joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400025e8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002632
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002632
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002632
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002632
cmp dword [rcx + 0x84], 0xe
jbe 0x140002632
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002634
xor al, al
add rsp, 0x28
ret

Function at 0x1400061b4
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140006013
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006013
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140006013
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140006013
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140006013
cmp dword [rcx + 0x84], 0xe
jbe 0x140006013
cmp dword [rcx + 0xf8], 0
je 0x140006013
mov ecx, ebx
call fcn.1400060d0
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140005ea0
nop
cmp dword [rbp + 0x20], 0
je 0x140006061
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000606c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140005fa4

Function at 0x14001191c
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0xe0
mov qword [rbp - 9], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x14002a008]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rsi, r8
mov qword [rbp - 0x49], r8
movsxd r14, edx
mov rbx, rcx
mov r13, qword [rbp + 0x7f]
mov qword [rbp - 0x51], r13
mov rcx, r14
mov qword [rbp - 0x19], rcx
mov rax, r14
sar rax, 6
mov qword [rbp - 0x59], rax
lea rdx, [0x140000000]
and ecx, 0x3f
mov qword [rbp - 0x11], rcx
lea r15, [rcx + rcx*8]
mov rax, qword [rdx + rax*8 + 0x2b790]
mov rax, qword [rax + r15*8 + 0x28]
mov qword [rbp - 0x29], rax
mov r12d, r9d
add r12, r8
mov qword [rbp - 0x71], r12
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov dword [rbp - 0x61], eax
xor edi, edi
cmp byte [r13 + 0x28], dil
jne 0x1400119bc
mov rcx, r13
call fcn.14000ba10
mov rcx, qword [r13 + 0x18]
mov r8d, dword [rcx + 0xc]
mov dword [rbp - 0x5d], r8d
xor eax, eax
mov qword [rbx], rax
mov dword [rbx + 8], eax
cmp qword [rbp - 0x49], r12
jae 0x140011d7c
mov rax, r14
sar rax, 6
mov qword [rbp - 0x21], rax
mov edx, edi
Function at 0x140040da0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x14004dd08], rbx
je 0x140040e07
cmp rax, rbx
jne 0x140040dfa
mov ebx, 1
mov esi, ebx
jmp 0x140040e0c
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x140040ddf
mov ebx, 1
mov eax, dword [0x14004dd10]
cmp eax, ebx
jne 0x140040e24
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x140040e90
mov eax, dword [0x14004dd10]
test eax, eax
jne 0x140040e85
mov dword [0x14004dd10], ebx
lea r15, [0x140044330]
lea rdi, [0x140044318]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x140040e77
test eax, eax
jne 0x140040e7b
cmp qword [rdi], r14
je 0x140040e6c
mov rax, qword [rdi]
mov rcx, qword [0x1400442d8]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x140040e4e
test eax, eax
je 0x140040e8b
mov eax, 0xff
jmp 0x140040fe6
mov dword [0x14004d384], ebx
mov edi, 0x1f
mov eax, dword [0x14004dd10]
cmp eax, ebx
jne 0x140040eb7
lea rdx, [0x140044310]
lea rcx, [0x1400442e0]
call sub.msvcrt.dll__initterm
mov dword [0x14004dd10], 2
test esi, esi
jne 0x140040ec5
mov rax, r14
xchg qword [0x14004dd08], rax
cmp qword [0x14004dd28], r14
je 0x140040ef8
lea rcx, [0x14004dd28]
call fcn.140041400
test eax, eax
je 0x140040ef8
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14004dd28]
mov r9, qword [0x1400442d8]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x140040f11
mov eax, 0xff
jmp 0x140040fe6
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x140040f97
test ax, ax
je 0x140040f2c
test edx, edx
jne 0x140040f97
sub ax, bx
cmp ax, di
ja 0x140040f42
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x140040f2c
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400024cc
mov dword [0x14004d380], eax
cmp dword [0x14004d3a0], r14d
jne 0x140040f80
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14004d384], r14d
jne 0x140040f95
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14004d380]
jmp 0x140040fe6
cmp ax, 0x22
jne 0x140040fab
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x140040f1a
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call 0x1401c0000
add rsp, 0x28
jmp 0x140040da0
Function at 0x1400026d0
Capabilities:
Create thread
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x10], rdx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov edi, dword [0x1401d53b0]
movsxd rax, dword [reloc.WS2_32.dll_accept]
xor edx, edx
cmp eax, 0x7b
ja 0x140002706
lea rdx, [0x1401d3b20]
mov rdx, qword [rdx + rax*8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
movdqa xmm1, xmmword [0x140165ef0]
movdqu xmmword [rbp - 0x18], xmm1
mov byte [rbp - 0x28], 0
test rdx, rdx
jne 0x140002772
mov dword [rbp - 0x40], 0x23292110
mov dword [rbp - 0x3c], 0x1693c24
mov dword [rbp - 0x38], 0x100352e
xor ecx, ecx
nop word [rax + rax]
lea eax, [rcx + 0x43]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xa
jb 0x140002740
mov byte [rbp - 0x35], 0
lea rax, [rbp - 0x40]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140002762
lea rdx, [rbp - 0x40]
jmp 0x14000278a
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140002780
lea rcx, [rbp - 0x28]
call fcn.14001a420
cmp edi, 1
jne 0x1400027f9
movdqa xmm0, xmmword [0x140166010]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x30], Ordinal_60
mov byte [rbp - 0x2e], dil
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x43]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x11
jb 0x1400027c0
mov byte [rbp - 0x2e], 0
lea rax, [rbp - 0x40]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400027e0
mov r8, rbx
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x28]
call fcn.14001a420
mov dword [rbp + 0x18], 0x42f00000
mov dword [rbp + 0x1c], 0x41a00000
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0xf
cmova rcx, qword [rbp - 0x28]
lea rdx, [rbp + 0x18]
call fcn.1400538d0
test al, al
je 0x140002848
test edi, edi
jne 0x140002848
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140002680]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x140002886
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002881
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002881
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012e890
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140005170
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x1080
call fcn.14012f3a0
sub rsp, rax
mov eax, dword [0x1401d5280]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], eax
xor esi, esi
xor eax, eax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x48], rax
mov rdi, rcx
mov rcx, qword [0x1401d5278]
lea rax, [rsp + 0x40]
mov ebx, edx
lea r9d, [rsi + 0x10]
mov qword [rsp + 0x30], rsi
mov edx, 0x7ab6fbbc
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, ebx
sar eax, 0x10
lea ecx, [rax*8 + 0x10]
mov rax, qword [rsp + 0x48]
add rax, 0xad44840
add rcx, rax
call fcn.14001aae0
movzx ecx, bx
lea r8, [rsp + 0x870]
mov r9d, 0x808
lea rdx, [rax + rcx*4]
call fcn.1400025f0
lea rcx, [rsp + 0x60]
mov r8d, 0x808
lea rdx, [rsp + 0x870]
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [0x1401d5270]
call fcn.14001aae0
mov qword [rsp + 0x1090], rax
movzx r9d, si
movzx eax, word [rsp + 0x874]
shr ax, 1
cmp si, ax
jae 0x140005295
nop word [rax + rax]
movzx ecx, r9w
lea r8, [rsp + 0x66]
add r8, rcx
movzx ecx, r9b
and ecx, 3
inc r9w
movzx edx, byte [rsp + rcx + 0x1090]
xor dl, byte [r8]
xor dl, al
mov byte [r8], dl
movzx eax, word [rsp + 0x64]
shr ax, 1
cmp r9w, ax
jb 0x140005260
xorps xmm0, xmm0
lea rax, [rsp + 0x66]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov r8, 0xffffffffffffffff
mov qword [rdi + 0x18], rsi
nop
inc r8
cmp byte [rax + r8], sil
jne 0x1400052b0
lea rdx, [rsp + 0x66]
mov rcx, rdi
call fcn.14001b970
lea r11, [rsp + 0x1080]
mov rax, rdi
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14000ae10
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x38
mov rcx, qword [0x1401d52d0]
test rcx, rcx
je 0x14000af03
lea rdx, [0x1401d5408]
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [0x1401d52d0]
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [rsp + 0x40]
mov dword [0x1401d5408], eax
mov eax, dword [rsp + 0x44]
mov dword [0x1401d540c], eax
mov eax, dword [0x1401d5410]
mov dword [0x1401d54e4], eax
mov eax, dword [0x1401d5414]
mov dword [0x1401d54d8], eax
mov rax, qword [0x1401d5860]
test rax, rax
jne 0x14000aea0
nop dword [rax + rax]
lea rdx, str.MedalOverlay
lea rcx, str.MedalOverlayClass
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x1401d5860], rax
test rax, rax
je 0x14000ae80
xor ecx, ecx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x24], rcx
mov rcx, rax
mov qword [rsp + 0x20], 0xffffffffffffffff
mov qword [rsp + 0x28], 0xffffffffffffffff
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, qword [0x1401d5860]
mov r9d, 2
mov r8b, 0xff
xor edx, edx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov rcx, qword [0x1401d5860]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1401d5860]
call qword [sym.imp.USER32.dll_UpdateWindow]
add rsp, 0x38
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140014fe0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x300
mov rbx, rcx
xor edi, edi
lea rcx, [rsp + 0x40]
call fcn.140017650
nop
mov r8, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140015012
mov r8, qword [rbx]
mov r9, qword [rbx + 0x10]
add r9, r8
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140019970
nop
lea rcx, [rsp + 0x40]
call fcn.140017560
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140015070
mov dword [rsp + 0xc0], 0x238
lea rdx, [rsp + 0xc0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x1400150ba
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x14001517b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015176
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400151e9
jmp 0x140015176
mov rbp, qword [rsp + 0x38]
mov r14, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x20]
nop dword [rax]
lea rcx, [rsp + 0xec]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400150e0
lea r8, [rsp + 0x20]
cmp rbp, 7
cmova r8, rbx
cmp r14, rax
jne 0x140015198
mov rdx, r14
lea rcx, [rsp + 0xec]
test r14, r14
je 0x140015134
lea rax, [rsp + 0xec]
sub r8, rax
nop dword [rax + rax]
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x140015198
add rcx, 2
sub rdx, 1
jne 0x140015120
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [rsp + 0xc8]
cmp rbp, 7
jbe 0x14001517b
lea rdx, [rbp*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140015173
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400151e9
mov rcx, rbx
call fcn.14012e890
test edi, edi
setne al
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
lea rdx, [rsp + 0xc0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400150d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rbp, 7
jbe 0x14001517b
lea rdx, [rbp*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140015173
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140015173
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140015dd0
Capabilities:
Execute command

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x14015e25c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 5
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x14015e260]
call fcn.140001ca0
lea rcx, str._n
call fcn.140001ca0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.__________________Selecione_uma_opcao:_____________________n
call fcn.140001ca0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 5
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._n_n
call fcn.140001ca0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
cmp qword [rbx + 0x10], 0
lea rcx, [0x14015de24]
je 0x140015f12
call fcn.140001ca0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, reloc.WS2_32.dll_ntohl
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x14015e328]
call fcn.140001ca0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x14015e32c]
call fcn.140001ca0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
cmp qword [rbx + 0x18], 0xf
jbe 0x140015efe
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, str._Status:__s_n
add rsp, 0x20
pop rbx
jmp fcn.140001ca0
call fcn.140001ca0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x14015e328]
call fcn.140001ca0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x14015e32c]
call fcn.140001ca0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._Inserir_Key:
add rsp, 0x20
pop rbx
jmp fcn.140001ca0
Function at 0x140017de0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140017e08
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140017e2e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140017e30
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140017e89
test ecx, ecx
jle 0x140017e69
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140017e89
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140017e89
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x140017eb0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140017ee1
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x140017eff
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140017f1b
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140017f1d
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140017f59
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140017fee
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140017f94
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140017fce
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140017fee
cmp rbx, rax
ja 0x140017fa0
test rbx, rbx
je 0x140017fee
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140018430
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140018454
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x140018497
mov rdx, qword [rbx + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x140018497
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov eax, edi
mov byte [rdx], dil
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x80], rsi
je 0x1400185c8
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400184da
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140018505
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x1400185cd
lea rax, [rsp + 0x90]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14001857a
sub eax, 1
je 0x14001857a
cmp eax, 2
jne 0x1400185c8
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x1400185cd
mov rsi, qword [rsp + 0x90]
lea rax, [rsp + 0x48]
sub rsi, rax
je 0x1400185ab
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400185c8
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x98], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400185cd
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x140019f20
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140019fe9
cmp byte [rcx + 0x71], 0
je 0x140019fe9
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x140019fdc
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140019f98
sub eax, 1
je 0x140019f9c
cmp eax, 2
jne 0x140019fdc
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x140019fca
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140019fdc
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret