joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400209b0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x34], 0
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x50], 0
call fcn.1400318f4
mov dword [rax], 0
lea r8, [rsp + 0x34]
xor edx, edx
mov ecx, 2
call sub.SspiCli.dll_GetUserNameExW
movzx eax, al
test eax, eax
jne 0x140020aee
mov eax, dword [rsp + 0x34]
shl rax, 1
mov rcx, rax
call fcn.140031834
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x140020aee
lea r8, [rsp + 0x34]
mov rdx, qword [rsp + 0x38]
mov ecx, 2
call sub.SspiCli.dll_GetUserNameExW
movzx eax, al
test eax, eax
je 0x140020aee
mov rcx, qword [rsp + 0x38]
call fcn.140019c20
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x140020aee
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
cmp eax, 1
je 0x140020aee
mov eax, dword [rsp + 0x30]
mov ecx, eax
call fcn.140031834
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x140020aee
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
mov edx, 1
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
test eax, eax
je 0x140020aee
lea rdx, [rsp + 0x50]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call sub.api_ms_win_security_sddl_l1_1_0.dll_ConvertSidToStringSidW
test eax, eax
jne 0x140020afb
call fcn.1400318f4
mov dword [rax], listen
jmp 0x140020b0f
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call fcn.140020db0
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x38], 0
je 0x140020b21
mov rcx, qword [rsp + 0x38]
call fcn.140031820
cmp qword [rsp + 0x48], 0
je 0x140020b33
mov rcx, qword [rsp + 0x48]
call fcn.140031820
cmp qword [rsp + 0x40], 0
je 0x140020b45
mov rcx, qword [rsp + 0x40]
call fcn.140031820
cmp qword [rsp + 0x50], 0
je 0x140020b58
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov rax, qword [rsp + 0x58]
add rsp, 0x68
ret
Function at 0x140021900
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x48], 0
jne 0x140021954
mov ecx, 0x800
call fcn.140031834
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x40], rax
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x40], 0
jne 0x140021948
call fcn.1400318f4
mov dword [rax], listen
mov eax, 0xffffffff
jmp 0x1400219e0
mov rax, qword [rsp + 0x50]
mov dword [rax + 0x48], 0x800
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x50]
lea r8, [0x140021600]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x1400219c4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.14001eaa0
mov dword [rsp + 0x30], eax
call fcn.1400318f4
mov ecx, dword [rsp + 0x30]
mov dword [rax], ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r8, qword [rsp + 0x50]
mov edx, eax
lea rcx, str.TermRead_initiate___ERROR_CreateThread__d__io:_p
call fcn.140003a10
mov eax, 0xffffffff
jmp 0x1400219e0
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x18], rcx
mov rax, qword [rsp + 0x50]
mov dword [rax + 0x54], 1
xor eax, eax
add rsp, 0x48
ret

Function at 0x140021c70
Capabilities:
Create thread

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rax, qword [rsp + 0x50]
add rax, 0xa4
mov rdi, rax
xor eax, eax
mov ecx, listen
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x58]
mov dword [rax + 0xa4], ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x50]
lea r8, [0x140021a90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140021d14
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.14001eaa0
mov dword [rsp + 0x30], eax
call fcn.1400318f4
mov ecx, dword [rsp + 0x30]
mov dword [rax], ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r8, qword [rsp + 0x50]
mov edx, eax
lea rcx, str.syncio_initiate_write_initiate___ERROR_CreateThread__d__io:_p
call fcn.140003a10
mov eax, 0xffffffff
jmp 0x140021d30
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x38], rcx
mov rax, qword [rsp + 0x50]
mov dword [rax + 0x74], 1
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x140021d40
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor edx, edx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x90]
call qword [sym.imp.api_ms_win_core_io_l1_1_0.dll_CancelIoEx]
mov rax, qword [rsp + 0x30]
cmp dword [rax + 0x54], 0
je 0x140021db8
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x90]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileType]
cmp eax, 2
jne 0x140021da4
call fcn.14001d040
test eax, eax
je 0x140021d91
cmp dword [0x140077b68], 0
je 0x140021da4
xor edx, edx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateThread]
jmp 0x140021db8
mov edx, 0xffffffff
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rax, qword [rsp + 0x30]
cmp dword [rax + 0x74], 0
je 0x140021dd7
mov edx, 0xffffffff
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x38]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SleepEx]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x90]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x40], 0
je 0x140021e10
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x40]
call fcn.140031820
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x60], 0
je 0x140021e2a
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x60]
call fcn.140031820
mov rcx, qword [rsp + 0x30]
call fcn.140031820
xor eax, eax
add rsp, 0x28
ret

