joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400068a4
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, qword [rcx + 8]
mov r14, qword [rcx]
mov ecx, dword [r14]
xor r9d, r9d
inc ecx
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x1400068ee
call fcn.140026f3c
cmp dword [rax], 4
je 0x1400068c4
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x14000d538
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rsi, rdx
mov dword [rax + 8], 1
mov rbx, r8
mov rdi, rcx
mov rcx, rsi
lea r8, [rax + 8]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov r8d, dword [rbx + 0x10]
mov rcx, rsi
mov rdx, qword [rbx + 0x20]
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x14000d5c9
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x14000d5a2
mov rax, qword [rdi + 8]
mov dword [rax], 2
xor al, al
jmp 0x14000d68d
mov r8, qword [rdi + 0x18]
mov rcx, rsi
mov rdx, qword [rdi + 0x10]
mov r8, qword [r8]
mov rdx, qword [rdx]
call fcn.14001c418
mov ecx, eax
mov rax, qword [rdi + 8]
mov dword [rax], ecx
mov rax, qword [rdi + 8]
cmp dword [rax], 0
jne 0x14000d59b
and dword [rsp + 0x40], 0
lea r8, [rsp + 0x40]
mov edx, 0x8004667e
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rax, qword [rdi + 0x28]
lea r9, [rsp + 0x40]
movabs r14, 0x20c49ba5e353f7cf
mov dword [rsp + 0x20], 4
mov ebx, 0xffff
mov r8d, 0x1006
mov rcx, qword [rax]
mov rax, r14
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, qword [rdi + 0x20]
imul ecx, dword [rax], 0x3e8
add edx, ecx
mov rcx, rsi
mov dword [rsp + 0x40], edx
mov edx, ebx
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, qword [rdi + 0x38]
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 4
mov rcx, qword [rax]
mov rax, r14
imul rcx
sar rdx, 7
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
mov rcx, qword [rdi + 0x30]
imul r8d, dword [rcx], 0x3e8
mov rcx, rsi
add edx, r8d
mov r8d, 0x1005
mov dword [rsp + 0x40], edx
mov edx, ebx
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rdi + 8]
mov al, 1
and dword [rcx], 0
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14000fd54
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
cmp ecx, 0xffffffff
je 0x14000fee1
cmp ecx, 0x7c
je 0x14000fee1
cmp ecx, 0x29
jne 0x14000fdce
cmp dword [rdi + 0x1c], 0
jne 0x14000fee1
lea rbx, [rdi + 0x80]
test dword [rbx], 0x10000000
je 0x14000fefa
cmp ecx, 0x5d
jne 0x14000fdab
test dword [rbx], 0x10000000
je 0x14000ff08
mov dl, byte [rdi + 0x78]
lea rcx, [rdi + 0x40]
call fcn.14000f360
mov rcx, rdi
call fcn.14001426c
mov rcx, rdi
call fcn.140014384
mov ecx, dword [rdi + 0x7c]
mov al, 1
jmp 0x14000fd66
lea rbx, [rdi + 0x80]
cmp ecx, 0x2e
jne 0x14000fde5
lea rcx, [rdi + 0x40]
call fcn.14000f5e4
jmp 0x14000fdb7
cmp ecx, 0x5c
jne 0x14000fe33
mov rcx, rdi
call fcn.14001426c
test byte [rbx], 0x80
je 0x14000fe29
mov al, byte [rdi + 0x78]
cmp al, 0x62
jne 0x14000fe11
lea rcx, [rdi + 0x40]
call fcn.14000fd48
mov rcx, rdi
call fcn.14001426c
jmp 0x14000fdc7
cmp al, 0x42
jne 0x14000fe29
lea rcx, [rdi + 0x40]
call fcn.14000fd48
lea rcx, [rdi + 0x40]
call fcn.140014208
jmp 0x14000fe07
mov rcx, rdi
call fcn.140010020
jmp 0x14000fdbf
cmp ecx, 0x5b
jne 0x14000fe5e
mov rcx, rdi
call fcn.14001426c
mov rcx, rdi
call fcn.140010830
mov edx, 0x5d
mov rcx, rdi
lea r8d, [rdx - 0x59]
call fcn.140012638
jmp 0x14000fdbf
cmp ecx, 0x28
jne 0x14000fe93
mov rcx, rdi
call fcn.14001426c
mov rcx, rdi
call fcn.140014c24
mov edx, 0x29
mov rcx, rdi
mov bl, al
lea r8d, [rdx - 0x24]
call fcn.140012638
test bl, bl
je 0x14000fdc7
jmp 0x14000fdbf
cmp ecx, 0x5e
jne 0x14000fea6
lea rcx, [rdi + 0x40]
call fcn.14000f354
jmp 0x14000fe07
cmp ecx, 0x24
jne 0x14000feb9
lea rcx, [rdi + 0x40]
call fcn.14000f6e4
jmp 0x14000fe07
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x14000ff16
cmp ecx, 0x3f
je 0x14000ff16
cmp ecx, 0x7b
je 0x14000ff16
cmp ecx, 0x7d
jne 0x14000fd9a
test dword [rbx], 0x10000000
je 0x14000feec
jmp 0x14000fdab
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 6
mov rcx, rdi
call fcn.14001262c
int3
mov edx, 5
mov rcx, rdi
call fcn.14001262c
int3
mov edx, 4
mov rcx, rdi
call fcn.14001262c
int3
mov edx, 0xa
mov rcx, rdi
call fcn.14001262c
int3
Function at 0x140012560
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14005e098]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400125d3
cmp byte [rcx + 0x72], 0
je 0x1400125d3
mov rax, qword [rcx]
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x140012627
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x1400125ed
sub eax, 1
je 0x1400125f1
cmp eax, 2
jne 0x140012627
mov byte [rbx + 0x72], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140020a40
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14001261e
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.14002a634
cmp rdi, rax
jne 0x140012627
cmp byte [rbx + 0x72], 0
sete al
jmp 0x1400125d5
xor al, al
jmp 0x1400125d5
Function at 0x14001545c
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
and dword [rax - 0x38], 0
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
and qword [rcx + 0x10], 0
and qword [rcx + 0x10], 0
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], 0
mov dword [rax - 0x38], 1
lea r15, [rdx + 0x10]
cmp qword [r15], 0xf
jbe 0x1400154c2
xor r8d, r8d
mov rdx, qword [r15]
call fcn.140004ecc
and qword [rbx + 0x10], 0
xor esi, esi
lea r14d, [rsi - 6]
cmp qword [rdi + 0x18], 0x10
jb 0x1400154da
mov rbp, qword [rdi]
mov rcx, rbp
mov rdi, rbp
jmp 0x1400154e0
mov rbp, rdi
mov rcx, rdi
mov r12, qword [r15]
add r12, rcx
cmp rdi, r12
je 0x140015601
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
shl esi, 8
movzx eax, byte [rbp]
add esi, eax
add r14d, 8
js 0x14001557c
movsxd r13, esi
movsxd rdi, r14d
lea ecx, [r14 + 6]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 2
mov r15d, edx
imul eax, edx, 0xfffffffa
add r14d, eax
mov rax, r13
mov rcx, rdi
sar rax, cl
and eax, 0x3f
mov r9b, byte [rax + r8]
mov rcx, qword [rbx + 0x10]
cmp rcx, qword [rbx + 0x18]
jae 0x14001555c
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140015551
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140015572
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rbx
call fcn.140004acc
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
sub rdi, 6
sub r15, 1
jne 0x140015522
inc rbp
cmp rbp, r12
jne 0x1400154f6
cmp r14d, 0xfffffffa
jle 0x140015601
lea ecx, [r14 + 8]
shl esi, 8
movsxd rdx, esi
sar rdx, cl
and edx, 0x3f
mov r9b, byte [rdx + r8]
mov rcx, qword [rbx + 0x10]
cmp rcx, qword [rbx + 0x18]
jae 0x1400155f2
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1400155c1
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140015601
cmp rcx, qword [rbx + 0x18]
jae 0x1400155ef
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1400155e7
mov rax, qword [rbx]
mov word [rcx + rax], 0x3d
jmp 0x140015601
mov r9b, 0x3d
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rbx
call fcn.140004acc
mov rcx, qword [rbx + 0x10]
test cl, 3
jne 0x1400155cc
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14001782c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x14005e098]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rdi, rcx
mov qword [rbp - 0x11], rcx
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x2f], xmm1
lea rcx, str.BCDFGHJKMPQRTVWXY2346789
call fcn.14002b200
mov r8, rax
lea rdx, str.BCDFGHJKMPQRTVWXY2346789
lea rcx, [rbp + 0x1f]
call fcn.140002b20
nop
mov ecx, 0x1a
call fcn.1400203e4
mov rbx, rax
mov r12d, 0xc8
mov ecx, r12d
call fcn.1400203e4
mov rsi, rax
and qword [rbp - 0x11], 0
mov dword [rbp - 0x19], r12d
xor edx, edx
lea r8d, [rdx + 0x1a]
mov rcx, rbx
call fcn.140021ef0
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14001797f
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
and qword [rdi + 0x10], 0
and qword [rdi + 0x18], 0
lea rcx, str.Couldnt_access_system_information_
call fcn.14002ad58
mov r8, rax
lea rdx, str.Couldnt_access_system_information_
mov rcx, rdi
call fcn.140002c00
nop
mov rdx, qword [rbp + 0x37]
cmp rdx, 0x10
jb 0x140017958
mov ebx, 0x1000
mov rcx, qword [rbp + 0x1f]
inc rdx
mov rax, rcx
cmp rdx, rbx
jb 0x140017953
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017a68
call fcn.1400203dc
mov rax, rdi
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140020a40
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DigitalProductID
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xorps xmm0, xmm0
test eax, eax
jne 0x1400178f0
mov r9d, dword [rbp - 0x19]
lea r8, [r9 + rsi]
movups xmmword [rbp - 1], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf], xmm1
cmp rsi, r8
jne 0x1400179da
movdqa xmm0, xmmword [0x140046c00]
movdqu xmmword [rbp + 0xf], xmm0
mov byte [rbp - 1], al
jmp 0x1400179e7
mov rdx, rsi
lea rcx, [rbp - 1]
call fcn.140002dcc
nop
mov rcx, r12
call fcn.1400203e4
lea rbx, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae rbx, qword [rbp - 1]
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8, r12
mov rdx, rbx
mov rcx, rdi
call fcn.14001644c
nop
mov ebx, 0x1000
mov rdx, qword [rbp + 0x17]
cmp rdx, 0x10
jb 0x140017a4f
inc rdx
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, rbx
jb 0x140017a49
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017a62
call fcn.1400203dc
nop
mov rdx, qword [rbp + 0x37]
cmp rdx, 0x10
jb 0x140017958
jmp 0x14001792b
call fcn.140026d68
nop
call fcn.140026d68
int3
Function at 0x140017b04
Capabilities:
Resolve dns

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x460
mov rax, qword [0x14005e098]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov r14d, 2
mov rsi, r9
mov rdi, r8
mov ebp, edx
mov rbx, rcx
cmp word [rcx], r14w
je 0x140017b41
cmp word [rcx], 0x17
jne 0x140017b9c
movzx ecx, word [rcx + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
xor edx, edx
mov dword [rsi], eax
lea rcx, [rsp + 0x40]
mov esi, 0x401
mov r8d, esi
call fcn.140021ef0
mov dword [rsp + 0x30], r14d
lea r8, [rsp + 0x40]
and dword [rsp + 0x28], 0
mov r9d, esi
and qword [rsp + 0x20], 0
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x140017b9c
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1400153e0
mov al, 1
jmp 0x140017b9e
xor al, al
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140020a40
add rsp, 0x460
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140017bbc
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x140017bc8
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x14005e098]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rdi, r8
mov dword [rsp + 0x20], 0x80
mov rbx, rdx
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x140017c1d
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r9, rdi
mov r8, rbx
call fcn.140017b04
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140020a40
mov rbx, qword [rsp + 0xe8]
add rsp, 0xc0
pop rdi
ret

Function at 0x140017bc8
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x140017bc8
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x14005e098]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rdi, r8
mov dword [rsp + 0x20], 0x80
mov rbx, rdx
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x140017c1d
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r9, rdi
mov r8, rbx
call fcn.140017b04
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140020a40
mov rbx, qword [rsp + 0xe8]
add rsp, 0xc0
pop rdi
ret
Function at 0x140019224
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14005e098]
xor rax, rsp
mov qword [rbp - 8], rax
mov edi, 0xffff
xor r14d, r14d
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x140019266
movzx eax, r14w
jmp 0x140019394
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x1400192a2
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x1400192a2
lea ecx, [r9 - 1]
mov dword [rax], ecx
movzx eax, si
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x140019394
cmp qword [rcx + 0x80], r14
je 0x140019391
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1400192e0
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140019309
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.140028434
cmp ax, di
je 0x140019391
movzx edi, si
jmp 0x140019391
lea r8, [rbp - 0x38]
mov word [rbp - 0x40], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp - 0x3e]
lea r8, [rbp - 8]
mov qword [rsp + 0x30], r8
lea r8, [rbp - 0x28]
mov qword [rsp + 0x28], r8
lea r8, [rbp - 0x30]
mov qword [rsp + 0x20], r8
lea r8, [rbp - 0x40]
call qword [rax + 0x38]
test eax, eax
je 0x140019357
sub eax, 1
je 0x140019357
cmp eax, 2
jne 0x140019391
movzx ecx, word [rbp - 0x40]
jmp 0x1400192ec
mov r14, qword [rbp - 0x38]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x140019381
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call fcn.14002a634
cmp r14, rax
jne 0x140019391
lea rax, [rbp - 0x40]
mov byte [rbx + 0x72], 1
cmp qword [rbp - 0x30], rax
cmovne di, si
movzx eax, di
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140020a40
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x140021024
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002106e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002106e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002106e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002106e
cmp dword [rcx + 0x84], 0xe
jbe 0x14002106e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140021070
xor al, al
add rsp, 0x28
ret
Function at 0x140027238
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1400270cb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400270cb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400270cb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400270cb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400270cb
cmp dword [rcx + 0x84], 0xe
jbe 0x1400270cb
cmp dword [rcx + 0xf8], 0
je 0x1400270cb
mov ecx, ebx
call fcn.14002716c
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140026f5c
cmp dword [rbp + 0x20], 0
je 0x140027118
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140027120
int3
xor r8d, r8d
xor edx, edx
jmp 0x140027064
Function at 0x140032d9c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x140032ac2
call fcn.140026f3c
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.140026d48
jmp 0x140032c0d
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140032c0d
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x140032c0d
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x140032af1
lock or dword [rcx + 0x14], 0x10
jmp 0x140032c0d
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x140032b05
call fcn.140033588
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x140032b15
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x140032b18
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.140032a64
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.14003dcac
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x140032bfb
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x140032ba9
mov rcx, rbx
call fcn.140032a64
cmp eax, 0xffffffff
je 0x140032b94
mov rcx, rbx
call fcn.140032a64
cmp eax, 0xfffffffe
je 0x140032b94
mov rcx, rbx
call fcn.140032a64
movsxd rdi, eax
lea r14, [0x140061e00]
mov rcx, rbx
sar rdi, 6
call fcn.140032a64
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x140032b9b
lea rdx, [0x14005e460]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140032ba9
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x140032bcd
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x140032bcd
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x140032bcd
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x140032beb
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x140032bf6
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x140032c12
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x140032a8c
Function at 0x140005010
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rdi, rcx
cmp qword [rcx + 0x80], 0
je 0x140005249
cmp byte [rcx + 0x89], 0
je 0x140005249
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000521d
mov edx, 0xf
mov qword [rbp - 0x10], rdx
mov byte [rbp - 0x28], 0
xor ecx, ecx
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x18], 8
lea rax, [rbp - 0x28]
cmp rdx, 0x10
cmovae rax, rcx
mov byte [rax + 8], cl
xor r12d, r12d
mov r9, qword [rbp - 0x10]
mov r10, qword [rbp - 0x28]
nop word [rax + rax]
lea rdx, [rbp - 0x28]
cmp r9, 0x10
cmovae rdx, r10
lea r8, [rbp - 0x28]
cmovae r8, r10
mov rcx, qword [rdi + 0x80]
mov r10, qword [rcx]
mov rax, qword [rbp - 0x18]
lea r9, [rdx + rax]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x8c]
call qword [r10 + 0x30]
test eax, eax
je 0x1400050e8
dec eax
jne 0x1400051e7
jmp 0x1400050ef
mov byte [rdi + 0x89], r12b
lea rax, [rbp - 0x28]
mov r10, qword [rbp - 0x28]
mov r9, qword [rbp - 0x10]
cmp r9, 0x10
cmovae rax, r10
mov rbx, qword [rbp + 0x20]
sub rbx, rax
je 0x14000513d
lea rcx, [rbp - 0x28]
cmp r9, 0x10
cmovae rcx, r10
mov r9, qword [rdi + 0x98]
mov r8, rbx
mov edx, 1
call fcn.14000d29c
cmp rbx, rax
jne 0x14000520d
mov r9, qword [rbp - 0x10]
mov r10, qword [rbp - 0x28]
cmp byte [rdi + 0x89], r12b
je 0x14000523b
test rbx, rbx
jne 0x1400050a0
or rax, 0xffffffffffffffff
mov r8, qword [rbp - 0x18]
sub rax, r8
cmp rax, 8
jbe 0x14000522e
lea rbx, [r8 + 8]
cmp rbx, 0xfffffffffffffffe
ja 0x140005221
cmp r9, rbx
jae 0x140005191
mov rdx, rbx
lea rcx, [rbp - 0x28]
call fcn.1400081e0
mov r9, qword [rbp - 0x10]
mov r10, qword [rbp - 0x28]
jmp 0x1400051ae
test rbx, rbx
jne 0x1400051b7
mov qword [rbp - 0x18], r12
lea rax, [rbp - 0x28]
cmp r9, 0x10
cmovae rax, r10
mov byte [rax], r12b
jmp 0x14000508b
test rbx, rbx
je 0x1400050a0
lea rcx, [rbp - 0x28]
cmp r9, 0x10
cmovae rcx, r10
mov rax, qword [rbp - 0x18]
xor edx, edx
mov qword [rcx + rax], rdx
mov qword [rbp - 0x18], rbx
lea rax, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rax, qword [rbp - 0x28]
mov byte [rax + rbx], dl
jmp 0x14000508b
sub eax, 2
je 0x140005200
cmp qword [rbp - 0x10], 0x10
jb 0x14000521d
mov rcx, qword [rbp - 0x28]
call fcn.14000d080
xor al, al
jmp 0x14000524b
cmp qword [rbp - 0x10], 0x10
jb 0x140005249
mov rcx, qword [rbp - 0x28]
jmp 0x140005244
cmp qword [rbp - 0x10], 0x10
jb 0x14000521d
mov rcx, qword [rbp - 0x28]
call fcn.14000d080
xor al, al
jmp 0x14000524b
lea rcx, str.string_too_long
call fcn.14000ab2c
int3
lea rcx, str.string_too_long
call fcn.14000ab2c
nop
cmp r9, 0x10
jb 0x140005249
mov rcx, r10
call fcn.14000d080
mov al, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret

Function at 0x140015570
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400153e0