joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14016fe90
Capabilities:
Set socket configuration

Disassembly:
mov byte [rsp + 0x18], r8b
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp rcx, 0xffffffffffffffff
je 0x14016ff33
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], 0x10000
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1002
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x14016ff33
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], 0x10000
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x14016ff33
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], 1
mov edx, 6
mov dword [rsp + 0x20], 4
mov r8d, 1
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x14016ff33
mov al, 1
add rsp, 0x30
pop rbx
ret
xor al, al
add rsp, 0x30
pop rbx
ret

Function at 0x140174970
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x450
mov rax, qword [0x140425440]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, reloc.OLEAUT32.dll_SafeArrayCopy
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1401749f6
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.14001a140
nop
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140178d10
nop
mov rcx, qword [rsp + 0x20]
add rcx, 0xfffffffffffffff0
mov edx, dword [rcx]
nop
test edx, 0x30000000
jne 0x140174a00
mov edx, 0xffffffff
lock xadd dword [rcx], edx
dec edx
cmp edx, 0xffffffff
jne 0x140174a00
call fcn.1400da0f0
jmp 0x140174a00
lea rax, [0x140379908]
mov qword [rbx], rax
mov rax, rbx
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400d9d70
add rsp, 0x450
pop rbx
ret

Function at 0x1401750a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rax, qword [rcx]
cmp byte [rax], 0
je 0x140175100
mov rdx, rcx
lea rcx, [rsp + 0x30]
call fcn.140015780
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x140175100
mov ebx, 4
nop dword [rax + rax]
lea rdx, [rdi + 8]
mov rcx, rdi
call fcn.140178870
test al, al
jne 0x140175112
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, 1
jns 0x1401750e0
xor al, al
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov al, 1
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140175130
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov edi, 4
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140015780
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
test al, 0x10
je 0x14017516c
cmp eax, 0xffffffff
je 0x14017516c
mov rcx, rbx
call fcn.140178ac0
jmp 0x140175174
mov rcx, rbx
call fcn.14014d7d0
test al, al
jne 0x140175188
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
sub edi, 1
jns 0x140175142
mov rcx, qword [rbx + 8]
sub rcx, 0x10
mov eax, dword [rcx]
nop
mov edi, 0xffffffff
test eax, 0x30000000
jne 0x1401751b0
mov eax, edi
lock xadd dword [rcx], eax
dec eax
cmp eax, edi
jne 0x1401751b0
call fcn.1400da0f0
mov rcx, qword [rbx]
sub rcx, 0x10
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x1401751d2
lock xadd dword [rcx], edi
dec edi
cmp edi, 0xffffffff
jne 0x1401751d2
call fcn.1400da0f0
nop
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140175d90
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
xor eax, eax
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140175e00
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140175dfc
lea rcx, [rsp + 0x58]
call fcn.14014d930
mov rcx, qword [rbx + 0x20]
mov rdx, qword [rax]
mov qword [rbx + 0x20], rdx
mov qword [rax], rcx
mov rcx, qword [rsp + 0x58]
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x140175dfc
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x140175dfc
call fcn.1400da0f0
mov eax, dword [rsp + 0x40]
add qword [rbx + 0x18], rax
add rsp, 0x30
pop rbx
ret
Function at 0x140176d00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
mov rsi, rcx
mov rax, qword [rcx]
cmp byte [rax], 0
je 0x140176f04
mov rdx, rcx
lea rcx, [rsp + 0x60]
call fcn.140015780
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x140176f04
mov edx, 0x2e
mov rcx, rsi
call fcn.140168d50
mov ebx, eax
mov edx, 0x5c
mov rcx, rsi
call fcn.140168d50
lea rbp, [0x140379908]
cmp ebx, eax
jle 0x140176dc3
mov rdx, qword [rsi]
test ebx, ebx
jg 0x140176d82
mov qword [rsp + 0x78], rdx
mov eax, dword [rdx - 0x10]
nop
test eax, 0x30000000
jne 0x140176dc8
lock inc dword [rdx - 0x10]
jmp 0x140176dc8
lea r8d, [rbx - 1]
test r8d, r8d
js 0x140176db7
nop dword [rax + rax]
movzx ecx, byte [rdx]
test cl, cl
je 0x140176dc3
inc rdx
test cl, cl
jns 0x140176db1
mov al, 0x40
test al, cl
je 0x140176db1
cmp al, 8
jbe 0x140176db1
inc rdx
shr al, 1
test cl, al
jne 0x140176da4
sub r8d, 1
jns 0x140176d90
lea rcx, [rsp + 0x78]
call fcn.14001a340
jmp 0x140176dc8
mov qword [rsp + 0x78], rbp
mov edx, 0x5c
mov rcx, rsi
call fcn.140168d50
lea ebx, [rax + 1]
mov edx, 0x2e
mov rcx, rsi
call fcn.140168d50
cmp eax, ebx
jle 0x140176dfe
mov r9d, eax
mov r8d, ebx
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.1401673a0
jmp 0x140176e58
mov rdx, qword [rsi]
test ebx, ebx
jg 0x140176e1b
mov qword [rsp + 0x60], rdx
mov eax, dword [rdx - 0x10]
nop
test eax, 0x30000000
jne 0x140176e58
lock inc dword [rdx - 0x10]
jmp 0x140176e58
lea r8d, [rbx - 1]
nop
movzx ecx, byte [rdx]
test cl, cl
je 0x140176e53
inc rdx
test cl, cl
jns 0x140176e41
mov al, 0x40
test al, cl
je 0x140176e41
cmp al, 8
jbe 0x140176e41
inc rdx
shr al, 1
test cl, al
jne 0x140176e34
sub r8d, 1
jns 0x140176e20
lea rcx, [rsp + 0x60]
call fcn.14001a340
jmp 0x140176e58
mov qword [rsp + 0x60], rbp
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.1401786f0
nop
mov byte [rsp + 0x20], 1
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x60]
mov rdx, rdi
mov rcx, rax
call fcn.140176f30
nop
mov rcx, qword [rsp + 0x38]
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
nop
mov ebx, 0xffffffff
test eax, 0x30000000
jne 0x140176eab
mov eax, ebx
lock xadd dword [rcx], eax
dec eax
cmp eax, ebx
jne 0x140176eab
call fcn.1400da0f0
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x140176ed1
mov eax, ebx
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x140176ed1
call fcn.1400da0f0
nop
mov rcx, qword [rsp + 0x78]
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x140176f19
lock xadd dword [rcx], ebx
dec ebx
cmp ebx, 0xffffffff
jne 0x140176f19
call fcn.1400da0f0
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rsi]
mov qword [rdi], rcx
mov eax, dword [rcx - 0x10]
nop
test eax, 0x30000000
jne 0x140176f19
lock inc dword [rcx - 0x10]
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140177a00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rdi, rdx
mov rsi, rcx
mov rax, qword [rcx]
cmp byte [rax], 0
je 0x140177a50
mov rdx, rcx
lea rcx, [rsp + 0xb8]
call fcn.140015780
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x140177a50
lea rax, [0x140379908]
mov qword [rdi], rax
mov rax, rdi
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
lea rdx, [rsp + 0xb0]
mov rcx, rsi
call fcn.1401786f0
nop
mov rdx, qword [rsi]
mov rcx, qword [rsp + 0xb0]
cmp rcx, rdx
je 0x140177b49
call fcn.140019450
test eax, eax
je 0x140177b49
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0xb0]
call fcn.14017c050
nop
mov ebx, 0xffffffff
mov rax, qword [rsp + 0xa0]
cmp byte [rax], 0
jne 0x140177b0f
mov r8d, 8
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.140175b80
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx - 0x10]
nop
test eax, 0x30000000
jne 0x140177ad1
lock inc dword [rcx - 0x10]
mov rcx, qword [rsp + 0x50]
xchg qword [rsp + 0xa0], rcx
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x140177afd
mov eax, ebx
lock xadd dword [rcx], eax
dec eax
cmp eax, ebx
jne 0x140177afd
call fcn.1400da0f0
lea rcx, [rsp + 0x30]
call fcn.140175ab0
mov rax, qword [rsp + 0xa0]
mov qword [rdi], rax
lea rax, [0x140379908]
mov qword [rsp + 0xa0], rax
mov eax, dword [0x1403798f8]
nop
test eax, 0x30000000
jne 0x140177b9a
mov eax, ebx
lock xadd dword [0x1403798f8], eax
dec eax
cmp eax, 0xffffffff
jne 0x140177b9a
lea rcx, [0x1403798f8]
jmp 0x140177b94
lea rdx, str.Cannot_create_parent_directory
lea rcx, [rsp + 0xb8]
call fcn.140019df0
lea rdx, [rsp + 0xb8]
mov rcx, rdi
call fcn.1401715a0
mov rcx, qword [rsp + 0xb8]
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
nop
mov ebx, 0xffffffff
test eax, 0x30000000
jne 0x140177b9a
mov eax, ebx
lock xadd dword [rcx], eax
dec eax
cmp eax, ebx
jne 0x140177b9a
call fcn.1400da0f0
nop
mov rcx, qword [rsp + 0xb0]
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
test eax, 0x30000000
nop
jne 0x140177bc0
lock xadd dword [rcx], ebx
dec ebx
cmp ebx, 0xffffffff
jne 0x140177bc0
call fcn.1400da0f0
mov rax, rdi
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x140178870
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rdx]
cmp rbx, qword [rcx]
je 0x140178925
mov rdx, qword [rcx]
mov rcx, rbx
call fcn.14001c670
test eax, eax
je 0x140178925
cmp byte [rbx], 0
je 0x140178937
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.140015780
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x140178937
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140015780
mov rbx, qword [rax]
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.140015780
xor ecx, ecx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov r9d, 6
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
jne 0x14017891d
xor al, al
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, rdi
call fcn.14014d7d0
mov al, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rdi]
cmp qword [rsi], rbx
je 0x140178925
mov rdx, rbx
mov rcx, qword [rsi]
call fcn.14001c670
test eax, eax
je 0x140178925
cmp byte [rbx], 0
je 0x14017890b
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140015780
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x14017890b
mov rdx, qword [rsi]
cmp qword [rdi], rdx
je 0x140178993
mov rcx, qword [rdi]
call fcn.140019450
test eax, eax
je 0x140178993
mov rcx, rsi
call fcn.14014d7d0
test al, al
je 0x14017890b
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.140015780
mov rbx, qword [rax]
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.140015780
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140178ac0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov byte [rsp + 0x10], dl
push rsi
push rdi
push r15
sub rsp, 0x40
mov r15, rcx
xor ebx, ebx
mov dword [rsp + 0x68], ebx
mov sil, 1
mov rdx, rcx
lea rcx, [rsp + 0x60]
call fcn.140015780
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
test al, 0x10
je 0x140178c1d
cmp eax, 0xffffffff
je 0x140178c1d
mov rdx, r15
lea rcx, [rsp + 0x60]
call fcn.140015780
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x140178b30
bt eax, 0xa
jb 0x140178c1d
lea rdx, [0x14037805c]
lea rcx, [rsp + 0x60]
call fcn.140019df0
nop
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x68], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, 3
lea rdx, [rsp + 0x30]
mov rcx, r15
call fcn.140177640
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x140178b9a
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x140178b9a
call fcn.1400da0f0
movsxd rax, dword [rsp + 0x3c]
mov rdi, qword [rsp + 0x30]
lea rbp, [rdi + rax*8]
mov rbx, rdi
cmp rdi, rbp
je 0x140178bd4
xor edx, edx
mov rcx, rbx
call fcn.140178ac0
test al, al
je 0x140178bc8
test sil, sil
je 0x140178bc8
mov sil, 1
jmp 0x140178bcb
xor sil, sil
add rbx, 8
cmp rbx, rbp
jne 0x140178bb0
cmp dword [rsp + 0x3c], 0
jle 0x140178c15
mov ebx, dword [rsp + 0x3c]
nop
mov rcx, qword [rdi]
sub rcx, 0x10
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x140178c06
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x140178c06
call fcn.1400da0f0
add rdi, 8
sub rbx, 1
jne 0x140178be0
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
call fcn.1400e0818
mov rcx, r15
call fcn.14014d7d0
test al, al
je 0x140178c32
test sil, sil
je 0x140178c32
mov al, 1
jmp 0x140178c34
xor al, al
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop rdi
pop rsi
ret
Function at 0x14017bbe0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
lea rdx, [r8*4]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rdx
shr rdx, 1
add rdx, 3
lea rcx, [rbp - 0x50]
call fcn.14017bb10
nop
test rbx, rbx
je 0x14017bcf1
lea r14, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop dword [rax]
movzx edx, byte [rdi]
inc rdi
mov eax, edx
shr rax, 2
movzx eax, byte [rax + r14]
mov byte [rbp + 0x20], al
and edx, 3
shl rdx, 4
cmp rbx, 1
jbe 0x14017bcbf
movzx ecx, byte [rdi]
inc rdi
mov eax, ecx
shr rax, 4
or rax, rdx
movzx eax, byte [rax + r14]
mov byte [rbp + 0x21], al
and ecx, 0xf
lea rdx, [rcx*4]
cmp rbx, 2
jbe 0x14017bcb1
movzx eax, byte [rdi]
inc rdi
mov ecx, eax
shr rax, 6
or rax, rdx
movzx eax, byte [rax + r14]
mov byte [rbp + 0x22], al
and ecx, 0x3f
movzx eax, byte [rcx + r14]
mov byte [rbp + 0x23], al
sub rbx, 3
jmp 0x14017bccf
movzx eax, byte [rdx + r14]
mov byte [rbp + 0x22], al
mov byte [rbp + 0x23], 0x3d
jmp 0x14017bccd
movzx eax, byte [rdx + r14]
mov byte [rbp + 0x21], al
mov word [rbp + 0x22], 0x3d3d
xor ebx, ebx
mov r8d, 4
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x50]
mov rax, qword [rbp - 0x50]
call qword [rax + 0x20]
test al, al
je 0x14017bcf1
test rbx, rbx
jne 0x14017bc40
mov rax, qword [rbp - 0x40]
mov r8, qword [rbp - 0x18]
test rax, rax
jne 0x14017bd04
mov rdx, qword [rbp - 0x28]
jmp 0x14017bd1d
cmp qword [rax + 8], r8
jbe 0x14017bd1a
mov rax, qword [rax]
mov byte [r8 + rax], 0
mov r8, qword [rbp - 0x18]
mov rax, qword [rbp - 0x40]
mov rdx, qword [rax]
mov rcx, rsi
call fcn.14017ca80
nop
lea rax, vtable.juce::MemoryOutputStream.0
mov qword [rbp - 0x50], rax
lea rax, [rbp - 0x38]
mov rcx, qword [rbp - 0x40]
cmp rcx, rax
je 0x14017bd4c
test rcx, rcx
je 0x14017bd4c
mov rdx, qword [rbp - 0x18]
call fcn.140171b40
mov rcx, qword [rbp - 0x38]
call fcn.1400e0818
lea rax, vtable.juce::OutputStream.0
mov qword [rbp - 0x50], rax
mov rcx, qword [rbp - 0x48]
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x14017bd88
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x14017bd88
call fcn.1400da0f0
nop
mov rax, rsi
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14017bdb0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp byte [rdx], 0
mov rbx, rdx
mov r14, rcx
je 0x14017bf0f
nop dword [rax]
nop dword [rax + rax]
xor r9d, r9d
movzx ecx, byte [rbx]
inc rbx
mov eax, ecx
test cl, cl
jns 0x14017be42
mov ecx, 0x40
xor r8d, r8d
mov edx, 0x7f
test cl, al
je 0x14017be10
cmp ecx, 8
jbe 0x14017be10
shr edx, 1
inc r8d
shr ecx, 1
test eax, ecx
jne 0x14017be00
and eax, edx
sub r8d, 1
js 0x14017be42
nop dword [rax + rax]
movzx edx, byte [rbx]
mov ecx, edx
and cl, 0xc0
cmp cl, 0x80
jne 0x14017be42
mov ecx, eax
and edx, 0x3f
shl ecx, 6
mov eax, edx
or eax, ecx
inc rbx
sub r8d, 1
jns 0x14017be20
lea ecx, [rax - 0x41]
cmp ecx, 0x19
jbe 0x14017be94
lea ecx, [rax - 0x61]
cmp ecx, 0x19
ja 0x14017be57
lea ecx, [rax - 0x47]
jmp 0x14017be94
lea ecx, [rax - 0x30]
cmp ecx, 9
ja 0x14017be64
lea ecx, [rax + 4]
jmp 0x14017be94
cmp eax, 0x2b
jne 0x14017be70
mov ecx, 0x3e
jmp 0x14017be94
cmp eax, 0x2f
jne 0x14017be7c
mov ecx, 0x3f
jmp 0x14017be94
cmp eax, 0x3d
jne 0x14017bf27
mov ecx, 0x40
cmp r9, 1
jle 0x14017bf27
mov byte [rsp + r9 + 0x38], cl
inc r9
cmp r9, 4
jl 0x14017bde3
movzx eax, byte [rsp + 0x38]
mov rcx, r14
movzx esi, byte [rsp + 0x39]
mov r8, qword [r14]
movzx edx, sil
shr dl, 4
shl al, 2
or dl, al
call qword [r8 + 0x28]
movzx edi, byte [rsp + 0x3a]
cmp dil, 0x40
jae 0x14017bf06
mov rax, qword [r14]
movzx edx, dil
shr dl, 2
mov rcx, r14
shl sil, 4
or dl, sil
call qword [rax + 0x28]
movzx ecx, byte [rsp + 0x3b]
cmp cl, 0x40
jae 0x14017bf06
mov rax, qword [r14]
shl dil, 6
or dil, cl
mov rcx, r14
movzx edx, dil
call qword [rax + 0x28]
cmp byte [rbx], 0
jne 0x14017bde0
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
xor al, al
jmp 0x14017bf11
Function at 0x14017d970
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x450
mov rax, qword [0x140425440]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor eax, eax
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x30]
mov ecx, 0x204
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.14001a140
nop
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140178d10
nop
mov rcx, qword [rsp + 0x20]
add rcx, 0xfffffffffffffff0
mov edx, dword [rcx]
nop
test edx, 0x30000000
jne 0x14017d9f1
mov edx, 0xffffffff
lock xadd dword [rcx], edx
dec edx
cmp edx, 0xffffffff
jne 0x14017d9f1
call fcn.1400da0f0
mov rax, rbx
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400d9d70
add rsp, 0x450
pop rbx
ret
Function at 0x14017de40
Capabilities:
Create pipe
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xe0
mov rbp, rdx
mov rdi, rcx
mov ecx, 0x30
call fcn.1400da124
mov rsi, rax
mov qword [rsp + 0x110], rax
mov byte [rax], 0
xor r15d, r15d
mov qword [rax + 8], r15
mov qword [rax + 0x10], r15
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x50], reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rsp + 0x60], 1
xor r9d, r9d
lea r8, [rsp + 0x50]
lea rdx, [rsi + 0x10]
lea rcx, [rsi + 8]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x14017df7f
xor r8d, r8d
mov edx, 1
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x14017df7f
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
mov dword [rsp + 0x70], 0x68
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], rax
mov dword [rsp + 0xac], 0x100
mov rdx, rbp
lea rcx, [rsp + 0x128]
call fcn.140015780
mov rdx, qword [rax]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x8000400
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne al
mov byte [rsi], al
mov rbx, qword [rdi]
mov qword [rdi], rsi
test rbx, rbx
je 0x14017dfce
cmp byte [rbx], 0
je 0x14017dfa3
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14017dfb2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14017dfc1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x30
mov rcx, rbx
call fcn.1400da0f0
mov rbx, qword [rdi]
cmp byte [rbx], 0
jne 0x14017e022
mov qword [rdi], r15
test rbx, rbx
je 0x14017e022
cmp byte [rbx], 0
je 0x14017dff7
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14017e006
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14017e015
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x30
mov rcx, rbx
call fcn.1400da0f0
cmp qword [rdi], 0
setne al
mov rbx, qword [rsp + 0x118]
add rsp, 0xe0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14017e3f0
Capabilities:
Get common file path

Disassembly:
push rbx
mov eax, 0x1040
call fcn.1400da8e0
sub rsp, rax
mov rax, qword [0x140425440]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp edx, 0x11
ja case.default.0x14017e439
movsxd rax, edx
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x17e5d4]
add rcx, rdx
jmp rcx
mov r8d, 0x28
jmp case.0x14017e439.2
mov r8d, 5
jmp case.0x14017e439.2
mov r8d, reloc.OLEAUT32.dll_SafeArrayCopy
jmp case.0x14017e439.2
mov r8d, 0x23
jmp case.0x14017e439.2
mov r8d, 0x2e
jmp case.0x14017e439.2
mov r8d, 0x26
jmp case.0x14017e439.2
mov r8d, 0x2a
jmp case.0x14017e439.2
mov r8d, 0x1c
jmp case.0x14017e439.2
mov r8d, SafeArrayGetDim
jmp case.0x14017e439.2
mov r8d, SafeArrayGetDim
jmp case.0x14017e439.2
mov r8d, 0x27
xor r9d, r9d
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je case.default.0x14017e439
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.14001a140
nop
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140178d10
nop
mov rcx, qword [rsp + 0x20]
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x14017e5b8
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x14017e5b8
call fcn.1400da0f0
jmp 0x14017e5b8
mov word [rsp + 0x30], r8w
lea rdx, [rsp + 0x30]
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.14001a140
nop
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140178d10
nop
jmp 0x14017e566
mov word [rsp + 0x30], r8w
mov edx, 0x800
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.14001a140
nop
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140178d10
nop
mov rcx, qword [rsp + 0x20]
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
test eax, 0x30000000
nop
jne 0x14017e5b8
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x14017e5b8
call fcn.1400da0f0
jmp 0x14017e5b8
call fcn.14017bf40
mov rdx, rax
mov rcx, rbx
call fcn.14014da10
jmp 0x14017e5b8
xor edx, edx
mov rcx, rbx
call fcn.14014da10
jmp 0x14017e5b8
lea rax, [0x140379908]
mov qword [rbx], rax
mov rax, rbx
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1400d9d70
add rsp, 0x1040
pop rbx
ret