joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc550070
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc551150
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc550a72
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc573108]
test eax, eax
je 0x2fc550b0a
lea rax, [0x2fc5730e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc573110]
mov qword [rbp - 8], rax
jmp 0x2fc550aee
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc550ae2
cmp qword [rbp - 0x10], 0
je 0x2fc550ae2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc550aa8
lea rax, [0x2fc5730e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc550b0b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc550c10
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc550c38
mov eax, 0
jmp 0x2fc550c86
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc550c61
mov eax, 0
jmp 0x2fc550c86
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc550c81
mov eax, 0
jmp 0x2fc550c86
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc550c8c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc550d0a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc550d01
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc550d01
mov rax, qword [rbp - 8]
jmp 0x2fc550d1f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc550cd4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc529eb0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc52af90
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc52a8b2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc54d108]
test eax, eax
je 0x2fc52a94a
lea rax, [0x2fc54d0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc54d110]
mov qword [rbp - 8], rax
jmp 0x2fc52a92e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc52a922
cmp qword [rbp - 0x10], 0
je 0x2fc52a922
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc52a8e8
lea rax, [0x2fc54d0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc52a94b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc52aa50
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc52aa78
mov eax, 0
jmp 0x2fc52aac6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc52aaa1
mov eax, 0
jmp 0x2fc52aac6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc52aac1
mov eax, 0
jmp 0x2fc52aac6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc52aacc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc52ab4a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc52ab41
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc52ab41
mov rax, qword [rbp - 8]
jmp 0x2fc52ab5f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc52ab14
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400061e7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov r10, qword [rsp + 0x68]
mov r11, qword [rsp + 0x60]
mov rax, qword [rsp + 0x58]
mov esi, ecx
shr esi, 8
lea r8, [rdx + r8*2]
xor edi, edi
cmp rdx, r8
je 0x140006263
lea rbx, [rdx + 2]
movzx r15d, byte [rdx + 1]
lea r14, [rdi + r15]
cmp byte [rdx], sil
jne 0x140006243
cmp rdi, r14
ja 0x1400062a0
cmp r14, rax
ja 0x1400062a0
add rdi, r9
xor edx, edx
cmp r15, rdx
je 0x14000624d
lea r12, [rdx + 1]
cmp byte [rdi + rdx], cl
mov rdx, r12
jne 0x140006230
jmp 0x140006255
mov rdx, rbx
mov rdi, r14
jbe 0x14000620a
jmp 0x140006263
mov rdx, rbx
mov rdi, r14
jmp 0x14000620a
xor eax, eax
and al, 1
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
movzx ecx, cx
add r10, r11
mov al, 1
cmp r11, r10
je 0x140006257
lea r8, [r11 + 1]
movzx edx, byte [r11]
test dl, dl
js 0x140006281
mov r11, r8
jmp 0x140006298
cmp r8, r10
je 0x1400062a0
and edx, 0x7f
shl edx, 8
movzx r8d, byte [r11 + 1]
add r11, 2
or edx, r8d
sub ecx, edx
js 0x140006257
xor al, 1
jmp 0x14000626b
ud2
Function at 0x14001a222
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov ecx, 0x10
call fcn.14001a1c1
mov rsi, rax
mov qword [rax], rbx
mov qword [rax + 8], rdi
and qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x14001a2ad]
xor ecx, ecx
mov rdx, r14
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdi, rax
mov rdx, rax
test rax, rax
jne 0x14001a29b
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
call qword [rax]
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140019138
mov rcx, rsi
call fcn.140007545
call fcn.14001824c
mov rdx, rax
xor eax, eax
test rdi, rdi
sete al
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400281db
Capabilities:
Hash data using fnv

Disassembly:
mov eax, 0x811c9dc5
xor edx, edx
cmp rdx, 2
je 0x1400281fb
movzx r8d, byte [rcx + rdx]
inc rdx
xor eax, r8d
imul eax, eax, 0x1000193
jmp 0x1400281e2
ret

Function at 0x14003c054
Capabilities:
Open clipboard

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ecx, ecx
mov rdi, rdx
xor ebx, ebx
call qword [sym.imp.user32.dll_OpenClipboard]
test eax, eax
je 0x14003c0cf
mov rdx, qword [str.text_plain]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14003c0ba
cmp byte [rdi], bl
je 0x14003c0ba
mov rdx, qword [str.image]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x14003c0c7
lea ecx, [rax + 8]
call qword [sym.imp.user32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x14003c0b3
lea ecx, [rax + 0xe]
call qword [sym.imp.user32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x14003c0c7
mov ebx, 1
jmp 0x14003c0c7
mov ecx, 0xd
call qword [sym.imp.user32.dll_IsClipboardFormatAvailable]
mov ebx, eax
call qword [sym.imp.user32.dll_CloseClipboard]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14003ce18
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140139980]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor ecx, ecx
call qword [sym.imp.user32.dll_GetKeyboardLayout]
movzx ecx, ax
mov r9d, 6
lea r8, [rsp + 0x20]
mov edx, 0x1004
call qword [sym.imp.kernel32.dll_GetLocaleInfoA]
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atol]
mov dword [0x140145da0], eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400a6970
add rsp, 0x38
ret

Function at 0x14003cf5c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.1400321d0
test rax, rax
je 0x14003d00b
mov rcx, qword [rax + 0xc8]
test rcx, rcx
je 0x14003cf83
mov rcx, qword [rcx]
call qword [sym.imp.user32.dll_OpenClipboard]
test eax, eax
je 0x14003d00b
call qword [sym.imp.user32.dll_EmptyClipboard]
mov edx, dword [0x140142e64]
xor r9d, r9d
mov rcx, qword [0x140142e58]
xor r8d, r8d
call fcn.140061a6c
mov ebx, eax
lea ecx, [rax*2 + 2]
movsxd rdx, ecx
mov ecx, 0x42
call qword [sym.imp.kernel32.dll_GlobalAlloc]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.kernel32.dll_GlobalLock]
mov edx, dword [0x140142e64]
lea r9d, [rbx + 1]
mov rcx, qword [0x140142e58]
mov r8, rax
call fcn.140061a6c
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, 0xd
call qword [sym.imp.user32.dll_SetClipboardData]
call qword [sym.imp.user32.dll_CloseClipboard]
mov byte [0x140142e71], 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14003e800
Capabilities:
Get socket status

Disassembly:
sub rsp, 0x678
mov rax, qword [0x140139980]
xor rax, rsp
mov qword [rsp + 0x660], rax
and dword [rsp + 0x20], 0
lea rcx, [0x140142e88]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.user32.dll_PeekMessageA]
test eax, eax
je 0x14003e83e
mov eax, 1
jmp 0x14003e893
cmp dword [0x140142f14], 0
jne 0x14003e84b
xor eax, eax
jmp 0x14003e893
and dword [rsp + 0x30], 0
lea rdx, [0x140142f20]
and dword [rsp + 0x34], 0
lea rcx, [rsp + 0x40]
mov r8d, 0x618
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x30]
xor ecx, ecx
lea r9, [rsp + 0x450]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x248]
lea rdx, [rsp + 0x40]
call qword [sym.imp.ws2_32.dll_select]
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.1400a6970
add rsp, 0x678
ret
Function at 0x14003f478
Capabilities:
Get socket status

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x680
movaps xmmword [rax - 0x28], xmm6
mov rax, qword [0x140139980]
xor rax, rsp
mov qword [rsp + 0x660], rax
call fcn.140041970
cmp dword [0x140142f14], 0
movaps xmm6, xmm0
je 0x14003f5b8
and dword [rsp + 0x30], 0
lea rdx, [0x140142f20]
and dword [rsp + 0x34], 0
lea rcx, [rsp + 0x40]
mov r8d, 0x618
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [0x140142f10]
lea rax, [rsp + 0x30]
inc ecx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x450]
lea r8, [rsp + 0x248]
lea rdx, [rsp + 0x40]
call qword [sym.imp.ws2_32.dll_select]
test eax, eax
je 0x14003f5a9
xor ebp, ebp
cmp dword [0x140142f14], ebp
jle 0x14003f5a4
xor esi, esi
mov rax, qword [0x140143538]
lea rdx, [rsp + 0x40]
movsxd r14, dword [rsi + rax]
mov rcx, r14
call sub.ws2_32.dll___WSAFDIsSet
xor ebx, ebx
lea rdx, [rsp + 0x248]
test eax, eax
mov rcx, r14
setne bl
call sub.ws2_32.dll___WSAFDIsSet
movzx edi, bx
lea rdx, [rsp + 0x450]
or di, 4
mov rcx, r14
test eax, eax
cmove di, bx
call sub.ws2_32.dll___WSAFDIsSet
movzx edx, di
or dx, 8
test eax, eax
mov rax, qword [0x140143538]
cmove dx, di
test word [rsi + rax + 4], dx
je 0x14003f592
mov rdx, qword [rsi + rax + 0x10]
mov rcx, r14
call qword [rsi + rax + 8]
inc ebp
add rsi, 0x18
cmp ebp, dword [0x140142f14]
jl 0x14003f51f
xorps xmm6, xmm6
jmp 0x14003f5b8
movsd xmm0, qword [0x14011c638]
minsd xmm0, xmm6
movaps xmm6, xmm0
cmp qword [0x140142c00], 0
jne 0x14003f5cb
cmp dword [0x140142bd0], 0
je 0x14003f5ce
xorps xmm6, xmm6
call fcn.1400321d0
test rax, rax
jne 0x14003f5e7
ucomisd xmm6, qword [0x14011a9f8]
jp 0x14003f5e7
jne 0x14003f5e7
xorps xmm6, xmm6
call qword [fcn.140030f28]
movsd xmm0, qword [0x14011c9c8]
minsd xmm0, xmm6
call fcn.1400602c4
mulsd xmm0, qword [0x14011c9c0]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xff
xor ecx, ecx
addsd xmm0, qword [0x1400a9e48]
cvttsd2si r9d, xmm0
call qword [sym.imp.user32.dll_MsgWaitForMultipleObjects]
call qword [fcn.140030f28]
lea rbx, [0x140142e88]
jmp 0x14003f68a
mov rcx, rbx
call fcn.140032378
test eax, eax
jne 0x14003f68a
mov eax, dword [0x140142e90]
cmp eax, 0x12
jne 0x14003f65d
lea ecx, [rax - 3]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_raise]
mov eax, dword [0x140142e90]
cmp eax, dword [0x140142e84]
jne 0x14003f678
mov rax, qword [0x140142e98]
mov qword [0x140143540], rax
call fcn.14003e7d8
mov rcx, rbx
call qword [sym.imp.user32.dll_TranslateMessage]
mov rcx, rbx
call qword [sym.imp.user32.dll_DispatchMessageW]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.user32.dll_PeekMessageW]
test eax, eax
jg 0x14003f637
call fcn.140048d60
test al, al
jne 0x14003f6b5
call fcn.14003e7d8
call fcn.1400324a8
movsd xmm0, qword [0x1400a9ea8]
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.1400a6970
lea r11, [rsp + 0x680]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140041278
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, 2
mov rbx, r8
mov rdi, rdx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
call fcn.1400419fc
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rdx, rax
mov ecx, 0xa
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x14004cf18
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
movzx edi, r9w
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14004b9f0
or dword [rbx + 0x6c], 0xffffffff
lea rax, vtable.Fl_Anim_GIF_Image.0
mov qword [rbx], rax
xor r14d, r14d
movabs rax, 0x3ff0000000000000
mov qword [rbx + 0x50], r14
mov ecx, 0x90
mov qword [rbx + 0x70], rax
mov word [rbx + 0x58], di
mov qword [rbx + 0x60], rsi
mov word [rbx + 0x68], r14w
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rdx, rax
test rax, rax
je 0x14004cffb
or dword [rax + 0x20], 0xffffffff
lea ecx, [r14 + 0x38]
or dword [rdx + 0x5c], 0xffffffff
mov dword [rax + 0x38], ecx
mov qword [rax], rbx
mov byte [rax + 8], r14b
mov dword [rax + 0xc], r14d
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 1
mov dword [rax + 0x24], 0xff000000
mov qword [rax + 0x28], r14
mov qword [rax + 0x30], r14
mov eax, 0xbf800000
mov dword [rdx + 0x3c], eax
mov dword [rdx + 0x78], eax
mov byte [rdx + 0x40], r14b
mov qword [rdx + 0x42], r14
mov qword [rdx + 0x50], r14
mov dword [rdx + 0x58], r14d
mov dword [rdx + 0x60], 0xff000000
mov qword [rdx + 0x68], r14
mov byte [rdx + 0x70], r14b
mov dword [rdx + 0x74], ecx
mov qword [rdx + 0x7c], r14
mov byte [rdx + 0x84], r14b
mov qword [rdx + 0x88], r14
jmp 0x14004cffe
mov rdx, r14
movzx ecx, word [rbx + 0x58]
xor r9d, r9d
mov eax, ecx
mov qword [rbx + 0x78], rdx
shr ecx, 6
xor r8d, r8d
and ecx, 1
shr eax, 7
and eax, 1
lea eax, [rcx + rax*2]
mov dword [rdx + 0x80], eax
mov rdx, rbp
mov cl, byte [rbx + 0x58]
mov rax, qword [rbx + 0x78]
shr cl, 3
and cl, 1
mov byte [rax + 0x84], cl
mov rcx, rbx
call fcn.14004dc70
mov rcx, rbx
mov byte [rbx + 0x69], al
call fcn.14004d334
test eax, eax
je 0x14004d084
mov rcx, rbx
call fcn.14004d32c
test eax, eax
je 0x14004d084
cmp dword [rbx + 8], r14d
jne 0x14004d084
cmp dword [rbx + 0xc], r14d
jne 0x14004d084
mov rcx, rbx
call fcn.14004d334
mov rcx, rbx
mov dword [rbx + 8], eax
mov dword [rbx + 0x1c], eax
call fcn.14004d32c
mov dword [rbx + 0xc], eax
mov dword [rbx + 0x20], eax
movzx r8d, di
mov rdx, rsi
mov rcx, rbx
call fcn.14004d23c
test dil, 1
jne 0x14004d0a3
mov rcx, rbx
call fcn.14004e780
jmp 0x14004d0a7
mov dword [rbx + 0x6c], r14d
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14005b6c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x140139980]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x14005b846
lea rdx, [0x14011ddf0]
call fcn.140061530
mov rdi, rax
test rax, rax
je 0x14005b846
mov edx, 1
lea rcx, [rsp + 0x30]
mov r9, rax
lea r8d, [rdx + 0x3f]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rdi
mov r14, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14d, r14d
je 0x14005b846
mov r8d, 7
cmp r14d, r8d
jl 0x14005b776
lea rdx, str.define
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14005b776
lea ecx, [rax + 0x50]
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
je 0x14005b7b1
mov rdx, qword [rbx + 0x30]
mov rcx, rax
call fcn.14005bc84
mov rdi, rax
jmp 0x14005b7f1
mov r8d, 9
cmp r14d, r8d
jl 0x14005b7b5
lea rdx, str.__XPM__
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14005b7b5
lea ecx, [rax + 0x50]
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
je 0x14005b7b1
mov rdx, qword [rbx + 0x30]
mov rcx, rax
call fcn.14005beac
jmp 0x14005b771
xor edi, edi
jmp 0x14005b7f1
xor esi, esi
cmp dword [0x140143f20], esi
jle 0x14005b846
xor ebp, ebp
mov rax, qword [0x140143f18]
lea rdx, [rsp + 0x30]
mov rcx, qword [rbx + 0x30]
mov r8d, r14d
call qword [rax + rbp]
mov rdi, rax
test rax, rax
jne 0x14005b7f6
inc esi
add rbp, 8
cmp esi, dword [0x140143f20]
jl 0x14005b7c5
test rdi, rdi
je 0x14005b846
cmp dword [rbx + 0x48], 0
je 0x14005b810
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x14005b810
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0x18]
mov esi, dword [rbx + 0xc]
mov rcx, rbx
mov qword [rbx + 0x40], rdi
mov edi, dword [rbx + 8]
mov dword [rbx + 0x48], 1
call fcn.14005b884
test edi, edi
je 0x14005b846
mov rax, qword [rbx]
xor r9d, r9d
mov r8d, esi
mov dword [rsp + 0x20], 1
mov edx, edi
mov rcx, rbx
call qword [rax + 0x58]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400a6970
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14005db28
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x14005db54
call fcn.14005db28
mov r8, qword [rbx + 0x18]
lea rdx, str._n__s__n_n
mov rcx, rdi
call fcn.14005dde4
xor r15d, r15d
cmp dword [rbx + 0x28], r15d
jle 0x14005dc3c
xor r14d, r14d
mov rax, qword [rbx + 0x20]
mov rcx, rdi
mov rsi, qword [r14 + rax + 8]
mov r8, qword [r14 + rax]
test rsi, rsi
je 0x14005dc1f
lea rdx, [0x14011ffd0]
call fcn.14005dde4
xor ebp, ebp
cmp byte [rsi + rbp], 0
je 0x14005dbad
inc rbp
cmp rbp, 0x3c
jb 0x14005db9e
mov r9, rdi
mov r8d, 1
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
lea rdx, [0x14011ffd4]
mov rcx, rdi
call fcn.14005dde4
jmp 0x14005dc15
xor ebp, ebp
cmp byte [rsi + rbp], 0
je 0x14005dbe4
inc rbp
cmp rbp, 0x50
jb 0x14005dbd5
mov rdx, rdi
mov ecx, 0x2b
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov r9, rdi
mov r8d, 1
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rdx, rdi
mov ecx, 0xa
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add rsi, rbp
cmp byte [rsi], 0
jne 0x14005dbd3
jmp 0x14005dc2b
lea rdx, [0x14011ffd8]
call fcn.14005dde4
inc r15d
add r14, 0x10
cmp r15d, dword [rbx + 0x28]
jl 0x14005db77
mov rcx, qword [rbx]
test rcx, rcx
je 0x14005dc4c
mov rdx, rdi
call fcn.14005db28
and byte [rbx + 0x30], 0xfe
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret