joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140010764
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x220
mov r8, rcx
xor ecx, ecx
mov r9, rdx
cmp r8, rcx
je 0x140010923
cmp rdx, rcx
je 0x140010923
cmp dword [r8 + 0x3c], ecx
je 0x140010923
movsxd r11, dword [r8 + 0x3c]
add r11, r8
mov r10d, dword [r11 + 0x88]
cmp r10d, ecx
jne 0x1400107bc
mov ecx, 0x7f
jmp 0x140010928
movzx eax, r9w
lea rdx, [r8 + r10]
cmp r9, rax
jne 0x14001080a
cmp r9w, cx
je 0x140010923
mov ecx, dword [rdx + 0x1c]
movzx eax, r9w
add rcx, r8
cmp eax, dword [rdx + 0x10]
jb 0x1400107b2
sub eax, dword [rdx + 0x10]
cmp eax, dword [rdx + 0x14]
jae 0x1400107b2
mov edx, dword [rcx + rax*4]
cmp edx, r10d
jbe 0x140010801
mov eax, dword [r11 + 0x8c]
lea ecx, [r10 + rax]
cmp edx, ecx
jb 0x1400107b2
lea rax, [r8 + rdx]
jmp 0x140010930
mov ebx, ecx
cmp dword [rdx + 0x18], ecx
jbe 0x14001092e
mov ebp, dword [rdx + 0x20]
mov rdi, rcx
add rbp, r8
cmp dword [rdi + rbp], ecx
je 0x14001084a
mov ecx, dword [rdi + rbp]
mov rax, r9
add rcx, r8
jmp 0x140010839
cmp sil, byte [rax]
jne 0x140010848
inc rcx
inc rax
mov sil, byte [rcx]
test sil, sil
jne 0x14001082e
mov al, byte [rax]
cmp sil, al
je 0x14001085b
xor ecx, ecx
inc ebx
add rdi, 4
cmp ebx, dword [rdx + 0x18]
jae 0x14001092e
jmp 0x14001081e
mov ecx, dword [rdx + 0x24]
mov r9d, dword [rdx + 0x1c]
mov eax, ebx
add rcx, r8
add r9, r8
movzx edx, word [rcx + rax*2]
cmp dword [r9 + rdx*4], r10d
jbe 0x14001091a
mov eax, dword [r11 + 0x8c]
lea ecx, [r10 + rax]
cmp dword [r9 + rdx*4], ecx
jae 0x14001091a
mov ebx, dword [r9 + rdx*4]
mov edi, 0x100
lea rcx, [rsp + 0x20]
add rbx, r8
mov r8, rdi
xor edx, edx
call fcn.14000b45c
lea rcx, [rsp + 0x120]
mov r8, rdi
xor edx, edx
call fcn.14000b45c
xor edx, edx
xor eax, eax
mov r11b, 1
mov cl, byte [rdx + rbx]
test cl, cl
je 0x1400108fd
cmp rax, 0xff
jge 0x14001092e
test r11b, r11b
je 0x1400108e7
cmp cl, 0x2e
jne 0x1400108e1
xor r11b, r11b
xor eax, eax
jmp 0x1400108f1
mov byte [rsp + rax + 0x20], cl
jmp 0x1400108ee
mov byte [rsp + rax + 0x120], cl
inc rax
inc rdx
cmp rdx, 0x200
jl 0x1400108c1
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0x120]
mov rcx, rax
call fcn.140010764
jmp 0x140010930
mov eax, dword [r9 + rdx*4]
add rax, r8
jmp 0x140010930
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140010df0
Capabilities:
Hash data using sha1

Disassembly:
test rcx, rcx
jne 0x140010df8
xor al, al
ret
xor eax, eax
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 0x14], eax
mov dword [rcx + 0x18], eax
mov word [rcx + 0x1c], ax
mov byte [rcx + 0x5e], al
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov al, 1
mov dword [rcx + 0x10], 0xc3d2e1f0
ret
Function at 0x140011350
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
movzx eax, word [rcx + 0x1c]
mov rbx, rcx
cmp ax, 0x37
movzx eax, ax
mov byte [rax + rcx + 0x1e], 0x80
jbe 0x1400113b8
inc word [rcx + 0x1c]
movzx eax, word [rcx + 0x1c]
cmp ax, 0x40
jae 0x140011396
nop dword [rax]
movzx eax, ax
mov byte [rax + rcx + 0x1e], 0
inc word [rcx + 0x1c]
mov ax, word [rcx + 0x1c]
cmp ax, 0x40
jb 0x140011380
call fcn.140010e40
cmp word [rbx + 0x1c], 0x38
jae 0x1400113e6
movzx eax, word [rbx + 0x1c]
mov byte [rax + rbx + 0x1e], 0
inc word [rbx + 0x1c]
cmp word [rbx + 0x1c], 0x38
jb 0x1400113a2
jmp 0x1400113e6
inc word [rcx + 0x1c]
movzx eax, word [rcx + 0x1c]
cmp ax, 0x38
jae 0x1400113e6
nop word [rax + rax]
movzx eax, ax
mov byte [rax + rcx + 0x1e], 0
inc word [rcx + 0x1c]
mov ax, word [rcx + 0x1c]
cmp ax, 0x38
jb 0x1400113d0
mov ecx, dword [rbx + 0x18]
mov eax, ecx
shr eax, 0x18
mov byte [rbx + 0x56], al
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [rbx + 0x58], cl
mov ecx, dword [rbx + 0x14]
mov byte [rbx + 0x57], al
movzx eax, byte [rbx + 0x18]
mov byte [rbx + 0x59], al
mov eax, ecx
shr eax, 0x18
mov byte [rbx + 0x5a], al
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [rbx + 0x5c], cl
mov rcx, rbx
mov byte [rbx + 0x5b], al
movzx eax, byte [rbx + 0x14]
mov byte [rbx + 0x5d], al
add rsp, 0x20
pop rbx
jmp fcn.140010e40
Function at 0x1400039f0
Capabilities:
Resume thread
Suspend thread

Disassembly:
push rbx
mov eax, 0x30
call fcn.1400064a0
sub rsp, rax
mov ebx, ecx
call fcn.140004250
mov r9d, dword [0x14003280c]
lea rcx, str._s___Thc__d:___Pause:__d___Stop:__d___Status:__d_n
mov rdx, rax
mov r8d, ebx
mov eax, dword [0x140032810]
mov dword [rsp + 0x28], eax
mov eax, dword [0x140032808]
mov dword [rsp + 0x20], eax
call fcn.140003fd0
mov eax, dword [0x140032810]
test eax, eax
jle 0x140003c58
cmp ebx, 1
jne 0x140003aa2
cmp eax, ebx
jne 0x140003c41
mov dword [0x14003280c], ebx
call fcn.140004250
mov rdx, rax
lea rcx, str._s___Thc_1:_Pause_gesetzt:__d___warte_auf_Quittung_n
mov r8d, ebx
call fcn.140003fd0
mov rcx, qword [0x140032820]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.140004250
mov rdx, rax
lea rcx, str._s___Thc_1:_Pause_quittiert_n
call fcn.140003fd0
xor eax, eax
mov dword [0x140032810], 2
jmp 0x140003c3b
cmp ebx, 2
jne 0x140003b05
cmp eax, ebx
jne 0x140003c41
call fcn.140004250
mov rdx, rax
lea rcx, str._s___Thc_2:_Resume_thread___warte_auf_Quittung_n
call fcn.140003fd0
mov rcx, qword [0x140032838]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [0x140032828]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [0x140032810], 1
call fcn.140004250
mov rdx, rax
lea rcx, str._s___Thc_2:_Resume_quittiert_n
call fcn.140003fd0
jmp 0x140003c41
cmp ebx, 3
jne 0x140003b67
cmp eax, 1
jne 0x140003c41
call fcn.140004250
mov rdx, rax
lea rcx, str._s___Thc_3:_Mache_Pause_und_quittiere_n
call fcn.140003fd0
mov rcx, qword [0x140032820]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [0x140032838]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
call fcn.140004250
mov rdx, rax
lea rcx, str._s___Thc_3:_Bin_aufgewacht_und_quittiere_n
call fcn.140003fd0
mov rcx, qword [0x140032828]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x140003c41
cmp ebx, 4
jne 0x140003c41
dec eax
cmp eax, 1
ja 0x140003c41
call fcn.140004250
mov rdx, rax
lea rcx, str._s___Thc_4:_Setze_Stop_Flag_n
call fcn.140003fd0
cmp dword [0x140032810], 2
mov dword [0x140032808], 1
jne 0x140003bf3
call fcn.140004250
mov rdx, rax
lea rcx, str._s___Thc_4:_Resume_thread_to_run____stop_n
call fcn.140003fd0
mov rcx, qword [0x140032838]
mov dword [0x140032810], 1
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [0x140032828]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.140004250
mov rdx, rax
lea rcx, str._s___Thc_4:_Running_quittiert_n
call fcn.140003fd0
call fcn.140004250
mov rdx, rax
lea rcx, str._s___Thc_4:_Warte_auf_Quittung_STOP_n
call fcn.140003fd0
mov rcx, qword [0x140032830]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.140004250
mov rdx, rax
lea rcx, str._s___Thc_4:_Stop_quittiert_n
call fcn.140003fd0
xor eax, eax
mov dword [0x140032808], eax
mov dword [0x140032810], eax
mov dword [0x14003280c], eax
call fcn.140004250
mov rdx, rax
lea rcx, str._s___Thc__d:_Exit_n
mov r8d, ebx
call fcn.140003fd0
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x140004160
Capabilities:
Accept command line arguments

Disassembly:
push rbx
mov eax, 0x20
call fcn.1400064a0
sub rsp, rax
mov rbx, rcx
test rcx, rcx
jne 0x1400041b3
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor r8d, r8d
lea rdx, [0x1400251b0]
mov r9, rax
mov cl, 0x45
call fcn.140005590
mov ecx, 0x1e7
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r8d, [rbx + 1]
lea rdx, str.called_with_NULL_pointer
lea rcx, str.ss_free
call fcn.1400049a0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x1400041e9
xor r8d, r8d
lea rdx, [0x140025200]
lea rcx, str.ss_free
call fcn.1400049a0
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x140004800
Capabilities:
Check mutex on windows

Disassembly:
mov eax, 0x28
call fcn.1400064a0
sub rsp, rax
movsxd rcx, ecx
call fcn.140004610
mov rcx, rax
add rsp, 0x28
jmp 0x140005df0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x20
call fcn.1400064a0
sub rsp, rax
cmp qword [0x140032888], 0
mov rbp, rcx
jne 0x140005e6f
xor r8d, r8d
lea edx, [rax - 0x1f]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [0x140032880], rax
test rax, rax
jne 0x140005e4b
lea r8d, [rax + 1]
lea rdx, str.CreateMutex
lea rcx, str.ss_ch
call fcn.1400049a0
mov ecx, 0x1000
call fcn.140004200
mov ecx, 0x2000
mov qword [0x140032888], rax
call fcn.140004200
mov qword [0x140032890], rax
jmp 0x140005e9f
mov rcx, qword [0x140032880]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x140005e9f
mov r8d, 1
lea rdx, [0x140025690]
lea rcx, str.ss_ch
call fcn.1400049a0
movsxd rbx, dword [0x140032864]
lea eax, [rbx + 1]
mov dword [0x140032864], eax
cmp eax, 0x400
jl 0x140005ec0
mov dword [0x140032864], 0
mov rcx, rbp
call fcn.140005dd0
mov rcx, qword [0x140032890]
lea rdi, [rbx*4]
lea rbx, [rbx*8]
lea esi, [rax + 8]
cmp qword [rbx + rcx], 0
jne 0x140005f20
mov eax, 0x20
mov ecx, esi
cmp esi, eax
cmovl ecx, eax
mov rax, qword [0x140032888]
mov dword [rdi + rax], ecx
mov rcx, qword [0x140032888]
mov ecx, dword [rdi + rcx]
call fcn.140004200
mov rcx, qword [0x140032890]
mov qword [rbx + rcx], rax
mov rcx, qword [0x140032890]
mov rax, qword [0x140032888]
cmp dword [rdi + rax], esi
jge 0x140005f51
mov rcx, qword [rbx + rcx]
call fcn.140004160
mov ecx, esi
call fcn.140004200
mov rdx, qword [0x140032890]
mov qword [rbx + rdx], rax
mov rax, qword [0x140032888]
mov dword [rdi + rax], esi
mov rcx, qword [0x140032880]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x140005f79
lea r8d, [rax + 1]
lea rdx, [0x140025700]
lea rcx, str.ss_ch
call fcn.1400049a0
mov rcx, qword [0x140032890]
mov rdx, rbp
mov rcx, qword [rbx + rcx]
call fcn.1400063b0
mov rax, qword [0x140032890]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rax, qword [rbx + rax]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400049a0
Capabilities:
Accept command line arguments

Disassembly:
push rbp
push rsi
push rdi
mov eax, 0xc0
call fcn.1400064a0
sub rsp, rax
mov rax, qword [0x140031c80]
xor rax, rsp
mov qword [rsp + 0xb0], rax
cmp dword [0x1400312e8], 0
mov ebp, r8d
mov rdi, rdx
mov rsi, rcx
je 0x140004bb1
mov qword [rsp + 0xf0], rbx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0xf8], r14
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rsp + 0x6c]
movzx edx, word [rsp + 0x6a]
movzx r8d, word [rsp + 0x68]
movzx eax, word [rsp + 0x6e]
movzx r10d, word [rsp + 0x66]
movzx r11d, word [rsp + 0x62]
movzx r9d, word [rsp + 0x60]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], ecx
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x38], edx
mov edx, 0x40
mov dword [rsp + 0x30], r8d
lea r8, str._4.4d._2.2d._2.2d__2.2d:_2.2d:_2.2d._3.3d
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r11d
call fcn.1400040a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x140004a62
test ebp, ebp
mov eax, 1
cmovne ebx, eax
call fcn.140006050
lea rcx, [0x1400252b4]
call fcn.140004100
mov r8d, ebx
lea rcx, [0x1400252b8]
mov edx, ebx
call fcn.140004100
lea rdx, [rsp + 0x70]
lea rcx, str._Date:_______s_n
call fcn.140004100
call fcn.140005fc0
mov rdx, rax
lea rcx, str._Imagename:___s__n
call fcn.140004100
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
lea rcx, str._Command:_____s__n
call fcn.140004100
lea rax, [rsp + 0x50]
mov dword [rsp + 0x58], 0xff
xor r14d, r14d
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x30], r14
mov r9d, 0x400
mov dword [rsp + 0x28], pe_nt_image_headers64
mov r8d, ebx
mov ecx, 0x1100
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
jle 0x140004b6e
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x140004b6e
movzx ecx, word [rdx]
mov rax, rdx
test cx, cx
je 0x140004b35
cmp cx, 0xa
je 0x140004b1e
cmp cx, 0xd
jne 0x140004b23
mov word [rax], 0x20
movzx ecx, word [rax + 2]
add rax, 2
test cx, cx
jne 0x140004b12
mov rdx, qword [rsp + 0x50]
cmp word [rax - 2], 0x20
jne 0x140004b46
mov word [rax - 2], r14w
mov rdx, qword [rsp + 0x50]
cmp word [rax - 4], 0x20
jne 0x140004b57
mov word [rax - 4], r14w
mov rdx, qword [rsp + 0x50]
lea rcx, str._Message:_____s__n
call fcn.140004100
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp word [rsi], 0
mov r14, qword [rsp + 0xf8]
je 0x140004b8b
mov rdx, rsi
lea rcx, str._Function:____s__n
call fcn.140004100
cmp word [rdi], 0
je 0x140004ba0
mov rdx, rdi
lea rcx, str._Parameter:___s__n
call fcn.140004100
test ebp, ebp
jne 0x140004bce
call fcn.140006110
mov rbx, qword [rsp + 0xf0]
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140006500
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret
lea rcx, str._Status:_____Program_aborted___n
call fcn.140004100
mov ecx, ebx
call fcn.1400148e0
int3
Function at 0x140004c50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov edx, dword [0x1400312f8]
lea r11, [0x1400510e0]
cmp edx, 0x270
jb 0x140004d55
jbe 0x140004ca2
mov edx, 0x1571
lea r9, [0x140051aa0]
xor r8d, r8d
mov rcx, r11
nop dword [rax]
mov eax, edx
mov dword [rcx], edx
shr eax, 0x1e
add rcx, 4
xor eax, edx
lea edx, [r8 + 1]
imul eax, eax, 0x6c078965
lea r8d, [r8 + 1]
add edx, eax
cmp rcx, r9
jl 0x140004c80
mov r8, r11
lea r10, [0x14005146c]
lea r9, [0x1400312f0]
mov edx, dword [r8 + 4]
mov ecx, edx
xor edx, dword [r8]
and ecx, 1
and edx, 0x7ffffffe
xor edx, dword [r8]
shr edx, 1
xor edx, dword [r9 + rcx*4]
xor edx, dword [r8 + 0x634]
mov dword [r8], edx
add r8, 4
cmp r8, r10
jl 0x140004cb3
lea r8, [0x14005146c]
lea r10, [0x140051a9c]
nop
mov edx, dword [r8 + 4]
mov ecx, edx
xor edx, dword [r8]
and ecx, 1
and edx, 0x7ffffffe
xor edx, dword [r8]
shr edx, 1
xor edx, dword [r9 + rcx*4]
xor edx, dword [r8 - 0x38c]
mov dword [r8], edx
add r8, 4
cmp r8, r10
jl 0x140004cf0
mov ecx, dword [0x140051a9c]
mov eax, dword [0x1400510e0]
and ecx, 0x80000001
and eax, 0x7ffffffe
or ecx, eax
mov rax, qword [0x1400510e0]
shr ecx, 1
and eax, 1
xor ecx, dword [r9 + rax*4]
xor ecx, dword [0x140051710]
mov dword [0x140051a9c], ecx
xor edx, edx
mov eax, edx
inc edx
mov dword [0x1400312f8], edx
mov ecx, dword [r11 + rax*4]
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret

Function at 0x140004de0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x30
call fcn.1400064a0
sub rsp, rax
mov rbx, rcx
test rcx, rcx
jne 0x140004e09
lea eax, [rcx + 1]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rcx]
mov edi, 1
test rcx, rcx
je 0x140004e77
cmp dword [rbx + 0x1c], 0
je 0x140004e4f
mov r8d, dword [rbx + 0x24]
test r8d, r8d
jle 0x140004e4f
mov rdx, qword [rbx + 0x10]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140004e4f
lea eax, [rdi - 2]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rbx + 0x18], 0
jne 0x140004e77
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
test eax, eax
jne 0x140004e77
mov rdx, qword [rbx + 8]
lea rcx, str.ss_fclose
xor r8d, r8d
call fcn.1400049a0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140004e85
call fcn.140004160
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140004e93
call fcn.140004160
mov rcx, rbx
call fcn.140004160
mov rbx, qword [rsp + 0x48]
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x140004f30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x40
call fcn.1400064a0
sub rsp, rax
mov rdi, rcx
call fcn.140004eb0
cmp word [rdi], 0x2d
mov rbx, rax
jne 0x140004f7e
cmp word [rdi + 2], 0
jne 0x140004f7e
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbx], rax
mov rax, rbx
mov dword [rbx + 0x18], 1
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov eax, dword [0x1400312fc]
xor r9d, r9d
mov qword [rsp + 0x58], rsi
mov edx, 0x80000000
xor esi, esi
mov rcx, rdi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 3
lea r8d, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400050cb
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x1400312fc]
lea r8d, [rsi + 1]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], eax
mov edx, 0x80000000
mov rcx, rdi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400050cb
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x1400312fc]
lea r8d, [rsi + 3]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], eax
mov edx, 0x80000000
mov rcx, rdi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400050cb
test rbx, rbx
je 0x1400050b9
mov rcx, qword [rbx]
test rcx, rcx
je 0x140005095
cmp dword [rbx + 0x1c], esi
je 0x140005070
mov r8d, dword [rbx + 0x24]
test r8d, r8d
jle 0x140005070
mov rdx, qword [rbx + 0x10]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400050b9
cmp dword [rbx + 0x18], esi
jne 0x140005095
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140005095
mov rdx, qword [rbx + 8]
lea rcx, str.ss_fclose
xor r8d, r8d
call fcn.1400049a0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400050a3
call fcn.140004160
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400050b1
call fcn.140004160
mov rcx, rbx
call fcn.140004160
mov rsi, qword [rsp + 0x58]
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov rsi, qword [rsp + 0x58]
mov qword [rbx], rax
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400050f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x40
call fcn.1400064a0
sub rsp, rax
mov rdi, rcx
call fcn.140004eb0
cmp word [rdi], 0x2d
mov rbx, rax
jne 0x14000513e
cmp word [rdi + 2], 0
jne 0x14000513e
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbx], rax
mov rax, rbx
mov dword [rbx + 0x18], 1
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov eax, dword [0x1400312fc]
xor r9d, r9d
mov qword [rsp + 0x58], rsi
mov edx, 0x40000000
xor esi, esi
mov rcx, rdi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
lea r8d, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x14000530a
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x1400312fc]
lea r8d, [rsi + 1]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], eax
mov edx, 0x40000000
mov rcx, rdi
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x14000530a
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x1400312fc]
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov edx, 0x40000000
mov rcx, rdi
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x14000530a
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x1400312fc]
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov edx, 0x40000000
mov rcx, rdi
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x14000530a
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x1400312fc]
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov edx, 0x40000000
mov rcx, rdi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x14000530a
test rbx, rbx
je 0x1400052f8
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400052d4
cmp dword [rbx + 0x1c], esi
je 0x1400052af
mov r8d, dword [rbx + 0x24]
test r8d, r8d
jle 0x1400052af
mov rdx, qword [rbx + 0x10]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400052f8
cmp dword [rbx + 0x18], esi
jne 0x1400052d4
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400052d4
mov rdx, qword [rbx + 8]
lea rcx, str.ss_fclose
xor r8d, r8d
call fcn.1400049a0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400052e2
call fcn.140004160
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400052f0
call fcn.140004160
mov rcx, rbx
call fcn.140004160
mov rsi, qword [rsp + 0x58]
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov qword [rbx], rax
mov dword [rbx + 0x1c], 1
mov eax, dword [0x140031300]
mov dword [rbx + 0x20], eax
mov ecx, dword [0x140031300]
call fcn.140004200
mov rsi, qword [rsp + 0x58]
mov qword [rbx + 0x10], rax
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140005340
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
mov eax, 0x30
call fcn.1400064a0
sub rsp, rax
mov ebp, r8d
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
jne 0x14000537b
lea r8d, [rax - 0x2f]
lea rdx, str.Called_with_NULL_pointer_for_SS_FileIO
lea rcx, str.ss_fread
call fcn.1400049a0
xor r14d, r14d
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x50], r14d
cmp qword [rbx + 0x10], r14
jne 0x1400053b8
mov rcx, qword [rbx]
lea r9, [rsp + 0x50]
mov r8d, ebp
mov qword [rsp + 0x20], r14
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000543f
mov eax, dword [rsp + 0x50]
jmp 0x140005451
mov esi, r14d
cmp ebp, 1
jle 0x14000544c
mov edx, dword [rbx + 0x24]
cmp edx, dword [rbx + 0x28]
jl 0x1400053fd
mov r8d, dword [rbx + 0x20]
lea r9, [rsp + 0x50]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx]
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000543f
mov eax, dword [rsp + 0x50]
mov edx, r14d
mov dword [rbx + 0x28], eax
mov dword [rbx + 0x24], r14d
test eax, eax
jle 0x140005431
mov rax, qword [rbx + 0x10]
movsxd rcx, edx
movzx r8d, byte [rcx + rax]
cmp r8b, 0xd
jne 0x140005417
lea eax, [rdx + 1]
mov dword [rbx + 0x24], eax
jmp 0x14000542a
cmp r8b, 0xa
je 0x140005446
mov byte [rdi], r8b
inc esi
inc dword [rbx + 0x24]
inc rdi
dec ebp
cmp ebp, 1
jg 0x1400053c4
jmp 0x14000544c
test esi, esi
mov byte [rdi], dl
mov eax, 0xffffffff
cmove esi, eax
jmp 0x14000544f
mov eax, 0xffffffff
jmp 0x140005451
lea eax, [rdx + 1]
mov dword [rbx + 0x24], eax
mov byte [rdi], r14b
mov eax, esi
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rbp
ret