joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400091b0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rsi, qword [0x1400a6720]
xor ebp, ebp
test rsi, rsi
je 0x1400092ab
mov rbx, qword [rsi]
call fcn.14001eea0
mov rdi, rax
test rax, rax
je 0x140009393
lea r8, [rsp + 0x50]
mov edx, 1
mov rcx, rax
call fcn.14001f460
test eax, eax
js 0x140009353
mov rcx, qword [rsp + 0x50]
mov byte [rcx], reloc.WS2_32.dll_setsockopt
test rbx, rbx
jne 0x140009216
mov r8, rbp
jmp 0x140009229
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rbx + r8], bpl
jne 0x140009220
mov rdx, rbx
mov rcx, rdi
call fcn.1400207a0
test eax, eax
jne 0x140009353
xor r8d, r8d
lea rdx, [0x14005c1e4]
mov rcx, rdi
call fcn.1400207a0
test eax, eax
jne 0x140009353
mov rdx, rdi
call fcn.1400089e0
mov rcx, rdi
call int.14001f2d0
mov rdx, rdi
call fcn.140008d80
mov rcx, rdi
call fcn.14001f200
mov rcx, qword [rsi + 8]
mov rax, qword [rsi + 0x10]
test rcx, rcx
je 0x140009289
mov qword [rcx + 0x10], rax
jmp 0x140009290
mov qword [0x1400a6728], rax
mov rcx, qword [rsi + 0x10]
mov rax, qword [rsi + 8]
mov qword [rcx], rax
mov rsi, qword [0x1400a6720]
test rsi, rsi
jne 0x1400091d6
mov ebx, dword [0x140082cf4]
cmp ebx, 0xffffffff
je 0x140009325
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp ebx, eax
jne 0x1400092cc
mov ecx, 8
call fcn.1400138f0
jmp 0x14000930b
mov ecx, dword [0x1400a6700]
test ecx, ecx
jle 0x14000930b
lea rax, [0x1400a5f00]
nop dword [rax]
cmp dword [rax], ebx
je 0x1400092f0
inc ebp
add rax, 4
cmp ebp, ecx
jl 0x1400092e0
jmp 0x14000930b
cmp ebp, 0xffffffff
je 0x14000930b
lea rax, [0x1400a4f00]
movsxd rcx, ebp
xor edx, edx
mov rcx, qword [rax + rcx*8]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x140082cf4]
xor r8d, r8d
xor edx, edx
call fcn.140010a10
mov dword [0x140082cf4], 0xffffffff
mov ecx, dword [0x140082cf0]
test ecx, ecx
js 0x140009334
call fcn.14000c6e0
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov dword [0x140082cf0], 0xffffffff
add rsp, 0x40
pop rdi
ret
mov ecx, eax
call fcn.140020e50
lea rcx, str.compose
mov r9d, 1
mov qword [rsp + 0x30], rcx
lea rdx, str.pkcs11_del_provider
mov qword [rsp + 0x28], rax
lea rcx, str.C:__w1_s_ssh_pkcs11_client.c
mov r8d, 0x3a9
mov dword [rsp + 0x20], 1
call fcn.14001aa60
int3
lea rax, str.sshbuf_new_failed
mov r9d, 1
mov qword [rsp + 0x30], rax
lea rdx, str.pkcs11_del_provider
mov qword [rsp + 0x28], rbp
lea rcx, str.C:__w1_s_ssh_pkcs11_client.c
mov r8d, 0x3a5
mov dword [rsp + 0x20], 1
call fcn.14001aa60
int3
Function at 0x14000daf0
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov r11, rsp
push rbx
push r14
sub rsp, 0x58
lea rax, [r11 + 0x18]
mov dword [rsp + 0x78], 0
mov qword [r11 - 0x38], rax
xor r9d, r9d
lea rax, [r11 + 0x20]
xor edx, edx
mov qword [r11 - 0x40], rax
mov r8d, 0x20000001
lea rax, [r11 + 0x10]
mov rbx, rcx
mov qword [r11 - 0x48], rax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov ecx, dword [rsp + 0x78]
call fcn.14003d014
mov r14, rax
test rax, rax
je 0x14000dd00
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x30], rax
mov r9, r14
lea rax, [rsp + 0x88]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rsp + 0x78]
mov r8d, 0x20000001
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
movsx ecx, byte [r14 + 4]
mov rax, qword [0x140094380]
mov dword [rax + 0x84], ecx
cmp ecx, 1
jne 0x14000dbad
mov rax, qword [0x140094380]
mov dword [rax + 0xb0], 3
movsx ecx, byte [r14 + 5]
mov rax, qword [0x140094388]
mov dword [rax + 0x84], ecx
cmp ecx, 1
jne 0x14000dbd5
mov rax, qword [0x140094388]
mov dword [rax + 0xb0], 3
movsx ecx, byte [r14 + 6]
mov rax, qword [0x140094390]
mov dword [rax + 0x84], ecx
cmp ecx, 1
jne 0x14000dbfd
mov rax, qword [0x140094390]
mov dword [rax + 0xb0], 3
mov esi, dword [r14]
lea rdi, [r14 + 8]
mov qword [rsp + 0x50], rbp
test esi, esi
je 0x14000dca7
lea rbp, [0x140094360]
nop dword [rax + rax]
mov ecx, 0xc0
dec esi
call fcn.14003d014
mov rbx, rax
test rax, rax
je 0x14000dcc6
xor edx, edx
mov r8d, 0xc0
mov rcx, rax
call fcn.14004f880
movsxd rcx, dword [rdi]
mov qword [rbx + 0x90], rcx
movsx ecx, byte [rdi + 6]
mov dword [rbx + 0x84], ecx
cmp ecx, 1
jne 0x14000dc6b
mov dword [rbx + 0xb0], 3
movsx rcx, word [rdi + 4]
mov rdx, rcx
sar rdx, 3
mov qword [rbp + rcx*8 + 0x20], rbx
mov dword [rbx + 0x80], ecx
and ecx, 0x80000007
jge 0x14000dc91
dec ecx
or ecx, 0xfffffff8
inc ecx
mov eax, 0x80
add rdi, 8
sar eax, cl
or byte [rdx + rbp], al
test esi, esi
jne 0x14000dc20
mov rcx, r14
call fcn.14003d000
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
add rsp, 0x58
pop r14
pop rbx
ret
lea rax, str.out_of_memory
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rdx, str.fd_decode_state
mov qword [rsp + 0x28], 0
lea rcx, str.C:__w1_scontribwin32win32compatw32fd.c
mov r8d, 0x4ce
mov dword [rsp + 0x20], 1
call fcn.14001aa60
int3
lea rax, str.out_of_memory
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rdx, str.fd_decode_state
mov qword [rsp + 0x28], 0
lea rcx, str.C:__w1_scontribwin32win32compatw32fd.c
mov r8d, 0x4ba
mov dword [rsp + 0x20], 1
call fcn.14001aa60
int3
Function at 0x1400119a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
cmp qword [rcx + 0x40], 0
mov esi, edx
mov rdi, rcx
mov ebx, 0x19000
jne 0x1400119e0
mov ecx, ebx
call fcn.14003d014
mov qword [rdi + 0x40], rax
test rax, rax
jne 0x1400119e0
call fcn.14003d440
mov dword [rax], 0xc
jmp 0x140011ae5
mov rcx, qword [rdi + 0x90]
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
jne 0x1400119f7
cmp esi, ebx
cmovb ebx, esi
mov dword [rdi + 0x48], ebx
lea rax, [0x140011980]
mov rdx, qword [rdi + 0x40]
mov r9, rdi
mov rcx, qword [rdi + 0x90]
mov r8d, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
je 0x140011a3a
mov dword [rdi + 0x54], 1
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0xe
jg 0x140011a66
je 0x140011a5f
sub eax, 1
je 0x140011a91
sub eax, 1
je 0x140011a83
sub eax, 1
je 0x140011a83
cmp eax, 2
je 0x140011a7c
jmp 0x140011a96
mov ebx, 0xc
jmp 0x140011a96
cmp eax, 0x32
je 0x140011a91
cmp eax, 0x50
je 0x140011a8a
cmp eax, 0x7b
je 0x140011a83
cmp eax, 0x522
jne 0x140011a96
mov ebx, 0xd
jmp 0x140011a96
mov ebx, 2
jmp 0x140011a96
mov ebx, setsockopt
jmp 0x140011a96
mov ebx, 0x82
call fcn.14003d440
mov dword [rax], ebx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x40], rdi
lea rdx, str.fileio_ReadFileEx
mov dword [rsp + 0x38], eax
lea rcx, str.C:__w1_scontribwin32win32compat_fileio.c
lea rax, str.ReadFileEx___ERROR:_d__io:_p
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov r8d, 0x236
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 7
call fcn.14001ae20
mov rbx, qword [rsp + 0x60]
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140012830
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xf0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov rbx, qword [rcx + 0xb8]
mov rdi, rcx
mov rcx, qword [rcx + 0x18]
mov dword [rsp + 0x50], 0x80
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rdi + 0x90]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x1400128ef
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140012770
mov ebx, eax
call fcn.14003d440
mov dword [rax], ebx
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x40], rdi
mov r8d, 0x74
mov dword [rsp + 0x38], eax
lea rax, str.acceptEx___getsockname___ERROR:_d__io:_p
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 5
xor r9d, r9d
lea rdx, str.socketio_acceptEx
lea rcx, str.C:__w1_scontribwin32win32compat_socketio.c
call fcn.14001ae20
mov eax, 0xffffffff
jmp 0x1400129b5
movzx ecx, word [rsp + 0x60]
mov edx, 1
mov r8d, 6
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbx + 0x400], rax
cmp rax, 0xffffffffffffffff
jne 0x14001295f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140012770
mov ebx, eax
call fcn.14003d440
mov dword [rax], ebx
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x40], rdi
mov r8d, 0x7c
mov dword [rsp + 0x38], eax
lea rax, str.acceptEx___socket___ERROR:_d__io:_p
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 7
jmp 0x1400128cf
mov qword [rsp + 0x38], rdi
lea rcx, [rbx + 0x418]
mov qword [rsp + 0x30], rcx
mov rdx, rax
mov rcx, qword [rdi + 0x90]
xor r9d, r9d
mov rax, qword [rbx + 0x408]
mov r8, rbx
mov dword [rsp + 0x28], 0x90
mov dword [rsp + 0x20], 0x90
call qword [0x1400519d0]
cmp eax, 1
jne 0x1400129d6
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rdi + 0x54], 1
xor eax, eax
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1400313f0
mov rbx, qword [rsp + 0x108]
add rsp, 0xf0
pop rdi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x1400129ac
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140012770
mov ebx, eax
call fcn.14003d440
mov dword [rax], ebx
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x40], rdi
mov r8d, 0x8f
mov dword [rsp + 0x38], eax
lea rax, str.acceptEx___AcceptEx___ERROR:_d__io:_p
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 7
jmp 0x1400128cf
Function at 0x140012a50
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
xor ebp, ebp
mov esi, r8d
mov dword [rsp + 0x70], ebp
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x140012a7a
mov dword [rdx], ebp
mov rcx, qword [rcx + 0x40]
mov eax, 0x11800
mov dword [rsp + 0x50], eax
test rcx, rcx
jne 0x140012ad7
mov ecx, eax
call fcn.14003d014
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x140012aca
call fcn.14003d440
mov dword [rax], 0xc
call fcn.14003d440
mov qword [rsp + 0x40], rdi
mov r8d, 0xbd
mov eax, dword [rax]
mov dword [rsp + 0x38], eax
lea rax, str.WSARecv___ERROR:_d__io:_p
jmp 0x140012b81
mov qword [rdi + 0x40], rax
mov eax, dword [rsp + 0x50]
mov dword [rdi + 0x48], eax
jmp 0x140012adc
mov qword [rsp + 0x58], rcx
test esi, esi
je 0x140012ae9
cmp esi, eax
cmovb eax, esi
mov dword [rsp + 0x50], eax
mov rcx, qword [rdi + 0x90]
lea rax, [0x140012a30]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rdi
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov r8d, 1
call qword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
jne 0x140012b37
mov dword [rdi + 0x54], 1
test rbx, rbx
je 0x140012b4b
mov dword [rbx], 1
jmp 0x140012bae
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x140012b4f
mov dword [rdi + 0x54], 1
xor eax, eax
jmp 0x140012bae
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140012770
mov ebx, eax
call fcn.14003d440
mov dword [rax], ebx
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x40], eax
mov r8d, 0xd7
mov qword [rsp + 0x38], rdi
lea rax, str.WSARecv___WSARecv___ERROR:_io:_p__d
mov qword [rsp + 0x30], rax
lea rdx, str.socketio_WSARecv
mov qword [rsp + 0x28], rbp
lea rcx, str.C:__w1_scontribwin32win32compat_socketio.c
xor r9d, r9d
mov dword [rsp + 0x20], 7
call fcn.14001ae20
mov eax, 0xffffffff
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400135b0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov eax, dword [rcx + 0x78]
xor esi, esi
xor r9d, r9d
mov rbx, rcx
mov edi, esi
test eax, eax
je 0x140013620
mov qword [rsp + 0x40], rcx
lea rdx, str.socketio_finish_connect
mov dword [rsp + 0x38], eax
lea rcx, str.C:__w1_scontribwin32win32compat_socketio.c
mov edi, eax
mov r8d, 0x368
lea rax, str.finish_connect___ERROR:_async_io_completed_with_error:__d__io:_p
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 7
call fcn.14001ae20
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x38], rsi
mov dword [rbx + 0x74], esi
jmp 0x14001369b
mov rcx, qword [rcx + 0x90]
mov edx, 0xffff
mov r8d, 0x7010
mov dword [rsp + 0x20], esi
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x140013686
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x40], rbx
lea rdx, str.socketio_finish_connect
mov dword [rsp + 0x38], eax
lea rcx, str.C:__w1_scontribwin32win32compat_socketio.c
mov edi, eax
xor r9d, r9d
lea rax, str.finish_connect___ERROR:_setsockopt_failed:_d__io:_p
mov r8d, 0x36e
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 7
call fcn.14001ae20
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x38], rsi
mov dword [rbx + 0x74], esi
test edi, edi
je 0x1400136b5
mov dword [rbx + 0x58], edi
mov dword [rbx + 0x78], edi
call fcn.14003d440
mov ecx, edi
mov r9, rax
call fcn.140012770
mov dword [r9], eax
jmp 0x1400136c0
xorps xmm0, xmm0
movups xmmword [rbx + 0x60], xmm0
movups xmmword [rbx + 0x70], xmm0
mov rsi, qword [rsp + 0x68]
neg edi
mov dword [rbx + 0xb0], 3
mov rbx, qword [rsp + 0x60]
sbb eax, eax
add rsp, 0x50
pop rdi
ret

Function at 0x1400151e0
Capabilities:
Manipulate console buffer

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov edi, edx
mov ebx, ecx
call fcn.140014780
mov rcx, rax
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x140015279
movsx ecx, word [rsp + 0x2a]
mov word [rsp + 0x20], bx
mov word [rsp + 0x22], di
lea eax, [rcx - 1]
cmp edi, eax
jle 0x140015248
mov edx, dword [0x1400a4e4c]
cmp edi, edx
jle 0x140015248
mov ebx, edi
sub ebx, edx
call fcn.140018f50
sub rbx, 1
jne 0x140015238
movzx ecx, word [rsp + 0x2a]
movsx eax, cx
cmp edi, eax
jl 0x140015257
dec cx
mov word [rsp + 0x22], cx
call fcn.140014780
mov edx, dword [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
jne 0x140015273
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1400a4e4c], edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400313f0
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140018f50
Capabilities:
Manipulate console buffer

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor r14d, r14d
mov qword [rsp + 0x80], rbx
mov edi, r14d
mov esi, r14d
call fcn.140014780
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x140018f9f
movsx edi, word [rsp + 0x44]
movsx esi, word [rsp + 0x46]
mov ebx, r14d
call fcn.140014780
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov r15d, 1
test eax, eax
je 0x14001900b
movsx eax, word [rsp + 0x4c]
mov qword [rsp + 0x88], rbp
movsx ebp, word [rsp + 0x46]
sub ebp, eax
call fcn.140014780
mov rcx, rax
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x140018ff1
mov ecx, 0xfffffffe
jmp 0x140018ffd
movsx eax, word [rsp + 0x34]
movsx ecx, word [rsp + 0x38]
sub ecx, eax
cmp ebp, ecx
mov rbp, qword [rsp + 0x88]
cmovge ebx, r15d
test ebx, ebx
mov rbx, qword [rsp + 0x80]
je 0x14001907d
call fcn.140014780
mov rcx, rax
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x140019033
mov eax, r14d
jmp 0x14001903a
movsx eax, word [rsp + 0x2a]
dec eax
cmp esi, eax
jl 0x140019075
lfence
mov edx, esi
xor ecx, ecx
call fcn.140014fd0
call fcn.140014780
mov rcx, rax
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x1400190c0
movzx eax, word [rsp + 0x2c]
sub ax, di
mov word [rsp + 0x20], ax
movzx eax, word [rsp + 0x2e]
jmp 0x1400190a9
mov ecx, r15d
call fcn.140014ea0
call fcn.140014780
lea rdx, [rsp + 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x1400190c0
movzx eax, word [rsp + 0x2c]
sub ax, di
mov word [rsp + 0x20], ax
movzx eax, word [rsp + 0x2e]
inc ax
mov word [rsp + 0x22], ax
call fcn.140014780
mov edx, dword [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov dword [0x14008425c], r14d
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400313f0
mov rsi, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop r14
pop rdi
ret
Function at 0x14002ed80
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov r9, rcx
movzx eax, byte [rdx + 2]
movzx r8d, byte [rdx + 3]
shl r8d, 8
or r8d, eax
movzx eax, byte [rdx + 1]
shl r8d, 8
or r8d, eax
movzx eax, byte [rdx]
shl r8d, 8
or r8d, eax
mov dword [rcx + 0x10], r8d
movzx eax, byte [rdx + 6]
movzx ecx, byte [rdx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 4]
shl ecx, 8
or ecx, eax
mov dword [r9 + 0x14], ecx
movzx eax, byte [rdx + 0xa]
movzx ecx, byte [rdx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 8]
shl ecx, 8
or ecx, eax
mov dword [r9 + 0x18], ecx
movzx eax, byte [rdx + 0xe]
movzx ecx, byte [rdx + 0xf]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [r9 + 0x1c], ecx
movzx eax, byte [rdx + 0x12]
movzx ecx, byte [rdx + 0x13]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x10]
shl ecx, 8
or ecx, eax
mov dword [r9 + 0x20], ecx
movzx eax, byte [rdx + 0x16]
movzx ecx, byte [rdx + 0x17]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x14]
shl ecx, 8
or ecx, eax
mov dword [r9 + 0x24], ecx
movzx eax, byte [rdx + 0x1a]
movzx ecx, byte [rdx + 0x1b]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x19]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x18]
shl ecx, 8
or ecx, eax
mov dword [r9 + 0x28], ecx
movzx ecx, byte [rdx + 0x1f]
movzx eax, byte [rdx + 0x1e]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x1c]
shl ecx, 8
or ecx, eax
mov dword [r9], 0x61707865
mov dword [r9 + 0x2c], ecx
mov dword [r9 + 4], 0x3320646e
mov dword [r9 + 8], 0x79622d32
mov dword [r9 + 0xc], 0x6b206574
ret
Function at 0x1400309b0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
xor ebx, ebx
lea r14, [0x140078bf0]
mov rbp, r9
mov rsi, r8
mov rdi, rdx
cmp rdx, 2
jbe 0x140030a79
mov r10d, 4
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rcx + 1]
sub rdi, 3
movzx r11d, byte [rcx]
movzx eax, dl
movzx r9d, byte [rcx + 2]
and dl, 0xf
shr al, 4
movzx r8d, r11b
and r8b, 3
shl dl, 2
shl r8b, 4
add rcx, 3
add r8b, al
movzx eax, r9b
shr al, 6
add dl, al
cmp r10, rbp
ja 0x140030b2a
and r9d, 0x3f
mov eax, r11d
shr rax, 2
add r10, 4
movzx eax, byte [rax + r14]
mov byte [rbx + rsi], al
movzx eax, r8b
movzx eax, byte [rax + r14]
mov byte [rbx + rsi + 1], al
movzx eax, dl
movzx eax, byte [rax + r14]
mov byte [rbx + rsi + 2], al
movzx eax, byte [r9 + r14]
mov byte [rbx + rsi + 3], al
add rbx, 4
cmp rdi, 2
ja 0x1400309f0
test rdi, rdi
je 0x140030b25
xor r8b, r8b
mov word [rsp + 0x49], 0
xor r9b, r9b
mov byte [rsp + 0x48], r8b
xor dl, dl
test rdi, rdi
je 0x140030abc
mov rdx, rcx
mov r8, rdi
lea rcx, [rsp + 0x48]
call fcn.14004fc40
movzx r9d, byte [rsp + 0x4a]
movzx edx, byte [rsp + 0x49]
movzx r8d, byte [rsp + 0x48]
lea rax, [rbx + 4]
cmp rax, rbp
ja 0x140030b2a
movzx eax, r8b
and r8b, 3
shr rax, 2
shl r8b, 4
movzx eax, byte [rax + r14]
mov byte [rbx + rsi], al
movzx eax, dl
shr al, 4
add r8b, al
movzx eax, r8b
movzx eax, byte [rax + r14]
mov byte [rbx + rsi + 1], al
add rbx, 2
lea rcx, [rbx + rsi]
cmp rdi, 1
jne 0x140030b05
mov al, 0x3d
jmp 0x140030b1a
and dl, 0xf
shr r9b, 6
shl dl, 2
add dl, r9b
movzx eax, dl
movzx eax, byte [rax + r14]
mov byte [rcx], al
mov byte [rbx + rsi + 1], 0x3d
add rbx, 2
cmp rbx, rbp
jb 0x140030b31
mov eax, 0xffffffff
jmp 0x140030b37
mov byte [rbx + rsi], 0
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x140031e0c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140031e56
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140031e56
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140031e56
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140031e56
cmp dword [rcx + 0x84], 0xe
jbe 0x140031e56
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140031e58
xor al, al
add rsp, 0x28
ret
Function at 0x140036240
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rbx, rcx
mov ecx, dword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
test eax, eax
jne 0x14003627b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14003d3b4
call fcn.14003d440
mov eax, dword [rax]
jmp 0x1400362f2
cmp rdi, qword [rbx + 0x18]
ja 0x140036287
mov qword [rbx + 0x20], rdi
jmp 0x1400362f0
cmp byte [rbx + 0x28], 0
lea rsi, [rdi + 1]
je 0x14003629e
mov rcx, qword [rbx + 0x10]
call fcn.1400432b4
mov byte [rbx + 0x28], 0
lea rcx, [rdi*2 + 2]
call fcn.1400432f0
mov qword [rbx + 0x10], rax
mov r8, rax
neg rax
mov edx, 0
sbb eax, eax
not eax
and eax, 0xc
cmove rdx, rsi
test eax, eax
sete cl
mov byte [rbx + 0x28], cl
mov qword [rbx + 0x18], rdx
test eax, eax
jne 0x1400362f2
mov ecx, dword [rbx + 0x18]
mov rdx, r8
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, eax
test rax, rax
je 0x140036265
mov qword [rbx + 0x20], rax
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14003f9bc
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x14003fa06
call fcn.14003d420
mov dword [rax], 0xf
call fcn.14003d440
mov dword [rax], 0xd
call fcn.1400354bc
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400313f0
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x14003fa11
lea eax, [rbx + 1]
jmp 0x14003f9f3
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x14003f9f1
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x14003f9f3

Function at 0x14004052c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14004059b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004059b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004059b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004059b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004059b
cmp dword [rcx + 0x84], 0xe
jbe 0x14004059b
cmp dword [rcx + 0xf8], 0
je 0x14004059b
mov ecx, ebx
call fcn.14004064c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140040428
nop
cmp dword [rbp + 0x20], 0
je 0x1400405e9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400405f4
int3
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x14004052c