joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007c7c0
Capabilities:
Get socket status
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x260
mov rax, qword [0x14024a080]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor r12d, r12d
mov rsi, r9
mov edi, r8d
mov r15, rdx
mov r14, rcx
mov ebp, 0x10000
mov ebx, r12d
test r8d, r8d
jle 0x14007c826
mov r8d, edi
movsxd rdx, ebx
sub r8d, ebx
add rdx, r15
xor r9d, r9d
mov rcx, r14
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x14007c8dc
add ebx, eax
cmp ebx, edi
jl 0x14007c800
mov ebx, r12d
mov edi, r12d
nop dword [rax]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], 1
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x48], r14
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 1
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x14007c87e
cmp eax, 0xffffffff
je 0x14007c8cd
test eax, eax
jne 0x14007c877
inc edi
cmp edi, 0xa
jl 0x14007c830
mov eax, 0x5b4
jmp 0x14007c8e6
lea rdx, [rsp + 0x40]
mov rcx, r14
mov edi, r12d
call qword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x14007c830
mov r8d, ebp
movsxd rdx, ebx
sub r8d, ebx
add rdx, rsi
xor r9d, r9d
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x14007c8dc
add ebx, eax
cmp ebx, 4
jl 0x14007c8bf
mov eax, dword [rsi + 4]
cmp eax, ebp
jg 0x14007c8d5
mov ebp, eax
cmp ebx, dword [rsi + 4]
jl 0x14007c830
mov eax, r12d
jmp 0x14007c8e6
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x14007c8e6
mov eax, 8
jmp 0x14007c8e6
cmp eax, 0xffffffff
je 0x14007c8cd
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400c7300
add rsp, 0x260
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14007d760
Capabilities:
Get file size
Hash data with md5
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0xd0
mov rax, qword [0x14024a080]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor ebx, ebx
mov rsi, rdx
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [rbx + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x14007d8fb
mov qword [rsp + 0x100], rdi
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x108], r14
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov eax, 0xfffff000
lea ecx, [rdi + 0x1000]
and rcx, rax
call fcn.1400c7368
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], ebx
mov r8d, edi
mov qword [rsp + 0x20], rbx
mov rdx, rax
mov rcx, rbp
mov r14, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14007d8da
cmp dword [rsp + 0x40], edi
jne 0x14007d8da
xor eax, eax
mov byte [rdi + r14], bl
mov r8d, edi
mov qword [rsp + 0x68], rax
mov rdx, r14
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x50], 0x67452301
mov dword [rsp + 0x54], 0xefcdab89
mov dword [rsp + 0x58], 0x98badcfe
mov dword [rsp + 0x5c], 0x10325476
call fcn.14007d450
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xb0]
call fcn.14007d520
mov rdi, rsi
nop dword [rax + rax]
movzx r9d, byte [rsp + rbx + 0xb0]
lea r8, str._02x
mov edx, 3
mov rcx, rdi
call fcn.14007b720
inc rbx
add rdi, 4
cmp rbx, 0x10
jb 0x14007d8b0
mov rcx, r14
call fcn.1400c7360
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x108]
mov rdi, qword [rsp + 0x100]
mov rax, rsi
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400c7300
add rsp, 0xd0
pop rsi
pop rbp
pop rbx
ret

Function at 0x14007f030
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x14025a8e0]
xor edi, edi
test rbx, rbx
jne 0x14007f066
lea ecx, [rdi + 0x10]
call fcn.1400c7324
mov rbx, rax
mov qword [rsp + 0x48], rax
mov qword [0x14025a8e0], rax
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov rax, qword [rbx + 8]
test rax, rax
jne 0x14007f089
xor r9d, r9d
lea edx, [rax + 1]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 8], rax
test rax, rax
je 0x14007f0b1
cmp qword [rbx], rdi
jne 0x14007f0b4
mov qword [rsp + 0x28], rdi
lea r9, [0x14007e6d0]
lea r8, [0x14007e690]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call fcn.140169174
mov qword [rbx], rax
cmp qword [rbx], rdi
mov rbx, qword [rsp + 0x40]
setne dil
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x14007f1b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x14025a8e0]
xor edi, edi
test rax, rax
jne 0x14007f1e3
lea ecx, [rdi + 0x10]
call fcn.1400c7324
mov qword [rsp + 0x50], rax
mov qword [0x14025a8e0], rax
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov rcx, qword [rax + 8]
mov rbx, rax
test rcx, rcx
jne 0x14007f211
xor r9d, r9d
lea edx, [rcx + 1]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, rax
mov qword [rbx + 8], rax
mov rax, qword [0x14025a8e0]
test rcx, rcx
je 0x14007f240
cmp qword [rbx], rdi
jne 0x14007f240
mov qword [rsp + 0x28], rdi
lea r9, [0x14007e6d0]
lea r8, [0x14007e690]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call fcn.140169174
mov qword [rbx], rax
mov rax, qword [0x14025a8e0]
test rax, rax
je 0x14007f258
mov rcx, qword [rax]
test rcx, rcx
je 0x14007f258
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x1400853d0
Capabilities:
Get disk information

Disassembly:
push rbx
push rbp
push r15
sub rsp, 0x720
mov rax, qword [0x14024a080]
xor rax, rsp
mov qword [rsp + 0x700], rax
mov r15, rdx
mov qword [rsp + 0x20], rcx
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x100]
mov r8d, 0x208
call fcn.140159570
xor edx, edx
lea rcx, [rsp + 0x310]
mov r8d, 0x3e8
call fcn.140159570
test r15, r15
jne 0x140085450
xor ebp, ebp
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rbp
lea rdx, [0x1401f1958]
xor r8d, r8d
mov word [rbx], bp
mov rcx, rbx
call fcn.14007dc20
jmp 0x14008556d
mov qword [rsp + 0x750], rsi
lea rdx, [rsp + 0x310]
mov qword [rsp + 0x718], rdi
mov ecx, 0x3e8
mov qword [rsp + 0x710], r14
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor ebp, ebp
test eax, eax
je 0x140085534
mov esi, ebp
cmp word [rsp + 0x310], bp
je 0x140085534
lea rdi, [rsp + 0x310]
nop dword [rax]
movsxd rax, esi
lea rcx, [rsp + 0x310]
lea rdx, [0x1401f2a10]
lea rcx, [rcx + rax*2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140085524
xor edx, edx
mov word [rsp + 0x24], bp
mov r8d, 0xc8
lea rcx, [rsp + 0x30]
call fcn.140159570
movzx eax, word [rdi]
lea rdx, [rsp + 0x30]
mov word [rsp + 0x20], ax
lea rcx, [rsp + 0x20]
movzx eax, word [rdi + 2]
mov r8d, 0x64
mov word [rsp + 0x22], ax
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x140085534
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r14, eax
lea rdx, [rsp + 0x30]
mov r8, r14
mov rcx, r15
call fcn.14016b5a0
test eax, eax
je 0x14008558c
add rdi, 8
add esi, 4
cmp word [rdi], bp
jne 0x1400854a0
mov qword [rbx + 0x10], rbp
lea rdx, [0x1401f1958]
mov qword [rbx + 0x18], 7
xor r8d, r8d
mov word [rbx], bp
mov rcx, rbx
call fcn.14007dc20
mov rdi, qword [rsp + 0x718]
mov rsi, qword [rsp + 0x750]
mov r14, qword [rsp + 0x710]
mov rax, rbx
mov rcx, qword [rsp + 0x700]
xor rcx, rsp
call fcn.1400c7300
add rsp, 0x720
pop r15
pop rbp
pop rbx
ret
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [r15 + r14*2]
lea rcx, [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rbx + 0x10], rbp
lea rax, [rsp + 0x100]
mov qword [rbx + 0x18], 7
mov r8, 0xffffffffffffffff
mov word [rbx], bp
nop
inc r8
cmp word [rax + r8*2], bp
jne 0x1400855d0
lea rdx, [rsp + 0x100]
jmp 0x14008554d
Function at 0x140085a90
Capabilities:
Check if file exists

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xb0], rbx
mov rax, qword [0x14024a080]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rdx
mov r14, rcx
mov rcx, qword [0x14025a8e8]
test rcx, rcx
je 0x140085afe
mov rax, rdx
cmp qword [rdx + 0x18], 8
jb 0x140085adb
mov rax, qword [rdx]
mov r9, r14
cmp qword [r14 + 0x18], 8
jb 0x140085ae8
mov r9, qword [r14]
mov qword [rsp + 0x20], rax
lea r8, str.Check_sign_string__s__s_
mov edx, 2
call fcn.14009f570
mov rcx, r14
cmp qword [r14 + 0x18], 8
jb 0x140085b0b
mov rcx, qword [r14]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140085b1f
mov eax, 3
jmp 0x140085c77
xor r15d, r15d
mov qword [rsp + 0x58], r15
mov rdx, r14
lea rcx, [rsp + 0x38]
call fcn.1400855f0
cmp qword [rax + 0x18], 0x10
jb 0x140085b3e
mov rax, qword [rax]
lea r8, [0x1401f2a4c]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.14016b90c
lea rcx, [rsp + 0x38]
call fcn.1400779e0
mov rbp, r15
mov rcx, qword [rsp + 0x58]
call fcn.14016b964
test eax, eax
jne 0x140085bec
inc rbp
cmp qword [rbx + 0x10], r15
jbe 0x140085c98
mov rdi, rbx
cmp qword [rbx + 0x18], 8
jb 0x140085b87
mov rdi, qword [rbx]
mov rcx, qword [rsp + 0x58]
call fcn.1401693a8
movzx ecx, word [rdi]
cmp eax, ecx
jne 0x140085b5f
mov edi, 1
cmp qword [rbx + 0x10], rdi
jbe 0x140085be6
inc rbp
mov rcx, qword [rsp + 0x58]
call fcn.14016b964
test eax, eax
jne 0x140085bdd
cmp qword [rbx + 0x10], rdi
jbe 0x140085c9e
mov rsi, rbx
cmp qword [rbx + 0x18], 8
jb 0x140085bcb
mov rsi, qword [rbx]
mov rcx, qword [rsp + 0x58]
call fcn.1401693a8
movzx ecx, word [rsi + rdi*2]
cmp eax, ecx
jne 0x140085b5f
inc rdi
cmp rdi, qword [rbx + 0x10]
jb 0x140085ba3
mov r15d, 1
mov rcx, qword [rsp + 0x58]
call fcn.14016ba14
mov rcx, qword [0x14025a8e8]
test r15d, r15d
je 0x140085c40
test rcx, rcx
je 0x140085c39
cmp qword [rbx + 0x18], 8
jb 0x140085c11
mov rbx, qword [rbx]
cmp qword [r14 + 0x18], 8
jb 0x140085c1b
mov r14, qword [r14]
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbx
mov r9, r14
lea r8, str.Check_sign_string__s__s_pos__u_
mov edx, 2
call fcn.14009f570
mov eax, 1
jmp 0x140085c77
test rcx, rcx
je 0x140085c72
cmp qword [rbx + 0x18], 8
jb 0x140085c4f
mov rbx, qword [rbx]
cmp qword [r14 + 0x18], 8
jb 0x140085c59
mov r14, qword [r14]
mov qword [rsp + 0x20], rbx
mov r9, r14
lea r8, str.Check_sign_string__s__s_not_match.
mov edx, 2
call fcn.14009f570
mov eax, 2
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400c7300
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.14007dd90
int3
call fcn.14007dd90
int3
Function at 0x140086b30
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push rdi
sub rsp, 0x270
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x290], rbx
mov rax, qword [0x14024a080]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov edi, edx
mov rbx, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x50]
call fcn.140159570
mov r8d, 0x104
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x140086ba0
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
movdqa xmm0, xmmword [0x140201ef0]
movdqu xmmword [rsp + 0x38], xmm0
xor eax, eax
mov word [rsp + 0x28], ax
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140086bc1
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.14007dc20
nop
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.gamepatchQconfig.ini
lea rcx, [rsp + 0x28]
call fcn.14007ddb0
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140086c3e
lea r9, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae r9, qword [rsp + 0x28]
cmp qword [rbx + 0x18], 8
jb 0x140086c29
mov rbx, qword [rbx]
mov r8d, edi
mov rdx, rbx
lea rcx, str.config
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
lea rcx, [rsp + 0x28]
call fcn.14007dbb0
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400c7300
mov rbx, qword [rsp + 0x290]
add rsp, 0x270
pop rdi
ret
Function at 0x140087460
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14024a080]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, 0xffff
movzx edi, dx
mov rbx, rcx
cmp si, dx
jne 0x14008749b
xor eax, eax
cmp dx, si
cmove di, ax
movzx eax, di
jmp 0x1400875e8
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x1400874d7
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x1400874d7
lea ecx, [r9 - 1]
mov dword [rax], ecx
movzx eax, di
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], di
jmp 0x1400875e8
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x1400875dd
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14008751e
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140087547
movzx ecx, di
mov rdx, qword [rbx + 0x80]
call fcn.140169864
cmp ax, si
je 0x1400875dd
movzx esi, di
jmp 0x1400875dd
lea r8, [rsp + 0x40]
mov word [rsp + 0x50], di
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x52]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
js 0x1400875dd
cmp eax, 1
jle 0x14008759d
cmp eax, 3
jne 0x1400875dd
movzx ecx, word [rsp + 0x50]
jmp 0x14008752a
mov rbp, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x1400875ca
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call fcn.14016c474
cmp rbp, rax
jne 0x1400875dd
lea rax, [rsp + 0x50]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x48], rax
movzx eax, di
jne 0x1400875e0
movzx eax, si
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400c7300
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x140088330
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14024a080]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14008835d
xor eax, eax
jmp 0x1400884a3
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140088397
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140088397
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400884a3
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140088496
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400883da
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400883e9
movsx ecx, dil
jmp 0x14008843d
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
js 0x140088496
cmp eax, 1
jle 0x140088457
cmp eax, 3
jne 0x140088496
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.1401695c4
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14008849b
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140088484
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.14016c474
cmp rsi, rax
jne 0x140088496
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x14008849b
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400c7300
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret

Function at 0x1400891c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14024a080]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140089271
cmp byte [rcx + 0x72], 0
je 0x140089271
mov rax, qword [rcx]
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x140089233
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x140089237
sub eax, 1
je 0x14008923b
sub eax, 2
je 0x140089271
xor al, al
jmp 0x140089273
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140089268
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.14016c474
cmp rdi, rax
jne 0x140089233
cmp byte [rbx + 0x72], 0
sete al
jmp 0x140089273
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400c7300
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x14008c170
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
movabs rax, 0xcbf29ce484222325
sar r8, 1
mov r9d, 0
add r8, r8
je 0x14008c1b4
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x14008c1a0
ret
Function at 0x14009ebe0
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x628]
sub rsp, 0x710
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14024a080]
xor rax, rsp
mov qword [rbp + 0x600], rax
mov r14, rcx
xor r15d, r15d
mov ebx, r15d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1e0]
call fcn.140159570
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x3f0]
call fcn.140159570
mov r8d, 0x104
lea rdx, [rbp + 0x1e0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x14009ec80
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rdx, str.log_
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rdi, [r14 + 0x80]
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x1e0]
lea r8, str._s_s.log
mov edx, 0x104
lea rcx, [rbp + 0x3f0]
call fcn.14007b720
xor edx, edx
mov r8d, 0x250
lea rcx, [rbp - 0x70]
call fcn.140159570
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x3f0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14009ed00
xor eax, eax
jmp 0x14009edf9
test byte [rbp - 0x70], 0x10
jne 0x14009edd9
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov dword [rbp - 0x80], eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r15w
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdi + r8*2], ax
jne 0x14009ed43
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.14007dc20
nop
mov rdx, qword [r14 + 0x10]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x14009ed70
lea rcx, [rsp + 0x40]
call fcn.14007ddb0
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x74]
lea rcx, [rbp - 0x44]
call fcn.14007b780
test eax, eax
je 0x14009edcf
cmp eax, 4
jne 0x14009edcf
cmp dword [rsp + 0x38], ebx
cmova ebx, dword [rsp + 0x38]
lea rcx, [rsp + 0x40]
call fcn.14007dbb0
lea rdx, [rbp - 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14009ed00
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebx
mov rcx, qword [rbp + 0x600]
xor rcx, rsp
call fcn.1400c7300
lea r11, [rsp + 0x710]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400cf5f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov ecx, 0x237eec81
cdq
out 0xfd, al
movabs byte [0xaf65e075581bac03], al
pop rsp
invalid
Function at 0x1401141ec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x148]
sub rsp, 0x208
movsxd r14, dword [rdx + 0x3c]
mov rbx, rdx
mov eax, dword [r14 + rdx + 0x88]
test eax, eax
je 0x1401142c3
lea rdi, [rdx + rax]
mov esi, dword [rdi + 0x18]
test esi, esi
je 0x1401142c3
mov r8d, dword [rdi + 0xc]
xor ecx, ecx
mov eax, dword [rdi + 0x20]
add r8, rdx
mov r12d, dword [rdi + 0x1c]
add rax, rdx
mov r13d, dword [rdi + 0x24]
add r12, rdx
mov qword [rbp + 0x158], rax
add r13, rdx
mov al, byte [r8]
test al, al
je 0x14011427a
xor edx, edx
inc ecx
or al, 0x20
mov byte [rbp + rdx - 0x10], al
mov edx, ecx
mov al, byte [rcx + r8]
test al, al
jne 0x140114268
mov byte [rbp + rcx - 0x10], 0
mov rdx, r9
lea rcx, [rbp - 0x10]
call fcn.140116754
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x158]
lea ecx, [rsi - 1]
mov rdx, qword [rbp + 0x168]
mov esi, ecx
mov r15d, ecx
mov ecx, dword [rax + rcx*4]
add rcx, rbx
call fcn.140116754
xor rax, qword [rsp + 0x20]
cmp rax, qword [rbp + 0x160]
je 0x1401142d9
test esi, esi
jne 0x140114290
xor eax, eax
add rsp, 0x208
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
movzx eax, word [r13 + r15*2]
mov r8d, dword [r12 + rax*4]
add r8, rbx
cmp r8, rdi
jb 0x140114399
mov eax, dword [r14 + rbx + 0x8c]
add rax, rdi
cmp r8, rax
jae 0x140114399
xor r10d, r10d
mov r9d, r10d
cmp byte [r8], r10b
je 0x14011432d
cmp r9d, 0x3c
jae 0x14011432d
mov eax, r9d
mov cl, byte [rax + r8]
mov byte [rsp + rax + 0x30], cl
cmp cl, 0x2e
je 0x14011432d
inc r9d
cmp byte [r9 + r8], r10b
jne 0x14011430e
lea eax, [r9 + 1]
mov edx, eax
mov byte [rsp + rax + 0x30], 0x64
lea eax, [r9 + 2]
mov byte [rsp + rax + 0x30], WSAGetLastError
lea eax, [r9 + 3]
mov byte [rsp + rax + 0x30], WSAGetLastError
lea eax, [r9 + 4]
lea r9, [rdx + r8]
mov byte [rsp + rax + 0x30], r10b
mov edx, r10d
cmp byte [r9], r10b
je 0x140114376
cmp edx, 0x7f
jae 0x140114376
mov ecx, edx
inc edx
mov al, byte [rcx + r9]
mov byte [rsp + rcx + 0x70], al
cmp byte [rdx + r9], r10b
jne 0x14011435f
mov rcx, qword [rbp + 0x150]
lea r9, [rsp + 0x70]
mov eax, edx
lea r8, [rsp + 0x30]
mov rdx, rbx
mov byte [rsp + rax + 0x70], r10b
call fcn.1401143a4
mov r8, rax
mov rax, r8
jmp 0x1401142c5
Function at 0x1401143a4
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rax, qword gs:[0x30]
xor r11d, r11d
mov rsi, r9
mov r14, r8
mov rbp, rdx
mov rdi, rcx
mov r10, qword [rax + 0x60]
mov rax, qword [r10 + 0x18]
mov rbx, qword [rax + 0x10]
cmp qword [rbx + 0x30], r11
je 0x140114415
test r11, r11
jne 0x140114436
mov rdx, qword [rbx + 0x30]
cmp rdx, rbp
je 0x140114406
xor r9d, r9d
mov r8, rsi
mov rcx, rdi
call fcn.140116538
mov r11, rax
mov rbx, qword [rbx]
cmp qword [rbx + 0x30], 0
jne 0x1401143e7
test r11, r11
jne 0x140114436
mov rdx, r14
mov rcx, rdi
call fcn.140116450
test rax, rax
je 0x140114433
mov rdx, rsi
mov rcx, rax
call qword [rdi + 0x38]
mov r11, rax
jmp 0x140114436
xor r11d, r11d
mov rbx, qword [rsp + 0x30]
mov rax, r11
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret