joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009a2b0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov r14, r9
mov r15, r8
mov rdi, rcx
xor ebp, ebp
mov ebx, ebp
mov rsi, qword [rdx]
mov qword [rsp + 0x50], rbp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14009a304
mov eax, ebp
mov rbx, qword [rsp + 0x50]
test eax, eax
je 0x14009a3ae
mov qword [rsp + 0x58], rbp
lea rax, [rsp + 0x98]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14009a364
mov eax, ebp
test rbx, rbx
je 0x14009a35f
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x58]
test eax, eax
je 0x14009a3ae
mov qword [rsp + 0x60], rbp
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14009a3a5
mov eax, ebp
test rbx, rbx
je 0x14009a3a0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x60]
test eax, eax
je 0x14009a3ae
xor dil, dil
jmp 0x14009a3e3
mov rax, qword [r14]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x28], 8
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0xb
xor r8d, r8d
mov rdx, qword [r15]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete dil
test rbx, rbx
je 0x14009a3f1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, dil
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14009a410
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x14024cdb8]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x70]
call fcn.140182d06
mov r9d, 0x104
lea r8, [rbp - 0x70]
mov edx, 0x5a
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea r14, str.DEFAULT_VALUE
lea rdx, [rbp - 0x70]
test eax, eax
cmove rdx, r14
xor esi, esi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], si
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x14009a4b0
lea rcx, [rsp + 0x50]
call fcn.140020930
nop
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1a0]
call fcn.140182d06
mov r9d, 0x104
lea r8, [rbp + 0x1a0]
mov edx, 0x59
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea rdx, [rbp + 0x1a0]
test eax, eax
cmove rdx, r14
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], si
nop dword [rax]
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x14009a520
mov r8, rbx
lea rcx, [rsp + 0x30]
call fcn.140020930
nop
mov edx, 0x2d
lea rcx, [rsp + 0x30]
call fcn.140023350
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [rbp - 0x80], xmm1
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], si
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x70]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.14002bd90
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x14009a5ca
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009a5c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009a5c4
call qword [0x1401cdd00]
int3
call fcn.1401816cc
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14009a60f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009a60a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009a60a
call qword [0x1401cdd00]
int3
call fcn.1401816cc
mov rax, rdi
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.140181670
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14009aae0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x8a0
mov rax, qword [0x14024cdb8]
xor rax, rsp
mov qword [rsp + 0x890], rax
mov ebx, edx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
xor esi, esi
mov dword [rsp + 0x30], esi
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x90]
call fcn.140182d06
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14009ab9e
mov qword [rsp + 0x38], rsi
movdqa xmm0, xmmword [0x140209d20]
movdqu xmmword [rsp + 0x48], xmm0
lea rax, [rsp + 0x90]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14009ab70
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x38]
call fcn.140020930
mov byte [rsp + 0x58], 1
lea rax, [rsp + 0x38]
mov ebx, 5
jmp 0x14009abb0
mov byte [rsp + 0x88], sil
lea rax, [rsp + 0x68]
mov ebx, 6
mov byte [rdi + 0x20], 0
cmp byte [rax + 0x20], 0
je 0x14009abdb
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov byte [rdi + 0x20], 1
