joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412c40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x412e6a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x004d9130]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0042d660
xorps xmm15, xmm15
mov r14, qword [0x0054d3c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x412cb9
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x412ccc
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x412cf0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x412d04
cmp rbx, 0x1000
jae 0x412cc3
jmp 0x412d85
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x412d16
xor esi, esi
jmp 0x412d76
mov rax, qword [0x004d9130]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.0042d660
xorps xmm15, xmm15
mov r14, qword [0x0054d3c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x412cfa
nop
jmp 0x412ce2
call fcn.0045a4c0
xorps xmm15, xmm15
mov r14, qword [0x0054d3c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x412e05
call fcn.004319e0
lea rax, [0x00478c5b]
mov ebx, 0x19
call fcn.004322e0
mov rax, qword [rsp + 0x68]
call fcn.00431fe0
lea rax, [0x00478a35]
mov ebx, 0x19
call fcn.004322e0
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00431fe0
call fcn.00431c40
call fcn.00431a60
lea rax, [0x00476a8d]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.004300a0
cmp eax, 0x5af
je 0x412da8
call fcn.004319e0
lea rax, [0x00478c5b]
mov ebx, 0x19
nop dword [rax]
call fcn.004322e0
mov rax, qword [rsp + 0x38]
call fcn.00431fe0
lea rax, [0x00478a35]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.004322e0
mov eax, dword [rsp + 0x34]
call fcn.00431fe0
call fcn.00431c40
call fcn.00431a60
lea rax, [0x00479d3f]
mov ebx, 0x1f
call fcn.004300a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00456960
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00412c40
Function at 0x458a60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0054d460]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x0054d1ed], 0
je 0x458a96
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x0054d7a0]
aesenc xmm0, xmmword [0x0054d7b0]
aesenc xmm0, xmmword [0x0054d7c0]
movq rax, xmm0
ret
jmp 0x408660
Function at 0x140f5daf8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f5db02
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f5db2b
pop rbp
sub rbp, 0x33
sub rbp, 0xf5daf8
sub rsp, 0x20
jmp 0x140f5db4a
mov rax, 0xf5daf8
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffedb1ad53
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f5db69
jmp 0x140f5db80
sbb ebx, edx
mov edx, 0x536fdad8
push rbx
push rbx
sbb edx, edx
xchg edx, eax
pop rbx
push rdx
push rbx
push rbx
sbb edx, dword [rdx - 0x46]
sbb edx, dword [rbx + rdx*4 + 0x53535354]
sbb edx, dword [rcx + rdx*4 + 0x5353537b]
sbb esp, dword [rcx + rsi*4 - 0x276dade5]
rcr byte [rdi + 0x53], cl
push rbx
push rbx
sbb edx, dword [rdx - 0x45]
add eax, dword [rbx]
sbb ebp, ebx
invalid
Function at 0x1400a3350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
sub rsp, 0x470
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x3dc], 0x8dc0
mov dword [rbp + 0x3d8], 0x3126fe
mov dword [rbp + 0x3d4], 0xe556
mov dword [rbp + 0x3d0], 0x1d5321
and dword [rbx + 0x1d], edx
add bh, al
test esp, ecx
add eax, dword [rax]
add dh, ah
out 1, al
add bh, al
test eax, ecx
add eax, dword [rax]
add byte [rbx], bh
pop rax
push rsp
add bh, al
test esp, eax
add eax, dword [rax]
add byte [rax], al
add byte [rax], al
add byte [rax - 0x39], cl
test dword [rax + 3], edi
add byte [rax], al
add byte [rax - 0x39], cl
test dword [rax + 3], esp
add byte [rax], al
add byte [rax - 0x39], cl
test dword [rax + 3], ebx
add byte [rax], al
add dh, al
test dword [rax + 0x56000003], eax
mov byte [rbp + 0x381], 0x36
mov byte [rbp + 0x382], 0x73
mov byte [rbp + 0x383], 0x21
mov byte [rbp + 0x384], 0x4c
mov byte [rbp + 0x385], 0x49
mov byte [rbp + 0x386], 0x2b
mov byte [rbp + 0x387], 0x77
mov byte [rbp + 0x388], 0x23
mov byte [rbp + 0x389], 0x40
mov byte [rbp + 0x38a], 0x67
mov byte [rbp + 0x38b], 0x31
mov byte [rbp + 0x38c], 0x26
mov byte [rbp + 0x38d], 0x73
mov byte [rbp + 0x38e], 0x5f
mov byte [rbp + 0x38f], 0x6f
mov byte [rbp + 0x390], 0x29
mov byte [rbp + 0x391], 0x2b
mov byte [rbp + 0x392], 0x44
mov byte [rbp + 0x393], 0
mov qword [rbp + 0x3b0], 0
mov eax, dword [rbp + 0x3d0]
imul eax, dword [rbp + 0x3d0]
mov edx, 0x715d5

Function at 0x1400a3384
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
sub rsp, 0x470
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x3dc], 0x8dc0
mov dword [rbp + 0x3d8], 0x3126fe
mov dword [rbp + 0x3d4], 0xe556
mov dword [rbp + 0x3d0], 0x1d5321
and dword [rbx + 0x1d], edx
add bh, al
test esp, ecx
add eax, dword [rax]
add dh, ah
out 1, al
add bh, al
test eax, ecx
add eax, dword [rax]
add byte [rbx], bh
pop rax
push rsp
add bh, al
test esp, eax
add eax, dword [rax]
add byte [rax], al
add byte [rax], al
add byte [rax - 0x39], cl
test dword [rax + 3], edi
add byte [rax], al
add byte [rax - 0x39], cl
test dword [rax + 3], esp
add byte [rax], al
add byte [rax - 0x39], cl
test dword [rax + 3], ebx
add byte [rax], al
add dh, al
test dword [rax + 0x56000003], eax
mov byte [rbp + 0x381], 0x36
mov byte [rbp + 0x382], 0x73
mov byte [rbp + 0x383], 0x21
mov byte [rbp + 0x384], 0x4c
mov byte [rbp + 0x385], 0x49
mov byte [rbp + 0x386], 0x2b
mov byte [rbp + 0x387], 0x77
mov byte [rbp + 0x388], 0x23
mov byte [rbp + 0x389], 0x40
mov byte [rbp + 0x38a], 0x67
mov byte [rbp + 0x38b], 0x31
mov byte [rbp + 0x38c], 0x26
mov byte [rbp + 0x38d], 0x73
mov byte [rbp + 0x38e], 0x5f
mov byte [rbp + 0x38f], 0x6f
mov byte [rbp + 0x390], 0x29
mov byte [rbp + 0x391], 0x2b
mov byte [rbp + 0x392], 0x44
mov byte [rbp + 0x393], 0
mov qword [rbp + 0x3b0], 0
mov eax, dword [rbp + 0x3d0]
imul eax, dword [rbp + 0x3d0]
mov edx, 0x715d5
Function at 0x1400a4666
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x88]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x20]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x1c]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x24]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x38], rax
mov dword [rbp - 4], 0
jmp 0x1400a4754

Function at 0x1400a4770
Capabilities:
Access peb ldr_data

Disassembly:
xor rax, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov rax, qword [rax]
mov rax, qword [rax + 0x20]
ret
Function at 0x140002fb8
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14004a490]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rcx
mov rcx, rdx
call fcn.140004f30
and qword [rsp + 0x30], 0
xor r9d, r9d
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140003029
lea rdx, [0x14003ea93]
mov rcx, rdi
call fcn.140004da4
jmp 0x1400030c7
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
jne 0x14000304d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x14003ea96]
jmp 0x14000301c
lea rcx, [rsp + 0x48]
call fcn.140004d44
lea rcx, [rsp + 0x48]
mov rdx, rsi
call fcn.140004e90
lea rcx, [rsp + 0x48]
xor edx, edx
call fcn.140004e28
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rdx, rax
mov r8d, esi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1400030ae
cmp dword [rsp + 0x40], esi
jne 0x1400030ae
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.140004dd8
jmp 0x1400030bd
lea rdx, [0x14003ea97]
mov rcx, rdi
call fcn.140004da4
lea rcx, [rsp + 0x48]
call fcn.140004e14
mov rax, rdi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14001cb70
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x140003544
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
lea rcx, str.sqlite.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x14004dbb0], rax
test rax, rax
je 0x14000368b
lea rdx, str.sqlite3_open
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14004dbb0]
lea rdx, str.sqlite3_open16
mov qword [0x14004dbb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14004dbb0]
lea rdx, str.sqlite3_prepare_v2
mov qword [0x14004dbf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14004dbb0]
lea rdx, str.sqlite3_column_text
mov qword [0x14004dbc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14004dbb0]
lea rdx, str.sqlite3_column_blob
mov qword [0x14004dbc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14004dbb0]
lea rdx, str.sqlite3_column_bytes
mov qword [0x14004dbd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14004dbb0]
lea rdx, str.sqlite3_step
mov qword [0x14004dbd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14004dbb0]
lea rdx, str.sqlite3_close
mov qword [0x14004dbe0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x14004dbb8], 0
mov qword [0x14004dbe8], rax
je 0x14000367e
cmp qword [0x14004dbc0], 0
je 0x14000367e
cmp qword [0x14004dbc8], 0
je 0x14000367e
cmp qword [0x14004dbd0], 0
je 0x14000367e
cmp qword [0x14004dbd8], 0
je 0x14000367e
cmp qword [0x14004dbe0], 0
je 0x14000367e
test rax, rax
je 0x14000367e
mov al, 1
jmp 0x14000368d
mov rcx, qword [0x14004dbb0]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
add rsp, 0x28
ret
Function at 0x140005724
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x14004a490]
xor rax, rsp
mov qword [rbp + 0x27], rax
movzx r12d, dx
mov rsi, rcx
mov word [rbp - 0x39], dx
call fcn.1400018ec
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x35]
movzx edi, ax
mov word [rbp - 0x35], ax
call fcn.1400018b4
test al, al
je 0x140005780
lea rcx, [rbp - 0x39]
call fcn.1400018c0
jmp 0x140005958
mov rcx, rsi
call fcn.140007684
test rax, rax
je 0x1400057c5
mov rcx, rsi
call fcn.1400077d0
mov rcx, rsi
mov rbx, rax
call fcn.140007684
cmp rax, rbx
jae 0x1400057c5
mov rcx, rsi
call fcn.140007828
lea rcx, [rbp - 0x39]
mov rbx, rax
call fcn.1400018b0
mov word [rbx], ax
movzx eax, r12w
jmp 0x140005958
cmp qword [rsi + 0x98], 0
je 0x140005955
mov rcx, rsi
call fcn.140007ca0
lea rcx, [rbp - 0x39]
call fcn.1400018b0
cmp qword [rsi + 0x80], 0
jne 0x140005809
mov rdx, qword [rsi + 0x98]
movzx ecx, ax
call fcn.140002d74
test al, al
cmovne di, r12w
jmp 0x140005955
xor r8d, r8d
lea rcx, [rbp - 1]
mov word [rbp - 0x39], ax
lea edx, [r8 + 8]
call fcn.140006d70
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 1]
call fcn.140007154
mov rcx, rax
call fcn.14000b358
lea rcx, [rbp - 1]
mov rbx, rax
call fcn.140004e88
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 1]
add rbx, rax
call fcn.140007154
mov rcx, rax
call fcn.14000b358
lea rcx, [rbp - 0x31]
lea r9, [rbp - 0x37]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsi + 0x80]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x29]
lea r8, [rbp - 0x39]
lea rdx, [rsi + 0x8c]
mov qword [rsp + 0x20], rax
call fcn.140008244
test eax, eax
js 0x14000594c
cmp eax, 1
jg 0x140005930
lea rdx, [rbp - 0x11]
lea rcx, [rbp - 1]
call fcn.140007154
mov rcx, rax
call fcn.14000b358
mov rbx, qword [rbp - 0x31]
sub rbx, rax
je 0x1400058ed
lea rdx, [rbp - 9]
lea rcx, [rbp - 1]
call fcn.140007154
mov rcx, rax
call fcn.14000b358
mov r9, qword [rsi + 0x98]
mov r8, rbx
mov rcx, rax
mov edx, 1
call fcn.14001e9cc
cmp rbx, rax
jne 0x14000594c
lea rax, [rbp - 0x39]
mov byte [rsi + 0x8a], 1
cmp qword [rbp - 0x29], rax
jne 0x14000592a
test rbx, rbx
jne 0x14000581d
lea rcx, [rbp - 1]
call fcn.140004e88
cmp rax, 0x20
jae 0x14000594c
lea edx, [rbx + 8]
lea rcx, [rbp - 1]
xor r8d, r8d
call fcn.140006e40
jmp 0x14000581d
movzx edi, r12w
jmp 0x14000594c
cmp eax, 3
jne 0x14000594c
mov rdx, qword [rsi + 0x98]
movzx ecx, word [rbp - 0x39]
call fcn.140002d74
test al, al
cmovne di, r12w
lea rcx, [rbp - 1]
call fcn.140004e14
movzx eax, di
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14001cb70
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400061ec
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x14004a490]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r12d, edx
mov rsi, rcx
mov dword [rbp - 0x31], edx
call fcn.1400019ac
lea rdx, [rbp - 0x31]
lea rcx, [rbp - 0x29]
mov edi, eax
mov dword [rbp - 0x29], eax
call fcn.14000197c
test al, al
je 0x140006244
lea rcx, [rbp - 0x31]
call fcn.140001984
jmp 0x140006413
mov rcx, rsi
call fcn.140007684
test rax, rax
je 0x140006287
mov rcx, rsi
call fcn.1400076b0
mov rcx, rsi
mov rbx, rax
call fcn.140007684
cmp rax, rbx
jae 0x140006287
mov rcx, rsi
call fcn.140007718
lea rcx, [rbp - 0x31]
mov rbx, rax
call fcn.14000d08c
mov byte [rbx], al
mov eax, r12d
jmp 0x140006413
cmp qword [rsi + 0x98], 0
je 0x140006411
mov rcx, rsi
call fcn.14000809c
lea rcx, [rbp - 0x31]
call fcn.14000d08c
cmp qword [rsi + 0x80], 0
jne 0x1400062c9
mov rdx, qword [rsi + 0x98]
mov cl, al
call fcn.140002d5c
test al, al
cmovne edi, r12d
jmp 0x140006411
xor r8d, r8d
lea rcx, [rbp - 1]
mov byte [rbp - 0x39], al
lea edx, [r8 + 8]
call fcn.140006d70
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 1]
call fcn.140007154
mov rcx, rax
call fcn.14000b358
lea rcx, [rbp - 1]
mov rbx, rax
call fcn.140004e88
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 1]
add rbx, rax
call fcn.140007154
mov rcx, rax
call fcn.14000b358
lea rcx, [rbp - 0x29]
lea r9, [rbp - 0x38]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsi + 0x80]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x31]
lea r8, [rbp - 0x39]
lea rdx, [rsi + 0x8c]
mov qword [rsp + 0x20], rax
call fcn.140008244
test eax, eax
js 0x140006408
cmp eax, 1
jg 0x1400063ee
lea rdx, [rbp - 0x11]
lea rcx, [rbp - 1]
call fcn.140007154
mov rcx, rax
call fcn.14000b358
mov rbx, qword [rbp - 0x29]
sub rbx, rax
je 0x1400063ac
lea rdx, [rbp - 9]
lea rcx, [rbp - 1]
call fcn.140007154
mov rcx, rax
call fcn.14000b358
mov r9, qword [rsi + 0x98]
mov r8, rbx
mov rcx, rax
mov edx, 1
call fcn.14001e9cc
cmp rbx, rax
jne 0x140006408
lea rax, [rbp - 0x39]
mov byte [rsi + 0x89], 1
cmp qword [rbp - 0x31], rax
jne 0x1400063e9
test rbx, rbx
jne 0x1400062dc
lea rcx, [rbp - 1]
call fcn.140004e88
cmp rax, 0x20
jae 0x140006408
lea edx, [rbx + 8]
lea rcx, [rbp - 1]
xor r8d, r8d
call fcn.140006e40
jmp 0x1400062dc
mov edi, r12d
jmp 0x140006408
cmp eax, 3
jne 0x140006408
mov rdx, qword [rsi + 0x98]
mov cl, byte [rbp - 0x39]
call fcn.140002d5c
test al, al
cmovne edi, r12d
lea rcx, [rbp - 1]
call fcn.140004e14
mov eax, edi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14001cb70
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140007ab4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x14004a490]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor edi, edi
mov rsi, rcx
cmp qword [rcx + 0x80], rdi
je 0x140007c39
cmp byte [rcx + 0x8a], dil
je 0x140007c39
call fcn.1400018ec
mov rcx, rsi
movzx ebx, ax
mov rax, qword [rsi]
movzx edx, bx
call qword [rax + 0x18]
lea rdx, [rbp - 0x17]
lea rcx, [rbp - 0x19]
mov word [rbp - 0x17], ax
mov word [rbp - 0x19], bx
call fcn.1400018b4
test al, al
je 0x140007b2f
xor al, al
jmp 0x140007c3b
xor r8d, r8d
lea rcx, [rbp + 0x17]
lea edx, [r8 + 8]
call fcn.140006d70
lea rdx, [rbp - 9]
lea rcx, [rbp + 0x17]
call fcn.140007154
mov rcx, rax
call fcn.14000b358
lea rcx, [rbp + 0x17]
mov rbx, rax
call fcn.140004e88
lea rdx, [rbp + 0xf]
lea rcx, [rbp + 0x17]
add rbx, rax
call fcn.140007154
mov rcx, rax
call fcn.14000b358
mov rcx, qword [rsi + 0x80]
lea rdx, [rsi + 0x8c]
mov r8, rax
lea rax, [rbp - 0x11]
mov r9, rbx
mov qword [rsp + 0x20], rax
call fcn.140001dac
mov r11d, eax
test eax, eax
je 0x140007bbd
dec r11d
je 0x140007bc4
cmp r11d, 2
jne 0x140007baf
mov dil, 1
lea rcx, [rbp + 0x17]
call fcn.140004e14
mov al, dil
jmp 0x140007c3b
mov byte [rsi + 0x8a], dil
lea rdx, [rbp - 1]
lea rcx, [rbp + 0x17]
call fcn.140007154
mov rcx, rax
call fcn.14000b358
mov rbx, qword [rbp - 0x11]
sub rbx, rax
je 0x140007c13
lea rdx, [rbp + 7]
lea rcx, [rbp + 0x17]
call fcn.140007154
mov rcx, rax
call fcn.14000b358
mov r9, qword [rsi + 0x98]
mov r8, rbx
mov rcx, rax
mov edx, 1
call fcn.14001e9cc
cmp rbx, rax
jne 0x140007baf
cmp byte [rsi + 0x8a], dil
je 0x140007bac
test rbx, rbx
jne 0x140007b3f
lea edx, [rbx + 8]
lea rcx, [rbp + 0x17]
xor r8d, r8d
call fcn.140006e40
jmp 0x140007b3f
mov al, 1
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14001cb70
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
Function at 0x140007eb4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x14004a490]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor edi, edi
mov rsi, rcx
cmp qword [rcx + 0x80], rdi
je 0x140008035
cmp byte [rcx + 0x89], dil
je 0x140008035
call fcn.1400019ac
mov rcx, rsi
mov ebx, eax
mov rax, qword [rsi]
mov edx, ebx
call qword [rax + 0x18]
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x11]
mov dword [rbp - 0x19], eax
mov dword [rbp - 0x11], ebx
call fcn.14000197c
test al, al
je 0x140007f2b
xor al, al
jmp 0x140008037
xor r8d, r8d
lea rcx, [rbp + 0xf]
lea edx, [r8 + 8]
call fcn.140006d70
lea rdx, [rbp - 0x11]
lea rcx, [rbp + 0xf]
call fcn.140007154
mov rcx, rax
call fcn.14000b358
lea rcx, [rbp + 0xf]
mov rbx, rax
call fcn.140004e88
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0xf]
add rbx, rax
call fcn.140007154
mov rcx, rax
call fcn.14000b358
mov rcx, qword [rsi + 0x80]
lea rdx, [rsi + 0x8c]
mov r8, rax
lea rax, [rbp - 9]
mov r9, rbx
mov qword [rsp + 0x20], rax
call fcn.140001dac
mov r11d, eax
test eax, eax
je 0x140007fb9
dec r11d
je 0x140007fc0
cmp r11d, 2
jne 0x140007fab
mov dil, 1
lea rcx, [rbp + 0xf]
call fcn.140004e14
mov al, dil
jmp 0x140008037
mov byte [rsi + 0x89], dil
lea rdx, [rbp + 7]
lea rcx, [rbp + 0xf]
call fcn.140007154
mov rcx, rax
call fcn.14000b358
mov rbx, qword [rbp - 9]
sub rbx, rax
je 0x14000800f
lea rdx, [rbp - 1]
lea rcx, [rbp + 0xf]
call fcn.140007154
mov rcx, rax
call fcn.14000b358
mov r9, qword [rsi + 0x98]
mov r8, rbx
mov rcx, rax
mov edx, 1
call fcn.14001e9cc
cmp rbx, rax
jne 0x140007fab
cmp byte [rsi + 0x89], dil
je 0x140007fa8
test rbx, rbx
jne 0x140007f3b
lea edx, [rbx + 8]
lea rcx, [rbp + 0xf]
xor r8d, r8d
call fcn.140006e40
jmp 0x140007f3b
mov al, 1
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14001cb70
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
Function at 0x14000a400
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x470]
sub rsp, 0x570
mov rax, qword [0x14004a490]
xor rax, rsp
mov qword [rbp + 0x460], rax
xor r9d, r9d
lea rax, [rbp + 0x250]
mov rbx, rcx
lea edx, [r9 + 0x1a]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14000a567
lea rdx, [rbp + 0x250]
lea rcx, [rsp + 0x30]
call fcn.140004ecc
lea r8, str.MozillaFirefoxProfiles_
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.140009230
lea rcx, [rsp + 0x30]
mov rdx, rax
call fcn.140004f00
lea rcx, [rsp + 0x58]
call fcn.140004f24
lea r8, [0x14003ee54]
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x30]
call fcn.140009230
mov rcx, rax
call fcn.140004f30
lea rdx, [rbp]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea rcx, [rbp - 0x30]
mov rdi, rax
call fcn.140004f24
lea rdx, [0x14003ee64]
lea rcx, [rbp - 0x80]
call fcn.140004ecc
test byte [rbp], 0x10
je 0x14000a51a
lea rdx, [rbp + 0x2c]
lea rcx, [rsp + 0x58]
call fcn.140004ecc
lea rdx, str.release
lea rcx, [rsp + 0x58]
call fcn.14000ab1c
cmp rax, 0xffffffffffffffff
je 0x14000a510
lea rdx, [rbp + 0x2c]
lea rcx, [rbp - 0x80]
call fcn.14000aa74
lea rcx, [rsp + 0x58]
call fcn.140004f24
lea rdx, [rbp]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14000a4d8
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x58]
call fcn.14000aea8
lea rdx, [rbp - 0x58]
mov rcx, rbx
call fcn.140009bd0
lea rcx, [rbp - 0x58]
call fcn.140004f24
lea rcx, [rbp - 0x80]
call fcn.140004f24
lea rcx, [rsp + 0x30]
call fcn.140004f24
jmp 0x14000a576
lea rdx, [0x14003ee7c]
mov rcx, rbx
call fcn.140004ecc
mov rax, rbx
mov rcx, qword [rbp + 0x460]
xor rcx, rsp
call fcn.14001cb70
lea r11, [rsp + 0x570]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret