joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140100d90
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
mov byte [0x1411ed321], 1
mov rcx, qword [rcx + 0xc8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QTimer::stop_void____ptr64]
mov edx, 6
lea rcx, [0x1402f80e4]
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
mov rcx, qword [rbx + 0x48]
call qword [sym.imp.Qt5Widgets.dll_public:_void___cdecl_QLabel::setText_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov edx, 6
lea rcx, [0x1402f80e4]
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.Qt5Widgets.dll_public:_void___cdecl_QLabel::setText_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov rcx, qword [rbx + 0x48]
call qword [sym.imp.Qt5Widgets.dll_public:_void___cdecl_QWidget::hide_void____ptr64]
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.Qt5Widgets.dll_public:_void___cdecl_QWidget::hide_void____ptr64]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.Qt5Widgets.dll_public:_void___cdecl_QWidget::hide_void____ptr64]
mov rcx, qword [rbx + 0x88]
call qword [sym.imp.Qt5Widgets.dll_public:_void___cdecl_QWidget::hide_void____ptr64]
mov rcx, qword [rbx + 0x58]
call qword [sym.imp.Qt5Widgets.dll_public:_void___cdecl_QWidget::hide_void____ptr64]
mov rcx, rbx
call qword [sym.imp.Qt5Widgets.dll_public:_bool___cdecl_QWidget::close_void____ptr64]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll__toUtf8_QString__QEGBA_AVQByteArray__XZ]
nop
mov rcx, rax
call qword [sym.imp.Qt5Core.dll_public:_char_const____ptr64___cdecl_QByteArray::operator_char_const____ptr64_void_const___ptr64]
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QByteArray::destructor_void____ptr64]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QCoreApplication____ptr64___cdecl_QCoreApplication::instance_void_]
call qword [sym.imp.Qt5Core.dll_public:_static_void___cdecl_QCoreApplication::quit_void_]
nop
mov rcx, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
Function at 0x14015e920
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x80
mov rbx, rcx
mov rax, qword [rcx + 0x28]
movups xmm0, xmmword [rax + 0x14]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
add rcx, 0xb0
call fcn.140015040
mov rcx, qword [rbx + 0x100]
call qword [sym.imp.Qt5Widgets.dll_public:_void___cdecl_QProgressBar::reset_void____ptr64]
mov edx, 3
mov rcx, qword [rbx + 0x100]
call qword [sym.imp.Qt5Widgets.dll_public:_void___cdecl_QProgressBar::setMaximum_int____ptr64]
mov dword [rsp + 0x20], 0xffffffff
xor r9d, r9d
lea r8, [0x1402f6b08]
lea rdx, [rsp + 0x90]
lea rcx, [0x1411d9188]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QMetaObject::tr_char_const____ptr64__char_const____ptr64__int____ptr64]
nop
lea rdx, [rsp + 0x90]
mov rcx, qword [rbx + 0xf8]
call qword [sym.imp.Qt5Widgets.dll_public:_void___cdecl_QLabel::setText_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov dword [rsp + 0x20], 0xffffffff
xor r9d, r9d
lea r8, [0x1402f6b30]
lea rdx, [rsp + 0x90]
lea rcx, [0x1411d9188]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QMetaObject::tr_char_const____ptr64__char_const____ptr64__int____ptr64]
nop
lea rdx, [rsp + 0x90]
mov rcx, qword [rbx + 0x110]
call qword [sym.imp.Qt5Widgets.dll_public:_void___cdecl_QLabel::setText_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rcx, [rbx + 0xb0]
call fcn.140084240
lea rcx, [rbx + 0xb0]
call qword [sym.imp.Qt5Widgets.dll_public:_void___cdecl_QWidget::show_void____ptr64]
mov edx, 1
mov rcx, qword [rbx + 0x100]
call qword [sym.imp.Qt5Widgets.dll_public:_void___cdecl_QProgressBar::setValue_int____ptr64]
mov word [0x1411ec731], 0
mov byte [0x1411dd024], 0
mov byte [0x1411ec733], 0
lea rcx, [rsp + 0x40]
call fcn.1401a2e70
nop
lea rcx, [rsp + 0x40]
call fcn.1401a3d70
mov edx, 2
mov rcx, qword [rbx + 0x100]
call qword [sym.imp.Qt5Widgets.dll_public:_void___cdecl_QProgressBar::setValue_int____ptr64]
movzx eax, byte [0x1411e99c4]
cmp al, 0x10
jne 0x14015ea91
lea rcx, [rsp + 0x58]
call fcn.1401c2280
nop
lea rcx, [rsp + 0x58]
call fcn.1401c2bb0
nop
jmp 0x14015eabe
cmp al, 0x20
jne 0x14015eac9
movzx ecx, byte [0x1411e99bd]
lea eax, [rcx - 1]
cmp al, 2
jbe 0x14015eaa8
cmp cl, 5
jne 0x14015eac9
lea rcx, [rsp + 0x58]
call fcn.1401c2280
nop
lea rcx, [rsp + 0x58]
call fcn.1401c2bb0
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.Qt5Core.dll_public_virtual:_void___cdecl_QObject::destructor_void____ptr64]
lea rcx, [rsp + 0x40]
call fcn.1401b1400
mov edx, 3
mov rcx, qword [rbx + 0x100]
call qword [sym.imp.Qt5Widgets.dll_public:_void___cdecl_QProgressBar::setValue_int____ptr64]
lea rcx, [rbx + 0xb0]
call fcn.140082ed0
lea rcx, [rbx + 0xb0]
call qword [sym.imp.Qt5Widgets.dll_public:_void___cdecl_QWidget::hide_void____ptr64]
nop
lea rcx, [rsp + 0x40]
call fcn.1401a30e0
mov rcx, rbx
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
jmp fcn.140166b60
Function at 0x140173200
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor ebp, ebp
mov ebx, ebp
mov dword [rsp + 0x40], ebx
cmp byte [0x1411dd024], bl
je 0x1401733c4
mov qword [rsp + 0x48], 0xfffffffffffffe00
mov dword [rsp + 0x44], ebp
lea rdi, [rcx + 0x308]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_QString::toStdWString_void____ptr64]
cmp qword [rax + 0x18], 8
jb 0x140173266
mov rax, qword [rax]
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x1401732d8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401732d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401732d3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402b2268
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], bp
cmp rsi, 0xffffffffffffffff
je 0x140173328
mov r8d, 4
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::right_int____ptr64]
nop
mov ebx, 1
mov dword [rsp + 0x40], ebx
lea rdx, [0x1402f2dd0]
mov rcx, rax
call qword [sym.imp.Qt5Core.dll_public:_bool___cdecl_QString::operator__char_const____ptr64_const___ptr64]
test al, al
jne 0x140173328
xor dil, dil
jmp 0x14017332b
mov dil, 1
test bl, 1
je 0x14017333b
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
test dil, dil
jne 0x1401733c4
mov ecx, 0x200
call fcn.1402b2a70
mov rdi, rax
xor edx, edx
mov r8d, 0x200
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov r9d, 2
lea r8, [rsp + 0x4c]
mov edx, dword [rsp + 0x48]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x44]
mov r8d, 0x200
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, dword [rdi]
mov rcx, rdi
call fcn.1402b2268
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1411dcce0], rbp
mov qword [0x1411dcce8], rbx
mov qword [0x1411dccf0], rbp
mov qword [0x1411dccf8], rbx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1402b25d0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140180c00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rbx, rdx
mov qword [rsp + 0x70], rdx
xor ebp, ebp
mov edi, ebp
mov dword [rsp + 0x40], ebp
mov rax, qword [rdx]
cmp dword [rax + 4], ebp
je 0x140180dd2
lea rcx, [rsp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_void____ptr64]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_void____ptr64]
nop
mov qword [rsp + 0x48], 0xfffffffffffffe00
lea rdx, [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_QString::toStdWString_void____ptr64]
cmp qword [rax + 0x18], 8
jb 0x140180c7e
mov rax, qword [rax]
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
mov rdx, qword [rsp + 0x90]
cmp rdx, 8
jb 0x140180cf3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140180cee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140180cee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402b2268
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x90], 7
mov word [rsp + 0x78], bp
cmp rsi, 0xffffffffffffffff
je 0x140180d41
mov r8d, 4
lea rdx, [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::right_int____ptr64]
nop
mov edi, 1
mov dword [rsp + 0x40], edi
lea rdx, [0x1402f2dd0]
mov rcx, rax
call qword [sym.imp.Qt5Core.dll_public:_bool___cdecl_QString::operator__char_const____ptr64_const___ptr64]
nop
test dil, 1
je 0x140180d52
lea rcx, [rsp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov ecx, 0x200
call fcn.1402b2a70
mov rdi, rax
xor edx, edx
mov r8d, 0x200
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov r9d, 2
lea r8, [rsp + 0x4c]
mov edx, dword [rsp + 0x48]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x50]
mov r8d, 0x200
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test rsi, rsi
je 0x140180db1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.1402b2268
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov al, 1
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1402b25d0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140187d10
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor ebp, ebp
mov ebx, ebp
mov dword [rsp + 0x40], ebx
cmp byte [0x1411dd024], bl
je 0x140187ed4
mov qword [rsp + 0x48], 0xfffffffffffffe00
mov dword [rsp + 0x44], ebp
lea rdi, [rcx + 0x2f0]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_QString::toStdWString_void____ptr64]
cmp qword [rax + 0x18], 8
jb 0x140187d76
mov rax, qword [rax]
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x140187de8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140187de3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140187de3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402b2268
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], bp
cmp rsi, 0xffffffffffffffff
je 0x140187e38
mov r8d, 4
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::right_int____ptr64]
nop
mov ebx, 1
mov dword [rsp + 0x40], ebx
lea rdx, [0x1402f2dd0]
mov rcx, rax
call qword [sym.imp.Qt5Core.dll_public:_bool___cdecl_QString::operator__char_const____ptr64_const___ptr64]
test al, al
jne 0x140187e38
xor dil, dil
jmp 0x140187e3b
mov dil, 1
test bl, 1
je 0x140187e4b
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
test dil, dil
jne 0x140187ed4
mov ecx, 0x200
call fcn.1402b2a70
mov rdi, rax
xor edx, edx
mov r8d, 0x200
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov r9d, 2
lea r8, [rsp + 0x4c]
mov edx, dword [rsp + 0x48]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x44]
mov r8d, 0x200
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, dword [rdi]
mov rcx, rdi
call fcn.1402b2268
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1411dcce0], rbp
mov qword [0x1411dcce8], rbx
mov qword [0x1411dccf0], rbp
mov qword [0x1411dccf8], rbx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1402b25d0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14018b050
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x298]
call qword [sym.imp.Qt5Widgets.dll_public:_void___cdecl_QTreeWidget::clear_void____ptr64]
lea rcx, [rbx + 0x2e0]
call fcn.1400befd0
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140186ec0
Function at 0x1401be6d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rdi, qword [rsp + 0x80]
mov esi, r9d
mov r14, r8
movzx r15d, dl
mov rbp, rcx
test rdi, rdi
jne 0x1401be709
mov rdi, qword [0x1411e9d7c]
jmp 0x1401be70d
mov rdi, qword [rdi + 0x20]
xor r12d, r12d
mov ebx, r12d
test rdi, rdi
jle 0x1401be81e
mov qword [rsp + 0x60], r13
lea r13, [0x140000000]
nop dword [rax + rax]
movzx eax, byte [rbx + r14]
test al, al
je 0x1401be7ea
cmp rbx, 0xe76e
jne 0x1401be756
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx eax, byte [rbx + r14]
mov dword [rsp + 0x80], r12d
mov byte [rsp + 0x80], al
movsxd rax, dword [rsp + 0x80]
mov dword [rsp + 0x20], r12d
mov byte [rsp + 0x20], r15b
mov dword [rsp + 0x80], r12d
movzx edx, byte [rax + r13 + 0x11edfb0]
movsxd rax, dword [rsp + 0x20]
mov dword [rsp + 0x20], r12d
mov byte [rsp + 0x80], dl
movzx ecx, byte [rax + r13 + 0x11edfb0]
mov byte [rsp + 0x20], cl
mov ecx, dword [rsp + 0x80]
sub ecx, dword [rsp + 0x20]
lea eax, [rcx + 0xff]
cmovns eax, ecx
cdqe
movzx edx, byte [rax + r13 + 0x11ee0b0]
test esi, esi
je 0x1401be7e5
mov rax, qword [0x1411eeb30]
cmp byte [rax + rbx], 1
jne 0x1401be7e5
mov rax, qword [0x1411eeb38]
movzx ecx, byte [rax + rbx]
xor cl, dl
jmp 0x1401be80a
movzx ecx, dl
jmp 0x1401be80a
test esi, esi
je 0x1401be808
mov rax, qword [0x1411eeb30]
cmp byte [rax + rbx], 1
jne 0x1401be808
mov rax, qword [0x1411eeb38]
movzx ecx, byte [rax + rbx]
jmp 0x1401be80a
xor cl, cl
mov byte [rbx + rbp], cl
inc rbx
cmp rbx, rdi
jl 0x1401be730
mov r13, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1401bed80
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rsp + 0x70], rax
cmp byte [0x1411ec733], 0
mov r14, rdx
mov rbx, rcx
mov ebp, r8d
lea rdx, [rsp + 0x50]
lea rcx, [0x1411e9a80]
je 0x1401beea4
call qword [sym.imp.Qt5Core.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_QString::toStdWString_void____ptr64]
cmp qword [rax + 0x18], 8
jb 0x1401bedcf
mov rax, qword [rax]
xor edi, edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov rcx, rax
mov dword [rsp + 0x20], 3
lea r8d, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdx, qword [rsp + 0x68]
mov rsi, rax
cmp rdx, 8
jb 0x1401bee43
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401bee3e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401bee3e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402b2268
mov rcx, rbp
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], di
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, rbp
xor edx, edx
mov rcx, rax
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
cmp rsi, 0xffffffffffffffff
je 0x1401bee87
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1402b25d0
add rsp, 0x80
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.Qt5Core.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_QString::toStdWString_void____ptr64]
cmp qword [rax + 0x18], 8
jb 0x1401beeb4
mov rax, qword [rax]
xor edi, edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov rcx, rax
mov dword [rsp + 0x20], 3
lea r8d, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdx, qword [rsp + 0x68]
mov rsi, rax
cmp rdx, 8
jb 0x1401bef28
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401bef23
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401bef23
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402b2268
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], di
cmp rsi, 0xffffffffffffffff
je 0x1401bee87
shl rbx, 9
lea r8, [rsp + 0x4c]
mov edx, ebx
mov qword [rsp + 0x48], rbx
xor r9d, r9d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rdi
mov r8d, ebp
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1401bee89
Function at 0x1401c1200
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14d, r9d
mov rbp, r8
mov edi, edx
mov rbx, rcx
cmp edx, 1
jle 0x1401c12e1
mov qword [rsp + 0x30], rsi
test r9d, r9d
je 0x1401c125c
xor r10d, r10d
mov r9d, r14d
nop dword [rax]
mov rax, qword [rbx + 8]
lea r10, [r10 + 1]
mov rdx, qword [rbx]
movzx ecx, byte [rax + r10 - 1]
xor byte [rdx + r10 - 1], cl
sub r9, 1
jne 0x1401c1240
mov rdx, qword [rbx]
mov r8, r14
mov rcx, rbp
call sub.VCRUNTIME140.dll_memcpy
cmp edi, 2
jle 0x1401c12c1
jbe 0x1401c12c1
add rbx, 0x10
add edi, 0xfffffffe
test r14d, r14d
je 0x1401c12a9
mov rdx, rbp
xor r8d, r8d
mov r9, r14
nop word [rax + rax]
movzx eax, byte [rdx]
lea r8, [r8 + 1]
mov rcx, qword [rbx]
lea rdx, [rdx + 1]
xor byte [rcx + r8 - 1], al
sub r9, 1
jne 0x1401c1290
mov rdx, qword [rbx]
mov r8, r14
mov rcx, rbp
call sub.VCRUNTIME140.dll_memcpy
add rbx, 8
sub rdi, 1
jne 0x1401c1278
mov rsi, qword [rsp + 0x30]
mov eax, 1
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jne 0x1401c12f1
mov rdx, qword [rcx]
mov r8, r14
mov rcx, rbp
call sub.VCRUNTIME140.dll_memcpy
mov eax, 1
jmp 0x1401c12cb
Function at 0x1401c1bc0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rsp + 0x70], rax
cmp byte [0x1411ec733], 0
mov r14, rdx
mov esi, ecx
mov ebp, r9d
lea rdx, [rsp + 0x50]
mov r15, r8
lea rcx, [0x1411e9a80]
je 0x1401c1cea
call qword [sym.imp.Qt5Core.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_QString::toStdWString_void____ptr64]
cmp qword [rax + 0x18], 8
jb 0x1401c1c13
mov rax, qword [rax]
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov rcx, rax
mov dword [rsp + 0x20], 3
lea r8d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdx, qword [rsp + 0x68]
mov rsi, rax
cmp rdx, 8
jb 0x1401c1c87
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401c1c82
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401c1c82
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402b2268
mov rcx, rbp
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], bx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, rbp
xor edx, edx
mov rcx, rax
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
cmp rsi, 0xffffffffffffffff
je 0x1401c1ccb
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1402b25d0
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.Qt5Core.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_QString::toStdWString_void____ptr64]
cmp qword [rax + 0x18], 8
jb 0x1401c1cfa
mov rax, qword [rax]
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov rcx, rax
mov dword [rsp + 0x20], 3
lea r8d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdx, qword [rsp + 0x68]
mov rdi, rax
cmp rdx, 8
jb 0x1401c1d6e
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401c1d69
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401c1d69
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402b2268
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], bx
cmp rdi, 0xffffffffffffffff
je 0x1401c1ccb
shl esi, 9
lea r8, [rsp + 0x4c]
mov eax, esi
xor r9d, r9d
imul rax, r14
mov rcx, rdi
mov edx, eax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbx
mov r8d, ebp
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1401c1ccd