Function at 0x140027290
Capabilities:
Manipulate console buffer

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov rax, qword [0x1400761f0]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x30]
mov rcx, qword [0x140077b30]
call qword [sym.imp.api_ms_win_core_console_l2_1_0.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x1400272c6
jmp 0x140027364
movzx eax, word [rsp + 0x60]
mov word [rsp + 0x24], ax
movzx eax, word [rsp + 0x68]
mov word [rsp + 0x26], ax
movsx eax, word [rsp + 0x32]
dec eax
cmp dword [rsp + 0x68], eax
jle 0x14002731a
mov eax, dword [0x140079220]
cmp dword [rsp + 0x68], eax
jle 0x14002731a
mov eax, dword [0x140079220]
mov dword [rsp + 0x20], eax
jmp 0x140027309
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x68]
cmp dword [rsp + 0x20], eax
jge 0x14002731a
call fcn.140029ba0
jmp 0x1400272ff
movsx eax, word [rsp + 0x32]
cmp dword [rsp + 0x68], eax
jl 0x140027331
movsx eax, word [rsp + 0x32]
dec eax
mov word [rsp + 0x26], ax
mov edx, dword [rsp + 0x24]
mov rcx, qword [0x140077b30]
call qword [sym.imp.api_ms_win_core_console_l2_1_0.dll_SetConsoleCursorPosition]
test eax, eax
jne 0x140027350
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x60]
mov dword [0x140079224], eax
mov eax, dword [rsp + 0x68]
mov dword [0x140079220], eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14002a0e0
add rsp, 0x58
ret
Function at 0x1400274d0
Capabilities:
Manipulate console buffer

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov rax, qword [0x1400761f0]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x28]
mov rcx, qword [0x140077b30]
call qword [sym.imp.api_ms_win_core_console_l2_1_0.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x140027503
jmp 0x140027530
movsx eax, word [rsp + 0x2c]
add eax, dword [rsp + 0x60]
mov word [rsp + 0x20], ax
movsx eax, word [rsp + 0x2e]
add eax, dword [rsp + 0x68]
mov word [rsp + 0x22], ax
mov edx, dword [rsp + 0x20]
mov rcx, qword [0x140077b30]
call qword [sym.imp.api_ms_win_core_console_l2_1_0.dll_SetConsoleCursorPosition]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14002a0e0
add rsp, 0x58
ret
Function at 0x1400275d0
Capabilities:
Manipulate console buffer

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [0x1400761f0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x48], 0
xor eax, eax
mov word [rsp + 0x30], ax
xor eax, eax
mov word [rsp + 0x32], ax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x38], rax
cmp qword [0x140077b30], 0
jne 0x14002761f
xor eax, eax
jmp 0x140027760
lea rdx, [rsp + 0x58]
mov rcx, qword [0x140077b30]
call qword [sym.imp.api_ms_win_core_console_l2_1_0.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x14002763c
xor eax, eax
jmp 0x140027760
movsx eax, word [rsp + 0x66]
movsx ecx, word [rsp + 0x62]
sub eax, ecx
inc eax
mov dword [rsp + 0x40], eax
movsx eax, word [rsp + 0x68]
movsx ecx, word [rsp + 0x64]
sub eax, ecx
inc eax
mov dword [rsp + 0x44], eax
movzx eax, word [rsp + 0x62]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x64]
mov word [rsp + 0x32], ax
mov eax, dword [rsp + 0x40]
imul eax, dword [rsp + 0x44]
lea rcx, [rsp + 0x4c]
mov qword [rsp + 0x20], rcx
mov r9d, dword [rsp + 0x30]
mov r8d, eax
mov dl, 0x20
mov rcx, qword [0x140077b30]
call qword [sym.imp.api_ms_win_core_console_l2_1_0.dll_FillConsoleOutputCharacterA]
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movzx edx, word [rax + 2]
mov rcx, qword [0x140077b30]
call qword [sym.imp.api_ms_win_core_console_l2_1_0.dll_SetConsoleTextAttribute]
mov eax, dword [rsp + 0x40]
imul eax, dword [rsp + 0x44]
lea rcx, [rsp + 0x4c]
mov qword [rsp + 0x20], rcx
mov r9d, dword [rsp + 0x30]
mov r8d, eax
mov rax, qword [rsp + 0x50]
movzx edx, word [rax + 2]
mov rcx, qword [0x140077b30]
call qword [sym.imp.api_ms_win_core_console_l2_1_0.dll_FillConsoleOutputAttribute]
lea rax, [rsp + 0x62]
mov qword [rsp + 0x20], rax
mov r9d, dword [0x140077b44]
mov rax, qword [rsp + 0x38]
mov r8d, dword [rax + 8]
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rcx, qword [0x140077b30]
call qword [sym.imp.api_ms_win_core_console_l2_1_0.dll_WriteConsoleOutputA]
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x38]
add rax, 0x10
mov r8, rax
mov edx, 1
mov rcx, qword [0x140077b30]
call qword [sym.imp.api_ms_win_core_console_l2_1_0.dll_SetConsoleWindowInfo]
mov rax, qword [rsp + 0x38]
movsx eax, word [rax + 0xe]
mov rcx, qword [rsp + 0x38]
movsx ecx, word [rcx + 0xc]
mov edx, eax
call fcn.140027290
mov eax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14002a0e0
add rsp, 0x88
ret
Function at 0x140027c40
Capabilities:
Manipulate console buffer

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x478
mov rax, qword [0x1400761f0]
xor rax, rsp
mov qword [rsp + 0x460], rax
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140077b30]
call qword [sym.imp.api_ms_win_core_console_l2_1_0.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x140027c78
jmp 0x140027d5b
movzx eax, word [rsp + 0x4c]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x4e]
mov word [rsp + 0x32], ax
movsx eax, word [rsp + 0x30]
add eax, dword [rsp + 0x480]
mov word [rsp + 0x38], ax
movzx eax, word [rsp + 0x32]
mov word [rsp + 0x3a], ax
movzx eax, word [rsp + 0x32]
mov word [rsp + 0x3e], ax
movzx eax, word [rsp + 0x56]
mov word [rsp + 0x3c], ax
mov eax, 0x100
mov word [rsp + 0x34], ax
mov eax, 1
mov word [rsp + 0x36], ax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, dword [0x140077b44]
mov r8d, dword [rsp + 0x34]
lea rdx, [rsp + 0x60]
mov rcx, qword [0x140077b30]
call qword [sym.imp.api_ms_win_core_console_l2_1_0.dll_ReadConsoleOutputA]
mov dword [rsp + 0x40], eax
call fcn.140026c50
movzx eax, word [rsp + 0x30]
mov word [rsp + 0x38], ax
mov eax, 0x100
mov word [rsp + 0x34], ax
mov eax, 1
mov word [rsp + 0x36], ax
movsx eax, word [rsp + 0x3c]
sub eax, dword [rsp + 0x480]
mov word [rsp + 0x3c], ax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, dword [0x140077b44]
mov r8d, dword [rsp + 0x34]
lea rdx, [rsp + 0x60]
mov rcx, qword [0x140077b30]
call qword [sym.imp.api_ms_win_core_console_l2_1_0.dll_WriteConsoleOutputA]
mov dword [rsp + 0x40], eax
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.14002a0e0
add rsp, 0x478
ret

Function at 0x14003419c
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_RemoveDirectoryW]
test eax, eax
jne 0x1400341bc
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.140031884
or eax, 0xffffffff
jmp 0x1400341be
xor eax, eax
add rsp, 0x28
ret

Function at 0x140034260
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
test eax, eax
jne 0x140034280
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.140031884
or eax, 0xffffffff
jmp 0x140034282
xor eax, eax
add rsp, 0x28
ret
jmp 0x140034260

Function at 0x140034288
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
test eax, eax
jne 0x140034280
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.140031884
or eax, 0xffffffff
jmp 0x140034282
xor eax, eax
add rsp, 0x28
ret
jmp 0x140034260
Function at 0x140034e40
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140034ccb
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test rax, rax
je 0x140034ccb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140034ccb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140034ccb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140034ccb
cmp dword [rcx + 0x84], 0xe
jbe 0x140034ccb
cmp dword [rcx + 0xf8], 0
je 0x140034ccb
mov ecx, ebx
call fcn.140034d6c
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140034b48
cmp dword [rbp + 0x20], 0
je 0x140034d18
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140034d20
int3
xor r8d, r8d
xor edx, edx
jmp 0x140034c64

Function at 0x140036284
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x1400761f0]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor esi, esi
mov rbx, rdx
test rdx, rdx
jne 0x140035fc3
call fcn.1400318f4
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.14002c548
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14002a0e0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
test rcx, rcx
je 0x140035f8a
mov dword [rsp + 0x28], esi
lea r8, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileExW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140036031
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
jb 0x140036004
cmp eax, 3
jbe 0x140036021
cmp eax, 8
je 0x140036011
cmp eax, 0x12
je 0x140036021
call fcn.1400318f4
mov dword [rax], reloc.WS2_32.dll_shutdown
jmp 0x140035f9a
call fcn.1400318f4
mov dword [rax], listen
jmp 0x140035f9a
call fcn.1400318f4
mov dword [rax], 2
jmp 0x140035f9a
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x34]
cmp eax, 0x80
cmove eax, esi
mov dword [rbx], eax
call fcn.1400361cc
lea rcx, [rsp + 0x3c]
mov qword [rbx + 8], rax
call fcn.1400361cc
lea rcx, [rsp + 0x44]
mov qword [rbx + 0x10], rax
call fcn.1400361cc
mov qword [rbx + 0x18], rax
lea rcx, [rbx + 0x24]
mov eax, dword [rsp + 0x50]
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov dword [rbx + 0x20], eax
call fcn.1400324f8
test eax, eax
jne 0x14003608f
mov rax, rdi
jmp 0x140035f9e
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14002c568
int3
jmp 0x140035f5c
Function at 0x14003628c
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x1400761f0]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor edi, edi
mov rbx, rdx
test rcx, rcx
jne 0x140036101
call fcn.1400318f4
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.14002c548
or eax, 0xffffffff
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14002a0e0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x290
pop rdi
ret
cmp rcx, 0xffffffffffffffff
je 0x1400360cd
test rbx, rbx
je 0x1400360cd
lea rdx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
test eax, eax
jne 0x14003615c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
jb 0x140036135
cmp eax, 3
jbe 0x14003614f
cmp eax, 8
je 0x140036142
cmp eax, 0x12
je 0x14003614f
call fcn.1400318f4
mov dword [rax], reloc.WS2_32.dll_shutdown
jmp 0x1400360dd
call fcn.1400318f4
mov dword [rax], listen
jmp 0x1400360dd
call fcn.1400318f4
mov dword [rax], 2
jmp 0x1400360dd
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x34]
cmp eax, 0x80
cmove eax, edi
mov dword [rbx], eax
call fcn.1400361cc
lea rcx, [rsp + 0x3c]
mov qword [rbx + 8], rax
call fcn.1400361cc
lea rcx, [rsp + 0x44]
mov qword [rbx + 0x10], rax
call fcn.1400361cc
mov qword [rbx + 0x18], rax
lea rcx, [rbx + 0x24]
mov eax, dword [rsp + 0x50]
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov dword [rbx + 0x20], eax
call fcn.1400324f8
test eax, eax
je 0x1400360e0
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14002c568
int3
jmp 0x1400360a4

Function at 0x140036f18
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x140036ef5
call fcn.1400318f4
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.14002c548
or eax, 0xffffffff
jmp 0x140036f12
sub dword [rcx + 0x10], 1
jns 0x140036f04
add rsp, 0x28
jmp fcn.14003ca94
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x140036ed4
Function at 0x140001200
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov rdi, rcx
mov byte [rcx], 0
mov byte [rcx + 4], 1
mov dword [rcx + 8], 0x23
mov dword [rcx + 0xc], 1
add rcx, 0x10
mov dword [rsp + 0x20], 0xff
mov r9d, 0xc8
xor r8d, r8d
mov edx, 0xff
call fcn.14000b960
mov qword [rdi + 0x14], 1
xor r12d, r12d
mov ecx, 0x3f800000
call fcn.140030720
movss dword [rdi + 0x1c], xmm0
mov byte [rdi + 0x20], r12b
lea r14, [rdi + 0x28]
mov qword [rsp + 0xa0], r14
movabs rax, 0x5f80fa03e1da7615
mov qword [rsp + 0x50], rax
movabs rcx, 0xac961856b30c3d06
mov qword [rsp + 0x58], rcx
movabs rax, 0x5f809d6a87b41976
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
movaps xmm0, xmmword [rsp + 0x40]
xorps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x30], xmm0
mov dword [r14], r12d
mov qword [r14 + 8], r12
mov qword [r14 + 0x10], r12
mov qword [r14 + 0x18], r12
lea rbx, [rsp + 0x30]
movd eax, xmm0
test al, al
je 0x1400012e8
nop word [rax + rax]
inc rbx
cmp byte [rbx], 0
jne 0x1400012e0
lea rax, [rsp + 0x30]
sub rbx, rax
mov dword [rsp + 0x50], r12d
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r12
lea rdx, [rbx + 1]
test rdx, rdx
je 0x140001316
lea rcx, [rsp + 0x58]
call fcn.1400020f0
rdtsc
shl rdx, 0x20
or rax, rdx
mov rbp, rax
mov dword [rsp + 0x50], ebp
mov r8, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
sub r8, rsi
xor edx, edx
mov rcx, rsi
call fcn.1400a6950
mov r8d, r12d
test rbx, rbx
je 0x140001371
mov r9, r12
nop dword [rax + rax]
movzx eax, r8b
add al, al
lea edx, [rax + r8]
add dl, bpl
xor dl, byte [rsp + r9 + 0x30]
mov byte [r9 + rsi], dl
inc r8d
movsxd r9, r8d
cmp r9, rbx
jb 0x140001350
lea rdx, [rsp + 0x58]
lea rcx, [r14 + 8]
call fcn.140001fb0
mov eax, dword [rsp + 0x50]
mov dword [r14], eax
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400013ba
mov rax, qword [rsp + 0x68]
sub rax, rcx
mov rdx, rcx
cmp rax, 0x1000
jb 0x1400013b4
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x140001418
call fcn.14000da60
nop
mov dword [rdi + 0x48], r12d
mov qword [rdi + 0x50], r12
mov qword [rdi + 0x58], r12
mov qword [rdi + 0x60], r12
mov qword [rdi + 0x70], r12
mov qword [rdi + 0x68], r12
mov qword [rdi + 0x80], r12
mov qword [rdi + 0x88], r12
mov qword [rdi + 0x90], r12
mov qword [rdi + 0x98], r12
mov qword [rdi + 0xa0], r12
mov qword [rdi + 0xa8], r12
mov rax, rdi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.140087d64
nop
int3