test bl, 2
je 0x14009abf7
and ebx, 0xfffffffd
cmp byte [rsp + 0x88], 0
je 0x14009abf7
lea rcx, [rsp + 0x68]
call fcn.1400208c0
test bl, 1
je 0x14009ac48
cmp byte [rsp + 0x58], 0
je 0x14009ac48
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x14009ac48
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009ac43
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009ac43
call qword [0x1401cdd00]
int3
call fcn.1401816cc
mov rax, rdi
mov rcx, qword [rsp + 0x890]
xor rcx, rsp
call fcn.140181670
lea r11, [rsp + 0x8a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14009b150
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x30], 0
jne 0x14009b16b
mov rax, qword [rcx + 0x40]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov rsi, rcx
cmp qword [rcx + 0x18], 8
jb 0x14009b178
mov rsi, qword [rcx]
lea rdx, [rcx + 0x20]
cmp qword [rdx + 0x18], 8
jb 0x14009b186
mov rdx, qword [rdx]
xor edi, edi
mov ebx, edi
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14009b1ba
mov eax, edi
mov rbx, qword [rsp + 0x60]
test eax, eax
jne 0x14009b203
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x50], 8
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14009b203
cmp dword [rsp + 0x58], 0xb
jne 0x14009b203
mov rdi, qword [rsp + 0x68]
test rbx, rbx
je 0x14009b211
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rdi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400e7bc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push r15
sub rsp, 0x68
mov r15, rdx
mov rdi, rcx
movzx edx, byte [rdx]
movzx eax, dl
cmp dl, 0xad
jne 0x1400e7bde
movzx eax, byte [r15 + 2]
cmp al, 0xae
jne 0x1400e7be8
mov rax, qword [r15 + 0x20]
jmp 0x1400e7bf8
cmp al, 0x88
jne 0x1400e7d77
mov rax, qword [r15 + 0x20]
mov rax, qword [rax + 0x20]
movsxd rcx, dword [rax]
cmp ecx, 1
je 0x1400e7d77
mov dword [r8], 0
cmp dl, 0x88
jne 0x1400e7c22
mov rdx, r15
mov rcx, rdi
add rsp, 0x68
pop r15
pop rdi
jmp fcn.1400e59f0
mov eax, dword [rdi + 0x38]
mov qword [rsp + 0x60], r12
mov r12, rcx
mov qword [rsp + 0x58], r13
lea r13d, [rax + 1]
add eax, ecx
mov dword [rsp + 0x88], r13d
mov dword [rdi + 0x38], eax
test ecx, ecx
jle 0x1400e7d62
mov qword [rsp + 0x80], rbx
lea rcx, [0x1400e3e00]
mov qword [rsp + 0x90], rbp
mov ebp, r13d
mov qword [rsp + 0x50], r14
lea r13, [fcn.1400e3fb0]
xor r14d, r14d
mov qword [rsp + 0x98], rsi
lea edx, [r14 + 2]
cmp byte [rdi + 0x23], 0
mov rax, qword [r15 + 0x20]
mov rbx, qword [rax + r14 + 8]
je 0x1400e7cd0
mov word [rsp + 0x44], dx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x48], 0
test rbx, rbx
je 0x1400e7cc0
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400dd630
cmp word [rsp + 0x44], 0
je 0x1400e7cd0
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call fcn.1400e9350
jmp 0x1400e7d10
mov rsi, qword [rdi]
test rbx, rbx
je 0x1400e7cec
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.1400e2ad0
mov rbx, rax
cmp byte [rsi + 0x61], 0
jne 0x1400e7d00
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call fcn.1400e9600
test rbx, rbx
je 0x1400e7d10
mov rdx, rbx
mov rcx, rsi
call fcn.1400e28a0
inc ebp
lea rcx, [0x1400e3e00]
add r14, 0x20
mov edx, 2
sub r12, 1
jne 0x1400e7c80
mov eax, dword [rsp + 0x88]
mov r14, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x80]
mov r12, qword [rsp + 0x60]
mov r13, qword [rsp + 0x58]
add rsp, 0x68
pop r15
pop rdi
ret
mov r12, qword [rsp + 0x60]
mov eax, r13d
mov r13, qword [rsp + 0x58]
add rsp, 0x68
pop r15
pop rdi
ret
mov rdx, r15
mov rcx, rdi
add rsp, 0x68
pop r15
pop rdi
jmp fcn.1400e94d0

Function at 0x1400eb410
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ebx, r8d
lea r9, str.sqlite_master
mov rdi, rdx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdx
mov r8, rdx
lea rdx, str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
mov rsi, rcx
call fcn.1400f3180
test ebx, ebx
jne 0x1400eb464
mov r9, rdi
lea r8, str.sqlite_master
lea rdx, str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
mov rcx, rsi
call fcn.1400f3180
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400f37e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x28
xor r11d, r11d
mov rdi, r8
mov ebx, r11d
mov r14, rdx
mov rsi, rcx
cmp dword [rcx + 0x28], ebx
jle 0x1400f38e9
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r12
lea r12, str.main
mov qword [rsp + 0x20], r15
lea r15, [0x1401d9cc0]
nop
mov rax, qword [rsi + 0x20]
mov r10d, ebx
xor r10d, 1
cmp ebx, 2
cmovge r10d, ebx
movsxd rcx, r10d
shl rcx, 5
mov rbp, qword [rcx + rax + 0x18]
test rdi, rdi
je 0x1400f3861
mov r8, qword [rcx + rax]
mov r9, rdi
sub r9, r8
nop dword [rax]
movzx ecx, byte [r8]
movzx eax, byte [r9 + r8]
cmp ecx, eax
jne 0x1400f389c
test ecx, ecx
jne 0x1400f38aa
lea rcx, [rbp + 0x20]
xor r8d, r8d
mov rdx, r14
call fcn.1400a6aa0
mov r11, qword [rax + 0x10]
test r11, r11
jne 0x1400f3880
inc ebx
cmp ebx, dword [rsi + 0x28]
jl 0x1400f3820
mov r12, qword [rsp + 0x60]
mov rax, r11
mov rbp, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
movzx edx, byte [rax + r15]
movzx ecx, byte [rcx + r15]
cmp ecx, edx
jne 0x1400f38af
inc r8
jmp 0x1400f3850
test r10d, r10d
jne 0x1400f3879
mov r9, rdi
mov rax, r12
sub r9, r12
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [r9 + rax]
cmp edx, ecx
jne 0x1400f38d5
test edx, edx
je 0x1400f3861
inc rax
jmp 0x1400f38c0
movzx r8d, byte [rcx + r15]
movzx edx, byte [rdx + r15]
cmp edx, r8d
jne 0x1400f3879
inc rax
jmp 0x1400f38c0
mov rax, r11
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14010a0d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x38
mov rsi, qword [rcx + 0x98]
mov rbx, rcx
mov rdi, qword [rcx + 0x10]
mov r12, qword [rcx]
test rsi, rsi
je 0x14010a2c8
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], r13
xor r13d, r13d
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x30], r15
nop dword [rax + rax]
movsxd rbp, dword [rsi + 0x10]
movzx eax, byte [rbx + 0x1f]
mov r14d, dword [rsi + 0x14]
shl rbp, 5
add rbp, qword [r12 + 0x20]
test al, al
jne 0x14010a132
inc dword [rbx + 0x38]
mov r15d, dword [rbx + 0x38]
jmp 0x14010a142
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov r15d, dword [rbx + rax*4 + 0xd4]
movsxd rcx, dword [rdi + 0x90]
lea r8d, [r14 + 2]
lea edx, [rcx + 7]
cmp dword [rdi + 0x94], ecx
jg 0x14010a16f
mov r9d, edx
mov dword [rsp + 0x20], r14d
mov edx, 0x37
mov rcx, rdi
call fcn.1400c7e50
jmp 0x14010a19d
lea eax, [rcx + 1]
mov dword [rdi + 0x90], eax
lea rcx, [rcx + rcx*2]
mov rax, qword [rdi + 0x88]
mov dword [rax + rcx*8], 0x37
mov dword [rax + rcx*8 + 4], r8d
mov dword [rax + rcx*8 + 8], edx
mov dword [rax + rcx*8 + 0xc], r14d
mov qword [rax + rcx*8 + 0x10], r13
mov r9, qword [rbp + 0x18]
xor edx, edx
mov r8d, dword [rsi + 0x10]
mov rcx, rbx
mov dword [rsp + 0x20], 0x61
mov r9, qword [r9 + 0x68]
call fcn.140109640
mov eax, dword [rdi + 0x90]
add eax, 5
cmp eax, dword [rdi + 0x94]
jle 0x14010a1dc
mov rcx, rdi
call fcn.1400c7cc0
test eax, eax
jne 0x14010a2b4
movsxd rax, dword [rdi + 0x90]
lea rcx, [rax + rax*2]
mov rax, qword [rdi + 0x88]
mov dword [rax + rcx*8 + 8], 2
mov byte [rax + rcx*8], 0x33
mov dword [rax + rcx*8 + 4], r13d
lea rdx, [rax + rcx*8]
mov eax, dword [rdi + 0x90]
mov dword [rdx + 0xc], r13d
lea ecx, [r14 + 1]
mov byte [rdx + 1], r13b
add eax, 2
mov dword [rdx + 8], eax
lea eax, [r14 - 1]
mov qword [rdx + 0x10], r13
mov word [rdx + 2], r13w
mov qword [rdx + 0x18], 0x78
mov qword [rdx + 0x20], r13
mov qword [rdx + 0x28], r13
mov qword [rdx + 0x30], 0x5b
mov qword [rdx + 0x38], 2
mov qword [rdx + 0x40], r13
mov qword [rdx + 0x48], 0x79
mov qword [rdx + 0x50], r13
mov qword [rdx + 0x58], r13
mov qword [rdx + 0x60], 0x74
mov qword [rdx + 0x68], r13
mov qword [rdx + 0x70], r13
add dword [rdi + 0x90], 5
mov dword [rdx + 0x34], eax
mov eax, 8
mov word [rdx + 0x4a], ax
mov dword [rdx + 4], ecx
mov dword [rdx + 0x20], ecx
mov dword [rdx + 0x3c], r15d
mov dword [rdx + 0x50], r15d
mov dword [rdx + 0x54], ecx
test r15d, r15d
je 0x14010a2a8
movzx eax, byte [rbx + 0x1f]
cmp al, 8
jae 0x14010a2a8
mov dword [rbx + rax*4 + 0xd4], r15d
inc byte [rbx + 0x1f]
mov rsi, qword [rsi]
test rsi, rsi
jne 0x14010a110
mov r15, qword [rsp + 0x30]
mov r13, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov r14, qword [rsp + 0x70]
add rsp, 0x38
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14015a1a0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x50], rax
mov rdi, rax
test rax, rax
jne 0x14015a1dd
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x40]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x98], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x60], r14
cmovo rax, r15
mov rcx, rax
call fcn.140181e64
mov r14, rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x14015a2dc
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0xa0], r12
mov r12, r14
mov qword [rsp + 0x68], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
nop word [rax + rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.140181e64
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x40]
inc r14d
cmp r14d, eax
jne 0x14015a250
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x90]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x40]
mov rdx, r14
call fcn.14001ff20
mov esi, eax
cmp dword [rsp + 0x40], ebx
je 0x14015a31b
mov rdi, r14
mov rcx, qword [rdi]
test rcx, rcx
je 0x14015a31b
call fcn.1401816cc
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x40]
jne 0x14015a302
mov rcx, r14
call fcn.1401816cc
mov r14, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x98]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret

Function at 0x14015a5e0
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, byte [rdx]
movabs r9, 0x100000001b3
movzx eax, byte [rdx + 1]
xor r8, rcx
movzx ecx, byte [rdx + 2]
imul r8, r9
xor rax, r8
imul rax, r9
xor rax, rcx
movzx ecx, byte [rdx + 3]
imul rax, r9
xor rax, rcx
imul rax, r9
ret
mov rdx, rcx
movabs rcx, 0xcbf29ce484222325
jmp 0x14015a5a0
Function at 0x14016f610
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov rcx, qword [rdx + 0x10]
movabs rax, 0xaaaaaaaaaaaaaaab
add rcx, 2
mov r8b, 0x3d
mul rcx
mov rcx, rdi
shr rdx, 1
shl rdx, 2
call fcn.140060330
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov r10d, r9d
mov esi, r9d
mov rcx, rbx
cmp rdx, 0x10
jb 0x14016f665
mov rcx, qword [rbx]
mov r8, qword [rbx + 0x10]
add r8, rcx
cmp rdx, 0x10
jb 0x14016f675
mov rbx, qword [rbx]
cmp rbx, r8
je 0x14016f73b
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], r14
lea r14, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop
movsx eax, byte [rbx]
add r10d, 8
shl esi, 8
movzx ecx, al
or esi, ecx
cmp r10d, 6
jl 0x14016f6ec
mov eax, 0xaaaaaaab
movsxd rcx, r10d
mul r10d
shr edx, 2
imul eax, edx, 0xfffffffa
mov r11d, edx
add r10d, eax
nop dword [rax]
sub rcx, 6
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14016f6d1
mov rdx, qword [rdi]
mov rax, rsi
shr rax, cl
and eax, 0x3f
movzx eax, byte [rax + r14]
mov byte [rdx + r9], al
inc r9
sub r11, 1
jne 0x14016f6c0
inc rbx
cmp rbx, r8
jne 0x14016f690
mov rbp, qword [rsp + 0x30]
test r10d, r10d
jle 0x14016f723
mov ecx, 6
sub ecx, r10d
shl esi, cl
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14016f715
mov rcx, qword [rdi]
mov eax, esi
and eax, 0x3f
movzx eax, byte [rax + r14]
mov byte [rcx + r9], al
mov r14, qword [rsp + 0x38]
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov rax, rdi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140171480
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, dword [rdx + 0x14]
mov rdi, rcx
mov ebp, dword [rdx + 0x18]
lea rcx, [rdx + 0x1c]
mov eax, esi
mov rbx, rdx
shr eax, 3
and eax, 0x3f
lea r8d, [rax + 1]
mov byte [rax + rdx + 0x1c], 0x80
mov eax, r8d
xor edx, edx
add rcx, rax
cmp r8d, 0x38
jbe 0x1401714f0
mov r8d, 0x40
sub r8, rax
call fcn.140182d06
mov rcx, rbx
call fcn.140171670
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx + 0x1c], xmm0
movups xmmword [rbx + 0x2c], xmm0
movups xmmword [rbx + 0x3c], xmm0
mov qword [rbx + 0x4c], rax
jmp 0x1401714fe
mov r8d, 0x38
sub r8, rax
call fcn.140182d06
mov eax, ebp
mov byte [rbx + 0x57], bpl
shr eax, 0x18
mov rcx, rbx
mov byte [rbx + 0x54], al
mov eax, ebp
shr eax, 0x10
mov byte [rbx + 0x55], al
mov eax, ebp
shr eax, 8
mov byte [rbx + 0x56], al
mov eax, esi
shr eax, 0x18
mov byte [rbx + 0x58], al
mov eax, esi
shr eax, 0x10
mov byte [rbx + 0x59], al
mov eax, esi
shr eax, 8
mov byte [rbx + 0x5a], al
mov byte [rbx + 0x5b], sil
call fcn.140171670
movzx eax, byte [rbx + 3]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov byte [rdi], al
movzx eax, byte [rbx + 2]
mov byte [rdi + 1], al
movzx eax, byte [rbx + 1]
mov byte [rdi + 2], al
movzx eax, byte [rbx]
mov byte [rdi + 3], al
movzx eax, byte [rbx + 7]
mov byte [rdi + 4], al
movzx eax, byte [rbx + 6]
mov byte [rdi + 5], al
movzx eax, byte [rbx + 5]
mov byte [rdi + 6], al
movzx eax, byte [rbx + 4]
mov byte [rdi + 7], al
movzx eax, byte [rbx + 0xb]
mov byte [rdi + 8], al
movzx eax, byte [rbx + 0xa]
mov byte [rdi + 9], al
movzx eax, byte [rbx + 9]
mov byte [rdi + 0xa], al
movzx eax, byte [rbx + 8]
mov byte [rdi + 0xb], al
movzx eax, byte [rbx + 0xf]
mov byte [rdi + 0xc], al
movzx eax, byte [rbx + 0xe]
mov byte [rdi + 0xd], al
movzx eax, byte [rbx + 0xd]
mov byte [rdi + 0xe], al
movzx eax, byte [rbx + 0xc]
mov byte [rdi + 0xf], al
movzx eax, byte [rbx + 0x13]
mov byte [rdi + 0x10], al
movzx eax, byte [rbx + 0x12]
mov byte [rdi + 0x11], al
movzx eax, byte [rbx + 0x11]
mov byte [rdi + 0x12], al
movzx eax, byte [rbx + 0x10]
mov rbx, qword [rsp + 0x30]
mov byte [rdi + 0x13], al
add rsp, 0x20
pop rdi
ret
Function at 0x14017d7b4
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [rcx]
mov rdi, rdx
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14017d7e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14017d7e4
xor al, al
jmp 0x14017d7f4
mov ecx, dword [rsp + 0x30]
mov al, 1
shl rcx, 0x20
add rcx, rbx
mov qword [rdi], rcx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14017d838
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
mov rbx, r9
and dword [rsp + 0x58], 0
lea r9, [rsp + 0x58]
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x58]
test eax, eax
mov dword [rbx], ecx
setne al
add rsp, 0x30
pop rbx
ret
cmp r8d, dword [0x14024cd88]
cmova r8d, dword [0x14024cd88]
jmp 0x14017d838

Function at 0x14017d86c
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
mov rbx, r9
and dword [rsp + 0x58], 0
lea r9, [rsp + 0x58]
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x58]
test eax, eax
mov dword [rbx], ecx
setne al
add rsp, 0x30
pop rbx
ret
cmp r8d, dword [0x14024cd88]
cmova r8d, dword [0x14024cd88]
jmp 0x14017d838

Function at 0x14017d8e8
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rbx, rdx
mov rdi, rcx
call fcn.14017d880
test al, al
je 0x14017d920
cmp qword [rsp + 0x40], rbx
jne 0x14017d920
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
jmp 0x14017d922
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14017d99c
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
cmp r8d, dword [0x14024cd88]
mov rbx, r9
mov rcx, qword [rcx]
lea r9, [rsp + 0x50]
cmova r8d, dword [0x14024cd88]
and dword [rsp + 0x50], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x50]
test eax, eax
mov dword [rbx], ecx
setne al
add rsp, 0x30
pop rbx
ret

Function at 0x14017f6a4
Capabilities:
Get file attributes

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x18], 8
jb 0x14017f6b2
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
shr eax, 4
and al, 1
add rsp, 0x28
ret

Function at 0x14017f738
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x18], 8
jb 0x14017f746
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
add rsp, 0x28
ret

Function at 0x14017f758
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
cmp qword [rdx + 0x18], 8
jb 0x14017f766
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 8
jb 0x14017f770
mov rcx, qword [rcx]
mov r8d, 9
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne al
add rsp, 0x28
ret