joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45bbe0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45bc8f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [sym.runtime.callers.func1]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x00608800]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp sym.runtime.callers

Function at 0x466580
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x006085ec], 0
je 0x46658e
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback

Function at 0x4665a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x006085ec], 0
je 0x4665b5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback

Function at 0x4665c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x006085ec], 0
je 0x4665f5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00608c00]
aesenc xmm0, xmmword [0x00608c10]
aesenc xmm0, xmmword [0x00608c20]
movq rax, xmm0
ret
jmp sym.runtime.memhash32Fallback

Function at 0x466600
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x006085ec], 0
je 0x466636
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00608c00]
aesenc xmm0, xmmword [0x00608c10]
aesenc xmm0, xmmword [0x00608c20]
movq rax, xmm0
ret
jmp sym.runtime.memhash64Fallback
Function at 0x467ca0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
xorps xmm15, xmm15
xor r14, r14
mov rax, qword [0x00608800]
mov rax, qword gs:[rax]
cmp rax, 0
je 0x467d3b
mov r14, qword [rax]
sub rsp, 0x10
mov rax, rcx
mov rbx, rdx
call sym.runtime.sigtrampgo
add rsp, 0x10
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
pop rbp
ret

Function at 0x467f60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
mov rax, qword [0x00608800]
mov rax, qword gs:[rax]
cmp rax, 0
jne 0x467ff7
int 3
mov r14, qword [rax]
sub rsp, 0x28
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], r9
call sym.runtime.sehhandler.abi0
mov eax, dword [rsp + 0x20]
add rsp, 0x28
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
add rsp, 0x28
pop rbp
ret
Function at 0x4683c0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x4683f4
mov rcx, 0x28
jmp 0x4683ff
shl rcx, 3
add rcx, 0x1480
mov qword [0x00608800], rcx
pop rbp
ret
Function at 0x482960
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x482a2a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x00608800]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x482a0f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004b2780]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x4829fe
mov edi, 1
lea rsi, [0x004b2780]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004f45d8]
lea rsi, [0x004f3ca8]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString

Function at 0x4a2440
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a2b7f
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x4a246d
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x4a26f1
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x4a271d
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x004f5c80]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x004b2680]
lea rbx, [0x004f4430]
call sym.runtime.gopanic
inc rax
cmp rax, r8
jge 0x4a2742
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x4a2777
lea rdi, [0x004b2700]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x4a2463
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x4a275b
jmp 0x4a2730
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.internal_bisect.Hash

Function at 0x4a2d20
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4a2d37
inc rax
cmp rax, 4
jge 0x4a2d4f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4a2d34
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4a2d60
inc rax
cmp rax, 4
jge 0x4a2d6e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4a2d97
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4a2d7b
jmp 0x4a2d5d
Function at 0x14000c43c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140014c60], rbx
je 0x14000c4a3
cmp rax, rbx
jne 0x14000c496
mov ebx, 1
mov esi, ebx
jmp 0x14000c4a8
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000c47b
mov ebx, 1
mov eax, dword [0x140014c68]
cmp eax, ebx
jne 0x14000c4c0
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14000c52c
mov eax, dword [0x140014c68]
test eax, eax
jne 0x14000c521
mov dword [0x140014c68], ebx
lea r15, [0x14000eba0]
lea rdi, [0x14000eb88]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14000c513
test eax, eax
jne 0x14000c517
cmp qword [rdi], r14
je 0x14000c508
mov rax, qword [rdi]
mov rcx, qword [0x14000eb40]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000c4ea
test eax, eax
je 0x14000c527
mov eax, 0xff
jmp 0x14000c682
mov dword [0x1400143e4], ebx
mov edi, 0x1f
mov eax, dword [0x140014c68]
cmp eax, ebx
jne 0x14000c553
lea rdx, [0x14000eb80]
lea rcx, [0x14000eb48]
call sub.msvcrt.dll__initterm
mov dword [0x140014c68], 2
test esi, esi
jne 0x14000c561
mov rax, r14
xchg qword [0x140014c60], rax
cmp qword [0x140014c80], r14
je 0x14000c594
lea rcx, [0x140014c80]
call fcn.14000ca70
test eax, eax
je 0x14000c594
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140014c80]
mov r9, qword [0x14000eb40]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000c5ad
mov eax, 0xff
jmp 0x14000c682
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14000c633
test ax, ax
je 0x14000c5c8
test edx, edx
jne 0x14000c633
sub ax, bx
cmp ax, di
ja 0x14000c5de
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14000c5c8
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001878
mov dword [0x1400143e0], eax
cmp dword [0x140014400], r14d
jne 0x14000c61c
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400143e4], r14d
jne 0x14000c631
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400143e0]
jmp 0x14000c682
cmp ax, 0x22
jne 0x14000c647
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000c5b6
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.14014a000
add rsp, 0x28
jmp 0x14000c43c
Function at 0x140c16a25
Capabilities:
Authenticate hmac

Disassembly:
mov r8, qword [rsp + rcx*4 + 0x10]
mov qword [rsp + rcx*4 + 0x10], 0xffffffffeaa5c19a
movsxd rdi, edi
xor r10, qword [rsp + rcx*2 + 0x10]
cdqe
cbw
adc r9, rdi
call fcn.140c2279a

Function at 0x140c210f3
Capabilities:
Encode data using base64

Disassembly:
or r9w, r9w
lea ebp, [rdx + rbp + 0x7d1709ac]
lea r9, [rcx*8 - 0x43fb1b66]
push rdi
push rax
sbb r9, rdx
sub r9, rcx
push r11
shl rcx, 0x5c
lea r9, [r9 + rcx*4 - 0x6b40c6ef]
btc rdx, rdx
adc rbp, r8
movzx r8d, dl
add rbp, r10
mov qword [rsp + rdx*2 + 0x76], rsi
xor rcx, rdx
mov eax, r9d
mov qword [rsp + rdx*2 + 0x7e], rbx
movsx esi, r9w
push rsi
neg byte [rsp + rcx*8 - 3]
lea r11, [rsp + rdx*4 + 4]
lea r9, [r11 + rdx*8 - 0x238]
and r9b, 0xf0
mov rsp, r9
movzx ecx, sil
mov r10d, dword [rdx + rbp - 0x6f88]
xor r10d, r8d
shl sil, 0xc2
ror r10d, 1
push rsi
inc r10d
sar byte [rsp + rax*2 - 0x761cdf0b], 0x87
movzx edi, si
cwde
not r10d
bts eax, 0x87
pop rdx
shr rdi, 0xb4
lea r10d, [r10 + rax + 0x3eafdfb3]
cwde
lea rbx, [rdx*4 + 0x57ab6980]
not cl
ror r10d, 1
bt ebx, 0xae
sbb dil, al
inc r10d
and dx, cx
xchg cx, di
dec esi
push r8
xor dword [rsp + rsi - 0x1f], r10d
sal ecx, cl
cwd
add rdx, rbx
movsx eax, sil
not eax
xor ecx, r8d
dec ecx
mov ebx, 0x873cbc2c
or bx, si
imul bl
xor ecx, 0xe31a88a9
xor rax, rsi
js 0x140c0c157
sbb ecx, 0x4dafbe96
cdqe
mov edi, eax
bswap esi
bswap ecx
rol dil, 0x46
not ecx
lea r10, [rax + 0x3d203e05]
push r8
mov r8d, edi
xor dword [rsp + rax - 0x408c9a14], ecx
sar al, 0x67
sal al, 0xc1
and dil, 0xb3
pop r8
dec bl
add r10w, 0x3b2f
xor dil, dil
movsxd rcx, ecx
movzx edx, si
shr rax, 0x18
call fcn.140c151d3
mov eax, 0xe8908a06
rol esi, 3
xchg al, dil
lea esi, [rdx + rsi - 0x71f02b8]
mov qword [rsp + rdi + 2], r8
mov r10d, dword [rsp + rdi - 4]
mov qword [rsp + rdi - 6], 0xffffffffd0b5b7b2
movsx r8d, di
xor dword [rsp + rdi + 2], esi
push rcx
neg dword [rsp + rdi + 4]
mov r8, qword [rsp + rdi*2 + 4]
xadd edx, eax
shl di, 0x4f
movsxd rsi, esi
add r9, rsi
mov qword [rsp + rdi], r9
ret 0x10
push r8
push rcx
mov r8d, 0x1e83f899
rol r8, 0xac
push r12
movabs r8, 0
xor r9d, r9d
push rdx
push r8
mov edx, r9d
adc bp, r9w
sal dl, 0xa3
mov ebp, dword [rsp + r9*2 + 0x68]
movsx ecx, r9w
lea r9, [r9 + rdx*4 - 0x514f9668]
inc ebp
bswap ebp
dec r9b
shl rcx, 0xb8
sar r9w, 0x6f
ror ebp, 1
bt ecx, ecx
neg ebp
bt rdx, rdx
jae 0x140bec39e
mov qword [rsp + rcx - 0xf463], rdi
rol ebx, cl
dec ebx
lea rcx, [rdx*4 + 0x48351d1e]
mov qword [rsp + rcx - 0x4837f512], r8
mul ecx
lea r8, [rax + rdi - 0x68e6705d]
xor dword [rsp + rax - 0x619e6326], ebx
inc byte [rsp + rcx - 0x4837f525]
mov r8, qword [rsp + rcx - 0x4837f512]
bts r10w, 0x9a
movsxd rbx, ebx
jb 0x140c21806
mov ecx, 0xd394e205
movsx eax, cx
sub rbp, 4
call fcn.140c1b857
lea r11, [rax + r11 - 0x3b0e6f84]
mov dword [r11 + rdx - 0x6f88], ebx
lea rbp, [rbp + rdx - 0x6f8c]
jno 0x140bf49d6
mov ecx, 0x408c7890
lea rbp, [rbp + rcx - 0x408c7894]
mov esi, ecx
mov ecx, dword [rsi + rbp - 0x408c7890]
jmp 0x140c082c3
add r9, rbx
mov qword [rsp + rax - 0x619e6326], 0x3cab0aa4
push rdi
neg rdi
mov qword [rsp + rcx - 0x4837f52a], r9
ret 0x20
Function at 0x140005730
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400d3280]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140005803
cmp byte [rcx + 0x71], 0
je 0x140005803
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x1400057ff
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400057c4
sub eax, 1
je 0x1400057c8
cmp eax, 2
jne 0x1400057ff
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400a4d40
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400057f6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400057ff
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400057ac
xor al, al
jmp 0x1400057ac
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400a4d40
add rsp, 0x60
pop rbx
ret
Function at 0x1400093f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1400d3280]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x14000941d
xor eax, eax
jmp 0x140009586
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x14000945d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x14000945d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x14000957e
cmp qword [rdi + 0x80], 0
je 0x140009579
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x140009497
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x1400094c2
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14000957e
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140009531
sub eax, 1
je 0x140009531
cmp eax, 2
jne 0x140009579
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14000957e
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x14000955f
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x140009579
lea rax, [rsp + 0x50]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x14000957e
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400a4d40
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140009ac0
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
sub rsp, 0x20
xor eax, eax
mov word [rsp + 0x32], cx
mov ecx, 0xfffffff5
mov word [rsp + 0x30], ax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, dword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov ecx, 0xfffffff5
mov ebx, 0xa
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 0xfffffff5
mov ebx, 7
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
Function at 0x140011670
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0xd0
mov rax, qword [0x1400d3280]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, rcx
mov qword [r11 - 0x38], rcx
mov r8, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
mov rax, rcx
sub rax, r8
xor r15d, r15d
cmp rax, 3
jb 0x14001173f
lea rax, [r8 + 3]
mov qword [rbx + 0x10], rax
mov rdi, rbx
cmp rcx, 0xf
jbe 0x1400116d3
mov rdi, qword [rbx]
lea rax, [0x1400aa64b]
mov r14d, 3
lea rsi, [0x1400aa648]
cmp rax, rdi
jbe 0x140011707
lea rax, [rdi + r8]
cmp rsi, rax
ja 0x140011707
cmp rdi, rsi
ja 0x1400116ff
mov rbp, r15
jmp 0x14001170a
mov rbp, rdi
sub rbp, rsi
jmp 0x14001170a
mov rbp, r14
inc r8
lea rcx, [rdi + 3]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
sub r14, rbp
lea rdx, [rsi + 3]
add rdx, rbp
lea rcx, [rdi + rbp]
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14001176a
mov r14d, 3
mov qword [rsp + 0x28], r14
lea rsi, [0x1400aa648]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
movzx r8d, byte [rsp + 0x30]
mov edx, r14d
mov rcx, rbx
call fcn.140002ea0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
mov dword [rsp + 0x40], reloc.WS2_32.dll_WSASetLastError
mov dword [rsp + 0x44], 0x40
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r15
lea rax, str.cmd.exe
mov qword [rsp + 0x58], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400117cc
mov rax, qword [rbx]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], r15d
mov qword [rsp + 0x78], r15
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x140011802
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14001185d
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140011858
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140011899
mov rcx, r8
call fcn.1400a49e0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400a4d40
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3