joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d7b60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov esi, r8d
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x1400d7d5b
test rdx, rdx
je 0x1400d7d5b
mov r11d, dword [rdx + 4]
mov qword [rsp + 0x40], rbp
mov ebp, r11d
mov qword [rsp + 0x48], r14
mov r14d, dword [rcx + 4]
or ebp, r14d
mov qword [rsp + 0x50], r15
bt ebp, 0xa
jae 0x1400d7bd9
and r11d, r14d
bt r11d, 0xa
jae 0x1400d7d23
mov eax, dword [rdx + 8]
cmp dword [rcx + 8], eax
jne 0x1400d7d23
xor eax, eax
mov r14, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
movzx edx, byte [rcx]
cmp dl, byte [rbx]
je 0x1400d7c1e
cmp dl, 0x35
jne 0x1400d7bf6
mov rcx, qword [rcx + 0x10]
mov rdx, rbx
call fcn.1400d7b60
cmp eax, 2
jl 0x1400d7c17
cmp byte [rbx], 0x35
jne 0x1400d7d23
mov rdx, qword [rbx + 0x10]
mov r8d, esi
mov rcx, rdi
call fcn.1400d7b60
cmp eax, 2
jge 0x1400d7d23
mov eax, 1
jmp 0x1400d7bc2
lea eax, [rdx + 0x68]
test al, 0xfd
je 0x1400d7c93
mov r8, qword [rcx + 8]
test r8, r8
je 0x1400d7c93
mov r9, qword [rbx + 8]
cmp dl, 0x97
jne 0x1400d7d2d
movzx edx, byte [r8]
lea r15, [0x1401d90d0]
movzx eax, byte [r9]
movzx r10d, byte [rdx + r15]
movzx eax, byte [rax + r15]
sub r10d, eax
jne 0x1400d7d23
sub r9, r8
test dl, dl
je 0x1400d7c8a
movzx edx, byte [r8 + 1]
inc r8
movzx eax, byte [r9 + r8]
movzx r10d, byte [rdx + r15]
movzx ecx, byte [rax + r15]
sub r10d, ecx
je 0x1400d7c60
mov eax, 2
jmp 0x1400d7bc2
test r10d, r10d
jne 0x1400d7d23
xor r14d, r11d
test r14b, 0x10
jne 0x1400d7d23
bt ebp, 0xe
jb 0x1400d7bc0
bt ebp, 0xb
jb 0x1400d7d23
mov rdx, qword [rbx + 0x10]
mov r8d, esi
mov rcx, qword [rdi + 0x10]
call fcn.1400d7b60
test eax, eax
jne 0x1400d7d23
mov rdx, qword [rbx + 0x18]
mov r8d, esi
mov rcx, qword [rdi + 0x18]
call fcn.1400d7b60
test eax, eax
jne 0x1400d7d23
mov rdx, qword [rbx + 0x20]
mov r8d, esi
mov rcx, qword [rdi + 0x20]
call fcn.1400d7d80
test eax, eax
jne 0x1400d7d23
bt ebp, 0xd
jb 0x1400d7bc0
cmp byte [rdi], 0x61
je 0x1400d7bc0
movzx eax, word [rbx + 0x30]
cmp word [rdi + 0x30], ax
jne 0x1400d7d23
mov ecx, dword [rdi + 0x2c]
mov eax, dword [rbx + 0x2c]
cmp ecx, eax
je 0x1400d7bc0
cmp ecx, esi
jne 0x1400d7d23
test eax, eax
js 0x1400d7bc0
mov eax, 2
jmp 0x1400d7bc2
sub r9, r8
movzx ecx, byte [r8]
movzx eax, byte [r8 + r9]
sub ecx, eax
jne 0x1400d7d44
inc r8
test eax, eax
jne 0x1400d7d30
test ecx, ecx
je 0x1400d7c93
xor eax, eax
cmp dl, 0x35
setne al
inc eax
jmp 0x1400d7bc2
xor eax, eax
mov ecx, 2
cmp rbx, rdi
cmove ecx, eax
mov eax, ecx
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400dde40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
cmp byte [rcx + 0x2a0], 3
lea r15, [0x1401d90d0]
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
jae 0x1400ddeb9
test rdx, rdx
je 0x1400ddeb9
mov r9, rdx
movzx edx, byte [rdx]
movzx eax, byte [rdx + r15]
sub eax, 0x73
jne 0x1400ddeb9
lea r8, str.sqlite_user
sub r8, r9
test dl, dl
je 0x1400ddeb1
movzx eax, byte [r8 + r9 + 1]
inc r9
movzx ecx, byte [rax + r15]
movzx edx, byte [r9]
movzx eax, byte [rdx + r15]
sub eax, ecx
je 0x1400dde90
jmp 0x1400ddeb9
test eax, eax
je 0x1400ddfa1
mov r14d, dword [rbp + 0x28]
nop dword [rax]
xor ebx, ebx
test r14d, r14d
jle 0x1400ddf6f
nop dword [rax + rax]
mov r9d, ebx
xor r9d, 1
cmp ebx, 2
cmovge r9d, ebx
test rsi, rsi
je 0x1400ddf35
mov rax, qword [rbp + 0x20]
mov r8, rsi
movzx edx, byte [rsi]
movsxd rcx, r9d
shl rcx, 5
mov r10, qword [rcx + rax]
movzx eax, byte [r10]
movzx ecx, byte [rax + r15]
movzx eax, byte [rdx + r15]
sub eax, ecx
jne 0x1400ddf64
sub r10, rsi
nop dword [rax]
test dl, dl
je 0x1400ddf31
movzx eax, byte [r10 + r8 + 1]
inc r8
movzx ecx, byte [rax + r15]
movzx edx, byte [r8]
movzx eax, byte [rdx + r15]
sub eax, ecx
je 0x1400ddf10
jmp 0x1400ddf64
test eax, eax
jne 0x1400ddf64
mov rax, qword [rbp + 0x20]
lea r8, [rsp + 0x40]
movsxd rcx, r9d
mov rdx, rdi
shl rcx, 5
mov rcx, qword [rcx + rax + 0x18]
add rcx, 8
call fcn.14009bc30
test rax, rax
je 0x1400ddf64
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1400ddfa3
inc ebx
cmp ebx, r14d
jl 0x1400dded0
movzx edx, byte [rdi]
cmp byte [rdx + r15], 0x73
jne 0x1400ddfa1
lea r8, str.sqlite_master
sub r8, rdi
test dl, dl
je 0x1400ddfbc
movzx eax, byte [r8 + rdi + 1]
inc rdi
movzx ecx, byte [rax + r15]
movzx edx, byte [rdi]
movzx eax, byte [rdx + r15]
cmp eax, ecx
je 0x1400ddf83
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov rax, qword [rbp + 0x20]
mov r9, qword [rax + 0x20]
test rsi, rsi
jne 0x1400ddfd0
neg r9
sbb eax, eax
jmp 0x1400de00f
test r9, r9
je 0x1400ddfa1
movzx eax, byte [r9]
mov r8, rsi
movzx edx, byte [rsi]
movzx ecx, byte [rax + r15]
movzx eax, byte [rdx + r15]
sub eax, ecx
jne 0x1400de00f
sub r9, rsi
test dl, dl
je 0x1400de00f
movzx eax, byte [r9 + r8 + 1]
inc r8
movzx ecx, byte [rax + r15]
movzx edx, byte [r8]
movzx eax, byte [rdx + r15]
sub eax, ecx
je 0x1400ddff0
test eax, eax
jne 0x1400ddfa1
lea rdi, str.sqlite_temp_master
jmp 0x1400ddec0
Function at 0x1400de1f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov esi, dword [rcx + 0x28]
xor r9d, r9d
xor ebx, ebx
mov rdi, r8
mov rbp, rdx
test esi, esi
jle 0x1400de2dd
mov qword [rsp + 0x48], r14
mov r14, qword [rcx + 0x20]
mov qword [rsp + 0x50], r15
lea r15, [0x1401d90d0]
nop word [rax + rax]
mov eax, ebx
xor eax, 1
cmp ebx, 2
cmovge eax, ebx
cdqe
shl rax, 5
mov r11, qword [rax + r14 + 0x18]
test rdi, rdi
je 0x1400de295
mov r10, qword [rax + r14]
mov r8, rdi
movzx edx, byte [rdi]
movzx eax, byte [r10]
movzx ecx, byte [rax + r15]
movzx eax, byte [rdx + r15]
sub eax, ecx
jne 0x1400de2b9
sub r10, rdi
nop word [rax + rax]
test dl, dl
je 0x1400de291
movzx eax, byte [r10 + r8 + 1]
inc r8
movzx ecx, byte [rax + r15]
movzx edx, byte [r8]
movzx eax, byte [rdx + r15]
sub eax, ecx
je 0x1400de270
jmp 0x1400de2b9
test eax, eax
jne 0x1400de2b9
lea rcx, [r11 + 0x20]
mov rdx, rbp
lea r8, [rsp + 0x40]
call fcn.14009bc30
test rax, rax
je 0x1400de2b6
mov r9, qword [rax + 0x10]
test r9, r9
jne 0x1400de2c3
jmp 0x1400de2b9
xor r9d, r9d
inc ebx
cmp ebx, esi
jl 0x1400de230
mov r14, qword [rsp + 0x48]
mov rax, r9
mov r15, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov rbx, qword [rsp + 0x58]
mov rax, r9
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x14010ecc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [rcx + 0xa0]
mov r10, rcx
test rax, rax
cmovne r10, rax
mov rax, qword [r10 + 0x238]
test rax, rax
je 0x14010ecee
cmp qword [rax], rdx
jne 0x14010ece8
cmp dword [rax + 0x18], r9d
je 0x14010ecf3
mov rax, qword [rax + 8]
jmp 0x14010ecd8
jmp fcn.14010e7c0
ret
Function at 0x14012d200
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, r8
mov byte [r8], 0
mov rbx, rdx
mov rdi, rcx
call fcn.14012d110
test eax, eax
jne 0x14012d238
mov byte [rsi], 3
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp qword [rdi + 0x2b0], 0
jne 0x14012d257
mov byte [rsi], 1
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r8, rbx
lea rdx, str.SELECT_pwsqlite_crypt__1_pw___isAdmin_FROM___w_.sqlite_user_WHERE_uname_2
mov rcx, rdi
call fcn.14012d050
mov rbx, rax
test rax, rax
jne 0x14012d284
lea eax, [rbx + 7]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r9d, dword [rdi + 0x2a4]
mov edx, 1
mov r8, qword [rdi + 0x2a8]
mov rcx, rbx
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call fcn.1400c0b10
mov r8, qword [rdi + 0x2b0]
mov r9d, 0xffffffff
mov byte [rsp + 0x28], 1
mov rcx, rbx
mov qword [rsp + 0x20], 0
lea edx, [r9 + 3]
call fcn.1400c0b10
mov rcx, rbx
call fcn.1400bf800
cmp eax, 0x64
jne 0x14012d386
xor edx, edx
mov rcx, rbx
call fcn.1400bffa0
mov rcx, rax
call fcn.1400b83b0
mov rcx, qword [rbx]
mov rdi, rax
cmp byte [rcx + 0x55], 0
jne 0x14012d315
mov edx, dword [rbx + 0x38]
cmp edx, 0xc0a
je 0x14012d315
mov eax, dword [rcx + 0x48]
and eax, edx
jmp 0x14012d31d
call fcn.1400980a0
mov rcx, qword [rbx]
mov dword [rbx + 0x38], eax
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x14012d32f
call qword [0x1402151a8]
test edi, edi
je 0x14012d386
mov edx, 1
mov rcx, rbx
call fcn.1400bffa0
mov rcx, rax
call fcn.1400b83b0
mov rcx, qword [rbx]
mov rdi, rax
cmp byte [rcx + 0x55], 0
jne 0x14012d366
mov edx, dword [rbx + 0x38]
cmp edx, 0xc0a
je 0x14012d366
mov eax, dword [rcx + 0x48]
and eax, edx
jmp 0x14012d36e
call fcn.1400980a0
mov rcx, qword [rbx]
mov dword [rbx + 0x38], eax
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x14012d380
call qword [0x1402151a8]
add dil, 2
jmp 0x14012d389
mov dil, 1
mov rcx, rbx
mov byte [rsi], dil
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.1400bea10
Function at 0x14012e250
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r15d, dword [rcx + 0x1c]
xor esi, esi
sub r15d, 6
xor ebx, ebx
movsxd rdi, r15d
mov r14, rcx
test r15d, r15d
jle 0x14012e2fc
mov r8, rdi
lea rcx, [rbp - 0x20]
shl r8, 2
call fcn.1401756a0
xor r8d, r8d
xor edx, edx
nop word [rax + rax]
cmp esi, dword [r14 + 0x1c]
ja 0x14012e469
cmp r8, rdi
jge 0x14012e2d3
nop
cmp rdx, 4
jge 0x14012e2d3
mov eax, esi
inc ebx
lea rcx, [rdx + rax*4]
mov eax, dword [rbp + r8*4 - 0x20]
inc r8
mov dword [r14 + rcx*4 + 0x20], eax
inc rdx
cmp r8, rdi
jl 0x14012e2b0
cmp rdx, 4
lea eax, [rsi + 1]
cmovne eax, esi
mov esi, eax
xor eax, eax
cmp rdx, 4
cmovne eax, ebx
mov ebx, eax
xor eax, eax
cmp rdx, 4
cmovne rax, rdx
mov rdx, rax
cmp r8, rdi
jl 0x14012e2a0
cmp esi, dword [r14 + 0x1c]
ja 0x14012e469
movsxd rax, ebx
lea r9, [0x1401d8680]
lea r10, str.cw
nop word [rax + rax]
movzx ecx, byte [rbp + rdi*4 - 0x23]
lea r9, [r9 + 4]
movzx edx, byte [rbp - 0x20]
xor dl, byte [rcx + r10]
mov byte [rbp - 0x20], dl
movzx ecx, byte [rbp + rdi*4 - 0x22]
xor dl, byte [r9 - 4]
movzx ecx, byte [rcx + r10]
xor byte [rbp - 0x1f], cl
movzx ecx, byte [rbp + rdi*4 - 0x21]
movzx ecx, byte [rcx + r10]
xor byte [rbp - 0x1e], cl
movzx ecx, byte [rbp + rdi*4 - 0x24]
mov byte [rbp - 0x20], dl
mov edx, 1
movzx ecx, byte [rcx + r10]
xor byte [rbp - 0x1d], cl
cmp r15d, 8
je 0x14012e3a0
cmp rdx, rdi
jge 0x14012e400
nop word [rax + rax]
mov ecx, dword [rbp + rdx*4 - 0x24]
xor dword [rbp + rdx*4 - 0x20], ecx
inc rdx
cmp rdx, rdi
jl 0x14012e380
jmp 0x14012e400
mov ecx, dword [rbp + rdx*4 - 0x24]
xor dword [rbp + rdx*4 - 0x20], ecx
inc rdx
cmp rdx, 4
jl 0x14012e3a0
movzx ecx, byte [rbp - 0x14]
mov edx, 5
movzx ecx, byte [rcx + r10]
xor byte [rbp - 0x10], cl
movzx ecx, byte [rbp - 0x13]
movzx ecx, byte [rcx + r10]
xor byte [rbp - 0xf], cl
movzx ecx, byte [rbp - 0x12]
movzx ecx, byte [rcx + r10]
xor byte [rbp - 0xe], cl
movzx ecx, byte [rbp - 0x11]
movzx ecx, byte [rcx + r10]
xor byte [rbp - 0xd], cl
cmp rdx, rdi
jge 0x14012e400
nop dword [rax + rax]
mov ecx, dword [rbp + rdx*4 - 0x24]
xor dword [rbp + rdx*4 - 0x20], ecx
inc rdx
cmp rdx, rdi
jl 0x14012e3f0
xor r8d, r8d
test r15d, r15d
jle 0x14012e45f
cmp esi, dword [r14 + 0x1c]
ja 0x14012e469
cmp r8, rdi
jge 0x14012e436
cmp rax, 4
jge 0x14012e436
mov ecx, esi
inc ebx
lea rdx, [rax + rcx*4]
mov ecx, dword [rbp + r8*4 - 0x20]
inc r8
mov dword [r14 + rdx*4 + 0x20], ecx
inc rax
cmp r8, rdi
jl 0x14012e413
cmp rax, 4
lea ecx, [rsi + 1]
cmovne ecx, esi
mov esi, ecx
xor ecx, ecx
cmp rax, 4
cmovne ecx, ebx
mov ebx, ecx
xor ecx, ecx
cmp rax, 4
cmovne rcx, rax
mov rax, rcx
cmp r8, rdi
jl 0x14012e408
cmp esi, dword [r14 + 0x1c]
jbe 0x14012e320
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x14012f870
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
lea ecx, [rdx + 1]
mov rbx, r8
mov eax, 0x4f7a09cd
imul ecx
imul ecx, ecx, 0x9ef4
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7fffff07
sub ecx, eax
lea r8d, [rcx + 0x7fffff07]
cmovns r8d, ecx
imul ecx, r8d, 0x9ef4
mov eax, r8d
sar eax, 8
mov byte [rbp - 0x18], al
mov eax, r8d
sar eax, 0x10
mov byte [rbp - 0x17], al
mov eax, r8d
sar eax, 0x18
mov byte [rbp - 0x16], al
mov eax, 0x4f7a09cd
imul r8d
mov byte [rbp - 0x19], r8b
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7fffff07
sub ecx, eax
lea r8d, [rcx + 0x7fffff07]
cmovns r8d, ecx
imul ecx, r8d, 0x9ef4
mov eax, r8d
sar eax, 8
mov byte [rbp - 0x14], al
mov eax, r8d
sar eax, 0x10
mov byte [rbp - 0x13], al
mov eax, r8d
sar eax, 0x18
mov byte [rbp - 0x12], al
mov eax, 0x4f7a09cd
imul r8d
mov byte [rbp - 0x15], r8b
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7fffff07
sub ecx, eax
mov eax, 0x4f7a09cd
lea r8d, [rcx + 0x7fffff07]
cmovns r8d, ecx
imul r8d
mov ecx, r8d
mov byte [rbp - 0x11], r8b
sar ecx, 8
mov byte [rbp - 0x10], cl
mov ecx, r8d
sar ecx, 0x10
sar edx, 0xe
mov byte [rbp - 0xf], cl
mov eax, edx
shr eax, 0x1f
mov ecx, r8d
add edx, eax
sar ecx, 0x18
imul eax, edx, 0x7fffff07
mov byte [rbp - 0xe], cl
imul ecx, r8d, 0x9ef4
sub ecx, eax
lea edx, [rcx + 0x7fffff07]
cmovns edx, ecx
mov eax, edx
mov byte [rbp - 0xd], dl
sar eax, 8
mov byte [rbp - 0xc], al
mov eax, edx
sar eax, 0x10
lea rcx, [rbp - 9]
sar edx, 0x18
mov byte [rbp - 0xb], al
xor eax, eax
mov byte [rbp - 0xa], dl
lea rdx, [rbp - 0x19]
mov dword [rbp - 9], 0x67452301
mov dword [rbp - 5], 0xefcdab89
lea r8d, [rax + 0x10]
mov dword [rbp - 1], 0x98badcfe
mov qword [rbp + 3], 0x10325476
mov dword [rbp + 0xb], eax
call fcn.14012eec0
lea rdx, [rbp - 9]
mov rcx, rbx
call fcn.14012ed10
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rbp
ret
Function at 0x14012fa00
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x3f]
sub rsp, 0xc0
movzx eax, byte [r9]
mov rsi, rcx
mov byte [rbp - 0x51], al
xor ecx, ecx
movzx eax, byte [r9 + 1]
test r8d, r8d
mov byte [rbp - 0x50], al
mov edi, ecx
movzx eax, byte [r9 + 2]
sete dil
mov byte [rbp - 0x4f], al
mov ebx, edx
movzx eax, byte [r9 + 3]
mov r14d, r8d
mov byte [rbp - 0x4e], al
lea r8d, [rcx + 0x18]
movzx eax, byte [r9 + 4]
mov byte [rbp - 0x4d], al
movzx eax, byte [r9 + 5]
mov byte [rbp - 0x4c], al
movzx eax, byte [r9 + 6]
mov byte [rbp - 0x4b], al
movzx eax, byte [r9 + 7]
mov byte [rbp - 0x4a], al
movzx eax, byte [r9 + 8]
mov byte [rbp - 0x49], al
movzx eax, byte [r9 + 9]
mov byte [rbp - 0x48], al
movzx eax, byte [r9 + 0xa]
mov byte [rbp - 0x47], al
movzx eax, byte [r9 + 0xb]
mov byte [rbp - 0x46], al
movzx eax, byte [r9 + 0xc]
mov byte [rbp - 0x45], al
movzx eax, byte [r9 + 0xd]
mov byte [rbp - 0x44], al
movzx eax, byte [r9 + 0xe]
mov byte [rbp - 0x43], al
movzx eax, byte [r9 + 0xf]
mov byte [rbp - 0x42], al
mov eax, edx
sar eax, 8
mov byte [rbp - 0x40], al
mov eax, edx
sar eax, 0x10
mov byte [rbp - 0x3f], al
mov eax, edx
sar eax, 0x18
lea rdx, [rbp - 0x51]
mov dword [rbp - 0xd], ecx
lea rcx, [rbp - 0x21]
mov byte [rbp - 0x3e], al
mov byte [rbp - 0x41], bl
mov dword [rbp - 0x3d], 0x546c4173
mov dword [rbp - 0x21], 0x67452301
mov dword [rbp - 0x1d], 0xefcdab89
mov dword [rbp - 0x19], 0x98badcfe
mov qword [rbp - 0x15], 0x10325476
call fcn.14012eec0
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 0x51]
call fcn.14012ed10
lea r8, [rbp - 0x39]
mov edx, ebx
call fcn.14012f870
mov rcx, qword [rsi + 0x30]
lea rax, [rbp - 0x39]
lea r9, [rbp - 0x51]
mov qword [rsp + 0x28], rax
mov r8d, edi
call fcn.14012d750
mov eax, dword [rbp + 0x77]
mov rcx, qword [rsi + 0x30]
mov r9, qword [rbp + 0x7f]
mov rdx, qword [rbp + 0x6f]
lea r8d, [rax*8]
test r14d, r14d
je 0x14012fb5a
call fcn.14012d9a0
jmp 0x14012fb5f
call fcn.14012dde0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14015ac28
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14015ac3b
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.140164aec
lea rdx, [0x14020ec90]
lea rcx, [rsp + 0x20]
call fcn.1401760d0
int3

Function at 0x14016547c
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x14021c998]
xor edx, edx
jmp fcn.14015ac28

Function at 0x140165e0c
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x14021c998]
jmp fcn.14015ac28

Function at 0x140171aa8
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x140171b64]
mov r9, qword [r9 + 8]
jmp fcn.140162ca0

Function at 0x140171b3c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x140171b74]
mov r9, qword [r9 + 8]
jmp fcn.140162ca0

Function at 0x140180c94
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140180cb4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140180d5c
or eax, 0xffffffff
jmp 0x140180cb6
xor eax, eax
add rsp, 0x28
ret
Function at 0x1401818cc
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x1402120d8]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor esi, esi
mov rbx, rdx
test rdx, rdx
jne 0x14018160b
call fcn.140180dcc
mov dword [rax], reloc.WLDAP32.dll_Ordinal_22
call fcn.14017a800
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1401571e0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
test rcx, rcx
je 0x1401815d2
mov dword [rsp + 0x28], esi
lea r8, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140181679
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x14018164c
cmp eax, 3
jbe 0x140181669
cmp eax, 8
je 0x140181659
cmp eax, 0x12
je 0x140181669
call fcn.140180dcc
mov dword [rax], reloc.WLDAP32.dll_Ordinal_22
jmp 0x1401815e2
call fcn.140180dcc
mov dword [rax], reloc.WSOCK32.dll_ioctlsocket
jmp 0x1401815e2
call fcn.140180dcc
mov dword [rax], 2
jmp 0x1401815e2
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x34]
cmp eax, 0x80
cmove eax, esi
mov dword [rbx], eax
call fcn.140181814
lea rcx, [rsp + 0x3c]
mov qword [rbx + 8], rax
call fcn.140181814
lea rcx, [rsp + 0x44]
mov qword [rbx + 0x10], rax
call fcn.140181814
mov qword [rbx + 0x18], rax
lea rcx, [rbx + 0x24]
mov eax, dword [rsp + 0x50]
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov dword [rbx + 0x20], eax
call fcn.14018f298
test eax, eax
jne 0x1401816d7
mov rax, rdi
jmp 0x1401815e6
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14017a850
int3
jmp 0x1401815a4
Function at 0x1401818d4
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x1402120d8]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor edi, edi
mov rbx, rdx
test rcx, rcx
jne 0x140181749
call fcn.140180dcc
mov dword [rax], reloc.WLDAP32.dll_Ordinal_22
call fcn.14017a800
or eax, 0xffffffff
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1401571e0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x290
pop rdi
ret
cmp rcx, 0xffffffffffffffff
je 0x140181715
test rbx, rbx
je 0x140181715
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1401817a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x14018177d
cmp eax, 3
jbe 0x140181797
cmp eax, 8
je 0x14018178a
cmp eax, 0x12
je 0x140181797
call fcn.140180dcc
mov dword [rax], reloc.WLDAP32.dll_Ordinal_22
jmp 0x140181725
call fcn.140180dcc
mov dword [rax], reloc.WSOCK32.dll_ioctlsocket
jmp 0x140181725
call fcn.140180dcc
mov dword [rax], 2
jmp 0x140181725
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x34]
cmp eax, 0x80
cmove eax, edi
mov dword [rbx], eax
call fcn.140181814
lea rcx, [rsp + 0x3c]
mov qword [rbx + 8], rax
call fcn.140181814
lea rcx, [rsp + 0x44]
mov qword [rbx + 0x10], rax
call fcn.140181814
mov qword [rbx + 0x18], rax
lea rcx, [rbx + 0x24]
mov eax, dword [rsp + 0x50]
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov dword [rbx + 0x20], eax
call fcn.14018f298
test eax, eax
je 0x140181728
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14017a850
int3
jmp 0x1401816ec
Function at 0x1400061c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov esi, r9d
mov ebp, r8d
mov rdi, rcx
mov byte [rcx + 0xc], 0xff
mov dword [rcx + 0x38], edx
mov dword [rcx + 0x3c], r8d
mov dword [rcx + 0x40], r9d
mov byte [rcx + 0x44], 0
xor r14d, r14d
mov dword [rcx + 8], r14d
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x18], r14
mov dword [rcx + 0x20], r14d
mov dword [rcx + 0x24], 5
mov dword [rcx + 0x28], 1
mov dword [rcx + 0x2c], 1
mov dword [rcx + 0x30], 1
mov dword [rcx + 0x34], 1
lea rax, [0x140290d70]
mov qword [rcx], rax
mov ecx, edx
sub ecx, 6
je 0x14000626f
cmp ecx, 1
je 0x140006266
mov dword [rsp + 0x20], edx
lea r9, str.Called_with_unsupported_type:__u.
lea r8, [0x140346534]
lea edx, [r14 + 5]
mov rcx, qword [0x14037a480]
call fcn.140016400
mov eax, r14d
jmp 0x140006276
lea rax, [rdi + 0x1d0]
jmp 0x140006276
lea rax, [rdi + 0x160]
mov qword [rdi + 0x48], rax
lea rcx, [rdi + 0x50]
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x20], 0xff
movzx ebx, byte [rsp + 0x88]
movzx r9d, bl
mov r8d, esi
mov edx, ebp
call fcn.1400086c0
nop
lea rcx, [rdi + 0x160]
mov byte [rsp + 0x28], 0xff
mov byte [rsp + 0x20], bl
mov r9d, esi
mov r8d, ebp
mov edx, 2
call fcn.140006fa0
nop
mov byte [rdi + 0x1dc], 0xff
mov dword [rdi + 0x208], 3
mov dword [rdi + 0x20c], ebp
mov dword [rdi + 0x210], esi
mov byte [rdi + 0x214], 0
mov dword [rdi + 0x1d8], r14d
mov qword [rdi + 0x1e0], r14
mov qword [rdi + 0x1e8], r14
mov dword [rdi + 0x1f0], r14d
mov dword [rdi + 0x1f4], 5
mov dword [rdi + 0x1f8], 1
mov dword [rdi + 0x1fc], 1
mov dword [rdi + 0x200], 1
mov dword [rdi + 0x204], 1
lea rax, [0x140290ed0]
mov qword [rdi + 0x1d0], rax
mov qword [rdi + 0x218], r14
mov qword [rdi + 0x220], r14
mov qword [rdi + 0x228], r14
mov byte [rdi + 0x230], bl
lea rsi, [rdi + 0x238]
mov qword [rsp + 0x30], rsi
mov qword [rsi + 0x38], r14
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x14000638f
mov rax, qword [rcx]
mov rdx, rsi
mov rax, qword [rax]
call qword [case.0x1401289aa.0]
mov qword [rsi + 0x38], rax
mov byte [rdi + 0x278], 1
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1400063b6
mov rax, qword [rcx]
cmp rcx, rbx
setne dl
mov rax, qword [rax + 0x20]
call qword [case.0x1401289aa.0]
mov qword [rbx + 0x38], r14
mov rax, rdi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret