joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14037ffc0
Capabilities:
Query environment variable

Disassembly:
jmp 0x14037ffc0
push rsi
sub rsp, 0x140
mov rax, qword [0x14056a550]
xor rax, rsp
mov qword [rsp + 0x138], rax
xor esi, esi
test rcx, rcx
je 0x14038009e
lea rdx, [rsp + 0x30]
mov r8d, 0x105
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x14038009e
xor ecx, ecx
cmp eax, 0x104
ja 0x140380096
movsx ecx, byte [rsp + 0x30]
lea eax, [rcx - 0x54]
cmp eax, 0x25
ja 0x14038002f
movabs rdx, 0x2100000021
bt rdx, rax
jae 0x14038002f
mov ecx, 1
jmp 0x140380096
test ecx, ecx
je 0x140380096
mov dword [rsp + 0x2c], 0
xor eax, eax
test cl, cl
je 0x140380094
movzx ecx, cl
add ecx, 0xffffffd0
cmp ecx, 9
ja 0x140380094
lea rcx, [rsp + 0x31]
nop word cs:[rax + rax]
movzx edx, byte [rcx]
lea r8d, [rdx - 0x30]
inc rcx
cmp r8d, 0xa
jb 0x140380060
test dl, dl
jne 0x140380094
lea rdx, [0x14052c90c]
lea rcx, [rsp + 0x30]
lea r8, [rsp + 0x2c]
call fcn.140004683
xor eax, eax
cmp dword [rsp + 0x2c], 0
setne al
mov ecx, eax
xor esi, esi
test ecx, ecx
setne sil
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.140003706
mov eax, esi
add rsp, 0x140
pop rsi
ret
Function at 0x140388f70
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x14056a550]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [rcx + 0x78]
mov rdi, qword [rcx + 0x88]
sub rdi, rbx
mov r14, qword [rcx + 0x240]
test r14, r14
mov r12d, 0x20000
cmove r14, r12
cmp rdi, r14
jbe 0x14038901f
lea r15, [rsp + 0x2c]
mov r13, qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbp, rdi
nop dword [rax + rax]
mov rcx, qword [rsi + 0x1a0]
mov qword [rsp + 0x20], 0
mov rdx, rbx
mov r8d, r14d
mov r9, r15
call r13
test eax, eax
sete al
je 0x140389045
mov ecx, dword [rsp + 0x2c]
sub rbp, rcx
mov rax, qword [rsi + 0x240]
test rax, rax
cmove rax, r12
cmp rbp, rax
cmovb r14, rbp
xor eax, eax
test rbp, rbp
je 0x140389045
add rbx, rcx
test ecx, ecx
jne 0x140388fd0
jmp 0x140389045
mov rcx, qword [rsi + 0x1a0]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x2c]
mov rdx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
sete al
mov rcx, qword [rsi + 0x78]
mov qword [rsi + 0x88], rcx
add rcx, qword [rsi + 0x1c8]
mov qword [rsi + 0x90], rcx
and byte [rsi + 0x295], 0xfb
mov qword [rsi + 0x158], 0
add rdi, qword [rsi + 0x170]
mov qword [rsi + 0x170], rdi
mov qword [rsi + 0x168], rdi
xor edi, edi
test al, al
je 0x14038909c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi + 0x1a8], eax
mov edi, 0x26
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140003706
mov eax, edi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1403a3d40
Capabilities:
Read file on windows

Disassembly:
jmp 0x1403a3d40
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, r9
mov rbx, r8
mov rdi, rdx
mov r14, rcx
mov r13, qword [rsp + 0xb8]
mov rax, qword [0x14056a550]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov qword [r9], 0
test r13, r13
je 0x1403a3d99
cmp dword [r13 + 0x40], 0xfffffffc
jne 0x1403a3d99
call case.0x1400ebcb9.136
mov ebp, 1
cmp eax, 1
jg 0x1403a3f9a
mov r12, qword [rsp + 0xb0]
cmp dword [0x1407108a8], 0
je 0x1403a3e47
lea rax, [r12 - 1]
xor ebp, ebp
cmp rax, 2
jb 0x1403a3f9a
mov edx, dword [rsp + 0xa0]
test edx, edx
je 0x1403a3de3
cmp r12, 0xfffffffffffffffa
jne 0x1403a3de3
mov al, 1
xor r15d, r15d
mov ecx, r14d
mov dword [rsp + 0x28], r14d
test al, al
jne 0x1403a3e13
jmp 0x1403a3e3e
test r12, r12
je 0x1403a3df3
mov al, 1
mov r15b, 1
test al, al
jne 0x1403a3e13
jmp 0x1403a3e3e
mov r15d, edx
call fcn.140003c1a
mov edx, r15d
mov dword [rsp + 0x28], eax
cmp dword [0x1407108a8], 0
setne al
xor r15d, r15d
test al, al
je 0x1403a3e3e
cmp dword [rsp + 0xa8], 0
je 0x1403a3e3e
test edx, edx
je 0x1403a3e3e
mov r12d, dword [rsp + 0x28]
mov ecx, r12d
call fcn.1400034b3
mov ecx, r12d
mov r12, qword [rsp + 0xb0]
call fcn.14000507e
test r15b, r15b
je 0x1403a3f56
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsi], 0
test r13, r13
je 0x1403a3e82
mov rax, qword [r13 + 0x240]
test rax, rax
mov r15d, 0x20000
cmovne r15, rax
cmp r15, rbx
jae 0x1403a3f27
test r12, r12
jne 0x1403a3e9e
jmp 0x1403a3f27
cmp rbx, 0x20001
jb 0x1403a3f27
mov r15d, 0x20000
test r12, r12
je 0x1403a3f27
lea r12, [rsp + 0x2c]
mov rbp, qword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x1403a3ebf
add rdi, rax
cmp r15, rax
mov r15, rdx
jne 0x1403a3f91
mov qword [rsp + 0x20], 0
mov rcx, r14
mov rdx, rdi
mov r8d, r15d
mov r9, r12
call rbp
test eax, eax
je 0x1403a3f98
movsxd rax, dword [rsp + 0x2c]
sub rbx, rax
add qword [rsi], rax
test r13, r13
je 0x1403a3f10
mov rcx, qword [r13 + 0x240]
test rcx, rcx
mov edx, 0x20000
cmove rcx, rdx
jmp 0x1403a3f15
mov ecx, 0x20000
mov rdx, r15
cmp rbx, rcx
ja 0x1403a3eb0
mov rdx, rbx
test rbx, rbx
jne 0x1403a3eb0
jmp 0x1403a3f91
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x2c]
mov rcx, r14
mov rdx, rdi
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rcx, dword [rsp + 0x2c]
mov qword [rsi], rcx
xor ebp, ebp
test eax, eax
setne bpl
jmp 0x1403a3f9a
mov rcx, rdi
mov edx, ebx
mov r14d, dword [rsp + 0x28]
mov r8d, r14d
call fcn.1400044f8
movsxd rbx, eax
mov qword [rsi], rbx
cmp ebx, 0xffffffff
je 0x1403a3f9a
lea rcx, [0x14052de51]
mov edx, 2
mov r8d, r14d
xor r9d, r9d
call fcn.140003a44
mov byte [rdi + rbx], 0xa
inc qword [rsi]
mov ebp, 1
jmp 0x1403a3f9a
xor ebp, ebp
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140003706
mov eax, ebp
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1403a66b0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x14056a550]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [rcx + 0x78]
mov rdi, qword [rcx + 0x88]
sub rdi, rbx
mov r14, qword [rcx + 0x240]
test r14, r14
mov r12d, 0x20000
cmove r14, r12
cmp rdi, r14
jbe 0x1403a675f
lea r15, [rsp + 0x2c]
mov r13, qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbp, rdi
nop dword [rax + rax]
mov rcx, qword [rsi + 0x1a0]
mov qword [rsp + 0x20], 0
mov rdx, rbx
mov r8d, r14d
mov r9, r15
call r13
test eax, eax
sete al
je 0x1403a6785
mov ecx, dword [rsp + 0x2c]
sub rbp, rcx
mov rax, qword [rsi + 0x240]
test rax, rax
cmove rax, r12
cmp rbp, rax
cmovb r14, rbp
xor eax, eax
test rbp, rbp
je 0x1403a6785
add rbx, rcx
test ecx, ecx
jne 0x1403a6710
jmp 0x1403a6785
mov rcx, qword [rsi + 0x1a0]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x2c]
mov rdx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
sete al
mov rcx, qword [rsi + 0x78]
mov qword [rsi + 0x88], rcx
add rcx, qword [rsi + 0x1c8]
mov qword [rsi + 0x90], rcx
and byte [rsi + 0x295], 0xfb
mov qword [rsi + 0x158], 0
add rdi, qword [rsi + 0x170]
mov qword [rsi + 0x170], rdi
mov qword [rsi + 0x168], rdi
xor edi, edi
test al, al
je 0x1403a67dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi + 0x1a8], eax
mov edi, 0x26
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140003706
mov eax, edi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1403aa770
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov rsi, rcx
mov rax, qword [0x14056a550]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x38], 0
call fcn.1400041e2
mov ebx, eax
call fcn.140004a89
mov r12d, eax
mov word [rsp + 0x40], 0x7b
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.140003463
lea rcx, [rsp + rax]
add rcx, 0x40
lea rdx, str._08X
mov r8d, 0x1160913
call fcn.140005b05
mov rcx, rdi
call fcn.140003463
movabs rcx, 0x30302d303030302d
mov qword [rsp + rax + 0x40], rcx
mov dword [rsp + rax + 0x48], 0x2d3030
movzx ebp, bl
mov rcx, rdi
call fcn.140003463
lea rcx, [rsp + rax]
add rcx, 0x40
lea r14, str._02X
mov rdx, r14
mov r8d, ebp
call fcn.140005b05
movzx ebp, bh
mov rcx, rdi
call fcn.140003463
lea rcx, [rsp + rax]
add rcx, 0x40
mov rdx, r14
mov r8d, ebp
call fcn.140005b05
mov rcx, rdi
call fcn.140003463
mov word [rsp + rax + 0x40], 0x2d
mov eax, ebx
shr eax, 0x10
movzx ebp, al
mov rcx, rdi
call fcn.140003463
lea rcx, [rsp + rax]
add rcx, 0x40
mov rdx, r14
mov r8d, ebp
call fcn.140005b05
mov r15d, ebx
shr ebx, 0x18
mov rcx, rdi
call fcn.140003463
lea rcx, [rsp + rax]
add rcx, 0x40
mov rdx, r14
mov r8d, ebx
call fcn.140005b05
mov ebx, r12d
movzx ebp, bl
mov rcx, rdi
call fcn.140003463
lea rcx, [rsp + rax]
add rcx, 0x40
mov rdx, r14
mov r8d, ebp
call fcn.140005b05
movzx ebp, bh
mov rcx, rdi
call fcn.140003463
lea rcx, [rsp + rax]
add rcx, 0x40
mov rdx, r14
mov r8d, ebp
call fcn.140005b05
mov eax, r12d
shr eax, 0x10
movzx ebp, al
mov rcx, rdi
call fcn.140003463
lea rcx, [rsp + rax]
add rcx, 0x40
mov rdx, r14
mov r8d, ebp
call fcn.140005b05
mov ebp, r12d
shr ebx, 0x18
mov rcx, rdi
call fcn.140003463
lea rcx, [rsp + rax]
add rcx, 0x40
mov rdx, r14
mov r8d, ebx
call fcn.140005b05
mov rcx, rdi
call fcn.140003463
mov word [rsp + rax + 0x40], 0x7d
mov ecx, 4
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov r14, rax
test rax, rax
je 0x1403aa972
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rsp + 0x38]
mov rcx, rsi
xor edx, edx
call fcn.140003765
mov rdi, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140003706
mov rax, rdi
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ebx, r15d
lea r15, [rsi + 0x10]
mov r9, r15
shr r9, 0x20
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r15d
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test rax, rax
je 0x1403aa93f
mov r14, rax
mov qword [rsp + 0x20], r15
mov rcx, rax
mov edx, 6
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x1403aa936
mov rdi, rax
mov dword [rax], 0x1160913
mov dword [rax + 4], r14d
mov dword [rax + 8], ebx
mov dword [rax + 0xc], ebp
add rdi, 0x10
jmp 0x1403aa953
Function at 0x1403b0a50
Capabilities:
Query environment variable

Disassembly:
jmp 0x1403b0a50
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rax, qword [0x14056a550]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [0x14070c6c8], 0xfffffffc
lea rax, [0x14070c4e8]
mov dword [0x14070c528], 0xfffffffc
mov ebx, 0xffffe7ff
mov ecx, dword [0x14070c778]
and ecx, ebx
or ecx, 0x800
mov dword [0x14070c778], ecx
mov qword [0x1406f9fc8], rax
mov qword [0x1407044b0], rax
mov dword [0x14070c420], 0xfffffffd
lea rax, [0x14070c240]
mov dword [0x14070c280], 0xfffffffd
mov ecx, dword [0x14070c4d0]
and ecx, ebx
or ecx, 0x800
mov dword [0x14070c4d0], ecx
mov qword [0x1406fa000], rax
mov qword [0x1407044b8], rax
mov dword [0x14070cec0], 0xffffffff
lea rax, [0x14070cce0]
mov dword [0x14070cd20], 0xffffffff
mov ecx, dword [0x14070cf70]
and ecx, ebx
or ecx, 0x800
mov dword [0x14070cf70], ecx
mov qword [0x1406fa070], rax
mov qword [0x1407044c8], rax
mov dword [0x14070cc18], 0xfffffffe
lea rax, [0x14070ca38]
mov dword [0x14070ca78], 0xfffffffe
mov ecx, dword [0x14070ccc8]
and ecx, ebx
or ecx, 0x800
mov dword [0x14070ccc8], ecx
mov qword [0x1406fa038], rax
mov qword [0x1407044c0], rax
lea rdi, str.FORT_d
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
call fcn.140005b05
mov dword [0x14070c178], 0
lea r15, [0x14070bf98]
mov dword [0x14070bfd8], 0
mov r14, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov rcx, rsi
xor edx, edx
xor r8d, r8d
call r14
xor ecx, ecx
test eax, eax
setne cl
shl ecx, 0xb
mov eax, dword [0x14070c228]
and eax, ebx
add eax, ecx
add eax, 0x800
mov dword [0x14070c228], eax
mov qword [0x1406fa0a8], r15
mov qword [0x1407044d0], r15
mov rcx, rsi
mov rdx, rdi
mov r8d, 5
call fcn.140005b05
mov dword [0x14070c970], 5
lea r15, [0x14070c790]
mov dword [0x14070c7d0], 5
mov rcx, rsi
xor edx, edx
xor r8d, r8d
call r14
xor ecx, ecx
test eax, eax
setne cl
shl ecx, 0xb
mov eax, dword [0x14070ca20]
and eax, ebx
add eax, ecx
add eax, 0x800
mov dword [0x14070ca20], eax
mov qword [0x1406fa1c0], r15
mov qword [0x1407044f8], r15
mov rcx, rsi
mov rdx, rdi
mov r8d, 6
call fcn.140005b05
mov dword [0x14070d168], 6
lea rdi, [0x14070cf88]
mov dword [0x14070cfc8], 6
mov rcx, rsi
xor edx, edx
xor r8d, r8d
call r14
xor ecx, ecx
test eax, eax
setne cl
shl ecx, 0xb
and ebx, dword [0x14070d218]
lea eax, [rcx + rbx]
add eax, 0x800
mov dword [0x14070d218], eax
mov qword [0x1406fa1f8], rdi
mov qword [0x140704500], rdi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140003706
nop
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1403b0d60
Capabilities:
Query environment variable

Disassembly:
jmp 0x1403b0d60
sub rsp, 0x148
mov rax, qword [0x14056a550]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp dword [0x1406f9ec8], 0
jne 0x1403b0f65
cmp dword [0x1406f9ecc], 0
jne 0x1403b0f65
cmp dword [0x1406f9ec0], 0
jne 0x1403b0f65
cmp dword [0x1406f9ec4], 0
jne 0x1403b0f65
lea rcx, str.FORT_BLOCKSIZE
lea rdx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1403b0e1c
cmp eax, 0x104
jb 0x1403b0dd7
mov byte [rsp + 0x30], 0
dec eax
lea rcx, [rsp + 0x30]
lea r9, [rsp + 0x2c]
mov edx, eax
mov r8d, 2
call fcn.140003b75
mov edx, dword [rsp + 0x2c]
lea ecx, [rdx + 0x1ff]
and ecx, 0xfffffe00
cmp edx, 0x7fffc001
mov r8d, 0xfffffffe
cmovae ecx, r8d
test edx, edx
cmovs ecx, r8d
test eax, eax
cmovne ecx, r8d
jmp 0x1403b0e26
mov byte [rsp + 0x30], 0
mov ecx, 0xffffffff
mov dword [0x1406f9ec8], ecx
lea rcx, str.FORT_BUFFERCOUNT
lea rdx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1403b0e8e
cmp eax, 0x104
jb 0x1403b0e56
mov byte [rsp + 0x30], 0
dec eax
lea rcx, [rsp + 0x30]
lea r9, [rsp + 0x2c]
mov edx, eax
mov r8d, 2
call fcn.140003b75
mov edx, dword [rsp + 0x2c]
cmp edx, 0x7f
mov r8d, 0xfffffffe
mov ecx, edx
cmovg ecx, r8d
test edx, edx
cmovs ecx, r8d
test eax, eax
cmovne ecx, r8d
jmp 0x1403b0e98
mov byte [rsp + 0x30], 0
mov ecx, 0xffffffff
mov dword [0x1406f9ecc], ecx
lea rcx, str.FORT_FMT_RECL
lea rdx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1403b0ef4
cmp eax, 0x104
jb 0x1403b0ec8
mov byte [rsp + 0x30], 0
dec eax
lea rcx, [rsp + 0x30]
lea r9, [rsp + 0x2c]
mov edx, eax
mov r8d, 2
call fcn.140003b75
mov ecx, dword [rsp + 0x2c]
test ecx, ecx
mov edx, 0xfffffffe
cmovs ecx, edx
test eax, eax
cmovne ecx, edx
jmp 0x1403b0efe
mov byte [rsp + 0x30], 0
mov ecx, 0xffffffff
mov dword [0x1406f9ec0], ecx
lea rcx, str.FORT_UFMT_RECL
lea rdx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1403b0f5a
cmp eax, 0x104
jb 0x1403b0f2e
mov byte [rsp + 0x30], 0
dec eax
lea rcx, [rsp + 0x30]
lea r9, [rsp + 0x2c]
mov edx, eax
mov r8d, 2
call fcn.140003b75
mov ecx, dword [rsp + 0x2c]
test ecx, ecx
mov edx, 0xfffffffe
cmovs ecx, edx
test eax, eax
cmovne ecx, edx
jmp 0x1403b0f5f
mov ecx, 0xffffffff
mov dword [0x1406f9ec4], ecx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140003706
nop
add rsp, 0x148
ret
Function at 0x1403fe66c
Capabilities:
Parse pe header

Disassembly:
jmp 0x1403fe66c
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1403fe6b6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1403fe6b6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1403fe6b6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1403fe6b6
cmp dword [rcx + 0x84], 0xe
jbe 0x1403fe6b6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1403fe6b8
xor al, al
add rsp, 0x28
ret
Function at 0x1404867fc
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x14070fd20]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x14048685a
cmp word [rdx], r12w
jne 0x14048685a
or byte [rax + r8*8 + 0x38], cl
jmp 0x140486860
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x1404869bb
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x140486996
lea r9, [rcx + 2]
cmp ax, r13w
je 0x140486899
mov rcx, r9
jmp 0x1404868bc
cmp r9, rdx
jae 0x1404868d3
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x14048687d
jmp 0x1404869bb
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140486990
cmp dword [rsp + 0x80], edi
je 0x140486990
mov rdx, r14
lea r11, [0x14070fd20]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x140486969
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x14048693c
mov word [rbx], r12w
jmp 0x1404869b7
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x140486945
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x1404869b7
cmp word [rsp + 0x70], r12w
jne 0x140486976
cmp rbx, rsi
je 0x140486936
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.140001cf3
cmp word [rsp + 0x70], r12w
je 0x1404869bb
mov word [rbx], r13w
jmp 0x1404869b7
lea r11, [0x14070fd20]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x1404869b3
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x1404869bb
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14049f2f0
Capabilities:
Terminate thread

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx + 0x60]
mov r8, qword [rax]
mov qword [rcx + 0x60], r8
test edx, edx
je 0x14049f33a
cmp qword [rax + 8], 0
je 0x14049f334
mov rcx, qword [rax + 8]
mov qword [rsp + 0x28], rcx
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x28]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x38
ret
mov rcx, qword [rax + 0x18]
add rsp, 0x38
jmp qword [sym.imp.KERNEL32.dll_SetEvent]
Function at 0x18001113b
Capabilities:
Write file on windows

Disassembly:
jmp 0x18001ebb0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1800440fe]
call fcn.180011b4a
nop
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x18001ec08
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x18001ed1a
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x18001ecb3
cmp qword [rbp + 0x28], 0
jle 0x18001ecb3
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x18001ec51
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.180011aa0
nop
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rbp + 0x130], 0
jle 0x18001ed09
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x18001ed09
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x180011668
Capabilities:
Terminate process

Disassembly:
jmp 0x180028070
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x415840
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4159cb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432480
xorps xmm15, xmm15
mov r14, qword [0x005c7630]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x4158a5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4158b4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x4158d3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x4158e3
cmp rbx, 0x1000
jae 0x4158ab
jmp 0x41594d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4158f5
xor edx, edx
jmp 0x415944
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432480
xorps xmm15, xmm15
mov r14, qword [0x005c7630]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x4158d9
jmp 0x4158c8
call fcn.00463d60
xorps xmm15, xmm15
mov r14, qword [0x005c7630]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00436520
lea rax, [0x004aaaef]
mov ebx, 0x18
nop dword [rax]
call fcn.00436da0
mov rax, qword [rsp + 0x38]
call fcn.00436ae0
lea rax, [0x004aadf7]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00436da0
mov rax, qword [rsp + 0x30]
call fcn.00436ae0
call fcn.00436760
call fcn.00436580
lea rax, [0x004aca10]
mov ebx, 0x21
call fcn.00434a80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460640
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415840