joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f0b0
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
movdqa xmmword [rsp + 0x50], xmm6
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [0x140128a08], 0
je 0x14000f0dd
xor esi, esi
jmp 0x14000f1fe
mov ecx, 0x30
call fcn.1400a8a10
mov rsi, rax
mov ecx, 0x20
call fcn.1400a8a10
mov qword [rsi], rax
lea rcx, [rax + 0x20]
mov qword [rsi + 0x10], rcx
mov edx, 7
movq xmm6, rdx
pslldq xmm6, 8
movdqu xmmword [rax + 0x10], xmm6
mov word [rax], 0
mov qword [rsi + 8], rcx
mov qword [rsi + 0x20], 0
mov ecx, 0x60
call fcn.1400a8a10
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x28], 1
mov qword [0x140128a08], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdi, rax
movdqu xmmword [rsp + 0x38], xmm6
mov word [rsp + 0x28], 0
mov rcx, rax
call fcn.1400e0570
mov rbx, rax
cmp rax, 7
jbe 0x14000f18b
lea rcx, [rsp + 0x28]
mov rdx, rbx
mov r9, rdi
call fcn.140003250
jmp 0x14000f1aa
mov qword [rsp + 0x38], rbx
mov r8, rbx
add r8, rbx
lea rcx, [rsp + 0x28]
mov rdx, rdi
call fcn.1400cc760
mov word [rsp + rbx*2 + 0x28], 0
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.14000f230
mov rax, qword [rsp + 0x40]
cmp rax, 8
jb 0x14000f1fb
mov rcx, qword [rsp + 0x28]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14000f1f6
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x14000f21a
add rax, rax
add rax, 0x29
mov rdx, rax
call fcn.1400a8a80
mov sil, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400a8dd0
mov eax, esi
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
call fcn.1400d9340
ud2

Function at 0x14000f230
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov eax, 7
movq xmm0, rax
pslldq xmm0, 8
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], 0
lea rdi, [rsp + 0x30]
mov rcx, rdx
mov edx, 3
mov r8, rdi
call fcn.140024390
cmp qword [rsp + 0x40], 0
je 0x14000f2bf
mov dword [rsp + 0x2c], 0
cmp qword [rsp + 0x48], 7
jbe 0x14000f296
mov rdi, qword [rsp + 0x30]
lea rdx, [rsp + 0x2c]
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rdi, rax
mov edx, dword [rsp + 0x2c]
mov rcx, rsi
mov r8, rax
call fcn.14000ed30
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0x48]
cmp rax, 8
jb 0x14000f303
mov rcx, qword [rsp + 0x30]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14000f2fe
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x14000f318
add rax, rax
add rax, 0x29
mov rdx, rax
call fcn.1400a8a80
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400a8dd0
nop
add rsp, 0x58
pop rdi
pop rsi
ret
call fcn.1400d9340
ud2
Function at 0x140016d60
Capabilities:
Move file

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x28]
xor edi, edi
xor edx, edx
call fcn.140026380
cmp qword [rsi + 0x10], 0x103
ja 0x140016db1
cmp qword [rsi + 0x18], 7
jbe 0x140016d9a
mov rsi, qword [rsi]
mov rcx, rsi
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne dil
lea rcx, [rsp + 0x28]
call fcn.140026480
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400a8dd0
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x140016de0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rdi, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rsi, [rsp + 0x20]
mov rcx, rsi
xor edx, edx
call fcn.140026380
cmp qword [rdi + 0x18], 7
jbe 0x140016e12
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov rcx, rsi
call fcn.140026480
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400a8dd0
mov eax, ebx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x140016e40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rdi, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rsi, [rsp + 0x28]
mov rcx, rsi
xor edx, edx
call fcn.140026380
cmp qword [rdi + 0x18], 7
jbe 0x140016e71
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
setne al
and edi, 0x10
shr edi, 4
and dil, al
mov rcx, rsi
call fcn.140026480
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400a8dd0
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x140016eb0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x290
mov rsi, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x288], rax
lea rdi, [rsp + 0x70]
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
add eax, 0xffffffff
cmp eax, 0x102
jbe 0x140016ef0
xor esi, esi
jmp 0x140016f55
mov qword [rsp + 0x20], rdi
cmp word [rsp + 0x70], 0
je 0x140016f0e
xor eax, eax
nop
cmp word [rsp + rax*2 + 0x72], 0
lea rax, [rax + 1]
jne 0x140016f00
jmp 0x140016f10
xor eax, eax
mov qword [rsp + 0x28], rax
lea rdi, [rsp + 0x30]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140013df0
lea rbx, [rsp + 0x50]
mov rcx, rdi
mov rdx, rbx
call fcn.140015c70
mov rcx, rsi
mov rdx, rbx
call fcn.140013f80
mov rcx, rbx
call fcn.140013ea0
mov rcx, rdi
call fcn.140013ea0
mov sil, 1
mov rcx, qword [rsp + 0x288]
xor rcx, rsp
call fcn.1400a8dd0
mov eax, esi
add rsp, 0x290
pop rbx
pop rdi
pop rsi
ret
Function at 0x140016f80
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x288
mov rsi, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x280], rax
lea rdi, [rsp + 0x70]
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0x28
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x140016ff0
movzx eax, word [rsp + 0x70]
test ax, ax
je 0x140016ff0
mov qword [rsp + 0x40], rdi
xor eax, eax
cmp word [rsp + rax*2 + 0x72], 0
lea rax, [rax + 1]
jne 0x140016fd0
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140013df0
jmp 0x140017044
lea rdi, [rsp + 0x50]
mov rcx, rdi
call fcn.140013cc0
mov rcx, rdi
call fcn.140016eb0
test al, al
je 0x140017018
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140013db0
jmp 0x14001703a
lea rax, [0x1400f58d8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 3
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140013df0
lea rcx, [rsp + 0x50]
call fcn.140013ea0
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400a8dd0
mov rax, rsi
add rsp, 0x288
pop rdi
pop rsi
ret
Function at 0x140017480
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r15, rdx
mov rdi, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.140026380
cmp qword [rdi + 0x18], 7
mov rbx, rdi
jbe 0x1400174ba
mov rbx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400174f0
mov bl, 1
test al, 0x10
jne 0x1400175e1
test r15, r15
je 0x1400174de
mov dword [r15], 0xfffffff7
mov ecx, 0x50
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x1400175e1
lea rbp, [rsp + 0x50]
mov rcx, rdi
mov rdx, rbp
call fcn.140014c20
mov rax, qword [rdi + 0x10]
cmp qword [rsp + 0x60], rax
jne 0x140017557
test rax, rax
je 0x140017544
cmp qword [rdi + 0x18], 7
mov rcx, rdi
jbe 0x14001751d
mov rcx, qword [rdi]
cmp qword [rsp + 0x68], 7
jbe 0x14001752a
mov rbp, qword [rsp + 0x50]
xor edx, edx
nop dword [rax]
movzx esi, word [rbp + rdx*2]
cmp si, word [rcx + rdx*2]
jne 0x140017557
add rdx, 1
cmp rax, rdx
jne 0x140017530
test r15, r15
je 0x140017550
mov dword [r15], 0xfffffffc
mov ecx, 2
jmp 0x1400175cf
lea rcx, [rsp + 0x50]
mov rdx, r15
call fcn.140017480
test al, al
je 0x1400175d5
mov rcx, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x1400175d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp eax, 0xb7
jne 0x1400175be
lea r14, [rsp + 0x38]
mov rcx, r14
xor edx, edx
call fcn.140026380
cmp qword [rdi + 0x18], 7
jbe 0x1400175a1
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov rcx, r14
call fcn.140026480
cmp edi, 0xffffffff
je 0x1400175be
and edi, 0x10
jne 0x1400175d7
test r15, r15
je 0x1400175cd
mov ecx, ebp
call fcn.140027cf0
mov dword [r15], eax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
lea rcx, [rsp + 0x50]
call fcn.140013ea0
lea rcx, [rsp + 0x20]
call fcn.140026480
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400a8dd0
mov eax, ebx
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140017b30
Capabilities:
Check if file exists
Copy file

Disassembly:
xor r8d, r8d
jmp 0x140017b40
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov ebp, r8d
mov rsi, rdx
mov rbx, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x28]
xor edi, edi
xor edx, edx
call fcn.140026380
mov rcx, rbx
call fcn.140015d50
test al, al
jne 0x140017be9
mov rcx, rsi
call fcn.140015d50
test al, al
jne 0x140017be7
cmp qword [rbx + 0x10], 0x103
ja 0x140017be7
cmp qword [rsi + 0x10], 0x103
ja 0x140017be7
cmp qword [rsi + 0x18], 7
jbe 0x140017ba4
mov rsi, qword [rsi]
movzx r8d, bpl
cmp qword [rbx + 0x18], 7
jbe 0x140017bb2
mov rbx, qword [rbx]
mov rcx, rbx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140017be7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140017be7
mov dil, 1
test al, 1
je 0x140017be9
and eax, 0xfffffffe
mov rcx, rsi
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x140017be9
xor edi, edi
lea rcx, [rsp + 0x28]
call fcn.140026480
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400a8dd0
mov eax, edi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x140017b40
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
xor r8d, r8d
jmp 0x140017b40
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov ebp, r8d
mov rsi, rdx
mov rbx, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x28]
xor edi, edi
xor edx, edx
call fcn.140026380
mov rcx, rbx
call fcn.140015d50
test al, al
jne 0x140017be9
mov rcx, rsi
call fcn.140015d50
test al, al
jne 0x140017be7
cmp qword [rbx + 0x10], 0x103
ja 0x140017be7
cmp qword [rsi + 0x10], 0x103
ja 0x140017be7
cmp qword [rsi + 0x18], 7
jbe 0x140017ba4
mov rsi, qword [rsi]
movzx r8d, bpl
cmp qword [rbx + 0x18], 7
jbe 0x140017bb2
mov rbx, qword [rbx]
mov rcx, rbx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140017be7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140017be7
mov dil, 1
test al, 1
je 0x140017be9
and eax, 0xfffffffe
mov rcx, rsi
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x140017be9
xor edi, edi
lea rcx, [rsp + 0x28]
call fcn.140026480
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400a8dd0
mov eax, edi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x140017c10
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x578
mov r15d, r8d
mov r14, rdx
mov rdx, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x570], rax
mov qword [rsp + 0x20], r14
xor ebp, ebp
lea rsi, [rsp + 0x2a0]
mov rcx, rsi
xor r8d, r8d
mov r9d, 3
call fcn.14001ee40
lea rdi, [rsp + 0x280]
mov rcx, rsi
mov rdx, rdi
call fcn.14001efd0
cmp qword [rsp + 0x290], 0
je 0x140017db4
lea rsi, [rsp + 0x2a0]
lea rbx, [rsp + 0x30]
mov r12, qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r13d, r13d
nop word [rax + rax]
mov rcx, rsi
mov rdx, rbx
call fcn.14001ef40
mov edx, dword [rsp + 0x30]
test dl, 1
je 0x140017ce8
test r15b, r15b
jne 0x140017cc9
mov rcx, rbx
call fcn.14001ec40
test al, al
jne 0x140017ce8
mov edx, dword [rsp + 0x30]
and edx, 0xfffffffe
cmp qword [rsp + 0x298], 7
mov rcx, rdi
jbe 0x140017ce2
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call fcn.14001ec40
test al, al
je 0x140017d40
xor ebp, ebp
test r15b, r15b
je 0x140017d75
mov rcx, rdi
mov rdx, r14
mov r8b, 1
call fcn.140017c10
mov ebp, eax
test eax, eax
jne 0x140017d75
cmp qword [rsp + 0x298], 7
mov rcx, rdi
jbe 0x140017d25
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebp, 0
test eax, eax
jne 0x140017d75
jmp 0x140017d5f
cmp qword [rsp + 0x298], 7
mov rcx, rdi
jbe 0x140017d56
mov rcx, qword [rsp + 0x280]
call r12
xor ebp, ebp
test eax, eax
jne 0x140017d75
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
or eax, 1
cmp eax, 3
mov eax, 0
cmove ebp, eax
test r13d, r13d
cmovne ebp, r13d
mov rcx, rbx
call fcn.140004c50
mov rcx, rsi
mov rdx, rbx
call fcn.14001efd0
mov rcx, rdi
mov rdx, rbx
call fcn.140013f80
mov rcx, rbx
call fcn.140013ea0
cmp qword [rsp + 0x290], 0
mov r13d, ebp
jne 0x140017ca0
lea rcx, [rsp + 0x280]
call fcn.140013ea0
lea rcx, [rsp + 0x2a0]
call fcn.14001ee70
mov rcx, qword [rsp + 0x570]
xor rcx, rsp
call fcn.1400a8dd0
mov eax, ebp
add rsp, 0x578
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400182c0
Capabilities:
Delete file

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x178
mov r14, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x170], rax
call fcn.14000f320
mov rdi, rax
lea r15, [0x1400f92d1]
mov rcx, rax
mov rdx, r15
call fcn.14000f740
test al, al
jne 0x14001831a
lea rdx, str.vmodule
mov rcx, rdi
call fcn.14000f740
test al, al
je 0x140018458
cmp qword [0x140128a18], 0
je 0x14001834d
lea rdx, str..._.._base_logging.cc
lea r9, str._g_vlog_info_prev
lea rsi, [rsp + 0x60]
mov rcx, rsi
mov r8d, 0x1a4
call fcn.140018570
mov rcx, rsi
call fcn.1400186e0
mov rax, qword [0x140128a20]
mov qword [0x140128a18], rax
mov ecx, 0x20
call fcn.1400a8a10
mov rsi, rax
lea rcx, str.vmodule
mov qword [rsp + 0x30], rcx
call fcn.1400dff30
mov qword [rsp + 0x38], rax
lea r12, [rsp + 0x60]
lea r8, [rsp + 0x30]
mov rcx, rdi
mov rdx, r12
call fcn.14000f7b0
mov qword [rsp + 0x20], r15
mov rcx, r15
call fcn.1400dff30
mov qword [rsp + 0x28], rax
lea rbx, [rsp + 0x40]
lea r8, [rsp + 0x20]
mov rcx, rdi
mov rdx, rbx
call fcn.14000f7b0
lea r9, [0x140128a28]
mov rcx, rsi
mov rdx, rbx
mov r8, r12
call fcn.140029dd0
mov qword [0x140128a20], rsi
mov rax, qword [rsp + 0x58]
cmp rax, 0x10
jb 0x140018417
mov rcx, qword [rsp + 0x40]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140018412
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140018560
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1400a8a80
mov rax, qword [rsp + 0x78]
cmp rax, 0x10
jb 0x140018458
mov rcx, qword [rsp + 0x60]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140018453
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140018560
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1400a8a80
mov eax, dword [r14]
mov dword [section..data], eax
mov bl, 1
test al, 1
je 0x14001853d
mov rcx, qword [0x140128a78]
test rcx, rcx
je 0x140018488
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140128a78], 0
mov rdi, qword [0x140128a30]
test rdi, rdi
jne 0x1400184c1
mov ecx, 0x20
call fcn.1400a8a10
mov rdi, rax
mov eax, 7
movq xmm0, rax
pslldq xmm0, 8
movdqu xmmword [rdi + 0x10], xmm0
mov word [rdi], 0
mov qword [0x140128a30], rdi
mov rsi, qword [r14 + 8]
mov rcx, rsi
call fcn.1400e0570
mov rbx, rax
mov rax, qword [rdi + 0x18]
cmp rax, rbx
jae 0x1400184f0
mov rcx, rdi
mov rdx, rbx
mov r9, rsi
call fcn.140003250
cmp dword [r14 + 0x14], 0
jne 0x140018536
jmp 0x14001851f
mov r15, rdi
cmp rax, 8
jb 0x1400184fc
mov r15, qword [rdi]
mov qword [rdi + 0x10], rbx
mov r8, rbx
add r8, rbx
mov rcx, r15
mov rdx, rsi
call fcn.1400cc760
mov word [r15 + rbx*2], 0
cmp dword [r14 + 0x14], 0
jne 0x140018536
mov rcx, qword [0x140128a30]
cmp qword [rcx + 0x18], 7
jbe 0x140018530
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.140018cf0
mov ebx, eax
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400a8dd0
mov eax, ebx
add rsp, 0x178
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.1400d9340
ud2
Function at 0x14001b7f0
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r13, r8
mov r14, rdx
mov r15, rcx
movzx eax, byte [r8]
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
movzx edx, byte [r8 + 1]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [r8 + 2]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [r8 + 3]
xor rdx, rcx
imul rdx, rax
and rdx, qword [r15 + 0x30]
mov rax, qword [r15 + 8]
mov r8, qword [r15 + 0x18]
lea rdi, [rdx + rdx]
add rdi, 1
shl rdx, 4
mov rcx, qword [r8 + rdx]
mov ebx, dword [r13]
mov rdx, rcx
jmp 0x14001b873
mov rdx, qword [rdx]
mov rsi, rcx
cmp rcx, rax
je 0x14001b882
mov rsi, qword [r8 + rdi*8]
mov rsi, qword [rsi]
cmp rsi, rdx
je 0x14001b89b
cmp dword [rdx + 0x10], ebx
jne 0x14001b870
cmp rdx, rax
je 0x14001b89b
mov qword [r14], rdx
mov byte [r14 + 8], 0
jmp 0x14001b910
mov rdi, qword [rax]
mov r12, qword [rdi + 8]
mov ecx, 0x38
call fcn.1400a8a10
mov rsi, rax
test rdi, rdi
mov rax, r12
cmove rax, rsi
mov rcx, rdi
cmove rcx, rsi
mov qword [rsi], rcx
mov qword [rsi + 8], rax
mov eax, dword [r13]
mov dword [rsi + 0x10], eax
lea rcx, [rsi + 0x18]
call fcn.140013cc0
mov rax, qword [r15 + 0x10]
movabs rcx, 0x492492492492491
cmp rax, rcx
je 0x14001b923
add rax, 1
mov qword [r15 + 0x10], rax
mov qword [rdi + 8], rsi
mov qword [r12], rsi
mov rax, qword [r15 + 8]
mov r9, qword [rax]
lea r8, [r9 + 0x10]
mov rcx, r15
mov rdx, r14
call fcn.14001b940
mov rax, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.list_T__too_long
call fcn.1400aa2a0
ud2
Function at 0x14001c780
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x14001c7af
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14001c7b2
mov rcx, qword [rdi]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x14001c7d3
test bl, bl
je 0x14001c81c
cmp byte [rdi + 8], 0
je 0x14001c80e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14001c811
cmp byte [rdi + 8], 0
je 0x14001c7e4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14001c7e7
mov rcx, qword [rdi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14001c7fd
xor edi, edi
jmp 0x14001c898
cmp byte [rdi + 8], 0
je 0x14001c850
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14001c853
mov rcx, qword [rdi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [rdi + 8], 0
je 0x14001c82d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14001c830
mov rcx, qword [rdi]
call sub.KERNEL32.dll_GetProcessId
mov rcx, qword [0x140128e88]
mov dil, 1
test rcx, rcx
je 0x14001c898
mov edx, eax
mov r8d, esi
call fcn.14002bed0
jmp 0x14001c898
mov rcx, qword [rdi]
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14001c866
mov esi, dword [rsp + 0x24]
cmp byte [rdi + 8], 0
je 0x14001c877
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14001c87a
mov rcx, qword [rdi]
call sub.KERNEL32.dll_GetProcessId
mov rcx, qword [0x140128e88]
test rcx, rcx
je 0x14001c895
mov edx, eax
mov r8d, esi
call fcn.14002bed0
mov dil, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400a8dd0
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400221c0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov qword [rsp + 0x40], rdx
mov r12, qword [rcx]
lea rax, [r12 + 8]
mov qword [rsp + 0x38], rax
mov r13, qword [r12 + 8]
cmp byte [r13 + 0x19], 0
mov qword [rsp + 0x30], r8
je 0x1400221fd
mov qword [rsp + 0x28], r12
jmp 0x140022286
mov rbx, qword [r8]
mov r15, qword [r8 + 8]
sub r15, rbx
mov qword [rsp + 0x28], r12
mov rdi, qword [r13 + 0x20]
mov rbp, qword [r13 + 0x28]
sub rbp, rdi
cmp rbp, r15
setb r14b
mov rsi, r15
cmovb rsi, rbp
mov rcx, rdi
mov rdx, rbx
mov r8, rsi
call fcn.1400cc660
test eax, eax
sete cl
test eax, eax
js 0x140022277
and r14b, cl
jne 0x140022277
cmp byte [r12 + 0x19], 0
je 0x140022270
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.1400cc660
test eax, eax
mov rcx, r12
cmove rcx, r13
cmp r15, rbp
cmovae rcx, r12
test eax, eax
cmovs rcx, r13
mov r12, rcx
mov qword [rsp + 0x28], r13
jmp 0x14002227b
add r13, 0x10
mov r13, qword [r13]
cmp byte [r13 + 0x19], 0
je 0x14002220c
xor eax, eax
cmp byte [r12 + 0x19], al
mov rcx, qword [rsp + 0x38]
cmove rcx, r12
mov rdi, qword [rcx]
cmp byte [rdi + 0x19], al
jne 0x1400222f4
mov rax, qword [rsp + 0x30]
mov rsi, qword [rax]
mov rbp, qword [rax + 8]
sub rbp, rsi
xor r15d, r15d
mov rdx, qword [rdi + 0x20]
mov r8, qword [rdi + 0x28]
sub r8, rdx
cmp rbp, r8
setb bl
cmovb r8, rbp
mov rcx, rsi
call fcn.1400cc660
test eax, eax
sets al
sete cl
and cl, bl
or cl, al
mov eax, ecx
xor al, 1
movzx eax, al
shl rax, 4
test cl, cl
cmovne r12, rdi
mov rdi, qword [rdi + rax]
cmp byte [rdi + 0x19], r15b
je 0x1400222b0
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
mov qword [rax + 8], r12
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140023200
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x230
mov r14, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x228], rax
lea rdi, [rsp + 0x20]
mov word [rdi], 0
xor ebx, ebx
lea r15, str.PROGRAMFILES
mov rsi, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rbx + r15]
mov word [rsp + 0x20], 0
mov rdx, rdi
mov r8d, 0x104
call rsi
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x14002326f
mov edx, eax
mov rcx, rdi
mov r8, r14
call fcn.140023190
test al, al
jne 0x14002327d
add rbx, 8
cmp rbx, 0x18
jne 0x14002323d
xor esi, esi
jmp 0x140023280
mov sil, 1
mov rcx, qword [rsp + 0x228]
xor rcx, rsp
call fcn.1400a8dd0
mov eax, esi
add rsp, 0x230
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret