joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004e574
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1800461a8
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1800461a8
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x18004e6c4
cmp rax, 0xffffffffffffffff
je 0x18004e6c4
xor edi, edi
test rbp, rbp
jle 0x18004e66f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.180042734
mov rbx, rax
test rax, rax
jne 0x18004e5fc
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x18004e665
mov edx, 0x8000
mov ecx, r14d
call fcn.18004e3f8
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.180043d20
cmp eax, 0xffffffff
je 0x18004e645
cdqe
sub rbp, rax
test rbp, rbp
jg 0x18004e60c
mov edx, r15d
mov ecx, r14d
call fcn.18004e3f8
jmp 0x18004e665
cmp byte [rsi + 0x38], dil
je 0x18004e65c
cmp dword [rsi + 0x34], 5
jne 0x18004e65c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x18004e665
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1800427ac
jmp 0x18004e6d8
jns 0x18004e6d8
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1800461a8
cmp rax, 0xffffffffffffffff
jne 0x18004e690
cmp byte [rsi + 0x30], dil
je 0x18004e6d8
mov edi, dword [rsi + 0x2c]
jmp 0x18004e6d8
mov ecx, r14d
call fcn.18004a79c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x18004e6d8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x18004e6d8
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x18004e6d1
mov eax, dword [rsi + 0x2c]
jmp 0x18004e6d6
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1800461a8
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x18004f700
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18004f728
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18004f728
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140002cd0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140019680]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140002da3
cmp byte [rcx + 0x71], 0
je 0x140002da3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140002d9f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002d64
sub eax, 1
je 0x140002d68
cmp eax, 2
jne 0x140002d9f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000e8f0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140002d96
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140002d9f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140002d4c
xor al, al
jmp 0x140002d4c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000e8f0
add rsp, 0x60
pop rbx
ret
Function at 0x140003bd0
Capabilities:
Execute command

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, [0x140011e34]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140002190]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xfffffff5
mov ebx, 3
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n_________________________________________________________n_______________________________________________n___________________________________n________________________________________n__________________________________________n
call fcn.1400015c0
lea rdx, [0x140002190]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xfffffff5
mov ebx, 0xf
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140002190]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
Function at 0x140006c20
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x98
mov rax, qword [0x140019680]
xor rax, rsp
mov qword [rsp + 0x78], rax
cmp byte [0x140012323], 0
xorps xmm0, xmm0
mov eax, dword [0x140012320]
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x70], eax
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [0x140012310]
movups xmmword [rsp + 0x60], xmm0
je 0x140006e0f
xor ecx, ecx
cmp dword [0x140019650], 2
jl 0x140006dd4
movdqa xmm0, xmmword [0x140012350]
lea rdx, [rsp + 0x64]
movdqa xmm5, xmmword [0x1400122c0]
movdqa xmm4, xmmword [0x140012360]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x80], xmm6
movdqa xmm6, xmmword [str.8888]
nop dword [rax]
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400122e0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400122e0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x10
jl 0x140006cc0
movaps xmm6, xmmword [rsp + 0x80]
cmp ecx, 0x14
jge 0x140006e0f
movsxd rax, ecx
lea r8, [rsp + 0x60]
add r8, rax
nop
mov eax, 0x92492493
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x38
movzx eax, cl
inc ecx
sub al, dl
add al, 0x32
xor byte [r8 - 1], al
cmp ecx, 0x14
jl 0x140006de0
xor r9d, r9d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
lea r8d, [r9 + 1]
call fcn.140008b40
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14000e8f0
add rsp, 0x98
ret
Function at 0x140009490
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0xae0
mov rax, qword [0x140019680]
xor rax, rsp
mov qword [rsp + 0xad0], rax
mov rbx, rdx
mov dword [rsp + 0x28], 0x20
lea rax, [rsp + 0x80]
mov r8, rcx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
or r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 0x20
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, rbx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareValveSteam
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000953f
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Error_opening_Steam_key_n
jmp 0x140009607
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.SteamExe
lea rax, [rsp + 0xc0]
mov dword [rsp + 0x30], 0x208
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1400095f5
mov ecx, dword [rsp + 0x30]
cmp ecx, 1
jb 0x1400095f5
shr ecx, 1
je 0x1400095b3
lea rax, [rsp + 0xc0]
lea edx, [rbx + 0x5c]
nop
cmp word [rax], 0x2f
jne 0x1400095a9
mov word [rax], dx
add rax, 2
sub rcx, 1
jne 0x1400095a0
lea rax, [rsp + 0x40]
mov edx, 0x800
lea r9, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r8, str.__s__steam:__rungameid__s
lea rcx, [rsp + 0x2d0]
call fcn.140009320
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x80]
call fcn.140008f80
jmp 0x14000960f
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Error_reading_SteamExe_key_n
mov rcx, rax
call fcn.140009640
mov rcx, qword [rsp + 0xad0]
xor rcx, rsp
call fcn.14000e8f0
add rsp, 0xae0
pop rbx
ret

Function at 0x14000f008
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000f052
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000f052
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000f052
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000f052
cmp dword [rcx + 0x84], 0xe
jbe 0x14000f052
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000f054
xor al, al
add rsp, 0x28
ret
Function at 0x1400115a5
Capabilities:
Manipulate console buffer

Disassembly:
jmp 0x14001f640
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140036040]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x14003e106]
call fcn.140011b27
nop
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbp + 8], rax
xor eax, eax
mov word [rbp + 0x24], ax
xor eax, eax
mov word [rbp + 0x26], ax
lea rdx, [rbp + 0x68]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
nop
movsx eax, word [rbp + 0x68]
movsx ecx, word [rbp + 0x6a]
imul eax, ecx
mov dword [rbp + 0x94], eax
lea rax, [rbp + 0x44]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x24]
mov r8d, dword [rbp + 0x94]
mov dx, 0x20
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
nop
lea rdx, [rbp + 0x68]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
nop
lea rax, [rbp + 0x44]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x24]
mov r8d, dword [rbp + 0x94]
movzx edx, word [rbp + 0x70]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
nop
mov edx, dword [rbp + 0x24]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x14002e020]
call fcn.140011933
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.14001155a
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret

Function at 0x140011618
Capabilities:
Terminate process

Disassembly:
jmp 0x140023b90
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x1400117a8
Capabilities:
Parse pe header

Disassembly:
jmp 0x140024ee0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140024f00
xor al, al
jmp 0x140024f81
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140024f13
xor al, al
jmp 0x140024f81
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140024f3d
xor al, al
jmp 0x140024f81
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140024f51
xor al, al
jmp 0x140024f81
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140024f63
xor al, al
jmp 0x140024f81
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140024f7f
xor al, al
jmp 0x140024f81
mov al, 1
add rsp, 0x38
ret
Function at 0x140022ce0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140011b8b
movzx eax, al
test eax, eax
jne 0x140022d00
mov ecx, 7
call fcn.140011947
nop
mov byte [rsp + 0x20], 0
call fcn.140011997
mov byte [rsp + 0x21], al
cmp dword [0x140036ba8], 1
jne 0x140022d24
mov ecx, 7
call fcn.140011947
nop
jmp 0x140022d7c
cmp dword [0x140036ba8], 0
jne 0x140022d77
mov dword [0x140036ba8], 1
lea rdx, [0x14002c660]
lea rcx, [0x14002c330]
call fcn.140011537
test eax, eax
je 0x140022d58
mov eax, 0xff
jmp 0x140022e81
lea rdx, [0x14002c220]
lea rcx, [section..rdata]
call fcn.14001197e
mov dword [0x140036ba8], 2
jmp 0x140022d7c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001191f
call fcn.1400117f3
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140022dd9
mov rcx, qword [rsp + 0x30]
call fcn.140011447
movzx eax, al
test eax, eax
je 0x140022dd9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x14003f020]
nop
call fcn.14001187a
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140022e0d
mov rcx, qword [rsp + 0x38]
call fcn.140011447
movzx eax, al
test eax, eax
je 0x140022e0d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011aeb
nop
call fcn.140022f30
mov dword [rsp + 0x28], eax
call fcn.1400117a8
movzx eax, al
test eax, eax
jne 0x140022e2c
mov ecx, dword [rsp + 0x28]
call fcn.1400110d7
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140022e3b
call fcn.140011b04
nop
xor edx, edx
mov cl, 1
call fcn.140011401
mov eax, dword [rsp + 0x28]
jmp 0x140022e81
add rsp, 0x68
ret
Function at 0x140146270
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [0x14027a15c], 0x12c
mov rdi, rcx
jg 0x14014633f
lea rdx, [rcx + 0x20]
add rcx, 0x50
lea r8, [rsp + 0x38]
call fcn.1401ab924
lea rbx, [rdi + 0x18]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x140146303
cmp dword [rsp + 0x38], 0
jne 0x140146303
cmp byte [rdi + 0x70], 0
lea rdx, [rsp + 0x38]
mov rcx, rbx
je 0x1401462cc
call fcn.1401abb5c
test al, al
jne 0x1401462db
jmp 0x140146303
mov r8d, 0x493e0
call fcn.1401abbc0
test al, al
je 0x14014633f
and dword [0x14027a15c], 0
mov rcx, qword [rdi + 0x28]
mov byte [rdi + 0x70], 1
test rcx, rcx
je 0x140146303
mov rax, qword [rcx]
mov rdx, rbx
mov rax, qword [rax + 8]
call qword [case.0x1401ab3a5.0]
test al, al
jne 0x140146334
cmp qword [rbx], 0xffffffffffffffff
je 0x14014631c
cmp dword [rsp + 0x38], 0
jne 0x140146334
mov rcx, rbx
call fcn.1401ab7b4
or qword [rbx], 0xffffffffffffffff
cmp dword [rsp + 0x38], 0
je 0x140146334
inc dword [0x14027a15c]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1401662f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x140150552
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x140150535
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x140150520

Function at 0x140180730
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14018055c

Function at 0x140197430
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140197450
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1401768a0
or eax, 0xffffffff
jmp 0x140197452
xor eax, eax
add rsp, 0x28
ret
Function at 0x1401a4fa0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov al, byte [rcx + 8]
test al, al
je 0x1401a5057
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1401ab3a5.0]
test al, al
je 0x1401a5057
xor eax, eax
xchg byte [rbx + 8], al
mov rdi, qword [rbx + 0x10]
test rdi, rdi
je 0x1401a4ff9
mov rcx, qword [rdi + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x1401a4fec
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov edx, 0x18
mov rcx, rdi
call fcn.14016f250
mov ecx, 0x18
call fcn.14016f214
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1401a5025
lea rax, [0x1401a4f60]
mov qword [rdi], rax
mov qword [rdi + 8], rbx
or qword [rdi + 0x10], 0xffffffffffffffff
jmp 0x1401a5027
xor edi, edi
mov qword [rbx + 0x10], rdi
and dword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
mov r9, rdi
lea r8, [0x1401a5110]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 0x10], rax
mov al, byte [rbx + 8]
test al, al
sete al
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1401ab830
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
or rbp, 0xffffffffffffffff
mov r14, r9
cmp qword [rcx + 0x10], 0
mov rbx, r8
mov rsi, rcx
jne 0x1401ab865
mov dword [r8], 1
or rax, rbp
jmp 0x1401ab911
mov eax, 0x10624dd3
mov dword [r8], 7
mul dword [rdx]
mov edi, edx
shr edi, 4
test r14, r14
je 0x1401ab892
mov rax, qword [r14]
mov rcx, r14
mov rax, qword [rax + 0x18]
call qword [case.0x1401ab3a5.0]
cmp eax, 6
je 0x1401ab90e
cmp qword [rsi + 0x18], 8
mov rcx, rsi
jb 0x1401ab89f
mov rcx, qword [rsi]
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x4110100
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1401ab90b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x60], eax
cmp eax, 2
je 0x1401ab8e5
cmp eax, 0xe7
jne 0x1401ab8fd
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, edi
dec edi
test eax, eax
je 0x1401ab90e
jmp 0x1401ab878
lea rcx, [rsp + 0x60]
call fcn.1401ab70c
mov dword [rbx], eax
jmp 0x1401ab90e
and dword [rbx], 0
mov rax, rbp
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1401ab924
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
or rsi, 0xffffffffffffffff
mov dword [r8], 7
cmp qword [rcx + 0x10], 0
mov rbx, r8
mov rdi, rcx
jne 0x1401ab957
mov dword [r8], 1
jmp 0x1401aba0f
and qword [rsp + 0x70], 0
lea r8, [rsp + 0x70]
xor r9d, r9d
lea rcx, str.S:_ML__NW___LW_
lea edx, [r9 + 1]
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
and dword [rsp + 0x50], 0
cmp qword [rdi + 0x18], 8
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], 0x18
jb 0x1401ab996
mov rdi, qword [rdi]
mov al, byte [0x140269628]
mov r9d, 0xff
neg al
mov r8d, 8
lea rax, [rsp + 0x40]
mov rcx, rdi
mov qword [rsp + 0x38], rax
sbb edx, edx
and dword [rsp + 0x30], 0
mov eax, 0x400
and edx, 0x80000
mov dword [rsp + 0x28], eax
inc edx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rcx, qword [rsp + 0x70]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp rsi, 0xffffffffffffffff
jne 0x1401aba05
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], eax
call fcn.1401ab70c
mov dword [rbx], eax
jmp 0x1401aba0f
and dword [rbx], 0
mov byte [0x140269628], 0
lea r11, [rsp + 0x60]
mov rax, rsi
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1401aba24
Capabilities:
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
xor esi, esi
mov dword [r8], 7
cmp qword [rcx], 0xffffffffffffffff
mov rbx, r8
mov rdi, rdx
mov r14, rcx
jne 0x1401aba56
mov dword [r8], 1
jmp 0x1401abb4c
mov rcx, qword [rcx]
lea r9, [rbp + 0x48]
and dword [rbp + 0x40], esi
lea rdx, [rbp + 0x40]
and dword [rbp + 0x48], esi
mov r8d, 4
and qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1401aba95
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x30], eax
cmp eax, 0xea
je 0x1401aba95
lea rcx, [rbp + 0x30]
jmp 0x1401abb45
mov ecx, dword [rbp + 0x40]
cmp ecx, 0x1fffff
jbe 0x1401abaab
mov dword [rbx], 3
jmp 0x1401abb4c
mov r9, qword [rdi]
mov rdx, rcx
mov r8, qword [rdi + 8]
sub r8, r9
cmp rcx, r8
jae 0x1401abac3
lea rax, [r9 + rcx]
jmp 0x1401abaf4
jbe 0x1401abaf8
mov rax, qword [rdi + 0x10]
sub rax, r9
cmp rdx, rax
jbe 0x1401abae2
lea r8, [rbp + 0x30]
mov rcx, rdi
call fcn.1401ab604
mov ecx, dword [rbp + 0x40]
jmp 0x1401abaf8
mov rcx, qword [rdi + 8]
sub rdx, r8
mov r8, rdi
call fcn.1400f16c8
mov ecx, dword [rbp + 0x40]
mov qword [rdi + 8], rax
mov rdx, qword [rdi]
lea r9, [rbp + 0x30]
and dword [rbp + 0x30], 0
sub ecx, esi
and qword [rsp + 0x20], 0
mov r8d, ecx
mov rcx, qword [r14]
add rdx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1401abb2e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x10], eax
cmp eax, 0xea
jne 0x1401abb41
mov eax, dword [rbp + 0x30]
and dword [rbx], 0
add rsi, rax
mov ecx, dword [rbp + 0x40]
cmp rsi, rcx
jae 0x1401abb4c
jmp 0x1401abaf8
lea rcx, [rbp - 0x10]
call fcn.1401ab70c
mov dword [rbx], eax
mov rax, rsi
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret