joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401022b0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x78
mov dword [rsp + 0x30], 0
jmp 0x1401022c8
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x14
jge 0x140102353
movsxd rax, dword [rsp + 0x30]
lea rcx, [0x14022ed60]
cmp qword [rcx + rax*8], 0
jne 0x14010234e
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
mov edx, dword [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.1400dd980
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov r8, qword [rsp + 0x40]
lea rdx, [0x1401f2318]
mov rcx, qword [rsp + 0x48]
call fcn.1400c2be0
mov qword [rsp + 0x50], rax
mov edx, 0x10e1
mov rcx, qword [rsp + 0x50]
call fcn.1401218a0
nop
lea rcx, [rsp + 0x58]
call fcn.1400c00e0
mov eax, dword [rsp + 0x30]
mov dword [0x14022ea28], eax
jmp 0x140102353
jmp 0x1401022be
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400de240]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x60], rax
movsxd rax, dword [0x14022ea28]
lea rcx, [0x14022eac0]
mov rdx, qword [rsp + 0x60]
mov qword [rcx + rax*8], rdx
add rsp, 0x78
ret
Function at 0x140117700
Capabilities:
Terminate process

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov r8d, dword [rsp + 0x50]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140117773
lea rdx, str.OpenProcess_failed:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400b1c20
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov qword [rsp + 0x38], rax
lea rdx, [0x1400b9cc0]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor al, al
jmp 0x1401177aa
mov edx, 1
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jne 0x14011779d
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x1401177aa
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x48
ret
Function at 0x14011d790
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x12a8
call fcn.140194220
sub rsp, rax
lea r8, [rsp + 0x24]
mov edx, 0x1000
lea rcx, [rsp + 0x2a0]
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
jne 0x14011d7c6
xor eax, eax
jmp 0x14011d950
mov eax, dword [rsp + 0x24]
xor edx, edx
mov ecx, 4
div rcx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 0
jmp 0x14011d7ec
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp + 0x20], eax
jae 0x14011d94e
mov eax, dword [rsp + 0x20]
cmp dword [rsp + rax*4 + 0x2a0], 0
je 0x14011d949
lea rax, [rsp + 0x90]
lea rcx, str._unknown_
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_sendto
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xa4]
mov rdi, rax
xor eax, eax
mov ecx, 0x1f4
rep stosb byte [rdi], al
mov eax, dword [rsp + 0x20]
mov r8d, dword [rsp + rax*4 + 0x2a0]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14011d949
mov dword [rsp + 0x2c], 0x104
lea r9, [rsp + 0x2c]
lea r8, [rsp + 0x90]
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x14011d93e
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x48]
call fcn.1400bd800
nop
mov r8, 0xffffffffffffffff
lea rdx, [0x1401ef314]
lea rcx, [rsp + 0x48]
call fcn.1400dcc40
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0xffffffffffffffff
je 0x14011d934
mov rax, qword [rsp + 0x40]
inc rax
mov r9, 0xffffffffffffffff
mov r8, rax
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.1400e5de0
mov rdx, qword [rsp + 0x12c0]
lea rcx, [rsp + 0x68]
call fcn.1400d8cd0
test eax, eax
jne 0x14011d929
mov eax, dword [rsp + 0x20]
mov eax, dword [rsp + rax*4 + 0x2a0]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x68]
call fcn.1400c0b70
nop
lea rcx, [rsp + 0x48]
call fcn.1400c0b70
mov eax, dword [rsp + 0x30]
jmp 0x14011d950
lea rcx, [rsp + 0x68]
call fcn.1400c0b70
nop
lea rcx, [rsp + 0x48]
call fcn.1400c0b70
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14011d7e2
xor eax, eax
add rsp, 0x12a8
pop rdi
pop rsi
ret
Function at 0x14011fa30
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x34], 0
lea rdx, [0x1401ef47a]
lea rcx, [rsp + 0x38]
call fcn.1400bba20
nop
mov dword [rsp + 0x30], 0x32000
mov rcx, qword [rsp + 0x88]
call fcn.1400b6080
mov qword [rsp + 0x40], rax
mov edx, dword [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.1400c8af0
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x80]
call fcn.1400b6080
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x78]
call fcn.1400b6080
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x48]
lea r8, [0x1401f0ce0]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edx, 0xffffffff
lea rcx, [rsp + 0x38]
call fcn.1400ceaa0
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
call fcn.1400bb9c0
mov eax, dword [rsp + 0x34]
or eax, 1
mov dword [rsp + 0x34], eax
lea rcx, [rsp + 0x38]
call fcn.1400c00e0
nop
mov rcx, qword [rsp + 0x78]
call fcn.1400c00e0
nop
mov rcx, qword [rsp + 0x80]
call fcn.1400c00e0
nop
mov rcx, qword [rsp + 0x88]
call fcn.1400c00e0
mov rax, qword [rsp + 0x70]
add rsp, 0x68
ret

Function at 0x140120520
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x30]
call fcn.1400bbbe0
nop
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jle 0x1401205cf
mov eax, dword [rsp + 0x20]
inc eax
cdqe
mov qword [rsp + 0x38], rax
mov eax, 2
mov rcx, qword [rsp + 0x38]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1401942ac
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x20]
inc eax
mov r8d, eax
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.1400c1930
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.140193e90
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
call fcn.1400bb9c0
mov eax, dword [rsp + 0x24]
or eax, 1
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0x30]
call fcn.1400c00e0
mov rax, qword [rsp + 0x60]
add rsp, 0x58
ret
Function at 0x140121910
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb0
mov dword [rsp + 0x40], reloc.WS2_32.dll_WSASetLastError
lea rax, [rsp + 0x44]
mov rdi, rax
xor eax, eax
mov ecx, WSAGetLastError
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0xc0]
call fcn.1400b6080
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x70], 5
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x140121968
jmp 0x140121997
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, [0x1401ef620]
mov rcx, qword [rsp + 0x28]
call fcn.1400bbae0
mov qword [rsp + 0x30], rax
mov edx, 0x447
mov rcx, qword [rsp + 0x30]
call fcn.1401218a0
xor eax, eax
add rsp, 0xb0
pop rdi
ret

Function at 0x14012ba90
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x2c8
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0x20]
call fcn.1400bbbe0
nop
mov rdx, qword [rsp + 0x2d8]
lea rcx, [rsp + 0x38]
call fcn.1400bb9c0
nop
lea rdx, [0x1401ef404]
lea rcx, [rsp + 0x38]
call fcn.1400c3980
lea rcx, [rsp + 0x38]
call fcn.1400b6080
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0xffffffffffffffff
je 0x14012bb4c
mov eax, dword [rsp + 0x70]
and eax, 0x10
test eax, eax
je 0x14012bb0a
jmp 0x14012bb2d
lea rdx, [0x1401ef474]
lea rcx, [rsp + 0x20]
call fcn.1400c3920
lea rdx, [rsp + 0x9c]
lea rcx, [rsp + 0x20]
call fcn.1400c3980
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14012bafd
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call fcn.1400bb9c0
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x60]
call fcn.1400ea8e0
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x20]
call fcn.1400c1870
nop
lea rcx, [rsp + 0x60]
call fcn.1400c00e0
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x2d0]
call fcn.1400bb9c0
mov eax, dword [rsp + 0x28]
or eax, 1
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x38]
call fcn.1400c00e0
nop
lea rcx, [rsp + 0x20]
call fcn.1400c00e0
mov rax, qword [rsp + 0x2d0]
add rsp, 0x2c8
ret
Function at 0x14012e760
Capabilities:
Terminate process

Disassembly:
sub rsp, 0xa8
mov eax, Ordinal_41
mov eax, eax
mov ecx, dword [0x140d152b0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rax + rcx]
cmp dword [0x140d0b380], eax
jle 0x14012e7c2
lea rcx, [0x140d0b380]
call fcn.140194190
cmp dword [0x140d0b380], 0xffffffff
jne 0x14012e7c2
mov edx, reloc.WLDAP32.dll_Ordinal_45
mov ecx, reloc.WLDAP32.dll_Ordinal_30
call fcn.14012e450
mov dword [0x140d0b37c], eax
lea rcx, [0x140d0b380]
call fcn.140194124
mov eax, Ordinal_41
mov eax, eax
mov ecx, dword [0x140d152b0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rax + rcx]
cmp dword [0x140d0b390], eax
jle 0x14012e81c
lea rcx, [0x140d0b390]
call fcn.140194190
cmp dword [0x140d0b390], 0xffffffff
jne 0x14012e81c
xor ecx, ecx
call fcn.140130d10
sub rax, 0x3e8
mov qword [0x140d0b388], rax
lea rcx, [0x140d0b390]
call fcn.140194124
xor ecx, ecx
call fcn.140130d10
mov qword [rsp + 0x30], rax
mov rax, qword [0x140d0b388]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea rdx, [0x1401f3d64]
mov rcx, qword [rsp + 0x20]
call fcn.1400bba20
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call fcn.1400c66c0
cmp eax, dword [0x140d0b37c]
jl 0x14012e910
call fcn.14012edb0
movzx eax, al
test eax, eax
je 0x14012e8bb
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rdx, [0x1401f3dd8]
mov rcx, qword [rsp + 0x48]
call fcn.1400bbae0
mov qword [rsp + 0x50], rax
mov edx, 0x6ef
mov rcx, qword [rsp + 0x50]
call fcn.1401218a0
jmp 0x14012e8ed
lea rax, [rsp + 0x78]
mov qword [rsp + 0x58], rax
lea rdx, str.err1
mov rcx, qword [rsp + 0x58]
call fcn.1400717b0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.1400f3fb0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov edx, reloc.WLDAP32.dll_Ordinal_30
mov ecx, reloc.WS2_32.dll_ntohs
call fcn.14012e450
mov dword [0x140d0b37c], eax
xor ecx, ecx
call fcn.140130d10
mov qword [0x140d0b388], rax
add rsp, 0xa8
ret
Function at 0x140137030
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov byte [rsp + 0x20], 0
mov dword [rsp + 0x24], 0
mov rcx, qword [rsp + 0x68]
call fcn.14006e400
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp + 0x24], eax
jge 0x1401370e1
movsxd rax, dword [rsp + 0x24]
mov rdx, rax
mov rcx, qword [rsp + 0x68]
call fcn.1400c23f0
movsx eax, byte [rax]
cmp eax, 0x61
jge 0x140137097
movsxd rax, dword [rsp + 0x24]
mov rdx, rax
mov rcx, qword [rsp + 0x68]
call fcn.1400c23f0
movsx eax, byte [rax]
cmp eax, 0x41
jl 0x1401370d2
movsxd rax, dword [rsp + 0x24]
mov rdx, rax
mov rcx, qword [rsp + 0x68]
call fcn.1400c23f0
movsx eax, byte [rax]
cmp eax, 0x7a
jle 0x1401370cb
movsxd rax, dword [rsp + 0x24]
mov rdx, rax
mov rcx, qword [rsp + 0x68]
call fcn.1400c23f0
movsx eax, byte [rax]
cmp eax, 0x5a
jg 0x1401370d2
mov byte [rsp + 0x20], 1
jmp 0x1401370e1
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
jmp 0x140137059
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x140137161
mov rcx, qword [rsp + 0x68]
call fcn.1400d6730
mov rcx, rax
call sub.WS2_32.dll_gethostbyname
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x140137149
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x40], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
mov dword [rsp + 0x2c], eax
mov rcx, qword [rsp + 0x68]
call fcn.140071ab0
mov eax, dword [rsp + 0x2c]
jmp 0x140137185
mov dword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x68]
call fcn.140071ab0
mov eax, dword [rsp + 0x30]
jmp 0x140137185
mov rcx, qword [rsp + 0x68]
call fcn.1400d6730
mov rcx, rax
call sub.WS2_32.dll_inet_addr
mov dword [rsp + 0x34], eax
mov rcx, qword [rsp + 0x68]
call fcn.140071ab0
mov eax, dword [rsp + 0x34]
add rsp, 0x58
ret

Function at 0x140138310
Capabilities:
Connect socket

Disassembly:
mov word [rsp + 0x18], r8w
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rcx, qword [rsp + 0x40]
call fcn.140138390
movzx eax, al
test eax, eax
jne 0x140138336
jmp 0x14013837b
mov eax, 2
mov word [rsp + 0x20], ax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x24], eax
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x22], ax
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x20]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
jne 0x140138371
jmp 0x14013837b
mov al, 1
jmp 0x14013837d
xor al, al
add rsp, 0x38
ret

Function at 0x1401383f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor r9d, r9d
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call sub.WS2_32.dll_recv
add rsp, 0x28
ret
Function at 0x140138600
Capabilities:
Send data
Send data on socket

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor r9d, r9d
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call sub.WS2_32.dll_send
add rsp, 0x28
ret
Function at 0x140141140
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0x1505
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x50], rax
jae 0x1401411ca
mov rax, qword [rsp + 0x28]
shl rax, 5
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax]
mov byte [rsp + 0x20], al
movzx ecx, byte [rsp + 0x20]
call fcn.1401535e0
movsx rax, al
mov rcx, qword [rsp + 0x28]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
jmp 0x14014116c
xor edx, edx
mov rax, qword [rsp + 0x28]
mov ecx, 0x3f
div rcx
mov rax, rdx
add rsp, 0x48
ret
push rdi
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
je 0x14014161d
call fcn.140157c00
test al, al
jne 0x14014161d
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
xor esi, esi
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rdi + rbx], sil
jne 0x1401415b7
mov r8, rbx
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov rcx, rdi
call fcn.1401626a0
test rax, rax
je 0x1401415fc
sub rax, rdi
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov r8, rax
mov rcx, rdi
call fcn.1401626a0
mov rsi, rax
test rax, rax
je 0x1401415fc
inc rsi
mov rcx, rdi
sub rcx, rsi
add rbx, rcx
test rsi, rsi
mov rdx, rbx
cmovne rdi, rsi
mov rcx, rdi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140141140
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x140141590
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0x1505
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x50], rax
jae 0x1401411ca
mov rax, qword [rsp + 0x28]
shl rax, 5
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax]
mov byte [rsp + 0x20], al
movzx ecx, byte [rsp + 0x20]
call fcn.1401535e0
movsx rax, al
mov rcx, qword [rsp + 0x28]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
jmp 0x14014116c
xor edx, edx
mov rax, qword [rsp + 0x28]
mov ecx, 0x3f
div rcx
mov rax, rdx
add rsp, 0x48
ret
push rdi
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
je 0x14014161d
call fcn.140157c00
test al, al
jne 0x14014161d
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
xor esi, esi
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rdi + rbx], sil
jne 0x1401415b7
mov r8, rbx
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov rcx, rdi
call fcn.1401626a0
test rax, rax
je 0x1401415fc
sub rax, rdi
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov r8, rax
mov rcx, rdi
call fcn.1401626a0
mov rsi, rax
test rax, rax
je 0x1401415fc
inc rsi
mov rcx, rdi
sub rcx, rsi
add rbx, rcx
test rsi, rsi
mov rdx, rbx
cmovne rdi, rsi
mov rcx, rdi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140141140
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x14014e590
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
cmp byte [rcx + 0xa97], 0
mov rbp, r9
mov r14, r8
movsxd rsi, edx
mov rdi, rcx
je 0x14014e64e
cmp qword [rcx + 0x260], 0
je 0x14014e60e
mov qword [rsp + 0x40], rbx
call fcn.14013c2b0
mov dl, 1
mov rcx, rdi
movzx ebx, al
call fcn.14013c610
mov rcx, qword [rdi + 0x1d8]
mov r9, rbp
mov qword [rsp + 0x20], rcx
mov r8, r14
mov rcx, rdi
mov edx, esi
call qword [rdi + 0x260]
movzx edx, bl
mov rcx, rdi
call fcn.14013c610
mov rbx, qword [rsp + 0x40]
jmp 0x14014e64e
cmp esi, 2
ja 0x14014e64e
mov r9, qword [rdi + 0x1d0]
lea rax, [0x140201310]
mov edx, 2
lea rcx, [rsi + rsi*2]
add rcx, rax
lea r8d, [rdx - 1]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov r9, qword [rdi + 0x1d0]
mov r8d, 1
mov rdx, rbp
mov rcx, r14
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14014e670
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x160
mov rax, qword [0x140229948]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [rcx + 0xa97], 0
mov rdi, rcx
jne 0x14014e6b3
cmp qword [rcx + 0x1e0], 0
je 0x14014e7a1
mov r8, rdx
mov qword [rsp + 0x150], rsi
mov edx, 0x100
lea r9, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.140155e80
mov rdx, qword [rdi + 0x1e0]
movsxd r9, eax
test rdx, rdx
je 0x14014e719
cmp byte [rdi + 0x132f], 0
jne 0x14014e719
lea r8, [rsp + 0x30]
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
mov byte [rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x14014e700
mov byte [rdi + 0x132f], 1
mov byte [rsp + r9 + 0x30], 0xa
inc r9d
movsxd rsi, r9d
cmp rsi, 0x102
jae 0x14014e7f2
cmp byte [rdi + 0xa97], 0
mov byte [rsp + rsi + 0x30], 0
je 0x14014e799
cmp qword [rdi + 0x260], 0
je 0x14014e7ba
mov rcx, rdi
mov qword [rsp + 0x158], rbx
call fcn.14013c2b0
mov dl, 1
mov rcx, rdi
movzx ebx, al
call fcn.14013c610
mov rdx, qword [rdi + 0x1d8]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
mov r9, rsi
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x260]
movzx edx, bl
mov rcx, rdi
call fcn.14013c610
mov rbx, qword [rsp + 0x158]
mov rsi, qword [rsp + 0x150]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140194380
add rsp, 0x160
pop rdi
ret
mov r9, qword [rdi + 0x1d0]
lea rcx, [0x140201310]
mov edx, 2
lea r8d, [rdx - 1]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov r9, qword [rdi + 0x1d0]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
jmp 0x14014e799
call fcn.1401944a8
int3

Function at 0x140151210
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
cdqe
add rsp, 0x28
ret
Function at 0x140151500
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ebp, ebp
lea rcx, [0x1402017e0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x14015152a
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, [0x1402017f0]
mov qword [rsp + 0x48], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x140201800]
mov rcx, rbx
mov r14, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strpbrk
test eax, eax
je 0x14015158c
mov rcx, rbx
test r14, r14
je 0x140151576
xor edx, edx
lea r8d, [rdx + 8]
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
test r14, r14
je 0x1401515c4
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401515c4
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x50], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r15d, eax
test eax, eax
je 0x140151688
mov qword [rsp + 0x40], rsi
or rsi, 0xffffffffffffffff
mov rdx, rsi
nop word [rax + rax]
inc rdx
cmp byte [rbx + rdx], bpl
jne 0x1401515f0
lea ecx, [rax + 1]
add rcx, rdx
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x14015167a
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x14015167a
mov rax, rsi
cmp byte [rdi + rax + 1], bpl
lea rax, [rax + 1]
jne 0x140151620
mov ecx, 0x5c
mov word [rax + rdi], cx
cmp byte [rdi + rsi + 1], bpl
lea rsi, [rsi + 1]
jne 0x140151634
lea rcx, [rsi + rdi]
sub rcx, rbx
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x140151650
mov rcx, rdi
test r14, r14
je 0x140151671
xor edx, edx
lea r8d, [rdx + 8]
call r14
jmp 0x140151677
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
mov rcx, rdi
call qword [fcn.140195925]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rax, rbp
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret