joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400053e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
lea r10, [rcx + 0x40]
lea rbx, [rdx + 0x10]
mov rsi, rcx
mov r11, r10
sub rsi, rdx
mov rdi, rdx
sub r11, rcx
mov r14, rcx
mov r9b, 0x10
sub r10, rdx
mov r8, rbx
nop word [rax + rax]
movzx eax, byte [r10 + r8 - 1]
dec r8
lea rcx, [rsi + r8]
mov byte [rsi + r8], al
xor byte [r8], al
movzx eax, byte [rcx + r11 + 0x10]
mov byte [rcx + 0x10], al
add r9b, 0xff
jne 0x140005420
movzx ecx, byte [rdx + 1]
movzx eax, byte [rdx + 0xd]
mov byte [rdx + 1], al
movzx eax, byte [rdx + 9]
mov byte [rdx + 0xd], al
movzx eax, byte [rdx + 5]
mov byte [rdx + 5], cl
movzx ecx, byte [rdx + 2]
mov byte [rdx + 9], al
movzx eax, byte [rdx + 0xa]
mov byte [rdx + 2], al
movzx eax, byte [rdx + 7]
mov byte [rdx + 0xa], cl
movzx ecx, byte [rdx + 3]
mov byte [rdx + 3], al
movzx eax, byte [rdx + 0xb]
mov byte [rdx + 7], al
movzx eax, byte [rdx + 0xf]
mov byte [rdx + 0xf], cl
movzx ecx, byte [rdx + 6]
mov byte [rdx + 0xb], al
movzx eax, byte [rdx + 0xe]
mov byte [rdx + 0xe], cl
mov rcx, rdx
mov byte [rdx + 6], al
call fcn.1400048f0
mov byte [rsp + 0x40], pe_nt_image_headers64
mov bpl, 0xd
test bpl, 1
je 0x1400054d2
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.140004f70
mov dl, 0x10
mov rcx, rbx
nop
movzx eax, byte [rcx + rsi + 0xf]
lea rcx, [rcx - 1]
xor byte [rcx], al
add dl, 0xff
jne 0x1400054c0
jmp 0x1400054f0
mov dl, 0x10
mov rcx, rbx
nop word [rax + rax]
movzx eax, byte [rcx + rsi - 1]
lea rcx, [rcx - 1]
xor byte [rcx], al
add dl, 0xff
jne 0x1400054e0
mov rcx, rdi
call fcn.140004a70
movzx eax, byte [rdi + 0xd]
movzx ecx, byte [rdi + 1]
mov byte [rdi + 1], al
movzx eax, byte [rdi + 9]
mov r10b, 0x10
mov byte [rdi + 0xd], al
movzx eax, byte [rdi + 5]
mov byte [rdi + 5], cl
movzx ecx, byte [rdi + 2]
mov byte [rdi + 9], al
movzx eax, byte [rdi + 0xa]
mov byte [rdi + 2], al
movzx eax, byte [rdi + 7]
mov byte [rdi + 0xa], cl
movzx ecx, byte [rdi + 3]
mov byte [rdi + 3], al
movzx eax, byte [rdi + 0xb]
mov byte [rdi + 7], al
movzx eax, byte [rdi + 0xf]
mov byte [rdi + 0xf], cl
movzx ecx, byte [rdi + 6]
mov byte [rdi + 0xb], al
movzx eax, byte [rdi + 0xe]
mov byte [rdi + 6], al
mov byte [rdi + 0xe], cl
mov r9, rbx
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r9 - 1]
lea r9, [r9 - 1]
add r10b, 0xff
xor cl, 0x63
rol cl, 1
movzx eax, cl
rol al, 2
movzx r8d, al
rol r8b, 3
xor r8b, cl
xor r8b, al
je 0x1400055ca
mov al, 1
xor dl, dl
nop dword [rax]
cmp al, r8b
je 0x1400055a6
movzx ecx, al
add al, al
test cl, cl
jns 0x1400055a0
xor al, 0x1b
xor al, cl
inc dl
jne 0x140005590
mov ecx, 0xff
mov al, 1
sub cl, dl
je 0x1400055c5
movzx edx, al
add cl, 0xff
add al, al
test dl, dl
jns 0x1400055bf
xor al, 0x1b
xor al, dl
test cl, cl
jne 0x1400055b1
movzx ecx, al
jmp 0x1400055cc
xor ecx, ecx
mov byte [r9], cl
test r10b, r10b
jne 0x140005560
add bpl, 0xff
jne 0x1400054a7
mov cl, 0x10
movzx eax, byte [rbx + rsi - 1]
lea rbx, [rbx - 1]
xor byte [rbx], al
add cl, 0xff
jne 0x1400055e0
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140016e40
Capabilities:
Accept command line arguments

Disassembly:
mov r11, rsp
push rdi
push r14
push r15
sub rsp, 0x70
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1400e5430]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
mov qword [r11 - 0x50], rcx
xor r15d, r15d
mov qword [rcx], r15
mov qword [rcx + 8], r15
mov qword [rcx + 0x10], r15
mov dword [r11 - 0x68], r15d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbp, rax
test rax, rax
je 0x140016fe7
mov esi, r15d
cmp dword [rsp + 0x20], r15d
jle 0x140016fdd
mov r14, rax
nop dword [rax]
mov rdx, qword [r14]
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r15
mov word [rsp + 0x48], r15w
cmp word [rdx], 0
jne 0x140016ee2
mov r8, r15
jmp 0x140016efb
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140016ef0
lea rcx, [rsp + 0x48]
call fcn.14000bc90
nop
mov rax, qword [rbx + 8]
lea rcx, [rsp + 0x48]
cmp rcx, rax
jae 0x140016f73
mov rcx, qword [rbx]
lea rdx, [rsp + 0x48]
cmp rcx, rdx
ja 0x140016f73
lea rdi, [rsp + 0x48]
sub rdi, rcx
cmp rax, qword [rbx + 0x10]
jne 0x140016f37
mov rcx, rbx
call fcn.140018de0
and rdi, 0xffffffffffffffe0
add rdi, qword [rbx]
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
test rcx, rcx
je 0x140016f71
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], r15
mov word [rcx], r15w
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rdi
call fcn.140009940
nop
jmp 0x140016fb6
cmp rax, qword [rbx + 0x10]
jne 0x140016f81
mov rcx, rbx
call fcn.140018de0
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rcx
test rcx, rcx
je 0x140016fb6
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], r15
mov word [rcx], r15w
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x48]
call fcn.140009940
nop
add qword [rbx + 8], 0x20
cmp qword [rsp + 0x60], 8
jb 0x140016fcd
mov rcx, qword [rsp + 0x48]
call fcn.14007f05c
inc esi
add r14, 8
cmp esi, dword [rsp + 0x20]
jl 0x140016ec0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
mov rax, rbx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14007e1c0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400170b0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x1400e5430]
xor rax, rsp
mov qword [rsp + 0x250], rax
lea rax, [rsp + 0x40]
mov rdi, rcx
xor ebx, ebx
mov qword [rsp + 0x28], rax
lea rax, str.VebanaulGameNetlogs
xor r9d, r9d
xor r8d, r8d
mov edx, 0x801c
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], ebx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathAndSubDirW]
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbx
mov word [rdi], bx
test eax, eax
je 0x140017131
cmp word [0], bx
je 0x14001712d
mov eax, ebx
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], ax
jne 0x140017124
xor edx, edx
jmp 0x140017150
cmp word [rsp + 0x40], bx
je 0x14001714b
lea rax, [rsp + 0x40]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140017141
lea rdx, [rsp + 0x40]
mov r8, rbx
mov rcx, rdi
call fcn.14000bc90
mov rax, rdi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14007e1c0
mov rbx, qword [rsp + 0x278]
add rsp, 0x260
pop rdi
ret

Function at 0x140017b30
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov qword [rbp + 7], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1400e5430]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r13, rdx
mov r12, rcx
lea rcx, [0x1400c85a0]
jmp 0x140367c3b

Function at 0x140019a00
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
movzx r9d, byte [r8]
mov rbx, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r11, rdx
mov rdx, qword [rbx + 0x28]
xor r9, rax
movzx eax, byte [r8 + 1]
mov r10, r8
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, r9
shr rcx, 0x20
xor rcx, r9
and rcx, rdx
cmp qword [rbx + 0x30], rcx
ja 0x140019a75
shr rdx, 1
or rax, 0xffffffffffffffff
sub rax, rdx
add rcx, rax
mov r8, qword [rbx + 0x10]
mov rdx, qword [rbx]
mov rax, rcx
add rax, rax
add rcx, rcx
mov r9, qword [r8 + rcx*8]
mov rax, qword [r8 + rax*8]
lea r8, [r8 + rcx*8]
cmp r9, rdx
jne 0x140019a9b
mov rcx, rdx
jmp 0x140019aa2
mov rcx, qword [r8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140019ada
mov ecx, dword [r10]
cmp dword [rax + 0x10], ecx
je 0x140019ab4
mov rax, qword [rax]
jmp 0x140019a91
mov ecx, dword [rax + 0x10]
mov qword [rsp + 8], rdx
cmp dword [r10], ecx
jne 0x140019ac6
mov qword [rsp + 8], rax
lea rax, [rsp + 8]
mov rax, qword [rax]
mov qword [r11], rax
mov rax, r11
mov rbx, qword [rsp + 0x10]
ret
mov rbx, qword [rsp + 0x10]
mov qword [r11], rdx
mov rax, r11
ret
Function at 0x14001e970
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r9
movzx r9d, byte [r8]
mov r10, rcx
movabs rcx, 0x100000001b3
mov r11, r8
movabs rax, 0xcbf29ce484222325
xor r9, rax
movzx eax, byte [r8 + 1]
mov rsi, rdx
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [r10 + 0x28]
mov r8, r9
shr r8, 0x20
xor r8, r9
and r8, rcx
cmp qword [r10 + 0x30], r8
ja 0x14001e9f2
shr rcx, 1
or rax, 0xffffffffffffffff
sub rax, rcx
add r8, rax
mov rcx, qword [r10 + 0x10]
mov rbx, qword [r10]
shl r8, 4
mov rax, qword [rcx + r8]
cmp rbx, rax
je 0x14001ea56
mov rbx, qword [rcx + r8 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x14001ea56
mov ecx, dword [r11]
mov rbx, qword [rbx + 8]
cmp dword [rbx + 0x10], ecx
je 0x14001ea26
cmp rbx, rax
jne 0x14001ea16
jmp 0x14001ea56
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec qword [r10 + 8]
mov rcx, rdi
call fcn.14007f05c
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x14001eae6
mov rax, qword [rdi]
cmp rbx, rax
je 0x14001ea8b
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r10 + 0x10]
add rdx, r8
mov rax, qword [rdx]
cmp rax, qword [r10]
jne 0x14001eaa8
mov qword [rdx], rdi
mov rax, qword [r10 + 0x10]
mov qword [r8 + rax + 8], rdi
jmp 0x14001ead4
cmp rax, rbx
jne 0x14001eab2
mov qword [rdx], rdi
jmp 0x14001ead4
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x14001ead4
mov rdx, qword [r10 + 0x10]
mov rax, qword [rdx + r8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8 + 8], rcx
mov rcx, r10
call fcn.14001ee00
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140023d00
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rdi
mov eax, 0x1400
call fcn.140081b50
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x1418], rbx
mov qword [rsp + 0x1420], rsi
mov rax, qword [0x1400e5430]
xor rax, rsp
mov qword [rsp + 0x13f0], rax
mov rsi, rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x50], shutdown
mov qword [rsp + 0x48], 0
mov byte [rsp + 0x38], 0
xor r8d, r8d
lea rdx, [0x1400c74c5]
lea rcx, [rsp + 0x38]
call fcn.14000b3f0
nop
call fcn.1400563d4
nop
cmp qword [rsp + 0x50], 0x10
jb 0x140023d86
mov rcx, qword [rsp + 0x38]
call fcn.14007f05c
call fcn.1400563d4
mov ecx, eax
jmp 0x140023d98
mov dword [rsp + 0x13e4], 0xffffffff
mov dword [rsp + 0x64], ecx
mov r8d, 1
mov edx, r8d
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, r8d
mov dword [rsp + rdx*4 + 0x64], ecx
inc r8d
inc rdx
cmp rdx, 0x270
jl 0x140023db0
mov dword [rsp + 0x60], 0x270
nop dword [rax + rax]
lea rcx, [rsp + 0x60]
call fcn.140025800
cmp eax, 0xffffffff
ja 0x140023de0
mov dword [rsi], eax
lea rcx, [rsp + 0x60]
call fcn.140025800
cmp eax, 0xffffffff
ja 0x140023df1
mov dword [rsi + 4], eax
lea rcx, [rsp + 0x60]
call fcn.140025800
cmp eax, 0xffffffff
ja 0x140023e03
mov dword [rsi + 8], eax
lea rcx, [rsp + 0x60]
call fcn.140025800
cmp eax, 0xffffffff
ja 0x140023e15
mov dword [rsi + 0xc], eax
lea rbx, [rsi + 0x10]
mov edi, 4
lea rcx, [rsp + 0x60]
call fcn.140025800
cmp eax, 0xffffffff
ja 0x140023e30
mov dword [rbx], eax
add rbx, 4
dec rdi
jne 0x140023e30
mov rax, rsi
mov rcx, qword [rsp + 0x13f0]
xor rcx, rsp
call fcn.14007e1c0
lea r11, [rsp + 0x1400]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140023f30
Capabilities:
Authenticate hmac
Execute anti-debugging instructions
Hash data using murmur3
Hash data using sha256
Parse pe header

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1c8]
sub rsp, 0x2a0
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400e5430]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rdi, r8
mov qword [rbp - 0x80], rdx
xor r13d, r13d
mov dword [rbp - 0x70], r13d
lea rcx, [0x1400c85a0]
jmp 0x140368c78
Function at 0x140025800
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx]
mov r9d, 0x270
mov rbx, rcx
cmp eax, r9d
jne 0x14002585b
lea r8, [rcx + 8]
nop word [rax + rax]
mov edx, dword [r8 - 4]
lea r8, [r8 + 4]
xor edx, dword [r8 - 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
dec r9
jne 0x140025820
jmp 0x140025867
cmp eax, 0x4e0
jb 0x140025867
call fcn.1400258b0
mov eax, dword [rbx]
mov edx, dword [rbx + rax*4 + 4]
inc eax
mov dword [rbx], eax
mov eax, dword [rbx + 0x1384]
mov ecx, edx
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x20
pop rbx
ret

Function at 0x1400258b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov r10, rcx
lea r9, [rcx + 0x9c4]
mov r11d, 0xe3
mov edx, dword [r9 + 4]
lea r9, [r9 + 4]
xor edx, dword [r9 - 4]
btr edx, 0x1f
xor edx, dword [r9 - 4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x630]
xor ecx, edx
mov dword [r9 - 0x9c4], ecx
dec r11
jne 0x1400258c0
lea r9, [r10 + 0xd50]
mov r11d, 0x18c
nop word [rax + rax]
mov edx, dword [r9 + 4]
lea r9, [r9 + 4]
xor edx, dword [r9 - 4]
btr edx, 0x1f
xor edx, dword [r9 - 4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 - 0xd50]
xor ecx, edx
mov dword [r9 - 0x9c4], ecx
dec r11
jne 0x140025910
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov dword [r10], r11d
ret

Function at 0x140025e40
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x80], 0
mov rbx, rcx
jne 0x140025e7e
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, qword [rbx + 0x80]
mov qword [rbx + 0x80], rax
test rcx, rcx
je 0x140025e7e
call qword [rbx + 0x88]
cmp qword [rbx + 0xc0], 0
jne 0x140025eb1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, qword [rbx + 0xc0]
mov qword [rbx + 0xc0], rax
test rcx, rcx
je 0x140025eb1
call qword [rbx + reloc.OLEAUT32.dll_SetErrorInfo]
cmp qword [rbx + 0x40], 0
jne 0x140025ef5
lea rax, [rbx + 0x50]
lea r8, [0x140026310]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call fcn.14008020c
mov rcx, qword [rbx + 0x40]
mov qword [rbx + 0x40], rax
test rcx, rcx
je 0x140025ef5
mov rax, qword [rbx + 0x48]
add rsp, 0x30
pop rbx
jmp rax
add rsp, 0x30
pop rbx
ret
Function at 0x1400260d0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
call qword [rax + 0x28]
test al, al
je 0x140026146
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x50], eax
je 0x140026115
cmp qword [rbx + 0xb8], 0
je 0x140026115
nop dword [rax + rax]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [rbx + 0xb8], 0
jne 0x140026100
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
test al, al
je 0x140026146
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [rsp + 0x30]
or ecx, 0xffffffff
cmp dword [rsp + 0x34], 0
cmovne eax, ecx
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140026230
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [r11 - 0x40], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rax, qword [0x1400e5430]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rdx
mov rdi, rcx
mov qword [r11 - 0x20], 0xf
mov qword [r11 - 0x28], 0
mov byte [rsp + 0x40], 0
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x14002629d
mov rax, qword [rcx]
lea r8, [r11 - 0x38]
call qword [rax + htons]
test al, al
je 0x14002629d
mov rax, qword [rsp + 0x50]
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
jmp 0x1400262b0
mov rax, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400262ad
mov rdx, qword [rbx]
jmp 0x1400262b0
mov rdx, rbx
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, eax
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400262e3
mov rax, qword [rcx]
lea r8, [rsp + 0x40]
mov rdx, rbx
call qword [rax + 0x10]
nop
cmp qword [rsp + 0x58], 0x10
jb 0x1400262f5
mov rcx, qword [rsp + 0x40]
call fcn.14007f05c
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14007e1c0
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret

Function at 0x140027740
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
call qword [rax + 0x28]
test al, al
jne 0x14002775b
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [rsp + 0x30]
or ecx, 0xffffffff
cmp dword [rsp + 0x34], 0
cmovne eax, ecx
add rsp, 0x20
pop rbx
ret
Function at 0x1400278a0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1400e5430]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, rdx
mov rsi, rcx
mov rax, qword [rcx]
call qword [rax + 0x28]
test al, al
je 0x1400279b8
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x40]
mov rbx, rax
mov qword [rsp + 0x40], rax
mov rax, qword [rax]
mov rcx, rbx
call qword [rax + htons]
nop
mov qword [rsp + 0x60], shutdown
mov qword [rsp + 0x58], 0
mov byte [rsp + 0x48], 0
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140027940
mov rax, qword [rcx]
lea r8, [rsp + 0x48]
mov rdx, rdi
call qword [rax + htons]
test al, al
je 0x140027940
mov rax, qword [rsp + 0x58]
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rdx, qword [rsp + 0x48]
jmp 0x140027953
mov rax, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0x10
jb 0x140027950
mov rdx, qword [rdi]
jmp 0x140027953
mov rdx, rdi
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, eax
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140027986
mov rax, qword [rcx]
lea r8, [rsp + 0x48]
mov rdx, rdi
call qword [rax + 0x10]
nop
cmp qword [rsp + 0x60], 0x10
jb 0x140027998
mov rcx, qword [rsp + 0x48]
call fcn.14007f05c
mov qword [rsp + 0x60], shutdown
mov qword [rsp + 0x58], 0
mov byte [rsp + 0x48], 0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14007e1c0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400283c0
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x80
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x98], rbx
mov rax, qword [0x1400e5430]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rcx
xor edi, edi
cmp qword [rcx + 0xe0], rdi
jne 0x140028486
lea rdx, [rsp + 0x58]
call fcn.140027d60
nop
mov r8, rax
mov rdx, qword [0x1400ed520]
lea rcx, [rsp + 0x38]
call fcn.1400289f0
cmp qword [rax + 0x18], 8
jb 0x140028424
mov rax, qword [rax]
mov r9, rax
xor r8d, r8d
lea edx, [r8 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, qword [rbx + 0xe0]
mov qword [rbx + 0xe0], rax
test rcx, rcx
je 0x14002844f
call qword [rbx + 0xe8]
cmp qword [rsp + 0x50], 8
jb 0x140028461
mov rcx, qword [rsp + 0x38]
call fcn.14007f05c
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x38], di
cmp qword [rsp + 0x70], 8
jb 0x140028486
mov rcx, qword [rsp + 0x58]
call fcn.14007f05c
cmp qword [rbx + 0xf0], 0
jne 0x1400284bb
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, qword [rbx + 0xf0]
mov qword [rbx + 0xf0], rax
test rcx, rcx
je 0x1400284bb
call qword [rbx + 0xf8]
cmp qword [rbx + 0x100], 0
jne 0x140028501
lea rax, [rbx + 0x110]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
mov r9, rbx
lea r8, [0x140028720]
xor edx, edx
xor ecx, ecx
call fcn.14008020c
mov rcx, qword [rbx + 0x100]
mov qword [rbx + 0x100], rax
test rcx, rcx
je 0x140028501
call qword [rbx + 0x108]
mov rcx, rbx
call fcn.140025e40
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14007e1c0
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
Function at 0x140028830
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [r11 - 0x38], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1400e5430]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rdx
mov rdi, rcx
mov qword [r11 - 0x18], 0xf
mov qword [r11 - 0x20], 0
mov byte [rsp + 0x48], 0
xor sil, sil
movzx eax, byte [rcx + 0x114]
test al, al
je 0x14002888d
call fcn.1400287c0
xor eax, eax
xchg byte [rdi + 0x114], al
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400288a7
mov rax, qword [rcx]
lea r8, [rsp + 0x48]
mov rdx, rbx
call qword [rax + htons]
movzx esi, al
mov qword [rsp + 0x30], 0
mov r9d, 2
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test sil, sil
je 0x1400288e5
mov rax, qword [rsp + 0x58]
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rdx, qword [rsp + 0x48]
jmp 0x1400288f8
mov rax, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400288f5
mov rdx, qword [rbx]
jmp 0x1400288f8
mov rdx, rbx
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
mov r8d, eax
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14002892b
mov rax, qword [rcx]
lea r8, [rsp + 0x48]
mov rdx, rbx
call qword [rax + 0x10]
nop
cmp qword [rsp + 0x60], 0x10
jb 0x14002893d
mov rcx, qword [rsp + 0x48]
call fcn.14007f05c
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14007e1c0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140028c70
Capabilities:
Get file size

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rdi, rcx
mov rax, qword [rcx]
call qword [rax + 0x40]
mov rbx, rax
mov qword [rsp + 0x48], rax
mov rax, qword [rax]
mov rcx, rbx
call qword [rax + htons]
nop
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
test al, al
jne 0x140028cb0
xor edi, edi
jmp 0x140028cce
lea rdx, [rsp + 0x40]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov edi, dword [rsp + 0x40]
or eax, 0xffffffff
cmp dword [rsp + 0x44], 0
cmovne edi, eax
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x10]
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret