joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004e02c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18004e05c
xor eax, eax
jmp 0x18004e11f
mov rbp, rbx
cmp word [rax], si
je 0x18004e081
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18004e068
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18004e064
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18004c714
movsxd r14, eax
test eax, eax
jne 0x18004e0bf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18004e055
mov rcx, r14
call fcn.180049548
mov rdi, rax
test rax, rax
jne 0x18004e0d8
xor ecx, ecx
call fcn.18004767c
jmp 0x18004e0b4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18004c714
test eax, eax
jne 0x18004e109
mov rcx, rdi
call fcn.18004767c
jmp 0x18004e113
xor ecx, ecx
call fcn.18004767c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x180051d18
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.1800457b0
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x180051db9
cmp ebx, dword [rsp + 0x30]
je 0x180051db2
test esi, esi
je 0x180051db2
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x180051d8d
sub r8w, 0x61
cmp r8w, 0x19
ja 0x180051d9a
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x180051d77
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x180051d9e
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x180051dbb
mov eax, 1
jmp 0x180051dbb
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180053444
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.18004b078
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.18004b078
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x180053594
cmp rax, 0xffffffffffffffff
je 0x180053594
xor edi, edi
test rbp, rbp
jle 0x18005353f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.180047604
mov rbx, rax
test rax, rax
jne 0x1800534cc
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x180053535
mov edx, 0x8000
mov ecx, r14d
call fcn.1800532c8
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.180048bf0
cmp eax, 0xffffffff
je 0x180053515
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1800534dc
mov edx, r15d
mov ecx, r14d
call fcn.1800532c8
jmp 0x180053535
cmp byte [rsi + 0x38], dil
je 0x18005352c
cmp dword [rsi + 0x34], 5
jne 0x18005352c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x180053535
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.18004767c
jmp 0x1800535a8
jns 0x1800535a8
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.18004b078
cmp rax, 0xffffffffffffffff
jne 0x180053560
cmp byte [rsi + 0x30], dil
je 0x1800535a8
mov edi, dword [rsi + 0x2c]
jmp 0x1800535a8
mov ecx, r14d
call fcn.18004f66c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1800535a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1800535a8
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1800535a1
mov eax, dword [rsi + 0x2c]
jmp 0x1800535a6
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.18004b078
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1800545d0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1800545f8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1800545f8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14001bdf0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x14001be24
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x14001be10
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140012660
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14001be49
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140027280
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14001bec3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bebe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001bebe
call qword [0x140081a10]
int3
call fcn.14007d34c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14001bed0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x14001bf04
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x14001bef0
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140012660
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14001bf29
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140027280
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14001bfa3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bf9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001bf9e
call qword [0x140081a10]
int3
call fcn.14007d34c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14001bfb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x14001bfe4
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x14001bfd0
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140012660
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14001c009
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140027280
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14001c083
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c07e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001c07e
call qword [0x140081a10]
int3
call fcn.14007d34c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14001c090
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r10, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
cmp byte [r8 + 0xb], bl
je 0x14001c0c4
mov ecx, ebx
lea eax, [rcx - 0x65]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x14001c0b0
mov byte [r8 + 0xb], bl
add r8, 0xa
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.140012660
nop
cmp byte [rdi + 0xb], 0
je 0x14001c0f4
lea eax, [rbx - 0x65]
xor byte [rbx + rdi], al
inc rbx
cmp rbx, 0xa
jb 0x14001c0e1
mov byte [rdi + 0xb], 0
lea r8, [rdi + 0xa]
lea r9, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140012660
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
movzx edx, byte [rsp + 0x20]
mov rcx, rsi
call fcn.140021950
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14001c164
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c15e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001c15e
call qword [0x140081a10]
int3
call fcn.14007d34c
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14001c1a4
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c19f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001c19f
call qword [0x140081a10]
int3
call fcn.14007d34c
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x14001c1b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x14001c1e4
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x14001c1d0
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140012660
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14001c209
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140027280
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14001c283
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c27e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001c27e
call qword [0x140081a10]
int3
call fcn.14007d34c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140022900
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x140022923
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x140022910
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140012660
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140022940
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x140022963
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x140022950
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140012660
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400234d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x1400234f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x1400234e0
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x140023500
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x140023528
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x140023510
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x140023530
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x140023553
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x140023540
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x140023560
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x140023583
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x140023570
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x140023c90
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r10, rcx
mov ecx, r9d
test r8, r8
je 0x140023d77
sub r10, rdx
cmp r8, 8
jb 0x140023d53
mov rax, r8
lea r9, [rdx + 4]
and rax, 0xfffffffffffffff8
xorps xmm3, xmm3
xorps xmm2, xmm2
movd xmm1, dword [r10 + r9 - 4]
add rcx, 8
movd xmm0, dword [r9 - 4]
lea r9, [r9 + 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklbw xmm0, xmm0
psrad xmm1, 0x18
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
pxor xmm1, xmm0
movd xmm0, dword [r9 - 8]
punpcklbw xmm0, xmm0
por xmm3, xmm1
movd xmm1, dword [r10 + r9 - 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklwd xmm0, xmm0
psrad xmm1, 0x18
psrad xmm0, 0x18
pxor xmm1, xmm0
por xmm2, xmm1
cmp rcx, rax
jb 0x140023cc0
por xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd r9d, xmm2
cmp rcx, r8
jae 0x140023d77
lea rax, [rcx + rdx]
sub r8, rcx
nop word [rax + rax]
movsx edx, byte [r10 + rax]
movsx ecx, byte [rax]
lea rax, [rax + 1]
xor edx, ecx
or r9d, edx
sub r8, 1
jne 0x140023d60
test r9d, r9d
sete al
ret
Function at 0x140047da0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [rcx + 0x28]
mov rdi, rdx
mov rbx, rcx
cmp r8d, 0x40
jae 0x140047f58
lea ecx, [r8*8]
mov qword [rsp + 0x30], rsi
add qword [rbx], rcx
mov byte [r8 + rbx + 0x2c], 0x80
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x38
jbe 0x140047e18
cmp eax, 0x40
jae 0x140047e02
nop word [rax + rax]
mov byte [rax + rbx + 0x2c], 0
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x40
jb 0x140047df0
lea rsi, [rbx + 0x2c]
mov rcx, rbx
mov rdx, rsi
call fcn.140048080
xor eax, eax
mov dword [rbx + 0x28], eax
jmp 0x140047e20
lea rsi, [rbx + 0x2c]
jae 0x140047e32
nop
mov byte [rax + rbx + 0x2c], 0
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x38
jb 0x140047e20
movzx eax, byte [rbx + 7]
mov rdx, rsi
mov byte [rbx + 0x64], al
mov rcx, rbx
movzx eax, byte [rbx + 6]
mov byte [rbx + 0x65], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 0x66], al
movzx eax, byte [rbx + 4]
mov byte [rbx + 0x67], al
movzx eax, byte [rbx + 3]
mov byte [rbx + 0x68], al
movzx eax, byte [rbx + 2]
mov byte [rbx + 0x69], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 0x6a], al
movzx eax, byte [rbx]
mov byte [rbx + 0x6b], al
call fcn.140048080
movzx eax, byte [rbx + 0xb]
mov byte [rdi], al
movzx eax, byte [rbx + 0xa]
mov byte [rdi + 1], al
movzx eax, byte [rbx + 9]
mov byte [rdi + 2], al
movzx eax, byte [rbx + 8]
mov byte [rdi + 3], al
movzx eax, byte [rbx + 0xf]
mov byte [rdi + 4], al
movzx eax, byte [rbx + 0xe]
mov byte [rdi + 5], al
movzx eax, byte [rbx + 0xd]
mov byte [rdi + 6], al
movzx eax, byte [rbx + 0xc]
mov byte [rdi + 7], al
movzx eax, byte [rbx + 0x13]
mov byte [rdi + 8], al
movzx eax, byte [rbx + 0x12]
mov byte [rdi + 9], al
movzx eax, byte [rbx + 0x11]
mov byte [rdi + 0xa], al
movzx eax, byte [rbx + 0x10]
mov byte [rdi + 0xb], al
movzx eax, byte [rbx + 0x17]
mov byte [rdi + 0xc], al
movzx eax, byte [rbx + 0x16]
mov byte [rdi + 0xd], al
movzx eax, byte [rbx + 0x15]
mov byte [rdi + 0xe], al
movzx eax, byte [rbx + 0x14]
mov byte [rdi + 0xf], al
movzx eax, byte [rbx + 0x1b]
mov byte [rdi + 0x10], al
movzx eax, byte [rbx + 0x1a]
mov byte [rdi + 0x11], al
movzx eax, byte [rbx + 0x19]
mov byte [rdi + 0x12], al
movzx eax, byte [rbx + 0x18]
mov byte [rdi + 0x13], al
movzx eax, byte [rbx + 0x1f]
mov byte [rdi + 0x14], al
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 0x15], al
movzx eax, byte [rbx + 0x1d]
mov byte [rdi + 0x16], al
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 0x17], al
movzx eax, byte [rbx + 0x23]
mov byte [rdi + 0x18], al
movzx eax, byte [rbx + 0x22]
mov byte [rdi + 0x19], al
movzx eax, byte [rbx + 0x21]
mov byte [rdi + 0x1a], al
movzx eax, byte [rbx + 0x20]
mov byte [rdi + 0x1b], al
movzx eax, byte [rbx + 0x27]
mov byte [rdi + 0x1c], al
movzx eax, byte [rbx + 0x26]
mov byte [rdi + 0x1d], al
movzx eax, byte [rbx + 0x25]
mov byte [rdi + 0x1e], al
movzx eax, byte [rbx + 0x24]
mov rsi, qword [rsp + 0x30]
mov byte [rdi + 0x1f], al
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140047f70
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov qword [rcx + 0x24], 0x5be0cd19
mov qword [rcx], rax
mov dword [rcx + 8], 0x6a09e667
mov dword [rcx + 0xc], 0xbb67ae85
mov dword [rcx + 0x10], 0x3c6ef372
mov dword [rcx + 0x14], 0xa54ff53a
mov dword [rcx + 0x18], 0x510e527f
mov dword [rcx + 0x1c], 0x9b05688c
mov dword [rcx + 0x20], 0x1f83d9ab
ret
Function at 0x140061f90
Capabilities:
Check http status code

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
lea eax, [rdx - 0xc8]
mov rdi, rcx
mov rcx, qword [rcx]
mov esi, r8d
cmp eax, 0x64
jb 0x140061fc5
lea rdx, str.Couldnt_set_desired_mode
call fcn.1400442d0
lea eax, [rbx + 0x11]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
cmp edx, 0xc8
je 0x140061fdc
mov r8d, edx
lea rdx, str.Got_a__03d_response_code_instead_of_the_assumed_200_n
call fcn.140044450
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r14
cmp esi, 0x13
jne 0x140061ff8
mov rcx, rdi
call fcn.140061ed0
jmp 0x14006212f
cmp esi, 0x14
jne 0x140062111
mov rsi, qword [rdi]
mov rbp, rbx
cmp dword [rsi + 0xba0], 2
jne 0x140062079
mov rax, qword [rsi + 0x1e0]
mov rdx, qword [rax]
test rdx, rdx
je 0x140062079
mov byte [rsp + 0x28], 1
lea r9, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rcx, rsi
mov qword [rsp + 0x50], rbx
call fcn.14002d970
test eax, eax
jne 0x14006212f
mov rcx, qword [rsp + 0x50]
lea edx, [rax + 0x2f]
call fcn.14007e346
test rax, rax
je 0x14006206e
mov rbp, qword [rsp + 0x50]
mov ecx, 1
sub rax, rbp
cmovne rcx, rax
mov byte [rcx + rbp], bl
jmp 0x140062079
mov rcx, qword [rsp + 0x50]
call qword [fcn.14007e370]
mov rdx, qword [rsi + 0xc08]
test rdx, rdx
jne 0x14006209d
cmp byte [rsi + 0xf0d], bl
lea rax, str.NLST
lea rdx, str.LIST
cmovne rdx, rax
lea r8, [0x14008f649]
test rbp, rbp
mov r9, r8
lea rax, [0x140082170]
cmovne r9, rbp
lea rcx, [0x140085448]
cmovne r8, rax
call fcn.140032b90
mov rcx, rbp
mov r14, rax
call qword [fcn.14007e370]
test r14, r14
jne 0x1400620dc
lea ebx, [r14 + 0x1b]
jmp 0x140062131
lea rcx, [rdi + 0xa00]
mov r8, r14
lea rdx, [0x140089c40]
call fcn.1400780f0
mov rcx, r14
mov esi, eax
call qword [fcn.14007e370]
test esi, esi
je 0x140062105
mov ebx, esi
jmp 0x140062131
mov dword [rdi + 0xab8], 0x1f
jmp 0x140062131
cmp esi, 0x15
jne 0x14006211c
lea r8d, [rsi - 8]
jmp 0x140062125
cmp esi, 0x16
jne 0x140062131
lea r8d, [rsi - 8]
mov dl, 1
mov rcx, rdi
call fcn.140061a00
mov ebx, eax
mov r14, qword [rsp + 0x60]
mov eax, ebx
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x14007c970
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [fcn.14007e376]
mov rdi, rax
test rax, rax
jne 0x14007c9b2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x14007c9f9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + 8]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + 0x10]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x14007ca52
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + 8]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + 8]
sub rbp, 1
jne 0x14007ca10
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x14007ca93
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x14008f3ca]
mov r8d, 1
call qword [rbx + 8]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14008f3cb]
mov r8d, 1
call qword [rbx + 8]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x14007ca60
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x14007dfe8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x140081200]
test rax, rax
je 0x14007e032
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14007e032
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14007e032
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14007e032
cmp dword [rcx + 0x84], 0xe
jbe 0x14007e032
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14007e034
xor al, al
add rsp, 0x28
ret