joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011ff60
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x198
mov dword [rsp + 0x48], 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x80]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameA]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x14011ffe6
cmp qword [rsp + 0x40], 0xffffffffffffffff
jne 0x14012001c
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x1a8]
call fcn.1400025b8
mov rax, qword [rsp + 0x1a8]
jmp 0x1401200d1
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x14012008e
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x68], 0
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x1a8]
call fcn.1400025b8
mov rax, qword [rsp + 0x1a8]
jmp 0x1401200d1
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x78], rax
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x1a8]
call fcn.140005763
mov rax, qword [rsp + 0x1a8]
add rsp, 0x198
ret

Function at 0x1401228f0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x1401228f0
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jne 0x140122912
mov rcx, qword [rsp + 0x40]
call fcn.140002743
jmp 0x140122929
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4e0
jb 0x140122929
mov rcx, qword [rsp + 0x40]
call fcn.1400049a3
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xb
mov rcx, qword [rsp + 0x40]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x140127cf0
Capabilities:
Check processdebugflags

Disassembly:
jmp 0x140127cf0
sub rsp, 0x48
mov dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x30]
mov edx, Ordinal_33
mov rcx, rax
call sub.ntdll.dll_NtQueryInformationProcess
cmp dword [rsp + 0x30], 0
jne 0x140127d34
mov dword [rsp + 0x34], 1
jmp 0x140127d3c
mov dword [rsp + 0x34], 0
mov eax, dword [rsp + 0x34]
add rsp, 0x48
ret

Function at 0x140127d60
Capabilities:
Check for process debug object

Disassembly:
jmp 0x140127d60
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rsp + 0x38]
mov edx, reloc.WLDAP32.dll_Ordinal_30
mov rcx, rax
call sub.ntdll.dll_NtQueryInformationProcess
cmp qword [rsp + 0x38], 0
je 0x140127d9d
mov dword [rsp + 0x30], 1
jmp 0x140127da5
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x140127dd0
Capabilities:
Check processdebugport

Disassembly:
jmp 0x140127dd0
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rsp + 0x38]
mov edx, 7
mov rcx, rax
call sub.ntdll.dll_NtQueryInformationProcess
cmp qword [rsp + 0x38], 0
je 0x140127e0d
mov dword [rsp + 0x30], 1
jmp 0x140127e15
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x140127e60
Capabilities:
Enumerate gui resources

Disassembly:
jmp 0x140127e60
push rdi
sub rsp, 0x30
xor edx, edx
lea rcx, [0x14000120d]
call qword [sym.imp.USER32.dll_EnumWindows]
call fcn.140003544
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x21]
lea rcx, [rsp + 0x20]
call fcn.14011e4d0
mov rcx, rax
call fcn.1400089db
xor edx, edx
mov rcx, rax
call fcn.14000459d
movzx eax, al
test eax, eax
je 0x140127eb7
xor ecx, ecx
int 0x29
add rsp, 0x30
pop rdi
ret

Function at 0x140128010
Capabilities:
Check for debugger via api

Disassembly:
jmp 0x140128010
sub rsp, 0x38
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x140128560
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x140128560
push rdi
sub rsp, 0x60
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1401207b0
mov rcx, rax
call fcn.140008107
mov qword [rsp + 0x30], rax
call fcn.14000790f
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
call fcn.140004f16
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1401285f9
lea r9, [rsp + 0x24]
mov r8d, 0x40
mov edx, 4
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x28]
mov dword [rax], 0x1ee7c0de
lea r9, [rsp + 0x24]
mov r8d, dword [rsp + 0x24]
mov edx, 4
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x60
pop rdi
ret
Function at 0x140128630
Capabilities:
Hide thread from debugger

Disassembly:
jmp 0x140128630
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recvfrom
mov rcx, rax
call sub.ntdll.dll_NtSetInformationThread
add rsp, 0x28
ret

Function at 0x140129310
Capabilities:
Get session user name

Disassembly:
jmp 0x140129310
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x150
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x28], 0x101
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x140129368
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x160]
call fcn.14000457a
mov eax, dword [rsp + 0x24]
or eax, 1
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x160]
jmp 0x1401293b3
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x2c]
lea rcx, [rsp + 0x20]
call fcn.14011f170
mov rcx, rax
call fcn.14000736f
mov rdx, rax
mov rcx, qword [rsp + 0x160]
call fcn.14000457a
mov eax, dword [rsp + 0x24]
or eax, 1
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x160]
add rsp, 0x150
pop rdi
ret
Function at 0x14012a540
Capabilities:
Delete file

Disassembly:
jmp 0x14012a540
push rdi
sub rsp, 0x2c0
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x30]
call fcn.14011fea0
lea rax, [rsp + 0x31]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x31]
call fcn.140122230
lea rcx, [rsp + 0x38]
call fcn.140001e51
lea rcx, [rsp + 0x38]
call fcn.140001e51
lea rcx, [rsp + 0x68]
call fcn.1400016b3
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
mov rdx, rax
lea rcx, [rsp + 0x1b0]
call fcn.140003da0
nop
lea rcx, [rsp + 0x38]
call fcn.1400016b3
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.140003da0
nop
mov rax, qword [rsp + 0x1b0]
movsxd rax, dword [rax + 4]
lea rax, [rsp + rax + 0x1b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::good_void_const___ptr64]
movzx eax, al
test eax, eax
je 0x14012a669
mov rax, qword [rsp + 0xa0]
movsxd rax, dword [rax + 4]
lea rax, [rsp + rax + 0xa0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::good_void_const___ptr64]
movzx eax, al
test eax, eax
je 0x14012a669
lea rcx, [rsp + 0x68]
call fcn.1400016b3
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [rsp + 0x38]
call fcn.1400016b3
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rdx, [0x1403a2720]
lea rcx, [rsp + 0x1b0]
call fcn.140001ccb
lea rdx, [0x1403a2820]
lea rcx, [rsp + 0xa0]
call fcn.140001ccb
lea rcx, [rsp + 0x1b0]
call fcn.140004c78
lea rcx, [rsp + 0xa0]
call fcn.140004c78
nop
lea rcx, [rsp + 0xa0]
call fcn.140002cd9
nop
lea rcx, [rsp + 0x1b0]
call fcn.140002cd9
add rsp, 0x2c0
pop rdi
ret
Function at 0x14012bdb0
Capabilities:
Write file on windows

Disassembly:
jmp 0x14012bdb0
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x14012bddb
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14012bde2
mov al, 1
jmp 0x14012bf3a
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.140003030
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.140003030
mov dword [rsp + 0x40], eax
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x40]
call fcn.140006c4e
movzx eax, al
test eax, eax
je 0x14012be37
xor al, al
jmp 0x14012bf3a
mov qword [rsp + 0x68], reloc.WLDAP32.dll_Ordinal_32
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14012bea7
cmp dword [rsp + 0x30], 1
je 0x14012beb3
cmp dword [rsp + 0x30], 3
je 0x14012bf28
jmp 0x14012bf38
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x14012beff
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x14012beff
xor al, al
jmp 0x14012bf3a
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14012bf19
mov dword [rsp + 0x34], 1
jmp 0x14012bf21
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x14012bf3a
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14012bf3a
xor al, al
add rsp, 0xa8
ret
Function at 0x14012d2c0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x14012d2c0
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0x26f
mov qword [rsp + 0x30], 0xe3
mov qword [rsp], 0
jmp 0x14012d2f0
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xe3
jae 0x14012d372
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x14012d33e
mov dword [rsp + 0x14], 0x9908b0df
jmp 0x14012d346
mov dword [rsp + 0x14], 0
mov eax, dword [rsp + 0x10]
shr eax, 1
xor eax, dword [rsp + 0x14]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14012d2e5
mov qword [rsp + 8], 0xe3
jmp 0x14012d38a
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x26f
jae 0x14012d411
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x18], eax
mov eax, dword [rsp + 0x18]
and eax, 1
test eax, eax
je 0x14012d3db
mov dword [rsp + 0x1c], 0x9908b0df
jmp 0x14012d3e3
mov dword [rsp + 0x1c], 0
mov eax, dword [rsp + 0x18]
shr eax, 1
xor eax, dword [rsp + 0x1c]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14012d37d
mov qword [rsp + 0x38], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x14012d465
mov dword [rsp + 0x24], 0x9908b0df
jmp 0x14012d46d
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x20]
shr eax, 1
xor eax, dword [rsp + 0x24]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x50]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rsp + 0x50]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rsp + 0x50]
mov dword [rax], 0
add rsp, 0x48
ret
Function at 0x14012d530
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x14012d530
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp + 8], 0x270
jmp 0x14012d551
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x4e0
jae 0x14012d5d5
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 - 0x9bc]
and eax, 0x80000000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 - 0x9b8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x14012d5a0
mov dword [rsp + 4], 0x9908b0df
jmp 0x14012d5a8
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14012d544
add rsp, 0x18
ret
Function at 0x14012fdf0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
jmp 0x14012fdf0
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x160
xor edx, edx
mov ecx, reloc.WS2_32.dll_ntohs
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0x130
lea rax, [rsp + 0x34]
mov rdi, rax
xor eax, eax
mov ecx, Ordinal_301
rep stosb byte [rdi], al
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14012fe9d
mov rdx, qword [rsp + 0x170]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14012fe8a
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14012fe8a
xor edx, edx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14012fe9d
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14012fe3a
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x160
pop rdi
ret
Function at 0x1401395d0
Capabilities:
Read file on windows

Disassembly:
jmp 0x1401395d0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [rsp + 0x80], 0
jg 0x1401395f5
xor eax, eax
jmp 0x1401397bb
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x68], 0
je 0x14013961e
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x1401397bb
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jbe 0x1401396bd
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.1400015aa
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x28]
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.140007d6f
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x80], 0
je 0x1401397ab
mov rcx, qword [rsp + 0x70]
call fcn.14000865c
mov qword [rsp + 0x58], 0xfff
cmp qword [rsp + 0x20], 0xfff
jbe 0x14013975e
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x30], 0xfff
je 0x14013975c
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
jmp 0x1401397bb
jmp 0x1401396e3
cmp qword [rsp + 0x20], 0
jbe 0x1401397ab
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x20]
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
add rsp, 0x68
ret
Function at 0x140139840
Capabilities:
Write file on windows

Disassembly:
jmp 0x140139840
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x140139879
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140139967
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x14013990f
cmp qword [rsp + 0x20], 0
jle 0x14013990f
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x1401398b9
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.140007d6f
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rsp + 0x50], 0
jle 0x140139957
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x140139957
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
add rsp, 0x38
ret
Function at 0x140152b10
Capabilities:
Parse pe header

Disassembly:
jmp 0x140152b10
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
mov rax, qword [rsp]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140152b34
xor eax, eax
jmp 0x140152b62
mov rax, qword [rsp]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
cmp dword [rax], 0x4550
je 0x140152b5d
xor eax, eax
jmp 0x140152b62
mov rax, qword [rsp + 8]
add rsp, 0x18
ret
Function at 0x140155710
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
jmp 0x140155710
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], 0xffffffffffffffff
inc qword [rsp + 0x30]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
cmp byte [rax + rcx], 0
jne 0x140155739
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x88]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], 0
jmp 0x1401557a3
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x20], eax
jae 0x140155869
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x80]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140155864
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x38], 0xffffffffffffffff
inc qword [rsp + 0x38]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
cmp byte [rax + rcx], 0
jne 0x1401557ff
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x48], rax
jne 0x140155864
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0xc], 0
jne 0x14015582f
xor eax, eax
jmp 0x14015586b
cmp qword [rsp + 0x90], 0
je 0x14015584c
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 8]
mov dword [rax], ecx
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
jmp 0x14015586b
jmp 0x140155799
xor eax, eax
add rsp, 0x78
ret