joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140023a20
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14007f010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x14007fc20]
mov edi, ecx
cmp byte [rbx + 0x4a55], 0
jne 0x140023a81
cmp byte [rbx + 0x4a56], 0
jne 0x140023a81
movsx r9d, word [rbx + 0x5b7a]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140013c30
test dil, 1
je 0x140023baf
jmp 0x140023b0a
movss xmm1, dword [rbx + 0x389c]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5b7a]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x140074a5c]
mulss xmm1, dword [0x140074a50]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xe08]
addss xmm1, dword [rbx + 0xe0c]
mov qword [rbx + 0x47c0], rax
mov dword [rbx + 0x47ac], 1
movss dword [rbx + 0x47b8], xmm0
movss dword [rbx + 0x47bc], xmm1
movss xmm0, dword [rbx + 0x38f8]
mulss xmm0, dword [0x1400749a4]
or dword [rbx + 0x47a8], 0x41
movss dword [rbx + 0x4808], xmm0
call fcn.140013c30
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140023b60
lea r11, [0x140068e00]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x140023b43
cmp byte [r8], r9b
jne 0x140023b43
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140023b30
not ecx
call fcn.14001ad30
test rax, rax
je 0x140023baf
cmp byte [rax + 0xb6], 0
je 0x140023baf
mov byte [rax + 0xbb], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xbd], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xd8], 1
mov edx, 0x10
inc word [rbx + 0x5b7a]
movsx r9d, word [rbx + 0x5b7a]
call fcn.140013c30
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14001d500
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140064080
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140028d00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c60], 0
lea rbx, [rcx + 0x5c68]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140028da7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x140028d5a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14002b020
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1400145a0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c60]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5c70]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x14007fc18]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x140028daf
mov rcx, rbx
call fcn.1400145a0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140029250
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x14007fc20]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x1400292b3
mov qword [rsp], rbx
lea rbx, [0x140068e00]
nop dword [rax]
cmp r9b, 0x23
jne 0x140029293
cmp byte [r8], r9b
jne 0x140029293
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x140029280
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5bd8]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x1400292e7
mov r10, qword [r10 + 0x5be0]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x1400292ee
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x1400292d4
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x14003bd10
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x14007fc20]
mov edx, 0x210
call fcn.140020370
cmp byte [rax], 0
je 0x14003bd86
xor edx, edx
mov ecx, 0x210
call fcn.1400227b0
test al, al
je 0x14003bd86
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x14003bd86
mov rbx, qword [0x14007fc20]
cmp byte [rbx + 0x37b9], 0
je 0x14003bd72
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x210
call fcn.1400138f0
mov dword [rbx + 0x380], 0x210
mov dword [rbx + 0x940], 0xa0
mov rcx, qword [0x14007fc20]
mov edx, 0x214
call fcn.140020370
cmp byte [rax], 0
je 0x14003bdf6
xor edx, edx
mov ecx, 0x214
call fcn.1400227b0
test al, al
je 0x14003bdf6
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x14003bdf6
mov rbx, qword [0x14007fc20]
cmp byte [rbx + 0x37b9], 0
je 0x14003bde2
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x214
call fcn.1400138f0
mov dword [rbx + 0x384], 0x214
mov dword [rbx + 0x950], 0xa1
mov rcx, qword [0x14007fc20]
mov edx, 0x212
call fcn.140020370
cmp byte [rax], 0
je 0x14003be66
xor edx, edx
mov ecx, 0x212
call fcn.1400227b0
test al, al
je 0x14003be66
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x14003be66
mov rbx, qword [0x14007fc20]
cmp byte [rbx + 0x37b9], 0
je 0x14003be52
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x212
call fcn.1400138f0
mov dword [rbx + 0x26c], 0x212
mov dword [rbx + 0x948], 0x5b
mov rcx, qword [0x14007fc20]
mov edx, 0x216
call fcn.140020370
cmp byte [rax], 0
je 0x14003bed6
xor edx, edx
mov ecx, 0x216
call fcn.1400227b0
test al, al
je 0x14003bed6
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x14003bed6
mov rbx, qword [0x14007fc20]
cmp byte [rbx + 0x37b9], 0
je 0x14003bec2
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x216
call fcn.1400138f0
mov dword [rbx + 0x270], 0x216
mov dword [rbx + 0x958], 0x5c
add rsp, 0x20
pop rbx
ret
Function at 0x140049080
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x14007f010]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, qword [0x14007fe10]
test rbx, rbx
je 0x1400492cd
lea rdx, [rbx + 0x368]
movaps xmmword [rsp + 0x90], xmm6
call fcn.14004b490
lea rdx, [rbx + 0x370]
movaps xmm6, xmm0
call fcn.14004b490
addss xmm0, dword [0x140074978]
comiss xmm0, xmm6
jb 0x1400492c5
mov r8d, 0x6d
movaps xmmword [rsp + 0x80], xmm7
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140048570
movups xmm0, xmmword [rsp + 0x20]
lea rdx, [rsp + 0x40]
movsd xmm1, qword [rsp + 0x30]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x40], xmm0
movsd qword [rsp + 0x50], xmm1
call fcn.140048090
movsd xmm6, qword [rsp + 0x20]
xorps xmm4, xmm4
ucomisd xmm6, xmm4
movss xmm7, dword [0x14007f044]
xorps xmm3, xmm3
xorps xmm2, xmm2
jp 0x14004913b
je 0x1400491a2
mov eax, dword [0x14007fe88]
movd xmm5, eax
cvtdq2pd xmm5, xmm5
comisd xmm6, xmm5
jbe 0x14004917e
movaps xmm3, xmm5
add eax, eax
subsd xmm3, xmm6
cvtps2pd xmm0, xmm7
xorps xmm3, xmmword [0x140074ea0]
divsd xmm3, xmm0
movd xmm0, eax
movaps xmm1, xmm3
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm5
comisd xmm1, xmm0
jbe 0x14004917e
xorps xmm3, xmm3
comisd xmm5, xmm6
jbe 0x1400491a2
movaps xmm3, xmm6
cvtps2pd xmm0, xmm7
subsd xmm3, xmm5
divsd xmm3, xmm0
movaps xmm0, xmm3
addsd xmm0, xmm5
comisd xmm4, xmm0
jbe 0x1400491a2
xorps xmm3, xmm3
movsd xmm5, qword [rsp + 0x28]
ucomisd xmm5, xmm4
jp 0x1400491b0
je 0x140049217
mov eax, dword [0x14007fe90]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
comisd xmm5, xmm6
jbe 0x1400491f3
movaps xmm2, xmm6
add eax, eax
subsd xmm2, xmm5
cvtps2pd xmm0, xmm7
xorps xmm2, xmmword [0x140074ea0]
divsd xmm2, xmm0
movd xmm0, eax
movaps xmm1, xmm2
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm6
comisd xmm1, xmm0
jbe 0x1400491f3
xorps xmm2, xmm2
comisd xmm6, xmm5
jbe 0x140049217
movaps xmm2, xmm5
cvtps2pd xmm0, xmm7
subsd xmm2, xmm6
divsd xmm2, xmm0
movaps xmm0, xmm2
addsd xmm0, xmm6
comisd xmm4, xmm0
jbe 0x140049217
xorps xmm2, xmm2
xor eax, eax
mov qword [rsp + 0x54], 0x4001
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x5c], rax
mov edx, 0x1000
mov dword [rsp + 0x64], eax
mov r8d, edx
mov dword [rsp + 0x50], eax
cvttsd2si eax, xmm3
lea r9d, [rcx + 0x40]
mov dword [rsp + 0x48], eax
cvttsd2si eax, xmm2
mov dword [rsp + 0x4c], eax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
movaps xmm7, xmmword [rsp + 0x80]
mov rbx, rax
test rax, rax
je 0x1400492c5
movups xmm0, xmmword [0x14007fd50]
mov r8d, 0x28
lea rdx, [rsp + 0x40]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x14007fd60]
movsd qword [rax + 0x10], xmm1
mov ecx, dword [0x14007fd68]
mov dword [rax + 0x18], ecx
movzx ecx, word [0x14007fd6c]
mov word [rax + 0x1c], cx
lea ecx, [r8 - 0x27]
call rbx
xor edx, edx
mov r8d, 0x1000
mov rcx, rbx
call fcn.140065628
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
movaps xmm6, xmmword [rsp + 0x90]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140064080
add rsp, 0xa0
pop rbx
ret
Function at 0x14004b140
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.14004ab60
test al, al
je 0x14004b163
call fcn.14004acc0
call fcn.140048ed0
call fcn.140048a50
call fcn.14004a3c0
jmp 0x14004b16e
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x14004cb60
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x110
mov rax, qword [0x14007f010]
xor rax, rsp
mov qword [rsp + 0x108], rax
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x30]
call fcn.14004cda0
mov rcx, rax
call fcn.140051c80
lea rcx, [rsp + 0xf8]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea rax, [rsp + 0x31]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x31]
call fcn.14004ce40
mov rcx, rax
call fcn.140051c60
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x100]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [rsp + 0xf0]
mov ecx, eax
call fcn.140064b28
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x32]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x32]
call fcn.14004ce40
mov rcx, rax
call fcn.140051c60
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x100]
xor r8d, r8d
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x38]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x34], 0
jmp 0x14004ccf8
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x48]
cmp dword [rsp + 0x34], eax
jae 0x14004cd37
mov rax, qword [rsp + 0x40]
add rax, 8
mov r9, rax
mov r8, qword [rsp + 0x40]
lea rdx, [rsp + 0xa8]
lea rcx, [0x14007fce8]
call fcn.1400563f0
mov rax, qword [rsp + 0x40]
add rax, 0x14
mov qword [rsp + 0x40], rax
jmp 0x14004ccee
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.1400642ec
cmp qword [rsp + 0x50], 0
jne 0x14004cd61
mov qword [rsp + 0x80], 0
jmp 0x14004cd77
mov qword [rsp + 0x38], 0x8123
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x108]
xor rcx, rsp
call fcn.140064080
add rsp, 0x110
pop rdi
ret
Function at 0x14004e520
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
mov rax, qword [0x14007f010]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14007fd84], eax
jle 0x14004e5bf
lea rcx, [0x14007fd84]
call fcn.1400644ec
cmp dword [0x14007fd84], 0xffffffff
jne 0x14004e5bf
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14004e6c0
mov rcx, rax
call fcn.1400508d0
mov rdx, rax
lea rcx, [0x14007fd88]
call fcn.140052680
lea rcx, [0x140066dc0]
call fcn.140064834
nop
lea rcx, [0x14007fd84]
call fcn.14006448c
lea rcx, [0x14007fd88]
call fcn.140052300
lea r8, [rsp + 0x68]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [rsp + 0x28], eax
mov rcx, qword [rsp + 0x90]
call fcn.140052300
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x14004e62d
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x14004e62d
mov dword [rsp + 0x24], 1
jmp 0x14004e635
mov dword [rsp + 0x24], 0
movzx eax, byte [rsp + 0x24]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140064080
add rsp, 0x80
pop rdi
ret
Function at 0x140050f20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x140050f59
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140051047
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x140050fef
cmp qword [rsp + 0x20], 0
jle 0x140050fef
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x140050f99
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.140054fa0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rsp + 0x50], 0
jle 0x140051037
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x140051037
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
add rsp, 0x38
ret
Function at 0x140051050
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x14007f010]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x90], 0
jg 0x140051084
xor eax, eax
jmp 0x140051280
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x68], 0
je 0x1400510b6
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x140051280
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jbe 0x140051167
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.14004b9c0
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x88]
call fcn.140054fa0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x80], 0
je 0x140051270
mov rcx, qword [rsp + 0x80]
call fcn.140052fa0
mov qword [rsp + 0x48], 0xfff
cmp qword [rsp + 0x50], 0xfff
jbe 0x14005121d
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x28], 0xfff
je 0x140051218
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
jmp 0x140051280
jmp 0x140051193
cmp qword [rsp + 0x50], 0
jbe 0x140051270
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140064080
add rsp, 0x78
ret
Function at 0x140053060
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x14007f010]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x14005309d
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400530a4
mov al, 1
jmp 0x1400531fe
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.14004b2a0
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.14004b2a0
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x3c]
lea rcx, [rsp + 0x40]
call fcn.14004b2b0
movzx eax, al
test eax, eax
je 0x1400530fb
xor al, al
jmp 0x1400531fe
mov qword [rsp + 0x60], 0x20
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14005316b
cmp dword [rsp + 0x30], 1
je 0x140053177
cmp dword [rsp + 0x30], 3
je 0x1400531ec
jmp 0x1400531fc
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x1400531c3
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x1400531c3
xor al, al
jmp 0x1400531fe
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400531dd
mov dword [rsp + 0x34], 1
jmp 0x1400531e5
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x1400531fe
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x1400531fe
xor al, al
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140064080
add rsp, 0xa8
ret
Function at 0x14005b0a0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x118
mov rax, qword [rsp + 0x120]
add rax, 0x18
mov rcx, rax
call fcn.14005b9c0
mov rax, qword [rsp + 0x120]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x120]
mov rax, qword [rax + 0x38]
mov eax, dword [rax + 0x50]
mov edx, eax
mov rcx, qword [rsp + 0x38]
call fcn.14005ba30
mov rax, qword [rsp + 0x120]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0xc0]
mov rcx, qword [rsp + 0x40]
call fcn.14005b960
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x120]
mov rax, qword [rax + 0x38]
mov eax, dword [rax + 0x54]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0xc8]
mov rcx, qword [rsp + 0x50]
call fcn.14005b960
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x68], rax
mov r9, qword [rsp + 0x60]
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0xd0]
call fcn.14005bc60
mov qword [rsp + 0x28], 0
jmp 0x14005b199
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x120]
mov rax, qword [rax + 0x38]
movzx eax, word [rax + 6]
cmp qword [rsp + 0x28], rax
jae 0x14005b323
imul rax, qword [rsp + 0x28], 0x28
mov rcx, qword [rsp + 0x120]
add rax, qword [rcx + 0x40]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x120]
add rax, 0x18
mov rcx, rax
call fcn.140050a40
mov rcx, qword [rsp + 0x20]
mov ecx, dword [rcx + 0xc]
add rax, rcx
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x14]
mov rcx, qword [rsp + 0x120]
add rax, qword [rcx + 0x30]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x120]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0xe8]
mov rcx, qword [rsp + 0x70]
call fcn.14005b960
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0xc]
mov qword [rsp + 0x78], rax
mov r8, qword [rsp + 0x78]
lea rdx, [rsp + 0xf0]
mov rcx, qword [rsp + 0x80]
call fcn.14005b8e0
mov rax, qword [rax]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x90], rax
lea rdx, [rsp + 0xf8]
mov rcx, qword [rsp + 0x90]
call fcn.14005b960
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x14]
mov qword [rsp + 0x98], rax
mov r8, qword [rsp + 0x98]
lea rdx, [rsp + 0x100]
mov rcx, qword [rsp + 0xa0]
call fcn.14005b8e0
mov rax, qword [rax]
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xb8], rax
mov r9, qword [rsp + 0xb0]
mov r8d, dword [rsp + 0x34]
mov rdx, qword [rsp + 0xb8]
lea rcx, [rsp + 0x108]
call fcn.14005bc60
jmp 0x14005b18c
add rsp, 0x118
ret