test dword [rdi + 0x58], 0x40000
je 0x18001714f
and qword [rsi + 0x60], 0
mov ecx, dword [rdi + 0x7c]
inc dword [rdi + 0x78]
mov rax, qword [rsi + 0x60]
add qword [rdi + 0x60], rax
inc qword [rdi + 0x68]
lea eax, [rcx + 1]
mov dword [rdi + 0x7c], eax
test ecx, ecx
jne 0x1800170f6
mov eax, dword [rdi + 0x58]
test al, 0x40
jne 0x1800170f6
or eax, 0x40
mov dword [rdi + 0x58], eax
test al, 0x20
je 0x1800170f6
mov rax, qword [rdi + 8]
inc dword [rax + 8]
lea rcx, [rsi + 0x10]
lea rax, [rbp + 0x20]
mov qword [rcx], rax
mov rax, qword [rbp + 0x28]
mov qword [rsi + 0x18], rax
mov qword [rax], rcx
mov qword [rbp + 0x28], rcx
and qword [rsi + 0x68], 0
mov rax, qword [rbp + 0x48]
test rax, rax
je 0x180017130
mov rax, qword [rax + 0x68]
mov qword [rsi + 0x68], rax
mov rax, qword [rbp + 0x48]
mov qword [rax + 0x68], rsi
jmp 0x180017134
mov qword [rsi + 0x68], rsi
mov qword [rbp + 0x48], rsi
jmp 0x1800171a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x18001714f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x1800171a6
mov eax, dword [r14]
mov qword [rsi + 0x60], rax
mov ecx, dword [rdi + 0x7c]
inc dword [rdi + 0x78]
mov rax, qword [rsi + 0x60]
add qword [rdi + 0x60], rax
inc qword [rdi + 0x68]
lea eax, [rcx + 1]
mov dword [rdi + 0x7c], eax
test ecx, ecx
jne 0x18001718a
mov eax, dword [rdi + 0x58]
test al, 0x40
jne 0x18001718a
or eax, 0x40
mov dword [rdi + 0x58], eax
test al, 0x20
je 0x18001718a
mov rax, qword [rdi + 8]
inc dword [rax + 8]
lea rcx, [rsi + 0x10]
lea rax, [rbp + 0x20]
mov qword [rcx], rax
mov rax, qword [rbp + 0x28]
mov qword [rsi + 0x18], rax
mov qword [rax], rcx
mov qword [rbp + 0x28], rcx
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x1800171bc
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov r9d, dword [rdx + 0x58]
xor r15d, r15d
mov eax, r9d
mov r14, r8
btr eax, 0x11
mov rbx, rdx
mov dword [rdx + 0x58], eax
mov rsi, rcx
mov r10d, dword [r8 + 0x40]
mov r11d, 0x80000
test r10d, r10d
jns 0x18001726a
mov ecx, r10d
call fcn.1800176c4
mov edi, eax
cmp eax, 0x2738
je 0x18001726a
lea ecx, [rax - 0x2744]
test ecx, 0xfffffffd
je 0x180017261
bt r9d, 8
jae 0x1800173ae
mov rcx, rbx
call fcn.180014478
test dword [rbx + 0x58], r11d
je 0x180017243
mov qword [rbp - 0x51], r15
lea rax, [rbp - 0x59]
mov dword [rbp - 0x59], r15d
jmp 0x18001724a
lea rax, [rbx + 0xf0]
movups xmm0, xmmword [rax]
mov ecx, edi
movdqu xmmword [rbp - 0x59], xmm0
call fcn.180012840
movsxd rdx, eax
jmp 0x180017399
test r11d, r9d
je 0x1800173ae
test r11d, r9d
jne 0x180017293
mov rdx, qword [r14 + 0x48]
lea r9, [rbx + 0x100]
sar r10d, 0x1f
lea r8, [rbx + 0xf0]
and r10d, 2
mov dword [rsp + 0x20], r10d
jmp 0x1800173a5
bt r9d, 8
jae 0x1800173ae
mov qword [rbp - 0x51], r15
lea r8, [rbp - 0x59]
mov dword [rbp - 0x59], r15d
mov edx, 0x10000
movaps xmm0, xmmword [rbp - 0x59]
mov rcx, rbx
movdqa xmmword [rbp - 0x59], xmm0
call qword [rbx + 0x190]
cmp qword [rbp - 0x51], r15
je 0x180017392
cmp dword [rbp - 0x59], r15d
je 0x180017392
mov edi, 0x80
lea rcx, [rbp - 0x49]
mov r8d, edi
xor edx, edx
call fcn.180025ca4
mov rcx, qword [rbx + 0x70]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x40], r15
lea r9, [rbp + 0x6f]
mov qword [rsp + 0x38], r15
lea r8d, [rdi - 0x7f]
mov qword [rsp + 0x30], rax
lea rdx, [rbp - 0x59]
lea rax, [rbp - 0x49]
mov dword [rbp + 0x77], edi
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x7f], r15d
call qword [sym.imp.WS2_32.dll_WSARecvFrom]
cmp eax, 0xffffffff
je 0x180017338
mov edx, dword [rbp + 0x6f]
lea r9, [rbp - 0x49]
jmp 0x18001739c
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r9d, eax
cmp eax, 0x2738
jne 0x180017359
mov edx, dword [rbp + 0x6f]
lea r9, [rbp - 0x49]
mov dword [rsp + 0x20], 2
jmp 0x1800173a1
cmp r9d, 0x2733
jne 0x180017366
xor edx, edx
jmp 0x180017399
add eax, 0xffffd8bc
mov rcx, rbx
test eax, 0xfffffffd
je 0x180017382
call fcn.180014478
mov ecx, r9d
jmp 0x180017254
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor edx, edx
lea r8, [rbp - 0x59]
jmp 0x1800173a8
mov rdx, 0xfffffffffffff024
xor r9d, r9d
mov dword [rsp + 0x20], r15d
lea r8, [rbp - 0x59]
mov rcx, rbx
call qword [rbx + 0x188]
mov ecx, dword [rbx + 0x58]
mov eax, ecx
and eax, 0x20100
cmp eax, 0x100
jne 0x1800173cd
mov rdx, rbx
mov rcx, rsi
call fcn.180016e2c
mov ecx, dword [rbx + 0x58]
mov eax, dword [rbx + 0x78]
dec eax
mov dword [rbx + 0x78], eax
test cl, 1
je 0x1800173f5
test eax, eax
jne 0x1800173f5
test cl, 8
jne 0x1800173f5
or ecx, 8
mov dword [rbx + 0x58], ecx
mov rax, qword [rsi + 0x50]
mov qword [rbx + 0x50], rax
mov qword [rsi + 0x50], rbx
mov rbx, qword [rsp + 0x110]
add rsp, 0xe0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800174dc
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x450
mov ecx, 0x202
lea rdx, [rsp + 0x2b0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
or edi, 0xffffffff
test eax, eax
je 0x180017510
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [0x180029080]
xor edx, edx
lea rcx, [0x180001a30]
call fcn.180014280
test eax, eax
je 0x180017531
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [0x1800290a0]
xor edx, edx
lea rcx, [0x1800033a0]
call fcn.1800142d8
test eax, eax
je 0x180017552
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r8d, r8d
lea esi, [r8 + 1]
mov edx, esi
lea ecx, [rsi + 1]
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800175d8
lea rax, [rsp + 0x460]
mov dword [rsp + 0x460], 0x274
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov r8d, 0x2005
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
jne 0x1800175b1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x1800290c0]
mov rcx, rbx
test dword [rsp + 0x30], 0x20000
cmove eax, esi
mov dword [0x1800290c0], eax
call qword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
jne 0x180017601
jmp 0x1800175f3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x273d
je 0x1800175f3
cmp eax, 0x273a
jbe 0x1800175f3
cmp eax, 0x2740
jb 0x180017601
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r8d, r8d
mov edx, esi
lea ecx, [r8 + 0x17]
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180017684
lea rax, [rsp + 0x460]
mov dword [rsp + 0x460], 0x274
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov r8d, 0x2005
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
jne 0x18001765d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x1800290bc]
mov rcx, rbx
test dword [rsp + 0x30], 0x20000
cmove eax, esi
mov dword [0x1800290bc], eax
call qword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
jne 0x1800176ad
jmp 0x18001769f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x273d
je 0x18001769f
cmp eax, 0x273a
jbe 0x18001769f
cmp eax, 0x2740
jb 0x1800176ad
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18001da08
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov esi, r8d
lea rcx, [0x180028680]
mov r12, rdx
mov r8d, 0x20
lea rdx, [0x1800286a0]
call fcn.180025c50
xor ebx, ebx
test eax, eax
je 0x18001dbcf
mov bpl, byte [rsp + 0x90]
mov r14b, bpl
and r14b, 0x10
je 0x18001da66
lea r15d, [rbx + 0x50]
jmp 0x18001da76
test bpl, 0x20
je 0x18001dbcf
mov r15d, 0x38
lea r13d, [r15 + rsi]
mov edx, r13d
test r13d, r13d
je 0x18001dba8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x18001dba8
mov r10, qword [rsp + 0x70]
lea r13, [rax + 0x18]
mov word [rax], 0x202
mov ebp, 4
lea r11, [r10 + 0x10a70]
test r11, r11
lea r9, [0x180028e20]
cmovne r9, r11
mov rcx, qword [r9]
mov rdx, qword [r9 + 8]
lea r8, [rdx + rcx]
xor rdx, rcx
ror rcx, 9
mov rax, rdx
shl rax, 0xe
xor rcx, rax
xor rcx, rdx
ror rdx, 0x1c
mov qword [r9 + 8], rdx
mov qword [r9], rcx
mov dword [r13], r8d
lea r13, [r13 + 4]
sub rbp, 1
jne 0x18001dab4
mov rax, qword [r10 + 0x10a80]
lea rcx, [rdi + 8]
mov qword [rdi + 0x28], rax
lea r9, [rdi + 0x18]
mov rax, qword [r12]
lea r8, [0x180028680]
inc qword [r10 + 0x10a80]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
mov rax, qword [0x180027080]
mov edx, r15d
add rdx, rdi
call qword [rax + 0x160]
mov bpl, byte [rsp + 0x90]
test bpl, 0x20
je 0x18001db70
call fcn.180012088
mov cl, byte [rax + rbx*4 + 1]
add cl, byte [rax + rbx*4]
xor cl, byte [rax + rbx*4 + 2]
rol cl, 3
xor cl, byte [rax + rbx*4 + 3]
mov byte [rbx + rdi + 0x30], cl
inc rbx
cmp rbx, 8
jl 0x18001db4f
jmp 0x18001db89
test r14b, r14b
je 0x18001db89
call fcn.180012088
movups xmm0, xmmword [rax]
movups xmmword [rdi + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x40], xmm1
mov rax, qword [rsp + 0x88]
mov rcx, qword [r12]
or byte [rax], bpl
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [r15 + rsi]
mov qword [r12], rdi
jmp 0x18001dbd1
lea rcx, [0x1800035b0]
call fcn.180004a90
test rax, rax
je 0x18001dbbd
lea rcx, [rax + 1]
lea r8, [0x180004200]
mov edx, 0xc9d
call qword [0x180029278]
mov eax, esi
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18001dbe8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov bl, r9b
mov r14d, edx
mov r12, rcx
call fcn.180012054
xor edi, edi
mov r13, rax
test rax, rax
je 0x18001dd90
mov bpl, bl
mov r15b, bl
and bpl, 0x20
and r15b, 0x10
je 0x18001dc37
lea eax, [rdi + 0x68]
jmp 0x18001dc45
test bpl, bpl
je 0x18001dd90
mov eax, 0x50
mov dword [rsp + 0x30], eax
add eax, r14d
mov dword [rsp + 0x34], eax
mov edx, eax
je 0x18001dd64
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x18001dd64
mov word [rax], 0x102
lea rcx, [rax + 8]
mov rax, qword [0x180027080]
lea rdx, [r13 + 0x40]
mov r9, qword [r12]
lea r8, [r13 + 0x20]
mov qword [rsp + 0x20], r14
call qword [rax + 0x100]
mov rax, qword [0x180027080]
lea rdx, [r13 + 0x20]
mov r8, qword [r12]
lea rcx, [rsi + 8]
mov r9, r14
call qword [rax + 0x108]
test eax, eax
je 0x18001dced
lea rcx, [0x1800035b0]
call fcn.180004a90
test rax, rax
je 0x18001dccd
call fcn.180004a90
lea rcx, [rax + 1]
lea r8, [0x180004268]
mov edx, 0xcdd
call qword [0x180029278]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x18001dd90
test bpl, bpl
je 0x18001dd17
lea rcx, [r13 + 0x22]
mov al, byte [rcx - 2]
add al, byte [rcx - 1]
xor al, byte [rcx]
lea rcx, [rcx + 4]
rol al, 3
xor al, byte [rcx - 3]
mov byte [rdi + rsi + 0x48], al
inc rdi
cmp rdi, 8
jl 0x18001dcf6
jmp 0x18001dd2e
test r15b, r15b
je 0x18001dd2e
movups xmm0, xmmword [r13 + 0x20]
movups xmmword [rsi + 0x48], xmm0
movups xmm1, xmmword [r13 + 0x30]
movups xmmword [rsi + 0x58], xmm1
mov ecx, dword [rsp + 0x30]
mov r8, r14
mov rdx, qword [r12]
add rcx, rsi
call fcn.180025c84
mov rax, qword [rsp + 0x90]
mov cl, byte [rsp + 0x98]
or byte [rax], cl
mov rcx, r12
call fcn.1800049a0
mov eax, dword [rsp + 0x34]
mov qword [r12], rsi
jmp 0x18001dd93
lea rcx, [0x1800035b0]
call fcn.180004a90
test rax, rax
je 0x18001dd7e
call fcn.180004a90
lea rcx, [rax + 1]
lea r8, [0x180004200]
mov edx, 0xcd4
call qword [0x180029278]
mov eax, r14d
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18001e550
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov ebx, edx
mov rsi, rcx
xor ecx, ecx
mov rbp, r8
lea rdx, [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
jne 0x18001e5b4
lea rcx, [0x1800043d0]
call fcn.180004a90
test rax, rax
je 0x18001e59e
call fcn.180004a90
lea rcx, [rax + 1]
lea r8, [0x180004200]
mov edx, 0x13b
call qword [0x180029278]
mov eax, ebx
jmp 0x18001e611
mov edx, 0x18
mov word [rax], 0x202
lea rcx, [rax + 0x18]
mov dword [rax + 4], ebx
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
mov rax, qword [rsi]
lea rdx, [rdi + 0x30]
mov r10, qword [0x180027080]
lea rcx, [rdi + 8]
mov qword [rsp + 0x28], rbx
lea r9, [rdi + 0x18]
lea r8, [0x1800012b8]
mov qword [rsp + 0x20], rax
call qword [r10 + 0x160]
cmp qword [rsi], 0
je 0x18001e607
mov rcx, rsi
call fcn.1800049a0
mov qword [rsi], rdi
lea eax, [rbx + 0x30]
or byte [rbp], 4
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x180022dd0
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r8, qword [rcx + 0x18]
lea rdi, [rcx + 0x10]
lea rsi, [rcx + 0x20]
mov rbx, rcx
mov rdx, rdi
mov rcx, rsi
call fcn.1800227b4
movzx ecx, word [rsi]
xor r11d, r11d
test eax, eax
je 0x180022f5e
lea r10d, [r11 + 0x30]
cmp cx, r10w
je 0x180022f53
cmp cx, 0x42
je 0x180022f4c
cmp cx, 0x44
je 0x180022f22
cmp cx, 0x53
je 0x180022f10
cmp cx, 0x57
je 0x180022efe
cmp cx, 0x62
je 0x180022ef4
cmp cx, 0x64
je 0x180022ed9
cmp cx, 0x73
je 0x180022eba
cmp cx, 0x77
je 0x180022ea8
sub cx, r10w
cmp cx, 9
ja 0x180022f9d
mov rdx, qword [rdi]
mov word [rsi], cx
movsx eax, byte [rdx]
movzx r8d, ax
sub al, r10b
cmp al, 9
ja 0x180022e9e
movzx eax, cx
shl cx, 2
add ax, cx
add ax, ax
add ax, r8w
sub ax, r10w
mov word [rsi], ax
lea rax, [rdx + 1]
mov qword [rdi], rax
mov eax, 0x106
jmp 0x180022fa2
mov rcx, rbx
call fcn.180022870
mov rcx, rbx
call fcn.180022958
jmp 0x180022eca
mov rcx, rbx
call fcn.180022870
mov rcx, rbx
call fcn.1800228ec
cmp byte [rbx], r11b
jne 0x180022f40
mov eax, 0x107
jmp 0x180022fa2
mov rcx, rbx
call fcn.180022870
mov r8d, 0x39
mov edx, r10d
mov rcx, rbx
call fcn.1800228ac
jmp 0x180022eca
mov eax, 0x109
jmp 0x180022fa2
mov rcx, rbx
call fcn.180022870
mov rcx, rbx
call fcn.180022958
jmp 0x180022f3b
mov rcx, rbx
call fcn.180022870
mov rcx, rbx
call fcn.1800228ec
jmp 0x180022f3b
mov rcx, rbx
call fcn.180022870
mov r8d, 0x39
mov edx, r10d
mov rcx, rbx
call fcn.1800228ac
cmp byte [rbx], r11b
je 0x180022f45
or eax, 0xffffffff
jmp 0x180022fa2
mov eax, 0x108
jmp 0x180022fa2
mov eax, 0x10a
jmp 0x180022fa2
mov word [rsi], r11w
mov eax, 0x102
jmp 0x180022fa2
cmp dword [rbx + 8], r11d
je 0x180023016
movzx edx, cx
cmp edx, 0x3f
ja 0x180022fe8
je 0x180023008
test edx, edx
je 0x18002301b
cmp edx, 0x24
je 0x180023008
mov eax, 0x28
cmp edx, eax
je 0x180022fb2
lea eax, [rdx - 0x29]
cmp eax, 2
jbe 0x180023008
cmp edx, 0x2e
je 0x180023008
mov eax, 0x100
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rdi]
cmp byte [rcx], 0x3f
jne 0x180022fa2
cmp byte [rcx + 1], 0x21
je 0x180022fda
cmp byte [rcx + 1], 0x3a
je 0x180022fd3
cmp byte [rcx + 1], 0x3d
jne 0x180022fa2
mov eax, 0x103
jmp 0x180022fdf
mov eax, 0x104
jmp 0x180022fdf
mov eax, 0x105
add rcx, 2
mov qword [rdi], rcx
jmp 0x180022fa2
mov ecx, edx
sub ecx, 0x5b
je 0x18002300c
sub ecx, 3
je 0x180023008
sub ecx, 0x1d
je 0x180022ffe
cmp ecx, 1
jmp 0x180022f9b
mov rcx, rbx
call fcn.1800229a0
jmp 0x180022fa2
mov eax, edx
jmp 0x180022fa2
mov rcx, rbx
call fcn.180022abc
jmp 0x180022fa2
test cx, cx
jne 0x180022f9d
xor eax, eax
jmp 0x180022fa2
Function at 0x140001000
Capabilities:
Execute command
Set console window title

Disassembly:
sub rsp, 0x28
lea rcx, str.zen_bot
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rcx, str.color_4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n_n_n_______________________________________n___________________________________n___________________________________n_____________________________n_______________________________n_________________.____________n___n
call fcn.1400010f0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._________welcome_to_zen_bot
call fcn.1400010f0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400033f4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n_n_n_______________________________________n___________________________________n___________________________________n_____________________________n_______________________________n_________________.____________n___n
call fcn.1400010f0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.______1__viewbot
call fcn.1400010f0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.______2__discord_n_n
call fcn.1400010f0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.________choose:
call fcn.1400010f0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea rdx, [0x140005628]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
lea rcx, str.start_https:__freer.in_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_https:__dsc.gg_zensdiscord
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x28
ret

Function at 0x140001c1c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001c66
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001c66
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001c66
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001c66
cmp dword [rcx + 0x84], 0xe
jbe 0x140001c66
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001c68
xor al, al
add rsp, 0x28
ret
Function at 0x140008188
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x14000d868], rdi
je 0x1400081e8
cmp rax, rdi
jne 0x1400081db
mov r12d, 1
jmp 0x1400081e8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400081c1
mov eax, dword [0x14000d860]
cmp eax, 1
jne 0x1400081fd
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x140008264
mov eax, dword [0x14000d860]
cmp eax, ebx
jne 0x14000825a
mov dword [0x14000d860], 1
lea r13, [0x140001548]
lea rdi, [0x140001530]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x14000824c
cmp eax, ebx
jne 0x14000824c
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x140008241
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000822a
cmp eax, ebx
je 0x140008264
mov eax, 0xff
jmp 0x1400083ac
mov dword [0x14000b554], 1
mov eax, dword [0x14000d860]
cmp eax, 1
jne 0x14000828c
lea rdx, [0x140001528]
lea rcx, [0x1400014b8]
call sub.msvcrt.dll__initterm
mov dword [0x14000d860], 2
cmp r12d, ebx
jne 0x14000829b
mov rax, rbx
xchg qword [0x14000d868], rax
cmp qword [0x14000d870], rbx
je 0x1400082c3
lea rcx, [0x14000d870]
call fcn.14000862c
cmp eax, ebx
je 0x1400082c3
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x14000d870]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x1400082d9
mov eax, 0xff
jmp 0x1400083ac
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x14000835e
cmp word [rcx], bx
je 0x1400082f4
cmp edx, ebx
jne 0x14000835e
cmp word [rcx], bx
je 0x14000830a
cmp word [rcx], 0x20
ja 0x14000830a
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400082f4
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140003b3c
mov dword [0x14000b550], eax
cmp dword [0x14000b534], ebx
jne 0x140008348
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000b554], ebx
jne 0x14000835c
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000b550]
jmp 0x1400083ac
cmp word [rcx], 0x22
jne 0x140008371
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400082e5
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call fcn.14015a000
add rsp, 0x28
jmp 0x140008188