joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401e2180
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x160
mov rax, qword [0x1402ded38]
xor rax, rsp
mov qword [rsp + 0x150], rax
call fcn.1401dafe0
mov rbx, rax
test rax, rax
je 0x1401e21e1
cmp dword [rax], 1
je 0x1401e21c6
mov rcx, rax
mov dword [0x1402ed880], 0x80000
call fcn.1401d92b0
xor eax, eax
jmp 0x1401e2352
mov rcx, qword [rax + 8]
call fcn.1401d63a0
mov dword [0x1402ed880], eax
test eax, eax
je 0x1401e21e8
mov rcx, rbx
call fcn.1401d92b0
xor eax, eax
jmp 0x1401e2352
mov qword [rsp + 0x170], rbp
xor ebp, ebp
mov qword [rsp + 0x178], rsi
mov esi, ebp
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x148], ebp
mov byte [rsp + 0x24], sil
cmp dword [rbx], 1
mov qword [rsp + 0x180], rdi
je 0x1401e2232
mov rcx, rbx
mov dword [0x1402ed880], 0x80000
call fcn.1401d92b0
xor eax, eax
jmp 0x1401e233a
mov rdi, qword [rbx + 8]
mov rcx, qword [rdi]
cmp dword [rcx + 8], 0xffffffff
jg 0x1401e2246
mov eax, 0x10000
jmp 0x1401e2290
cmp dword [rdi + 8], 0xffffffff
je 0x1401e2251
call fcn.1401d64e0
mov rax, qword [rdi]
mov dword [rdi + 8], 0xffffffff
mov esi, dword [rax + 8]
mov byte [rsp + 0x24], bpl
mov qword [rsp + 0x128], rbp
mov qword [rsp + 0x130], rbp
mov qword [rsp + 0x138], rbp
mov qword [rsp + 0x140], rbp
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x148], ebp
mov eax, ebp
mov dword [0x1402ed880], eax
test eax, eax
je 0x1401e22a9
mov rcx, rbx
call fcn.1401d92b0
xor eax, eax
jmp 0x1401e233a
mov edi, ebp
test esi, esi
jle 0x1401e2320
nop
mov dword [rsp + 0x20], ebp
mov byte [rsp + 0x24], bpl
mov dword [rsp + 0x148], ebp
cmp dword [rbx], 1
je 0x1401e22d1
mov dword [0x1402ed880], 0x80000
jmp 0x1401e22f3
cmp edi, 0xffffffff
jl 0x1401e22e8
mov rcx, qword [rbx + 8]
lea r8, [rsp + 0x20]
mov edx, edi
call fcn.1401da8d0
jmp 0x1401e22ed
mov eax, 0x10000
mov dword [0x1402ed880], eax
cmp dword [rbx], 1
je 0x1401e2304
mov dword [0x1402ed880], 0x80000
jmp 0x1401e231a
mov rcx, qword [rbx + 8]
lea r8, [rsp + 0x24]
mov edx, edi
call fcn.1401db060
mov dword [0x1402ed880], eax
inc edi
cmp edi, esi
jl 0x1401e22b0
mov rcx, rbx
call fcn.1401d92b0
lea rcx, str.C:UsersPublicL78V3gUKHilu2km1RgBU.dat
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
mov rsi, qword [rsp + 0x178]
mov rbp, qword [rsp + 0x170]
mov rdi, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14017ae40
add rsp, 0x160
pop rbx
ret
Function at 0x1401e2de0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
lea r8, [rcx + 0x1f8]
mov rbx, rcx
mov rcx, rdi
mov edx, 0x3ee
call fcn.140033de8
lea r8, [rbx + 0x2f0]
mov edx, 0x408
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14003402c
Function at 0x1401e94a0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
lea r8, [rcx + 0x140]
mov rbx, rcx
mov rcx, rdi
mov edx, 0x443
call fcn.140033b60
lea r8, [rbx + 0x144]
mov edx, 0x446
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x148]
mov edx, 0x447
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x14c]
mov edx, 0x444
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x150]
mov edx, 0x445
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x154]
mov edx, 0x44d
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x158]
mov edx, 0x450
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x15c]
mov edx, 0x451
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x160]
mov edx, 0x44e
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x164]
mov edx, 0x44f
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x168]
mov edx, 0x459
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x16c]
mov edx, 0x456
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x170]
mov edx, 0x458
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x174]
mov edx, 0x45a
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x178]
mov edx, 0x457
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x17c]
mov edx, 0x453
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x180]
mov edx, 0x454
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x184]
mov edx, 0x455
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x188]
mov edx, 0x452
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x18c]
mov edx, 0x44c
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x190]
mov edx, 0x44b
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x194]
mov edx, 0x448
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x198]
mov edx, 0x449
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x19c]
mov edx, 0x44a
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x1a0]
mov edx, 0x439
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + reloc.OLEAUT32.dll_OleTranslateColor]
mov edx, 0x43b
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x1a8]
mov edx, 0x436
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x1ac]
mov edx, 0x437
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x1b0]
mov edx, 0x434
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x1b4]
mov edx, 0x438
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x1b8]
mov edx, 0x419
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x1bc]
mov edx, 0x43c
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x1c0]
mov edx, 0x43d
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x1c4]
mov edx, 0x43e
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x1c8]
mov edx, 0x43f
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x1d0]
mov edx, 0x40a
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x1d8]
mov edx, 0x407
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x1e0]
mov edx, 0x408
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x1e8]
mov edx, 0x40b
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x1f0]
mov edx, 0x409
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x1f8]
mov edx, 0x40c
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14003402c
Function at 0x1401e9c40
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
lea r8, [rcx + 0x140]
mov rbx, rcx
mov rcx, rdi
mov edx, 0x428
call fcn.140033de8
lea r8, [rbx + 0x238]
mov edx, 0x427
mov rcx, rdi
call fcn.140033de8
lea r8, [rbx + 0x330]
mov edx, 0x412
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x338]
mov edx, 0x413
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x340]
mov edx, 0x414
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x348]
mov edx, 0x415
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x350]
mov edx, 0x416
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x358]
mov edx, 0x417
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x360]
mov edx, 0x418
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x368]
mov edx, 0x419
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x370]
mov edx, 0x41a
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x378]
mov edx, 0x41b
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x380]
mov edx, 0x41c
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x388]
mov edx, 0x41d
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x390]
mov edx, 0x41e
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x398]
mov edx, 0x41f
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x3a0]
mov edx, 0x420
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x3a8]
mov edx, 0x421
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x3b0]
mov edx, 0x422
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x3b8]
mov edx, 0x423
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x3c0]
mov edx, 0x424
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14003402c

Function at 0x1401ea120
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
lea r8, [rcx + 0x140]
mov rbx, rcx
mov rcx, rdi
mov edx, 0x42c
call fcn.140033de8
lea r8, [rbx + 0x218]
mov edx, 0x42a
mov rcx, rdi
call fcn.140033de8
lea r8, [rbx + 0x2f0]
mov edx, 0x42d
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x2f8]
mov edx, 0x42f
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x300]
mov edx, 0x40b
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x308]
mov edx, 0x40c
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x310]
mov edx, 0x432
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x318]
mov edx, 0x433
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x320]
mov edx, 0x40d
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x328]
mov edx, 0x435
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x330]
mov edx, 0x436
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x338]
mov edx, 0x40e
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x340]
mov edx, 0x42e
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14003402c
Function at 0x1401ea450
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
lea r8, [rcx + 0x158]
mov rbx, rcx
mov rcx, rdi
mov edx, 0x3fc
call fcn.140033de8
lea r8, [rbx + 0x230]
mov edx, 0x3ee
mov rcx, rdi
call fcn.140033de8
lea r8, [rbx + 0x308]
mov edx, 0x3f0
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x310]
mov edx, 0x3f1
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x318]
mov edx, 0x3f2
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x320]
mov edx, 0x3f3
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x328]
mov edx, 0x3f4
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x330]
mov edx, 0x3f5
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x338]
mov edx, 0x3f6
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x340]
mov edx, 0x3f8
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x348]
mov edx, 0x3f7
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x350]
mov edx, 0x3f9
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x358]
mov edx, 0x3fb
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x360]
mov edx, 0x3fa
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14003402c

Function at 0x1401ea820
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
lea r8, [rcx + 0x140]
mov rbx, rcx
mov rcx, rdi
mov edx, 0x3eb
call fcn.140033b60
lea r8, [rbx + 0x144]
mov edx, 0x3ec
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x148]
mov edx, 0x3ed
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x150]
mov edx, 0x3ee
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x158]
mov edx, 0x3ef
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x160]
mov edx, 0x3f0
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x168]
mov edx, 0x3f3
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x16c]
mov edx, 0x3f1
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x170]
mov edx, 0x3f4
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x174]
mov edx, 0x3f5
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x178]
mov edx, 0x3f6
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x17c]
mov edx, 0x3f7
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x180]
mov edx, 0x3f8
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x188]
mov edx, 0x405
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x190]
mov edx, 0x3f2
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x198]
mov edx, 0x3f9
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x19c]
mov edx, 0x3fa
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x1a0]
mov edx, 0x3fb
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x1a8]
mov edx, 0x406
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14003402c
Function at 0x1401eb250
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
lea r8, [rcx + 0x140]
mov rbx, rcx
mov rcx, rdi
mov edx, 0x3e9
call fcn.14003402c
lea r8, [rbx + 0x148]
mov edx, 0x3ea
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x150]
mov edx, 0x3eb
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x158]
mov edx, 0x3ec
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x160]
mov edx, 0x3ed
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x168]
mov edx, 0x3ef
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x170]
mov edx, 0x3ee
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x178]
mov edx, 0x3f3
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x180]
mov edx, 0x3f4
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x188]
mov edx, 0x3f6
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x190]
mov edx, 0x3f5
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x198]
mov edx, 0x3f7
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x1a0]
mov edx, 0x3fa
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x1a8]
mov edx, 0x3fb
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x1b0]
mov edx, 0x3fc
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x1b8]
mov edx, 0x3fd
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x1c0]
mov edx, 0x3fe
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x1c8]
mov edx, 0x3e8
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x1d0]
mov edx, 0x403
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x1d8]
mov edx, 0x404
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x1e0]
mov edx, 0x79
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14003402c
Function at 0x1401f73f0
Capabilities:
Reference http user-agent string

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1402ded38]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [rcx + 0x38], 0x10
lea r8, [rcx + 0x20]
mov rbx, rcx
jb 0x1401f7416
mov r8, qword [r8]
mov rcx, qword [rcx + 8]
mov edx, 0x2712
call fcn.140197990
lea rcx, [rsp + 0x20]
xor r8d, r8d
mov edx, Ordinal_143
mov qword [rsp + 0x38], reloc.ODBC32.dll_SQLFreeEnv
mov qword [rsp + 0x30], 0
mov byte [rsp + 0x20], 0
call fcn.140002830
cmp qword [rsp + 0x38], 0x10
lea rcx, [rsp + 0x20]
lea rdx, str.Mozilla_5.0__iPad__U__CPU_OS_4_3_3_like_Mac_OS_X__en_us__AppleWebKit_533.17.9__KHTML__like_Gecko__Version_5.0.2_Mobile_8J2_Safari_6533.18.5
mov r8d, Ordinal_143
cmovae rcx, qword [rsp + 0x20]
call fcn.14017b330
cmp qword [rsp + 0x38], 0x10
mov qword [rsp + 0x30], Ordinal_143
lea rax, [rsp + 0x20]
lea r8, [rsp + 0x20]
mov edx, 0x2722
cmovae rax, qword [rsp + 0x20]
mov byte [rax + 0x8b], 0
cmp qword [rsp + 0x38], 0x10
mov rcx, qword [rbx + 8]
cmovae r8, qword [rsp + 0x20]
call fcn.140197990
mov rcx, qword [rbx + 8]
mov edx, reloc.ODBC32.dll_SQLSetPos
lea r8d, [rdx - 0x3f]
call fcn.140197990
mov rcx, qword [rbx + 8]
mov edx, SQLTables
lea r8d, [rdx - 0x33]
call fcn.140197990
mov rcx, qword [rbx + 8]
mov edx, 0x63
lea r8d, [rdx - 0x62]
call fcn.140197990
mov rcx, qword [rbx + 8]
xor r8d, r8d
lea edx, [r8 + 0x2f]
call fcn.140197990
mov rcx, qword [rbx + 8]
lea r8, [0x1401f7220]
mov edx, 0x4e2b
call fcn.140197990
mov rcx, qword [rbx + 8]
mov r8, rbx
mov edx, 0x2711
call fcn.140197990
mov rcx, qword [rbx + 8]
xor r8d, r8d
lea edx, [r8 + 0x40]
call fcn.140197990
mov rcx, qword [rbx + 8]
xor r8d, r8d
lea edx, [r8 + 0x51]
call fcn.140197990
cmp qword [rsp + 0x38], 0x10
jb 0x1401f754e
mov rcx, qword [rsp + 0x20]
call fcn.140004d64
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14017ae40
add rsp, 0x50
pop rbx
ret

Function at 0x1401fdf10
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
lea r8, [rcx + 0x130]
mov rbx, rcx
mov rcx, rdi
mov edx, 0x400
call fcn.140033de8
lea r8, [rbx + 0x208]
mov edx, 0x3f3
mov rcx, rdi
call fcn.140033de8
lea r8, [rbx + 0x2e0]
mov edx, 0x3f4
mov rcx, rdi
call fcn.140033de8
lea r8, [rbx + 0x3b8]
mov edx, 0x3ee
mov rcx, rdi
call fcn.140033de8
lea r8, [rbx + 0x4b0]
mov edx, 0x400
mov rcx, rdi
call fcn.140033b60
lea r8, [rbx + 0x4b8]
mov edx, 0x408
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14003402c
Function at 0x14002934c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001c944
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001c944
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002949c
cmp rax, 0xffffffffffffffff
je 0x14002949c
xor edi, edi
test rbp, rbp
jle 0x140029447
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f258
mov rbx, rax
test rax, rax
jne 0x1400293d4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002943d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a278
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d620
cmp eax, 0xffffffff
je 0x14002941d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400293e4
mov edx, r15d
mov ecx, r14d
call fcn.14001a278
jmp 0x14002943d
cmp byte [rsi + 0x38], dil
je 0x140029434
cmp dword [rsi + 0x34], 5
jne 0x140029434
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002943d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b00c
jmp 0x1400294b0
jns 0x1400294b0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001c944
cmp rax, 0xffffffffffffffff
jne 0x140029468
cmp byte [rsi + 0x30], dil
je 0x1400294b0
mov edi, dword [rsi + 0x2c]
jmp 0x1400294b0
mov ecx, r14d
call fcn.140018730
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400294b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400294b0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400294a9
mov eax, dword [rsi + 0x2c]
jmp 0x1400294ae
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001c944
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400025ec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002636
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002636
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002636
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002636
cmp dword [rcx + 0x84], 0xe
jbe 0x140002636
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002638
xor al, al
add rsp, 0x28
ret
Function at 0x140002050
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov eax, dword [rcx + 0x48]
lea rbx, [rcx + 0x28]
mov rdi, qword [rcx]
lea r11, [rcx + 0x28]
add rbx, rax
mov r9, rcx
movabs rbp, 0xc2b2ae3d27d4eb4f
movabs rsi, 0x9e3779b185ebca87
movabs r14, 0x27d4eb2f165667c5
movabs r15, 0x7a1435883d4d519d
cmp rdi, 0x20
jb 0x140002149
mov r8, qword [r9 + 0x18]
mov rdx, qword [rcx + 8]
mov rax, r8
mov r9, qword [r9 + 0x20]
mov rcx, qword [rcx + 0x10]
mov r10, r9
rol r10, 0x12
rol rax, 0xc
add r10, rax
mov rax, rcx
rol rax, 7
add r10, rax
mov rax, rdx
rol rax, 1
add r10, rax
movabs rax, 0x85ebca77c2b2ae63
imul rdx, rbp
imul rcx, rbp
imul r8, rbp
imul r9, rbp
rol rdx, 0x1f
imul rdx, rsi
rol rcx, 0x1f
xor r10, rdx
rol r8, 0x1f
imul r10, rsi
imul rcx, rsi
imul r8, rsi
sub r10, r15
rol r9, 0x1f
xor r10, rcx
imul r10, rsi
imul r9, rsi
sub r10, r15
xor r10, r8
imul r10, rsi
sub r10, r15
xor r10, r9
imul r10, rsi
add rax, r10
add rax, rdi
jmp 0x140002151
lea rax, [rdi + r14]
add rax, qword [rcx + 0x18]
lea rdx, [r11 + 8]
cmp rdx, rbx
ja 0x14000218a
nop word [rax + rax]
mov rcx, qword [r11]
add rdx, 8
imul rcx, rbp
add r11, 8
rol rcx, 0x1f
imul rcx, rsi
xor rax, rcx
rol rax, 0x1b
imul rax, rsi
sub rax, r15
cmp rdx, rbx
jbe 0x140002160
lea rdx, [r11 + 4]
movabs r8, 0x165667b19e3779f9
cmp rdx, rbx
ja 0x1400021b5
mov ecx, dword [r11]
mov r11, rdx
imul rcx, rsi
xor rax, rcx
rol rax, 0x17
imul rax, rbp
add rax, r8
cmp r11, rbx
jae 0x1400021db
nop word [rax + rax]
movzx ecx, byte [r11]
inc r11
imul rcx, r14
xor rax, rcx
rol rax, 0xb
imul rax, rsi
cmp r11, rbx
jb 0x1400021c0
mov rbx, qword [rsp + 0x18]
mov rcx, rax
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
shr rcx, 0x21
xor rcx, rax
imul rcx, rbp
mov rbp, qword [rsp + 0x20]
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
ret

Function at 0x14000a3d0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
lea rbx, [rsp + 0x30]
mov rbp, rdx
mov word [rsp + 0x30], ax
movzx edx, byte [rcx]
mov rsi, rcx
lea edi, [rax + 0x28]
test dl, dl
je 0x14000a475
nop dword [rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x14000a42d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x14000a420
cmp rcx, 1
jb 0x14000a4a6
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x14000a443
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.1400101a0
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x14000a410
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14000b7f0
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
call fcn.14000fe64
int3
Function at 0x14000a530
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, r8
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000a575
xor al, al
jmp 0x14000a5c2
cmp word [rbx], 0
je 0x14000a58d
nop dword [rax + rax]
add rbx, 2
dec rdi
cmp word [rbx], 0
jne 0x14000a580
cmp word [rsp + 0x30], 0
je 0x14000a5bb
lea rcx, [rsp + 0x30]
sub rcx, rbx
nop dword [rax]
cmp rdi, 1
jb 0x14000a5e3
movzx eax, word [rcx + rbx]
dec rdi
mov word [rbx], ax
add rbx, 2
cmp word [rcx + rbx], 0
jne 0x14000a5a0
xor eax, eax
mov word [rbx], ax
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000b7f0
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
call fcn.14000fe64
int3
Function at 0x14000ad70
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2030
call fcn.14001f7e0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov r11d, dword [0x14002fdd4]
lea rsi, [0x140032e10]
mov rdi, rcx
test r11d, r11d
jne 0x14000ade9
mov r8d, 0x1000
lea rdx, str.HOME
lea rcx, [rsp + 0x20]
call fcn.14000a5f0
test al, al
je 0x14000aec9
lea rcx, [rsp + 0x20]
call fcn.14001446c
movsxd r11, dword [0x14002fdd4]
mov qword [rsi + r11*8], rax
inc r11d
mov dword [0x14002fdd4], r11d
xor r9d, r9d
test r11d, r11d
jle 0x14000ae24
mov r10, rsi
mov r8, qword [r10]
mov rax, rdi
sub r8, rdi
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000ae14
add rax, 2
test ecx, ecx
jne 0x14000ae00
test edx, edx
je 0x14000ae47
inc r9d
add r10, 8
cmp r9d, r11d
jl 0x14000adf4
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x14000ae30
cmp rax, 2
jne 0x14000ae4b
cmp word [rdi + 2], 0x3a
jne 0x14000ae4b
mov al, 1
jmp 0x14000aea8
xor edx, edx
mov qword [rsp + 0x2048], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
test eax, eax
jne 0x14000ae76
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000ae9d
mov bl, 1
cmp dword [0x14002fdd4], 0x400
jge 0x14000ae9d
mov rcx, rdi
call fcn.14001446c
movsxd rdx, dword [0x14002fdd4]
mov qword [rsi + rdx*8], rax
inc edx
mov dword [0x14002fdd4], edx
movzx eax, bl
mov rbx, qword [rsp + 0x2048]
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.14000b7f0
mov rsi, qword [rsp + 0x2050]
add rsp, 0x2030
pop rdi
ret
lea rcx, str.HOME
call fcn.14000ac10
int3