joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140052f00
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x140084080]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa00]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x140052f95
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x140052ff6
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.14002c920
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400674f0
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret
mov rdx, qword [rbx + 0x168]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x1400530b1
sub ecx, 1
je 0x140053124
sub ecx, 1
je 0x140053060
cmp ecx, 1
je 0x140053043
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x140070780]
call fcn.14002c920
jmp 0x140053124
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.140052c30
test eax, eax
je 0x140053124
jmp 0x140052fca
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140053124
sub rax, rsi
cmp rax, rbp
jae 0x140053124
mov r8, rsi
lea rdx, str.TFTP_error:__s_n
mov rcx, rdi
call fcn.14002caa0
jmp 0x140053124
cmp r8d, 4
jle 0x140053124
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x140053124
lea eax, [r8 - 4]
mov rcx, r14
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.14002c840
mov esi, eax
test eax, eax
je 0x140053103
mov edx, 5
mov rcx, rbx
call fcn.140053bf0
mov eax, esi
jmp 0x140052fca
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.14003a910
mov rcx, r14
call fcn.14003abf0
test eax, eax
je 0x140052fc8
mov edx, 5
mov rcx, rbx
call fcn.140053bf0
mov eax, Ordinal_45
jmp 0x140052fca
Function at 0x140067320
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [section..data]
mov rdi, rax
test rax, rax
jne 0x140067362
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1400673a9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x140067402
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1400673c0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x140067443
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x140077aba]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x140077abb]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x140067410
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1400ae069
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0x6313b710
pushf
not eax
add eax, 0xdbd3d7a9
xor eax, 0xe226b8ca
rol eax, 0xa0
popf
pushf
not eax
add eax, 0xa6dd7a89
xor eax, 0x8ea5eee4
rol eax, 0x95
popf
pushf
not eax
add eax, 0xf05b8518
xor eax, 0xe9ce9826
rol eax, 0x16
popf
pushf
not eax
add eax, 0x8b007b88
xor eax, 0xe6d08a77
rol eax, 0x61
popf
cmp eax, 4
jne 0x1400ae0cc
popf
pop rax
jmp 0x1400ae2c5
cmp eax, 0
jne 0x1400ae0db
popf
pop rax
jmp 0x1400ae108
cmp eax, 3
jne 0x1400ae0ea
popf
pop rax
jmp 0x1400ae268
cmp eax, 1
jne 0x1400ae0f9
popf
pop rax
jmp 0x1400ae1c2
cmp eax, 2
jne 0x1400ae108
popf
pop rax
jmp 0x1400ae20d
push rbx
push rbp
push rsi
sub rsp, 0x20
mov rbx, qword [rcx]
mov rbp, rdx
mov rsi, rcx
mov rbx, qword [rbx + 8]
cmp byte [rbx + 0x19], 0
jne 0x1400ae17c
push rax
pushf
mov eax, 0xf895ecb9
pushf
not eax
add eax, 0xd5908ca5
xor eax, 0x86b7e31b
rol eax, 0x5f
popf
pushf
not eax
add eax, 0xcc8d9c91
xor eax, 0xdff7356d
rol eax, 0x98
popf
pushf
not eax
add eax, 0xa2d050fd
xor eax, 0xa63af1c8
rol eax, 0xb4
popf
pushf
not eax
add eax, 0x80f4ad29
xor eax, 0x9b5bf1d4
rol eax, 0xa5
popf
jmp 0x1400ae0bd
push rax
pushf
mov eax, 0xd139aee0
pushf
not eax
add eax, 0xfc113570
xor eax, 0xa0f91ae6
rol eax, 0x64
popf
pushf
not eax
add eax, 0x82c9fdef
xor eax, 0xbe122c27
rol eax, 0xb0
popf
pushf
not eax
add eax, 0xb080bef7
xor eax, 0x950f5c04
rol eax, 0x3a
popf
jmp 0x1400ae0bd
mov qword [rsp + 0x50], rdi
push rax
pushf
mov eax, 0x31513f31
pushf
not eax
add eax, 0xb5e308ca
xor eax, 0xcb98beb1
rol eax, 0x49
popf
pushf
not eax
add eax, 0xe8f37708
xor eax, 0xfc8a28ab
rol eax, 0xf3
popf
pushf
not eax
add eax, 0xf22c5b29
xor eax, 0x8c1b46b0
rol eax, 0x33
popf
jmp 0x1400ae0bd
mov r8, qword [rbx + 0x10]
mov rdx, rbp
mov rcx, rsi
call fcn.1400e2c56
mov rdi, rbx
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.1401066e3
mov edx, 0x129ee4d0
pushf
not edx
add edx, 0xfa4d4285
xor edx, 0x858f8738
rol edx, 0x81
popf
pushf
not edx
add edx, 0x9cd5c1e4
xor edx, 0xd89206cb
rol edx, 0x1b
popf
mov rcx, rdi
call fcn.1400c3e2f
cmp byte [rbx + 0x19], 0
je 0x1400ae20d
mov rdi, qword [rsp + 0x50]
push rax
pushf
mov eax, 0x74041a3
pushf
not eax
add eax, 0x8505d6d6
xor eax, 0x93f8161d
rol eax, 0x6f
popf
pushf
not eax
add eax, 0xf9ea320d
xor eax, 0xff4be0c2
rol eax, 0x32
popf
pushf
not eax
add eax, 0xe07620a6
xor eax, 0xbc1f8eea
rol eax, 0xf9
popf
pushf
not eax
add eax, 0xa34d586e
xor eax, 0xf9b59f5a
rol eax, 1
popf
jmp 0x1400ae0bd
mov rcx, qword [rsi]
mov edx, 0x6b3f9c2a
pushf
not edx
add edx, 0xe9bbb3cc
xor edx, 0xcb5fdd57
rol edx, 0x66
popf
pushf
not edx
add edx, 0xf45fa600
xor edx, 0xab6c4852
rol edx, 0x97
popf
add rsp, 0x20
pop rsi
pop rbp
pop rbx
jmp fcn.1400c3e2f
Function at 0x1400b0796
Capabilities:
Authenticate hmac
Hash data using murmur3
Parse credit card information
Parse pe header

Disassembly:
push rax
pushf
mov eax, 0x3aef250b
pushf
not eax
add eax, 0xf72fb93b
xor eax, 0x97342770
rol eax, 0xf3
popf
pushf
not eax
add eax, 0xa0556a6c
xor eax, 0x95b4c902
rol eax, 0x5e
popf
pushf
not eax
add eax, 0xb719f359
xor eax, 0x894ce26b
rol eax, 0x67
popf
pushf
not eax
add eax, 0xa335513d
xor eax, 0xd9a3cb2f
rol eax, 0x8f
popf
cmp eax, 0
jne 0x1400b07f9
popf
pop rax
jmp 0x1400b07f9
movzx edx, byte [rcx]
add rcx, 8
jmp fcn.1400f724b
Function at 0x1400e2c56
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0xc8b2bbfb
pushf
not eax
add eax, 0x90896ee2
xor eax, 0x8fc94768
rol eax, 0xe6
popf
pushf
not eax
add eax, 0xb2007423
xor eax, 0xff60e4bb
rol eax, 0x85
popf
pushf
not eax
add eax, 0xff7b494d
xor eax, 0xb51de490
rol eax, 0x73
popf
pushf
not eax
add eax, 0xfcad67f8
xor eax, 0xc11628ee
rol eax, 0xe8
popf
cmp eax, 4
jne 0x1400e2cb9
popf
pop rax
jmp 0x1400e2eb5
cmp eax, 0
jne 0x1400e2cc8
popf
pop rax
jmp 0x1400e2cf5
cmp eax, 3
jne 0x1400e2cd7
popf
pop rax
jmp 0x1400e2e7d
cmp eax, 1
jne 0x1400e2ce6
popf
pop rax
jmp 0x1400e2dac
cmp eax, 2
jne 0x1400e2cf5
popf
pop rax
jmp 0x1400e2e0d
push rbx
push rbp
push rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
mov rbx, r8
mov rbp, rdx
mov rsi, rcx
jne 0x1400e2d53
push rax
pushf
mov eax, 0xebe17136
pushf
not eax
add eax, 0x96907d13
xor eax, 0x911a6f43
rol eax, 0xd
popf
pushf
not eax
add eax, 0x9354f0fa
xor eax, 0xa87a627c
rol eax, 0x2c
popf
pushf
not eax
add eax, 0xa5b6860c
xor eax, 0xee769120
rol eax, 0x29
popf
jmp 0x1400e2caa
push rax
pushf
mov eax, 0x27507d35
pushf
not eax
add eax, 0xd55164e3
xor eax, 0xd1f082a8
rol eax, 0x32
popf
pushf
not eax
add eax, 0x95e3f8f4
xor eax, 0xbe3c6951
rol eax, 0xc9
popf
pushf
not eax
add eax, 0xaaa3d88b
xor eax, 0xabd34a89
rol eax, 0x59
popf
pushf
not eax
add eax, 0xdcda1a43
xor eax, 0xda01798b
rol eax, 0x89
popf
jmp 0x1400e2caa
mov qword [rsp + 0x58], rdi
nop dword [rax]
push rax
pushf
mov eax, 0xe1ca0a0b
pushf
not eax
add eax, 0x9a9eb327
xor eax, 0xfdcca560
rol eax, 0xcd
popf
pushf
not eax
add eax, 0xdb2b26e9
xor eax, 0xa4544574
rol eax, 0xa6
popf
pushf
not eax
add eax, 0xe4ad2a63
xor eax, 0xc3430e43
rol eax, 0x32
popf
pushf
not eax
add eax, 0xd770a2a6
xor eax, 0x966d52f0
rol eax, 0x12
popf
jmp 0x1400e2caa
mov r8, qword [rbx + 0x10]
mov rdx, rbp
mov rcx, rsi
call fcn.1400e2c56
mov rdi, rbx
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.1401066e3
mov edx, 0x5f9f9747
pushf
not edx
add edx, 0xed551423
xor edx, 0x96bca0b4
rol edx, 0xe3
popf
pushf
not edx
add edx, 0xc9c224cd
xor edx, 0xe0165be8
rol edx, 0x5e
popf
pushf
not edx
add edx, 0xa4796ab6
xor edx, 0xa0216406
rol edx, 0x36
popf
mov rcx, rdi
call fcn.1400c3e2f
cmp byte [rbx + 0x19], 0
je 0x1400e2e0d
mov rdi, qword [rsp + 0x58]
push rax
pushf
mov eax, 0xbe83c839
pushf
not eax
add eax, 0x8972fee5
xor eax, 0x8f997bce
rol eax, 0x39
popf
pushf
not eax
add eax, 0xafe89dbe
xor eax, 0xe15db123
rol eax, 0xa8
popf
jmp 0x1400e2caa
add rsp, 0x20
pop rsi
pop rbp
pop rbx
ret
Function at 0x140006350
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140006372
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x1400063ec
mov rdi, r14
mov rcx, rbx
call fcn.140008de0
test rax, rax
jle 0x1400063c4
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.140047260
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1400063dc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x1400063e4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140006386
sub r14, rdi
jmp 0x1400064cf
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140006403
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140006405
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140006437
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.140047260
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1400064cc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140006472
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x1400064ad
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.140030528
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x1400064cc
cmp rbp, rax
ja 0x140006480
test rbp, rbp
je 0x1400064cc
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.140030528
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x14001d8c0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x1400620c0]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xor esi, esi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], si
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
lea r9d, [rsi - 1]
lea r8, str.cs2.exe
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
test eax, eax
jle 0x14001d9f2
mov r8, qword [rsp + 0x48]
cmp rbx, r8
ja 0x14001d95f
mov qword [rsp + 0x48], rbx
lea rax, [rsp + 0x38]
cmp qword [rsp + 0x50], 7
cmova rax, qword [rsp + 0x38]
mov word [rax + rbx*2], si
jmp 0x14001d9be
mov rdx, rbx
sub rdx, r8
mov rdi, qword [rsp + 0x50]
mov rax, rdi
sub rax, r8
cmp rdx, rax
ja 0x14001d9a6
mov qword [rsp + 0x48], rbx
lea r9, [rsp + 0x38]
cmp rdi, 7
cmova r9, qword [rsp + 0x38]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x14001d99b
movzx eax, si
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], si
jmp 0x14001d9be
mov word [rsp + 0x20], si
mov r9, rdx
movzx r8d, byte [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.14001ded0
lea rax, [rsp + 0x38]
cmp qword [rsp + 0x50], 7
cmova rax, qword [rsp + 0x38]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, str.cs2.exe
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x64]
call fcn.140047900
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14001da7f
nop dword [rax]
lea rdi, [rsp + 0x38]
cmp qword [rsp + 0x50], 7
cmova rdi, qword [rsp + 0x38]
lea rax, [rbp - 0x74]
sub rdi, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + rdi]
sub edx, ecx
jne 0x14001da63
add rax, 2
test ecx, ecx
jne 0x14001da50
test edx, edx
je 0x14001da7b
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14001da30
jmp 0x14001da7f
mov esi, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 7
jbe 0x14001dac7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001dac2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001daf1
call fcn.140022210
mov eax, esi
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.1400221f0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.140030d38
int3
Function at 0x14001db00
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x1400620c0]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor esi, esi
mov edi, edx
mov ebx, esi
nop word [rax + rax]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExA]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [rsp + 0x20], edi
jne 0x14001db84
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x14001db84
cmp byte [rsp + 0x30], sil
jne 0x14001dbb0
test rbx, rbx
jne 0x14001db30
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400221f0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov rax, rbx
jmp 0x14001db8b
Function at 0x140022f3c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140022f86
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140022f86
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140022f86
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140022f86
cmp dword [rcx + 0x84], 0xe
jbe 0x140022f86
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140022f88
xor al, al
add rsp, 0x28
ret

Function at 0x140030ee8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x140030f1f
call fcn.14002df94
mov dword [rax], 0x16
call fcn.140030d18
xor eax, eax
jmp 0x140030fad
mov rdx, r9
mov rcx, r8
call fcn.140030e84
mov rbx, rax
test rax, rax
je 0x140030faa
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x140030db0]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x140030f97
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14002df08
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140030f7e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140030f8d
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.1400370d4
jmp 0x140030faa
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140030fa7
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1400328f8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400326f4

Function at 0x1400354bc
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400354d2
mov al, 1
jmp 0x140035532
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400354e3
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140035530
mov ecx, dword [rcx + 0x18]
nop
call fcn.14003ed14
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140035530
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140035530
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140035530
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140035532
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140039924
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140022920
sub rsp, rax
mov rax, qword [0x1400620c0]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14003539c
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x140039973
mov rax, rbp
jmp 0x140039a7b
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x64f10]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.14003a870
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x64f10]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x140039a77
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140039a77
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.14003a870
test rax, rax
js 0x140039a77
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x140039a77
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x140039a69
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x140039a69
cmp byte [rcx], 0xd
jne 0x140039a4f
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x140039a5e
cmp byte [rcx + 1], 0xa
jne 0x140039a5e
inc rcx
jmp 0x140039a5e
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x624f0]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x140039a31
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x140039a7b
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400221f0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140039c10
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x140064f10]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x140039c67
cmp word [rdx], r13w
jne 0x140039c67
or byte [rax + rdi*8 + 0x38], cl
jmp 0x140039c6c
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x140039d91
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x140039db2
lea r9, [rdx + 2]
cmp cx, r11w
je 0x140039ca5
mov rdx, r9
mov word [rbx], cx
jmp 0x140039ccc
cmp r9, r8
jae 0x140039cdc
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x140039c86
jmp 0x140039d91
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140039d86
cmp dword [rsp + 0x80], esi
je 0x140039d86
lea r8, [0x140064f10]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x140039d5e
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x140039d2e
mov word [rbx], r13w
jmp 0x140039d8e
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x140039d3b
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x140039d8e
cmp word [rsp + 0x70], r13w
jne 0x140039d6b
cmp rbx, r14
je 0x140039d28
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.14003a878
cmp word [rsp + 0x70], r13w
je 0x140039d91
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x140064f10]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x140039d8b
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x140039d91