joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6a1f20
Capabilities:
Enumerate gui resources

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov esi, edx
mov rax, qword [0x00717b90]
cmp qword [rax + 0x2a8], 0
je 0x6a20e6
test sil, sil
jne 0x6a2008
cmp dword [rbx + 0x110], 0
jne 0x6a1ff9
mov rcx, rbx
call fcn.006a6530
lea rcx, [0x006a1df0]
mov rdx, rax
call sub.user32.dll_EnumWindows
cmp qword [rbx + 0x88], 0
je 0x6a1fbb
mov rax, qword [0x00717b90]
cmp byte [rax + 0x16b], 0
je 0x6a1fbb
mov rcx, qword [rbx + 0x178]
call fcn.00410800
mov rdi, rax
test edi, edi
jl 0x6a1fba
mov rax, qword [rbx + 0x178]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
xor rdx, rdx
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6a1f9c
nop
mov rax, qword [rbx + 0x108]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6a1ff8
mov rcx, qword [rbx + 0x108]
mov edx, edi
call fcn.004fe9d0
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6a1fcc
nop
lea rax, [rbx + 0x110]
add dword [rax], 1
jmp 0x6a20e6
cmp dword [rbx + 0x110], 0
jle 0x6a20e6
lea rax, [rbx + 0x110]
sub dword [rax], 1
cmp dword [rbx + 0x110], 0
jne 0x6a20e6
cmp qword [rbx + 0x88], 0
je 0x6a207b
mov rax, qword [0x00717b90]
cmp byte [rax + 0x16b], 0
je 0x6a207b
mov rcx, qword [rbx + 0x178]
call fcn.00410800
mov rdi, rax
test edi, edi
jl 0x6a207a
mov rax, qword [rbx + 0x178]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
mov edx, 5
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6a2059
nop
mov rax, qword [rbx + 0x108]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6a20b8
mov rcx, qword [rbx + 0x108]
mov edx, edi
call fcn.004fe9d0
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6a208c
nop
mov rax, qword [rbx + 0x108]
mov rcx, rax
mov rsi, qword [rax]
call qword [rsi + 0x10]
lea rcx, [rbx + 0x178]
mov rdx, qword [0x0068c388]
mov r8d, 1
xor r9, r9
call fcn.00410b90
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x6a32f0
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x220
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
cmp byte [rbx + 0x130], 0
je 0x6a335e
cmp byte [rbx + 0x16b], 0
jne 0x6a335e
mov rcx, qword [rbx + 0x2a8]
lea rdx, [rbp + 0x20]
mov r8d, pe_nt_image_headers64
call sub.user32.dll_GetWindowTextW
mov rcx, rsi
lea rdx, [rbp + 0x20]
mov r8d, eax
call fcn.0040dc30
mov rax, qword [rsi]
xor rcx, rcx
test rax, rax
je 0x6a3349
mov ecx, dword [rax - 4]
test ecx, ecx
jne 0x6a336d
mov rcx, rsi
mov rdx, qword [rbx + 0xf0]
call fcn.0040dfa0
jmp 0x6a336d
mov rcx, rsi
mov rdx, qword [rbx + 0xf0]
call fcn.0040dfa0
mov rax, rsi
lea rsp, [rbp + 0x220]
pop rbx
pop rsi
pop rbp
ret
Function at 0x6a6930
Capabilities:
Hide graphical window from taskbar

Disassembly:
push rbp
push rbx
sub rsp, 0x48
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov byte [rbp + 0x2f], dl
mov qword [rbp + 0x38], 0
nop
movzx rax, byte [rbp + 0x2f]
mov rcx, qword [rbp + 0x20]
cmp al, byte [rcx + 0x16b]
je 0x6a6b7b
movzx rax, byte [rbp + 0x2f]
mov rcx, qword [rbp + 0x20]
mov byte [rcx + 0x16b], al
mov rax, qword [rbp + 0x20]
cmp qword [rax + 0x88], 0
je 0x6a6ab4
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x88]
call fcn.005c12c0
test al, al
je 0x6a6ab4
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x88]
movzx rax, word [rax + 0x34]
test ax, 0x10
jne 0x6a6ab4
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x88]
movzx rax, word [rax + 0x34]
test ax, 2
jne 0x6a6ab4
movzx rax, byte [rbp + 0x2f]
test al, al
je 0x6a6a1b
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x2a8]
xor rdx, rdx
xor r8, r8
call fcn.00690a80
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x88]
call fcn.005c0cb0
mov rcx, rax
mov dl, 1
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x88]
movzx r8, byte [rax + 0x99]
call fcn.00690a80
jmp 0x6a6a98
call sub.user32.dll_GetForegroundWindow
mov rbx, rax
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x88]
call fcn.005c0cb0
cmp rbx, rax
sete bl
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x88]
call fcn.005c0cb0
mov rcx, rax
xor rdx, rdx
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x88]
movzx r8, byte [rax + 0x99]
call fcn.00690a80
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x2a8]
mov dl, 1
mov r8b, 1
call fcn.00690a80
test bl, bl
je 0x6a6a98
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x88]
call fcn.005c0cb0
mov rcx, rax
call sub.user32.dll_SetForegroundWindow
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x88]
mov edx, 0xb033
xor r8, r8
xor r9, r9
call fcn.005b46e0
movzx rax, byte [rbp + 0x2f]
test al, al
je 0x6a6b0d
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x2a8]
mov ecx, 0xffffffec
mov edx, ecx
mov rcx, rax
call sub.user32.dll_GetWindowLongPtrW
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx + 0x2a8]
mov edx, 0xffffffec
or rax, 0x80
mov r8, rax
call sub.user32.dll_SetWindowLongPtrW
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x2a8]
xor rdx, rdx
call sub.user32.dll_SetWindowTextW
jmp 0x6a6b7b
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x2a8]
mov ecx, 0xffffffec
mov edx, ecx
mov rcx, rax
call sub.user32.dll_GetWindowLongPtrW
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx + 0x2a8]
mov edx, 0xffffffec
and rax, 0xffffffffffffff7f
mov r8, rax
call sub.user32.dll_SetWindowLongPtrW
mov rax, qword [rbp + 0x20]
mov rbx, qword [rax + 0x2a8]
lea rcx, [rbp + 0x38]
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax + 0xf0]
call fcn.0040e020
mov rcx, qword [rbp + 0x38]
call fcn.0040ef20
mov rcx, rbx
mov rdx, rax
call sub.user32.dll_SetWindowTextW
nop
lea rcx, [rbp + 0x38]
call fcn.0040d970
lea rsp, [rbp + 0x48]
pop rbx
pop rbp
ret
Function at 0x6af3d0
Capabilities:
Hide graphical window

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbx, rcx
cmp qword [rbx + 0xc0], 0
jne 0x6af486
mov rcx, qword [rbx + 0x10]
call fcn.005c0cb0
mov rcx, qword [0x005da7b0]
mov dl, 1
mov r8, rax
call fcn.005b7910
mov qword [rbx + 0xc0], rax
mov rsi, qword [rbx + 0xc0]
mov rcx, rsi
xor rdx, rdx
call fcn.005e9470
lea rax, [rsi + 0x498]
mov qword [rax + 8], rbx
lea rcx, [0x006aea40]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xc0]
call fcn.005c0cb0
mov rsi, rax
mov ecx, 3
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor rdx, rdx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xc0]
call fcn.005c0cb0
mov rcx, rax
xor rdx, rdx
call sub.user32.dll_ShowWindow
cmp qword [rbx + 0xe0], 0
jne 0x6af531
mov rcx, qword [rbx + 0x10]
call fcn.005c0cb0
mov rcx, qword [0x005da7b0]
mov dl, 1
mov r8, rax
call fcn.005b7910
mov qword [rbx + 0xe0], rax
mov rsi, qword [rbx + 0xe0]
mov rcx, rsi
mov dl, 1
call fcn.005e9470
lea rax, [rsi + 0x498]
mov qword [rax + 8], rbx
lea rcx, [0x006aeaa0]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xe0]
call fcn.005c0cb0
mov rsi, rax
mov ecx, 2
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor rdx, rdx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xe0]
call fcn.005c0cb0
mov rcx, rax
xor rdx, rdx
call sub.user32.dll_ShowWindow
cmp qword [rbx + 0xd0], 0
jne 0x6af5cd
mov rcx, qword [rbx + 0x10]
call fcn.005c0cb0
mov rcx, qword [0x005db770]
mov dl, 1
mov r8, rax
call fcn.005b7910
mov qword [rbx + 0xd0], rax
mov rax, qword [rbx + 0xd0]
mov byte [rax + 0x468], 1
mov rcx, qword [rbx + 0xd0]
call fcn.005c0cb0
mov rsi, rax
mov ecx, 2
call sub.user32.dll_GetSystemMetrics
mov edi, eax
mov ecx, 3
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor rdx, rdx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xd0]
call fcn.005c0cb0
mov rcx, rax
xor rdx, rdx
call sub.user32.dll_ShowWindow
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
Function at 0x6b5970
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x78
mov rbp, rsp
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0x90], rcx
mov byte [rbp + 0x98], dl
mov qword [rbp + 0xa0], r8
mov qword [rbp + 0xa8], r9
mov rcx, qword [rbp + 0xa0]
call fcn.0040db00
cmp byte [rbp + 0x98], 0
je 0x6b59d0
mov rcx, qword [rbp + 0x90]
movzx rdx, byte [rbp + 0x98]
call fcn.0040b010
mov qword [rbp + 0x90], rax
nop
nop
mov rax, qword [rbp + 0x90]
mov dword [rax + 0x34], 0
mov rax, qword [rbp + 0x90]
mov byte [rax + 0x31], 0
mov rax, qword [rbp + 0x90]
mov byte [rax + 0x30], 0
mov rcx, qword [rbp + 0x90]
xor rdx, rdx
xor r8, r8
call fcn.0056df70
mov rax, qword [rbp + 0x90]
mov rcx, qword [rbp + 0x90]
mov rcx, qword [rcx + 0x10]
mov qword [rax + 0x28], rcx
mov rax, qword [rbp + 0x90]
lea rcx, [rax + 0x20]
mov rdx, qword [rbp + 0xa0]
call fcn.0040dfa0
mov rax, qword [rbp + 0x90]
cmp qword [rax + 0x20], 0
je 0x6b5bb8
mov rcx, qword [rbp + 0x90]
mov rax, qword [rbp + 0x90]
mov rdx, qword [rax + 0x20]
call fcn.006b5570
mov rax, qword [rbp + 0x90]
mov rax, qword [rax + 0x28]
lea rax, [rax + 0x68]
mov rcx, qword [rbp + 0x90]
mov qword [rax + 8], rcx
lea rcx, [0x006b5860]
mov qword [rax], rcx
mov rax, qword [rbp + 0x90]
mov rcx, qword [rax + 0x20]
mov dl, 1
call fcn.00432340
test al, al
jne 0x6b5ba0
lea rcx, [rbp + 0xa0]
mov rax, qword [rbp + 0x90]
mov rdx, qword [rax + 0x20]
call fcn.00432d60
mov dword [rbp + 0x58], 0
cmp qword [rbp + 0xa0], 0
je 0x6b5ad1
mov rax, qword [rbp + 0xa0]
mov eax, dword [rax - 4]
mov dword [rbp + 0x58], eax
cmp dword [rbp + 0x58], 0
jle 0x6b5ae3
mov rcx, qword [rbp + 0xa0]
call fcn.006b56f0
mov rax, qword [rbp + 0x90]
mov rcx, qword [rax + 0x20]
call fcn.0040ef20
mov rcx, rax
mov edx, 0xc0000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0xffffffffffffffff
je 0x6b5ba0
cmp qword [rbp + 0xa8], 0
je 0x6b5b97
mov rax, qword [rbp + 0x90]
mov rcx, qword [rbp + 0xa8]
mov qword [rax + 0x18], rcx
mov rcx, qword [rbp + 0xa8]
lea rdx, [rbp + 0x60]
mov rax, qword [rbp + 0xa8]
mov rbx, qword [rax]
call qword [rbx + 0x48]
mov rcx, qword [rbp + 0x60]
call fcn.004107f0
test rax, rax
jle 0x6b5b97
mov rcx, qword [rbp + 0x60]
call fcn.004107f0
mov rcx, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov r8d, eax
lea r9, [rbp + 0x5c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov rcx, qword [rbp + 0x68]
call sub.kernel32.dll_CloseHandle
mov rax, qword [rbp + 0x90]
cmp dword [rax + 0x34], 0
je 0x6b5bb8
mov rax, qword [rbp + 0x90]
mov byte [rax + 0x31], 1
nop
lea rcx, [rbp + 0x60]
mov rdx, qword [0x00426c20]
call fcn.00410d70
lea rcx, [rbp + 0xa0]
call fcn.0040d970
cmp byte [rbp + 0x98], 0
je 0x6b5c30
mov rcx, qword [rbp + 0x90]
call fcn.0040b050
mov qword [rbp + 0x90], rax
jmp 0x6b5c30
mov rax, qword [rbp + 0x90]
lea rsp, [rbp + 0x78]
pop rbx
pop rbp
ret
Function at 0x6b6190
Capabilities:
Get session user name

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x38], 0
nop
mov dword [rbp + 0x34], 0xff
lea rcx, [rbp + 0x38]
mov edx, dword [rbp + 0x34]
add edx, 1
call fcn.0040ee30
mov rcx, qword [rbp + 0x38]
call fcn.0040eba0
mov rcx, rax
lea rdx, [rbp + 0x34]
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x6b61f2
lea rcx, [rbp + 0x38]
mov edx, dword [rbp + 0x34]
sub edx, 1
call fcn.0040ee30
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x38]
call fcn.0040f070
jmp 0x6b61fb
mov rcx, qword [rbp + 0x28]
call fcn.0040d970
nop
lea rcx, [rbp + 0x38]
call fcn.0040da10
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x40]
pop rbp
ret
Function at 0x6b75c0
Capabilities:
Print debug messages

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov ebx, ecx
lea rcx, [0x006b7600]
call sub.kernel32.dll_OutputDebugStringW
or esi, 0xffffffff
cmp qword [0x00717d80], 0
je 0x6b75eb
mov ecx, ebx
call qword [0x00717d80]
mov esi, eax
lea rcx, [0x006b761c]
call sub.kernel32.dll_OutputDebugStringW
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x6b9bf0
Capabilities:
Print debug messages

Disassembly:
push rbp
sub rsp, 0x20
mov rbp, rsp
mov qword [rbp + 0x30], rcx
mov rcx, qword [rbp + 0x30]
call fcn.0040db00
nop
cmp byte [0x00717e2c], 0
je 0x6b9c20
mov rcx, qword [rbp + 0x30]
call fcn.0040ef20
mov rcx, rax
call sub.kernel32.dll_OutputDebugStringW
nop
lea rcx, [rbp + 0x30]
call fcn.0040d970
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x14001e330
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rdi, r9
mov r14, rdx
mov rsi, rcx
movzx ecx, byte [r8]
mov eax, ecx
movabs rdx, 0xcbf29ce484222325
xor rax, rdx
movabs rdx, 0x100000001b3
imul rax, rdx
mov r8, qword [rsi + 0x30]
and r8, rax
add r8, r8
mov rdx, qword [rsi + 0x18]
mov rbx, qword [rsi + 8]
mov rax, qword [rdx + r8*8]
cmp rbx, rax
je 0x14001e3cc
mov rbx, qword [rdx + r8*8 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x14001e3cc
mov rbx, qword [rbx + 8]
cmp cl, byte [rbx + 0x10]
jne 0x14001e3a3
mov rdx, rdi
mov rcx, rsi
call fcn.140022a90
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x14001e4fb
mov qword [rsp + 0x20], rdi
mov rax, qword [r9]
cmp rbx, rax
je 0x14001e406
mov rcx, qword [r9 + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [r9 + 8]
mov qword [rax + 8], rcx
mov qword [r9 + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x14001e423
mov qword [rdx + r8*8], rdi
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rdi
jmp 0x14001e452
cmp rax, rbx
jne 0x14001e42e
mov qword [rdx + r8*8], rdi
jmp 0x14001e452
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rdi
je 0x14001e452
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x140256c40]
test rax, rax
jns 0x14001e473
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x14001e484
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x14001e4f0
cmp rdx, 0x200
jae 0x14001e4a0
lea rdx, [rdx*8]
jmp 0x14001e4b2
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x14001e4b2
add rdx, rdx
mov rcx, rsi
call fcn.1400232e0
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x14001e4f0
mov r15, qword [rax + 8]
nop word [rax + rax]
mov rbx, qword [rsi + 8]
mov rbx, qword [rbx]
lea r8, [rbx + 0x10]
mov r9, rbx
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14001e330
cmp rbx, r15
jne 0x14001e4d0
mov qword [r14], rdi
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x14001f100
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
movzx eax, byte [r8 + 0x10]
mov r9, rcx
movabs rcx, 0xcbf29ce484222325
mov rbx, rdx
xor rax, rcx
movabs rcx, 0x100000001b3
imul rax, rcx
mov r10, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and r10, rax
shl r10, 4
add rcx, r10
mov rax, qword [rcx]
cmp qword [rcx + 8], r8
jne 0x14001f18c
cmp rax, r8
jne 0x14001f172
mov rax, qword [r9 + 8]
mov qword [rcx], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
mov qword [r10 + rcx + 8], rax
lea rcx, [r9 + 8]
call fcn.140026990
mov rax, rbx
add rsp, 0x20
pop rbx
ret
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
lea rcx, [r9 + 8]
call fcn.140026990
mov rax, rbx
add rsp, 0x20
pop rbx
ret
cmp rax, r8
jne 0x14001f197
mov rax, qword [r8]
mov qword [rcx], rax
lea rcx, [r9 + 8]
call fcn.140026990
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x140022af0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140022ba2
cmp byte [rcx + 0x71], 0
je 0x140022ba2
mov rax, qword [rcx]
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140022b52
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x140022b5f
sub eax, 1
je 0x140022b63
sub eax, 2
je 0x140022ba2
xor al, al
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x140022b90
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call fcn.140207d34
cmp rdi, rax
jne 0x140022b52
cmp byte [rbx + 0x71], 0
sete al
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov rbx, qword [rsp + 0x68]
mov al, 1
add rsp, 0x50
pop rdi
ret
Function at 0x140028900
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140028924
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x140028967
mov rdx, qword [rbx + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x140028967
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov eax, edi
mov byte [rdx], dil
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x80], rsi
je 0x140028a72
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400289aa
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400289b9
movsx ecx, dil
jmp 0x140028a13
lea r8, [rsp + 0x90]
mov byte [rsp + 0x40], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x41]
lea r8, [rsp + 0x68]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x98]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x40]
call qword [rax + 0x38]
test eax, eax
js 0x140028a72
cmp eax, 1
jle 0x140028a2d
cmp eax, 3
jne 0x140028a72
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call fcn.140207418
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140028a77
mov rsi, qword [rsp + 0x90]
lea rax, [rsp + 0x48]
sub rsi, rax
je 0x140028a5d
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rsi
mov edx, 1
call fcn.140207d34
cmp rsi, rax
jne 0x140028a72
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x98], rax
mov eax, edi
jne 0x140028a77
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x140029f90
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rsi, rdx
mov rbx, rcx
je 0x14002a02b
mov rdi, r8
test r8, r8
jle 0x14002a020
mov rcx, rbx
call fcn.1400232b0
test rax, rax
jle 0x14002a000
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.1401fc480
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14002a018
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14002a020
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140029fc2
sub r14, rdi
mov rax, r14
jmp 0x14002a0da
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14002a042
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14002a044
xor ecx, ecx
movsxd rdi, ecx
test r14, r14
jle 0x14002a0d4
test ecx, ecx
jle 0x14002a07c
cmp r14, rdi
mov rcx, rsi
cmovl rdi, r14
mov r8, rdi
call fcn.1401fc480
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub r14, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
test r14, r14
jle 0x14002a0d4
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x14002a0d4
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14002a0c1
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov r9, qword [rbx + 0x80]
mov r8, r14
mov edx, 1
mov rcx, rsi
call fcn.1402077cc
sub r14, rax
sub rbp, r14
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14002a1b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rbp, rdx
mov rdi, rcx
je 0x14002a24a
mov rbx, r8
test r8, r8
jle 0x14002a242
mov rcx, rdi
call fcn.140024250
test rax, rax
jle 0x14002a220
mov rcx, qword [rdi + 0x40]
cmp rbx, rax
mov rsi, rbx
mov rdx, rbp
cmovge rsi, rax
mov r8, rsi
mov rcx, qword [rcx]
call fcn.1401fc480
mov rax, qword [rdi + 0x58]
sub rbx, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
jmp 0x14002a23a
mov rax, qword [rdi]
mov rcx, rdi
movzx edx, byte [rbp]
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14002a242
dec rbx
mov esi, 1
add rbp, rsi
test rbx, rbx
jg 0x14002a1e2
sub r14, rbx
mov rax, r14
jmp 0x14002a2c1
mov rax, qword [rcx + 0x40]
mov rsi, r14
mov r9, qword [rax]
test r9, r9
je 0x14002a261
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14002a263
xor ecx, ecx
movsxd rbx, ecx
test r14, r14
jle 0x14002a2bb
test ecx, ecx
jle 0x14002a297
cmp r14, rbx
mov rcx, r9
cmovl rbx, r14
mov r8, rbx
call fcn.1401fc480
mov rax, qword [rdi + 0x58]
add rbp, rbx
sub r14, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x40]
movsxd rax, ebx
add qword [rcx], rax
test r14, r14
jle 0x14002a2bb
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14002a2bb
mov r8, r14
mov edx, 1
mov rcx, rbp
call fcn.140207d34
sub r14, rax
sub rsi, r14
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14003a4d0
Capabilities:
Manipulate console buffer

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movzx ecx, word [rbx]
mov esi, 1
mov rdi, rax
mov word [rsp + 0x20], si
xor eax, eax
mov dword [rsp + 0x24], esi
mov dword [rsp + 0x28], esi
mov word [rsp + 0x2c], ax
mov dword [rsp + 0x30], eax
test cx, cx
je 0x14003a548
nop word [rax + rax]
mov word [rsp + 0x2e], cx
lea r9, [rsp + 0x50]
mov rcx, rdi
lea rdx, [rsp + 0x20]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
movzx ecx, word [rbx + 2]
lea rbx, [rbx + 2]
test cx, cx
jne 0x14003a520
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400496d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140049704
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1400496f0
ret