joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009420
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14004f040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400094f3
cmp byte [rcx + 0x71], 0
je 0x1400094f3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400094ef
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400094b4
sub eax, 1
je 0x1400094b8
cmp eax, 2
jne 0x1400094ef
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140021660
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400094e6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400094ef
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000949c
xor al, al
jmp 0x14000949c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140021660
add rsp, 0x60
pop rbx
ret
Function at 0x1400221d8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140022222
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140022222
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140022222
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140022222
cmp dword [rcx + 0x84], 0xe
jbe 0x140022222
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140022224
xor al, al
add rsp, 0x28
ret
Function at 0x140008080
Capabilities:
Hash data with crc32
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov r15, rcx
lea r8, [rax + 0x18]
xor edi, edi
lea rcx, [0x1400158c0]
mov edx, 0x8000
mov ebx, edi
call qword [sym.imp.msvcrt.dll__open]
nop dword [rax + rax]
mov esi, eax
cmp eax, 0xffffffff
jne 0x140008138
lea r9, [0x1400158c0]
mov rcx, r14
lea r8, [0x140010c00]
lea rdx, str.Could_not_open_file:__1
call fcn.1400081b0
jmp 0x140008160
mov r8d, 0x1000
mov rdx, rbp
mov ecx, esi
call qword [sym.imp.msvcrt.dll__read]
nop dword [rax + rax]
mov edx, eax
cmp eax, 0xffffffff
je 0x14000818b
test eax, eax
je 0x140008138
mov r8, rbp
not ebx
movzx ecx, byte [r8]
lea r9, [0x140010080]
movzx eax, bl
inc r8
xor rcx, rax
mov eax, ebx
shr eax, 8
mov ebx, dword [r9 + rcx*4]
xor ebx, eax
add edx, 0xffffffff
jne 0x140008112
not ebx
mov ecx, esi
call qword [sym.imp.msvcrt.dll__eof]
nop dword [rax + rax]
test eax, eax
je 0x1400080e7
mov edi, 1
mov dword [r15], ebx
mov ecx, esi
call qword [sym.imp.msvcrt.dll__close]
nop dword [rax + rax]
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
lea r9, [0x1400158c0]
mov rcx, r14
lea r8, [0x140010c00]
lea rdx, str.Read_failure_doing_CRC_on_file:__1
call fcn.1400081b0
jmp 0x140008152

Function at 0x140008730
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
test r8b, 0x50
je 0x140008751
lea rdx, str._1_is_not_a_file
jmp 0x1400087c7
and qword [rsp + 0x30], 0
xor r9d, r9d
and dword [rsp + 0x28], 0
xor edx, edx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400087c0
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
nop dword [rax + rax]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
cmp ebx, 0xffffffff
je 0x1400087c0
cmp dword [rsp + 0x60], 0
jle 0x1400087bc
lea rdx, str.File_is_larger_than_the_4GB_limit:__1
jmp 0x1400087c7
mov eax, ebx
jmp 0x1400087e0
lea rdx, str.Could_not_find_file:__1
lea r9, [0x1400158c0]
mov rcx, rdi
lea r8, [0x140010c00]
call fcn.1400081b0
or eax, 0xffffffff
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140009448
Capabilities:
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
lea rcx, [0x1400168c0]
mov qword [rax - 0x28], r15
mov rsi, r8
mov r14, rdx
mov dword [rax - 0x30], r15d
xor r9d, r9d
xor r8d, r8d
lea edi, [r15 + 3]
mov edx, 0x40000000
mov dword [rax - 0x38], edi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
nop dword [rax + rax]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400094e7
lea ecx, [rdi + 0x61]
call qword [sym.imp.KERNEL32.dll_Sleep]
nop dword [rax + rax]
mov qword [rsp + 0x30], r15
lea rcx, [0x1400168c0]
mov dword [rsp + 0x28], r15d
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], edi
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
nop dword [rax + rax]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140009593
movzx edx, word [r14 + 2]
lea r8, [rsp + 0x60]
movzx ecx, word [r14]
call qword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
nop dword [rax + rax]
lea rdx, [rsp + 0x78]
mov edi, eax
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
nop dword [rax + rax]
lea r9, [rsp + 0x78]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
or edi, eax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
nop dword [rax + rax]
mov rcx, rbx
or edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
cmp word [r14 + 4], r15w
jne 0x140009553
mov edx, 0x80
jmp 0x14000955b
movzx edx, word [r14 + 4]
and edx, 0x27
lea rcx, [0x1400168c0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
nop dword [rax + rax]
or eax, edi
jne 0x140009593
lea r9, [0x1400168c0]
mov rcx, rsi
lea r8, [0x140010c00]
lea rdx, str.Cannot_set_date_time_attributes_for_file:__1
call fcn.1400081b0
xor eax, eax
jmp 0x140009598
mov eax, 1
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x14000a9d0
Capabilities:
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rdx
mov rsi, rcx
call fcn.14000aadc
test eax, eax
je 0x14000aab8
mov rdi, rsi
mov ebp, 3
mov rbx, qword [rdi]
test rbx, rbx
je 0x14000aa98
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000aa24
call qword [sym.imp.msvcrt.dll_fclose]
nop dword [rax + rax]
mov rcx, qword [rbx + 8]
call qword [sym.imp.msvcrt.dll_remove]
nop dword [rax + rax]
test eax, eax
je 0x14000aa5b
mov rax, qword [rbx + 8]
lea r8, str._s_s
mov r9, qword [rbx + 0x10]
lea rdx, str.Cannot_delete__1:__2
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.1400081b0
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14000aa70
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000aa85
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
and qword [rdi], 0
add rdi, 8
sub rbp, 1
jne 0x14000aa04
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
lea eax, [rbp + 1]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14000b330
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, qword [r8 + 0x10]
mov ecx, 0x800
mov r14, qword [r8 + 8]
mov rdi, r8
mov r12, rdx
xor r15d, r15d
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
jne 0x14000b3a9
mov rcx, qword [rsp + 0x80]
lea r8, str._s_s_s
mov qword [rsp + 0x28], r12
lea rdx, str.Out_of_memory_copying__1__2_to__3
mov r9, r13
mov qword [rsp + 0x20], r14
call fcn.1400081b0
xor eax, eax
jmp 0x14000b50a
lea rdx, [0x140012c54]
mov rcx, r14
call qword [sym.imp.msvcrt.dll_fopen]
nop dword [rax + rax]
mov qword [rdi], rax
mov rbx, rax
test rax, rax
jne 0x14000b3fe
mov rax, qword [rdi + 8]
lea r8, str._s_s
mov r9, qword [rdi + 0x10]
lea rdx, str.Cannot_open__1:__2
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
call fcn.1400081b0
mov rbx, qword [rdi]
test rbx, rbx
je 0x14000b4ba
mov r15, rbx
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_feof]
nop dword [rax + rax]
test eax, eax
jne 0x14000b4e6
mov r9, rbx
lea edx, [rax + 1]
mov r8d, 0x800
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_fread]
nop dword [rax + rax]
mov rcx, rbx
mov qword [rsp + 0x78], rax
call qword [sym.imp.msvcrt.dll_ferror]
nop dword [rax + rax]
test eax, eax
jne 0x14000b492
mov rax, qword [rsp + 0x78]
test eax, eax
jle 0x14000b401
mov r9, qword [rsp + 0x60]
mov edx, 1
movsxd r8, eax
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_fwrite]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.msvcrt.dll_ferror]
nop dword [rax + rax]
test eax, eax
je 0x14000b401
lea rdx, str.Write_failed_copying__1__2_to__3
jmp 0x14000b499
lea rdx, str.Read_failed_copying__1__2_to__3
mov rcx, qword [rsp + 0x80]
lea r8, str._s_s_s
mov qword [rsp + 0x28], r12
mov r9, r13
mov qword [rsp + 0x20], r14
call fcn.1400081b0
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test r15, r15
je 0x14000b3a2
mov rcx, r15
call qword [sym.imp.msvcrt.dll_fclose]
nop dword [rax + rax]
jmp 0x14000b3a2
mov rdx, qword [rsp + 0x80]
mov rcx, rdi
call fcn.140008514
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov eax, 1
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000d580
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov dword [rax + 0x18], r8d
push rdi
push r14
push r15
sub rsp, 0x20
xor r8d, r8d
mov edx, 0x8000
mov rsi, r9
mov rdi, rcx
call qword [sym.imp.msvcrt.dll__open]
nop dword [rax + rax]
mov r15d, eax
cmp eax, 0xffffffff
jne 0x14000d5de
lea rdx, str.Could_not_open_file__1
lea r8, [0x140010c00]
mov r9, rdi
mov rcx, rsi
call fcn.1400081b0
xor eax, eax
jmp 0x14000d6be
mov ecx, 0x438
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x14000d600
lea rdx, str.Out_of_memory_opening_file:__1
jmp 0x14000d5c5
mov ecx, 0x1000
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov qword [rbx + 0x10], rax
mov rbp, rax
test rax, rax
jne 0x14000d62e
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
jmp 0x14000d5f7
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__strdup]
nop dword [rax + rax]
mov qword [rbx], rax
mov r14, rax
test rax, rax
jne 0x14000d659
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
jmp 0x14000d61d
and qword [rbx + 0x20], 0
lea rdx, [rsp + 0x50]
and dword [rbx + 0x28], 0
mov r8d, 3
and dword [rbx + 0x2c], 0
mov ecx, r15d
and dword [rbx + 0x34], 0
mov dword [rbx + 8], r15d
mov dword [rbx + 0xc], 0x1000
mov qword [rbx + 0x18], rbp
mov dword [rbx + 0x30], 1
call qword [sym.imp.msvcrt.dll__read]
nop dword [rax + rax]
cmp eax, 3
jne 0x14000d6d8
cmp byte [rsp + 0x50], 0xef
jne 0x14000d6d8
cmp byte [rsp + 0x51], 0xbb
jne 0x14000d6d8
cmp byte [rsp + 0x52], 0xbf
jne 0x14000d6d8
mov dword [rbx + 0x34], 1
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
xor r8d, r8d
xor edx, edx
mov ecx, r15d
call qword [sym.imp.msvcrt.dll__lseek]
nop dword [rax + rax]
cmp eax, 0xffffffff
jne 0x14000d6bb
mov rcx, r14
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
jmp 0x14000d5be
Function at 0x14000e4f0
Capabilities:
Access peb ldr_data

Disassembly:
push r12
push r14
push r15
sub r12, r12
add r12, 0x60
mov r14, qword gs:[r12]
push r11
mov r11, qword [r14 + 0x10]
add r14, 0x18
mov r15, qword [r14]
mov r12, r15
add r12, 0x10
mov r14, qword [r12]
push rax

Function at 0x14000e86c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000e8b8
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000e8b0
cmp dword [rcx + 0x3c], edx
jl 0x14000e8b0
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14000e8b0
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14000e8b8
mov rax, rdx
add rsp, 0x18
ret
Function at 0x180004710
Capabilities:
Delete file

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r15
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rcx, qword [0x18000da88]
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
sub rax, rcx
cmp rax, 4
jb 0x1800048ad
cmp qword [0x18000da90], 0xf
lea rdi, [0x18000da78]
mov qword [r11 - 0x38], 4
lea r15, str.lock
mov qword [r11 - 0x40], r15
mov r9, rdi
cmova r9, qword [0x18000da78]
mov qword [r11 - 0x48], rcx
lea rcx, [rbp - 0x20]
call fcn.180006a54
cmp qword [rbp - 8], 0xf
lea rcx, [rbp - 0x20]
cmova rcx, qword [rbp - 0x20]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x1800047d4
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800047cf
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800047cf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180006ee0
mov rax, qword [0x18000da88]
sub rbx, rax
cmp rbx, 4
jb 0x1800048a7
cmp qword [0x18000da90], 0xf
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x30], 4
cmova rdi, qword [0x18000da78]
mov r9, rdi
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call fcn.180006a54
cmp qword [rbp - 8], 0xf
lea rcx, [rbp - 0x20]
mov eax, 2
mov edx, 0x80000000
cmova rcx, qword [rbp - 0x20]
xor r9d, r9d
and qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdx, qword [rbp - 8]
mov rbx, rax
cmp rdx, 0xf
jbe 0x18000488a
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004885
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180004885
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180006ee0
lea r11, [rsp + 0x60]
cmp rbx, 0xffffffffffffffff
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
setne al
mov r15, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.1800012bc
int3
call fcn.1800012bc
int3
Function at 0x180004da0
Capabilities:
Create process on windows
Create thread

Disassembly:
sub rsp, 0x68
cmp edx, 1
jne 0x180004edd
call fcn.180004710
test al, al
je 0x180004edd
xor r9d, r9d
lea r8, str.TeamsJack
lea rdx, str.created_by_d15c0rdh4ckr_ndiscord.gg_aluminum
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r9d, 4
lea r8, str.TeamsJack
lea rdx, str.start_app:
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
je 0x180004eac
mov rcx, qword [0x18000daa8]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0x10
jb 0x180004ee7
cmp qword [0x18000dab0], 0xf
lea rax, [0x18000da98]
mov qword [rsp + 0x30], rcx
lea r9, str.taskkill__f__im
cmova rax, qword [0x18000da98]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x10
call fcn.180006a54
cmp qword [rsp + 0x58], 0xf
lea rcx, [rsp + 0x40]
cmova rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x180004edd
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004ea5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180004ea5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180006ee0
jmp 0x180004edd
call fcn.180003d1c
test al, al
je 0x180004edd
and qword [rsp + 0x28], 0
lea r8, [0x180004af8]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x68
ret
call fcn.1800012bc
int3

Function at 0x180005200
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x180005230
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1800052a8
mov rax, qword [rcx + 0x40]
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x180005247
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x180005249
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1800052a2
test ecx, ecx
jle 0x180005282
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1800052a2
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1800052a2
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1800052c4
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1800052e4
xor eax, eax
jmp 0x1800053cd
cmp qword [rcx + 0x68], 0
je 0x1800052f6
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x1800053cd
mov rax, qword [rcx + 0x38]
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x18000530d
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18000530f
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180005341
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rdi, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1800053c7
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x180005378
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x1800053a2
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rdi, rax
cmp rax, rbx
jne 0x1800053c7
cmp rdi, rbx
ja 0x18000537f
test rdi, rdi
je 0x1800053c7
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rbp, rdi
mov rax, rbp
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180005774
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x18000d040]
xor rax, rsp
mov qword [rbp - 8], rax
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x1800057ad
xor eax, eax
jmp 0x1800058cd
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x1800057e7
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
mov rcx, r8
add rcx, qword [rax]
cmp qword [rax], rcx
jae 0x1800057e7
lea ecx, [r8 - 1]
mov eax, esi
mov dword [rdx], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], sil
jmp 0x1800058cd
cmp qword [rbx + 0x80], 0
je 0x1800058cb
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x180005822
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180005843
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, edi
jmp 0x1800058c8
lea rax, [rbp - 0x40]
mov byte [rbp - 0x30], sil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x2f]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x30]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180005891
sub eax, 1
je 0x180005891
cmp eax, 2
jne 0x1800058cb
movsx ecx, byte [rbp - 0x30]
jmp 0x18000582f
mov r14, qword [rbp - 0x40]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x1800058bc
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r14, rax
jne 0x1800058cb
lea rax, [rbp - 0x30]
mov byte [rbx + 0x71], 1
cmp qword [rbp - 0x38], rax
cmovne edi, esi
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180006ec0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180005dd0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x18000d040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180005e3f
cmp byte [rcx + 0x71], 0
je 0x180005e3f
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x180005e94
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180005e59
sub eax, 1
je 0x180005e5d
cmp eax, 2
jne 0x180005e94
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180006ec0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180005e8b
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x180005e94
cmp byte [rbx + 0x71], 0
sete al
jmp 0x180005e41
xor al, al
jmp 0x180005e41