joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140016950
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x98
movabs rax, 0x6c6320726f727245
movabs rdx, 0x7520676e696e6165
mov qword [rsp + 0x20], rax
movabs rax, 0x6b5f6e6970732070
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20726f6620737965
mov qword [rsp + 0x30], rax
movabs rax, 0x20646165726874
mov qword [rsp + 0x38], rdx
xor edx, edx
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov word [rsp + 0x88], ax
mov byte [rsp + 0x8a], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x47]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x140016a62
mov eax, 0x28
lea rcx, [rsp + 0x20]
jmp 0x140016a3a
add rax, 1
cmp rax, 0x6b
je 0x140016a57
cmp byte [rcx + rax], 0
movsxd rdx, eax
jne 0x140016a30
cmp edx, 0x6a
je 0x140016a57
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rdx + 0x20], 0xa
mov byte [rsp + rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov eax, 0x28
mov edx, 0x27
lea rcx, [rsp + 0x20]
jmp 0x140016a4b
Function at 0x140016fe0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push r13
push r12
push rbx
sub rsp, 0x48
cmp dword [0x140179dc0], 1
je 0x14001708b
lea r13, [0x140133400]
lea rbx, [0x140179dc0]
mov rcx, r13
call fcn.1400168e0
mov r12, qword [0x140179d70]
test r12, r12
jne 0x140017031
jmp 0x140017225
mov rax, qword [r12 + 0x18]
test rax, rax
je 0x1400171f0
mov r12, rax
cmp qword [r12], rbx
jne 0x140017020
add dword [r12 + 0x10], 1
lea r14, [r12 + 8]
mov rcx, r13
call fcn.140016920
mov rcx, r14
call fcn.140016260
mov ebx, dword [0x140179dc0]
test ebx, ebx
jne 0x1400170b0
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140133418], eax
cmp eax, 0xffffffff
je 0x140132e40
mov dword [0x140179dc0], 1
mov rcx, r14
call fcn.140016580
mov rcx, r12
call fcn.140016a80
mov ecx, dword [0x140133418]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x1400170e0
mov rax, r12
add rsp, 0x48
pop rbx
pop r12
pop r13
pop r14
ret
cmp ebx, 1
je 0x14001707b
mov ecx, 2
call qword [fcn.1400145c0]
mov r9d, ebx
lea r8, [0x140179dc0]
lea rdx, str._once__p_is__d_n
mov rcx, rax
call sub.msvcrt.dll_fprintf
jmp 0x14001707b
call fcn.140016f10
cmp qword [0x14017d050], 0
mov rbx, rax
je 0x14001709f
test rax, rax
je 0x14001709f
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rbx + 0x70], eax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x38], 0xffffffffffffffff
lea rcx, [rbx + 0x68]
mov qword [rbx + 0x30], rax
call fcn.1400168d0
cmp eax, 1
je 0x14001724a
mov r14, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x68], 0xffffffffffffffff
mov dword [rbx + 0xb8], 0
mov qword [rbx + 0x28], 0
call r14
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r12, rax
call r14
lea r9, [rbx + 0x28]
mov r8, r13
mov rdx, r12
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x140132e40
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov ecx, dword [0x140133418]
mov rdx, rbx
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0xc0], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140132e40
mov r12, rbx
mov rax, r12
add rsp, 0x48
pop rbx
pop r12
pop r13
pop r14
ret
mov edx, 0x20
mov ecx, 1
call sub.msvcrt.dll_calloc
mov qword [rax], rbx
mov dword [rax + 0x10], 1
mov qword [r12 + 0x18], rax
mov r12, rax
lea r14, [r12 + 8]
xor edx, edx
mov rcx, r14
call fcn.140016700
jmp 0x140017042
mov edx, 0x20
mov ecx, 1
call sub.msvcrt.dll_calloc
mov qword [rax], rbx
mov r12, rax
mov dword [rax + 0x10], 1
mov qword [0x140179d70], rax
jmp 0x140017211
call fcn.140016950
nop
Function at 0x140018ff0
Capabilities:
Create thread
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
mov rbp, r9
call fcn.140016f10
mov r12, rax
test rax, rax
je 0x140019251
test rdi, rdi
je 0x14001902a
mov rax, qword [rax + 0x1d8]
mov qword [rdi], rax
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [r12 + 8], rbp
mov dword [r12 + 0x44], 1
mov rbp, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [r12 + 0xbc], 0
mov r14, r13
mov qword [r12 + 0x28], 0xffffffffffffffff
mov qword [r12 + 0x10], rbx
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call rbp
mov qword [r12 + 0x30], rax
test rax, rax
jne 0x140019097
add ebx, 1
cmp ebx, 1
je 0x1400191a0
mov ecx, 0x14
call r14
cmp ebx, 5
jne 0x140019065
mov qword [r12 + 0x38], 0xffffffffffffffff
lea r14, [r12 + 0x68]
mov rcx, r14
call fcn.1400168d0
cmp eax, 1
je 0x14001929a
cmp qword [r12 + 0x30], 0
mov qword [r12 + 0x68], 0xffffffffffffffff
mov dword [r12], 0xbab1f00d
mov dword [r12 + 0xc0], 0
mov dword [r12 + 0xb8], 0
je 0x14001923a
xor edx, edx
test rsi, rsi
je 0x14001910f
mov eax, dword [rsi]
mov edx, dword [rsi + 0x10]
mov dword [r12 + 0x44], eax
test al, 8
jne 0x140019268
mov eax, dword [rsi + 0x18]
mov dword [r12 + 0xc0], eax
lea r8, [0x140017400]
mov r9, r12
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov r13, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140019200
mov eax, dword [r12 + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jge 0x1400191d0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [r12 + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [r12 + 0x44], 4
jne 0x1400191b0
mov qword [r12 + 0x28], r13
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor ecx, ecx
call r13
jmp 0x140019065
mov qword [r12 + 0x28], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001917f
mov edx, 0xfffffffe
cmp eax, 0xffffffff
jl 0x140019155
mov edx, 2
cmp eax, edx
cmovle edx, eax
cmp eax, 0xf
mov eax, 0xf
cmovge edx, eax
jmp 0x140019155
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x140019210
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [r12 + 0x38]
call fcn.140016750
mov rcx, r14
call fcn.1400168d0
cmp eax, 1
je 0x14001929a
mov qword [r12 + 0x68], 0xffffffffffffffff
pxor xmm0, xmm0
movups xmmword [r12 + 0x28], xmm0
test rdi, rdi
je 0x140019246
mov qword [rdi], 0
cmp qword [r12 + 0x1d0], 0
je 0x140019290
mov eax, 0xb
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov dword [rsp + 0x3c], edx
call fcn.140016fe0
mov edx, dword [rsp + 0x3c]
mov eax, dword [rax + 0xc0]
mov dword [r12 + 0xc0], eax
jmp 0x14001910f
mov rcx, r12
call fcn.140016b80
jmp 0x140019251
call fcn.140016950
nop
Function at 0x14001ee30
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
mov rax, qword [rbp + 0x38]
mov r8, rax
mov edx, 0
mov rcx, qword [rbp + 0x20]
call fcn.14001f0a0
mov rax, qword [rbp + 0x30]
mov ecx, eax
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
mov rdx, qword [rbp + 0x28]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WSOCK32.dll_recv]
call rax
mov dword [rbp - 4], eax
jmp 0x14001eeb5
mov rax, qword [rbp + 0x30]
mov ecx, eax
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
mov rdx, qword [rbp + 0x28]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WSOCK32.dll_recv]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0xffffffff
jne 0x14001eed2
mov rax, qword [sym.imp.WSOCK32.dll_WSAGetLastError]
call rax
cmp eax, 0x2714
jne 0x14001eed2
mov eax, 1
jmp 0x14001eed7
mov eax, 0
test al, al
jne 0x14001ee8c
cmp dword [rbp - 4], 0xffffffff
jne 0x14001ef28
mov ecx, 0x20
call fcn.140131750
mov rbx, rax
mov rax, qword [sym.imp.WSOCK32.dll_WSAGetLastError]
call rax
lea r9, str.Failed_to_read_data
lea r8, [0x1401351c0]
mov edx, eax
mov rcx, rbx
call fcn.1400cf2b0
mov r8, qword [fcn.1400cf460]
lea rax, [0x14013fda0]
mov rdx, rax
mov rcx, rbx
call fcn.140131e30
mov eax, dword [rbp - 4]
cdqe
jmp 0x14001ef45
add rsp, 0x30
pop rbx
pop rsi
pop rbp
ret

Function at 0x14001ef50
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
mov rax, qword [rbp + 0x38]
mov r8, rax
mov edx, 1
mov rcx, qword [rbp + 0x20]
call fcn.14001f0a0
mov rax, qword [rbp + 0x30]
mov ecx, eax
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
mov rdx, qword [rbp + 0x28]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WSOCK32.dll_send]
call rax
mov dword [rbp - 4], eax
jmp 0x14001efd5
mov rax, qword [rbp + 0x30]
mov ecx, eax
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
mov rdx, qword [rbp + 0x28]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WSOCK32.dll_send]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0xffffffff
jne 0x14001eff2
mov rax, qword [sym.imp.WSOCK32.dll_WSAGetLastError]
call rax
cmp eax, 0x2714
jne 0x14001eff2
mov eax, 1
jmp 0x14001eff7
mov eax, 0
test al, al
jne 0x14001efac
cmp dword [rbp - 4], 0xffffffff
jne 0x14001f048
mov ecx, 0x20
call fcn.140131750
mov rbx, rax
mov rax, qword [sym.imp.WSOCK32.dll_WSAGetLastError]
call rax
lea r9, str.Failed_to_send_data
lea r8, [0x1401351c0]
mov edx, eax
mov rcx, rbx
call fcn.1400cf2b0
mov r8, qword [fcn.1400cf460]
lea rax, [0x14013fda0]
mov rdx, rax
mov rcx, rbx
call fcn.140131e30
mov eax, dword [rbp - 4]
cdqe
jmp 0x14001f065
add rsp, 0x30
pop rbx
pop rsi
pop rbp
ret
Function at 0x14001f370
Capabilities:
Connect socket

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov dword [rbp + 0x30], r8d
mov qword [rbp + 0x38], r9
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
mov ecx, dword [rbp + 0x30]
mov rdx, qword [rbp + 0x28]
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WSOCK32.dll_connect]
call rax
mov dword [rbp - 4], eax
jmp 0x14001f3ce
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
mov ecx, dword [rbp + 0x30]
mov rdx, qword [rbp + 0x28]
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WSOCK32.dll_connect]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0xffffffff
jne 0x14001f3eb
mov rax, qword [sym.imp.WSOCK32.dll_WSAGetLastError]
call rax
cmp eax, 0x2714
jne 0x14001f3eb
mov eax, 1
jmp 0x14001f3f0
mov eax, 0
test al, al
jne 0x14001f3ae
cmp dword [rbp - 4], 0xffffffff
jne 0x14001f58d
mov rax, qword [sym.imp.WSOCK32.dll_WSAGetLastError]
call rax
cmp eax, 0x2733
sete al
test al, al
je 0x14001f504
mov rax, qword [rbp + 0x38]
mov r8, rax
mov edx, 1
mov rcx, qword [rbp + 0x20]
call fcn.14001f0a0
mov dword [rbp - 0xc], 4
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
lea rcx, [rbp - 8]
lea rdx, [rbp - 0xc]
mov qword [rsp + 0x20], rdx
mov r9, rcx
mov r8d, 0x1007
mov edx, 0xffff
mov rcx, rax
mov rax, qword [sym.imp.WSOCK32.dll_getsockopt]
call rax
cmp eax, 0xffffffff
sete al
test al, al
je 0x14001f4b2
mov ecx, 0x20
call fcn.140131750
mov rbx, rax
mov rax, qword [sym.imp.WSOCK32.dll_WSAGetLastError]
call rax
lea r9, str.Failed_to_get_socket_option
lea r8, [0x1401351c0]
mov edx, eax
mov rcx, rbx
call fcn.1400cf2b0
mov r8, qword [fcn.1400cf460]
lea rax, [0x14013fda0]
mov rdx, rax
mov rcx, rbx
call fcn.140131e30
mov eax, dword [rbp - 8]
mov dword [rbp - 0x10], eax
mov eax, dword [rbp - 0x10]
test eax, eax
je 0x14001f58d
mov ecx, 0x20
call fcn.140131750
mov rbx, rax
mov eax, dword [rbp - 0x10]
lea r9, str.Failed_to_connect
lea r8, [0x1401351c0]
mov edx, eax
mov rcx, rbx
call fcn.1400cf2b0
mov r8, qword [fcn.1400cf460]
lea rax, [0x14013fda0]
mov rdx, rax
mov rcx, rbx
call fcn.140131e30
mov ecx, 0x20
call fcn.140131750
mov rbx, rax
mov rax, qword [sym.imp.WSOCK32.dll_WSAGetLastError]
call rax
lea r9, str.Failed_to_connect
lea r8, [0x1401351c0]
mov edx, eax
mov rcx, rbx
call fcn.1400cf2b0
mov r8, qword [fcn.1400cf460]
lea rax, [0x14013fda0]
mov rdx, rax
mov rcx, rbx
call fcn.140131e30
mov rsi, rax
mov rcx, rbx
call fcn.140131a40
mov rax, rsi
mov rcx, rax
call fcn.140008850
mov rsi, rax
mov rcx, rbx
call fcn.140131a40
mov rax, rsi
mov rcx, rax
call fcn.140008850
mov rsi, rax
mov rcx, rbx
call fcn.140131a40
mov rax, rsi
mov rcx, rax
call fcn.140008850
nop
add rsp, 0x40
pop rbx
pop rsi
pop rbp
ret
Function at 0x14001f5a0
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov eax, edx
mov byte [rbp + 0x28], al
movzx eax, byte [rbp + 0x28]
mov ecx, eax
call fcn.14001e1d0
mov r8d, 6
mov edx, 1
mov ecx, eax
mov rax, qword [sym.imp.WSOCK32.dll_socket]
call rax
mov rdx, qword [rbp + 0x20]
mov qword [rdx], rax
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
cmp rax, 0xffffffffffffffff
jne 0x14001f631
mov ecx, 0x20
call fcn.140131750
mov rbx, rax
mov rax, qword [sym.imp.WSOCK32.dll_WSAGetLastError]
call rax
lea r9, str.Failed_to_create_socket
lea r8, [0x1401351c0]
mov edx, eax
mov rcx, rbx
call fcn.1400cf2b0
mov r8, qword [fcn.1400cf460]
lea rax, [0x14013fda0]
mov rdx, rax
mov rcx, rbx
call fcn.140131e30
mov dword [rbp - 4], 1
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
lea rdx, [rbp - 4]
mov r8, rdx
mov edx, 0x8004667e
mov rcx, rax
mov rax, qword [sym.imp.WSOCK32.dll_ioctlsocket]
call rax
cmp eax, 0xffffffff
sete al
test al, al
je 0x14001f6dd
mov rcx, qword [rbp + 0x20]
call fcn.14001f070
mov ecx, 0x20
call fcn.140131750
mov rbx, rax
mov rax, qword [sym.imp.WSOCK32.dll_WSAGetLastError]
call rax
lea r9, str.Failed_to_get_socket_flags
lea r8, [0x1401351c0]
mov edx, eax
mov rcx, rbx
call fcn.1400cf2b0
mov r8, qword [fcn.1400cf460]
lea rax, [0x14013fda0]
mov rdx, rax
mov rcx, rbx
call fcn.140131e30
mov rsi, rax
mov rcx, rbx
call fcn.140131a40
mov rax, rsi
mov rcx, rax
call fcn.140008850
mov rsi, rax
mov rcx, rbx
call fcn.140131a40
mov rax, rsi
mov rcx, rax
call fcn.140008850
nop
add rsp, 0x30
pop rbx
pop rsi
pop rbp
ret

Function at 0x14001f850
Capabilities:
Initialize winsock library

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x1c0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x160], rcx
mov rax, qword [rbp + 0x160]
mov byte [rax], 0
lea rax, [rbp - 0x60]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WSOCK32.dll_WSAStartup]
call rax
mov dword [rbp + 0x13c], eax
cmp dword [rbp + 0x13c], 0
je 0x14001f8db
mov ecx, 0x20
call fcn.140131750
mov rbx, rax
mov eax, dword [rbp + 0x13c]
lea r9, str.WSAStartup_failed
lea r8, [0x1401351c0]
mov edx, eax
mov rcx, rbx
call fcn.1400cf2b0
mov r8, qword [fcn.1400cf460]
lea rax, [0x14013fda0]
mov rdx, rax
mov rcx, rbx
call fcn.140131e30
movzx eax, word [rbp - 0x60]
cmp al, 2
jne 0x14001f8ef
movzx eax, word [rbp - 0x60]
shr ax, 8
cmp al, 2
je 0x14001f930
mov rax, qword [sym.imp.WSOCK32.dll_WSACleanup]
call rax
mov ecx, 0x10
call fcn.140131750
mov rbx, rax
lea rax, str.Invalid_WinSock_version
mov rdx, rax
mov rcx, rbx
call fcn.1400e67c0
mov r8, qword [fcn.1400e6a50]
lea rax, [0x14013fef0]
mov rdx, rax
mov rcx, rbx
call fcn.140131e30
mov rax, qword [rbp + 0x160]
mov byte [rax], 1
jmp 0x14001f969
add rsp, 0x1c0
pop rbx
pop rsi
pop rbp
ret
Function at 0x1400b6170
Capabilities:
Create directory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x60
mov r9, rdx
mov r12, rcx
lea rdx, [rsp + 0x20]
mov rbx, r8
mov rcx, qword [r9]
call qword [sym.imp.msvcrt.dll__wstat64]
test eax, eax
jne 0x1400b61e8
mov rcx, qword [r12]
call qword [sym.imp.msvcrt.dll__wmkdir]
test eax, eax
jne 0x1400b61c0
call fcn.1400fb490
mov dword [rbx], 0
mov qword [rbx + 8], rax
mov eax, 1
add rsp, 0x60
pop rbx
pop rsi
pop r12
ret
call qword [sym.imp.msvcrt.dll__errno]
mov esi, dword [rax]
cmp esi, 0x11
je 0x1400b6210
call fcn.1400fb4a0
mov dword [rbx], esi
mov qword [rbx + 8], rax
xor eax, eax
add rsp, 0x60
pop rbx
pop rsi
pop r12
ret
call fcn.1400fb4a0
mov r12, rax
call qword [sym.imp.msvcrt.dll__errno]
mov eax, dword [rax]
mov qword [rbx + 8], r12
mov dword [rbx], eax
xor eax, eax
add rsp, 0x60
pop rbx
pop rsi
pop r12
ret
mov rdx, rbx
mov rcx, r12
call fcn.1400ba8a0
cmp al, 2
jne 0x1400b61cd
xor eax, eax
jmp 0x1400b61b5
Function at 0x1400ba420
Capabilities:
Delete directory
Delete file

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, rdx
call fcn.1400b5570
test al, al
je 0x1400ba487
cmp al, 0xff
je 0x1400ba478
mov rdx, rbx
mov rcx, rsi
call fcn.1400ba8a0
cmp al, 2
je 0x1400ba490
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400ba49d
mov eax, dword [rbx]
test eax, eax
jne 0x1400ba487
call fcn.1400fb490
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rbx + 8], rsi
mov dword [rbx], eax
xor eax, eax
jmp 0x1400ba489
call fcn.1400fb490
mov dword [rbx], 0
mov qword [rbx + 8], rax
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x1400ba448
call fcn.1400fb490
mov dword [rbx], 0
mov qword [rbx + 8], rax
mov eax, 1
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x1400cd380
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
jmp 0x1400cd3a7
call rbp
cmp dword [rax], 4
jne 0x1400cd3c4
mov rcx, qword [rdi]
call sub.msvcrt.dll__fileno_1
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sub.msvcrt.dll__read
movsxd r12, eax
cmp eax, 0xffffffff
je 0x1400cd3a0
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140121f60
Capabilities:
Encode data using xor

Disassembly:
mov r11, rdx
mov rax, rcx
mov r10, rdx
and r11, 0xfffffffffffffff8
add r11, rcx
movabs rcx, 0xc6a4a7935bd1e995
imul r10, rcx
xor r10, r8
cmp rax, r11
je 0x140121fb8
nop word cs:[rax + rax]
mov r9, qword [rax]
add rax, 8
imul r9, rcx
mov r8, r9
shr r8, 0x2f
xor r8, r9
imul r8, rcx
xor r8, r10
mov r10, r8
imul r10, rcx
cmp r11, rax
jne 0x140121f90
and edx, 7
je 0x140122061
lea eax, [rdx - 1]
mov ecx, edx
cdqe
movzx eax, byte [r11 + rax]
sub ecx, 2
js 0x140122050
movsxd rcx, ecx
shl rax, 8
movzx ecx, byte [r11 + rcx]
add rax, rcx
lea ecx, [rdx - 3]
cmp rdx, 2
je 0x140122050
movsxd rcx, ecx
shl rax, 8
movzx ecx, byte [r11 + rcx]
add rax, rcx
lea ecx, [rdx - 4]
cmp rdx, 3
je 0x140122050
movsxd rcx, ecx
shl rax, 8
movzx ecx, byte [r11 + rcx]
add rax, rcx
lea ecx, [rdx - 5]
cmp rdx, 4
je 0x140122050
movsxd rcx, ecx
shl rax, 8
movzx ecx, byte [r11 + rcx]
add rax, rcx
lea ecx, [rdx - 6]
cmp rdx, 5
je 0x140122050
movsxd rdx, ecx
shl rax, 8
movzx edx, byte [r11 + rdx]
add rax, rdx
test ecx, ecx
je 0x140122050
movzx edx, byte [r11]
shl rax, 8
add rax, rdx
xor rax, r10
movabs r10, 0xc6a4a7935bd1e995
imul r10, rax
movabs rax, 0xc6a4a7935bd1e995
mov rdx, r10
shr rdx, 0x2f
xor rdx, r10
imul rdx, rax
mov rax, rdx
shr rax, 0x2f
xor rax, rdx
ret
Function at 0x415ba0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415d46
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00431f60
xorps xmm15, xmm15
mov r14, qword [0x005de810]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x415c0b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x415c20
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x415c45
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x415c59
cmp rbx, 0x1000
jae 0x415c15
nop dword [rax]
jmp 0x415cc9
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x415c6d
xor edx, edx
jmp 0x415cc0
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00431f60
xorps xmm15, xmm15
mov r14, qword [0x005de810]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x415c4f
jmp 0x415c34
call fcn.004639e0
xorps xmm15, xmm15
mov r14, qword [0x005de810]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00436640
lea rax, [0x004d766b]
mov ebx, 0x18
call fcn.00436f40
mov rax, qword [rsp + 0x38]
call fcn.00436c40
lea rax, [0x004d772b]
mov ebx, 0x19
call fcn.00436f40
mov rax, qword [rsp + 0x30]
nop
call fcn.00436c40
call fcn.004368a0
call fcn.004366c0
lea rax, [0x004d996a]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00434d00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045fe20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00415ba0
Function at 0x415d80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415faa
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00431fe0
xorps xmm15, xmm15
mov r14, qword [0x005de810]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x415df9
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x415e0c
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x415e30
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x415e44
cmp rbx, 0x1000
jae 0x415e03
jmp 0x415ec5
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x415e56
xor esi, esi
jmp 0x415eb6
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00431fe0
xorps xmm15, xmm15
mov r14, qword [0x005de810]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x415e3a
nop
jmp 0x415e22
call fcn.004639e0
xorps xmm15, xmm15
mov r14, qword [0x005de810]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x415f45
call fcn.00436640
lea rax, [0x004d7b2c]
mov ebx, 0x19
call fcn.00436f40
mov rax, qword [rsp + 0x68]
call fcn.00436c40
lea rax, [0x004d772b]
mov ebx, 0x19
call fcn.00436f40
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00436c40
call fcn.004368a0
call fcn.004366c0
lea rax, [0x004d45e2]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.00434d00
cmp eax, 0x5af
je 0x415ee8
call fcn.00436640
lea rax, [0x004d7b2c]
mov ebx, 0x19
nop dword [rax]
call fcn.00436f40
mov rax, qword [rsp + 0x38]
call fcn.00436c40
lea rax, [0x004d772b]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00436f40
mov eax, dword [rsp + 0x34]
call fcn.00436c40
call fcn.004368a0
call fcn.004366c0
lea rax, [0x004d927e]
mov ebx, 0x1f
call fcn.00434d00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045fe20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415d80