joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003c64
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [0x140012030]
call fcn.1400064dc
xor ebx, ebx
or esi, 0xffffffff
mov rbp, rax
call qword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dl, byte [rax]
test dl, dl
je 0x140003d2a
mov rcx, qword [rsp + 0x30]
mov r10b, 0x20
lea r9d, [rbx + 1]
cmp dl, r10b
jne 0x140003cb8
add rax, r9
cmp byte [rax], r10b
je 0x140003cb0
mov dl, byte [rax]
mov r8d, r9d
cmp dl, 0x22
jne 0x140003cee
add rax, r9
mov rbx, rax
mov cl, byte [rax]
test cl, cl
je 0x140003ce9
cmp cl, 0x22
je 0x140003cdc
add rax, r9
mov cl, byte [rax]
test cl, cl
jne 0x140003cce
cmp byte [rax], 0
je 0x140003ce9
mov rcx, rax
add rax, r9
jmp 0x140003d10
mov rcx, rax
jmp 0x140003d10
test dl, dl
je 0x140003d0d
mov rbx, rax
cmp dl, r10b
je 0x140003d03
add rax, r9
mov dl, byte [rax]
test dl, dl
jne 0x140003cf5
cmp byte [rax], 0
mov rcx, rax
je 0x140003d10
jmp 0x140003ce4
xor r8d, r8d
cmp dword [rbp], esi
jne 0x140003d1a
test rdi, rdi
jne 0x140003d34
test r8d, r8d
je 0x140003d22
add esi, r9d
mov dl, byte [rax]
xor ebx, ebx
test dl, dl
jne 0x140003cab
test rdi, rdi
jne 0x140003d46
movsxd rax, esi
jmp 0x140003d49
test rbx, rbx
je 0x140003d46
sub ecx, ebx
mov rax, rbx
mov dword [rdi], ecx
add dword [rbp], r9d
jmp 0x140003d49
and dword [rdi], 0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140003e24
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x140012030]
call fcn.1400064dc
xor ecx, ecx
add rsp, 0x28
jmp fcn.140003c64

Function at 0x140003f84
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edx, ecx
mov esi, 0x104
mov ecx, esi
call fcn.140006c60
mov ecx, esi
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
movsxd rbx, eax
test eax, eax
je 0x140003fc3
cmp byte [rbx + rdi - 1], 0x5c
je 0x140003fc3
mov byte [rbx + rdi], 0x5c
inc ebx
sub esi, ebx
mov ecx, esi
call fcn.140006d10
mov rsi, qword [rsp + 0x38]
movsxd r11, ebx
mov rbx, qword [rsp + 0x30]
mov byte [r11 + rdi], 0
add rsp, 0x20
pop rdi
ret

Function at 0x140003fe4
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x140003ff7
call qword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
cdqe
jmp 0x140003ff9
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400040a4
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400040cf
test dl, 2
je 0x1400040c2
mov edx, pe_nt_image_headers64
call qword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_DeleteFileA]
cdqe
jmp 0x1400040d1
xor eax, eax
add rsp, 0x20
pop rbx
ret
xor edx, edx
jmp 0x1400040a4
Function at 0x1400040d8
Capabilities:
Delete file
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400040cf
test dl, 2
je 0x1400040c2
mov edx, pe_nt_image_headers64
call qword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_DeleteFileA]
cdqe
jmp 0x1400040d1
xor eax, eax
add rsp, 0x20
pop rbx
ret
xor edx, edx
jmp 0x1400040a4

Function at 0x1400040fc
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edx, ecx
mov ebx, 0x104
mov ecx, ebx
call fcn.140006c60
mov ecx, ebx
mov rdx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.DLL_GetTempPathA]
lea rcx, str.Kernel32.DLL
mov edi, eax
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov rbp, rax
test rax, rax
je 0x14000416e
lea rdx, str.GetLongPathNameA
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
test rax, rax
je 0x140004165
mov r8d, ebx
mov rdx, rsi
mov rcx, rsi
call rax
mov edi, eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_FreeLibrary]
sub ebx, edi
mov ecx, ebx
call fcn.140006d10
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
movsxd r11, edi
mov byte [r11 + rsi], 0
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400042d4
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor ebx, ebx
mov rsi, r8
mov rbp, rdx
cmp qword [0x140011fa0], rbx
mov r13, rcx
jne 0x14000431b
lea r8, [fcn.140004290]
lea edx, [rbx + 0x10]
mov ecx, 0x150
call fcn.140006460
mov qword [0x140011fa0], rax
test rbp, rbp
lea rdi, [0x14000d999]
cmovne rdi, rbp
test rsi, rsi
je 0x140004332
cmp byte [rsi], bl
jne 0x140004339
lea rsi, [0x14000d9cc]
mov rcx, rdi
call sub.msvcrt.dll_strlen
mov rcx, rsi
mov r12, rax
call sub.msvcrt.dll_strlen
mov rcx, qword [0x140011e38]
lea eax, [rax + r12 + 2]
xor edx, edx
movsxd r8, eax
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x140004411
mov rdx, rdi
mov rcx, rax
call sub.msvcrt.dll_strcpy
test r12d, r12d
je 0x140004398
movsxd rax, r12d
cmp byte [rax + rdi - 1], 0x5c
je 0x140004398
lea rdx, [0x14000d9c8]
mov rcx, rbp
call sub.msvcrt.dll_strcat
mov rdx, rsi
mov rcx, rbp
call sub.msvcrt.dll_strcat
mov rcx, qword [0x140011fa0]
mov rdx, r13
call fcn.140006354
mov rcx, rbp
lea rdx, [rax + 0xc]
mov rdi, rax
call qword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov qword [rdi], rax
cmp rax, 0xffffffffffffffff
je 0x1400043d0
mov dword [rdi + 8], ebx
jmp 0x1400043e2
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
jne 0x1400043e7
mov dword [rdi + 8], 1
mov rbx, rdi
jmp 0x1400043ff
cmp r13, 0xffffffffffffffff
jne 0x1400043fc
mov rcx, qword [0x140011fa0]
mov rdx, rdi
call fcn.140006420
mov qword [rdi], rbx
mov rcx, qword [0x140011e38]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_HeapFree]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x14000448c
Capabilities:
Create directory

Disassembly:
sub rsp, 0x138
test rcx, rcx
je 0x1400044ff
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call sub.msvcrt.dll_strncpy
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x124], 0
call sub.msvcrt.dll_strlen
lea rcx, [rsp + rax + 0x20]
lea rax, [rsp + 0x20]
cmp rcx, rax
jbe 0x1400044eb
lea rdx, [rcx - 1]
mov al, byte [rdx]
cmp al, 0x20
je 0x1400044de
cmp al, 0x5c
je 0x1400044de
cmp al, 0x2f
jne 0x1400044eb
lea rax, [rsp + 0x20]
mov rcx, rdx
cmp rdx, rax
ja 0x1400044cc
mov byte [rcx], 0
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
cdqe
jmp 0x140004501
xor eax, eax
add rsp, 0x138
ret

Function at 0x140004510
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rcx
mov dword [rsp + 0x40], eax
cmp dword [rcx + 0x1c], eax
jne 0x140004556
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx + 8]
lea r9, [rsp + 0x40]
sub r8d, dword [rcx + 0x14]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov r11d, dword [rbx + 0x10]
movsxd rax, dword [rsp + 0x40]
mov dword [rbx + 0x14], r11d
add rsp, 0x30
pop rbx
ret
cdqe
add rsp, 0x30
pop rbx
ret

Function at 0x140004e50
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, rcx
mov rcx, qword [0x140012080]
call fcn.1400063f4
mov rbx, rax
test rax, rax
je 0x140004ea4
cmp qword [rax + 8], 0
je 0x140004e82
cmp dword [rax + 0x1c], 0
jne 0x140004e82
mov rcx, rax
call fcn.140004510
mov rcx, qword [rbx]
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.DLL_GetFileSize]
mov r11d, eax
mov eax, dword [rsp + 0x38]
shl rax, 0x20
or rax, r11
add rsp, 0x20
pop rbx
ret
or rax, 0xffffffffffffffff
add rsp, 0x20
pop rbx
ret

Function at 0x140004eb0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rdx, rcx
mov rcx, qword [0x140012080]
mov rbx, r8
mov dword [rsp + 0x58], 0
call fcn.1400063f4
test rax, rax
je 0x140004f18
cmp qword [rax + 8], 0
mov rdx, rdi
je 0x140004efe
mov r8, rbx
mov rcx, rax
call fcn.140005490
cdqe
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rax]
lea r9, [rsp + 0x58]
mov r8d, ebx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.DLL_ReadFile]
movsxd rax, dword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140004f30
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x30
mov rsi, rdx
mov rdx, rcx
mov rcx, qword [0x140012080]
xor ebp, ebp
mov dword [rsp + 0x60], ebp
mov dword [rsp + 0x68], ebp
call fcn.1400063f4
mov rbx, rax
test rax, rax
je 0x140005010
test rsi, rsi
je 0x140004fbb
cmp byte [rsi], bpl
je 0x140004fbb
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x50], rdi
mov rdx, rsi
mov rdi, rsi
cmp qword [rax + 8], rbp
je 0x140004f98
xor eax, eax
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.1400055c0
mov dword [rsp + 0x60], eax
jmp 0x140004fb6
xor eax, eax
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rbp
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rdi, qword [rsp + 0x50]
mov r8d, 2
lea rdx, [0x14000d9d0]
cmp qword [rbx + 8], rbp
je 0x140004fe9
mov rcx, rbx
call fcn.1400055c0
mov rdx, rax
mov eax, dword [rsp + 0x60]
add eax, edx
cdqe
add rsp, 0x30
pop rsi
pop rbp
pop rbx
ret
mov rcx, qword [rbx]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [rsp + 0x60]
mov edx, dword [rsp + 0x68]
add eax, edx
cdqe
add rsp, 0x30
pop rsi
pop rbp
pop rbx
ret
movsxd rax, dword [rsp + 0x60]
add rsp, 0x30
pop rsi
pop rbp
pop rbx
ret

Function at 0x140005020
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov edi, r8d
mov rsi, rdx
mov dword [rsp + 0x48], ebx
test rdx, rdx
je 0x140005098
test r8d, r8d
je 0x140005098
mov rdx, rcx
mov rcx, qword [0x140012080]
call fcn.1400063f4
test rax, rax
je 0x140005094
mov r8d, edi
mov rdx, rsi
cmp qword [rax + 8], rbx
je 0x140005081
mov rcx, rax
call fcn.1400055c0
mov ebx, eax
cdqe
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rax]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov ebx, dword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
movsxd rax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400050b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, rcx
mov rcx, qword [0x140011e38]
mov rbp, r8
mov r13d, edx
mov r8d, 0x1000
xor edx, edx
mov r15, r9
xor edi, edi
mov r14d, 0x800
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov r12, rax
test rax, rax
je 0x140005283
movzx edx, word [rsp + 0x30]
mov qword [rsp + 0x70], rbx
mov rbx, rax
nop dword [rax]
cmp rbp, 0xffffffffffffffff
je 0x140005122
test rbp, rbp
je 0x1400051e4
dec rbp
cmp qword [rsi + 8], 0
lea rdx, [rsp + 0x30]
je 0x140005142
mov r8d, 2
mov rcx, rsi
call fcn.140005490
mov dword [rsp + 0x34], eax
jmp 0x14000515f
mov rcx, qword [rsi]
lea r9, [rsp + 0x34]
mov r8d, 2
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [rsp + 0x34]
movzx edx, word [rsp + 0x30]
cmp eax, 2
jne 0x1400051e4
test dx, dx
je 0x14000517a
mov word [rbx], dx
movzx edx, word [rsp + 0x30]
add rbx, 2
mov rdi, rbx
lea eax, [r14 - 1]
sub rdi, r12
movsxd rcx, eax
sar rdi, 1
cmp rdi, rcx
jle 0x1400051c0
mov rcx, qword [0x140011e38]
add r14d, 0x800
mov r8, r12
movsxd r9, r14d
mov edx, 8
add r9, r9
call qword [sym.imp.KERNEL32.DLL_HeapReAlloc]
movzx edx, word [rsp + 0x30]
mov r12, rax
movsxd rax, edi
lea rbx, [r12 + rax*2]
test dx, dx
je 0x1400051e4
mov edi, 0
test r13d, r13d
jne 0x140005110
cmp dx, 0xd
je 0x1400051e9
cmp dx, 0xa
je 0x1400051ef
jmp 0x140005110
test r13d, r13d
jne 0x1400051f3
cmp dx, 0xa
jne 0x14000520e
sub rbx, 2
xor edi, edi
mov rax, rbx
sub rax, r12
sar rax, 1
mov qword [r15], rax
mov word [rbx], di
mov rbx, qword [rsp + 0x70]
mov rax, r12
jmp 0x140005286
cmp dx, 0xd
jne 0x1400051f3
sub rbx, 2
cmp qword [rsi + 8], 0
lea rdx, [rsp + 0x30]
je 0x14000523a
mov r8d, 2
mov rcx, rsi
call fcn.140005490
xor edi, edi
mov dword [rsp + 0x34], eax
jmp 0x140005253
mov rcx, qword [rsi]
xor edi, edi
lea r9, [rsp + 0x34]
lea r8d, [rdi + 2]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.DLL_ReadFile]
cmp word [rsp + 0x30], 0xa
je 0x1400051f5
cmp qword [rsi + 8], 0
je 0x140005268
add dword [rsi + 0x14], 2
jmp 0x1400051f5
mov rcx, qword [rsi]
mov r9d, 1
xor r8d, r8d
lea edx, [r9 - 3]
call qword [sym.imp.KERNEL32.DLL_SetFilePointer]
jmp 0x1400051f5
mov rax, rdi
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400052b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rdi, rcx
mov rcx, qword [0x140011e38]
mov rsi, r8
mov r12d, edx
mov r13d, 0x1000
xor edx, edx
mov r8d, r13d
mov r14, r9
xor r15d, r15d
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x140005465
movzx r8d, byte [rsp + 0x30]
mov qword [rsp + 0x70], rbx
mov rbx, rax
cmp rsi, 0xffffffffffffffff
je 0x14000531a
test rsi, rsi
je 0x1400053d7
dec rsi
lea rdx, [rsp + 0x30]
cmp qword [rdi + 8], r15
je 0x140005339
mov r8d, 1
mov rcx, rdi
call fcn.140005490
mov dword [rsp + 0x34], eax
jmp 0x140005356
mov rcx, qword [rdi]
lea r9, [rsp + 0x34]
mov r8d, 1
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [rsp + 0x34]
movzx r8d, byte [rsp + 0x30]
cmp eax, 1
jne 0x1400053d7
test r8b, r8b
je 0x140005372
mov byte [rbx], r8b
movzx r8d, byte [rsp + 0x30]
inc rbx
lea eax, [r13 - 1]
mov rdx, rbx
movsxd rcx, eax
sub rdx, rbp
cmp rdx, rcx
jle 0x1400053b4
mov rcx, qword [0x140011e38]
add r13d, 0x1000
mov r8, rbp
mov edx, 8
movsxd r9, r13d
sub ebx, ebp
call qword [sym.imp.KERNEL32.DLL_HeapReAlloc]
movzx r8d, byte [rsp + 0x30]
movsxd rbx, ebx
mov rbp, rax
add rbx, rax
test r8b, r8b
je 0x1400053d7
test r12d, r12d
jne 0x140005308
cmp r8b, 0xd
je 0x1400053dc
cmp r8b, 0xa
jne 0x140005308
dec rbx
jmp 0x14000544f
test r12d, r12d
jne 0x14000544f
cmp r8b, 0xa
jne 0x1400053e7
dec rbx
jmp 0x14000544f
cmp r8b, 0xd
jne 0x14000544f
dec rbx
lea rdx, [rsp + 0x30]
cmp qword [rdi + 8], r15
je 0x14000540f
mov r8d, 1
mov rcx, rdi
call fcn.140005490
mov dword [rsp + 0x34], eax
jmp 0x140005428
mov rcx, qword [rdi]
lea r9, [rsp + 0x34]
mov r8d, 1
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.DLL_ReadFile]
cmp byte [rsp + 0x30], 0xa
je 0x14000544f
cmp qword [rdi + 8], r15
je 0x14000543a
inc dword [rdi + 0x14]
jmp 0x14000544f
mov rcx, qword [rdi]
mov r9d, 1
xor r8d, r8d
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov rax, rbx
sub rax, rbp
mov qword [r14], rax
mov byte [rbx], r15b
mov rbx, qword [rsp + 0x70]
mov rax, rbp
jmp 0x140005468
mov rax, r15
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140005490
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
xor r12d, r12d
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
cmp dword [rcx + 0x1c], r12d
jne 0x1400054c4
call fcn.140004510
mov dword [rbx + 0x1c], 1
mov dword [rbx + 0x14], r12d
movsxd rcx, dword [rbx + 0x14]
mov eax, dword [rbx + 0x18]
sub eax, ecx
mov rbp, rcx
cmp rcx, rdi
jl 0x140005529
movsxd rcx, eax
mov rax, rdi
add rcx, qword [rbx + 8]
dec rax
je 0x14000551f
dec rax
je 0x140005511
cmp rax, 2
je 0x140005505
mov rdx, rcx
mov r8, rdi
mov rcx, rsi
call sub.msvcrt.dll_memcpy
movsxd rax, edi
jmp 0x1400055a4
mov eax, dword [rcx]
mov dword [rsi], eax
movsxd rax, edi
jmp 0x1400055a4
movzx eax, word [rcx]
mov word [rsi], ax
movsxd rax, edi
jmp 0x1400055a4
movzx eax, byte [rcx]
mov byte [rsi], al
movsxd rax, edi
jmp 0x1400055a4
movsxd rdx, eax
mov r8, rcx
mov rcx, rsi
add rdx, qword [rbx + 8]
call sub.msvcrt.dll_memcpy
movsxd r8, dword [rbx + 0x10]
mov rcx, qword [rbx]
sub rdi, rbp
add rsi, rbp
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
cmp rdi, r8
jl 0x140005571
mov r8d, edi
mov rdx, rsi
call qword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [rsp + 0x50]
mov dword [rbx + 0x14], r12d
add eax, ebp
cdqe
jmp 0x1400055a7
mov rdx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.DLL_ReadFile]
movsxd r11, dword [rsp + 0x50]
mov rdx, qword [rbx + 8]
cmp rdi, r11
mov rcx, rsi
mov dword [rbx + 0x14], r11d
cmovg rdi, r11
mov dword [rbx + 0x18], r11d
mov r8, rdi
call sub.msvcrt.dll_memcpy
lea eax, [rbp + rdi]
cdqe
sub dword [rbx + 0x14], edi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret

Function at 0x1400055c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x1c], 1
movsxd rdi, r8d
mov rsi, rdx
mov rbx, rcx
mov dword [rsp + 0x50], 0
jne 0x14000560a
mov edx, dword [rcx + 0x14]
mov rcx, qword [rcx]
mov r9d, 1
neg edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0x1c], 0
mov dword [rbx + 0x14], eax
mov ecx, dword [rbx + 0x14]
cmp ecx, edi
jle 0x140005646
mov eax, dword [rbx + 0x10]
mov edx, edi
sub eax, ecx
movsxd rcx, eax
add rcx, qword [rbx + 8]
dec edx
je 0x14000563f
dec edx
je 0x140005637
cmp edx, 2
je 0x140005631
mov rdx, rsi
jmp 0x140005694
mov eax, dword [rsi]
mov dword [rcx], eax
jmp 0x14000569c
movzx eax, word [rsi]
mov word [rcx], ax
jmp 0x14000569c
movzx eax, byte [rsi]
mov byte [rcx], al
jmp 0x14000569c
mov rcx, rbx
call fcn.140004510
mov r11d, dword [rbx + 0x10]
mov rdx, rsi
cmp edi, r11d
jl 0x140005689
mov rcx, qword [rbx]
lea r9, [rsp + 0x50]
mov r8d, edi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.DLL_WriteFile]
movsxd rax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
sub r11d, dword [rbx + 0x14]
movsxd rcx, r11d
add rcx, qword [rbx + 8]
mov r8, rdi
call sub.msvcrt.dll_memcpy
sub dword [rbx + 0x14], edi
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rax, rdi
add rsp, 0x30
pop rdi
ret
Function at 0x14000da60
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x14017d340]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [0x1402397c8]
test eax, eax
jne 0x14000da9b
mov rcx, qword [rsp + 0xa0]
call fcn.14000dc90
jmp 0x14000dc74
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x140239b00], eax
jle 0x14000dae7
lea rcx, [0x140239b00]
call fcn.140130b68
cmp dword [0x140239b00], 0xffffffff
jne 0x14000dae7
lea rcx, [0x1402397e8]
call fcn.1400090b0
nop
lea rcx, [0x140239b00]
call fcn.140130afc
mov rax, qword [rsp + 0xa0]
mov ecx, dword [0x1401c3c64]
cmp dword [rax + 0xc0], ecx
jbe 0x14000dc4d
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax + 0x70]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xa0]
add rax, 0xc4
mov qword [rsp + 0x38], rax
movss xmm2, dword [0x14016af30]
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
call fcn.14000d2a0
mov r8, qword [rax]
lea rdx, [rsp + 0x50]
lea rcx, [0x1402397e8]
call fcn.14000d250
mov r8, qword [rax]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x70]
call fcn.14000d200
mov r8, qword [rax]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x70]
call fcn.14000d250
mov rax, qword [rsp + 0xa0]
movss xmm0, dword [rax + 0x110]
mulss xmm0, dword [0x14016ac3c]
movss xmm1, dword [rsp + 0x7c]
divss xmm1, xmm0
movaps xmm0, xmm1
mulss xmm0, dword [0x140239ef0]
cvttss2si eax, xmm0
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0xa0]
movss xmm0, dword [rax + 0x110]
mulss xmm0, dword [0x14016ac3c]
movss xmm1, dword [rsp + 0x78]
divss xmm1, xmm0
movaps xmm0, xmm1
mulss xmm0, dword [0x140239ef4]
cvttss2si eax, xmm0
mov dword [rsp + 0x30], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14000dc17
mov eax, dword [rsp + 0x30]
neg eax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, eax
mov edx, dword [rsp + 0x34]
mov ecx, 1
call qword [sym.imp.USER32.dll_mouse_event]
mov rax, qword [rsp + 0xa0]
add rax, 0xc4
mov qword [rsp + 0x40], rax
movss xmm2, dword [0x14016af30]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
call fcn.14000d2a0
mov rax, qword [rax]
mov qword [0x1402397e8], rax
jmp 0x14000dc67
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rsp + 0x68]
call fcn.14000cf20
mov rax, qword [rax]
mov qword [0x1402397e8], rax
mov rcx, qword [rsp + 0xa0]
call fcn.14000dc90
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140130aa0
add rsp, 0x98
ret
Function at 0x140013070
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
add rsp, 0x28
ret

Function at 0x14002e6a0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.14002f1c0
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x1400343e0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jne 0x140034402
mov rcx, qword [rsp + 0x40]
call fcn.1400344b0
jmp 0x140034419
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4e0
jb 0x140034419
mov rcx, qword [rsp + 0x40]
call fcn.140034560
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xb
mov rcx, qword [rsp + 0x40]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x1400344b0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp + 8], 0x270
jmp 0x1400344d1
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x4e0
jae 0x140034555
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 - 0x9bc]
and eax, 0x80000000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 - 0x9b8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x140034520
mov dword [rsp + 4], 0x9908b0df
jmp 0x140034528
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x1400344c4
add rsp, 0x18
ret