joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400aea40
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
mov byte [rcx + 0x28], 0
mov dword [rcx + 0x42], 1
mov word [rcx + 0x46], 0x100
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
mov dword [rbx], eax
mov dword [rbx + 0x4c], 5
mov byte [rbx + 0x48], 1
mov byte [rbx + 0x50], 0
mov dword [rbx + 4], 4
mov qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 0x38], 0xffffffffffffffff
mov word [rbx + 0x40], 0
add rsp, 0x50
pop rbx
ret

Function at 0x1400b41d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r11d, r11d
mov rbx, rcx
bts edx, 8
nop
mov ecx, edx
mov eax, edx
shr ecx, 7
add edx, edx
and ecx, 1
shr rax, 8
neg ecx
sar rcx, 4
and ecx, 0x7f
movzx r10d, word [rbx + rax*2]
shr r10, 4
xor r10, rcx
add r11d, dword [r8 + r10*4]
cmp edx, 0x10000
jb 0x1400b41e0
mov rbx, qword [rsp + 8]
mov eax, r11d
ret

Function at 0x1400b4220
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor ebx, ebx
mov r10d, 0x100
or edx, r10d
mov r11d, r8d
mov rdi, rcx
nop dword [rax + rax]
add r11d, r11d
mov r8d, edx
shr r8d, 8
mov ecx, edx
shr ecx, 7
mov eax, r10d
and ecx, 1
and eax, r11d
neg ecx
add eax, r10d
sar rcx, 4
add r8d, eax
and ecx, 0x7f
add edx, edx
movzx r8d, word [rdi + r8*2]
shr r8, 4
xor r8, rcx
mov ecx, edx
xor ecx, r11d
not ecx
and r10d, ecx
add ebx, dword [r9 + r8*4]
cmp edx, 0x10000
jb 0x1400b4240
mov rdi, qword [rsp + 0x10]
mov eax, ebx
mov rbx, qword [rsp + 8]
ret
Function at 0x1400b4a60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov r11, qword [rsp + 0x48]
mov ebp, r8d
movzx r10d, word [rcx]
mov r13, r9
movzx r8d, word [rcx + 2]
mov eax, r10d
shr rax, 4
xor r10, 0x7f0
shr r10, 4
mov r15d, edx
mov rbx, rcx
mov rsi, r13
mov r14d, dword [r11 + rax*4]
mov eax, r8d
shr rax, 4
xor r8, 0x7f0
shr r8, 4
mov r12d, dword [r11 + rax*4]
mov eax, dword [r11 + r8*4]
add eax, dword [r11 + r10*4]
add r12d, dword [r11 + r10*4]
mov dword [rsp + 0x48], eax
xor r9d, r9d
nop dword [rax + rax]
cmp r9d, ebp
jae 0x1400b4c20
xor r10d, r10d
lea edi, [r15*8]
mov r8d, r9d
or r8d, 8
nop dword [rax + rax]
mov ecx, r8d
mov eax, r8d
and ecx, 1
shr rax, 1
neg ecx
shr r8d, 1
sar rcx, 4
add rax, rdi
and ecx, 0x7f
movzx edx, word [rbx + rax*2 + 4]
shr rdx, 4
xor rdx, rcx
add r10d, dword [r11 + rdx*4]
cmp r8d, 1
jne 0x1400b4b00
lea eax, [r10 + r14]
inc r9d
mov dword [rsi], eax
add rsi, 4
cmp r9d, 8
jb 0x1400b4ae0
cmp r9d, 0x10
jae 0x1400b4bb7
lea rsi, [r9*4]
add rsi, r13
cmp r9d, ebp
jae 0x1400b4c20
xor r10d, r10d
lea r8d, [r9 - 8]
or r8d, 8
nop dword [rax]
mov ecx, r8d
mov eax, r8d
and ecx, 1
shr rax, 1
neg ecx
shr r8d, 1
sar rcx, 4
add rax, rdi
and ecx, 0x7f
movzx edx, word [rbx + rax*2 + 0x104]
shr rdx, 4
xor rdx, rcx
add r10d, dword [r11 + rdx*4]
cmp r8d, 1
jne 0x1400b4b70
lea eax, [r10 + r12]
inc r9d
mov dword [rsi], eax
add rsi, 4
cmp r9d, 0x10
jb 0x1400b4b55
cmp r9d, ebp
jae 0x1400b4c20
mov esi, dword [rsp + 0x48]
lea rdi, [r9*4]
add rdi, r13
nop dword [rax + rax]
xor r10d, r10d
lea eax, [r9 - 0x10]
bts eax, 8
nop dword [rax + rax]
mov edx, eax
mov ecx, eax
and edx, 1
shr rcx, 1
neg edx
shr eax, 1
sar rdx, 4
and edx, 0x7f
movzx r8d, word [rbx + rcx*2 + 0x204]
shr r8, 4
xor r8, rdx
add r10d, dword [r11 + r8*4]
cmp eax, 1
jne 0x1400b4be0
lea eax, [r10 + rsi]
inc r9d
mov dword [rdi], eax
add rdi, 4
cmp r9d, ebp
jb 0x1400b4bd0
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1400b6d60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor ebx, ebx
lea rdi, [rcx + 0x33e1c]
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx + 0x344c6]
lea rdi, [rdi + 4]
shr rax, 4
mov r9d, ebx
and r9d, 1
mov r11d, ebx
mov edx, r9d
shr r11d, 1
neg edx
or r9d, 2
sar rdx, 4
mov r8d, r11d
and edx, 0x7f
shr r11d, 1
xor rdx, rax
and r8d, 1
mov eax, r8d
inc ebx
neg eax
sar rax, 4
mov r10d, dword [rcx + rdx*4 + 0x3276c]
and eax, 0x7f
movzx edx, word [rcx + r9*2 + 0x344c4]
add r9d, r9d
shr rdx, 4
or r9d, r8d
xor rdx, rax
mov r8d, r11d
and r8d, 1
shr r11d, 1
mov eax, r8d
and r11d, 1
neg eax
add r10d, dword [rcx + rdx*4 + 0x3276c]
movzx edx, word [rcx + r9*2 + 0x344c4]
sar rax, 4
and eax, 0x7f
shr rdx, 4
xor rdx, rax
lea eax, [r9 + r9]
or eax, r8d
add r10d, dword [rcx + rdx*4 + 0x3276c]
movzx edx, word [rcx + rax*2 + 0x344c4]
mov eax, r11d
shr rdx, 4
neg eax
sar rax, 4
and eax, 0x7f
xor rdx, rax
mov edx, dword [rcx + rdx*4 + 0x3276c]
add edx, r10d
mov dword [rdi - 4], edx
cmp ebx, 0x10
jb 0x1400b6d80
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov dword [rcx + 0x33e5c], 0
ret
Function at 0x1400b7420
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x50
xor ebp, ebp
mov qword [rsp + 0x68], rsi
mov qword [rcx + 0x3d5b0], rbp
lea r9, [rcx + 0x248]
mov qword [rcx + 0x3d5a8], rbp
lea r8, [rcx + 0x2d4]
mov qword [rcx + 0x288], rbp
mov edx, ebp
mov qword [rcx + 0x270], rbp
mov rdi, rcx
mov qword [rsp + 0x70], r14
mov qword [rcx + 0x2a8], 4
mov dword [rcx + 0x284], 0x20
mov qword [rcx + 0x2b8], 1
nop word [rax + rax]
mov ecx, edx
lea r8, [r8 + 4]
and ecx, 1
mov eax, edx
shr eax, 1
neg ecx
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x1400b7490
lea rdx, [rsp + 0x20]
mov qword [rdi + 0x178], rbp
mov rcx, rdi
mov dword [rdi + 0x1c0], ebp
mov qword [rdi + 0x200], rbp
mov qword [rdi + 0x1d0], rbp
mov qword [rdi + 0x1d8], rbp
mov qword [rdi + 0x1e0], rbp
mov qword [rdi + 0x1e8], rbp
mov qword [rdi + 0x1f0], rbp
mov qword [rdi + 0x1f8], rbp
mov dword [rdi + 0x80], ebp
mov qword [rdi + 0xc0], rbp
mov qword [rdi + 0x90], rbp
mov qword [rdi + 0x98], rbp
mov qword [rdi + 0xa0], rbp
mov qword [rdi + 0xa8], rbp
mov qword [rdi + 0xb0], rbp
mov qword [rdi + 0xb8], rbp
mov qword [rdi + 0x240], r9
mov qword [rsp + 0x20], 5
mov qword [rsp + 0x44], rbp
mov dword [rsp + 0x4c], 0xffffffff
mov qword [rsp + 0x3c], 0xffffffffffffffff
mov qword [rsp + 0x34], 0xffffffffffffffff
mov qword [rsp + 0x2c], 0xffffffffffffffff
mov dword [rsp + 0x28], 0xffffffff
call fcn.1400b3e30
mov esi, 2
mov word [rdi + 0x3076c], 0x100
mov r14d, esi
mov qword [rsp + 0x60], rbx
nop dword [rax]
nop dword [rax + rax]
mov ecx, esi
mov edx, 1
sar ecx, 1
dec ecx
shl edx, cl
test edx, edx
je 0x1400b763c
mov ebx, edx
lea rcx, [rdi + 0x3076c]
mov r8d, edx
add rcx, r14
movzx edx, sil
call fcn.1400f8720
add r14, rbx
inc esi
cmp esi, 0x1a
jl 0x1400b7610
mov r14, qword [rsp + 0x70]
mov r8d, 8
mov rsi, qword [rsp + 0x68]
mov r9d, r8d
mov rbx, qword [rsp + 0x60]
nop dword [rax + rax]
mov eax, r8d
mov edx, ebp
mov ecx, 4
nop word [rax + rax]
imul eax, eax
add edx, edx
cmp eax, 0x10000
jb 0x1400b768b
nop dword [rax]
shr eax, 1
inc edx
cmp eax, 0x10000
jae 0x1400b7680
sub rcx, 1
jne 0x1400b7670
mov rax, r9
mov ecx, 0xa1
shr rax, 4
sub ecx, edx
add r8d, 0x10
add r9, 0x10
mov dword [rdi + rax*4 + 0x3276c], ecx
cmp r8d, 0x800
jb 0x1400b7660
mov qword [rdi + 0x33e78], rbp
mov qword [rdi + 0x3d5f8], rbp
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400c87e0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 8], 0
mov rbx, rcx
jne 0x1400c8825
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 8], rax
test rax, rax
jne 0x1400c8825
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 1
cmovne ecx, eax
test ecx, ecx
je 0x1400c8825
mov eax, ecx
add rsp, 0x30
pop rbx
ret
cmp qword [rbx + 0x10], 0
jne 0x1400c8859
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x1400c8859
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 1
cmovne ecx, eax
test ecx, ecx
jne 0x1400c881d
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
jne 0x1400c886d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
jne 0x1400c8881
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [rbx + 0x18], 0
mov byte [rbx + 0x20], 0
je 0x1400c8894
xor eax, eax
add rsp, 0x30
pop rbx
ret
lea rax, [rsp + 0x40]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x28], rax
lea r8, [0x1400c8780]
xor edi, edi
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call fcn.14010cd4c
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x1400c88d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov edi, 1
cmovne edi, eax
mov eax, edi
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret

Function at 0x1400c9e80
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x40]
mov r9, r8
mov r8, rdx
mov qword [rsp + 0x28], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call fcn.14010cd4c
mov qword [rbx], rax
test rax, rax
je 0x1400c9eba
xor eax, eax
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 1
cmovne ecx, eax
mov eax, ecx
add rsp, 0x30
pop rbx
ret
Function at 0x1400cdb20
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [r8 + 0xc], 0x105
mov rbx, r8
mov rdi, rcx
jg 0x1400cdb47
mov edx, 0x105
mov rcx, rbx
call fcn.140095bd0
mov r9, qword [rbx]
lea rdx, [0x14014eb68]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov r8, qword [rbx]
xor edx, edx
mov r9d, eax
cmp byte [r8], dl
je 0x1400cdb7b
mov rcx, r8
nop dword [rax]
inc edx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x1400cdb70
movsxd rax, edx
mov byte [rax + r8], 0
mov eax, r9d
mov dword [rbx + 8], edx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400cdba0
Capabilities:
Delete file
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp byte [rcx], 0
mov rsi, r9
mov rbp, rdx
mov rbx, rcx
je 0x1400cdbe9
mov rdi, qword [rcx + 8]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x1400cdbd9
mov al, 1
jmp 0x1400cdbe7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
sete al
mov byte [rbx], al
mov r8, rsi
mov rcx, rbp
call fcn.1400cdb20
mov edi, eax
test eax, eax
je 0x1400cdc0b
lea rcx, [rbx + 8]
mov rdx, rsi
call fcn.1400cdc20
mov eax, edi
mov byte [rbx], 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400ce110
Capabilities:
Delete file
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
call fcn.1400f5c2c
mov rcx, qword [rbx + 0x30]
call fcn.1400f5c2c
mov rcx, qword [rbx + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x1400ce147
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1400ce147
mov qword [rbx + 0x18], 0xffffffffffffffff
cmp byte [rbx], 0
je 0x1400ce17d
mov qword [rsp + 0x30], rdi
xor edx, edx
mov rdi, qword [rbx + 8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x1400ce168
mov al, 1
jmp 0x1400ce176
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
sete al
mov rdi, qword [rsp + 0x30]
mov byte [rbx], al
mov rcx, qword [rbx + 8]
add rsp, 0x20
pop rbx
jmp fcn.1400f5c2c
Function at 0x1400ce190
Capabilities:
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r14d, r8d
mov r15, rdx
mov rsi, rcx
test r8d, r8d
jne 0x1400ce1c1
mov al, 1
jmp 0x1400ce325
xor r12d, r12d
cmp byte [rcx + 0x40], r12b
jne 0x1400ce2a1
mov dword [rsp + 0x38], r12d
lea ecx, [r12 + 4]
call fcn.1400f6418
mov rbx, rax
mov qword [rsp + 0x30], rax
mov byte [rax], r12b
mov dword [rsp + 0x3c], 4
mov ecx, 0x106
call fcn.1400f6418
mov rdi, rax
mov rcx, rbx
call fcn.1400f5c2c
mov qword [rsp + 0x30], rdi
mov byte [rdi], r12b
mov dword [rsp + 0x3c], 0x106
mov rdx, rdi
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov r8d, eax
mov edx, r12d
cmp byte [rdi], dl
je 0x1400ce23b
mov rcx, rdi
inc edx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x1400ce230
movsxd rax, edx
mov byte [rax + rdi], 0
mov dword [rsp + 0x38], edx
lea eax, [r8 - 1]
cmp eax, 0x103
ja 0x1400ce31b
lea r9, [rsi + 0x30]
mov rdx, rdi
mov rcx, rsi
call fcn.1400cdba0
test eax, eax
je 0x1400ce31b
lea rcx, [rsi + 0x18]
mov dword [rsp + 0x20], 2
mov r9d, 1
mov r8d, 0x40000000
mov rdx, qword [rsi + 0x30]
call fcn.140095940
test al, al
je 0x1400ce31b
mov byte [rsi + 0x40], 1
mov rcx, rdi
call fcn.1400f5c2c
mov ebx, r14d
mov rdi, r15
mov ebp, r12d
mov r13d, 0x400000
mov r8d, ebx
cmp ebx, r13d
cmova r8d, r13d
mov dword [rsp + 0x80], r12d
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x80]
mov rdx, rdi
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x80]
add ebp, ecx
test eax, eax
je 0x1400ce323
test ecx, ecx
je 0x1400ce2f4
add rdi, rcx
sub ebx, ecx
jne 0x1400ce2b0
mov ebx, ebp
lea r9, [0x14017b1e0]
mov r8d, ebp
mov rdx, r15
mov ecx, dword [rsi + 0x50]
call qword [0x14017ae80]
mov dword [rsi + 0x50], eax
add qword [rsi + 0x48], rbx
cmp ebp, r14d
sete al
jmp 0x1400ce325
mov rcx, rdi
call fcn.1400f5c2c
xor al, al
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400ce350
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov rsi, rdx
mov rbp, rcx
mov rcx, qword [rcx + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x1400ce391
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400ce389
mov eax, 0x80004005
jmp 0x1400ce516
mov qword [rbp + 0x18], 0xffffffffffffffff
xor r13d, r13d
mov r12d, r13d
mov edi, 0xffffffff
mov dword [rsp + 0xa0], edi
mov eax, dword [rbp + 0x28]
test eax, eax
je 0x1400ce3e5
mov r8d, eax
mov rdx, qword [rbp + 0x20]
mov rcx, rsi
call fcn.1400b0680
test eax, eax
jne 0x1400ce516
mov r8d, dword [rbp + 0x28]
lea r9, [0x14017b1e0]
mov rdx, qword [rbp + 0x20]
mov ecx, edi
call qword [0x14017ae80]
mov edi, eax
mov dword [rsp + 0xa0], eax
mov r12d, dword [rbp + 0x28]
cmp byte [rbp + 0x40], r13b
je 0x1400ce502
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x40], rax
cmp rax, 0xffffffffffffffff
je 0x1400ce527
cmp r12, qword [rbp + 0x48]
jae 0x1400ce4f3
mov dword [rsp + 0xb0], r13d
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0xb0]
mov r8d, 0x100000
mov rdx, qword [rbp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400ce527
mov eax, dword [rsp + 0xb0]
test eax, eax
je 0x1400ce4f3
mov r15d, eax
mov edi, eax
mov r14, qword [rbp + 0x20]
nop
mov eax, 0x80000000
mov r8d, eax
cmp rdi, rax
cmovb r8d, edi
mov rax, qword [rsi]
lea r9, [rsp + 0xb8]
mov rdx, r14
mov rcx, rsi
call qword [rax + 0x18]
mov esi, eax
mov ecx, dword [rsp + 0xb8]
add r14, rcx
sub rdi, rcx
test eax, eax
jne 0x1400ce52c
test ecx, ecx
je 0x1400ce527
test rdi, rdi
mov rsi, qword [rsp + 0xa8]
jne 0x1400ce480
lea r9, [0x14017b1e0]
mov r8, r15
mov rdx, qword [rbp + 0x20]
mov ecx, dword [rsp + 0xa0]
call qword [0x14017ae80]
mov edi, eax
mov dword [rsp + 0xa0], eax
add r12, r15
jmp 0x1400ce42c
cmp rbx, 0xffffffffffffffff
je 0x1400ce502
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbp + 0x50], edi
jne 0x1400ce50d
cmp r12, qword [rbp + 0x48]
je 0x1400ce513
mov r13d, 0x80004005
mov eax, r13d
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov esi, 0x80004005
cmp rbx, 0xffffffffffffffff
je 0x1400ce53b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x1400ce516
Function at 0x140115f80
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x140115ca6
call fcn.140101bd8
mov dword [rax], 0x16
call fcn.1400fcb00
jmp 0x140115df1
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140115df1
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x140115df1
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x140115cd5
lock or dword [rcx + 0x14], 0x10
jmp 0x140115df1
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x140115ce9
call fcn.1401165bc
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x140115cf9
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x140115cfc
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.140108654
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.14011a898
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x140115ddf
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x140115d8d
mov rcx, rbx
call fcn.140108654
cmp eax, 0xffffffff
je 0x140115d78
mov rcx, rbx
call fcn.140108654
cmp eax, 0xfffffffe
je 0x140115d78
mov rcx, rbx
call fcn.140108654
movsxd rdi, eax
lea r14, [0x14017a0d0]
mov rcx, rbx
sar rdi, 6
call fcn.140108654
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x140115d7f
lea rdx, [0x1401742d0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140115d8d
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x140115db1
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x140115db1
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x140115db1
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x140115dcf
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x140115dda
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x140115df6
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x140115c70
Function at 0x1400111f4
Capabilities:
Terminate process

Disassembly:
jmp 0x140013650
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140012150
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, dword [0x14001e2d0]
call fcn.140011352
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400097a0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1400097b0]
mov dword [rax], 1
mov rax, qword [0x1400097c0]
mov dword [rax], 1
mov rax, qword [0x140009740]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140009790]
mov dword [0x14000d020], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x140009870]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x140009850]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x1400096f0]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x140001820
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]