joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004c82
Capabilities:
Create directory

Disassembly:
jmp 0x14008a630
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x14023c868]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xb0]
add rax, 0x80
mov rcx, rax
call fcn.140001b63
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x14008a69c
mov rax, qword [rsp + 0xb0]
add rax, 0x80
mov rcx, rax
call fcn.140001b63
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rax, qword [rsp + 0xb0]
add rax, 0x80
lea r8, [0x1401dd30c]
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.140007478
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea r8, [0x1401dd300]
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x58]
call fcn.1400085c1
nop
lea rcx, [rsp + 0x78]
call fcn.14000274d
lea rcx, [rsp + 0x58]
call fcn.140001b63
mov rdx, rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_char_const____ptr64____ptr64]
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QFile::constructor_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov edx, 2
mov rcx, qword [rsp + 0x50]
call fcn.140007a90
mov edx, dword [rax]
lea rcx, [rsp + 0x28]
call qword [sym.imp.Qt5Core.dll_public_virtual:_bool___cdecl_QFile::open_class_QFlags_enum_QIODevice::OpenModeFlag_____ptr64]
movzx eax, al
test eax, eax
jne 0x14008a768
lea rcx, [rsp + 0x28]
call qword [sym.imp.Qt5Core.dll_public_virtual:_void___cdecl_QFile::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x58]
call fcn.14000274d
jmp 0x14008a7a7
mov eax, dword [rsp + 0xc0]
mov r8d, eax
mov rdx, qword [rsp + 0xb8]
lea rcx, [rsp + 0x28]
call qword [sym.imp.Qt5Core.dll_public:_long_long___int64____cdecl_QIODevice::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rsp + 0x28]
call qword [sym.imp.Qt5Core.dll_public_virtual:_void___cdecl_QFileDevice::close_void____ptr64]
nop
lea rcx, [rsp + 0x28]
call qword [sym.imp.Qt5Core.dll_public_virtual:_void___cdecl_QFile::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x58]
call fcn.14000274d
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140004de0
add rsp, 0xa8
ret
Function at 0x140004de5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140079310
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14023c868]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor eax, eax
mov word [rsp + 0x24], ax
mov dword [rsp + 0x28], 1
jmp 0x14007934d
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xf
jg 0x140079389
movzx eax, word [rsp + 0x24]
mov ecx, dword [rsp + 0x28]
dec ecx
movsxd rcx, ecx
mov rdx, qword [rsp + 0x70]
movzx ecx, word [rdx + rcx*2 + 0x1018]
add eax, ecx
shl eax, 1
mov word [rsp + 0x24], ax
movsxd rax, dword [rsp + 0x28]
movzx ecx, word [rsp + 0x24]
mov word [rsp + rax*2 + 0x38], cx
jmp 0x140079343
movzx eax, word [rsp + 0x24]
mov ecx, 2
imul rcx, rcx, 0xf
mov rdx, qword [rsp + 0x70]
movzx ecx, word [rdx + rcx + 0x1018]
lea eax, [rax + rcx - 1]
cmp eax, 0x7fff
jne 0x1400793b6
mov byte [rsp + 0x20], 1
jmp 0x1400793bb
mov byte [rsp + 0x20], 0
lea r8, str.inconsistent_bit_counts
movzx edx, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x70]
call fcn.140006901
mov edx, dword [rsp + 0x80]
lea rcx, str._ngen_codes:_max_code__d
call fcn.14000688e
mov dword [rsp + 0x30], 0
jmp 0x1400793f8
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x80]
cmp dword [rsp + 0x30], eax
jg 0x140079463
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
movzx eax, word [rcx + rax*4 + 2]
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0
jne 0x140079421
jmp 0x1400793ee
movsxd rax, dword [rsp + 0x2c]
movzx eax, word [rsp + rax*2 + 0x38]
mov dword [rsp + 0x34], eax
movsxd rax, dword [rsp + 0x2c]
movzx eax, word [rsp + rax*2 + 0x38]
inc ax
movsxd rcx, dword [rsp + 0x2c]
mov word [rsp + rcx*2 + 0x38], ax
mov edx, dword [rsp + 0x2c]
mov ecx, dword [rsp + 0x34]
call fcn.1400048b8
movsxd rcx, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x78]
mov word [rdx + rcx*4], ax
jmp 0x1400793ee
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004de0
add rsp, 0x68
ret

Function at 0x140004e67
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
jmp 0x1400f1384
jmp 0x1400f7e18
xor r9d, r9d
movabs r8, 0xcbf29ce484222325
test rdx, rdx
je 0x1400f13b4
movzx eax, byte [r9 + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc r9
imul r8, r10
cmp r9, rdx
jb 0x1400f1396
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
mov rdx, r8
jmp 0x140002f4a
Function at 0x140004f66
Capabilities:
Check if file exists
Create directory

Disassembly:
jmp 0x140074ec0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x488
mov rax, qword [0x14023c868]
xor rax, rsp
mov qword [rsp + 0x470], rax
cmp qword [rsp + 0x490], 0
je 0x140074f11
mov rcx, qword [rsp + 0x490]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140074f11
xor edx, edx
mov rcx, qword [rsp + 0x490]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rax, qword [rsp + 0x498]
movzx eax, word [rax]
test eax, eax
jne 0x140074f25
jmp 0x1400750a4
mov rax, qword [rsp + 0x498]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
test eax, eax
je 0x140074f7c
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x2f
je 0x140074f62
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5c
jne 0x140074f6c
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
add rax, 2
mov qword [rsp + 0x20], rax
jmp 0x140074f3c
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x498]
cmp qword [rsp + 0x28], rax
je 0x14007502c
mov rax, qword [rsp + 0x498]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
sar rax, 1
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x498]
lea rcx, [rsp + 0x260]
call fcn.140004e21
mov rax, qword [rsp + 0x498]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
sar rax, 1
shl rax, 1
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0x208
jae 0x140074ff5
jmp 0x140074ffa
call fcn.140006c94
xor eax, eax
mov rcx, qword [rsp + 0x30]
mov word [rsp + rcx + 0x260], ax
lea rdx, [rsp + 0x260]
mov rcx, qword [rsp + 0x490]
call fcn.140004f66
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov eax, 2
imul rax, rax, 0
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0x208
jae 0x140075047
jmp 0x14007504c
call fcn.140006c94
xor eax, eax
mov rcx, qword [rsp + 0x40]
mov word [rsp + rcx + 0x50], ax
cmp qword [rsp + 0x490], 0
je 0x140075075
mov rdx, qword [rsp + 0x490]
lea rcx, [rsp + 0x50]
call fcn.140003a99
mov rdx, qword [rsp + 0x498]
lea rcx, [rsp + 0x50]
call fcn.140003d0a
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400750a4
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140004de0
add rsp, 0x488
ret

Function at 0x1400051e1
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x14013b4a8
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x1401fc808]
mov ecx, 2
lea r8, [0x1401fc800]
lea rdx, str.FlsGetValue
call fcn.14013af78
mov ecx, ebx
test rax, rax
je 0x14013b4e2
add rsp, 0x20
pop rbx
jmp qword [0x14026d020]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1400052cc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x14011f7d0
push rbx
sub rsp, 0x20
test byte [rcx + 0x68], 1
mov rbx, rcx
je 0x14011f80c
mov rax, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
je 0x14011f7fc
mov rcx, rax
call fcn.14000205e
add qword [rbx + 8], 0x20
add rsp, 0x20
pop rbx
ret
mov r8, rdx
mov rdx, rax
add rsp, 0x20
pop rbx
jmp fcn.140003080
cmp qword [rdx + 0x18], 0x10
mov rax, rdx
jb 0x14011f819
mov rax, qword [rdx]
mov r8, qword [rdx + 0x10]
mov rdx, rax
mov rcx, qword [rcx + 0x18]
add rsp, 0x20
pop rbx
jmp fcn.140005ea2

Function at 0x1400055c4
Capabilities:
Read file on windows

Disassembly:
jmp 0x140071240
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x58]
imul rax, qword [rsp + 0x60]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x68]
movzx eax, byte [rax]
test eax, eax
je 0x1400712bb
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jne 0x1400712ae
mov rax, qword [rsp + 0x68]
mov byte [rax + 0x10], 1
mov eax, dword [rsp + 0x3c]
xor edx, edx
div qword [rsp + 0x58]
jmp 0x140071333
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 0x2c]
add eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
cmp eax, dword [rcx + 0x28]
jbe 0x1400712e7
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x68]
mov ecx, dword [rcx + 0x2c]
mov eax, dword [rax + 0x28]
sub eax, ecx
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
mov ecx, dword [rcx + 0x2c]
mov rdx, qword [rsp + 0x68]
add rcx, qword [rdx + 0x20]
mov r8d, eax
mov rdx, rcx
mov rcx, qword [rsp + 0x50]
call fcn.140004e21
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 0x2c]
add eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x68]
mov dword [rcx + 0x2c], eax
mov eax, dword [rsp + 0x34]
xor edx, edx
div qword [rsp + 0x58]
add rsp, 0x48
ret
Function at 0x14000560a
Capabilities:
Query environment variable

Disassembly:
jmp 0x14019da30
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14019da60
xor eax, eax
jmp 0x14019db23
mov rbp, rbx
cmp word [rax], si
je 0x14019da85
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14019da6c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14019da68
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400070ea
movsxd r14, eax
test eax, eax
jne 0x14019dac3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14019da59
mov rcx, r14
call fcn.140001087
mov rdi, rax
test rax, rax
jne 0x14019dadc
xor ecx, ecx
call fcn.1400013c5
jmp 0x14019dab8
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400070ea
test eax, eax
jne 0x14019db0d
mov rcx, rdi
call fcn.1400013c5
jmp 0x14019db17
xor ecx, ecx
call fcn.1400013c5
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140005623
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x14013b3f8
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x1401fc7c8]
xor ecx, ecx
lea r8, [0x1401fc7c0]
lea rdx, str.FlsAlloc
call fcn.14013af78
test rax, rax
je 0x14013b431
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [0x14026d020]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x14000574a
Capabilities:
Get geographical location

Disassembly:
jmp 0x14018bb10
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, r9d
mov rdi, r8
mov esi, edx
lea r9, [0x140201e88]
mov rbp, rcx
lea r8, [0x140201e80]
lea rdx, str.GetLocaleInfoEx
mov ecx, 8
call fcn.14018b030
test rax, rax
je 0x14018bb70
movabs r10, 0xe375262d7cd44270
mov r9d, ebx
mov r8, rdi
mov edx, esi
mov rcx, rbp
call qword [0x14026d030]
jmp 0x14018bb8a
xor edx, edx
mov rcx, rbp
call fcn.1400041ce
mov ecx, eax
mov r9d, ebx
mov r8, rdi
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140005781
Capabilities:
Terminate process

Disassembly:
jmp 0x1400faf98
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x140005a47
Capabilities:
Create directory

Disassembly:
jmp 0x14008a460
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov rax, qword [0x14023c868]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xc0]
add rax, 0x60
mov rcx, rax
call fcn.140001b63
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x14008a4c3
mov rax, qword [rsp + 0xc0]
add rax, 0x60
mov rcx, rax
call fcn.140001b63
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rax, qword [rsp + 0xc0]
add rax, 0x60
lea r8, [0x1401dd2fc]
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.140007478
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea r8, str.account.txt
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x68]
call fcn.1400085c1
nop
lea rcx, [rsp + 0x88]
call fcn.14000274d
lea rcx, [rsp + 0x68]
call fcn.140001b63
mov rdx, rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_char_const____ptr64____ptr64]
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QFile::constructor_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov r8d, reloc.WS2_32.dll_recv
mov edx, 2
lea rcx, [rsp + 0x38]
call fcn.1400089cc
mov edx, dword [rax]
lea rcx, [rsp + 0x28]
call qword [sym.imp.Qt5Core.dll_public_virtual:_bool___cdecl_QFile::open_class_QFlags_enum_QIODevice::OpenModeFlag_____ptr64]
movzx eax, al
test eax, eax
jne 0x14008a59e
lea rcx, [rsp + 0x28]
call qword [sym.imp.Qt5Core.dll_public_virtual:_void___cdecl_QFile::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x68]
call fcn.14000274d
nop
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
jmp 0x14008a60d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.Qt5Core.dll__toLocal8Bit_QString__QEGBA_AVQByteArray__XZ]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x28]
call qword [sym.imp.Qt5Core.dll_public:_long_long___int64____cdecl_QIODevice::write_class_QByteArray_const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QByteArray::destructor_void____ptr64]
lea rcx, [rsp + 0x28]
call qword [sym.imp.Qt5Core.dll_public_virtual:_void___cdecl_QFileDevice::close_void____ptr64]
nop
lea rcx, [rsp + 0x28]
call qword [sym.imp.Qt5Core.dll_public_virtual:_void___cdecl_QFile::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x68]
call fcn.14000274d
nop
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.140004de0
add rsp, 0xb8
ret

Function at 0x140005b46
Capabilities:
Parse pe header

Disassembly:
jmp 0x14017d1d0
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x14017cf2c
Function at 0x140005d85
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140085610
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x288
mov rax, qword [0x14023c868]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov dword [rsp + 0x30], 0x238
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
jne 0x140085658
xor eax, eax
jmp 0x1400856ab
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x14008566f
xor eax, eax
jmp 0x1400856ab
mov rdx, qword [rsp + 0x298]
lea rcx, [rsp + 0x5c]
call fcn.140008e81
test eax, eax
jne 0x14008568b
mov eax, dword [rsp + 0x38]
jmp 0x1400856ab
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14008566f
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140004de0
add rsp, 0x288
ret
Function at 0x1400066f9
Capabilities:
Clear file content

Disassembly:
jmp 0x1401b14a8
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400024d7
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400024d7
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1401b15f8
cmp rax, 0xffffffffffffffff
je 0x1401b15f8
xor edi, edi
test rbp, rbp
jle 0x1401b15a3
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140008427
mov rbx, rax
test rax, rax
jne 0x1401b1530
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1401b1599
mov edx, 0x8000
mov ecx, r14d
call fcn.140006bea
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.140007c34
cmp eax, 0xffffffff
je 0x1401b1579
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1401b1540
mov edx, r15d
mov ecx, r14d
call fcn.140006bea
jmp 0x1401b1599
cmp byte [rsi + 0x38], dil
je 0x1401b1590
cmp dword [rsi + 0x34], 5
jne 0x1401b1590
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], select
cmp byte [rsi + 0x30], dil
je 0x1401b1599
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400013c5
jmp 0x1401b160c
jns 0x1401b160c
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400024d7
cmp rax, 0xffffffffffffffff
jne 0x1401b15c4
cmp byte [rsi + 0x30], dil
je 0x1401b160c
mov edi, dword [rsi + 0x2c]
jmp 0x1401b160c
mov ecx, r14d
call fcn.140009633
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1401b160c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, ntohs
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], select
jmp 0x1401b160c
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1401b1605
mov eax, dword [rsi + 0x2c]
jmp 0x1401b160a
mov eax, socket
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400024d7
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140006834
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400fbf4c
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400fbf96
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400fbf96
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400fbf96
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400fbf96
cmp dword [rcx + 0x84], 0xe
jbe 0x1400fbf96
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400fbf98
xor al, al
add rsp, 0x28
ret
Function at 0x140006979
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x14011f740
sub rsp, 0x28
test byte [rcx + 0xd8], 1
je 0x14011f78e
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
mov qword [rsp + 0x20], rbx
lea rbx, [rcx + 0x10]
je 0x14011f777
mov rcx, rax
call fcn.14000205e
add qword [rbx + 8], 0x20
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
mov r8, rdx
mov rcx, rbx
mov rdx, rax
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
jmp fcn.140003080
cmp qword [rdx + 0x18], 0x10
mov rax, rdx
jb 0x14011f79b
mov rax, qword [rdx]
mov r8, qword [rdx + 0x10]
mov rdx, rax
mov rcx, qword [rcx + 8]
add rsp, 0x28
jmp fcn.140005ea2
Function at 0x1400069fb
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
jmp 0x1400ccaa8
jmp 0x1400eab44
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x1400ccada
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x1400ccabd
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x140001271

Function at 0x140006c67
Capabilities:
Accept command line arguments

Disassembly:
jmp 0x1401b29d0
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x50], rax
mov rdi, rax
test rax, rax
jne 0x1401b2a0d
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x40]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x98], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x60], r14
cmovo rax, r15
mov rcx, rax
call fcn.1400047b9
mov r14, rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x1401b2b0c
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0xa0], r12
mov r12, r14
mov qword [rsp + 0x68], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
nop word [rax + rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.1400047b9
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x40]
inc r14d
cmp r14d, eax
jne 0x1401b2a80
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x90]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x40]
mov rdx, r14
call fcn.1400065fa
mov esi, eax
cmp dword [rsp + 0x40], ebx
je 0x1401b2b4b
mov rdi, r14
mov rcx, qword [rdi]
test rcx, rcx
je 0x1401b2b4b
call fcn.140004d95
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x40]
jne 0x1401b2b32
mov rcx, r14
call fcn.140004d95
mov r14, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x98]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret